@tensorix/metahub 0.1.2 → 0.1.3

package/dist/index.js

@@ -704,6 +704,21 @@ var HTML = `<!doctype html>
   .theme-card.sel .tc-check { opacity:1; transform:scale(1); }
   @media (max-width:560px) { .theme-grid { grid-template-columns:1fr; } }
 
+  /* sync devices */
+  .peer-actions { display:flex; gap:10px; margin-bottom:16px; flex-wrap:wrap; }
+  .peer-actions .btn { display:inline-flex; align-items:center; gap:6px; }
+  .peer-list { display:flex; flex-direction:column; gap:8px; }
+  .peer-row { display:flex; align-items:center; gap:12px; padding:12px 14px; border:1px solid var(--line);
+    border-radius:10px; background:var(--surface); }
+  .peer-dot { width:9px; height:9px; border-radius:50%; flex:none; background:var(--muted); }
+  .peer-dot.on { background:#3fb950; } .peer-dot.err { background:#f85149; } .peer-dot.off { background:var(--muted); }
+  .peer-main { flex:1; min-width:0; }
+  .peer-url { font-weight:600; font-size:14px; color:var(--fg); overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+  .peer-sub { font-size:12px; color:var(--muted); margin-top:2px; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+  .peer-menu { flex:none; padding:6px; }
+  .pair-code { font-family:var(--mono); font-size:26px; font-weight:700; letter-spacing:.12em;
+    text-align:center; padding:16px; border:1px dashed var(--line); border-radius:10px; background:var(--surface); color:var(--fg); }
+
   /* main */
   .main { flex:1; display:flex; flex-direction:column; overflow:hidden; min-width:0; }
   .topbar { display:flex; align-items:center; gap:6px; padding:10px 18px; border-bottom:1px solid var(--line); min-height:49px; }
@@ -1140,6 +1155,49 @@ var HTML = `<!doctype html>
     .db { padding:16px 14px 90px; }
     .peek { width:100%; }
   }
+
+  /* Quick Notes window (desktop, loaded at #quick). A transparent body lets the
+     macOS vibrancy blur show through; a translucent panel keeps text readable.
+     The top bar is the window drag region; its buttons opt back out. */
+  body.quicknote { background:transparent; }
+  /* The main app lays #app out as a flex row (sidebar + main); the quick-note
+     route has a single child, so override to a full-bleed block or the panel
+     shrinks to its content width and the window's vibrancy shows through. */
+  body.quicknote #app { display:block; width:100vw; height:100vh; }
+  .qn { display:flex; flex-direction:column; width:100%; height:100vh; overflow:hidden;
+    background:color-mix(in srgb, var(--bg) 20%, transparent); }
+  .qn-bar { display:flex; align-items:center; gap:6px; padding:4px 10px 4px 76px;
+    user-select:none; -webkit-app-region:drag;
+    background:color-mix(in srgb, var(--surface) 30%, transparent); }
+  .qn-brand { flex:1; min-width:0; font-size:12px; font-weight:600; color:var(--fg-soft);
+    white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .qn-actions { display:flex; gap:2px; -webkit-app-region:no-drag; }
+  .qn-actions .iconbtn { width:26px; height:26px; }
+  .qn-actions .iconbtn.active { color:var(--accent); background:var(--hover-2); }
+  .qn-body { flex:1; overflow:auto; -webkit-app-region:no-drag; }
+  .qn-body .doc { max-width:none; margin:0; padding:14px 22px 30vh; }
+  .qn-body .doc-title { font-size:24px; margin-bottom:2px; }
+  .qn-body .doc-meta { display:none; }
+  /* Compact menus inside the quick-note window only (dropdown + slash command
+     share .pop/.item/.lico with the main app; scope under body.quicknote so the
+     main app keeps its roomier density). */
+  body.quicknote .pop { padding:5px; border-radius:9px; }
+  body.quicknote .pop .lbl { padding:4px 8px 2px; font-size:10px; }
+  body.quicknote .pop .item { padding:5px 9px; gap:8px; font-size:12.5px; }
+  body.quicknote .pop .item .t { font-size:12.5px; }
+  body.quicknote .pop .item .d { font-size:10.5px; }
+  body.quicknote .pop .item .lico { width:22px; height:22px; }
+  body.quicknote .pop .item .lico.plain { width:20px; height:20px; }
+  body.quicknote .pop .sep { margin:4px 4px; }
+
+  /* Quick Notes settings rows (desktop only). */
+  .qn-set-row { display:flex; align-items:center; gap:14px; padding:12px 0; border-top:1px solid var(--line); }
+  .qn-set-row:first-of-type { border-top:0; }
+  .qn-set-main { flex:1; min-width:0; }
+  .qn-set-name { font-weight:600; }
+  .qn-set-desc { color:var(--muted); font-size:13px; margin-top:2px; }
+  .qn-shortcut { min-width:140px; justify-content:center; font-family:var(--mono); }
+  .qn-shortcut.capturing { outline:2px solid var(--accent); color:var(--accent); }
 </style>
 </head>
 <body>
@@ -1207,11 +1265,41 @@ CREATE TABLE IF NOT EXISTS crdt_changes (
 CREATE INDEX IF NOT EXISTS idx_changes_hlc ON crdt_changes(hlc);
 
 -- Per-peer replication cursors (SQLite rowids: monotonic in insertion order,
--- so no change is ever skipped regardless of HLC/clock skew).
+-- so no change is ever skipped regardless of HLC/clock skew). Outbound side of
+-- a pairing: "token" is the credential the *remote* issued to us (sent as a
+-- Bearer header when we sync to them). See migratePeers in db.ts for the columns
+-- added to legacy databases.
 CREATE TABLE IF NOT EXISTS peers (
-  url         TEXT PRIMARY KEY,
-  pull_cursor INTEGER NOT NULL DEFAULT 0,
-  push_cursor INTEGER NOT NULL DEFAULT 0
+  url          TEXT PRIMARY KEY,
+  pull_cursor  INTEGER NOT NULL DEFAULT 0,
+  push_cursor  INTEGER NOT NULL DEFAULT 0,
+  token        TEXT,
+  label        TEXT,
+  node_id      TEXT,
+  enabled      INTEGER NOT NULL DEFAULT 1,
+  last_sync_at INTEGER,
+  last_status  TEXT,
+  last_error   TEXT
+);
+
+-- Inbound side of a pairing: credentials *we* issued to remote devices. A peer
+-- presents one of these on /sync; acceptsSyncToken() checks it alongside the
+-- managed master token. Revoke by deleting the row.
+CREATE TABLE IF NOT EXISTS peer_grants (
+  token      TEXT PRIMARY KEY,
+  peer_url   TEXT,
+  node_id    TEXT,
+  created_at INTEGER
+);
+
+-- One-time pairing codes minted by "mh config peer code" / POST /api/pair/new.
+-- Short-lived and single-use: redeemed during the pairing handshake, then the
+-- two devices exchange durable peer_grants. used/exp gate redemption.
+CREATE TABLE IF NOT EXISTS pairing_codes (
+  code       TEXT PRIMARY KEY,
+  exp        INTEGER NOT NULL,
+  used       INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER
 );
 
 CREATE TABLE IF NOT EXISTS databases (
@@ -1924,12 +2012,28 @@ function migrateRecords(db) {
   tx();
   backfillRecordOrderKeys(db);
 }
+function migratePeers(db) {
+  const add = [
+    ["token", "TEXT"],
+    ["label", "TEXT"],
+    ["node_id", "TEXT"],
+    ["enabled", "INTEGER NOT NULL DEFAULT 1"],
+    ["last_sync_at", "INTEGER"],
+    ["last_status", "TEXT"],
+    ["last_error", "TEXT"]
+  ];
+  for (const [col, decl] of add) {
+    if (!hasColumn(db, "peers", col))
+      db.exec(`ALTER TABLE peers ADD COLUMN ${col} ${decl}`);
+  }
+}
 function openMetahub() {
   ensureDirs();
   const db = new Database(dbPath(), { create: true });
   db.exec("PRAGMA journal_mode = WAL;");
   runSchema(db);
   migrateRecords(db);
+  migratePeers(db);
   return db;
 }
 
@@ -2032,9 +2136,12 @@ function getDocument(db, id) {
   return db.query("SELECT id, title, body, database_id, parent_id, created_hlc FROM documents WHERE id = ? AND __deleted = 0").get(id);
 }
 function listDocuments(db, opts = {}) {
+  const cols = "SELECT id, title, database_id, parent_id, created_hlc FROM documents WHERE __deleted = 0";
+  if (opts.parent_id !== undefined)
+    return db.query(`${cols} AND parent_id = ? ORDER BY created_hlc`).all(opts.parent_id);
   if (opts.database_id)
-    return db.query("SELECT id, title, database_id, parent_id, created_hlc FROM documents WHERE database_id = ? AND __deleted = 0 ORDER BY created_hlc").all(opts.database_id);
-  return db.query("SELECT id, title, database_id, parent_id, created_hlc FROM documents WHERE __deleted = 0 ORDER BY created_hlc").all();
+    return db.query(`${cols} AND database_id = ? ORDER BY created_hlc`).all(opts.database_id);
+  return db.query(`${cols} ORDER BY created_hlc`).all();
 }
 function updateDocument(db, id, fields) {
   if (!getDocument(db, id))
@@ -16517,26 +16624,41 @@ var HealthResponseSchema = exports_external.object({
   ok: exports_external.boolean(),
   node: exports_external.string().describe("Server's node id")
 });
+var PairRequestSchema = exports_external.object({
+  code: exports_external.string().describe("One-time pairing code minted by this server"),
+  node_id: exports_external.string().describe("Calling device's node id"),
+  grant: exports_external.string().describe("Durable credential the caller issues to us"),
+  self_url: exports_external.string().optional().describe("Caller's reachable server URL (for mutual sync)")
+});
+var PairResponseSchema = exports_external.object({
+  node_id: exports_external.string().describe("This server's node id"),
+  grant: exports_external.string().describe("Durable credential we issue to the caller")
+});
 var SYNC_PATH = "/sync";
 var HEALTH_PATH = "/health";
 var RENEW_PATH = "/auth/token";
+var PAIR_PATH = "/api/pair";
 // src/core/sync/client.ts
 init_node();
 init_crdt();
 function getPeer(db, url2) {
-  const row = db.query("SELECT pull_cursor, push_cursor FROM peers WHERE url = ?").get(url2);
-  return row ?? { pull_cursor: 0, push_cursor: 0 };
+  const row = db.query("SELECT pull_cursor, push_cursor, token FROM peers WHERE url = ?").get(url2);
+  return row ?? { pull_cursor: 0, push_cursor: 0, token: null };
 }
 function setPeer(db, url2, c) {
   db.query("INSERT INTO peers (url, pull_cursor, push_cursor) VALUES (?, ?, ?) ON CONFLICT(url) DO UPDATE SET pull_cursor = excluded.pull_cursor, push_cursor = excluded.push_cursor").run(url2, c.pull_cursor, c.push_cursor);
 }
-async function syncWithPeer(db, url2) {
+async function syncWithPeer(db, url2, token) {
   const node = getNodeId(db);
   const peer = getPeer(db, url2);
+  const bearer = token ?? peer.token ?? undefined;
   const toPush = changesAfterSeq(db, peer.push_cursor);
+  const headers = { "content-type": "application/json" };
+  if (bearer)
+    headers.authorization = `Bearer ${bearer}`;
   const res = await fetch(new URL(SYNC_PATH, url2), {
     method: "POST",
-    headers: { "content-type": "application/json" },
+    headers,
     body: JSON.stringify({ node_id: node, since: peer.pull_cursor, changes: toPush.changes })
   });
   if (!res.ok)
@@ -16549,10 +16671,108 @@ async function syncWithPeer(db, url2) {
 }
 // src/core/sync/server.ts
 init_node();
+
+// src/core/sync/token.ts
+init_ids();
+var K_TOKEN = "auth_token";
+var K_EXP = "auth_token_exp";
+var K_PREV = "auth_token_prev";
+var K_PREV_EXP = "auth_token_prev_exp";
+function parseDuration(s, fallbackMs) {
+  if (!s)
+    return fallbackMs;
+  const m = /^(\d+)\s*(ms|s|m|h|d)?$/.exec(s.trim());
+  if (!m)
+    return fallbackMs;
+  const n = Number(m[1]);
+  switch (m[2]) {
+    case "ms":
+      return n;
+    case "m":
+      return n * 60000;
+    case "h":
+      return n * 3600000;
+    case "d":
+      return n * 86400000;
+    default:
+      return n * 1000;
+  }
+}
+var DAY = 86400000;
+var DEFAULT_TTL_MS = parseDuration(process.env.METAHUB_TOKEN_TTL, 30 * DAY);
+var DEFAULT_GRACE_MS = parseDuration(process.env.METAHUB_TOKEN_GRACE, 7 * DAY);
+function getMeta(db, key) {
+  const row = db.query("SELECT value FROM meta WHERE key = ?").get(key);
+  return row ? row.value : null;
+}
+function setMeta(db, key, value) {
+  db.query("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+}
+function readState(db) {
+  const token = getMeta(db, K_TOKEN);
+  if (!token)
+    return null;
+  const prev = getMeta(db, K_PREV);
+  return {
+    token,
+    exp: Number(getMeta(db, K_EXP) ?? 0),
+    prev: prev && prev.length > 0 ? prev : null,
+    prevExp: Number(getMeta(db, K_PREV_EXP) ?? 0)
+  };
+}
+function rotate(db, ttlMs, graceMs) {
+  const now = Date.now();
+  const old = getMeta(db, K_TOKEN);
+  const next = {
+    token: randomSuffix(24),
+    exp: now + ttlMs,
+    prev: old,
+    prevExp: old ? now + graceMs : 0
+  };
+  setMeta(db, K_TOKEN, next.token);
+  setMeta(db, K_EXP, String(next.exp));
+  setMeta(db, K_PREV, next.prev ?? "");
+  setMeta(db, K_PREV_EXP, String(next.prevExp));
+  return next;
+}
+function loadOrRotate(db, ttlMs, graceMs) {
+  const s = readState(db);
+  if (!s || Date.now() > s.exp)
+    return rotate(db, ttlMs, graceMs);
+  return s;
+}
+
+// src/core/config.ts
+var K_HOST = "cfg_host";
+var K_PORT = "cfg_port";
+var K_SYNC_INTERVAL = "cfg_sync_interval";
+var K_AUTO_SYNC = "cfg_auto_sync";
+var DEFAULT_CONFIG = {
+  host: "127.0.0.1",
+  port: 7777,
+  syncIntervalMs: parseDuration(process.env.METAHUB_SYNC_INTERVAL, 30000),
+  autoSync: true
+};
+function getMeta2(db, key) {
+  const row = db.query("SELECT value FROM meta WHERE key = ?").get(key);
+  return row ? row.value : null;
+}
+function getServerConfig(db) {
+  const host = getMeta2(db, K_HOST);
+  const port = getMeta2(db, K_PORT);
+  const interval = getMeta2(db, K_SYNC_INTERVAL);
+  const auto = getMeta2(db, K_AUTO_SYNC);
+  return {
+    host: host ?? DEFAULT_CONFIG.host,
+    port: port != null ? Number(port) : DEFAULT_CONFIG.port,
+    syncIntervalMs: interval != null ? Number(interval) : DEFAULT_CONFIG.syncIntervalMs,
+    autoSync: auto != null ? auto === "1" : DEFAULT_CONFIG.autoSync
+  };
+}
 // package.json
 var package_default = {
   name: "@tensorix/metahub",
-  version: "0.1.2",
+  version: "0.1.3",
   description: "Metahub core library and CLI",
   type: "module",
   main: "./dist/index.js",
@@ -16581,6 +16801,7 @@ var package_default = {
     test: "bun test"
   },
   dependencies: {
+    "@clack/prompts": "^1.5.0",
     citty: "^0.1.6",
     "highlight.js": "^11.11.1",
     preact: "^10.29.2",
@@ -16657,7 +16878,8 @@ var RecordValuesReq = exports_external.record(exports_external.string(), exports
 var CreateDocumentReq = exports_external.object({
   title: exports_external.string(),
   body: exports_external.string().optional(),
-  database_id: exports_external.string().optional()
+  database_id: exports_external.string().optional(),
+  parent_id: exports_external.string().optional()
 });
 var UpdateDocumentReq = exports_external.object({
   title: exports_external.string().optional(),
@@ -16835,9 +17057,9 @@ var webuiRoutes = [
   {
     method: "GET",
     path: "/api/documents",
-    summary: "List documents. Optional query: ?db=<id>",
+    summary: "List documents. Optional query: ?db=<id> or ?parent=<id>",
     response: exports_external.array(DocumentSummarySchema),
-    handler: handle((req, { db }) => listDocuments(db, { database_id: opt(req, "db") }))
+    handler: handle((req, { db }) => listDocuments(db, { database_id: opt(req, "db"), parent_id: opt(req, "parent") }))
   },
   {
     method: "POST",
@@ -16937,6 +17159,250 @@ var sitesRoutes = [
   }
 ];
 
+// src/core/sync/pairing.ts
+init_ids();
+
+// src/core/sync/peers.ts
+function listPeers(db) {
+  return db.query("SELECT url, pull_cursor, push_cursor, token, label, node_id, enabled, last_sync_at, last_status, last_error FROM peers ORDER BY url").all();
+}
+function addPeer(db, input) {
+  db.query(`INSERT INTO peers (url, token, label, node_id, enabled, pull_cursor, push_cursor)
+     VALUES (?, ?, ?, ?, 1, 0, 0)
+     ON CONFLICT(url) DO UPDATE SET
+       token   = coalesce(excluded.token, peers.token),
+       label   = coalesce(excluded.label, peers.label),
+       node_id = coalesce(excluded.node_id, peers.node_id),
+       enabled = 1`).run(input.url, input.token ?? null, input.label ?? null, input.node_id ?? null);
+}
+function removePeer(db, url2) {
+  const tx = db.transaction(() => {
+    const changed = db.query("DELETE FROM peers WHERE url = ?").run(url2).changes > 0;
+    db.query("DELETE FROM peer_grants WHERE peer_url = ?").run(url2);
+    return changed;
+  });
+  return tx();
+}
+function setPeerEnabled(db, url2, enabled) {
+  return db.query("UPDATE peers SET enabled = ? WHERE url = ?").run(enabled ? 1 : 0, url2).changes > 0;
+}
+function setPeerLabel(db, url2, label) {
+  return db.query("UPDATE peers SET label = ? WHERE url = ?").run(label, url2).changes > 0;
+}
+function updatePeerStatus(db, url2, status, error51) {
+  db.query("UPDATE peers SET last_sync_at = ?, last_status = ?, last_error = ? WHERE url = ?").run(Date.now(), status, error51 ?? null, url2);
+}
+async function syncPeer(db, url2) {
+  try {
+    const result = await syncWithPeer(db, url2);
+    updatePeerStatus(db, url2, "ok", null);
+    return { url: url2, ok: true, pushed: result.pushed, pulled: result.pulled };
+  } catch (e) {
+    const error51 = e.message;
+    updatePeerStatus(db, url2, "error", error51);
+    return { url: url2, ok: false, error: error51 };
+  }
+}
+async function syncAllPeers(db) {
+  const peers = listPeers(db).filter((p) => p.enabled);
+  const out = [];
+  for (const p of peers)
+    out.push(await syncPeer(db, p.url));
+  return out;
+}
+
+// src/core/sync/pairing.ts
+var DEFAULT_PAIR_TTL_MS = parseDuration(process.env.METAHUB_PAIR_TTL, 10 * 60000);
+function generatePairingCode(db, ttlMs = DEFAULT_PAIR_TTL_MS) {
+  const now = Date.now();
+  db.query("DELETE FROM pairing_codes WHERE used = 1 OR exp < ?").run(now);
+  const code = randomSuffix(12);
+  const exp = now + ttlMs;
+  db.query("INSERT INTO pairing_codes (code, exp, used, created_at) VALUES (?, ?, 0, ?)").run(code, exp, now);
+  return { code, exp };
+}
+function redeemPairingCode(db, code) {
+  return db.query("UPDATE pairing_codes SET used = 1 WHERE code = ? AND used = 0 AND exp >= ?").run(code, Date.now()).changes > 0;
+}
+function mintGrant(db, peerUrl, nodeId) {
+  const token = randomSuffix(32);
+  db.query("INSERT INTO peer_grants (token, peer_url, node_id, created_at) VALUES (?, ?, ?, ?)").run(token, peerUrl, nodeId, Date.now());
+  return token;
+}
+function isAcceptedGrant(db, token) {
+  return db.query("SELECT 1 FROM peer_grants WHERE token = ?").get(token) != null;
+}
+function listGrants(db) {
+  return db.query("SELECT token, peer_url, node_id, created_at FROM peer_grants ORDER BY created_at DESC").all();
+}
+function revokeGrant(db, tokenOrPrefix) {
+  return db.query("DELETE FROM peer_grants WHERE token = ? OR token LIKE ? || '%'").run(tokenOrPrefix, tokenOrPrefix).changes;
+}
+function handlePairRequest(db, node, body) {
+  if (!redeemPairingCode(db, body.code)) {
+    throw new Error("invalid or expired pairing code");
+  }
+  if (body.self_url) {
+    addPeer(db, { url: body.self_url, token: body.grant, node_id: body.node_id });
+  }
+  const grant = mintGrant(db, body.self_url ?? null, body.node_id);
+  return { node_id: node, grant };
+}
+async function performPairing(db, node, remoteUrl, code, selfUrl) {
+  const ourGrant = mintGrant(db, remoteUrl, null);
+  const reqBody = { code, node_id: node, grant: ourGrant, self_url: selfUrl };
+  const res = await fetch(new URL(PAIR_PATH, remoteUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(reqBody)
+  });
+  if (!res.ok)
+    throw new Error(`pairing failed: ${res.status} ${await res.text()}`);
+  const data = await res.json();
+  addPeer(db, { url: remoteUrl, token: data.grant, node_id: data.node_id });
+  return { node_id: data.node_id, url: remoteUrl };
+}
+
+// src/core/sync/peers-routes.ts
+var PeerSchema = exports_external.object({
+  url: exports_external.string(),
+  pull_cursor: exports_external.number(),
+  push_cursor: exports_external.number(),
+  token: exports_external.string().nullable(),
+  label: exports_external.string().nullable(),
+  node_id: exports_external.string().nullable(),
+  enabled: exports_external.number(),
+  last_sync_at: exports_external.number().nullable(),
+  last_status: exports_external.string().nullable(),
+  last_error: exports_external.string().nullable()
+});
+var PairingCodeSchema = exports_external.object({ code: exports_external.string(), exp: exports_external.number() });
+var AddPeerReq = exports_external.object({
+  url: exports_external.string(),
+  code: exports_external.string(),
+  self_url: exports_external.string().optional()
+});
+var AddPeerRes = exports_external.object({ node_id: exports_external.string(), url: exports_external.string() });
+var UpdatePeerReq = exports_external.object({
+  enabled: exports_external.boolean().optional(),
+  label: exports_external.string().optional()
+});
+var PeerSyncRes = exports_external.object({
+  url: exports_external.string(),
+  ok: exports_external.boolean(),
+  pushed: exports_external.number().optional(),
+  pulled: exports_external.number().optional(),
+  error: exports_external.string().optional()
+});
+var GrantSchema = exports_external.object({
+  token: exports_external.string(),
+  peer_url: exports_external.string().nullable(),
+  node_id: exports_external.string().nullable(),
+  created_at: exports_external.number().nullable()
+});
+var RevokeRes = exports_external.object({ revoked: exports_external.number() });
+var OkSchema2 = exports_external.object({ ok: exports_external.boolean() });
+function need3(req, key) {
+  const v = new URL(req.url).searchParams.get(key);
+  if (!v)
+    throw new Error(`missing query param: ${key}`);
+  return v;
+}
+function handle3(fn) {
+  return async (req, ctx) => {
+    try {
+      const out = await fn(req, ctx);
+      if (out instanceof Response)
+        return out;
+      return Response.json(out ?? null);
+    } catch (e) {
+      return Response.json({ error: e.message }, { status: 400 });
+    }
+  };
+}
+var peersRoutes = [
+  {
+    method: "POST",
+    path: PAIR_PATH,
+    summary: "Pairing handshake: redeem a one-time code and exchange credentials",
+    request: PairRequestSchema,
+    response: PairResponseSchema,
+    handler: handle3(async (req, { db, node }) => {
+      const body = await req.json();
+      return handlePairRequest(db, node, body);
+    })
+  },
+  {
+    method: "POST",
+    path: "/api/pair/new",
+    summary: "Mint a one-time pairing code for another device to redeem",
+    response: PairingCodeSchema,
+    handler: handle3((_req, { db }) => generatePairingCode(db))
+  },
+  {
+    method: "POST",
+    path: "/api/peers/pair",
+    summary: "Pair this server with a remote one using its one-time code",
+    request: AddPeerReq,
+    response: AddPeerRes,
+    handler: handle3(async (req, { db, node }) => {
+      const body = await req.json();
+      return performPairing(db, node, body.url, body.code, body.self_url);
+    })
+  },
+  {
+    method: "GET",
+    path: "/api/peers",
+    summary: "List configured sync peers with status",
+    response: exports_external.array(PeerSchema),
+    handler: handle3((_req, { db }) => listPeers(db))
+  },
+  {
+    method: "PATCH",
+    path: "/api/peer",
+    summary: "Update a peer (enable/disable or label). Query: ?url=<url>",
+    request: UpdatePeerReq,
+    response: OkSchema2,
+    handler: handle3(async (req, { db }) => {
+      const url2 = need3(req, "url");
+      const body = await req.json();
+      if (body.enabled != null)
+        setPeerEnabled(db, url2, body.enabled);
+      if (body.label != null)
+        setPeerLabel(db, url2, body.label);
+      return { ok: true };
+    })
+  },
+  {
+    method: "DELETE",
+    path: "/api/peer",
+    summary: "Remove a sync peer. Query: ?url=<url>",
+    response: OkSchema2,
+    handler: handle3((req, { db }) => ({ ok: removePeer(db, need3(req, "url")) }))
+  },
+  {
+    method: "POST",
+    path: "/api/peer/sync",
+    summary: "Manually sync once with a peer. Query: ?url=<url>",
+    response: PeerSyncRes,
+    handler: handle3((req, { db }) => syncPeer(db, need3(req, "url")))
+  },
+  {
+    method: "GET",
+    path: "/api/grants",
+    summary: "List credentials this server issued and accepts on /sync (inbound)",
+    response: exports_external.array(GrantSchema),
+    handler: handle3((_req, { db }) => listGrants(db))
+  },
+  {
+    method: "DELETE",
+    path: "/api/grant",
+    summary: "Revoke an issued credential by token or prefix. Query: ?token=<token>",
+    response: RevokeRes,
+    handler: handle3((req, { db }) => ({ revoked: revokeGrant(db, need3(req, "token")) }))
+  }
+];
+
 // src/core/sync/routes.ts
 var syncRoutes = [
   {
@@ -16962,77 +17428,7 @@ var syncRoutes = [
     }
   }
 ];
-var routes = [...syncRoutes, ...webuiRoutes, ...sitesRoutes];
-
-// src/core/sync/token.ts
-init_ids();
-var K_TOKEN = "auth_token";
-var K_EXP = "auth_token_exp";
-var K_PREV = "auth_token_prev";
-var K_PREV_EXP = "auth_token_prev_exp";
-function parseDuration(s, fallbackMs) {
-  if (!s)
-    return fallbackMs;
-  const m = /^(\d+)\s*(ms|s|m|h|d)?$/.exec(s.trim());
-  if (!m)
-    return fallbackMs;
-  const n = Number(m[1]);
-  switch (m[2]) {
-    case "ms":
-      return n;
-    case "m":
-      return n * 60000;
-    case "h":
-      return n * 3600000;
-    case "d":
-      return n * 86400000;
-    default:
-      return n * 1000;
-  }
-}
-var DAY = 86400000;
-var DEFAULT_TTL_MS = parseDuration(process.env.METAHUB_TOKEN_TTL, 30 * DAY);
-var DEFAULT_GRACE_MS = parseDuration(process.env.METAHUB_TOKEN_GRACE, 7 * DAY);
-function getMeta(db, key) {
-  const row = db.query("SELECT value FROM meta WHERE key = ?").get(key);
-  return row ? row.value : null;
-}
-function setMeta(db, key, value) {
-  db.query("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
-}
-function readState(db) {
-  const token = getMeta(db, K_TOKEN);
-  if (!token)
-    return null;
-  const prev = getMeta(db, K_PREV);
-  return {
-    token,
-    exp: Number(getMeta(db, K_EXP) ?? 0),
-    prev: prev && prev.length > 0 ? prev : null,
-    prevExp: Number(getMeta(db, K_PREV_EXP) ?? 0)
-  };
-}
-function rotate(db, ttlMs, graceMs) {
-  const now = Date.now();
-  const old = getMeta(db, K_TOKEN);
-  const next = {
-    token: randomSuffix(24),
-    exp: now + ttlMs,
-    prev: old,
-    prevExp: old ? now + graceMs : 0
-  };
-  setMeta(db, K_TOKEN, next.token);
-  setMeta(db, K_EXP, String(next.exp));
-  setMeta(db, K_PREV, next.prev ?? "");
-  setMeta(db, K_PREV_EXP, String(next.prevExp));
-  return next;
-}
-function loadOrRotate(db, ttlMs, graceMs) {
-  const s = readState(db);
-  if (!s || Date.now() > s.exp)
-    return rotate(db, ttlMs, graceMs);
-  return s;
-}
+var routes = [...syncRoutes, ...webuiRoutes, ...sitesRoutes, ...peersRoutes];
 
 // src/core/sync/openapi.ts
 function buildOpenApi(version2) {
@@ -17101,6 +17497,17 @@ function hasValidToken(req, url2, cfg) {
     return true;
   return extractToken(req, url2) === cur.token;
 }
+function acceptsSyncToken(req, url2, cfg, db) {
+  if (!authActive(cfg))
+    return true;
+  const presented = extractToken(req, url2);
+  if (!presented)
+    return false;
+  const cur = activeToken(cfg);
+  if (cur && presented === cur.token)
+    return true;
+  return isAcceptedGrant(db, presented);
+}
 function renewToken(req, url2, cfg) {
   if (cfg.debug || cfg.staticToken != null || !cfg.db)
     return null;
@@ -17240,6 +17647,11 @@ function startServer(opts = {}) {
   const db = openMetahub();
   const node = getNodeId(db);
   const ctx = { db, node };
+  const cfg = getServerConfig(db);
+  const port = opts.port ?? cfg.port;
+  const host = opts.host ?? cfg.host;
+  const syncIntervalMs = opts.syncIntervalMs ?? cfg.syncIntervalMs;
+  const autoSync = opts.autoSync ?? cfg.autoSync;
   const auth = opts.debug ? { debug: true, staticToken: null, db: null, ttlMs: 0, graceMs: 0 } : opts.token ? { debug: false, staticToken: opts.token, db: null, ttlMs: 0, graceMs: 0 } : {
     debug: false,
     staticToken: null,
@@ -17248,13 +17660,18 @@ function startServer(opts = {}) {
     graceMs: DEFAULT_GRACE_MS
   };
   const server = Bun.serve({
-    port: opts.port ?? 7777,
-    hostname: opts.host ?? "127.0.0.1",
+    port,
+    hostname: host,
     async fetch(req) {
       const url2 = new URL(req.url);
-      const exempt = url2.pathname === SYNC_PATH || url2.pathname === HEALTH_PATH || url2.pathname === RENEW_PATH;
-      if (!exempt && !hasValidToken(req, url2, auth)) {
-        return wantsHtml(req) ? new Response(unlockPage(), { headers: HTML_HEADERS }) : unauthorized();
+      if (url2.pathname === SYNC_PATH) {
+        if (!acceptsSyncToken(req, url2, auth, db))
+          return unauthorized();
+      } else {
+        const exempt = url2.pathname === HEALTH_PATH || url2.pathname === RENEW_PATH || url2.pathname === PAIR_PATH;
+        if (!exempt && !hasValidToken(req, url2, auth)) {
+          return wantsHtml(req) ? new Response(unlockPage(), { headers: HTML_HEADERS }) : unauthorized();
+        }
       }
       if (url2.pathname === RENEW_PATH) {
         const r = renewToken(req, url2, auth);
@@ -17284,13 +17701,25 @@ function startServer(opts = {}) {
       return new Response("not found", { status: 404 });
     }
   });
+  let timer = null;
+  if (autoSync && syncIntervalMs > 0) {
+    timer = setInterval(() => {
+      syncAllPeers(db).catch(() => {});
+    }, syncIntervalMs);
+    timer.unref?.();
+  }
   const active = activeToken(auth);
   return {
     server,
     node,
-    port: server.port ?? opts.port ?? 7777,
+    port: server.port ?? port,
     token: active?.token ?? null,
-    exp: active?.exp ?? null
+    exp: active?.exp ?? null,
+    stop() {
+      if (timer)
+        clearInterval(timer);
+      server.stop();
+    }
   };
 }
 export {
@@ -17324,6 +17753,7 @@ export {
   newId,
   moveRecord,
   migrateRecords,
+  migratePeers,
   metahubHome,
   maybeAutoIndex,
   makeId,
@@ -17380,10 +17810,13 @@ export {
   SyncRequestSchema,
   SYNC_PATH,
   RENEW_PATH,
+  PairResponseSchema,
+  PairRequestSchema,
   PROP_TYPES,
+  PAIR_PATH,
   HealthResponseSchema,
   HEALTH_PATH,
   ChangeSchema
 };
 
-//# debugId=884E1F97976309E464756E2164756E21
+//# debugId=52E20C0E56A04E8A64756E2164756E21