@tensorix/metahub 0.2.0 → 0.2.2

package/dist/core/blobs.d.ts

@@ -97,4 +97,14 @@ export declare function clearCache(db: DbDriver): Promise<ClearResult>;
 /** Drop bytes for blobs no live site_files / doc image still references (true
  *  garbage, distinct from clearable cache). */
 export declare function gcOrphans(db: DbDriver): Promise<GcResult>;
+/** Clear a CHOSEN subset of cached blobs — the per-blob counterpart of
+ *  clearCache, for the Settings blob manager. Same safety floor: only a blob that
+ *  is unpinned AND isClearable (durable on the designated full set) has its bytes
+ *  dropped; everything else is left in place and counted as skipped. */
+export declare function clearBlobs(db: DbDriver, hashes: string[]): Promise<ClearResult>;
+/** Delete a CHOSEN subset of ORPHAN blobs — the per-blob counterpart of gcOrphans.
+ *  A hash is removed only when no live site_files / doc image still references it;
+ *  any still-referenced (or unknown) hash is skipped, so a blob a document points
+ *  at can never be deleted out from under it. */
+export declare function deleteOrphanBlobs(db: DbDriver, hashes: string[]): Promise<GcResult>;
 //# sourceMappingURL=blobs.d.ts.map

package/dist/core/blobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../src/core/blobs.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsB5C,cAAc,iBAAiB,CAAC;AAEhC,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;8EAG8E;AAC9E,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,WAAW,EAAE,CAYxD;AAWD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgCxF;AAID,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB;oFACgF;IAChF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAqBD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAoD9E;AAED,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsClF;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BzF;AAED,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAiBjD;AAED;kFACkF;AAClF,wBAAsB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAgBnE;AAED;+CAC+C;AAC/C,wBAAsB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY/D"}
+{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../src/core/blobs.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsB5C,cAAc,iBAAiB,CAAC;AAEhC,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;8EAG8E;AAC9E,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,WAAW,EAAE,CAYxD;AAWD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgCxF;AAID,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB;oFACgF;IAChF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAqBD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAoD9E;AAED,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsClF;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BzF;AAED,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAiBjD;AAED;kFACkF;AAClF,wBAAsB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAgBnE;AAED;+CAC+C;AAC/C,wBAAsB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY/D;AAED;;;wEAGwE;AACxE,wBAAsB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBrF;AAED;;;iDAGiD;AACjD,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAazF"}

package/dist/core/cache.d.ts

@@ -18,6 +18,11 @@ export declare function verifyBlobBytes(bytes: Uint8Array, hash: string): boolea
 /** Store bytes content-addressed under cache/. Returns its hash + path. */
 export declare function putBlob(data: ArrayBuffer | Uint8Array | string): Promise<BlobInfo>;
 export declare function getBlob(hash: string): Promise<Uint8Array | null>;
+/** Whether this node currently holds a blob's bytes on disk — a cheap existence
+ *  check (no read). Use over the ledger when correctness depends on the bytes
+ *  actually being present (e.g. answering a peer's "do you hold X" before it
+ *  drops its own copy), since the ledger can lag a vanished file. */
+export declare function blobExists(hash: string): Promise<boolean>;
 /** Store bytes under a GIVEN content hash (not recomputed) — for caching a blob
  *  fetched from a peer/bucket by its reference, which may be a legacy 64-hex hash
  *  that putBlob's truncation would not reproduce. Returns the byte length. */

package/dist/core/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/core/cache.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;kFAEkF;AAClF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,oCAAoC;AACpC,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAInD;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAElD;AAED;gFACgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,2EAA2E;AAC3E,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWxF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAItE;AAED;;8EAE8E;AAC9E,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhF;AAED,8EAA8E;AAC9E,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9D"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/core/cache.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;kFAEkF;AAClF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,oCAAoC;AACpC,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAInD;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAElD;AAED;gFACgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,2EAA2E;AAC3E,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWxF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAItE;AAED;;;qEAGqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzD;AAED;;8EAE8E;AAC9E,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhF;AAED,8EAA8E;AAC9E,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9D"}

package/dist/core/config.d.ts

@@ -1,4 +1,8 @@
 import type { DbDriver } from "./driver.ts";
+/** Authoritative upper bound for a single POST /api/blob upload (bytes). The
+ *  WebUI applies friendlier per-kind caps (image 25MB / av 100MB / file 100MB)
+ *  client-side; this is the hard server ceiling. Override with METAHUB_MAX_BLOB_UPLOAD. */
+export declare const MAX_BLOB_UPLOAD_BYTES: number;
 export interface ServerConfig {
     host: string;
     port: number;

package/dist/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAS5C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB;+EAC2E;IAC3E,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,YAM5B,CAAC;AAeF,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,YAAY,CAc1D;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAS1F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C;;2FAE2F;AAC3F,eAAO,MAAM,qBAAqB,QAAmE,CAAC;AAQtG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB;+EAC2E;IAC3E,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,YAM5B,CAAC;AAeF,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,YAAY,CAc1D;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAS1F"}

package/dist/core/crdt.d.ts

@@ -11,6 +11,13 @@ export interface Change {
 /** Oplog SELECT list, locked to the Change interface (also reused by history). */
 export declare const CHANGE_COLS: readonly ["hlc", "node_id", "dataset", "row_id", "col", "value", "txn"];
 export declare const CHANGE_SELECT: string;
+/**
+ * Run `fn` with every emit stamped with `node` as its node_id (and HLC node
+ * segment) instead of the host node. INVARIANT: relies on core mutators being
+ * synchronous (set/clear around one synchronous call) — do not make the wrapped
+ * mutators async or the slot can leak across requests.
+ */
+export declare function withNodeId<T>(node: string | null, fn: () => T): T;
 /**
  * Run `fn` with all emits stamped with one shared txn id. Nested calls keep the
  * outermost group (a revert that calls updateDocument is ONE revision). `label`

package/dist/core/crdt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crdt.d.ts","sourceRoot":"","sources":["../../src/core/crdt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAW5C,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,kFAAkF;AAClF,eAAO,MAAM,WAAW,yEAA0E,CAAC;AAEnG,eAAO,MAAM,aAAa,QAAyB,CAAC;AAMpD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAQvE;AAED,+DAA+D;AAC/D,wBAAgB,OAAO,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,EAC5C,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,EACrB,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAEnB;AAkJD;;;;;;mDAMmD;AACnD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,GAAG,WAAW,CAiBhE;AAED,6EAA6E;AAC7E,wBAAgB,IAAI,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,MAAM,CAaR;AAED,yDAAyD;AACzD,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,EAAE,CAMV;AAED;;;;4DAI4D;AAC5D,wBAAgB,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAW9D;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAIlE;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,gBAAqB,GAC1B,WAAW,CAkCb"}
+{"version":3,"file":"crdt.d.ts","sourceRoot":"","sources":["../../src/core/crdt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAW5C,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,kFAAkF;AAClF,eAAO,MAAM,WAAW,yEAA0E,CAAC;AAEnG,eAAO,MAAM,aAAa,QAAyB,CAAC;AAapD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAQjE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAQvE;AAED,+DAA+D;AAC/D,wBAAgB,OAAO,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,EAC5C,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,EACrB,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAEnB;AAkJD;;;;;;mDAMmD;AACnD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,GAAG,WAAW,CAiBhE;AAED,6EAA6E;AAC7E,wBAAgB,IAAI,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,MAAM,CAaR;AAED,yDAAyD;AACzD,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,EAAE,CAMV;AAED;;;;4DAI4D;AAC5D,wBAAgB,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAW9D;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAIlE;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,gBAAqB,GAC1B,WAAW,CAkCb"}

package/dist/core/schema-init.d.ts

@@ -12,6 +12,9 @@ export declare function migrateRecords(db: DbDriver): void;
  * enabled/last_sync_at/last_success_at/last_status/last_error). Idempotent —
  * guarded per column, never drops the table so existing replication cursors survive.
  */
+/** Add `served_base` to a `shares` table created before the column existed
+ *  (idempotent). The vestigial s3_* columns are left as-is. */
+export declare function migrateShares(db: DbDriver): void;
 export declare function migratePeers(db: DbDriver): void;
 /**
  * Add the `blank_after` column to a legacy `doc_blocks` table. Idempotent —
@@ -63,6 +66,32 @@ export declare function migrateOplog(db: DbDriver): void;
  * object-key based, never rowids, so they are left intact.
  */
 export declare function migrateCrdtChangesSeq(db: DbDriver): void;
+/**
+ * Migrate legacy storage-peer keys `s3://<bucket>/<prefix>` to the
+ * endpoint-qualified `s3://<host>/<bucket>/<prefix>` so two endpoints sharing a
+ * bucket name (R2/MinIO/COS each have their own namespace) no longer collide and
+ * silently overwrite each other's peer row (and stale cursor). Rewrites all three
+ * places the key is referenced — the peers row, its storage_cursors, and any
+ * blob_policy.fullNodes anchor pointing at the bucket.
+ *
+ * Key derivation goes through the shared `storageUrl` (storage-url.ts) so every
+ * producer — CLI/server, the WebUI worker, and this migration — agrees byte for
+ * byte; otherwise a producer still minting the legacy shape turns the rename into
+ * a permanent whack-a-mole.
+ *
+ * Idempotent — a row already at its endpoint-qualified key produces no rename.
+ * Keyed off config.endpoint (authoritative), so re-running is a no-op.
+ *
+ * Cross-version note: rewriting blob_policy.fullNodes is a CRDT write, so it
+ * replicates. A device still on the old code keeps a legacy-format storage peer
+ * and matches anchors by exact string, so it won't recognize the new-format
+ * anchor until it upgrades — during that window a bucket-anchored device pauses
+ * cache eviction (loss-free: bytes stay, nothing is dropped) and self-heals once
+ * the fleet is upgraded. Only affects setups that designate a bucket as a
+ * full-blob anchor. (Accepted over a tolerant-matcher rewrite, which is wider and
+ * still can't fix already-shipped old clients.)
+ */
+export declare function migrateStoragePeerUrls(db: DbDriver): void;
 /** Bring a freshly opened (or legacy) database to the current schema. */
 export declare function initSchema(db: DbDriver): void;
 //# sourceMappingURL=schema-init.d.ts.map

package/dist/core/schema-init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-init.d.ts","sourceRoot":"","sources":["../../src/core/schema-init.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5C,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAO5C;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAKlD;AAeD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAuBjD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAsB/C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAGnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAQnD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAInD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAG/C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CA4BxD;AAED,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAS7C"}
+{"version":3,"file":"schema-init.d.ts","sourceRoot":"","sources":["../../src/core/schema-init.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAO5C,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAO5C;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAKlD;AAeD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAuBjD;AAED;;;;GAIG;AACH;+DAC+D;AAC/D,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAGhD;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAsB/C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAGnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAQnD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAInD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAG/C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CA4BxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAuDzD;AAED,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAW7C"}

package/dist/core/schema.d.ts

@@ -1,3 +1,3 @@
-export declare const CORE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS meta (\n  key   TEXT PRIMARY KEY,\n  value TEXT\n);\n\n-- CRDT oplog: one row per field assignment. Source of truth for sync.\n-- txn groups the changes of one logical mutation for history rendering\n-- (nullable: legacy rows and changes from pre-txn peers have none).\n--\n-- seq is an explicit AUTOINCREMENT id used as the replication cursor. It must\n-- be a declared INTEGER PRIMARY KEY (not the implicit rowid): VACUUM renumbers\n-- the rowids of tables that lack one, which would shift them below a peer's\n-- stored push/pull cursor and silently strand every write in the gap.\n-- AUTOINCREMENT additionally guarantees ids are never reused. The\n-- (dataset,row_id,col,hlc) tuple stays UNIQUE so applyChange's INSERT OR IGNORE\n-- dedup is unchanged. Legacy databases are rebuilt into this shape by\n-- migrateCrdtChangesSeq (schema-init.ts).\nCREATE TABLE IF NOT EXISTS crdt_changes (\n  seq     INTEGER PRIMARY KEY AUTOINCREMENT,\n  hlc     TEXT NOT NULL,\n  node_id TEXT NOT NULL,\n  dataset TEXT NOT NULL,\n  row_id  TEXT NOT NULL,\n  col     TEXT NOT NULL,\n  value   TEXT,\n  txn     TEXT,\n  UNIQUE (dataset, row_id, col, hlc)\n);\nCREATE INDEX IF NOT EXISTS idx_changes_hlc ON crdt_changes(hlc);\n-- Serves history's \"every block ever attached to this doc\" lookup. Partial so\n-- it never indexes the large values other datasets carry (e.g. site file bodies).\nCREATE INDEX IF NOT EXISTS idx_changes_docref ON crdt_changes(value)\n  WHERE dataset = 'doc_blocks' AND col = 'doc_id';\n\n-- Per-peer replication cursors (crdt_changes.seq: AUTOINCREMENT, monotonic in\n-- insertion order and stable across VACUUM, so no change is ever skipped\n-- regardless of HLC/clock skew). Outbound side of\n-- a pairing: \"token\" is the credential the *remote* issued to us (sent as a\n-- Bearer header when we sync to them). See migratePeers in db.ts for the columns\n-- added to legacy databases.\n--\n-- kind selects the transport: 'http' (POST /sync to a peer server, the classic\n-- path) or 's3' (an S3-compatible bucket used as dumb store-and-forward \u2014 see\n-- sync/storage.ts). For 's3' peers url is a synthetic key (s3://<bucket>/<prefix>)\n-- and config holds the bucket settings + credentials + master key as JSON.\n-- Like the rest of peers, config is local-only and never enters the CRDT oplog.\nCREATE TABLE IF NOT EXISTS peers (\n  url          TEXT PRIMARY KEY,\n  pull_cursor  INTEGER NOT NULL DEFAULT 0,\n  push_cursor  INTEGER NOT NULL DEFAULT 0,\n  token        TEXT,\n  label        TEXT,\n  node_id      TEXT,\n  enabled      INTEGER NOT NULL DEFAULT 1,\n  last_sync_at INTEGER,\n  last_success_at INTEGER,\n  last_status  TEXT,\n  last_error   TEXT,\n  kind         TEXT NOT NULL DEFAULT 'http',\n  config       TEXT\n);\n\n-- Per-(storage-peer, remote-node) pull progress: the key of the last oplog\n-- segment we consumed from that node's bucket prefix. HTTP peers use the single\n-- pull_cursor above; storage peers need one cursor per remote node because each\n-- node publishes its own segment stream under its own prefix. last_key is a\n-- bucket object key (lexicographically ordered = chronological), so LIST\n-- start-after resumes exactly where we left off.\nCREATE TABLE IF NOT EXISTS storage_cursors (\n  peer_url TEXT NOT NULL,\n  node_id  TEXT NOT NULL,\n  last_key TEXT,\n  PRIMARY KEY (peer_url, node_id)\n);\n\n-- Inbound side of a pairing: credentials *we* issued to remote devices. A peer\n-- presents one of these on /sync; acceptsSyncToken() checks it alongside the\n-- managed master token. Revoke by deleting the row.\nCREATE TABLE IF NOT EXISTS peer_grants (\n  token      TEXT PRIMARY KEY,\n  peer_url   TEXT,\n  node_id    TEXT,\n  created_at INTEGER\n);\n\n-- One-time pairing codes minted by \"mh config peer code\" / POST /api/pair/new.\n-- Short-lived and single-use: redeemed during the pairing handshake, then the\n-- two devices exchange durable peer_grants. used/exp gate redemption.\nCREATE TABLE IF NOT EXISTS pairing_codes (\n  code       TEXT PRIMARY KEY,\n  exp        INTEGER NOT NULL,\n  used       INTEGER NOT NULL DEFAULT 0,\n  created_at INTEGER\n);\n\nCREATE TABLE IF NOT EXISTS databases (\n  id          TEXT PRIMARY KEY,\n  name        TEXT,\n  icon        TEXT,\n  created_hlc TEXT,\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n\nCREATE TABLE IF NOT EXISTS properties (\n  id          TEXT PRIMARY KEY,\n  database_id TEXT,\n  name        TEXT,\n  type        TEXT,\n  config      TEXT,\n  position    REAL,\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_properties_db ON properties(database_id);\n\n-- One row per record. Field cells live in the data JSON object, keyed by\n-- property id (rename-safe). Each (record,property) is still an independent\n-- CRDT register in the oplog; materialize() folds the winner into data via\n-- json_set/json_remove. Hot fields get expression indexes on data->>'propid'\n-- (see indexing.ts) so filter/sort/limit push down to SQL.\nCREATE TABLE IF NOT EXISTS records (\n  id          TEXT PRIMARY KEY,\n  database_id TEXT,\n  created_hlc TEXT,\n  order_key   TEXT,\n  data        TEXT NOT NULL DEFAULT '{}',\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_records_db_hlc ON records(database_id, created_hlc);\n\nCREATE TABLE IF NOT EXISTS documents (\n  id          TEXT PRIMARY KEY,\n  title       TEXT,\n  body        TEXT,        -- materialized cache: serialized from doc_blocks\n  database_id TEXT,\n  parent_id   TEXT,\n  created_hlc TEXT,\n  order_key   TEXT,        -- fractional index among siblings (same parent_id); ties broken by created_hlc,id\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n\n-- Document body as an ordered list of blocks; each (block,field) is an\n-- independent CRDT register so concurrent edits to different blocks merge.\n-- order_key is a fractional index (ties broken by id) giving display order.\nCREATE TABLE IF NOT EXISTS doc_blocks (\n  id          TEXT PRIMARY KEY,\n  doc_id      TEXT,\n  text        TEXT,\n  order_key   TEXT,\n  blank_after INTEGER NOT NULL DEFAULT 0,  -- extra blank lines kept after this block (user spacing)\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_doc_blocks_doc ON doc_blocks(doc_id);\n\n-- A named static site (Supabase-Storage-style bucket). Served at /sites/<name>/.\nCREATE TABLE IF NOT EXISTS sites (\n  id          TEXT PRIMARY KEY,\n  name        TEXT,        -- URL slug; resolved by getSiteByName\n  title       TEXT,\n  created_hlc TEXT,\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n\n-- One row per file in a site. content holds inline utf8/base64 text, or a blob\n-- hash (see cache.ts) when encoding = 'blob'. (site_id, path) maps to a stable\n-- id so re-uploads merge as a CRDT register instead of duplicating.\nCREATE TABLE IF NOT EXISTS site_files (\n  id           TEXT PRIMARY KEY,\n  site_id      TEXT,\n  path         TEXT,\n  content_type TEXT,\n  encoding     TEXT,       -- 'utf8' | 'base64' | 'blob'\n  content      TEXT,\n  created_hlc  TEXT,\n  __deleted    INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_site_files_site ON site_files(site_id);\n\n-- Node-local blob cache ledger (NOT synced, like peers/storage_cursors): one row\n-- per blob byte-file held in cache.ts's content-addressed store (~/.metahub/cache).\n-- Gives the bare hash-named files the metadata clearing/stats need. hash is the\n-- canonical content key (sha256 truncated to 32 hex; legacy 64-hex coexist).\n-- pending = bytes produced HERE not yet confirmed flushed to a durable anchor\n-- (bucket) \u2014 the only blobs a device must protect; never auto-evicted/cleared.\n-- pending=0 means a flushed production OR an acquired cache, both safely\n-- clearable (re-fetchable). This local fact replaces the old SYNCED blob_presence\n-- table \u2014 clearing is now purely local/offline. See blobs.ts / 22-blob-sync.\nCREATE TABLE IF NOT EXISTS blob_cache (\n  hash         TEXT PRIMARY KEY,\n  size         INTEGER NOT NULL,\n  content_type TEXT,\n  last_access  INTEGER,\n  pinned       INTEGER NOT NULL DEFAULT 0, -- node-local: never auto-evicted / cleared\n  pending      INTEGER NOT NULL DEFAULT 1, -- produced here, not yet flushed to anchor\n  anchored     INTEGER NOT NULL DEFAULT 0  -- node-local: last verify confirmed a designated anchor holds it (per redundancy). Drives isClearable; reset on policy change\n);\n\n-- Synced workspace policy (single row \"default\"): which nodes are designated\n-- full-blob libraries \u2014 the durable anchor in no-bucket topologies (they pull\n-- everything and never clear). full_nodes is a JSON array of node_id; redundancy\n-- is retained but unused since clearing moved to the local pending model.\nCREATE TABLE IF NOT EXISTS blob_policy (\n  id          TEXT PRIMARY KEY,  -- always \"default\"\n  full_nodes  TEXT,              -- JSON array of node_id\n  redundancy  TEXT,              -- 'all' | 'any'\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n";
+export declare const CORE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS meta (\n  key   TEXT PRIMARY KEY,\n  value TEXT\n);\n\n-- CRDT oplog: one row per field assignment. Source of truth for sync.\n-- txn groups the changes of one logical mutation for history rendering\n-- (nullable: legacy rows and changes from pre-txn peers have none).\n--\n-- seq is an explicit AUTOINCREMENT id used as the replication cursor. It must\n-- be a declared INTEGER PRIMARY KEY (not the implicit rowid): VACUUM renumbers\n-- the rowids of tables that lack one, which would shift them below a peer's\n-- stored push/pull cursor and silently strand every write in the gap.\n-- AUTOINCREMENT additionally guarantees ids are never reused. The\n-- (dataset,row_id,col,hlc) tuple stays UNIQUE so applyChange's INSERT OR IGNORE\n-- dedup is unchanged. Legacy databases are rebuilt into this shape by\n-- migrateCrdtChangesSeq (schema-init.ts).\nCREATE TABLE IF NOT EXISTS crdt_changes (\n  seq     INTEGER PRIMARY KEY AUTOINCREMENT,\n  hlc     TEXT NOT NULL,\n  node_id TEXT NOT NULL,\n  dataset TEXT NOT NULL,\n  row_id  TEXT NOT NULL,\n  col     TEXT NOT NULL,\n  value   TEXT,\n  txn     TEXT,\n  UNIQUE (dataset, row_id, col, hlc)\n);\nCREATE INDEX IF NOT EXISTS idx_changes_hlc ON crdt_changes(hlc);\n-- Serves history's \"every block ever attached to this doc\" lookup. Partial so\n-- it never indexes the large values other datasets carry (e.g. site file bodies).\nCREATE INDEX IF NOT EXISTS idx_changes_docref ON crdt_changes(value)\n  WHERE dataset = 'doc_blocks' AND col = 'doc_id';\n\n-- Per-peer replication cursors (crdt_changes.seq: AUTOINCREMENT, monotonic in\n-- insertion order and stable across VACUUM, so no change is ever skipped\n-- regardless of HLC/clock skew). Outbound side of\n-- a pairing: \"token\" is the credential the *remote* issued to us (sent as a\n-- Bearer header when we sync to them). See migratePeers in db.ts for the columns\n-- added to legacy databases.\n--\n-- kind selects the transport: 'http' (POST /sync to a peer server, the classic\n-- path) or 's3' (an S3-compatible bucket used as dumb store-and-forward \u2014 see\n-- sync/storage.ts). For 's3' peers url is a synthetic key (s3://<bucket>/<prefix>)\n-- and config holds the bucket settings + credentials + master key as JSON.\n-- Like the rest of peers, config is local-only and never enters the CRDT oplog.\nCREATE TABLE IF NOT EXISTS peers (\n  url          TEXT PRIMARY KEY,\n  pull_cursor  INTEGER NOT NULL DEFAULT 0,\n  push_cursor  INTEGER NOT NULL DEFAULT 0,\n  token        TEXT,\n  label        TEXT,\n  node_id      TEXT,\n  enabled      INTEGER NOT NULL DEFAULT 1,\n  last_sync_at INTEGER,\n  last_success_at INTEGER,\n  last_status  TEXT,\n  last_error   TEXT,\n  kind         TEXT NOT NULL DEFAULT 'http',\n  config       TEXT\n);\n\n-- Per-(storage-peer, remote-node) pull progress: the key of the last oplog\n-- segment we consumed from that node's bucket prefix. HTTP peers use the single\n-- pull_cursor above; storage peers need one cursor per remote node because each\n-- node publishes its own segment stream under its own prefix. last_key is a\n-- bucket object key (lexicographically ordered = chronological), so LIST\n-- start-after resumes exactly where we left off.\nCREATE TABLE IF NOT EXISTS storage_cursors (\n  peer_url TEXT NOT NULL,\n  node_id  TEXT NOT NULL,\n  last_key TEXT,\n  PRIMARY KEY (peer_url, node_id)\n);\n\n-- Inbound side of a pairing: credentials *we* issued to remote devices. A peer\n-- presents one of these on /sync; acceptsSyncToken() checks it alongside the\n-- managed master token. Revoke by deleting the row.\nCREATE TABLE IF NOT EXISTS peer_grants (\n  token      TEXT PRIMARY KEY,\n  peer_url   TEXT,\n  node_id    TEXT,\n  created_at INTEGER\n);\n\n-- One-time pairing codes minted by \"mh config peer code\" / POST /api/pair/new.\n-- Short-lived and single-use: redeemed during the pairing handshake, then the\n-- two devices exchange durable peer_grants. used/exp gate redemption.\nCREATE TABLE IF NOT EXISTS pairing_codes (\n  code       TEXT PRIMARY KEY,\n  exp        INTEGER NOT NULL,\n  used       INTEGER NOT NULL DEFAULT 0,\n  created_at INTEGER\n);\n\n-- Public capability links to a doc / database / site. Like peers and blob_cache\n-- this is node-local and deliberately ABSENT from crdt.ts's DOMAIN map, so it\n-- never enters the oplog and never syncs \u2014 a share is a property of the access\n-- point that minted it, not of the workspace. slug is the unguessable capability\n-- in the URL (/share/<slug>). transport selects how it's served: 'server' (the\n-- token-exempt /share endpoint on this node) or 's3' (a presigned static export\n-- under <prefix>/shares/<slug> in a bucket). permission 'edit' is server-only:\n-- a presigned static object can't accept writes. guest_node_id attributes every\n-- edit made through an edit-share to one synthetic node (see crdt.ts withNodeId).\n-- pw_hash/pw_salt: server path stores a PBKDF2 verifier; the s3 path is E2EE so\n-- only pw_salt travels (in the link) and decryption happens in the viewer.\nCREATE TABLE IF NOT EXISTS shares (\n  slug             TEXT PRIMARY KEY,\n  kind             TEXT NOT NULL,   -- 'doc' | 'database' | 'site'\n  target_id        TEXT NOT NULL,   -- documents.id / databases.id / sites.id\n  permission       TEXT NOT NULL,   -- 'view' | 'edit'\n  transport        TEXT NOT NULL,   -- 'server' | 's3'\n  pw_salt          TEXT,            -- base64; null = no password\n  pw_hash          TEXT,            -- base64 PBKDF2 verifier (server path only)\n  expires_at       INTEGER,         -- epoch ms; null = never\n  guest_node_id    TEXT,            -- synthetic node id for edit shares (null for view)\n  served_base      TEXT,            -- reachable base URL chosen at creation (link / source label)\n  s3_peer_url      TEXT,            -- vestigial (s3 shares live in the bucket, not here)\n  s3_object_prefix TEXT,            -- vestigial\n  s3_presign_exp   INTEGER,         -- vestigial\n  s3_key_b64       TEXT,            -- vestigial\n  created_at       INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_shares_target ON shares(target_id);\n\nCREATE TABLE IF NOT EXISTS databases (\n  id          TEXT PRIMARY KEY,\n  name        TEXT,\n  icon        TEXT,\n  created_hlc TEXT,\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n\nCREATE TABLE IF NOT EXISTS properties (\n  id          TEXT PRIMARY KEY,\n  database_id TEXT,\n  name        TEXT,\n  type        TEXT,\n  config      TEXT,\n  position    REAL,\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_properties_db ON properties(database_id);\n\n-- One row per record. Field cells live in the data JSON object, keyed by\n-- property id (rename-safe). Each (record,property) is still an independent\n-- CRDT register in the oplog; materialize() folds the winner into data via\n-- json_set/json_remove. Hot fields get expression indexes on data->>'propid'\n-- (see indexing.ts) so filter/sort/limit push down to SQL.\nCREATE TABLE IF NOT EXISTS records (\n  id          TEXT PRIMARY KEY,\n  database_id TEXT,\n  created_hlc TEXT,\n  order_key   TEXT,\n  data        TEXT NOT NULL DEFAULT '{}',\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_records_db_hlc ON records(database_id, created_hlc);\n\nCREATE TABLE IF NOT EXISTS documents (\n  id          TEXT PRIMARY KEY,\n  title       TEXT,\n  body        TEXT,        -- materialized cache: serialized from doc_blocks\n  database_id TEXT,\n  parent_id   TEXT,\n  created_hlc TEXT,\n  order_key   TEXT,        -- fractional index among siblings (same parent_id); ties broken by created_hlc,id\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n\n-- Document body as an ordered list of blocks; each (block,field) is an\n-- independent CRDT register so concurrent edits to different blocks merge.\n-- order_key is a fractional index (ties broken by id) giving display order.\nCREATE TABLE IF NOT EXISTS doc_blocks (\n  id          TEXT PRIMARY KEY,\n  doc_id      TEXT,\n  text        TEXT,\n  order_key   TEXT,\n  blank_after INTEGER NOT NULL DEFAULT 0,  -- extra blank lines kept after this block (user spacing)\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_doc_blocks_doc ON doc_blocks(doc_id);\n\n-- A named static site (Supabase-Storage-style bucket). Served at /sites/<name>/.\nCREATE TABLE IF NOT EXISTS sites (\n  id          TEXT PRIMARY KEY,\n  name        TEXT,        -- URL slug; resolved by getSiteByName\n  title       TEXT,\n  created_hlc TEXT,\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n\n-- One row per file in a site. content holds inline utf8/base64 text, or a blob\n-- hash (see cache.ts) when encoding = 'blob'. (site_id, path) maps to a stable\n-- id so re-uploads merge as a CRDT register instead of duplicating.\nCREATE TABLE IF NOT EXISTS site_files (\n  id           TEXT PRIMARY KEY,\n  site_id      TEXT,\n  path         TEXT,\n  content_type TEXT,\n  encoding     TEXT,       -- 'utf8' | 'base64' | 'blob'\n  content      TEXT,\n  created_hlc  TEXT,\n  __deleted    INTEGER NOT NULL DEFAULT 0\n);\nCREATE INDEX IF NOT EXISTS idx_site_files_site ON site_files(site_id);\n\n-- Node-local blob cache ledger (NOT synced, like peers/storage_cursors): one row\n-- per blob byte-file held in cache.ts's content-addressed store (~/.metahub/cache).\n-- Gives the bare hash-named files the metadata clearing/stats need. hash is the\n-- canonical content key (sha256 truncated to 32 hex; legacy 64-hex coexist).\n-- pending = bytes produced HERE not yet confirmed flushed to a durable anchor\n-- (bucket) \u2014 the only blobs a device must protect; never auto-evicted/cleared.\n-- pending=0 means a flushed production OR an acquired cache, both safely\n-- clearable (re-fetchable). This local fact replaces the old SYNCED blob_presence\n-- table \u2014 clearing is now purely local/offline. See blobs.ts / 22-blob-sync.\nCREATE TABLE IF NOT EXISTS blob_cache (\n  hash         TEXT PRIMARY KEY,\n  size         INTEGER NOT NULL,\n  content_type TEXT,\n  last_access  INTEGER,\n  pinned       INTEGER NOT NULL DEFAULT 0, -- node-local: never auto-evicted / cleared\n  pending      INTEGER NOT NULL DEFAULT 1, -- produced here, not yet flushed to anchor\n  anchored     INTEGER NOT NULL DEFAULT 0  -- node-local: last verify confirmed a designated anchor holds it (per redundancy). Drives isClearable; reset on policy change\n);\n\n-- Synced workspace policy (single row \"default\"): which nodes are designated\n-- full-blob libraries \u2014 the durable anchor in no-bucket topologies (they pull\n-- everything and never clear). full_nodes is a JSON array of node_id; redundancy\n-- is retained but unused since clearing moved to the local pending model.\nCREATE TABLE IF NOT EXISTS blob_policy (\n  id          TEXT PRIMARY KEY,  -- always \"default\"\n  full_nodes  TEXT,              -- JSON array of node_id\n  redundancy  TEXT,              -- 'all' | 'any'\n  __deleted   INTEGER NOT NULL DEFAULT 0\n);\n";
 export declare const FTS_SCHEMA = "\nCREATE VIRTUAL TABLE IF NOT EXISTS search_fts USING fts5(\n  kind UNINDEXED,\n  id UNINDEXED,\n  database_id UNINDEXED,\n  title,\n  body\n);\n";
 //# sourceMappingURL=schema.d.ts.map

package/dist/core/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,80RA+MvB,CAAC;AAGF,eAAO,MAAM,UAAU,sJAQtB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,kxVA6OvB,CAAC;AAGF,eAAO,MAAM,UAAU,sJAQtB,CAAC"}

package/dist/core/shares.d.ts

@@ -0,0 +1,60 @@
+import type { DbDriver } from "./driver.ts";
+export type ShareKind = "doc" | "database" | "site";
+export type SharePermission = "view" | "edit";
+export type ShareTransport = "server" | "s3";
+export interface ShareRow {
+    slug: string;
+    kind: ShareKind;
+    target_id: string;
+    permission: SharePermission;
+    transport: ShareTransport;
+    /** base64 salt; null = no password. */
+    pw_salt: string | null;
+    /** base64 PBKDF2 verifier — server path only (s3 password is client-side E2EE). */
+    pw_hash: string | null;
+    /** epoch ms; null = never. */
+    expires_at: number | null;
+    /** synthetic node id every edit through this share is attributed to (edit only). */
+    guest_node_id: string | null;
+    /** Reachable base URL chosen at creation (for the link / source label). */
+    served_base: string | null;
+    s3_peer_url: string | null;
+    s3_object_prefix: string | null;
+    s3_presign_exp: number | null;
+    s3_key_b64: string | null;
+    created_at: number;
+}
+export interface CreateShareInput {
+    kind: ShareKind;
+    target_id: string;
+    permission?: SharePermission;
+    /** base64 salt + verifier (server path); produce with hashSharePassword. */
+    pwSalt?: string | null;
+    pwHash?: string | null;
+    expiresAt?: number | null;
+    /** Reachable base URL recorded for the link / source label. */
+    servedBase?: string | null;
+}
+/**
+ * Mint a server-transport share row. (Object-storage shares are NOT stored here —
+ * they live in the bucket; see sync/share-export.ts.) Validates enums + the
+ * `edit ⇒ server` rule and allocates an unguessable slug (+ guest node for edit).
+ * The caller verifies that `target_id` exists.
+ */
+export declare function createShare(db: DbDriver, input: CreateShareInput): ShareRow;
+export declare function getShare(db: DbDriver, slug: string): ShareRow | null;
+export declare function listShares(db: DbDriver): ShareRow[];
+/** Shares pointing at one target — used to surface existing links in the UI. */
+export declare function listSharesForTarget(db: DbDriver, targetId: string): ShareRow[];
+export declare function deleteShare(db: DbDriver, slug: string): boolean;
+/** True once a share is past its expiry (null expiry = never expires). */
+export declare function shareExpired(row: ShareRow, now?: number): boolean;
+/** Derive a fresh {salt, hash} verifier for the server-path password. */
+export declare function hashSharePassword(password: string): Promise<{
+    salt: string;
+    hash: string;
+}>;
+/** Constant-time check of `password` against a share's stored verifier. A share
+ *  with no password always returns true (nothing to verify). */
+export declare function verifySharePassword(row: ShareRow, password: string): Promise<boolean>;
+//# sourceMappingURL=shares.d.ts.map

package/dist/core/shares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shares.d.ts","sourceRoot":"","sources":["../../src/core/shares.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5C,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAC9C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,IAAI,CAAC;AAI7C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,EAAE,cAAc,CAAC;IAC1B,uCAAuC;IACvC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oFAAoF;IACpF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAKD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,GAAG,QAAQ,CA+B3E;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAKpE;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAInD;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,EAAE,CAI9E;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,SAAa,GAAG,OAAO,CAErE;AA+BD,yEAAyE;AACzE,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAIjG;AAED;gEACgE;AAChE,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK3F"}

package/dist/core/sites-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites-core.d.ts","sourceRoot":"","sources":["../../src/core/sites-core.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM5C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,SAAS,iDAAkD,CAAC;AAIzE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAE3D,eAAO,MAAM,cAAc,2EAEjB,CAAC;AAEX,eAAO,MAAM,gBAAgB,QAA4B,CAAC;AA+B1D,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAID,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIhE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAcxE;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAIjD;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAWjF;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CAMzE;AAQD,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAAa,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED;;6CAE6C;AAC7C,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAG3E;AASD,eAAO,MAAM,UAAU;UAEP,MAAM;YAAU,MAAM;aASpC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,UAAU;WAGN,MAAM;YAAU,MAAM;aAWrC,CAAC;AAEH,eAAO,MAAM,UAAU,uCAQrB,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CAeb;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,WAAW,CAoBb;AAED,eAAO,MAAM,UAAU,yDAarB,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D"}
+{"version":3,"file":"sites-core.d.ts","sourceRoot":"","sources":["../../src/core/sites-core.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM5C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,SAAS,iDAAkD,CAAC;AAIzE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAE3D,eAAO,MAAM,cAAc,2EAEjB,CAAC;AAEX,eAAO,MAAM,gBAAgB,QAA4B,CAAC;AA4D1D,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAID,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIhE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAcxE;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAIjD;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAWjF;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CAMzE;AAQD,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAAa,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED;;6CAE6C;AAC7C,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAG3E;AASD,eAAO,MAAM,UAAU;UAEP,MAAM;YAAU,MAAM;aASpC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,UAAU;WAGN,MAAM;YAAU,MAAM;aAWrC,CAAC;AAEH,eAAO,MAAM,UAAU,uCAQrB,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CAeb;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,WAAW,CAoBb;AAED,eAAO,MAAM,UAAU,yDAarB,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D"}

package/dist/core/sites.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../src/core/sites.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EACL,KAAK,WAAW,EAUjB,MAAM,iBAAiB,CAAC;AAczB,cAAc,iBAAiB,CAAC;AAEhC;;yEAEyE;AACzE,wBAAsB,OAAO,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAe5D"}
+{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../src/core/sites.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EACL,KAAK,WAAW,EAUjB,MAAM,iBAAiB,CAAC;AAezB,cAAc,iBAAiB,CAAC;AAEhC;;yEAEyE;AACzE,wBAAsB,OAAO,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,WAAW,CAAC,CAetB;AASD,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAuB5D"}

package/dist/core/sync/auth.d.ts

@@ -6,6 +6,15 @@ export interface AuthConfig {
     ttlMs: number;
     graceMs: number;
 }
+/**
+ * When a request authenticated via a `?token=` query param and carries no cookie
+ * yet, return the `Set-Cookie` to persist it; otherwise null. A `/?token=...`
+ * link (QR / "copy login link") authorizes only that one navigation — without
+ * this, the browser's follow-up /webui.css, /webui.js etc. carry no credential
+ * and 401, serving a broken page. Setting the cookie on the HTML response lets
+ * those same-origin sub-requests ride it automatically.
+ */
+export declare function queryTokenCookie(req: Request, url: URL, cfg: AuthConfig): string | null;
 export declare function extractToken(req: Request, url: URL): string | null;
 /** Whether auth is on at all (so the gate runs and the fetch shim is injected). */
 export declare function authActive(cfg: AuthConfig): boolean;
@@ -40,8 +49,12 @@ export declare function unlockPage(): string;
 export declare function injectShim(html: string): string;
 /** Inject the page runtime into HTML responses. Unconditional (unlike the old
  *  token-only shim): the offline bridge matters even in --debug mode where
- *  auth is off — the token half simply no-ops without a stored token. */
-export declare function withShim(res: Response, _cfg: AuthConfig): Promise<Response>;
+ *  auth is off — the token half simply no-ops without a stored token.
+ *
+ *  When `req`/`url` are supplied and the navigation authenticated via a `?token=`
+ *  query param, persist that token as the mh_token cookie on this HTML response
+ *  so the browser's follow-up asset requests (/webui.css, /webui.js) carry it. */
+export declare function withShim(res: Response, cfg: AuthConfig, req?: Request, url?: URL): Promise<Response>;
 export declare function unauthorized(): Response;
 export { HTML_HEADERS };
 //# sourceMappingURL=auth.d.ts.map

package/dist/core/sync/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/sync/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAI9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAO/F;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,UAAU,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUvC;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/C;AAED,QAAA,MAAM,YAAY;;CAAiD,CAAC;AAEpE,sFAAsF;AACtF,wBAAgB,UAAU,IAAI,MAAM,CAoDnC;AAYD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;yEAEyE;AACzE,wBAAsB,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAMjF;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAEvC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/sync/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAMvF;AAYD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAI9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAO/F;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,UAAU,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUvC;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/C;AAED,QAAA,MAAM,YAAY;;CAAiD,CAAC;AAEpE,sFAAsF;AACtF,wBAAgB,UAAU,IAAI,MAAM,CAqDnC;AAYD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;;;;kFAMkF;AAClF,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,OAAO,EACb,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAEvC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/core/sync/blob-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blob-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/blob-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAyBvE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqBrF;AAgBD,eAAO,MAAM,UAAU,EAAE,KAAK,EAkD7B,CAAC"}
+{"version":3,"file":"blob-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/blob-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAkDvE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqBrF;AAgBD,eAAO,MAAM,UAAU,EAAE,KAAK,EAoE7B,CAAC"}

package/dist/core/sync/client.d.ts

@@ -2,6 +2,11 @@ import type { DbDriver } from "../driver.ts";
 export interface SyncResult {
     pushed: number;
     pulled: number;
+    /** Response page size (changes the peer returned this round), independent of
+     *  how many were new to our oplog. Pagination must break on this, NOT on
+     *  `pulled`: a page of all-known changes ingests 0 but may not be the last
+     *  page (e.g. after a cursor reset re-pulls data we already hold). */
+    received?: number;
     /** Storage-sync only: local own ops exist but were deferred by push batching. */
     pendingPush?: boolean;
 }

package/dist/core/sync/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/core/sync/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAyB7C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAQ,GAAG,MAAW,GAC3B,OAAO,CAAC,UAAU,CAAC,CAmCrB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/core/sync/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAyB7C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;0EAGsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAQ,GAAG,MAAW,GAC3B,OAAO,CAAC,UAAU,CAAC,CAqCrB"}

package/dist/core/sync/e2ee.d.ts

@@ -17,6 +17,13 @@ export declare function wrapMasterKey(rawKey: Uint8Array, passphrase: string): P
 /** Recover the master key from the envelope + passphrase. Throws `auth` on a
  *  wrong passphrase (the GCM tag won't verify) or a malformed envelope. */
 export declare function unwrapMasterKey(env: KeyEnvelope, passphrase: string): Promise<Uint8Array>;
+/**
+ * Derive a raw 32-byte content key from a share password + salt (same PBKDF2
+ * parameters as the bucket KEK). Used by the object-storage share path: the
+ * exporter and the in-browser viewer both derive the identical key, so a wrong
+ * password simply fails the GCM tag on decrypt — no server-side verifier needed.
+ */
+export declare function deriveShareKey(password: string, salt: Uint8Array): Promise<Uint8Array>;
 /** Encrypt arbitrary bytes (a compressed segment/snapshot) → iv ‖ ciphertext. */
 export declare function encryptBytes(rawKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
 /** Inverse of encryptBytes. Throws `auth` if the key is wrong or data tampered. */

package/dist/core/sync/e2ee.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"e2ee.d.ts","sourceRoot":"","sources":["../../../src/core/sync/e2ee.ts"],"names":[],"mappings":"AAkCA,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAK/C;AAID,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,UAAU,CAE9C;AAmBD,kFAAkF;AAClF,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBhG;AAED;2EAC2E;AAC3E,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAc/F;AAWD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUjG;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAU/F"}
+{"version":3,"file":"e2ee.d.ts","sourceRoot":"","sources":["../../../src/core/sync/e2ee.ts"],"names":[],"mappings":"AAkCA,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAK/C;AAID,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,UAAU,CAE9C;AAmBD,kFAAkF;AAClF,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBhG;AAED;2EAC2E;AAC3E,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAc/F;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAc5F;AAWD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUjG;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAU/F"}

package/dist/core/sync/peers.d.ts

@@ -37,8 +37,7 @@ export interface AddStoragePeerInput {
 }
 /** Upsert an 's3' (bucket store-and-forward) peer, preserving cursors on conflict. */
 export declare function addStoragePeer(db: DbDriver, input: AddStoragePeerInput): void;
-/** Synthetic peer key for a storage peer: one per bucket+prefix. */
-export declare const storageUrl: (bucket: string, prefix: string) => string;
+export { storageUrl, storageEndpointHost } from "./storage-url.ts";
 export interface StoragePeerSpec {
     endpoint: string;
     region?: string;

package/dist/core/sync/peers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAWtB,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAEjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAU7E;AAmCD,oEAAoE;AACpE,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,QAAQ,MAAM,WAA+B,CAAC;AAEzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BnE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAS7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAWN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;6DAE6D;AAC7D,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,GACnC,OAAO,CAAC,eAAe,CAAC,CAa1B;AAiCD,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAWtB,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAEjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAU7E;AAsCD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BnE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAS7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAWN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;6DAE6D;AAC7D,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,GACnC,OAAO,CAAC,eAAe,CAAC,CAa1B;AAiCD,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/core/sync/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAmBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CA+NnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAmBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CAqPnE"}

package/dist/core/sync/share-actions.d.ts

@@ -0,0 +1,69 @@
+import type { DbDriver } from "../driver.ts";
+import { type ShareKind, type SharePermission } from "../shares.ts";
+export interface CreateShareRequest {
+    kind: ShareKind;
+    ref: string;
+    permission?: SharePermission;
+    transport?: "server" | "s3";
+    password?: string | null;
+    /** Server: any duration (ms); null = never. s3: clamped to ≤7d; default 7d. */
+    expiresMs?: number | null;
+    /** server transport target: a paired peer url → create remotely on that peer;
+     *  any other base url (this node's origin / LAN / domain) → create locally and
+     *  record it as served_base; undefined → local with no recorded base. */
+    server?: string | null;
+    /** s3: which bucket peer url; default the single s3 peer if exactly one. */
+    bucketUrl?: string | null;
+    /** s3 only: the static viewer base for the link. */
+    viewerBase?: string;
+}
+export interface CreatedShare {
+    slug: string;
+    kind: ShareKind;
+    permission: SharePermission;
+    transport: "server" | "s3";
+    /** Full link to copy (server: served_base/share/slug; s3: viewer link). */
+    url: string;
+    expiresAt: number | null;
+    /** Human label of where it's served: a server address or a bucket name. */
+    source: string;
+}
+/** A row in the aggregated share listing (CLI `list` / WebUI panel). */
+export interface ShareListItem {
+    slug: string;
+    kind: string;
+    target_id: string;
+    /** Human title of the shared object (for the management list). */
+    title: string;
+    permission: string;
+    transport: "server" | "s3";
+    source: string;
+    sourceKind: "server" | "peer" | "bucket";
+    expiresAt: number | null;
+    hasPassword: boolean;
+    /** server: ready-to-copy link; s3: omitted (use renew to mint a fresh one). */
+    url?: string;
+}
+/** s3 bucket peers (no secrets) for a transport picker. */
+export declare function listShareBuckets(db: DbDriver): {
+    url: string;
+    label: string;
+}[];
+/** Paired HTTP peer servers (a share can be created on / served by them). */
+export declare function listShareServers(db: DbDriver): {
+    url: string;
+    label: string;
+}[];
+/** Resolve, validate, and create (server local / server remote / s3 bucket) a share. */
+export declare function createShareAction(db: DbDriver, req: CreateShareRequest): Promise<CreatedShare>;
+/** Local listing (server rows + each attached bucket) — NO peer fan-out (so the
+ *  /api/shares endpoint a peer calls can't recurse). Optional target filter. */
+export declare function listSharesLocal(db: DbDriver, targetId?: string): Promise<ShareListItem[]>;
+/** Aggregated listing for CLI/WebUI: local ∪ each paired peer's /api/shares
+ *  (best-effort, bounded), deduped by slug. Optional target filter. */
+export declare function listSharesAggregated(db: DbDriver, targetId?: string): Promise<ShareListItem[]>;
+/** Revoke: local server row → delete it; else a bucket holds it → delete objects. */
+export declare function revokeShareAction(db: DbDriver, slug: string): Promise<boolean>;
+/** Renew an s3 share (re-presign, mint a fresh ≤7d link). */
+export declare function renewShareAction(db: DbDriver, slug: string, viewerBaseOverride?: string): Promise<CreatedShare>;
+//# sourceMappingURL=share-actions.d.ts.map

package/dist/core/sync/share-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-actions.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-actions.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAQ7C,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AActB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,SAAS,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;6EAEyE;IACzE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAiCD,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/E;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/E;AAiCD,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0FpG;AAED;gFACgF;AAChF,wBAAsB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAsC/F;AAED;uEACuE;AACvE,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAepG;AAYD,qFAAqF;AACrF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWpF;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBrH"}

package/dist/core/sync/share-export.d.ts

@@ -0,0 +1,72 @@
+import type { DbDriver } from "../driver.ts";
+import { type S3Config } from "./storage.ts";
+export interface ShareManifest {
+    v: 1;
+    kind: "doc" | "database";
+    title: string;
+    body?: string;
+    properties?: {
+        id: string;
+        name: string;
+        type: string;
+    }[];
+    records?: {
+        cells: Record<string, unknown>;
+    }[];
+    /** hash → { presigned GET of the (encrypted) blob, original content-type }. */
+    blobs?: Record<string, {
+        url: string;
+        ct: string;
+    }>;
+}
+/** Bucket-resident share descriptor (master-key encrypted). The listable source
+ *  of truth for an object-storage share. */
+export interface BucketShareMeta {
+    v: 1;
+    slug: string;
+    kind: "doc" | "database";
+    target_id: string;
+    title: string;
+    permission: "view";
+    created_at: number;
+    /** epoch ms the presigned URLs expire (≤ 7 days out). */
+    presign_exp: number;
+    has_password: boolean;
+    /** every object key this share owns (manifest + each blob) — for renew + delete. */
+    objects: string[];
+    /** base64 per-share content key (lets a bucket-holder renew / re-copy the link). */
+    key: string;
+    /** base64 salt (password shares); the link carries this, viewer derives the key. */
+    salt?: string;
+}
+export interface BucketShareLink {
+    manifestUrl: string;
+    presignExp: number;
+    /** base64 random key (no-password) — goes in the link fragment as #k=. */
+    keyB64?: string;
+    /** base64 salt (password) — goes in the link fragment as #s=. */
+    saltB64?: string;
+    title: string;
+}
+/** Create an object-storage share: write manifest+blobs (per-share-key encrypted)
+ *  then meta.json (master-key encrypted, written LAST so a half-built share is
+ *  never listed), and allow the viewer origin in the bucket's CORS. */
+export declare function createBucketShare(db: DbDriver, opts: {
+    slug: string;
+    kind: "doc" | "database";
+    targetId: string;
+    config: S3Config;
+    password?: string | null;
+    expiresSec: number;
+    viewerOrigin?: string;
+}): Promise<BucketShareLink>;
+/** Renew an object-storage share: re-read the (live) source, re-encrypt with the
+ *  stored per-share key, re-upload + re-presign, refresh meta.json. Works for
+ *  password shares too (the key is stored master-encrypted). */
+export declare function renewBucketShare(db: DbDriver, config: S3Config, slug: string, expiresSec?: number): Promise<BucketShareLink>;
+/** List all object-storage shares in a bucket (decrypts each meta.json). */
+export declare function listBucketShares(config: S3Config): Promise<BucketShareMeta[]>;
+/** Delete a bucket share's objects. meta.json is deleted FIRST so the share
+ *  immediately disappears from listings even if the rest is slow. */
+export declare function deleteBucketShareObjects(config: S3Config, slug: string): Promise<void>;
+//# sourceMappingURL=share-export.d.ts.map

package/dist/core/sync/share-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-export.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-export.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAO7C,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW/D,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;4CAC4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAyGD;;uEAEuE;AACvE,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,eAAe,CAAC,CA0C1B;AAED;;gEAEgE;AAChE,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,SAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAanF;AAED;qEACqE;AACrE,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5F"}

package/dist/core/sync/share-render.d.ts

@@ -0,0 +1,10 @@
+export declare function escapeHtml(s: string): string;
+export interface RenderOpts {
+    /** Rewrite a `/blob/<hash>` URL to a reachable one (scoped endpoint or data URL). */
+    rewriteBlob?: (url: string) => string;
+}
+/** Inline Markdown → HTML: `code`, **bold**, *italic*, [link](url), ![img](url). */
+export declare function renderInline(src: string, opts?: RenderOpts): string;
+/** Render a markdown body to an HTML string (block-level). */
+export declare function renderMarkdown(md: string, opts?: RenderOpts): string;
+//# sourceMappingURL=share-render.d.ts.map

package/dist/core/sync/share-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-render.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-render.ts"],"names":[],"mappings":"AASA,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM5C;AAED,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC;AAOD,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAmBvE;AASD,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAkIxE"}

package/dist/core/sync/share-serve.d.ts

@@ -0,0 +1,3 @@
+import type { RouteCtx } from "./routes.ts";
+export declare function serveShare(req: Request, ctx: RouteCtx): Promise<Response | null>;
+//# sourceMappingURL=share-serve.d.ts.map

package/dist/core/sync/share-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-serve.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAmC5C,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkCtF"}