@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.5",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT",
   "author": {

package/server/auth.ts

@@ -31,6 +31,10 @@ export type AuthenticateMsg = { password?: unknown }
 export type Auth = {
   // True iff the gate is configured AND this socket hasn't authenticated.
   requiresAuth(socket: WebSocket): boolean
+  // Static "is a server password configured" flag — the socket-less
+  // predicate the REST put-begin gate needs (a REST request can never be
+  // operator-authorized, so `requiresAuth` collapses to this there).
+  passwordConfigured: boolean
   handleAuthenticate(socket: WebSocket, msg: AuthenticateMsg): void
   sendUnauthorized(socket: WebSocket, ctx: UnauthorizedContext): void
 }
@@ -106,5 +110,5 @@ export function createAuth(deps: {
     send(socket, { type: 'authenticated' })
   }
 
-  return { requiresAuth, handleAuthenticate, sendUnauthorized }
+  return { requiresAuth, passwordConfigured: CONFIGURED_PASSWORD_HMAC != null, handleAuthenticate, sendUnauthorized }
 }

package/server/config.ts

@@ -18,6 +18,7 @@ export type Config = {
   dbPath: string
   objstoreDir: string
   reapIntervalMs: number
+  reapDisabled: boolean
   maxInflightPerSocket: number
   debug: boolean
   neonUrl: string | null
@@ -78,6 +79,13 @@ Environment:
                              DATABASE_URL + BLOB_READ_WRITE_TOKEN
                              are set (bytes live in Vercel Blob).
   OBJSTORE_REAP_INTERVAL_MS  orphan reaper period (default 600000)
+  OBJSTORE_REAP_DISABLED     set '1' / 'true' to disable the orphan
+                             reaper ENTIRELY — no boot sweep, no
+                             periodic GC. Orphaned/superseded blobs and
+                             stale staging rows then accumulate
+                             unbounded; only set this if an external job
+                             handles GC (e.g. a cron calling reapOrphans).
+                             Default OFF (reaper runs).
   TRUST_PROXY                set '1' / 'true' to honour X-Forwarded-
                              Host / X-Forwarded-Proto when computing
                              the same-origin gate's expected origin.
@@ -163,6 +171,11 @@ export function loadConfig(): Config {
   const objstoreDir = env['OBJSTORE_DIR'] ?? join(dirname(dbPath), 'objstore')
   // No practical upper bound beyond the safe-integer range.
   const reapIntervalMs = intEnv('OBJSTORE_REAP_INTERVAL_MS', 10 * 60 * 1000, 1, Number.MAX_SAFE_INTEGER)
+  // Hard off-switch for the orphan reaper (both the boot sweep AND the
+  // periodic timer). '1' / 'true' (case-insensitive) → disabled; anything
+  // else, including unset, leaves it ON. Same boolean shape as TRUST_PROXY.
+  const reapDisabledEnv = env['OBJSTORE_REAP_DISABLED']
+  const reapDisabled = reapDisabledEnv === '1' || reapDisabledEnv?.toLowerCase() === 'true'
   const debug = env['DEBUG'] === '1'
 
   const configPath = env['CONFIG_PATH'] ?? fileURLToPath(new URL('./config.json', import.meta.url))
@@ -189,7 +202,7 @@ export function loadConfig(): Config {
   const tokenSecret = tokenSecretB64 ? decodeTokenSecret(tokenSecretB64) : null
 
   return {
-    port, host, dbPath, objstoreDir, reapIntervalMs, maxInflightPerSocket,
+    port, host, dbPath, objstoreDir, reapIntervalMs, reapDisabled, maxInflightPerSocket,
     debug, neonUrl, blobToken, tokenSecret, password,
     trustProxyEnv: env['TRUST_PROXY'],
   }

package/server/http.ts

@@ -20,6 +20,12 @@ import { errStack } from './util.ts'
 // similar) can route `/api/*` → this process and `/*` → the static UI
 // bundle with a single location block.
 export const WS_UPGRADE_PATH = '/api/sync'
+// Session-independent triage-sync save plane: `POST /api/sync/save`. The
+// SSE-mode alternative to the in-band `workspace-save` frame — a save POSTed
+// here commits + broadcasts WITHOUT taking over the client's SSE event-stream
+// (each in-band POST forces a stream takeover; see sse-server.ts). Sibling of
+// the WS upgrade path so one nginx `/api/*` block routes both.
+export const SAVE_REST_PATH = '/api/sync/save'
 function isUpgradePath(url: string | undefined): boolean {
   if (typeof url !== 'string') return false
   // Strip `?…` so clients can carry build / debug tags. Exact match
@@ -42,12 +48,68 @@ export type HttpServerDeps = {
   isOriginAllowed: (req: HasHeaders) => boolean
   isShuttingDown: () => boolean
   track: (promise: Promise<unknown>) => void
+  // Handler for `POST /api/sync/save` (see SAVE_REST_PATH). Owns body parse +
+  // the save pipeline + JSON response; this module owns the gates (method,
+  // same-origin, shutdown, idle-timeout) and the graceful-drain tracking.
+  handleSaveRest: (req: HttpRequest, res: ServerResponse) => Promise<void>
   restPutIdleTimeoutMs: number
   debug: boolean
 }
 
+// `POST /api/sync/save` dispatch. Returns the in-flight handler promise when
+// the request matched the route (the caller `track`s it for graceful drain),
+// or null when it's for a different route. The gate ladder — method →
+// shutdown → same-origin → idle-timeout — mirrors the objstore REST branch; a
+// gate rejection writes its own response and returns an already-settled
+// promise. Kept out of `createHttpServer` so that dispatcher stays compact.
+function dispatchSaveRest(
+  req: HttpRequest, res: ServerResponse,
+  deps: {
+    handleSaveRest: (req: HttpRequest, res: ServerResponse) => Promise<void>
+    isOriginAllowed: (req: HasHeaders) => boolean
+    isShuttingDown: () => boolean
+    restPutIdleTimeoutMs: number
+    debug: boolean
+  },
+): Promise<void> | null {
+  if (typeof req.url !== 'string' || req.url.split('?', 1)[0] !== SAVE_REST_PATH) return null
+  if (req.method !== 'POST') {
+    res.writeHead(405, { 'content-type': 'application/json', 'allow': 'POST', 'connection': 'close' })
+    res.end(JSON.stringify({ error: 'method-not-allowed' }))
+    return Promise.resolve()
+  }
+  // Shutdown gate — parity with the objstore REST branch (a POST on an
+  // existing keep-alive socket after SIGTERM but before close() drains).
+  if (deps.isShuttingDown()) {
+    res.writeHead(503, { 'content-type': 'application/json', 'connection': 'close' })
+    res.end(JSON.stringify({ error: 'shutting-down' }))
+    return Promise.resolve()
+  }
+  // Same-origin gate — a hostile cross-origin page would carry an Origin
+  // header (browser-set on fetch); same-origin XHR may omit it (allowed).
+  if (!deps.isOriginAllowed(req)) {
+    res.writeHead(403, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ error: 'origin-denied' }))
+    return Promise.resolve()
+  }
+  // Idle-body timeout — a slow-loris trickling the JSON body would otherwise
+  // hold the connection indefinitely.
+  req.setTimeout(deps.restPutIdleTimeoutMs, () => {
+    if (deps.debug) console.warn(`sync-save REST idle ${deps.restPutIdleTimeoutMs}ms → abort`)
+    try { req.destroy(new Error('idle-timeout')) } catch {}
+  })
+  // Outer catch is the unhandled-rejection guard for a throw OUTSIDE the
+  // handler's own try/catch — logs and terminates the response so the TCP
+  // socket doesn't dangle (same policy as the objstore handleRest wrapper).
+  return deps.handleSaveRest(req, res).catch((err) => {
+    console.warn('sync-save REST handler error:', errStack(err))
+    if (res.headersSent) { try { res.destroy() } catch {} }
+    else { try { res.writeHead(500, { 'content-type': 'application/json' }); res.end(JSON.stringify({ error: 'internal' })) } catch {} }
+  })
+}
+
 export function createHttpServer(deps: HttpServerDeps): Server {
-  const { wss, restDeps, sseServer, isOriginAllowed, isShuttingDown, track, restPutIdleTimeoutMs, debug } = deps
+  const { wss, restDeps, sseServer, isOriginAllowed, isShuttingDown, track, handleSaveRest, restPutIdleTimeoutMs, debug } = deps
   // Static-file plane (see ./static.ts). The directory is the
   // `build.js build` output sibling to this file; the loader handles
   // enumeration, pre-compression, and ETag derivation. Plugged in after
@@ -76,6 +138,12 @@ export function createHttpServer(deps: HttpServerDeps): Server {
       // the lifecycle's sseSessions() close loop.
       if (sseServer.handle(req, res)) return
     }
+    // Triage-sync save REST plane (see SAVE_REST_PATH) — session-independent
+    // `POST /api/sync/save` so an SSE-mode save doesn't take over the
+    // event-stream. The dispatch helper owns the gate ladder; we `track` the
+    // returned in-flight promise so SIGTERM drains it (mirrors npm-advisories).
+    const saveP = dispatchSaveRest(req, res, { handleSaveRest, isOriginAllowed, isShuttingDown, restPutIdleTimeoutMs, debug })
+    if (saveP) { track(saveP); return }
     // npm advisories proxy — same-origin + shutdown gates live in the
     // helper so this dispatcher stays compact. `dispatchNpmAdvisories`
     // returns the in-flight promise (or null when the route didn't
@@ -109,14 +177,16 @@ export function createHttpServer(deps: HttpServerDeps): Server {
         res.end(JSON.stringify({ error: 'origin-denied' }))
         return
       }
-      // PUT idle-body timeout — a slow-loris client trickling bytes
-      // within the declared Content-Length holds the staging fd + an
-      // inFlightSids slot indefinitely. `req.setTimeout` fires on
-      // inactivity; we destroy the request, aborting the body pipeline.
+      // Idle-body timeout for the body-bearing REST methods — a slow-loris
+      // client trickling bytes holds the connection (and, for PUT, the
+      // staging fd + inFlightSids slot) indefinitely. PUT carries the raw
+      // blob within its declared Content-Length; POST carries the small
+      // fetch-mint JSON body. `req.setTimeout` fires on inactivity; we
+      // destroy the request, aborting the body pipeline.
       // Transport audit `server/objstore/rest.ts:218`.
-      if (req.method === 'PUT') {
+      if (req.method === 'PUT' || req.method === 'POST') {
         req.setTimeout(restPutIdleTimeoutMs, () => {
-          if (debug) console.warn(`REST PUT idle ${restPutIdleTimeoutMs}ms → abort`)
+          if (debug) console.warn(`REST ${req.method} idle ${restPutIdleTimeoutMs}ms → abort`)
           try { req.destroy(new Error('idle-timeout')) } catch {}
         })
       }

package/server/index.ts

@@ -102,7 +102,7 @@ import { createBusReceiver } from './bus-receiver.ts'
 const config = loadConfig()
 const {
   port: PORT, host: HOST, dbPath: DB_PATH, objstoreDir: OBJSTORE_DIR,
-  reapIntervalMs: OBJSTORE_REAP_INTERVAL_MS,
+  reapIntervalMs: OBJSTORE_REAP_INTERVAL_MS, reapDisabled: OBJSTORE_REAP_DISABLED,
   maxInflightPerSocket: MAX_INFLIGHT_PER_SOCKET, debug: DEBUG,
   neonUrl: NEON_URL, blobToken: BLOB_TOKEN, tokenSecret: TOKEN_SECRET,
   password: CONFIG_PASSWORD, trustProxyEnv: TRUST_PROXY_ENV,
@@ -275,7 +275,7 @@ if (NEON_URL) {
 // Password gate (see ./auth.ts) — HMAC derivation + the `authenticate`
 // handshake.
 const auth = createAuth({ peers, password: CONFIG_PASSWORD, send, debug: DEBUG })
-const { requiresAuth, handleAuthenticate, sendUnauthorized } = auth
+const { requiresAuth, passwordConfigured, handleAuthenticate, sendUnauthorized } = auth
 
 // Triage-sync protocol handlers (see ./sync-handlers.ts). `getNonce`
 // resolves a socket's challenge nonce and is shared with the objstore
@@ -292,9 +292,9 @@ const publishObjDeleted = (tag: string, resourceTag: string, version: number): v
   pubsub.publish({ kind: 'objdel', tag, res: resourceTag, ver: version })
 }
 
-const { handleSave, handleSubscribe, sendSaveError } = createSyncHandlers({
+const { handleSave, handleSaveRest, handleSubscribe, sendSaveError } = createSyncHandlers({
   handle, send, broadcast, publishRevision, subscribe, getNonce,
-  requiresAuth, sendUnauthorized, workspaceExists,
+  requiresAuth, passwordConfigured, sendUnauthorized, workspaceExists,
   // Folds the objstore inventory into the `workspace-subscribed` ack.
   // The objstore store keeps its own richer `Handle`, so we wire the
   // query here where both handles exist rather than coupling
@@ -305,6 +305,7 @@ const { handleSave, handleSubscribe, sendSaveError } = createSyncHandlers({
 
 const { handlers: objstore, restDeps: objstoreRestDeps, startupReap, stopReaper } = initObjstore({
   handle: objstoreHandle, reapIntervalMs: OBJSTORE_REAP_INTERVAL_MS,
+  reapDisabled: OBJSTORE_REAP_DISABLED,
   send, broadcast, publishObjPut, publishObjDeleted,
   getNonce, debug: DEBUG,
   // Auth gate for the FIRST objstore-put-begin against a workspace
@@ -315,6 +316,11 @@ const { handlers: objstore, restDeps: objstoreRestDeps, startupReap, stopReaper
   // `unauthorized` frame and bails on `true`.
   authGate: async (socket, tag) => requiresAuth(socket) && !await workspaceExists(tag),
   sendUnauthorized,
+  // Socket-less analog of `authGate` for the REST put-begin mint: a REST
+  // request can never be operator-authorized, so the gate collapses to
+  // "password configured AND workspace new". A deny routes the client to
+  // its in-band WS put-begin fallback.
+  restPutGate: async (tag) => passwordConfigured && !await workspaceExists(tag),
   // `tokenSecret` is set only when OBJSTORE_TOKEN_SECRET was
   // provided in env (see TOKEN_SECRET resolution above). Omitted
   // → initObjstore mints a fresh per-process secret (fine for
@@ -361,10 +367,6 @@ const sseServer = installSseServer({
   // Mirror the WS `maxPayload` so the SSE plane can't accept frames
   // the WS plane would reject.
   maxBodyBytes: 4 * 1024 * 1024,
-  // 90s idle ceiling. The client's JSON ping/pong is 15s; this is ~6
-  // missed pings before we close — well past any transient network
-  // hiccup, much shorter than the kernel's hours-long TCP keepalive.
-  sessionIdleMs: 90_000,
   debug: DEBUG,
 })
 
@@ -375,7 +377,7 @@ const sseServer = installSseServer({
 // below.
 const httpServer = createHttpServer({
   wss, restDeps: objstoreRestDeps, sseServer, isOriginAllowed,
-  isShuttingDown, track,
+  isShuttingDown, track, handleSaveRest,
   restPutIdleTimeoutMs: REST_PUT_IDLE_TIMEOUT_MS, debug: DEBUG,
 })
 
@@ -444,6 +446,7 @@ const closeDb = async (): Promise<void> => {
 installLifecycle({
   httpServer, wss, heartbeatTimer, stopReaper,
   sseSessions: sseServer.sessions,
+  sseKeepaliveTimer: sseServer.keepaliveTimer,
   closeDb,
 })
 

package/server/lifecycle.ts

@@ -14,6 +14,10 @@ export type ShutdownDeps = {
   httpServer: Server
   wss: WebSocketServer
   heartbeatTimer: ReturnType<typeof setInterval>
+  // The SSE keepalive-sweep timer (server/sse-server.ts). Cleared on
+  // shutdown alongside `heartbeatTimer` so a tick can't write a keepalive
+  // comment to a session the close loop below is already tearing down.
+  sseKeepaliveTimer: ReturnType<typeof setInterval>
   // Stops the periodic reaper AND awaits any in-flight sweep.
   stopReaper: () => Promise<void>
   // Live SSE+POST session iterator (mirrors `wss.clients` for the SSE
@@ -62,7 +66,7 @@ export function createLifecycle(): Lifecycle {
   let pendingExitCode = 0
 
   function install(deps: ShutdownDeps): void {
-    const { httpServer, wss, heartbeatTimer, stopReaper, sseSessions, closeDb } = deps
+    const { httpServer, wss, heartbeatTimer, sseKeepaliveTimer, stopReaper, sseSessions, closeDb } = deps
 
     async function shutdown(exitCode: number = 0): Promise<void> {
       // Re-entry: don't restart the teardown, but escalate the pending
@@ -77,9 +81,9 @@ export function createLifecycle(): Lifecycle {
       shuttingDown = true
       pendingExitCode = exitCode
       console.log('Shutting down…')
-      // Stop the heartbeat so a tick can't fire mid-shutdown and ping a
-      // socket the close-loop below already started tearing down.
-      clearInterval(heartbeatTimer)
+      // Stop both periodic timers (WS heartbeat + SSE keepalive) so neither
+      // fires mid-shutdown against a peer the close-loop is tearing down.
+      for (const timer of [heartbeatTimer, sseKeepaliveTimer]) clearInterval(timer)
       // Send a 1001 (going away) close frame to every open socket BEFORE
       // shutting the listener. Lets clients distinguish a server-initiated
       // graceful shutdown from a network drop, so they can skip their

package/server/objstore/init.ts

@@ -18,6 +18,12 @@ export type ObjstoreInitDeps = {
   // the workspace_revision handle in server/db.ts.
   handle: Handle
   reapIntervalMs: number
+  // Hard off-switch (OBJSTORE_REAP_DISABLED). When true, NEITHER the boot
+  // sweep nor the periodic timer runs: `startupReap` resolves immediately
+  // and `stopReaper` is a no-op. Orphaned/superseded blobs and stale
+  // staging rows then accumulate unbounded — only safe if an external job
+  // handles GC. Omitted/false → reaper runs (the default). See config.ts.
+  reapDisabled?: boolean
   send: (socket: WebSocket, msg: object) => void
   broadcast: (tag: string, msg: object, except: WebSocket | null) => void
   // Cross-instance pub/sub publishers. SQLite mode passes no-ops; Neon
@@ -42,6 +48,12 @@ export type ObjstoreInitDeps = {
   // is not load-balancer-pinned). See server/index.ts boot logic
   // for the env var (`OBJSTORE_TOKEN_SECRET`).
   tokenSecret?: TokenSecret
+  // New-workspace operator gate for the REST put-begin mint — returns
+  // `true` to DENY (password configured AND workspace new). The
+  // connection-independent analog of `authGate`; the client falls back to
+  // the in-band WS put-begin on a deny. Omitted → open (never deny),
+  // matching `authGate`'s no-config default.
+  restPutGate?: (workspaceTag: string) => Promise<boolean>
 }
 
 export type ObjstoreInit = {
@@ -77,7 +89,10 @@ export function initObjstore(deps: ObjstoreInitDeps): ObjstoreInit {
     ...(deps.sendUnauthorized ? { sendUnauthorized: deps.sendUnauthorized } : {}),
   })
   const restDeps: ObjstoreRestDeps = {
-    handle, secret, broadcast: deps.broadcast, publishObjPut: deps.publishObjPut, debug: deps.debug,
+    handle, secret, broadcast: deps.broadcast,
+    publishObjPut: deps.publishObjPut, publishObjDeleted: deps.publishObjDeleted,
+    restPutGate: deps.restPutGate ?? (() => Promise.resolve(false)),
+    debug: deps.debug,
   }
   // Re-entrancy guard for periodic + startup sweeps. Kicking the
   // startup sweep through the same `enqueueSweep` path means the
@@ -98,6 +113,16 @@ export function initObjstore(deps: ObjstoreInitDeps): ObjstoreInit {
     inFlight = p
     return p
   }
+  // Hard off-switch (OBJSTORE_REAP_DISABLED). Skip the boot sweep AND the
+  // periodic timer entirely: `startupReap` resolves immediately so the
+  // index.ts `await startupReap` gate is a no-op, and `stopReaper` has
+  // nothing to clear or drain. Loud, unconditional warning — with GC off,
+  // orphaned/superseded blobs and stale staging rows are never reclaimed
+  // (they accumulate until an external job, if any, collects them).
+  if (deps.reapDisabled) {
+    console.warn('objstore: reaper DISABLED (OBJSTORE_REAP_DISABLED) — orphaned/superseded blobs and stale staging will NOT be reclaimed')
+    return { handlers, restDeps, startupReap: Promise.resolve(), stopReaper: async () => {} }
+  }
   // Caller awaits this before accepting traffic so a fresh boot
   // can't hand out list / fetch / put-begin against a tag whose
   // on-disk state still has stranded files from a prior crash.

package/server/objstore/rest.ts

@@ -41,6 +41,8 @@ import {
 } from './store.ts'
 import type { LiveReader } from './blob.ts'
 import { type TokenSecret, extractBearer, verifyToken } from './tokens.ts'
+import { deny, denyConflict } from './rest-deny.ts'
+import { handleRestMint } from './rest-mint.ts'
 import { debugId, debugTag, errMsg, errStack } from '../util.ts'
 
 // Server-side fault codes that should surface as 500 `io-error`
@@ -66,6 +68,18 @@ export type ObjstoreRestDeps = {
   // workspace_object for the full metadata (version, hash, length,
   // signature). SQLite mode passes a no-op.
   publishObjPut: (tag: string, resourceTag: string) => void
+  // Cross-instance pub/sub for objstore-deleted — fired alongside the local
+  // `broadcast` after a successful REST delete mint, so peers on OTHER
+  // instances drop the resource in real time. Carries (tag, resourceTag,
+  // version) inline (the row is gone post-delete). SQLite mode passes a no-op.
+  publishObjDeleted: (tag: string, resourceTag: string, version: number) => void
+  // New-workspace operator gate for the REST put-begin mint — the
+  // connection-independent analog of the WS path's `authGate`. Returns
+  // `true` to DENY (a password is configured AND the workspace is
+  // never-before-seen), which routes the client to its in-band WS
+  // put-begin fallback (REST has no socket auth state to consult).
+  // No-config default is open (never deny), matching the WS authGate.
+  restPutGate: (workspaceTag: string) => Promise<boolean>
   debug: boolean
 }
 
@@ -116,34 +130,21 @@ export function matchRoute(url: string | undefined): RouteMatch | null {
   return { tag: tag!, resourceTag: resourceTag! }
 }
 
-function deny(res: ServerResponse, status: number, body: string): void {
-  // Uniform `{ error: <reason> }` JSON envelope for every failure so
-  // clients parse one shape. Status + reason are NOT intentionally
-  // indistinguishable across causes — 401/404/405/410/411/500 each map
-  // to a documented reason in server/README.md and the client decides
-  // recovery from the code. Probe-distinguishing defense isn't a goal:
-  // every reason is reachable only after the route + bearer-token check
-  // passes (or as 401/404 from the public surface), so a probe gains no
-  // signal it couldn't otherwise enumerate.
-  res.writeHead(status, { 'content-type': 'application/json' })
-  res.end(JSON.stringify({ error: body }))
-}
-
-// Variant of `deny` that augments the JSON envelope with the live
-// row's `currentVersion` + `currentIncarnation` so a REST PUT 409 lets
-// the caller rebase onto the right precondition token. Without this the
-// client only learns the slot is occupied — not at what (version,
-// incarnation) — and retries blindly against a non-empty slot, looping
-// indefinitely against a live row. Symmetric with the WS plane's
-// `objstore-conflict` envelope.
-function denyConflict(res: ServerResponse, currentVersion: number | null, currentIncarnation: string | null): void {
-  res.writeHead(409, { 'content-type': 'application/json' })
-  res.end(JSON.stringify({ error: 'conflict', currentVersion, currentIncarnation }))
-}
-
 export async function handleRest(deps: ObjstoreRestDeps, req: IncomingMessage, res: ServerResponse): Promise<void> {
   const route = matchRoute(req.url)
   if (!route) { deny(res, 404, 'not-found'); return }
+  // POST = REST mint (fetch or put-begin, by body `op`; signature-authed
+  // via the JSON body, no bearer token). Dispatched before the bearer-token
+  // gate below, which guards the token-authed GET/PUT byte transfers.
+  if (req.method === 'POST') {
+    try { await handleRestMint(deps, req, res, route) }
+    catch (err: unknown) {
+      if (deps.debug) console.warn('objstore POST error:', errStack(err))
+      if (res.headersSent) res.destroy()
+      else deny(res, 500, 'internal')
+    }
+    return
+  }
   const token = extractBearer(req.headers['authorization'])
   if (!token) { deny(res, 401, 'unauthorized'); return }
   const payload = verifyToken(deps.secret, token)

package/server/objstore/sign.ts

@@ -10,6 +10,18 @@ import { isValidIncarnation } from './store.ts'
 const OBJSTORE_PUT_DOMAIN = 'deepview-objstore.v1.put'
 const OBJSTORE_DELETE_DOMAIN = 'deepview-objstore.v1.delete'
 const OBJSTORE_FETCH_DOMAIN = 'deepview-objstore.v1.fetch'
+// REST fetch-mint domain — MUST match the client's FETCH_REST_DOMAIN
+// (client/sync/objstore-crypto.ts). Distinct from OBJSTORE_FETCH_DOMAIN so
+// a WS-fetch signature can't be replayed against the REST mint endpoint.
+const OBJSTORE_FETCH_REST_DOMAIN = 'deepview-objstore.v1.fetch-rest'
+// REST put-begin domain — MUST match the client's PUT_REST_DOMAIN. Distinct
+// from OBJSTORE_PUT_DOMAIN so a WS put-begin signature can't be replayed
+// against the REST mint endpoint.
+const OBJSTORE_PUT_REST_DOMAIN = 'deepview-objstore.v1.put-rest'
+// REST delete domain — MUST match the client's DELETE_REST_DOMAIN. Distinct
+// from OBJSTORE_DELETE_DOMAIN so a WS delete signature can't be replayed
+// against the REST mint endpoint.
+const OBJSTORE_DELETE_REST_DOMAIN = 'deepview-objstore.v1.delete-rest'
 
 // Wire shapes the verifiers accept. Fields land here post-
 // `JSON.parse`, so every value starts life as `unknown` — strict
@@ -95,6 +107,38 @@ function canonicalObjstoreFetch(msg: ObjstoreFetchMsg, connectionNonce: string):
   ].join('\n'))
 }
 
+// REST fetch-mint canonical. Binds a client epoch-ms timestamp (string-
+// encoded to match the client) in place of the connection nonce; the REST
+// handler enforces the freshness window + replay dedup.
+function canonicalObjstoreFetchRest(workspaceTag: string, resourceTag: string, ts: number): Uint8Array<ArrayBuffer> {
+  return encodeUtf8([
+    OBJSTORE_FETCH_REST_DOMAIN,
+    workspaceTag,
+    resourceTag,
+    String(ts),
+  ].join('\n'))
+}
+
+// REST put-begin canonical — the WS `canonicalObjstorePut` fields in the
+// same order/coercion (intOrEmpty / strOrEmpty), under the put-rest domain
+// and binding the client `ts` in place of the connection nonce.
+function canonicalObjstorePutRest(
+  workspaceTag: string, resourceTag: string,
+  prevVersion: number | null, prevIncarnation: string | null,
+  contentHash: string, expectedLength: number, ts: number,
+): Uint8Array<ArrayBuffer> {
+  return encodeUtf8([
+    OBJSTORE_PUT_REST_DOMAIN,
+    workspaceTag,
+    resourceTag,
+    intOrEmpty(prevVersion),
+    strOrEmpty(prevIncarnation),
+    contentHash,
+    String(expectedLength),
+    String(ts),
+  ].join('\n'))
+}
+
 // `Number.isSafeInteger` rather than `Number.isInteger`: JSON numbers
 // are IEEE-754 and integers above 2^53-1 aren't precisely
 // representable. Accepting non-safe integers would let a signed
@@ -162,3 +206,64 @@ export function verifyObjstoreFetchSig(msg: ObjstoreFetchMsg, connectionNonce: u
   if (typeof msg.resourceTag !== 'string') return Promise.resolve(false)
   return verifyObjstoreSig(msg, connectionNonce, (nonce) => canonicalObjstoreFetch(msg, nonce))
 }
+
+// Verify a REST fetch-mint signature. Unlike the WS verifiers this takes
+// the already-validated fields directly (the REST handler parsed +
+// range-checked `ts` and `signature`) rather than a wire `msg` + socket
+// nonce. The workspaceTag IS the Ed25519 public key, so verification is
+// fully self-contained — no session or stored key needed. A throw from
+// the canonical build (lone surrogate, etc.) is treated as a verify
+// failure, never an escaping exception.
+export function verifyObjstoreFetchRestSig(
+  workspaceTag: string, resourceTag: string, ts: number, signature: string,
+): Promise<boolean> {
+  let payload: Uint8Array<ArrayBuffer>
+  try { payload = canonicalObjstoreFetchRest(workspaceTag, resourceTag, ts) }
+  catch { return Promise.resolve(false) }
+  return verifyEd25519(workspaceTag, payload, signature)
+}
+
+// Verify a REST put-begin signature. Same self-contained shape as
+// `verifyObjstoreFetchRestSig` — the caller (rest.ts) has already
+// range-checked the put fields + `ts`. The workspaceTag IS the pubkey.
+export function verifyObjstorePutBeginRestSig(
+  fields: { workspaceTag: string; resourceTag: string; prevVersion: number | null; prevIncarnation: string | null; contentHash: string; expectedLength: number },
+  ts: number, signature: string,
+): Promise<boolean> {
+  let payload: Uint8Array<ArrayBuffer>
+  try {
+    payload = canonicalObjstorePutRest(
+      fields.workspaceTag, fields.resourceTag, fields.prevVersion, fields.prevIncarnation,
+      fields.contentHash, fields.expectedLength, ts,
+    )
+  } catch { return Promise.resolve(false) }
+  return verifyEd25519(fields.workspaceTag, payload, signature)
+}
+
+// REST delete-mint canonical. WS `canonicalObjstoreDelete` fields, under the
+// delete-rest domain, binding the client `ts` in place of the nonce.
+function canonicalObjstoreDeleteRest(
+  workspaceTag: string, resourceTag: string,
+  prevVersion: number | null, prevIncarnation: string | null, ts: number,
+): Uint8Array<ArrayBuffer> {
+  return encodeUtf8([
+    OBJSTORE_DELETE_REST_DOMAIN,
+    workspaceTag,
+    resourceTag,
+    intOrEmpty(prevVersion),
+    strOrEmpty(prevIncarnation),
+    String(ts),
+  ].join('\n'))
+}
+
+// Verify a REST delete-mint signature. Self-contained (workspaceTag IS the
+// pubkey); the caller (rest.ts) has range-checked `ts` + the prev pair.
+export function verifyObjstoreDeleteRestSig(
+  fields: { workspaceTag: string; resourceTag: string; prevVersion: number | null; prevIncarnation: string | null },
+  ts: number, signature: string,
+): Promise<boolean> {
+  let payload: Uint8Array<ArrayBuffer>
+  try { payload = canonicalObjstoreDeleteRest(fields.workspaceTag, fields.resourceTag, fields.prevVersion, fields.prevIncarnation, ts) }
+  catch { return Promise.resolve(false) }
+  return verifyEd25519(fields.workspaceTag, payload, signature)
+}