@tensorix/metahub 0.1.11 → 0.2.1

package/dist/core/sites-core.d.ts

@@ -57,4 +57,39 @@ export declare function getFileRow(db: DbDriver, siteId: string, path: string):
     content: string | null;
 } | null;
 export declare function listFiles(db: DbDriver, siteId: string): SiteFileSummary[];
+/** Binaries at or below this size store inline (base64); larger need a blob. */
+export declare const INLINE_LIMIT: number;
+/** Text-ish types store as readable utf8; everything else is binary. */
+export declare function isTextType(contentType: string): boolean;
+/** Raster image types (svg is text, handled by isTextType). These always store
+ *  as a content-addressed blob regardless of size — they never base64-inline
+ *  into the oplog, keeping replicas lean. */
+export declare function isImageType(contentType: string): boolean;
+export declare function toBytes(data: string | Uint8Array | ArrayBuffer): Uint8Array;
+export declare const createSite: (db: DbDriver, opts: {
+    name: string;
+    title?: string;
+}) => SiteRow;
+/** Rename a site and/or change its title. Guards against duplicate names. */
+export declare const updateSite: (db: DbDriver, id: string, opts: {
+    name?: string;
+    title?: string;
+}) => SiteRow;
+export declare const deleteSite: (db: DbDriver, id: string) => boolean;
+/** Stable id for a (site, path) pair so re-uploads merge instead of duplicate. */
+export declare function fileIdFor(db: DbDriver, siteId: string, path: string): string | null;
+/** Emit the register writes for one file (shared by inline + blob put paths). */
+export declare function writeFileRow(db: DbDriver, siteId: string, cleanPath: string, contentType: string, encoding: FileEncoding, content: string): SiteFileRow;
+/**
+ * Upload/replace one file inline (utf8 text or small base64 binary) — portable,
+ * so the browser replica authors sites offline. Binaries over INLINE_LIMIT need
+ * the server-only blob store; here they throw (sites.ts putFile handles them).
+ */
+export declare function putFileInline(db: DbDriver, siteId: string, path: string, opts: {
+    data: string | Uint8Array | ArrayBuffer;
+    contentType?: string;
+}): SiteFileRow;
+export declare const deleteFile: (db: DbDriver, siteId: string, path: string) => boolean;
+/** Count of live files per site (for the management list's file_count). */
+export declare function fileCount(db: DbDriver, siteId: string): number;
 //# sourceMappingURL=sites-core.d.ts.map

package/dist/core/sites-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites-core.d.ts","sourceRoot":"","sources":["../../src/core/sites-core.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,SAAS,iDAAkD,CAAC;AAIzE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAE3D,eAAO,MAAM,cAAc,2EAEjB,CAAC;AAEX,eAAO,MAAM,gBAAgB,QAA4B,CAAC;AA+B1D,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAID,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIhE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAcxE;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAIjD;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAWjF;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CAMzE"}
+{"version":3,"file":"sites-core.d.ts","sourceRoot":"","sources":["../../src/core/sites-core.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM5C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,SAAS,iDAAkD,CAAC;AAIzE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAE3D,eAAO,MAAM,cAAc,2EAEjB,CAAC;AAEX,eAAO,MAAM,gBAAgB,QAA4B,CAAC;AA4D1D,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAID,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIhE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAcxE;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAIjD;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAWjF;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CAMzE;AAQD,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAAa,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED;;6CAE6C;AAC7C,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAG3E;AASD,eAAO,MAAM,UAAU;UAEP,MAAM;YAAU,MAAM;aASpC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,UAAU;WAGN,MAAM;YAAU,MAAM;aAWrC,CAAC;AAEH,eAAO,MAAM,UAAU,uCAQrB,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CAeb;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,WAAW,CAoBb;AAED,eAAO,MAAM,UAAU,yDAarB,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D"}

package/dist/core/sites.d.ts

@@ -1,22 +1,13 @@
 import type { DbDriver } from "./driver.ts";
-import { type SiteRow, type SiteFileRow } from "./sites-core.ts";
+import { type SiteFileRow } from "./sites-core.ts";
 export * from "./sites-core.ts";
-export declare const createSite: (db: DbDriver, opts: {
-    name: string;
-    title?: string;
-}) => SiteRow;
-/** Rename a site and/or change its title. Guards against duplicate names. */
-export declare const updateSite: (db: DbDriver, id: string, opts: {
-    name?: string;
-    title?: string;
-}) => SiteRow;
-export declare const deleteSite: (db: DbDriver, id: string) => boolean;
-/** Upload or replace one file. Picks utf8 / base64 / blob storage automatically. */
+/** Upload or replace one file. utf8 text and small binaries ride the oplog via
+ *  putFileInline (portable); binaries over the inline limit offload to the
+ *  node-local blob store (server-only — their bytes don't replicate). */
 export declare function putFile(db: DbDriver, siteId: string, path: string, opts: {
     data: string | Uint8Array | ArrayBuffer;
     contentType?: string;
 }): Promise<SiteFileRow>;
-export declare const deleteFile: (db: DbDriver, siteId: string, path: string) => boolean;
 /** Resolve a file to served bytes + content type. "" / trailing "/" → index.html. */
 export declare function getFileForServe(db: DbDriver, siteId: string, path: string): Promise<{
     contentType: string;

package/dist/core/sites.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../src/core/sites.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5C,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,WAAW,EAQjB,MAAM,iBAAiB,CAAC;AAYzB,cAAc,iBAAiB,CAAC;AA0BhC,eAAO,MAAM,UAAU;UAEP,MAAM;YAAU,MAAM;aASpC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,UAAU;WAGN,MAAM;YAAU,MAAM;aAWrC,CAAC;AAEH,eAAO,MAAM,UAAU,uCAQrB,CAAC;AAYH,oFAAoF;AACpF,wBAAsB,OAAO,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,WAAW,CAAC,CAwCtB;AAED,eAAO,MAAM,UAAU,yDAarB,CAAC;AAEH,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAY5D"}
+{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../src/core/sites.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EACL,KAAK,WAAW,EAUjB,MAAM,iBAAiB,CAAC;AAezB,cAAc,iBAAiB,CAAC;AAEhC;;yEAEyE;AACzE,wBAAsB,OAAO,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,WAAW,CAAC,CAetB;AASD,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAuB5D"}

package/dist/core/sync/auth.d.ts

@@ -6,6 +6,15 @@ export interface AuthConfig {
     ttlMs: number;
     graceMs: number;
 }
+/**
+ * When a request authenticated via a `?token=` query param and carries no cookie
+ * yet, return the `Set-Cookie` to persist it; otherwise null. A `/?token=...`
+ * link (QR / "copy login link") authorizes only that one navigation — without
+ * this, the browser's follow-up /webui.css, /webui.js etc. carry no credential
+ * and 401, serving a broken page. Setting the cookie on the HTML response lets
+ * those same-origin sub-requests ride it automatically.
+ */
+export declare function queryTokenCookie(req: Request, url: URL, cfg: AuthConfig): string | null;
 export declare function extractToken(req: Request, url: URL): string | null;
 /** Whether auth is on at all (so the gate runs and the fetch shim is injected). */
 export declare function authActive(cfg: AuthConfig): boolean;
@@ -40,8 +49,12 @@ export declare function unlockPage(): string;
 export declare function injectShim(html: string): string;
 /** Inject the page runtime into HTML responses. Unconditional (unlike the old
  *  token-only shim): the offline bridge matters even in --debug mode where
- *  auth is off — the token half simply no-ops without a stored token. */
-export declare function withShim(res: Response, _cfg: AuthConfig): Promise<Response>;
+ *  auth is off — the token half simply no-ops without a stored token.
+ *
+ *  When `req`/`url` are supplied and the navigation authenticated via a `?token=`
+ *  query param, persist that token as the mh_token cookie on this HTML response
+ *  so the browser's follow-up asset requests (/webui.css, /webui.js) carry it. */
+export declare function withShim(res: Response, cfg: AuthConfig, req?: Request, url?: URL): Promise<Response>;
 export declare function unauthorized(): Response;
 export { HTML_HEADERS };
 //# sourceMappingURL=auth.d.ts.map

package/dist/core/sync/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/sync/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAI9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAO/F;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,UAAU,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUvC;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/C;AAED,QAAA,MAAM,YAAY;;CAAiD,CAAC;AAEpE,sFAAsF;AACtF,wBAAgB,UAAU,IAAI,MAAM,CAoDnC;AAYD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;yEAEyE;AACzE,wBAAsB,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAMjF;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAEvC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/sync/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAMvF;AAYD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAI9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAO/F;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,UAAU,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUvC;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/C;AAED,QAAA,MAAM,YAAY;;CAAiD,CAAC;AAEpE,sFAAsF;AACtF,wBAAgB,UAAU,IAAI,MAAM,CAqDnC;AAYD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;;;;kFAMkF;AAClF,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,OAAO,EACb,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAEvC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/core/sync/blob-routes.d.ts

@@ -0,0 +1,12 @@
+import { type Route, type RouteCtx } from "./routes.ts";
+/**
+ * Serve `GET /blob/<hash>[.ext]`. Default: resolve on demand (local cache → peers
+ * → bucket) so a browser <img> or a far node gets the bytes even if this node
+ * hadn't cached them. `?local=1` (used by peer-to-peer resolution) serves only
+ * what we already hold, so cross-node fetches can't loop. Content-addressed →
+ * immutable cache. Returns null when the path isn't a blob URL (so the caller
+ * falls through to the next matcher).
+ */
+export declare function serveBlob(req: Request, ctx: RouteCtx): Promise<Response | null>;
+export declare const blobRoutes: Route[];
+//# sourceMappingURL=blob-routes.d.ts.map

package/dist/core/sync/blob-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/blob-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAkDvE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqBrF;AAgBD,eAAO,MAAM,UAAU,EAAE,KAAK,EAoE7B,CAAC"}

package/dist/core/sync/client.d.ts

@@ -2,6 +2,13 @@ import type { DbDriver } from "../driver.ts";
 export interface SyncResult {
     pushed: number;
     pulled: number;
+    /** Response page size (changes the peer returned this round), independent of
+     *  how many were new to our oplog. Pagination must break on this, NOT on
+     *  `pulled`: a page of all-known changes ingests 0 but may not be the last
+     *  page (e.g. after a cursor reset re-pulls data we already hold). */
+    received?: number;
+    /** Storage-sync only: local own ops exist but were deferred by push batching. */
+    pendingPush?: boolean;
 }
 export interface SyncOpts {
     /** Bearer credential; defaults to the one stored for this peer (pairing). */

package/dist/core/sync/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/core/sync/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAyB7C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAQ,GAAG,MAAW,GAC3B,OAAO,CAAC,UAAU,CAAC,CAiCrB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/core/sync/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAyB7C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;0EAGsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAQ,GAAG,MAAW,GAC3B,OAAO,CAAC,UAAU,CAAC,CAqCrB"}

package/dist/core/sync/e2ee.d.ts

@@ -0,0 +1,31 @@
+/** The bucket's keys/main.json: the master key wrapped by the passphrase KEK. */
+export interface KeyEnvelope {
+    v: 1;
+    kdf: "PBKDF2-SHA256";
+    iter: number;
+    salt: string;
+    wrap: "AES-GCM";
+    /** base64(iv ‖ ciphertext) of the raw 32-byte master key. */
+    wrapped_key: string;
+}
+export declare function toB64(bytes: Uint8Array): string;
+export declare function fromB64(b64: string): Uint8Array;
+/** A fresh random 256-bit master key (raw bytes). */
+export declare function generateMasterKey(): Uint8Array;
+/** Wrap the master key under a passphrase-derived KEK → bucket keys/main.json. */
+export declare function wrapMasterKey(rawKey: Uint8Array, passphrase: string): Promise<KeyEnvelope>;
+/** Recover the master key from the envelope + passphrase. Throws `auth` on a
+ *  wrong passphrase (the GCM tag won't verify) or a malformed envelope. */
+export declare function unwrapMasterKey(env: KeyEnvelope, passphrase: string): Promise<Uint8Array>;
+/**
+ * Derive a raw 32-byte content key from a share password + salt (same PBKDF2
+ * parameters as the bucket KEK). Used by the object-storage share path: the
+ * exporter and the in-browser viewer both derive the identical key, so a wrong
+ * password simply fails the GCM tag on decrypt — no server-side verifier needed.
+ */
+export declare function deriveShareKey(password: string, salt: Uint8Array): Promise<Uint8Array>;
+/** Encrypt arbitrary bytes (a compressed segment/snapshot) → iv ‖ ciphertext. */
+export declare function encryptBytes(rawKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
+/** Inverse of encryptBytes. Throws `auth` if the key is wrong or data tampered. */
+export declare function decryptBytes(rawKey: Uint8Array, payload: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=e2ee.d.ts.map

package/dist/core/sync/e2ee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee.d.ts","sourceRoot":"","sources":["../../../src/core/sync/e2ee.ts"],"names":[],"mappings":"AAkCA,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAK/C;AAID,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,UAAU,CAE9C;AAmBD,kFAAkF;AAClF,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBhG;AAED;2EAC2E;AAC3E,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAc/F;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAc5F;AAWD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUjG;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAU/F"}

package/dist/core/sync/enroll.d.ts

@@ -0,0 +1,21 @@
+/** The slim bucket descriptor an enroll token carries. Mirrors the access-only
+ *  subset of S3Config — no passphrase, no master key, no node-role hints. */
+export interface EnrollPayload {
+    endpoint: string;
+    region?: string;
+    bucket: string;
+    prefix?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    encrypt?: boolean;
+    virtualHostedStyle?: boolean;
+}
+/** Encode the bucket descriptor into a base64url enroll token. Keys are emitted
+ *  in a fixed order (and undefined fields omitted) so the token is stable. */
+export declare function encodeEnroll(p: EnrollPayload): string;
+/** Decode an enroll token back into a bucket descriptor. Accepts the bare token,
+ *  an `enroll=<token>` fragment, or a full `…/#enroll=<token>` deep link, so a
+ *  user can paste whatever they copied. Throws MhError("invalid_input") on a
+ *  malformed token or a payload missing the fields needed to reach the bucket. */
+export declare function decodeEnroll(tokenOrUrl: string): EnrollPayload;
+//# sourceMappingURL=enroll.d.ts.map

package/dist/core/sync/enroll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.d.ts","sourceRoot":"","sources":["../../../src/core/sync/enroll.ts"],"names":[],"mappings":"AAaA;6EAC6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAmBD;8EAC8E;AAC9E,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAYrD;AAED;;;kFAGkF;AAClF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CAoC9D"}

package/dist/core/sync/peers-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AA6FvE,eAAO,MAAM,WAAW,EAAE,KAAK,EA+E9B,CAAC"}
+{"version":3,"file":"peers-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AA6KvE,eAAO,MAAM,WAAW,EAAE,KAAK,EA+H9B,CAAC"}

package/dist/core/sync/peers.d.ts

@@ -1,4 +1,5 @@
 import type { DbDriver } from "../driver.ts";
+import { type S3Config, type StorageSyncOpts } from "./storage.ts";
 export interface PeerRow {
     url: string;
     pull_cursor: number;
@@ -7,9 +8,16 @@ export interface PeerRow {
     label: string | null;
     node_id: string | null;
     enabled: number;
+    /** Last sync attempt, successful or failed. */
     last_sync_at: number | null;
+    /** Last successful sync. Freshness gates must use this, not last_sync_at. */
+    last_success_at: number | null;
     last_status: string | null;
     last_error: string | null;
+    /** Transport: 'http' (POST /sync) or 's3' (bucket store-and-forward). */
+    kind: string;
+    /** JSON S3Config for 's3' peers; null for 'http'. */
+    config: string | null;
 }
 export declare function listPeers(db: DbDriver): PeerRow[];
 export declare function getPeer(db: DbDriver, url: string): PeerRow | null;
@@ -21,6 +29,46 @@ export interface AddPeerInput {
 }
 /** Upsert a peer, preserving replication cursors on conflict. */
 export declare function addPeer(db: DbDriver, input: AddPeerInput): void;
+export interface AddStoragePeerInput {
+    /** Synthetic peer key, by convention s3://<bucket>/<prefix>. */
+    url: string;
+    config: S3Config;
+    label?: string | null;
+}
+/** Upsert an 's3' (bucket store-and-forward) peer, preserving cursors on conflict. */
+export declare function addStoragePeer(db: DbDriver, input: AddStoragePeerInput): void;
+export { storageUrl, storageEndpointHost } from "./storage-url.ts";
+export interface StoragePeerSpec {
+    endpoint: string;
+    region?: string;
+    bucket: string;
+    prefix?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Virtual-hosted (COS) vs path-style addressing; undefined → auto-detect.
+     *  Carried by enroll codes so COS buckets join correctly. */
+    virtualHostedStyle?: boolean;
+    /** Default true; pass false for `--no-encrypt` plaintext buckets. */
+    encrypt?: boolean;
+    /** Required when encrypt — provisions/adopts the bucket's wrapped master key. */
+    passphrase?: string;
+    /** Mark this node the bucket's publisher (writes whole-hub snapshots). */
+    publish?: boolean;
+    priority?: number;
+    label?: string | null;
+}
+/**
+ * Resolve + persist an S3 storage peer and run one sync so a bad endpoint /
+ * credentials / missing CORS fail fast at the call site. Shared by the CLI
+ * (`mh config peer add --s3`) and the WebUI server endpoint (`POST /api/peer/s3`)
+ * so both go through the exact same provisioning + first-sync path. Returns the
+ * resolved config (incl. the wrapped master key) and the first sync outcome.
+ */
+export declare function addAndSyncStoragePeer(db: DbDriver, spec: StoragePeerSpec): Promise<{
+    url: string;
+    config: S3Config;
+    sync: PeerSyncOutcome;
+}>;
 /**
  * Remove a peer AND revoke the credential we issued to it during pairing, so
  * disconnecting is mutual: we stop syncing out to it (peers row) and it can no
@@ -36,10 +84,34 @@ export interface PeerSyncOutcome {
     ok: boolean;
     pushed?: number;
     pulled?: number;
+    pendingPush?: boolean;
     error?: string;
 }
-/** Sync once with a single peer, recording status. Errors are captured, not thrown. */
-export declare function syncPeer(db: DbDriver, url: string): Promise<PeerSyncOutcome>;
+/** Sync once with a single peer, recording status. Errors are captured, not
+ *  thrown. Dispatches on transport: 's3' peers go through the bucket
+ *  store-and-forward client, everything else POSTs /sync. */
+export declare function syncPeer(db: DbDriver, url: string, opts?: {
+    storage?: StorageSyncOpts;
+}): Promise<PeerSyncOutcome>;
 /** Sync once with every enabled peer. Used by the auto-sync timer. */
 export declare function syncAllPeers(db: DbDriver): Promise<PeerSyncOutcome[]>;
+/**
+ * Freshness gate for *non-reactive* consumers — CLI reads and the PWA's served
+ * site pages (②b). Their local DB is only as fresh as the last sync, and unlike
+ * the reactive WebUI they have no background poll and no `synced` revalidate. So
+ * if the newest successful peer sync is older than `maxAgeMs`, block on one
+ * bounded sync round before the caller reads; otherwise return immediately
+ * (read local).
+ *
+ * No enabled peers → no-op. A running daemon keeps `last_success_at` recent, so
+ * this is a near-instant no-op there and only does real work on a daemon-less node
+ * that hasn't synced successfully in a while. Failed attempts update
+ * `last_sync_at`, but never make local data fresh. Env overrides: MH_OFFLINE=1
+ * skips; MH_FRESH=1 forces; MH_SYNC_MAX_AGE=<ms> tunes the threshold.
+ */
+export declare function ensureFresh(db: DbDriver, opts?: {
+    maxAgeMs?: number;
+    force?: boolean;
+    offline?: boolean;
+}): Promise<void>;
 //# sourceMappingURL=peers.d.ts.map

package/dist/core/sync/peers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAMjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAMjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAIN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,wBAAsB,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAUlF;AAED,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E"}
+{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAWtB,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAEjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAU7E;AAsCD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BnE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAS7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAWN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;6DAE6D;AAC7D,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,GACnC,OAAO,CAAC,eAAe,CAAC,CAa1B;AAiCD,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/core/sync/publisher-lease.d.ts

@@ -0,0 +1,8 @@
+import type { StorageClient } from "./storage.ts";
+/**
+ * Refresh this node's heartbeat (throttled) and return whether it is the elected
+ * publisher among currently-live candidates. Call only when a snapshot is
+ * actually due, so the lease LIST/GETs aren't paid on idle rounds.
+ */
+export declare function isElectedPublisher(client: StorageClient, base: string, node: string, priority: number, now?: number): Promise<boolean>;
+//# sourceMappingURL=publisher-lease.d.ts.map

package/dist/core/sync/publisher-lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publisher-lease.d.ts","sourceRoot":"","sources":["../../../src/core/sync/publisher-lease.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAmBlD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,OAAO,CAAC,CAgDlB"}

package/dist/core/sync/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAc3C,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAeD;;8BAE8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMlD;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACxE;AAiCD,eAAO,MAAM,MAAM,EAAE,KAAK,EAAoD,CAAC"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAe3C,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAeD;;8BAE8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMlD;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACxE;AAiCD,eAAO,MAAM,MAAM,EAAE,KAAK,EAAmE,CAAC"}

package/dist/core/sync/server.d.ts

@@ -1,3 +1,4 @@
+import "./storage-s3-bun.ts";
 import { MhError } from "../errors.ts";
 import { type Route } from "./routes.ts";
 export interface RunningServer {

package/dist/core/sync/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAkBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CA8JnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAmBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CAqPnE"}

package/dist/core/sync/share-actions.d.ts

@@ -0,0 +1,69 @@
+import type { DbDriver } from "../driver.ts";
+import { type ShareKind, type SharePermission } from "../shares.ts";
+export interface CreateShareRequest {
+    kind: ShareKind;
+    ref: string;
+    permission?: SharePermission;
+    transport?: "server" | "s3";
+    password?: string | null;
+    /** Server: any duration (ms); null = never. s3: clamped to ≤7d; default 7d. */
+    expiresMs?: number | null;
+    /** server transport target: a paired peer url → create remotely on that peer;
+     *  any other base url (this node's origin / LAN / domain) → create locally and
+     *  record it as served_base; undefined → local with no recorded base. */
+    server?: string | null;
+    /** s3: which bucket peer url; default the single s3 peer if exactly one. */
+    bucketUrl?: string | null;
+    /** s3 only: the static viewer base for the link. */
+    viewerBase?: string;
+}
+export interface CreatedShare {
+    slug: string;
+    kind: ShareKind;
+    permission: SharePermission;
+    transport: "server" | "s3";
+    /** Full link to copy (server: served_base/share/slug; s3: viewer link). */
+    url: string;
+    expiresAt: number | null;
+    /** Human label of where it's served: a server address or a bucket name. */
+    source: string;
+}
+/** A row in the aggregated share listing (CLI `list` / WebUI panel). */
+export interface ShareListItem {
+    slug: string;
+    kind: string;
+    target_id: string;
+    /** Human title of the shared object (for the management list). */
+    title: string;
+    permission: string;
+    transport: "server" | "s3";
+    source: string;
+    sourceKind: "server" | "peer" | "bucket";
+    expiresAt: number | null;
+    hasPassword: boolean;
+    /** server: ready-to-copy link; s3: omitted (use renew to mint a fresh one). */
+    url?: string;
+}
+/** s3 bucket peers (no secrets) for a transport picker. */
+export declare function listShareBuckets(db: DbDriver): {
+    url: string;
+    label: string;
+}[];
+/** Paired HTTP peer servers (a share can be created on / served by them). */
+export declare function listShareServers(db: DbDriver): {
+    url: string;
+    label: string;
+}[];
+/** Resolve, validate, and create (server local / server remote / s3 bucket) a share. */
+export declare function createShareAction(db: DbDriver, req: CreateShareRequest): Promise<CreatedShare>;
+/** Local listing (server rows + each attached bucket) — NO peer fan-out (so the
+ *  /api/shares endpoint a peer calls can't recurse). Optional target filter. */
+export declare function listSharesLocal(db: DbDriver, targetId?: string): Promise<ShareListItem[]>;
+/** Aggregated listing for CLI/WebUI: local ∪ each paired peer's /api/shares
+ *  (best-effort, bounded), deduped by slug. Optional target filter. */
+export declare function listSharesAggregated(db: DbDriver, targetId?: string): Promise<ShareListItem[]>;
+/** Revoke: local server row → delete it; else a bucket holds it → delete objects. */
+export declare function revokeShareAction(db: DbDriver, slug: string): Promise<boolean>;
+/** Renew an s3 share (re-presign, mint a fresh ≤7d link). */
+export declare function renewShareAction(db: DbDriver, slug: string, viewerBaseOverride?: string): Promise<CreatedShare>;
+//# sourceMappingURL=share-actions.d.ts.map

package/dist/core/sync/share-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-actions.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-actions.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAQ7C,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AActB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,SAAS,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;6EAEyE;IACzE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAiCD,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/E;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/E;AAiCD,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0FpG;AAED;gFACgF;AAChF,wBAAsB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAsC/F;AAED;uEACuE;AACvE,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAepG;AAYD,qFAAqF;AACrF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWpF;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBrH"}

package/dist/core/sync/share-export.d.ts

@@ -0,0 +1,72 @@
+import type { DbDriver } from "../driver.ts";
+import { type S3Config } from "./storage.ts";
+export interface ShareManifest {
+    v: 1;
+    kind: "doc" | "database";
+    title: string;
+    body?: string;
+    properties?: {
+        id: string;
+        name: string;
+        type: string;
+    }[];
+    records?: {
+        cells: Record<string, unknown>;
+    }[];
+    /** hash → { presigned GET of the (encrypted) blob, original content-type }. */
+    blobs?: Record<string, {
+        url: string;
+        ct: string;
+    }>;
+}
+/** Bucket-resident share descriptor (master-key encrypted). The listable source
+ *  of truth for an object-storage share. */
+export interface BucketShareMeta {
+    v: 1;
+    slug: string;
+    kind: "doc" | "database";
+    target_id: string;
+    title: string;
+    permission: "view";
+    created_at: number;
+    /** epoch ms the presigned URLs expire (≤ 7 days out). */
+    presign_exp: number;
+    has_password: boolean;
+    /** every object key this share owns (manifest + each blob) — for renew + delete. */
+    objects: string[];
+    /** base64 per-share content key (lets a bucket-holder renew / re-copy the link). */
+    key: string;
+    /** base64 salt (password shares); the link carries this, viewer derives the key. */
+    salt?: string;
+}
+export interface BucketShareLink {
+    manifestUrl: string;
+    presignExp: number;
+    /** base64 random key (no-password) — goes in the link fragment as #k=. */
+    keyB64?: string;
+    /** base64 salt (password) — goes in the link fragment as #s=. */
+    saltB64?: string;
+    title: string;
+}
+/** Create an object-storage share: write manifest+blobs (per-share-key encrypted)
+ *  then meta.json (master-key encrypted, written LAST so a half-built share is
+ *  never listed), and allow the viewer origin in the bucket's CORS. */
+export declare function createBucketShare(db: DbDriver, opts: {
+    slug: string;
+    kind: "doc" | "database";
+    targetId: string;
+    config: S3Config;
+    password?: string | null;
+    expiresSec: number;
+    viewerOrigin?: string;
+}): Promise<BucketShareLink>;
+/** Renew an object-storage share: re-read the (live) source, re-encrypt with the
+ *  stored per-share key, re-upload + re-presign, refresh meta.json. Works for
+ *  password shares too (the key is stored master-encrypted). */
+export declare function renewBucketShare(db: DbDriver, config: S3Config, slug: string, expiresSec?: number): Promise<BucketShareLink>;
+/** List all object-storage shares in a bucket (decrypts each meta.json). */
+export declare function listBucketShares(config: S3Config): Promise<BucketShareMeta[]>;
+/** Delete a bucket share's objects. meta.json is deleted FIRST so the share
+ *  immediately disappears from listings even if the rest is slow. */
+export declare function deleteBucketShareObjects(config: S3Config, slug: string): Promise<void>;
+//# sourceMappingURL=share-export.d.ts.map

package/dist/core/sync/share-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-export.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-export.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAO7C,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW/D,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;4CAC4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAyGD;;uEAEuE;AACvE,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,eAAe,CAAC,CA0C1B;AAED;;gEAEgE;AAChE,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,SAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAanF;AAED;qEACqE;AACrE,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5F"}

package/dist/core/sync/share-render.d.ts

@@ -0,0 +1,10 @@
+export declare function escapeHtml(s: string): string;
+export interface RenderOpts {
+    /** Rewrite a `/blob/<hash>` URL to a reachable one (scoped endpoint or data URL). */
+    rewriteBlob?: (url: string) => string;
+}
+/** Inline Markdown → HTML: `code`, **bold**, *italic*, [link](url), ![img](url). */
+export declare function renderInline(src: string, opts?: RenderOpts): string;
+/** Render a markdown body to an HTML string (block-level). */
+export declare function renderMarkdown(md: string, opts?: RenderOpts): string;
+//# sourceMappingURL=share-render.d.ts.map

package/dist/core/sync/share-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-render.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-render.ts"],"names":[],"mappings":"AASA,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM5C;AAED,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC;AAOD,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAmBvE;AASD,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAkIxE"}

package/dist/core/sync/share-serve.d.ts

@@ -0,0 +1,3 @@
+import type { RouteCtx } from "./routes.ts";
+export declare function serveShare(req: Request, ctx: RouteCtx): Promise<Response | null>;
+//# sourceMappingURL=share-serve.d.ts.map

package/dist/core/sync/share-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-serve.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAmC5C,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkCtF"}

package/dist/core/sync/sites-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAQ5C,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuBrF"}
+{"version":3,"file":"sites-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAQ5C,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBrF"}

package/dist/core/sync/storage-s3-bun.d.ts

@@ -0,0 +1,35 @@
+import { type S3Config } from "./storage.ts";
+/** SigV4 presigned GET cap: 7 days (604800s) is the protocol maximum. */
+export declare const MAX_PRESIGN_SECONDS = 604800;
+/**
+ * Build a presigned GET URL for one object (used by the object-storage share
+ * path — the recipient fetches the ciphertext directly from the bucket, no
+ * credential in the link). Addressing mirrors corsEndpoint (virtual-hosted vs
+ * path-style). `expiresSec` is clamped to the 7-day SigV4 maximum.
+ */
+export declare function presignGet(config: S3Config, key: string, expiresSec: number): Promise<string>;
+/** Read the bucket's current CORS config (raw XML), or null if none is set. */
+export declare function getBucketCors(config: S3Config): Promise<string | null>;
+/**
+ * Build the PutBucketCors XML body from the bucket's current config. PutBucketCors
+ * replaces the whole config, so we keep every rule that isn't ours and re-emit our
+ * managed rule (id=metahub-pwa). `merge` decides our rule's origins:
+ *  - false (CLI `peer cors`): SET — exactly `origins` (lets the user shrink/reset).
+ *  - true  (auto-open on bucket-attach): UNION with the managed rule's existing
+ *    origins, so attaching the same bucket from a second shell/origin (a homelab
+ *    server origin alongside the official PWA shell) adds to the allow-list
+ *    instead of clobbering it.
+ * A wildcard `*` collapses the set. Pure (no I/O) so it's unit-testable.
+ */
+export declare function buildCorsXml(existing: string | null, origins: string[], merge: boolean): string;
+/**
+ * Allow a browser shell served from `origins` to talk to the bucket directly
+ * (GET/PUT/HEAD/DELETE) via GET-merge-PUT (see buildCorsXml). `opts.merge` unions
+ * with existing managed origins instead of replacing them — used when a second
+ * origin attaches the same bucket. Content-MD5 is required by the CORS API
+ * (S3 and COS both).
+ */
+export declare function putBucketCors(config: S3Config, origins: string[], opts?: {
+    merge?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=storage-s3-bun.d.ts.map