@1agh/maude 0.22.2 → 0.23.0

package/cli/commands/design-link.test.mjs

@@ -6,7 +6,7 @@
 
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { createServer } from 'node:http';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
@@ -205,3 +205,55 @@ test('status --json emits structured payload', async () => {
   assert.equal(payload.sync.agent, 'not-implemented');
   cleanup();
 });
+
+// --------------------------------------------------- DDR-054 F2/F4 trust gate
+
+const REMOTE_URL = 'http://hub.invalid:9999'; // .invalid never resolves (RFC 6761)
+
+test('linking a non-loopback hub without --yes (non-TTY) refuses', async () => {
+  // The spawned child has no TTY on stdin, so the gate must refuse rather
+  // than silently link a remote hub in a script.
+  const res = await runCli(['design', 'link', REMOTE_URL, '--token', 'mau_x', '--force']);
+  assert.equal(res.status, 1);
+  assert.match(res.stderr, /requires confirmation/);
+  // No link written.
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub, undefined);
+  cleanup();
+});
+
+test('linking a non-loopback hub with --yes records trust + links', async () => {
+  const res = await runCli(['design', 'link', REMOTE_URL, '--token', 'mau_x', '--yes', '--force']);
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stderr, /confirmed via --yes/);
+  assert.match(res.stderr, /experimental v1\.1 preview/); // F3 banner
+
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub.url, REMOTE_URL);
+
+  // Trust is recorded PER-MACHINE (hubs.json), never in a committable repo file.
+  const hubs = JSON.parse(readFileSync(hubsConfigPath, 'utf8'));
+  assert.ok(hubs.trusted.includes(REMOTE_URL), 'hub should be trusted on this machine');
+  assert.equal(
+    existsSync(join(workspace, '.maude/trusted-hubs')),
+    false,
+    'no committable trust file'
+  );
+
+  // Re-linking the now-trusted hub no longer needs --yes.
+  const second = await runCli(['design', 'link', REMOTE_URL, '--token', 'mau_y', '--force']);
+  assert.equal(second.status, 0, second.stderr);
+  cleanup();
+});
+
+test('--adopt against a non-loopback hub lists the upload manifest in the gate', async () => {
+  writeFileSync(join(workspace, '.design/screen.html'), '<button>hi</button>', 'utf8');
+  const res = await runCli(['design', 'adopt', REMOTE_URL, '--token', 'mau_x', '--yes', '--force']);
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stderr, /will UPLOAD 1 local file/);
+  assert.match(res.stderr, /\.design\/screen\.html/);
+
+  const hubs = JSON.parse(readFileSync(hubsConfigPath, 'utf8'));
+  assert.equal(typeof hubs.hubs[REMOTE_URL].adoptedAt, 'number'); // F4 attestation
+  cleanup();
+});

package/cli/commands/hub.test.mjs

@@ -3,12 +3,14 @@
 
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
 
+import { readTokens } from '../../plugins/design/hub/src/tokens.mjs';
+
 const BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'maude.mjs');
 
 function runCli(args, { cwd } = {}) {
@@ -40,7 +42,7 @@ test('hub token generate without --label exits 2', () => {
   assert.match(res.stderr, /--label <name> is required/);
 });
 
-test('hub token generate writes tokens.json + prints the connect command', () => {
+test('hub token generate persists to the store + prints the connect command', () => {
   withDataDir((dataDir) => {
     const res = runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
     assert.equal(res.status, 0, res.stderr);
@@ -48,11 +50,11 @@ test('hub token generate writes tokens.json + prints the connect command', () =>
     assert.match(res.stdout, /value:\s+mau_[0-9a-f]{32}/);
     assert.match(res.stdout, /maude design link/);
 
-    const raw = readFileSync(join(dataDir, 'tokens.json'), 'utf8');
-    const parsed = JSON.parse(raw);
-    assert.equal(parsed.tokens.length, 1);
-    assert.equal(parsed.tokens[0].label, 'alice');
-    assert.match(parsed.tokens[0].value, /^mau_[0-9a-f]{32}$/);
+    const { tokens } = readTokens(dataDir);
+    assert.equal(tokens.length, 1);
+    assert.equal(tokens[0].label, 'alice');
+    // The raw value is never persisted — only labels/metadata are listable.
+    assert.equal(tokens[0].value, undefined);
   });
 });
 
@@ -61,8 +63,7 @@ test('hub token generate --label is idempotent (overwrites in place)', () => {
     runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
     runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
 
-    const parsed = JSON.parse(readFileSync(join(dataDir, 'tokens.json'), 'utf8'));
-    assert.equal(parsed.tokens.length, 1);
+    assert.equal(readTokens(dataDir).tokens.length, 1);
   });
 });
 

package/cli/lib/design-link.mjs

@@ -10,19 +10,21 @@
 //
 // Token NEVER lands in .design/config.json — that's git-committed.
 
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
+import { createInterface } from 'node:readline';
 
 import { parseArgs } from './argv.mjs';
-import { addHub, getHub, normalizeUrl, removeHub } from './hubs-config.mjs';
+import { addHub, getHub, isHubTrusted, normalizeUrl, removeHub, trustHub } from './hubs-config.mjs';
 
 const DESIGN_CONFIG_PATH = '.design/config.json';
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
 
 // ---------------------------------------------------------------- link
 
 export async function runLink({ args, cwd = process.cwd(), forceAdopt = false }) {
   const tail = args.slice(args.indexOf(forceAdopt ? 'adopt' : 'link') + 1);
-  const { flags, positional } = parseArgs(tail, { booleans: ['adopt', 'force'] });
+  const { flags, positional } = parseArgs(tail, { booleans: ['adopt', 'force', 'yes'] });
   const url = positional[0];
   const token = flags.token;
 
@@ -52,6 +54,46 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
     process.exit(2);
   }
 
+  const cfg = readDesignConfig(designConfigPath);
+
+  // DDR-054 F2/F4: linking to a non-loopback hub grants a remote actor the same
+  // write access to .design/ as the local user (hub-pushed content lands on
+  // disk verbatim, like `git pull` from a stranger). Require explicit trust for
+  // a new remote hub. Trust is checked PER-MACHINE (`isHubTrusted`), never from
+  // a committable repo file — a committed allowlist (or the committed
+  // `linkedHub.url` itself) would let a malicious PR pre-seed trust and bypass
+  // this gate (trust laundering). Loopback dev hubs are exempt.
+  const loopback = isLoopbackUrl(normUrl);
+  const alreadyTrusted = loopback || isHubTrusted(normUrl);
+  const manifest = adopt ? collectAdoptManifest(cwd) : [];
+
+  if (!alreadyTrusted) {
+    process.stderr.write(trustGateText(normUrl, adopt, manifest));
+    if (flags.yes) {
+      process.stderr.write('  → confirmed via --yes\n');
+    } else if (process.stdin.isTTY) {
+      const question = adopt
+        ? `Link this repo to ${normUrl} AND push local design state up to it? [y/N] `
+        : `Link this repo to ${normUrl}? [y/N] `;
+      const ok = await promptYesNo(question);
+      if (!ok) {
+        process.stderr.write('maude design link: aborted — hub not trusted.\n');
+        process.exit(1);
+      }
+    } else {
+      process.stderr.write(
+        `maude design link: linking to a non-local hub (${normUrl}) requires confirmation.\n  Re-run in an interactive terminal, or pass --yes to confirm non-interactively.\n`
+      );
+      process.exit(1);
+    }
+    // NOTE: trust is recorded AFTER the link succeeds (below), not here — an
+    // aborted link (probe fail without --force, config write throws) must not
+    // leave a persisted trust that silently skips the gate on a later re-link.
+  } else if (adopt && manifest.length > 0) {
+    // Trusted (e.g. localhost) adopt — surface the manifest informationally.
+    process.stdout.write(adoptManifestText(normUrl, manifest));
+  }
+
   // Reachability probe — best-effort. Hub auth happens on WS upgrade (Task 4),
   // so a successful /health response only tells us the hub is up + reachable.
   // Token validity is verified when the sync agent connects for real.
@@ -63,11 +105,10 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
     process.exit(1);
   }
 
-  // Write hub side: tokens.json next to the user's other config.
-  const hubRecord = addHub(normUrl, token);
+  // Write hub side: token (+ adopt attestation) in ~/.config/maude/hubs.json.
+  const hubRecord = addHub(normUrl, token, adopt ? { adoptedAt: Date.now() } : {});
 
   // Write project side: linkedHub field on .design/config.json.
-  const cfg = readDesignConfig(designConfigPath);
   const existing = cfg.linkedHub;
   if (existing && !flags.force) {
     process.stdout.write(
@@ -81,9 +122,15 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
   };
   writeDesignConfig(designConfigPath, cfg);
 
+  // Record per-machine trust only now that the link fully succeeded, so a
+  // later re-link to this hub won't re-prompt. Skipped for loopback + hubs
+  // already trusted on this machine.
+  if (!alreadyTrusted) trustHub(normUrl);
+
   process.stdout.write(
-    `[design link] linked ${cwd} to ${normUrl}.\n  token:   stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:  .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''} }\n  hub:     ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n  (Sync agent lands in Phase 9 Task 4.)\n`
+    `[design link] linked ${cwd} to ${normUrl}.\n  token:   stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:  .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''} }\n  hub:     ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n`
   );
+  if (!loopback) process.stderr.write(linkedModeBanner());
 }
 
 // ---------------------------------------------------------------- adopt
@@ -214,3 +261,103 @@ async function probeHealth(url) {
     return { ok: false, error: err.message };
   }
 }
+
+// ----------------------------------------------------- trust gate (DDR-054 F2/F4)
+
+/** True when the hub URL points at the local machine (no remote-write risk). */
+function isLoopbackUrl(normUrl) {
+  try {
+    return LOOPBACK_HOSTS.has(new URL(normUrl).hostname);
+  } catch {
+    return false;
+  }
+}
+
+/** Promise-resolving [y/N] prompt. Prompt + echo go to stderr (stdout is data). */
+function promptYesNo(question) {
+  return new Promise((res) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    rl.question(question, (answer) => {
+      rl.close();
+      res(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+
+/**
+ * Files `--adopt` would push up to the hub: top-level canvases + annotation
+ * SVGs + comment JSON snapshots (the git-tracked sync surface per Task 9).
+ */
+function collectAdoptManifest(cwd) {
+  const base = resolve(cwd, '.design');
+  const files = [];
+  try {
+    for (const f of readdirSync(base)) {
+      if (f.endsWith('.html') || f.endsWith('.annotations.svg')) {
+        try {
+          files.push({ rel: `.design/${f}`, bytes: statSync(resolve(base, f)).size });
+        } catch {
+          /* skip unreadable */
+        }
+      }
+    }
+  } catch {
+    /* no .design — manifest stays empty */
+  }
+  const commentsDir = resolve(base, '_comments');
+  try {
+    for (const f of readdirSync(commentsDir)) {
+      if (!f.endsWith('.json')) continue;
+      try {
+        files.push({
+          rel: `.design/_comments/${f}`,
+          bytes: statSync(resolve(commentsDir, f)).size,
+        });
+      } catch {
+        /* skip unreadable */
+      }
+    }
+  } catch {
+    /* no comments dir */
+  }
+  return files;
+}
+
+function adoptManifestText(normUrl, manifest) {
+  const lines = manifest.map((f) => `    ${f.rel} (${f.bytes} B)`).join('\n');
+  return `[design link] --adopt will push ${manifest.length} local file(s) up to ${normUrl}:\n${lines}\n`;
+}
+
+function trustGateText(normUrl, adopt, manifest) {
+  let url;
+  try {
+    url = new URL(normUrl);
+  } catch {
+    url = { protocol: '?', hostname: normUrl };
+  }
+  const scheme = `${url.protocol.replace(':', '')}${url.protocol === 'http:' ? ' (NOT encrypted — token + edits travel in cleartext)' : ''}`;
+  let out = `
+⚠ Linking to a NON-LOCAL hub.
+    URL:    ${normUrl}
+    scheme: ${scheme}
+    host:   ${url.hostname}
+  A linked hub can write to your .design/ files (treat like \`git pull\` from a stranger).
+  Only link to hubs you operate or fully trust. See DDR-054 for the trust model.
+`;
+  if (adopt) {
+    const list = manifest.map((f) => `    ${f.rel} (${f.bytes} B)`).join('\n');
+    out +=
+      manifest.length > 0
+        ? `\n  --adopt will UPLOAD ${manifest.length} local file(s) to this hub:\n${list}\n`
+        : '\n  --adopt is set but no local canvases/comments/annotations were found to upload.\n';
+  }
+  return out;
+}
+
+function linkedModeBanner() {
+  return `
+⚠ Linked mode is an experimental v1.1 preview. Hub-pushed content is written
+  to your .design/ files as untrusted input. Only link to hubs you operate or
+  fully trust. See DDR-054 for the trust model.
+`;
+}

package/cli/lib/hubs-config.mjs

@@ -12,8 +12,15 @@
 //         "linkedAt": 1716800000000
 //       },
 //       ...
-//     }
+//     },
+//     "trusted": ["https://maude-hub-foo.fly.dev", ...]
 //   }
+//
+// `trusted` is the per-machine trust allowlist for non-loopback hubs (the
+// `maude design link` confirmation, DDR-054 F2). It lives here — NOT in a
+// committable repo file — on purpose: a committable allowlist would let an
+// attacker pre-seed trust via a PR and bypass the link-time confirmation
+// (trust laundering). Trust is a per-machine decision, like `~/.ssh/known_hosts`.
 
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -68,11 +75,20 @@ export function saveHubsConfig(config) {
   }
 }
 
-/** Upsert a hub entry. Same URL replaces the existing record. */
-export function addHub(url, token) {
+/**
+ * Upsert a hub entry. Same URL replaces the existing record. `extra` merges
+ * additional per-machine attestations (e.g. `adoptedAt` — the timestamp this
+ * machine pushed its local state up via `--adopt`, used by the sync runtime to
+ * avoid re-adopting; DDR-054 F4).
+ *
+ * @param {string} url
+ * @param {string} token
+ * @param {{ adoptedAt?: number }} [extra]
+ */
+export function addHub(url, token, extra = {}) {
   const norm = normalizeUrl(url);
   const cfg = loadHubsConfig();
-  cfg.hubs[norm] = { token, linkedAt: Date.now() };
+  cfg.hubs[norm] = { token, linkedAt: Date.now(), ...extra };
   saveHubsConfig(cfg);
   return cfg.hubs[norm];
 }
@@ -98,6 +114,28 @@ export function getHub(url) {
   return cfg.hubs[norm] ?? null;
 }
 
+/**
+ * Per-machine trust check for a non-loopback hub (DDR-054 F2). Trust is stored
+ * here, not in a committable repo file, so a malicious PR cannot pre-seed it.
+ */
+export function isHubTrusted(url) {
+  const norm = normalizeUrl(url);
+  const cfg = loadHubsConfig();
+  return Array.isArray(cfg.trusted) && cfg.trusted.includes(norm);
+}
+
+/** Record a hub as trusted on THIS machine. Idempotent. */
+export function trustHub(url) {
+  const norm = normalizeUrl(url);
+  const cfg = loadHubsConfig();
+  if (!Array.isArray(cfg.trusted)) cfg.trusted = [];
+  if (!cfg.trusted.includes(norm)) {
+    cfg.trusted.push(norm);
+    saveHubsConfig(cfg);
+  }
+  return norm;
+}
+
 /**
  * Normalize a hub URL so different spellings resolve to the same key:
  * - Trim trailing slash.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.22.2",
+  "version": "0.23.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -41,13 +41,13 @@
     "prepublishOnly": "bash scripts/check-version-parity.sh && bash plugins/design/dev-server/bin/check-runtime-bundles.sh"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.22.2",
-    "@1agh/maude-darwin-x64": "0.22.2",
-    "@1agh/maude-linux-arm64": "0.22.2",
-    "@1agh/maude-linux-arm64-musl": "0.22.2",
-    "@1agh/maude-linux-x64": "0.22.2",
-    "@1agh/maude-linux-x64-musl": "0.22.2",
-    "@1agh/maude-win32-x64": "0.22.2"
+    "@1agh/maude-darwin-arm64": "0.23.0",
+    "@1agh/maude-darwin-x64": "0.23.0",
+    "@1agh/maude-linux-arm64": "0.23.0",
+    "@1agh/maude-linux-arm64-musl": "0.23.0",
+    "@1agh/maude-linux-x64": "0.23.0",
+    "@1agh/maude-linux-x64-musl": "0.23.0",
+    "@1agh/maude-win32-x64": "0.23.0"
   },
   "files": [
     "cli",

package/plugins/design/dev-server/build.ts

@@ -114,6 +114,58 @@ async function buildClient(): Promise<{ outBytes: number; outPath: string }> {
   return { outBytes: out.size, outPath };
 }
 
+// ---------- (a.5) Comment mount layer (shell-owned comments) ----------
+//
+// canvas-comment-mount.tsx → dist/comment-mount.js. Loaded by _shell.html via
+// a `<script type="module">`; its `mountCanvas(...)` wraps any canvas default
+// export in the lite comment provider tree. React + the other canvas-runtime
+// packages are EXTERNAL (bare specifiers resolved by _shell.html's importmap)
+// so this bundle shares the single React/yjs singletons with the canvas
+// module — inlining a second React would break hooks ("invalid hook call").
+
+const COMMENT_MOUNT_EXTERNALS = [
+  'react',
+  'react-dom',
+  'react-dom/client',
+  'react/jsx-runtime',
+  'react/jsx-dev-runtime',
+  'yjs',
+  'y-protocols/sync',
+  'y-protocols/awareness',
+  'lib0/decoding',
+  'lib0/encoding',
+];
+
+async function buildCommentMount(): Promise<{ outBytes: number; outPath: string }> {
+  ensureDist();
+  const outPath = join(DIST, 'comment-mount.js');
+  const result = await Bun.build({
+    entrypoints: [join(ROOT, 'canvas-comment-mount.tsx')],
+    outdir: DIST,
+    target: 'browser',
+    format: 'esm',
+    naming: 'comment-mount.js',
+    external: COMMENT_MOUNT_EXTERNALS,
+    minify: MODE === 'release',
+    sourcemap: MODE === 'dev' ? 'inline' : 'none',
+    define: {
+      // ALWAYS production React — like canvas-build.ts. React is external and
+      // resolves through the importmap to the dev-server's PRODUCTION runtime
+      // bundles, where `react/jsx-dev-runtime`'s `jsxDEV` is a no-op (undefined
+      // at call time). Emitting dev jsx (`jsxDEV`) against a production runtime
+      // throws "jsxDEV is not a function". Both halves must agree on the JSX
+      // flavour — production jsx (`react/jsx-runtime`) is the contract.
+      'process.env.NODE_ENV': '"production"',
+    },
+  });
+  if (!result.success) {
+    const messages = result.logs.map((l) => l.message ?? String(l)).join('\n');
+    throw new Error(`Comment-mount build failed:\n${messages}`);
+  }
+  const out = Bun.file(outPath);
+  return { outBytes: out.size, outPath };
+}
+
 // ---------- (b) CSS bundle (Lightning CSS) ----------
 
 async function buildCss(): Promise<{ outBytes: number; outPath: string }> {
@@ -325,6 +377,7 @@ async function buildServerBinary(target: PlatformTarget): Promise<{ outPath: str
 
 async function watch() {
   await buildClient();
+  await buildCommentMount();
   await buildCss();
   console.log('[build:watch] initial build complete; watching client/ + server source...');
 
@@ -396,10 +449,16 @@ async function main() {
     `[build] client.bundle.js  ${client.outBytes.toLocaleString()} B  (${(t1 - t0).toFixed(0)} ms)`
   );
 
+  const commentMount = await buildCommentMount();
+  const t1b = performance.now();
+  console.log(
+    `[build] comment-mount.js  ${commentMount.outBytes.toLocaleString()} B  (${(t1b - t1).toFixed(0)} ms)`
+  );
+
   const css = await buildCss();
   const t2 = performance.now();
   console.log(
-    `[build] styles.css        ${css.outBytes.toLocaleString()} B  (${(t2 - t1).toFixed(0)} ms)`
+    `[build] styles.css        ${css.outBytes.toLocaleString()} B  (${(t2 - t1b).toFixed(0)} ms)`
   );
 
   // Pre-built runtime bundles — ship to disk so /_canvas-runtime/* never
@@ -415,7 +474,7 @@ async function main() {
   // on-disk artifacts against .min-sizes.json after the build.
   if (process.env.MAUDE_SKIP_RUNTIME_BUILD === '1') {
     console.log(
-      `[build] dist/runtime/*.js SKIPPED (MAUDE_SKIP_RUNTIME_BUILD=1 — using committed pre-built)`
+      '[build] dist/runtime/*.js SKIPPED (MAUDE_SKIP_RUNTIME_BUILD=1 — using committed pre-built)'
     );
   } else {
     const runtime = await buildRuntimeBundles();
@@ -444,4 +503,11 @@ if (import.meta.main) {
   await main();
 }
 
-export { buildClient, buildCss, buildServerBinary, PLATFORM_MATRIX, type PlatformTarget };
+export {
+  buildClient,
+  buildCommentMount,
+  buildCss,
+  buildServerBinary,
+  PLATFORM_MATRIX,
+  type PlatformTarget,
+};