@3sln/trove 0.0.2

package/packages/plugin-sdk/src/browser.js

@@ -0,0 +1,316 @@
+// Injectable browser build of the Trove plugin SDK — a single self-contained IIFE
+// with NO imports, so the host can inline it into a sandboxed iframe's srcdoc
+// alongside the plugin's entry script. The iframe runs on an opaque origin
+// (sandbox="allow-scripts", no allow-same-origin), so it can't fetch its own
+// package files; instead it reaches everything — resources, files, settings,
+// storage — through the host over a transferred MessagePort. Package resources
+// are handed back as raw bytes (or iframe-local blob: URLs), never host URLs, so
+// the plugin only ever holds opaque handles.
+//
+// Plugins use it as:  trove.activate(async (ctx) => { ... })
+(function () {
+  'use strict';
+  // Wire-protocol version this SDK speaks. MUST equal PROTOCOL_VERSION in
+  // protocol.js — this file is injected as text and cannot import it, so
+  // protocol.test.js asserts the two stay in step.
+  const SDK_PROTOCOL_VERSION = '1.0';
+  let port = null, manifest = null, capabilities = [], storageScopes = {}, online = true, seq = 0, role = 'primary';
+  const pending = new Map();
+  const commandHandlers = new Map();
+  const openerHandlers = new Map();
+  let onConnectivity = null, onDeactivate = null, onSettingsChange = null, onDock = null;
+  const mediaHandlers = {}; // action -> handler, for OS media-session controls
+
+  const now = () => { try { return Date.now(); } catch { return 0; } };
+
+  // The HOST times its own calls out; this side did not, and `pending` was never
+  // rejected — not on a dropped reply, not on port close. A plugin awaiting one hung
+  // forever with no way to find out, and the entry leaked with it.
+  const CALL_TIMEOUT_MS = 30_000;
+
+  function call(method, params, transfer) {
+    const id = ++seq;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject(new Error(`Timed out waiting for the host to answer "${method}"`));
+      }, CALL_TIMEOUT_MS);
+      if (timer && timer.unref) timer.unref();
+      pending.set(id, { resolve, reject, timer });
+      port.postMessage({ __trove: 'req', id, method, params }, transfer || []);
+    });
+  }
+  const emit = (method, params) => port.postMessage({ __trove: 'event', method, params });
+
+  // What this frame reports about itself on every heartbeat. Contributions are the
+  // host's own manifest reading — all the plugin can usefully say is which of its
+  // declared contributions it actually bound a handler to, plus whether it thinks
+  // it's online.
+  function buildManifest() {
+    return {
+      domain: manifest && manifest.domain, name: manifest && manifest.name,
+      online, role, ts: now(),
+      handlers: [...commandHandlers.keys()],
+    };
+  }
+  const announce = () => port && emit('manifest', buildManifest());
+
+  function onPort(e) {
+    const m = e.data;
+    if (!m || m.__trove == null) return;
+    if (m.__trove === 'res') {
+      const p = pending.get(m.id);
+      if (!p) return;
+      clearTimeout(p.timer);
+      pending.delete(m.id);
+      m.error ? p.reject(Object.assign(new Error(m.error.message), m.error)) : p.resolve(m.result);
+    } else if (m.__trove === 'req') {
+      Promise.resolve().then(() => dispatch(m.method, m.params))
+        .then((result) => port.postMessage({ __trove: 'res', id: m.id, result }))
+        .catch((err) => port.postMessage({ __trove: 'res', id: m.id, error: { message: err.message } }));
+    } else if (m.__trove === 'event') {
+      dispatchEvent(m.method, m.params);
+    }
+  }
+
+  function dispatch(method, params) {
+    if (method === 'command:execute') {
+      const h = commandHandlers.get(params.id);
+      // Throw, like `opener:open` two lines down. Resolving `undefined` for an id with
+      // no handler told the host the command had RUN when nothing had.
+      if (!h) throw new Error(`No handler registered for command "${params.id}"`);
+      return h(...(params.args || []));
+    }
+    if (method === 'opener:open') {
+      // An opener frame boots at that opener's entry module and runs exactly one
+      // opener, so an unkeyed onOpen(fn) handler is the normal case.
+      const f = openerHandlers.get(params.openerId) || openerHandlers.get('*');
+      if (!f) throw new Error('no opener ' + params.openerId);
+      return f(params.file, params.context);
+    }
+    if (method === 'manifest') return buildManifest();
+    throw new Error('Unknown host call ' + method);
+  }
+  async function dispatchEvent(method, params) {
+    if (method === 'deactivate') return onDeactivate && onDeactivate();
+    if (method === 'connectivity') { online = !!params.online; try { onConnectivity && (await onConnectivity({ online })); } catch (e) { console.error(e); } announce(); }
+    if (method === 'settings:changed') { try { onSettingsChange && onSettingsChange(params.key, params.value); } catch (e) { console.error(e); } }
+    // The OS/host fired a media transport control (play/pause/next/seek…).
+    if (method === 'media:action') { try { mediaHandlers[params.action] && mediaHandlers[params.action](params); } catch (e) { console.error(e); } }
+    // The host docked or undocked this viewer (see ctx.dock).
+    if (method === 'dock:state') { try { onDock && onDock(params); } catch (e) { console.error(e); } }
+  }
+
+  function requireCap(cap) { if (!capabilities.includes(cap)) throw new Error('Plugin lacks capability "' + cap + '"'); }
+
+  // Storage: one async SQL handle (mirrors the host SqliteDatabase interface) per
+  // scope+side, over RPC. Only granted scopes are exposed on ctx.storage.
+  function sqlHandle(scope, side) {
+    var send = function (op, extra) { return call('storage:sql', Object.assign({ scope: scope, side: side, op: op }, extra)); };
+    return {
+      exec: function (sql) { return send('exec', { sql: sql }); },
+      run: function (sql) { return send('run', { sql: sql, params: [].slice.call(arguments, 1) }); },
+      get: function (sql) { return send('get', { sql: sql, params: [].slice.call(arguments, 1) }); },
+      all: function (sql) { return send('all', { sql: sql, params: [].slice.call(arguments, 1) }); },
+      batch: function (statements) { return send('batch', { statements: statements }); },
+    };
+  }
+  function scopeHandle(scope) {
+    return { server: sqlHandle(scope, 'server'), client: sqlHandle(scope, 'client') };
+  }
+  function makeStorage() {
+    var s = {};
+    if (storageScopes.plugin) s.plugin = scopeHandle('plugin');
+    if (storageScopes.domain) s.domain = scopeHandle('domain');
+    return s;
+  }
+
+  function hasHeader(h, name) { name = name.toLowerCase(); for (var k in h) if (k.toLowerCase() === name) return true; return false; }
+  // Wrap the host's brokered-fetch result in a minimal Response-like object.
+  function makeResponse(r) {
+    var bytes = new Uint8Array(r.bytes || new ArrayBuffer(0));
+    var decode = function () { return new TextDecoder().decode(bytes); };
+    return {
+      ok: r.ok, status: r.status, statusText: r.statusText, url: r.url, headers: r.headers || {},
+      arrayBuffer: function () { return Promise.resolve(bytes.slice().buffer); },
+      bytes: function () { return Promise.resolve(bytes); },
+      text: function () { return Promise.resolve(decode()); },
+      json: function () { return Promise.resolve(JSON.parse(decode())); },
+    };
+  }
+
+  function makeContext() {
+    return {
+      manifest, capabilities,
+      // Which instance this is: 'primary' is the plugin's single background frame
+      // (register commands/indexers, do one-time setup here); 'viewer' is a
+      // per-open frame hosting an opener for one file (drive media/dock from here).
+      role,
+      get online() { return online; },
+      // Contributions are DECLARED IN THE MANIFEST (openers, indexers, commands,
+      // statusItems, keybindings). The host registers them before this code runs, so
+      // a plugin never registers anything at runtime — it only supplies the behaviour
+      // for what it declared, addressed by id.
+      commands: {
+        /** Implement a command this plugin's manifest declares, by its short name. */
+        handle(name, handler) { commandHandlers.set(name, handler); return this; },
+        /**
+         * Run a command. Its OWN commands by short name; anyone else's by full address
+         * (a built-in like 'explorer.download', or a `trove+contrib:` URI) — and only
+         * if the manifest's `commands` capability lists it.
+         */
+        execute(id) { const a = [].slice.call(arguments, 1); return call('command:execute', { id, args: a }); },
+      },
+      /** Implement the opener this frame was booted for (its entry module). The id is
+       *  optional — an opener frame runs exactly one opener. */
+      onOpen(idOrHandler, maybeHandler) {
+        const [id, handler] = typeof idOrHandler === 'function' ? ['*', idOrHandler] : [idOrHandler, maybeHandler];
+        openerHandlers.set(id, handler);
+        return this;
+      },
+      // NOTE: there is no onIndex(). Indexers run on the SERVER (in its isolate
+      // runtime), not in this sandbox — indexing has to happen once per upload for the
+      // drive, not in whichever tab is open. An indexer's entry module is plain ESM
+      // exporting `index(node, ctx)`; it doesn't use this SDK at all. What a plugin can
+      // do from here is PUSH contributions for a node via ctx.files.index (the
+      // `indexer` capability).
+      // Package resources — opaque handles. read() copies bytes into the iframe;
+      // url() wraps them in an iframe-local blob: URL.
+      resources: {
+        list() { return call('resources:list', {}); },
+        async read(path) { const r = await call('resources:read', { path }); return new Uint8Array(r.bytes); },
+        async text(path) { return new TextDecoder().decode(await this.read(path)); },
+        async url(path, type) {
+          const bytes = await this.read(path);
+          return URL.createObjectURL(new Blob([bytes], { type: type || 'application/octet-stream' }));
+        },
+      },
+      ui: {
+        toast: (text, opts) => emit('ui:toast', Object.assign({ text }, opts)),
+        showPanel: () => call('ui:showPanel', {}),
+        setBadge: (text) => emit('ui:badge', { text }),
+        /**
+         * Drive a status-bar slot this plugin's manifest declares. `html` is sanitized
+         * by the host down to a small inline-formatting allowlist before it renders.
+         *   ctx.ui.status('sync').set('<b>3</b> queued')
+         *   ctx.ui.status('sync').hide()
+         */
+        status(name) {
+          return {
+            set: (html, opts) => call('ui:status', Object.assign({ name, html, visible: true }, opts || {})),
+            show: () => call('ui:status', { name, visible: true }),
+            hide: () => call('ui:status', { name, visible: false }),
+          };
+        },
+      },
+      /**
+       * Registers — context value slots this plugin's manifest declares, which
+       * when-clauses (its own keymap's, its commands') read by contribution URI.
+       *   ctx.registers.set('busy', true)
+       */
+      registers: {
+        set: (name, value) => call('context:setRegister', { name, value }),
+      },
+      // Media session — surfaces this viewer's playback to the OS (lock-screen /
+      // notification transport controls, so phones can play/pause/seek). The host
+      // owns navigator.mediaSession; action handlers are called back over RPC.
+      media: {
+        setMetadata: (m) => (requireCap('media'), call('media:metadata', m || {})),
+        setPlaybackState: (state) => (requireCap('media'), call('media:playbackState', { state })),
+        setPositionState: (p) => (requireCap('media'), call('media:position', p || {})),
+        setActionHandler: (action, handler) => { requireCap('media'); if (handler) mediaHandlers[action] = handler; else delete mediaHandlers[action]; return call('media:action', { action, on: !!handler }); },
+        clear: () => call('media:clear', {}),
+      },
+      // Dock — register this viewer to persist as a small floating frame when the
+      // user navigates away (a docked video = picture-in-picture; docked audio = a
+      // mini transport). Enable while playing/active, disable otherwise. `minSize`/
+      // `maxSize` are {width,height} constraints. onDock is notified on (un)dock.
+      dock: {
+        enable: (opts) => (requireCap('dock'), call('dock:enable', opts || {})),
+        disable: () => (requireCap('dock'), call('dock:disable', {})),
+        close: () => call('dock:close', {}),
+        onChange: (fn) => { onDock = fn; },
+      },
+      // Network — there is no direct fetch in the sandbox; the host performs the
+      // request, but ONLY to endpoints declared in the manifest's `network` list
+      // (and only with the "network" capability). Returns a Response-like object.
+      net: {
+        fetch(url, opts) {
+          requireCap('network');
+          opts = opts || {};
+          var body = opts.body;
+          var headers = Object.assign({}, opts.headers);
+          if (body && typeof body === 'object' && !(body instanceof ArrayBuffer) && !(body instanceof Uint8Array)) {
+            body = JSON.stringify(body);
+            if (!hasHeader(headers, 'content-type')) headers['Content-Type'] = 'application/json';
+          }
+          // `.buffer` ignores byteOffset/byteLength, so any view produced by `subarray` or
+    // `slice` — or a view into a pooled buffer — sent the WHOLE backing store: the wrong
+    // payload, and an out-of-band leak of whatever else was in it.
+    if (ArrayBuffer.isView(body)) {
+      body = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
+    }
+          return call('net:fetch', { url: String(url), method: opts.method || 'GET', headers: headers, body: body })
+            .then(makeResponse);
+        },
+      },
+      files: {
+        read: (id, opts) => (requireCap('files'), call('files:read', Object.assign({ id }, opts))),
+        list: (pathOrId, opts) => (requireCap('files'), call('files:list', Object.assign({ pathOrId }, opts))),
+        stat: (id) => (requireCap('files'), call('files:stat', { id })),
+        downloadUrl: (id) => (requireCap('files'), call('files:downloadUrl', { id })),
+        // index(indexerId, nodeId, contribution) where contribution is
+        // { semanticTexts?, tags?, metadata? }. Legacy (indexerId, nodeId, documents[], facet)
+        // is still accepted when the 3rd arg is an array of documents.
+        index: (indexerId, nodeId, contribution, facet) => {
+          requireCap('indexer');
+          var payload = Array.isArray(contribution) ? { documents: contribution, facet: facet } : (contribution || {});
+          return call('files:index', Object.assign({ indexerId: indexerId, nodeId: nodeId }, payload));
+        },
+      },
+      // Persistent storage: an isolated SQLite database per granted scope. `plugin`
+      // is private to this plugin; `domain` (verified packages only) is shared with
+      // the vendor's other plugins. Each scope exposes a `.server` handle (and, from
+      // Stage 3, an on-device `.client` handle) with the same async SQL surface.
+      storage: makeStorage(),
+      // The plugin's own settings (declared in the manifest). getSecret reads a
+      // secret-typed value the host stores separately.
+      settings: {
+        get: (key) => call('settings:get', { key }),
+        getSecret: (key) => call('settings:getSecret', { key }),
+        set: (key, value) => call('settings:set', { key, value }),
+        onChange: (fn) => { onSettingsChange = fn; },
+      },
+      onConnectivity: (fn) => { onConnectivity = fn; },
+      announce,
+      onDeactivate: (fn) => { onDeactivate = fn; },
+    };
+  }
+
+  async function activate(setup) {
+    await new Promise((resolve) => {
+      function onInit(e) {
+        if (!e.data || e.data.__trove !== 'init') return;
+        window.removeEventListener('message', onInit);
+        manifest = e.data.manifest; capabilities = e.data.capabilities || []; storageScopes = e.data.storage || {}; online = e.data.online != null ? e.data.online : true; role = e.data.role || 'primary';
+        port = e.ports[0];
+        port.onmessage = onPort;
+        resolve();
+      }
+      window.addEventListener('message', onInit);
+      parent.postMessage({ __trove: 'ready', protocolVersion: SDK_PROTOCOL_VERSION }, '*');
+    });
+    const ctx = makeContext();
+    try {
+      await setup(ctx);
+      await call('activated', { ok: true });
+      announce();
+    } catch (err) {
+      await call('activated', { ok: false, error: err && err.message });
+      throw err;
+    }
+    return ctx;
+  }
+
+  globalThis.trove = { activate };
+})();

package/packages/plugin-sdk/src/index.js

@@ -0,0 +1,32 @@
+// @3sln/trove/plugin-sdk — the ESM entry a plugin author imports when building or
+// bundling a plugin outside the sandbox:
+//
+//   import { activate } from '@3sln/trove/plugin-sdk';
+//   activate(async (ctx) => {
+//     ctx.commands.register('hello.world', () => ctx.ui.toast('Hi from a plugin!'));
+//   });
+//
+// Inside a running Trove sandbox the host injects the SAME implementation directly
+// (see ./browser.js) and exposes it as the global `trove`. To keep exactly one
+// source of truth — so what an author imports can never drift from what actually
+// runs — this module loads that implementation for its side effect and re-exports
+// its surface. Importing is side-effect-safe: it only DEFINES the SDK (and sets
+// `globalThis.trove`); nothing talks to the host until you call `activate()`.
+
+import './browser.js';
+
+const trove = globalThis.trove;
+
+/**
+ * Entry point — call once at the top of your plugin. The host hands your callback
+ * a capability-scoped `ctx` (commands, resources, files, db, settings, net, ui).
+ * @param {(ctx: object) => (void | Promise<void>)} setup
+ * @returns {Promise<object>} the activated context
+ */
+export const activate = trove.activate;
+
+export default trove;
+
+// The host-side RPC channel — used by the workbench that hosts plugins, not by
+// plugins themselves. Re-exported here for convenience/parity with the subpath.
+export { RpcChannel } from './rpc.js';

package/packages/plugin-sdk/src/protocol.js

@@ -0,0 +1,59 @@
+// The host ↔ plugin wire protocol, in one place.
+//
+// Envelope (over the transferred MessagePort):
+//   { __trove: 'req',   id, method, params }   plugin → host, expects a 'res'
+//   { __trove: 'res',   id, result | error }   host → plugin
+//   { __trove: 'event', method, params }       either direction, fire-and-forget
+// Bootstrap (over postMessage, before the port exists):
+//   { __trove: 'ready',      protocolVersion } plugin → host
+//   { __trove: 'init',       manifest, capabilities, storage, online, role, protocolVersion }
+//   { __trove: 'boot-error', error }           plugin → host (module load failed)
+//
+// NOTE: browser.js is injected into the sandboxed frame as a TEXT blob (it must be a
+// self-contained IIFE with no imports), so it cannot import this module. It declares
+// its own `SDK_PROTOCOL_VERSION` constant instead, and protocol.test.js asserts the
+// two stay equal — a drift guard in place of an import.
+
+/** Bumped MAJOR when a change breaks older plugins; MINOR for additive changes. */
+export const PROTOCOL_VERSION = '1.0';
+
+export function majorOf(version) {
+  return String(version || '').split('.')[0] || '0';
+}
+
+/** Whether a plugin built against `version` can talk to this host. */
+export function isCompatible(version) {
+  // An SDK older than versioning itself reports nothing — accept it (it predates the
+  // field and the protocol hasn't broken yet); a differing MAJOR is a hard mismatch.
+  if (!version) return true;
+  return majorOf(version) === majorOf(PROTOCOL_VERSION);
+}
+
+// There are no `contribute:*` methods: contributions are DECLARED IN THE MANIFEST and
+// registered by the host before the plugin boots. A plugin can only ever drive what it
+// declared (`ui:status`, `context:setRegister`), never add to it.
+
+/** Canonical host methods a plugin may call. Grouped by namespace. */
+export const METHODS = {
+  activated: 'activated',
+  // Note: 'command:execute' travels BOTH ways on the same channel — the host calls it
+  // to run a plugin-contributed command, and a plugin calls it (needs that command in
+  // its `commands` allowlist) to run someone else's. The direction disambiguates.
+  command: { execute: 'command:execute' },
+  resources: { list: 'resources:list', read: 'resources:read' },
+  files: { read: 'files:read', list: 'files:list', stat: 'files:stat', downloadUrl: 'files:downloadUrl', index: 'files:index' },
+  net: { fetch: 'net:fetch' },
+  storage: { sql: 'storage:sql' },
+  settings: { get: 'settings:get', set: 'settings:set', getSecret: 'settings:getSecret' },
+  ui: { showPanel: 'ui:showPanel', status: 'ui:status' },
+  context: { setRegister: 'context:setRegister' },
+  media: { metadata: 'media:metadata', playbackState: 'media:playbackState', position: 'media:position', action: 'media:action', clear: 'media:clear' },
+  dock: { enable: 'dock:enable', disable: 'dock:disable', close: 'dock:close' },
+};
+
+/** Events a plugin may emit to the host (fire-and-forget, no reply). */
+export const EVENTS = {
+  manifest: 'manifest',
+  uiToast: 'ui:toast',
+  uiBadge: 'ui:badge',
+};

package/packages/plugin-sdk/src/rpc.js

@@ -0,0 +1,95 @@
+// A minimal, symmetric JSON-RPC-ish channel over a MessagePort. Used on both
+// ends of the host↔plugin boundary: the host keeps one port, the sandboxed
+// iframe gets the other (transferred cross-origin at init), so neither side ever
+// touches the other's globals — everything is messages. Requests get a reply;
+// events are fire-and-forget. Handlers may be async and may throw; the error is
+// serialized (code/message) back to the caller as a rejected promise.
+
+export class RpcChannel {
+  /**
+   * @param {MessagePort|Window} port  a MessagePort (preferred) or window
+   * @param {object} [opts]
+   * @param {(method:string, params:any) => any} [opts.onCall] handler for incoming requests
+   * @param {(method:string, params:any) => void} [opts.onEvent] handler for incoming events
+   * @param {string} [opts.targetOrigin] required when port is a Window
+   */
+  constructor(port, opts = {}) {
+    this.port = port;
+    this.onCall = opts.onCall;
+    this.onEvent = opts.onEvent;
+    this.targetOrigin = opts.targetOrigin;
+    this.seq = 0;
+    this.pending = new Map();
+    this._listener = (e) => this._receive(e.data, e);
+    if (typeof port.addEventListener === 'function') port.addEventListener('message', this._listener);
+    else port.onmessage = this._listener;
+    port.start?.();
+  }
+
+  _post(msg, transfer) {
+    if (this.targetOrigin) this.port.postMessage(msg, this.targetOrigin, transfer);
+    else this.port.postMessage(msg, transfer);
+  }
+
+  /** Call a remote method, awaiting its result. */
+  call(method, params, { timeout = 30000, transfer } = {}) {
+    const id = ++this.seq;
+    return new Promise((resolve, reject) => {
+      const timer = timeout
+        ? setTimeout(() => {
+            this.pending.delete(id);
+            reject(new Error(`RPC timeout: ${method}`));
+          }, timeout)
+        : null;
+      this.pending.set(id, { resolve, reject, timer });
+      this._post({ __trove: 'req', id, method, params }, transfer);
+    });
+  }
+
+  /** Fire an event; no reply expected. */
+  emit(method, params, transfer) {
+    this._post({ __trove: 'event', method, params }, transfer);
+  }
+
+  async _receive(msg, event) {
+    if (!msg || msg.__trove == null) return;
+    if (msg.__trove === 'res') {
+      const p = this.pending.get(msg.id);
+      if (!p) return;
+      this.pending.delete(msg.id);
+      if (p.timer) clearTimeout(p.timer);
+      if (msg.error) p.reject(Object.assign(new Error(msg.error.message), msg.error));
+      else p.resolve(msg.result);
+      return;
+    }
+    if (msg.__trove === 'event') {
+      try {
+        await this.onEvent?.(msg.method, msg.params, event);
+      } catch (err) {
+        console.error('rpc event handler error', err);
+      }
+      return;
+    }
+    if (msg.__trove === 'req') {
+      let result, error;
+      try {
+        result = await this.onCall?.(msg.method, msg.params, event);
+      } catch (err) {
+        error = { message: err?.message || String(err), code: err?.code || 'error' };
+      }
+      this._post({ __trove: 'res', id: msg.id, result, error });
+    }
+  }
+
+  dispose() {
+    if (typeof this.port.removeEventListener === 'function') {
+      this.port.removeEventListener('message', this._listener);
+    }
+    for (const p of this.pending.values()) {
+      if (p.timer) clearTimeout(p.timer);
+      p.reject(new Error('RPC channel disposed'));
+    }
+    this.pending.clear();
+    this.port.close?.();
+  }
+}

package/packages/server/src/adapters/bun.js

@@ -0,0 +1,78 @@
+// Bun adapter — the production runtime. Bun speaks Web Request/Response natively,
+// so the server's `handle(request)` plugs straight into `Bun.serve` with no
+// req/res conversion. Static assets are served with `Bun.file` (SPA fallback), and
+// SQLite uses `bun:sqlite` (see core/sqlite-driver.js). The Node adapter
+// (adapters/node.js) stays as a fully compatible alternative.
+//
+//   TROVE_STORAGE=filesystem TROVE_FS_ROOT=./data/objects \
+//   TROVE_METADATA=sqlite TROVE_DB_PATH=./data/trove.db \
+//   bun packages/server/src/adapters/bun.js
+
+import { readFileSync } from 'node:fs';
+import { createServer, configFromEnv, warnOnOpenAccess } from '../index.js';
+import { findWebDist } from './webDist.js';
+import { createStaticAssets } from './staticAssets.js';
+
+// A JWKS held in a file rather than inlined in the environment: multi-line JSON is
+// awkward in env vars and shows up in `docker inspect`, while a mounted secret file
+// does not. Read here rather than in configFromEnv, which has to stay loadable on
+// Workers where there is no filesystem.
+if (process.env.TROVE_JWT_JWKS_FILE && !process.env.TROVE_JWT_JWKS) {
+  process.env.TROVE_JWT_JWKS = readFileSync(process.env.TROVE_JWT_JWKS_FILE, 'utf8');
+}
+
+
+// TROVE_-prefixed to match every other setting; bare PORT/HOST still work, since that
+// is what most platforms inject and breaking them would be gratuitous.
+const PORT = Number(process.env.TROVE_PORT || process.env.PORT || 8787);
+const HOST = process.env.TROVE_HOST || process.env.HOST || '0.0.0.0';
+
+// Built web assets, if the app has been built — see webDist.js for why this is a
+// resolution rather than a relative path.
+const { dir: WEB_DIST, source: WEB_DIST_SOURCE } = findWebDist();
+
+// Where to look, what to refuse and what to say about caching is shared with the Node
+// adapter — see staticAssets.js. All that differs here is how a file is read.
+const staticAssets = WEB_DIST && createStaticAssets({
+  dir: WEB_DIST,
+  read: async (filePath) => {
+    const file = Bun.file(filePath);
+    if (!(await file.exists())) return null;
+    return { size: file.size, mtime: file.lastModified, type: file.type, open: () => file };
+  },
+});
+
+const hasWeb = !!WEB_DIST;
+const envConfig = configFromEnv();
+warnOnOpenAccess(envConfig);
+const { handle, close } = await createServer({
+  ...envConfig,
+  assets: hasWeb ? staticAssets : undefined,
+});
+
+const server = Bun.serve({
+  port: PORT,
+  hostname: HOST,
+  async fetch(req) {
+    return (await handle(req)) ?? new Response('Not found', { status: 404 });
+  },
+  error(err) {
+    console.error('server error', err);
+    return new Response('Internal error', { status: 500 });
+  },
+});
+
+console.log(`Trove server (Bun) on http://${HOST}:${PORT}  (web assets: ${hasWeb ? WEB_DIST : `none — ${WEB_DIST_SOURCE}; run npm run build:web`})`);
+
+// Graceful shutdown: stop serving, then flush notifications, dispose the sidecar,
+// and close SQLite cleanly so a redeploy doesn't lose in-flight work.
+let shuttingDown = false;
+async function shutdown(signal) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  console.log(`Trove shutting down (${signal})…`);
+  try { server.stop(); } catch { /* ignore */ }
+  try { await close(); } catch (err) { console.error('shutdown error', err); }
+  process.exit(0);
+}
+for (const sig of ['SIGTERM', 'SIGINT']) process.on(sig, () => shutdown(sig));