@tensorix/metahub 0.3.2 → 0.4.0

package/dist/edge-worker.js

@@ -0,0 +1,3960 @@
+// src/room/do-driver.ts
+class DoSqlDriver {
+  storage;
+  changesFnOk = null;
+  constructor(storage) {
+    this.storage = storage;
+  }
+  query(sql) {
+    const self = this;
+    return {
+      get(...params) {
+        const rows = self.storage.sql.exec(sql, ...normalizeBinds(params)).toArray();
+        return rows.length > 0 ? normalizeRow(rows[0]) : null;
+      },
+      all(...params) {
+        return self.storage.sql.exec(sql, ...normalizeBinds(params)).toArray().map(normalizeRow);
+      },
+      run(...params) {
+        const cur = self.storage.sql.exec(sql, ...normalizeBinds(params));
+        cur.toArray();
+        return { changes: self.changes(cur) };
+      }
+    };
+  }
+  exec(sql) {
+    this.storage.sql.exec(sql).toArray();
+  }
+  transaction(fn) {
+    return (...args) => this.storage.transactionSync(() => fn(...args));
+  }
+  changes(cur) {
+    if (this.changesFnOk !== false) {
+      try {
+        const rows = this.storage.sql.exec("SELECT changes() AS c").toArray();
+        this.changesFnOk = true;
+        return Number(rows[0]?.c ?? 0);
+      } catch {
+        this.changesFnOk = false;
+      }
+    }
+    return cur.rowsWritten;
+  }
+}
+function normalizeBinds(params) {
+  return params.map((p) => {
+    if (p === undefined || p === null)
+      return null;
+    if (typeof p === "boolean")
+      return p ? 1 : 0;
+    if (typeof p === "bigint")
+      return Number(p);
+    if (p instanceof Uint8Array) {
+      const buf = new ArrayBuffer(p.byteLength);
+      new Uint8Array(buf).set(p);
+      return buf;
+    }
+    return p;
+  });
+}
+function normalizeRow(row) {
+  for (const k of Object.keys(row)) {
+    const v = row[k];
+    if (v instanceof ArrayBuffer)
+      row[k] = new Uint8Array(v);
+  }
+  return row;
+}
+
+// src/core/errors.ts
+class MhError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "MhError";
+  }
+}
+function errorCode(e) {
+  return e instanceof MhError ? e.code : undefined;
+}
+
+// src/core/sync/http-status.ts
+var STATUS = {
+  invalid_input: 400,
+  not_found: 404,
+  ambiguous: 400,
+  stale: 409,
+  conflict: 409,
+  auth: 401,
+  rate_limited: 429
+};
+function httpStatusForCode(code) {
+  return code ? STATUS[code] ?? 400 : 400;
+}
+function errorBody(e) {
+  const message = e instanceof Error ? e.message : String(e);
+  const code = errorCode(e);
+  return { body: code ? { error: message, code } : { error: message }, status: httpStatusForCode(code) };
+}
+
+// src/core/ids.ts
+var ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz";
+function randomSuffix(len = 6) {
+  const bytes = crypto.getRandomValues(new Uint8Array(len));
+  let out = "";
+  for (const b of bytes)
+    out += ALPHABET.charAt(b % ALPHABET.length);
+  return out;
+}
+function slugify(name, fallback = "item") {
+  const slug = name.normalize("NFKD").replace(/[^\x20-\x7E]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32).replace(/-+$/g, "");
+  return slug || fallback;
+}
+var KINDS = new Set([
+  "db",
+  "prop",
+  "rec",
+  "doc",
+  "blk",
+  "site",
+  "sf",
+  "chan"
+]);
+function newId(kind, name, fallback = kind) {
+  return `${kind}_${slugify(name, fallback)}-${randomSuffix()}`;
+}
+function idKind(id) {
+  const i = id.indexOf("_");
+  if (i <= 0)
+    return null;
+  const prefix = id.slice(0, i);
+  return KINDS.has(prefix) ? prefix : null;
+}
+
+// src/core/node.ts
+function getNodeId(db) {
+  const row = db.query("SELECT value FROM meta WHERE key = 'node_id'").get();
+  if (row)
+    return row.value;
+  const id = randomSuffix(8);
+  db.query("INSERT INTO meta (key, value) VALUES ('node_id', ?)").run(id);
+  return id;
+}
+
+// src/core/hlc.ts
+var MAX_HLC_COUNTER = 65535;
+function carryCounter(millis, counter) {
+  if (counter <= MAX_HLC_COUNTER)
+    return { millis, counter };
+  return {
+    millis: millis + Math.floor(counter / (MAX_HLC_COUNTER + 1)),
+    counter: counter % (MAX_HLC_COUNTER + 1)
+  };
+}
+function formatHlc(h) {
+  const { millis, counter } = carryCounter(h.millis, h.counter);
+  return `${String(millis).padStart(15, "0")}-${counter.toString(16).padStart(4, "0")}-${h.node}`;
+}
+function parseHlc(s) {
+  const i1 = s.indexOf("-");
+  const i2 = s.indexOf("-", i1 + 1);
+  return {
+    millis: Number(s.slice(0, i1)),
+    counter: parseInt(s.slice(i1 + 1, i2), 16),
+    node: s.slice(i2 + 1)
+  };
+}
+function readLast(db, node) {
+  const row = db.query("SELECT value FROM meta WHERE key = 'hlc'").get();
+  return row ? parseHlc(row.value) : { millis: 0, counter: 0, node };
+}
+function writeLast(db, h) {
+  db.query("INSERT INTO meta (key, value) VALUES ('hlc', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(formatHlc(h));
+}
+function nextHlc(db, node, now = Date.now()) {
+  const last = readLast(db, node);
+  const millis = Math.max(last.millis, now);
+  const counter = millis === last.millis ? last.counter + 1 : 0;
+  const h = { ...carryCounter(millis, counter), node };
+  writeLast(db, h);
+  return formatHlc(h);
+}
+function observeHlc(db, node, remote, now = Date.now()) {
+  const last = readLast(db, node);
+  const r = parseHlc(remote);
+  if (!Number.isFinite(r.millis) || !Number.isFinite(r.counter))
+    return;
+  const millis = Math.max(last.millis, r.millis, now);
+  let counter;
+  if (millis === last.millis && millis === r.millis)
+    counter = Math.max(last.counter, r.counter) + 1;
+  else if (millis === last.millis)
+    counter = last.counter + 1;
+  else if (millis === r.millis)
+    counter = r.counter + 1;
+  else
+    counter = 0;
+  writeLast(db, { ...carryCounter(millis, counter), node });
+}
+
+// src/core/blocks.ts
+function parseDocBlocks(md) {
+  if (!md)
+    return [];
+  const lines = md.replace(/\r\n?/g, `
+`).split(`
+`);
+  const blocks = [];
+  let cur = [];
+  let fenceChar = null;
+  let fenceLen = 0;
+  const closeBlock = () => {
+    if (cur.length) {
+      blocks.push({ text: cur.join(`
+`), blankAfter: 0 });
+      cur = [];
+    }
+  };
+  const onBlank = () => {
+    closeBlock();
+    if (blocks.length)
+      blocks[blocks.length - 1].blankAfter++;
+  };
+  for (const raw of lines) {
+    if (fenceChar) {
+      cur.push(raw);
+      const m = raw.match(/^\s*(`{3,}|~{3,})\s*$/);
+      if (m && m[1][0] === fenceChar && m[1].length >= fenceLen) {
+        closeBlock();
+        fenceChar = null;
+        fenceLen = 0;
+      }
+      continue;
+    }
+    const open = raw.match(/^\s*(`{3,}|~{3,})/);
+    if (open) {
+      closeBlock();
+      fenceChar = open[1][0];
+      fenceLen = open[1].length;
+      cur.push(raw);
+    } else if (raw.trim() === "") {
+      onBlank();
+    } else {
+      cur.push(raw);
+    }
+  }
+  closeBlock();
+  for (let i = 0;i < blocks.length - 1; i++)
+    blocks[i].blankAfter = Math.max(0, blocks[i].blankAfter - 1);
+  return blocks;
+}
+function serializeDocBlocks(blocks) {
+  const live = blocks.filter((b) => !!b.text && b.text.length > 0);
+  const out = [];
+  live.forEach((b, i) => {
+    out.push(...b.text.split(`
+`));
+    const extra = Math.max(0, b.blankAfter ?? 0);
+    if (i < live.length - 1)
+      out.push("");
+    for (let k = 0;k < extra; k++)
+      out.push("");
+  });
+  return out.join(`
+`);
+}
+function reconcile(oldTexts, newTexts) {
+  const keep = lcs(oldTexts, newTexts);
+  const keptOld = new Set(keep.map((p) => p[0]));
+  const newToOld = new Map(keep.map((p) => [p[1], p[0]]));
+  const items = newTexts.map((text, ni) => newToOld.has(ni) ? { keep: newToOld.get(ni) } : { insert: text });
+  const deleted = [];
+  for (let oi = 0;oi < oldTexts.length; oi++)
+    if (!keptOld.has(oi))
+      deleted.push(oi);
+  return { items, deleted };
+}
+function lcs(a, b) {
+  const m = a.length;
+  const n = b.length;
+  const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i2 = m - 1;i2 >= 0; i2--)
+    for (let j2 = n - 1;j2 >= 0; j2--)
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+  const pairs = [];
+  let i = 0;
+  let j = 0;
+  while (i < m && j < n) {
+    if (a[i] === b[j]) {
+      pairs.push([i, j]);
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      i++;
+    } else {
+      j++;
+    }
+  }
+  return pairs;
+}
+
+// src/core/intent-retention.ts
+var DAY_MS = 24 * 60 * 60 * 1000;
+var DROP_ENVELOPE_RETENTION_MS = 30 * DAY_MS;
+var INTENT_REPLAY_WINDOW_MS = DROP_ENVELOPE_RETENTION_MS + DAY_MS;
+var INTENT_RECEIPT_DATASET = "intent_receipts";
+function safeNow(now) {
+  return Math.max(0, Math.trunc(Number.isFinite(now) ? now : Date.now()));
+}
+function intentReceiptCutoffHlc(now = Date.now()) {
+  const cutoff = Math.max(0, safeNow(now) - INTENT_REPLAY_WINDOW_MS);
+  return String(cutoff).padStart(15, "0") + "-";
+}
+function isExpiredIntentReceipt(change, now = Date.now()) {
+  return change.dataset === INTENT_RECEIPT_DATASET && change.hlc < intentReceiptCutoffHlc(now);
+}
+function pruneExpiredIntentReceipts(db, now = Date.now()) {
+  return db.query("DELETE FROM crdt_changes WHERE dataset = 'intent_receipts' AND hlc < ?").run(intentReceiptCutoffHlc(now)).changes;
+}
+function intentSubmissionExpired(submittedAt, now = Date.now()) {
+  if (!Number.isFinite(submittedAt))
+    return false;
+  return Math.trunc(submittedAt) < safeNow(now) - INTENT_REPLAY_WINDOW_MS;
+}
+
+// src/core/crdt.ts
+var CHANGE_COLS = ["hlc", "node_id", "dataset", "row_id", "col", "value", "txn"];
+var CHANGE_SELECT = CHANGE_COLS.join(", ");
+var currentTxn = null;
+var currentNodeOverride = null;
+function withNodeId(node, fn) {
+  const prev = currentNodeOverride;
+  currentNodeOverride = node;
+  try {
+    return fn();
+  } finally {
+    currentNodeOverride = prev;
+  }
+}
+function withChangeGroup(label, fn) {
+  if (currentTxn !== null)
+    return fn();
+  currentTxn = (label ? label + ":" : "") + randomSuffix(8);
+  try {
+    return fn();
+  } finally {
+    currentTxn = null;
+  }
+}
+function withTxnId(txn, fn) {
+  const prev = currentTxn;
+  currentTxn = txn;
+  try {
+    return fn();
+  } finally {
+    currentTxn = prev;
+  }
+}
+function grouped(fn, label = null) {
+  return (...args) => withChangeGroup(label, () => fn(...args));
+}
+var DOMAIN = {
+  databases: {
+    table: "databases",
+    cols: new Set(["name", "icon", "meta", "created_hlc", "__deleted"])
+  },
+  properties: {
+    table: "properties",
+    cols: new Set(["database_id", "name", "type", "config", "position", "__deleted"])
+  },
+  documents: {
+    table: "documents",
+    cols: new Set(["title", "body", "database_id", "parent_id", "created_hlc", "order_key", "__deleted"])
+  },
+  doc_blocks: {
+    table: "doc_blocks",
+    cols: new Set(["doc_id", "text", "order_key", "blank_after", "__deleted"])
+  },
+  sites: {
+    table: "sites",
+    cols: new Set(["name", "title", "created_hlc", "visibility", "spa", "public_grants", "__deleted"])
+  },
+  site_channels: {
+    table: "site_channels",
+    cols: new Set([
+      "site_id",
+      "audience",
+      "hosting",
+      "controller_node_id",
+      "target_ref",
+      "canonical_url",
+      "policy_json",
+      "desired_state",
+      "created_hlc",
+      "__deleted"
+    ])
+  },
+  site_files: {
+    table: "site_files",
+    cols: new Set([
+      "site_id",
+      "path",
+      "content_type",
+      "encoding",
+      "content",
+      "created_hlc",
+      "__deleted"
+    ])
+  },
+  blob_policy: {
+    table: "blob_policy",
+    cols: new Set(["full_nodes", "redundancy", "__deleted"])
+  }
+};
+var RECORD_META = new Set(["database_id", "created_hlc", "order_key", "__deleted"]);
+var OPLOG_ONLY_DATASETS = new Set([
+  INTENT_RECEIPT_DATASET
+]);
+var NOT_NULL_ZERO_COLS = new Set([
+  "records:__deleted",
+  "databases:__deleted",
+  "properties:__deleted",
+  "documents:__deleted",
+  "doc_blocks:__deleted",
+  "doc_blocks:blank_after",
+  "sites:__deleted",
+  "sites:spa",
+  "site_channels:__deleted",
+  "site_files:__deleted",
+  "blob_policy:__deleted"
+]);
+function decodeMaterializeValue(dataset, col, valueJson) {
+  if (valueJson !== null)
+    return JSON.parse(valueJson);
+  return NOT_NULL_ZERO_COLS.has(`${dataset}:${col}`) ? 0 : null;
+}
+function encodeScalar(val) {
+  if (val === null || val === undefined)
+    return null;
+  if (typeof val === "boolean")
+    return val ? 1 : 0;
+  if (typeof val === "number")
+    return val;
+  if (typeof val === "string")
+    return val;
+  return JSON.stringify(val);
+}
+function ensureRow(db, table, id) {
+  db.query(`INSERT OR IGNORE INTO ${table} (id) VALUES (?)`).run(id);
+}
+function isBlockManaged(db, docId) {
+  return db.query("SELECT 1 AS x FROM doc_blocks WHERE doc_id = ? LIMIT 1").get(docId) != null;
+}
+function recomputeDocBody(db, docId) {
+  const rows = db.query("SELECT text, blank_after FROM doc_blocks WHERE doc_id = ? AND __deleted = 0 ORDER BY order_key, id").all(docId);
+  ensureRow(db, "documents", docId);
+  db.query("UPDATE documents SET body = ? WHERE id = ?").run(serializeDocBlocks(rows.map((r) => ({ text: r.text, blankAfter: r.blank_after ?? 0 }))), docId);
+}
+function materialize(db, dataset, rowId, col, valueJson) {
+  if (OPLOG_ONLY_DATASETS.has(dataset))
+    return;
+  if (dataset === "records") {
+    if (RECORD_META.has(col)) {
+      ensureRow(db, "records", rowId);
+      const v2 = decodeMaterializeValue("records", col, valueJson);
+      db.query(`UPDATE records SET "${col}" = ? WHERE id = ?`).run(encodeScalar(v2), rowId);
+    } else {
+      ensureRow(db, "records", rowId);
+      if (valueJson === null) {
+        db.query(`UPDATE records SET data = json_remove(data, '$."' || ? || '"') WHERE id = ?`).run(col, rowId);
+      } else {
+        db.query(`UPDATE records SET data = json_set(coalesce(data, '{}'), '$."' || ? || '"', json(?)) WHERE id = ?`).run(col, valueJson, rowId);
+      }
+    }
+    return;
+  }
+  const d = DOMAIN[dataset];
+  if (!d || !d.cols.has(col))
+    return;
+  if (dataset === "documents" && col === "body" && isBlockManaged(db, rowId))
+    return;
+  ensureRow(db, d.table, rowId);
+  const v = decodeMaterializeValue(dataset, col, valueJson);
+  db.query(`UPDATE ${d.table} SET "${col}" = ? WHERE id = ?`).run(encodeScalar(v), rowId);
+  if (dataset === "doc_blocks") {
+    const blk = db.query("SELECT doc_id FROM doc_blocks WHERE id = ?").get(rowId);
+    if (blk?.doc_id)
+      recomputeDocBody(db, blk.doc_id);
+  }
+}
+function applyChange(db, c) {
+  const inserted = db.query("INSERT OR IGNORE INTO crdt_changes (hlc, node_id, dataset, row_id, col, value, txn) VALUES (?, ?, ?, ?, ?, ?, ?)").run(c.hlc, c.node_id, c.dataset, c.row_id, c.col, c.value, c.txn ?? null).changes > 0;
+  const cur = db.query("SELECT MAX(hlc) AS h FROM crdt_changes WHERE dataset = ? AND row_id = ? AND col = ?").get(c.dataset, c.row_id, c.col);
+  if (cur.h !== c.hlc)
+    return { inserted, winner: false };
+  try {
+    materialize(db, c.dataset, c.row_id, c.col, c.value);
+  } catch (e) {
+    if (inserted) {
+      db.query("DELETE FROM crdt_changes WHERE dataset = ? AND row_id = ? AND col = ? AND hlc = ?").run(c.dataset, c.row_id, c.col, c.hlc);
+    }
+    throw e;
+  }
+  return { inserted, winner: true };
+}
+function emit(db, dataset, rowId, col, value) {
+  const node = currentNodeOverride ?? getNodeId(db);
+  const change = {
+    hlc: nextHlc(db, node),
+    node_id: node,
+    dataset,
+    row_id: rowId,
+    col,
+    value: value === undefined ? null : JSON.stringify(value),
+    txn: currentTxn
+  };
+  applyChange(db, change);
+  return change;
+}
+function ingest(db, changes, opts = {}) {
+  const now = opts.now ?? Date.now();
+  pruneExpiredIntentReceipts(db, now);
+  const node = getNodeId(db);
+  let received = 0;
+  let poisoned = 0;
+  const tx = db.transaction((cs) => {
+    for (const c of cs) {
+      if (isExpiredIntentReceipt(c, now))
+        continue;
+      observeHlc(db, node, c.hlc);
+      try {
+        if (applyChange(db, c).inserted)
+          received++;
+      } catch (e) {
+        poisoned++;
+        console.error(`[ingest] skipped a change that failed to apply (dataset=${c.dataset} col=${c.col} row=${c.row_id}): ${e.message}`);
+      }
+    }
+  });
+  tx(changes);
+  if (poisoned)
+    console.error(`[ingest] ${poisoned} change(s) skipped this batch (see above)`);
+  return received;
+}
+
+// src/core/indexing.ts
+var AUTO_INDEX_ROW_THRESHOLD = 2000;
+function sanitize(s) {
+  return s.replace(/[^a-zA-Z0-9_]/g, "_");
+}
+function lit(s) {
+  return s.replace(/'/g, "''");
+}
+function indexName(databaseId, propId) {
+  return `idx_rec_${sanitize(databaseId)}_${sanitize(propId)}`;
+}
+function hasIndex(db, databaseId, propId) {
+  const row = db.query("SELECT 1 AS ok FROM sqlite_master WHERE type = 'index' AND name = ?").get(indexName(databaseId, propId));
+  return row != null;
+}
+function ensurePropIndex(db, databaseId, propId) {
+  const name = indexName(databaseId, propId);
+  db.exec(`CREATE INDEX IF NOT EXISTS "${name}" ON records (data ->> '${lit(propId)}', created_hlc) ` + `WHERE database_id = '${lit(databaseId)}' AND __deleted = 0`);
+}
+function maybeAutoIndex(db, databaseId, prop) {
+  if (hasIndex(db, databaseId, prop.id))
+    return;
+  if (prop.type !== "relation") {
+    const row = db.query("SELECT COUNT(*) AS c FROM records WHERE database_id = ? AND __deleted = 0").get(databaseId);
+    if (row.c < AUTO_INDEX_ROW_THRESHOLD)
+      return;
+  }
+  ensurePropIndex(db, databaseId, prop.id);
+}
+
+// src/core/properties.ts
+var PROP_TYPES = new Set([
+  "text",
+  "number",
+  "checkbox",
+  "select",
+  "multi_select",
+  "date",
+  "relation",
+  "url"
+]);
+var PROPERTY_COLS = ["id", "database_id", "name", "type", "config", "position"];
+var PROPERTY_SELECT = PROPERTY_COLS.join(", ");
+function validateConfig(type, config) {
+  if (type === "select" || type === "multi_select") {
+    const opts = config?.options;
+    if (!Array.isArray(opts) || opts.length === 0 || !opts.every((o) => typeof o === "string"))
+      throw new MhError("invalid_input", `${type} requires config.options: string[]`);
+  }
+  if (type === "relation") {
+    if (typeof config?.database !== "string")
+      throw new MhError("invalid_input", "relation requires config.database (target database id)");
+  }
+}
+function nextPosition(db, databaseId) {
+  const row = db.query("SELECT MAX(position) AS m FROM properties WHERE database_id = ? AND __deleted = 0").get(databaseId);
+  return (row.m ?? 0) + 1;
+}
+var addProperty = grouped(function addProperty2(db, databaseId, opts) {
+  if (!getDatabase(db, databaseId))
+    throw new MhError("not_found", `no such database: ${databaseId}`);
+  if (!PROP_TYPES.has(opts.type))
+    throw new MhError("invalid_input", `unknown property type: ${opts.type}`);
+  validateConfig(opts.type, opts.config);
+  const config = opts.indexed ? { ...opts.config ?? {}, indexed: true } : opts.config ?? null;
+  const id = newId("prop", opts.name);
+  emit(db, "properties", id, "database_id", databaseId);
+  emit(db, "properties", id, "name", opts.name);
+  emit(db, "properties", id, "type", opts.type);
+  emit(db, "properties", id, "config", config);
+  emit(db, "properties", id, "position", opts.position ?? nextPosition(db, databaseId));
+  if (opts.type === "relation" || opts.indexed === true)
+    ensurePropIndex(db, databaseId, id);
+  return getProperty(db, id);
+});
+function getProperty(db, id) {
+  const row = db.query(`SELECT ${PROPERTY_SELECT} FROM properties WHERE id = ? AND __deleted = 0`).get(id);
+  if (!row)
+    return null;
+  return { ...row, config: row.config ? JSON.parse(row.config) : null };
+}
+function listProperties(db, databaseId) {
+  const rows = db.query(`SELECT ${PROPERTY_SELECT} FROM properties WHERE database_id = ? AND __deleted = 0 ORDER BY position`).all(databaseId);
+  return rows.map((r) => ({
+    ...r,
+    config: r.config ? JSON.parse(r.config) : null
+  }));
+}
+var updateProperty = grouped(function updateProperty2(db, id, fields) {
+  const cur = getProperty(db, id);
+  if (!cur)
+    throw new MhError("not_found", `no such property: ${id}`);
+  const typeChanged = fields.type !== undefined && fields.type !== cur.type;
+  if (fields.type !== undefined && !PROP_TYPES.has(fields.type))
+    throw new MhError("invalid_input", `unknown property type: ${fields.type}`);
+  const effectiveType = fields.type ?? cur.type;
+  if (fields.config !== undefined)
+    validateConfig(effectiveType, fields.config);
+  else if (typeChanged)
+    validateConfig(fields.type, undefined);
+  if (fields.name !== undefined)
+    emit(db, "properties", id, "name", fields.name);
+  if (fields.type !== undefined)
+    emit(db, "properties", id, "type", fields.type);
+  if (fields.config !== undefined)
+    emit(db, "properties", id, "config", fields.config);
+  if (fields.position !== undefined)
+    emit(db, "properties", id, "position", fields.position);
+  if (typeChanged) {
+    const rows = db.query("SELECT id FROM records WHERE database_id = ? AND __deleted = 0 AND data ->> ? IS NOT NULL").all(cur.database_id, id);
+    for (const r of rows)
+      emit(db, "records", r.id, id, null);
+  }
+  return getProperty(db, id);
+});
+var removeProperty = grouped(function removeProperty2(db, id) {
+  const prop = getProperty(db, id);
+  if (!prop)
+    return false;
+  emit(db, "properties", id, "__deleted", 1);
+  const rows = db.query("SELECT id FROM records WHERE database_id = ? AND __deleted = 0 AND data ->> ? IS NOT NULL").all(prop.database_id, id);
+  for (const r of rows)
+    emit(db, "records", r.id, id, undefined);
+  return true;
+});
+
+// src/core/resolve.ts
+var SPECS = {
+  db: { table: "databases", nameCol: "name", scoped: false, noun: "database" },
+  prop: { table: "properties", nameCol: "name", scoped: true, noun: "property" },
+  rec: { table: "records", nameCol: null, scoped: true, noun: "record" },
+  doc: { table: "documents", nameCol: "title", scoped: true, noun: "document" }
+};
+var PUBLIC_KINDS = ["db", "prop", "rec", "doc"];
+function isPublic(k) {
+  return k !== null && k !== "blk";
+}
+var HI = "{";
+function titlePropId(db, databaseId) {
+  const row = db.query("SELECT id FROM properties WHERE database_id = ? AND type = 'text' AND __deleted = 0 ORDER BY position LIMIT 1").get(databaseId);
+  return row?.id ?? null;
+}
+function queryKind(db, kind, ref, databaseId) {
+  const spec = SPECS[kind];
+  let nameCol = spec.nameCol;
+  if (kind === "rec" && databaseId) {
+    const tp = titlePropId(db, databaseId);
+    if (tp)
+      nameCol = `data ->> '${tp.replace(/'/g, "''")}'`;
+  }
+  const labelExpr = nameCol ?? "''";
+  const conds = [];
+  const args = [];
+  conds.push("(id >= ? AND id < ?)");
+  args.push(ref, ref + HI);
+  const typed = `${kind}_${ref}`;
+  conds.push("(id >= ? AND id < ?)");
+  args.push(typed, typed + HI);
+  if (nameCol) {
+    conds.push(`lower(${nameCol}) = lower(?)`);
+    args.push(ref);
+  }
+  let sql = `SELECT id, ${labelExpr} AS label FROM ${spec.table} WHERE __deleted = 0 AND (${conds.join(" OR ")})`;
+  if (spec.scoped && databaseId) {
+    sql += " AND database_id = ?";
+    args.push(databaseId);
+  }
+  const rows = db.query(sql).all(...args);
+  return rows.map((r) => ({ kind, id: r.id, label: r.label ?? "" }));
+}
+function resolveCandidates(db, ref, opts = {}) {
+  const kinds = opts.kind ? [opts.kind] : isPublic(idKind(ref)) ? [idKind(ref)] : PUBLIC_KINDS;
+  const out = [];
+  const seen = new Set;
+  for (const k of kinds) {
+    for (const c of queryKind(db, k, ref, opts.databaseId)) {
+      if (seen.has(c.id))
+        continue;
+      seen.add(c.id);
+      out.push(c);
+    }
+  }
+  return out;
+}
+
+// src/core/fracdex.ts
+var DIGITS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+function midpoint(a, b) {
+  const zero = DIGITS[0];
+  if (b !== null && a >= b)
+    throw new Error(`fracdex: ${a} >= ${b}`);
+  if (a.endsWith(zero) || b !== null && b.endsWith(zero))
+    throw new Error(`fracdex: trailing zero in ${a}/${b}`);
+  if (b !== null) {
+    let n = 0;
+    while ((a[n] ?? zero) === b[n])
+      n++;
+    if (n > 0)
+      return b.slice(0, n) + midpoint(a.slice(n), b.slice(n));
+  }
+  const da = a === "" ? 0 : DIGITS.indexOf(a[0]);
+  const db = b === null ? DIGITS.length : DIGITS.indexOf(b[0]);
+  if (db - da > 1) {
+    const mid = Math.round(0.5 * (da + db));
+    return DIGITS[mid];
+  }
+  if (b !== null && b.length > 1)
+    return b.slice(0, 1);
+  return DIGITS[da] + midpoint(a.slice(1), null);
+}
+function keyBetween(a, b) {
+  return midpoint(a ?? "", b);
+}
+function keysBetween(a, b, n) {
+  if (n <= 0)
+    return [];
+  if (n === 1)
+    return [keyBetween(a, b)];
+  if (b === null) {
+    let prev = keyBetween(a, null);
+    const out = [prev];
+    for (let i = 1;i < n; i++) {
+      prev = keyBetween(prev, null);
+      out.push(prev);
+    }
+    return out;
+  }
+  if (a === null) {
+    let next = keyBetween(null, b);
+    const out = [next];
+    for (let i = 1;i < n; i++) {
+      next = keyBetween(null, next);
+      out.unshift(next);
+    }
+    return out;
+  }
+  const mid = Math.floor(n / 2);
+  const c = keyBetween(a, b);
+  return [...keysBetween(a, c, mid), c, ...keysBetween(c, b, n - mid - 1)];
+}
+
+// src/core/records.ts
+function isSqlScalar(v) {
+  return typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+}
+function sqlFilterValue(v) {
+  return typeof v === "boolean" ? v ? 1 : 0 : v;
+}
+function resolveRelation(db, prop, value) {
+  const target = prop.config?.database;
+  if (!target)
+    return value;
+  const cands = resolveCandidates(db, value, { kind: "rec", databaseId: target });
+  const exact = cands.find((c) => c.id === value);
+  if (exact)
+    return exact.id;
+  if (cands.length === 1)
+    return cands[0].id;
+  if (cands.length === 0) {
+    if (idKind(value) === "rec")
+      return value;
+    throw new MhError("not_found", `${prop.name}: no such record in target database: ${value}`);
+  }
+  throw new MhError("ambiguous", `${prop.name}: ambiguous relation "${value}" (${cands.length} matches); use a full id`);
+}
+function coerce(db, prop, value) {
+  switch (prop.type) {
+    case "text":
+    case "url":
+    case "date": {
+      if (value === null)
+        return null;
+      if (typeof value !== "string")
+        throw new MhError("invalid_input", `${prop.name} expects a string`);
+      return value;
+    }
+    case "number": {
+      if (value === null)
+        return null;
+      const n = typeof value === "number" ? value : Number(value);
+      if (!Number.isFinite(n))
+        throw new MhError("invalid_input", `${prop.name} expects a number`);
+      return n;
+    }
+    case "checkbox": {
+      if (typeof value === "boolean")
+        return value;
+      if (value === "true" || value === 1)
+        return true;
+      if (value === "false" || value === 0 || value === null)
+        return false;
+      throw new MhError("invalid_input", `${prop.name} expects a boolean`);
+    }
+    case "select": {
+      if (value === null)
+        return null;
+      const v = String(value);
+      if (!prop.config?.options?.includes(v))
+        throw new MhError("invalid_input", `${prop.name}: '${v}' is not an allowed option`);
+      return v;
+    }
+    case "multi_select": {
+      const arr = value === null ? [] : Array.isArray(value) ? value : [value];
+      const opts = prop.config?.options ?? [];
+      for (const item of arr)
+        if (!opts.includes(String(item)))
+          throw new MhError("invalid_input", `${prop.name}: '${item}' is not an allowed option`);
+      return arr.map(String);
+    }
+    case "relation": {
+      const arr = value === null ? [] : Array.isArray(value) ? value : [value];
+      return arr.map((v) => resolveRelation(db, prop, String(v)));
+    }
+  }
+}
+function propsByName(props) {
+  const byName = new Map;
+  for (const p of props) {
+    const k = p.name.toLowerCase();
+    const list = byName.get(k);
+    if (list)
+      list.push(p);
+    else
+      byName.set(k, [p]);
+  }
+  return byName;
+}
+function resolveData(props, data) {
+  const byId = new Map(props.map((p) => [p.id, p]));
+  const byName = propsByName(props);
+  const out = [];
+  for (const [key, value] of Object.entries(data)) {
+    let prop = byId.get(key);
+    if (!prop) {
+      const matches = byName.get(key.toLowerCase()) ?? [];
+      if (matches.length > 1)
+        throw new MhError("ambiguous", `property name "${key}" matches ${matches.length} properties; use a property id`);
+      prop = matches[0];
+    }
+    if (!prop)
+      throw new MhError("not_found", `unknown property: ${key}`);
+    out.push({ prop, value });
+  }
+  return out;
+}
+function prepareRecordCells(db, databaseId, data) {
+  return resolveData(listProperties(db, databaseId), data).map(({ prop, value }) => ({
+    prop,
+    value: coerce(db, prop, value)
+  }));
+}
+function rowToRecord(row, props) {
+  const raw = JSON.parse(row.data || "{}");
+  const byId = new Map(props.map((p) => [p.id, p]));
+  const values = {};
+  const cells = {};
+  for (const [propId, v] of Object.entries(raw)) {
+    const p = byId.get(propId);
+    if (!p)
+      continue;
+    values[p.name] = v;
+    cells[p.id] = v;
+  }
+  return { id: row.id, database_id: row.database_id, values, cells };
+}
+function deriveTitle(resolved, fallbackBase) {
+  const text = resolved.find((r) => r.prop.type === "text" && typeof r.value === "string" && r.value);
+  return newId("rec", text ? String(text.value) : "", fallbackBase);
+}
+function tableExists(db, table) {
+  return db.query("SELECT 1 AS ok FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function canEmitOrderKeys(db) {
+  return tableExists(db, "meta") && tableExists(db, "crdt_changes");
+}
+function writeRecordOrderKey(db, recordId, orderKey, emitChange) {
+  if (emitChange)
+    emit(db, "records", recordId, "order_key", orderKey);
+  else
+    db.query("UPDATE records SET order_key = ? WHERE id = ?").run(orderKey, recordId);
+}
+function lastRecordOrderKey(db, databaseId) {
+  const row = db.query(`SELECT order_key FROM records
+       WHERE database_id = ? AND __deleted = 0 AND order_key IS NOT NULL
+       ORDER BY order_key DESC, id DESC LIMIT 1`).get(databaseId);
+  return row?.order_key ?? null;
+}
+function orderedRecordRows(db, databaseId) {
+  return db.query(`SELECT id, database_id, created_hlc, order_key FROM records
+       WHERE database_id = ? AND __deleted = 0
+       ORDER BY order_key IS NULL, order_key, created_hlc, id`).all(databaseId);
+}
+function rebalanceRecordOrderKeys(db, databaseId) {
+  const rows = orderedRecordRows(db, databaseId);
+  const keys = keysBetween(null, null, rows.length);
+  rows.forEach((row, i) => {
+    if (row.order_key !== keys[i])
+      emit(db, "records", row.id, "order_key", keys[i]);
+  });
+}
+var backfillRecordOrderKeys = grouped(function backfillRecordOrderKeys2(db, databaseId) {
+  const emitChange = canEmitOrderKeys(db);
+  const dbRows = databaseId ? [{ database_id: databaseId }] : db.query(`SELECT DISTINCT database_id FROM records
+           WHERE database_id IS NOT NULL AND __deleted = 0 AND order_key IS NULL`).all();
+  for (const d of dbRows) {
+    const missing = db.query(`SELECT id FROM records
+         WHERE database_id = ? AND __deleted = 0 AND order_key IS NULL
+         ORDER BY created_hlc, id`).all(d.database_id);
+    if (!missing.length)
+      continue;
+    const start = lastRecordOrderKey(db, d.database_id);
+    const keys = keysBetween(start, null, missing.length);
+    missing.forEach((row, i) => writeRecordOrderKey(db, row.id, keys[i], emitChange));
+  }
+});
+var createRecordPrepared = grouped(function createRecordPrepared2(db, database, cells) {
+  const id = deriveTitle(cells, slugify(database.name, "rec"));
+  const orderKey = keyBetween(lastRecordOrderKey(db, database.id), null);
+  const first = emit(db, "records", id, "database_id", database.id);
+  emit(db, "records", id, "created_hlc", first.hlc);
+  emit(db, "records", id, "order_key", orderKey);
+  for (const { prop, value } of cells)
+    emit(db, "records", id, prop.id, value);
+  return getRecord(db, id);
+});
+var createRecord = grouped(function createRecord2(db, databaseId, data) {
+  const database = getDatabase(db, databaseId);
+  if (!database)
+    throw new MhError("not_found", `no such database: ${databaseId}`);
+  return createRecordPrepared(db, database, prepareRecordCells(db, database.id, data));
+});
+function getRecord(db, id) {
+  const row = db.query("SELECT id, database_id, data FROM records WHERE id = ? AND __deleted = 0").get(id);
+  if (!row)
+    return null;
+  return rowToRecord(row, listProperties(db, row.database_id));
+}
+function jsonKeyLit(propId) {
+  return propId.replace(/'/g, "''");
+}
+function listRecords(db, databaseId, opts = {}) {
+  const props = listProperties(db, databaseId);
+  const resolved = opts.filter && Object.keys(opts.filter).length ? resolveData(props, opts.filter).map(({ prop, value }) => ({
+    prop,
+    value: coerce(db, prop, value)
+  })) : [];
+  const sqlFilters = resolved.filter((f) => isSqlScalar(f.value));
+  const jsFilters = resolved.filter((f) => !isSqlScalar(f.value));
+  let sortProp;
+  let sortDesc = false;
+  if (opts.sort) {
+    let key = opts.sort;
+    if (key.startsWith("-")) {
+      sortDesc = true;
+      key = key.slice(1);
+    }
+    if (key !== "created" && key !== "created_hlc") {
+      let p = props.find((p2) => p2.id === key);
+      if (!p) {
+        const matches = props.filter((q) => q.name.toLowerCase() === key.toLowerCase());
+        if (matches.length > 1)
+          throw new MhError("ambiguous", `sort field "${key}" matches ${matches.length} properties; use a property id`);
+        p = matches[0];
+      }
+      if (!p)
+        throw new MhError("not_found", `unknown sort field: ${key}`);
+      sortProp = p;
+    }
+  }
+  for (const f of sqlFilters)
+    maybeAutoIndex(db, databaseId, f.prop);
+  if (sortProp)
+    maybeAutoIndex(db, databaseId, sortProp);
+  const where = ["database_id = ?", "__deleted = 0"];
+  const args = [databaseId];
+  for (const f of sqlFilters) {
+    where.push(`data ->> '${jsonKeyLit(f.prop.id)}' = ?`);
+    args.push(sqlFilterValue(f.value));
+  }
+  const manualOrder = opts.sort == null;
+  const orderExpr = sortProp ? `data ->> '${jsonKeyLit(sortProp.id)}'` : "created_hlc";
+  let sql = `SELECT id, database_id, data FROM records WHERE ${where.join(" AND ")} ` + (manualOrder ? "ORDER BY order_key IS NULL, order_key, id" : `ORDER BY ${orderExpr} ${sortDesc ? "DESC" : "ASC"}, id`);
+  const pushLimit = opts.limit != null && jsFilters.length === 0;
+  if (pushLimit) {
+    sql += " LIMIT ?";
+    args.push(opts.limit);
+  }
+  let rows = db.query(sql).all(...args).map((r) => rowToRecord(r, props));
+  if (jsFilters.length) {
+    rows = rows.filter((r) => jsFilters.every((f) => JSON.stringify(r.cells[f.prop.id] ?? null) === JSON.stringify(f.value)));
+    if (opts.limit != null)
+      rows = rows.slice(0, opts.limit);
+  }
+  return rows;
+}
+var moveRecord = grouped(function moveRecord2(db, id, targetId, where) {
+  if (where !== "before" && where !== "after")
+    throw new MhError("invalid_input", `unknown move position: ${where}`);
+  const src = db.query("SELECT id, database_id FROM records WHERE id = ? AND __deleted = 0").get(id);
+  if (!src)
+    throw new MhError("not_found", `no such record: ${id}`);
+  const target = db.query("SELECT id, database_id FROM records WHERE id = ? AND __deleted = 0").get(targetId);
+  if (!target)
+    throw new MhError("not_found", `no such record: ${targetId}`);
+  if (src.database_id !== target.database_id)
+    throw new MhError("invalid_input", "cannot move a record across databases");
+  if (id === targetId)
+    return getRecord(db, id);
+  backfillRecordOrderKeys(db, src.database_id);
+  let rows = orderedRecordRows(db, src.database_id).filter((r) => r.id !== id);
+  let to = rows.findIndex((r) => r.id === targetId);
+  if (to < 0)
+    throw new MhError("not_found", `no such target record: ${targetId}`);
+  let left = where === "before" ? rows[to - 1]?.order_key ?? null : rows[to].order_key;
+  let right = where === "before" ? rows[to].order_key : rows[to + 1]?.order_key ?? null;
+  if (left !== null && right !== null && left >= right) {
+    rebalanceRecordOrderKeys(db, src.database_id);
+    rows = orderedRecordRows(db, src.database_id).filter((r) => r.id !== id);
+    to = rows.findIndex((r) => r.id === targetId);
+    left = where === "before" ? rows[to - 1]?.order_key ?? null : rows[to].order_key;
+    right = where === "before" ? rows[to].order_key : rows[to + 1]?.order_key ?? null;
+  }
+  emit(db, "records", id, "order_key", keyBetween(left, right));
+  return getRecord(db, id);
+});
+var updateRecordPrepared = grouped(function updateRecordPrepared2(db, id, cells) {
+  const rec = db.query("SELECT id, database_id FROM records WHERE id = ? AND __deleted = 0").get(id);
+  if (!rec)
+    throw new MhError("not_found", `no such record: ${id}`);
+  for (const { prop, value } of cells)
+    emit(db, "records", id, prop.id, value);
+  return getRecord(db, id);
+});
+var updateRecord = grouped(function updateRecord2(db, id, data) {
+  const rec = db.query("SELECT id, database_id FROM records WHERE id = ? AND __deleted = 0").get(id);
+  if (!rec)
+    throw new MhError("not_found", `no such record: ${id}`);
+  return updateRecordPrepared(db, id, prepareRecordCells(db, rec.database_id, data));
+});
+var deleteRecord = grouped(function deleteRecord2(db, id) {
+  const rec = db.query("SELECT id FROM records WHERE id = ? AND __deleted = 0").get(id);
+  if (!rec)
+    return false;
+  emit(db, "records", id, "__deleted", 1);
+  return true;
+});
+
+// src/core/databases.ts
+var DATABASE_COLS = ["id", "name", "icon", "meta", "created_hlc"];
+var DATABASE_SELECT = DATABASE_COLS.join(", ");
+function rowOut(r) {
+  if (!r)
+    return null;
+  return { ...r, meta: r.meta === null ? null : JSON.parse(r.meta) };
+}
+var createDatabase = grouped(function createDatabase2(db, opts) {
+  const id = newId("db", opts.name);
+  const first = emit(db, "databases", id, "name", opts.name);
+  emit(db, "databases", id, "created_hlc", first.hlc);
+  if (opts.icon !== undefined)
+    emit(db, "databases", id, "icon", opts.icon);
+  return getDatabase(db, id);
+});
+var updateDatabase = grouped(function updateDatabase2(db, id, fields) {
+  if (!getDatabase(db, id))
+    throw new MhError("not_found", `no such database: ${id}`);
+  if (fields.name !== undefined)
+    emit(db, "databases", id, "name", fields.name);
+  if (fields.icon !== undefined)
+    emit(db, "databases", id, "icon", fields.icon);
+  if (fields.meta !== undefined) {
+    if (fields.meta !== null && (typeof fields.meta !== "object" || Array.isArray(fields.meta)))
+      throw new MhError("invalid_input", "meta must be a JSON object or null");
+    emit(db, "databases", id, "meta", fields.meta);
+  }
+  return getDatabase(db, id);
+});
+var duplicateDatabase = grouped(function duplicateDatabase2(db, id, opts = {}) {
+  const src = getDatabase(db, id);
+  if (!src)
+    throw new MhError("not_found", `no such database: ${id}`);
+  const dup = createDatabase(db, {
+    name: opts.name ?? src.name,
+    icon: opts.icon ?? src.icon ?? undefined
+  });
+  if (src.meta !== null) {
+    const { collapsed: _hidden, ...meta } = src.meta;
+    if (Object.keys(meta).length)
+      emit(db, "databases", dup.id, "meta", meta);
+  }
+  const propIdMap = new Map;
+  for (const p of listProperties(db, id)) {
+    const config = p.config?.database === id ? { ...p.config, database: dup.id } : p.config ?? undefined;
+    const np = addProperty(db, dup.id, { name: p.name, type: p.type, config, position: p.position });
+    propIdMap.set(p.id, np.id);
+  }
+  for (const r of listRecords(db, id)) {
+    const data = {};
+    for (const [pid, v] of Object.entries(r.cells)) {
+      const nid = propIdMap.get(pid);
+      if (nid)
+        data[nid] = v;
+    }
+    createRecord(db, dup.id, data);
+  }
+  return getDatabase(db, dup.id);
+});
+function getDatabase(db, id) {
+  return rowOut(db.query(`SELECT ${DATABASE_SELECT} FROM databases WHERE id = ? AND __deleted = 0`).get(id));
+}
+var deleteDatabase = grouped(function deleteDatabase2(db, id) {
+  if (!getDatabase(db, id))
+    return false;
+  emit(db, "databases", id, "__deleted", 1);
+  const tombstone = (table) => {
+    for (const r of liveChildren(db, table, "database_id", id))
+      emit(db, table, r, "__deleted", 1);
+  };
+  tombstone("properties");
+  tombstone("records");
+  for (const d of liveChildren(db, "documents", "database_id", id))
+    emit(db, "documents", d, "database_id", null);
+  db.query("DELETE FROM meta WHERE key = 'current_db' AND value = ?").run(id);
+  return true;
+});
+function liveChildren(db, table, col, parentId) {
+  return db.query(`SELECT id FROM ${table} WHERE ${col} = ? AND __deleted = 0`).all(parentId).map((r) => r.id);
+}
+
+// src/core/grants-core.ts
+var GRANT_OPS = ["read", "create", "update"];
+function emptySet() {
+  return { v: 1, tables: [] };
+}
+function isGrantOp(x) {
+  return typeof x === "string" && GRANT_OPS.includes(x);
+}
+function normalizeSet(tables) {
+  const byDb = new Map;
+  for (const t of tables) {
+    const ops = byDb.get(t.db) ?? new Set;
+    for (const op of t.ops)
+      ops.add(op);
+    byDb.set(t.db, ops);
+  }
+  const out = [];
+  for (const [dbId, ops] of byDb) {
+    const ordered = GRANT_OPS.filter((op) => ops.has(op));
+    if (ordered.length)
+      out.push({ db: dbId, ops: ordered });
+  }
+  out.sort((a, b) => a.db < b.db ? -1 : a.db > b.db ? 1 : 0);
+  return { v: 1, tables: out };
+}
+function parseGrantSet(raw) {
+  if (!raw)
+    return emptySet();
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return emptySet();
+  }
+  try {
+    return validateGrantSetInput(parsed);
+  } catch {
+    return emptySet();
+  }
+}
+function validateGrantSetInput(input) {
+  if (typeof input !== "object" || input === null || Array.isArray(input))
+    throw new MhError("invalid_input", "grants must be an object {v:1, tables:[...]}");
+  const obj = input;
+  if (obj.v !== 1)
+    throw new MhError("invalid_input", "grants version must be 1");
+  if (!Array.isArray(obj.tables))
+    throw new MhError("invalid_input", "grants.tables must be an array");
+  const tables = [];
+  for (const t of obj.tables) {
+    if (typeof t !== "object" || t === null)
+      throw new MhError("invalid_input", "each grant table must be an object {db, ops}");
+    const { db, ops } = t;
+    if (typeof db !== "string" || !db)
+      throw new MhError("invalid_input", "grant table `db` must be a database id");
+    if (!Array.isArray(ops) || !ops.every(isGrantOp))
+      throw new MhError("invalid_input", `grant ops must be a subset of ${GRANT_OPS.join("|")} (delete is never grantable)`);
+    tables.push({ db, ops });
+  }
+  return normalizeSet(tables);
+}
+function serializeGrantSet(set) {
+  return JSON.stringify(normalizeSet(set.tables));
+}
+function grantFor(set, dbId) {
+  return set.tables.find((t) => t.db === dbId);
+}
+function grantAllows(set, dbId, op) {
+  return grantFor(set, dbId)?.ops.includes(op) ?? false;
+}
+function deny() {
+  return new MhError("auth", "unauthorized");
+}
+function authorizeDbRef(db, set, dbRef, op) {
+  const matches = [];
+  for (const table of set.tables) {
+    const row = getDatabase(db, table.db);
+    if (!row)
+      continue;
+    if (row.id === dbRef || row.name.toLowerCase() === dbRef.toLowerCase())
+      matches.push({ row, table });
+  }
+  const exact = matches.find((m) => m.row.id === dbRef);
+  const hit = exact ?? (matches.length === 1 ? matches[0] : undefined);
+  if (!hit) {
+    if (matches.length > 1)
+      throw new MhError("ambiguous", `"${dbRef}" matches ${matches.length} granted databases; use a database id`);
+    throw deny();
+  }
+  if (!hit.table.ops.includes(op))
+    throw deny();
+  return hit.row;
+}
+function authorizeRecord(db, set, recordId, op) {
+  const rec = getRecord(db, recordId);
+  if (!rec || !grantAllows(set, rec.database_id, op))
+    throw deny();
+  return rec;
+}
+var GUEST_LIMITS = {
+  maxBodyBytes: 64 * 1024,
+  maxValueBytes: 8 * 1024,
+  maxCells: 64,
+  maxRows: 1e4
+};
+function utf8Len(s) {
+  return new TextEncoder().encode(s).byteLength;
+}
+function liveRowCount(db, databaseId) {
+  return db.query("SELECT COUNT(*) AS n FROM records WHERE database_id = ? AND __deleted = 0").get(databaseId).n;
+}
+function assertRelationAllowed(set, principalKind, prop) {
+  if (principalKind === "public")
+    throw new MhError("invalid_input", `${prop.name}: relation properties are not writable anonymously`);
+  const target = prop.config?.database;
+  if (!target || !grantFor(set, target))
+    throw new MhError("invalid_input", `${prop.name}: relation target database is not in this share's grants`);
+}
+function assertGuestPayload(db, set, principal, database, values, opts = {}) {
+  const limits = opts.limits ?? GUEST_LIMITS;
+  const entries = Object.entries(values);
+  if (entries.length > limits.maxCells)
+    throw new MhError("invalid_input", `too many cells (max ${limits.maxCells})`);
+  const props = listProperties(db, database.id);
+  const resolved = resolveData(props, values).map(({ prop, value }) => ({
+    prop,
+    value: coerce(db, prop, value)
+  }));
+  let total = 0;
+  for (const { prop, value } of resolved) {
+    const size = utf8Len(JSON.stringify(value ?? null));
+    if (size > limits.maxValueBytes)
+      throw new MhError("invalid_input", `${prop.name}: value too large (max ${limits.maxValueBytes} bytes)`);
+    total += size;
+    if (prop.type === "relation" && value != null && !(Array.isArray(value) && value.length === 0))
+      assertRelationAllowed(set, principal.kind, prop);
+  }
+  if (total > limits.maxBodyBytes)
+    throw new MhError("invalid_input", `payload too large (max ${limits.maxBodyBytes} bytes)`);
+  return resolved;
+}
+function assertGuestCreateCapacity(db, database, limits = GUEST_LIMITS) {
+  if (liveRowCount(db, database.id) >= limits.maxRows)
+    throw new MhError("invalid_input", `table is full (guest writes cap at ${limits.maxRows} rows)`);
+}
+var GUEST_META_COLS = new Set(["database_id", "created_hlc", "order_key"]);
+var GUEST_COERCIBLE_TYPES = new Set([
+  "text",
+  "url",
+  "date",
+  "number",
+  "checkbox",
+  "select",
+  "multi_select",
+  "relation"
+]);
+
+// src/core/sync/e2ee.ts
+function fromB64(b64) {
+  const s = atob(b64);
+  const out = new Uint8Array(s.length);
+  for (let i = 0;i < s.length; i++)
+    out[i] = s.charCodeAt(i);
+  return out;
+}
+
+// src/core/shares.ts
+var SHARE_KINDS = new Set(["doc", "database", "site"]);
+var PW_ITER = 600000;
+var PW_HASH_BITS = 256;
+function ab(u) {
+  const out = new Uint8Array(u.byteLength);
+  out.set(u);
+  return out.buffer;
+}
+async function pbkdf2(password, salt) {
+  const base = await crypto.subtle.importKey("raw", ab(new TextEncoder().encode(password)), "PBKDF2", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", salt: ab(salt), iterations: PW_ITER, hash: "SHA-256" }, base, PW_HASH_BITS);
+  return new Uint8Array(bits);
+}
+async function verifyPasswordVerifier(hashB64, saltB64, password) {
+  const expect = fromB64(hashB64);
+  const got = await pbkdf2(password, fromB64(saltB64));
+  return timingSafeEqual(expect, got);
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+
+// src/core/hash.ts
+var FNV32_OFFSET = 2166136261;
+var FNV64_OFFSET = 0xcbf29ce484222325n;
+var FNV64_PRIME = 0x100000001b3n;
+var U64_MASK = 0xffffffffffffffffn;
+function fnv1a32(text) {
+  let h = FNV32_OFFSET;
+  for (let i = 0;i < text.length; i++) {
+    h ^= text.charCodeAt(i);
+    h = h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24)) >>> 0;
+  }
+  return h >>> 0;
+}
+function fnv1a64Hex(text) {
+  let h = FNV64_OFFSET;
+  for (let i = 0;i < text.length; i++) {
+    h ^= BigInt(text.charCodeAt(i));
+    h = h * FNV64_PRIME & U64_MASK;
+  }
+  return h.toString(16).padStart(16, "0");
+}
+
+// src/core/access-policy.ts
+function computeRevision(policy) {
+  const canon = JSON.stringify({
+    a: policy.audience,
+    t: policy.grants.tables,
+    ts: policy.writeGate.turnstile ? { enabled: true, sitekey: policy.writeGate.turnstile.sitekey ?? null } : null,
+    pw: policy.writeGate.password ? { enabled: true, salt: policy.writeGate.password.saltB64 } : null,
+    x: policy.expiresAt ?? null
+  });
+  return fnv1a32(canon);
+}
+function policyForRoom(src) {
+  return withRevision({
+    audience: "share",
+    grants: parseGrantSet(src.grants),
+    writeGate: passwordGate(src.pwSalt ?? null, src.pwHash ?? null),
+    limits: GUEST_LIMITS,
+    revision: 0,
+    expiresAt: src.expiresAt ?? null,
+    guestBase: src.guestBase
+  });
+}
+function withRevision(p) {
+  p.revision = computeRevision(p);
+  return p;
+}
+function passwordGate(saltB64, verifierB64) {
+  return saltB64 && verifierB64 ? { password: { saltB64, verifierB64 } } : {};
+}
+
+// src/core/sync/http-util.ts
+function safeDecode(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return null;
+  }
+}
+
+// src/core/sync/html-escape.ts
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+// src/core/guest-intent.ts
+var HLC_SKEW_MS = 5 * 60000;
+var INTENT_ID_RE = /^[A-Za-z0-9._-]{1,64}$/;
+var RECEIPT_COL = "result";
+function applyGuestIntent(db, policy, session, intent, opts) {
+  if (!INTENT_ID_RE.test(intent.intentId))
+    throw new MhError("invalid_input", "intentId must be 1-64 safe characters");
+  const acceptedNow = opts.now ?? Date.now();
+  pruneExpiredIntentReceipts(db, acceptedNow);
+  const principal = {
+    kind: policy.audience,
+    guestNode: session.guestNode
+  };
+  const tx = db.transaction(() => {
+    const prepared = prepareIntent(db, policy, principal, intent, opts.clock);
+    const txn = intentTxnPrefix(session.guestNode, intent.intentId) + prepared.fingerprint;
+    const receipt = readReceipt(db, session.guestNode, intent.intentId, acceptedNow);
+    if (receipt) {
+      if (receipt.fingerprint !== prepared.fingerprint || receipt.action !== prepared.action || receipt.databaseId !== prepared.database.id)
+        throw new MhError("conflict", "intentId was already used for a different request");
+      const current = getRecord(db, receipt.recordId);
+      if (!current || current.database_id !== receipt.databaseId)
+        throw new MhError("conflict", "intent result no longer exists");
+      return responseForPolicy(policy, current, receipt.result);
+    }
+    if (opts.clock === "submitted" && intentSubmissionExpired(intent.submittedAt, acceptedNow))
+      throw new MhError("conflict", "intent replay window expired");
+    if (!prepared.targetLive)
+      throw new MhError("auth", "unauthorized");
+    if (opts.clock === "submitted")
+      return applySubmitted(db, policy, principal, intent, prepared, txn, acceptedNow);
+    return applyAuthority(db, policy, principal, intent, prepared, txn, acceptedNow);
+  });
+  return tx();
+}
+function prepareIntent(db, policy, principal, intent, clock) {
+  if (typeof intent.payload !== "object" || intent.payload === null || Array.isArray(intent.payload))
+    throw new MhError("invalid_input", "intent payload must be an object");
+  if (intent.action === "createRecord") {
+    if (!intent.table || typeof intent.table !== "string")
+      throw new MhError("invalid_input", "createRecord intent needs a table");
+    const database2 = authorizeDbRef(db, policy.grants, intent.table, "create");
+    const cells2 = assertGuestPayload(db, policy.grants, principal, database2, intent.payload, { limits: policy.limits });
+    return {
+      action: intent.action,
+      database: database2,
+      cells: cells2,
+      targetLive: true,
+      fingerprint: fingerprintIntent(intent.action, database2.id, clock === "submitted" ? intent.recordId ?? null : null, cells2)
+    };
+  }
+  if (intent.action !== "updateRecord")
+    throw new MhError("invalid_input", "unknown guest intent action");
+  if (!intent.recordId || typeof intent.recordId !== "string")
+    throw new MhError("invalid_input", "updateRecord intent needs a record id");
+  if (Object.keys(intent.payload).length === 0)
+    throw new MhError("invalid_input", "updateRecord intent payload must not be empty");
+  const rec = db.query("SELECT database_id, __deleted FROM records WHERE id = ?").get(intent.recordId);
+  if (!rec?.database_id)
+    throw new MhError("auth", "unauthorized");
+  const database = authorizeDbRef(db, policy.grants, rec.database_id, "update");
+  const cells = assertGuestPayload(db, policy.grants, principal, database, intent.payload, { limits: policy.limits });
+  return {
+    action: intent.action,
+    database,
+    cells,
+    targetLive: rec.__deleted === 0,
+    fingerprint: fingerprintIntent(intent.action, database.id, intent.recordId, cells)
+  };
+}
+function applyAuthority(db, policy, principal, intent, prepared, txn, acceptedNow) {
+  return withTxnId(txn, () => withNodeId(principal.guestNode, () => {
+    if (intent.action === "createRecord")
+      assertGuestCreateCapacity(db, prepared.database, policy.limits);
+    const current = intent.action === "createRecord" ? createRecordPrepared(db, prepared.database, prepared.cells) : updateRecordPrepared(db, intent.recordId, prepared.cells);
+    const projection = submittedProjection(current.id, prepared.database.id, prepared.cells);
+    writeReceiptAt(db, principal.guestNode, intent.intentId, makeReceipt(intent.action, prepared, current.id, projection), txn, acceptedNow);
+    return responseForPolicy(policy, current, projection);
+  }));
+}
+function applySubmitted(db, policy, principal, intent, prepared, txn, now) {
+  const node = principal.guestNode;
+  const millis = clampMillis(intent.submittedAt, now);
+  const cells = [...prepared.cells].sort((a, b) => a.prop.id < b.prop.id ? -1 : a.prop.id > b.prop.id ? 1 : 0);
+  const rowId = intent.action === "createRecord" ? intent.recordId ?? "rec_" + randomSuffix(10) : intent.recordId;
+  if (intent.action === "createRecord" && recordIdEverUsed(db, rowId))
+    throw new MhError("conflict", "record id already exists");
+  if (intent.action === "createRecord")
+    assertGuestCreateCapacity(db, prepared.database, policy.limits);
+  let counter = seedCounter(db, node, millis);
+  const changes = [];
+  const mk = (dataset, targetId, col, value) => {
+    const hlc = formatHlc({ millis, counter, node });
+    counter++;
+    changes.push({
+      hlc,
+      node_id: node,
+      dataset,
+      row_id: targetId,
+      col,
+      value: value == null ? null : JSON.stringify(value),
+      txn
+    });
+    return hlc;
+  };
+  if (intent.action === "createRecord") {
+    const firstHlc = formatHlc({ millis, counter, node });
+    mk("records", rowId, "database_id", prepared.database.id);
+    mk("records", rowId, "created_hlc", firstHlc);
+  }
+  for (const cell of cells)
+    mk("records", rowId, cell.prop.id, cell.value);
+  const projection = submittedProjection(rowId, prepared.database.id, cells);
+  const receipt = makeReceipt(intent.action, prepared, rowId, projection);
+  const receiptMillis = clampMillis(now, now);
+  const receiptCounter = receiptMillis === millis ? counter : seedCounter(db, node, receiptMillis);
+  changes.push({
+    hlc: formatHlc({ millis: receiptMillis, counter: receiptCounter, node }),
+    node_id: node,
+    dataset: INTENT_RECEIPT_DATASET,
+    row_id: receiptRowId(node, intent.intentId),
+    col: RECEIPT_COL,
+    value: JSON.stringify(receipt),
+    txn
+  });
+  ingest(db, changes, { now: receiptMillis });
+  const current = getRecord(db, rowId);
+  if (!current)
+    throw new MhError("conflict", "intent result no longer exists");
+  return responseForPolicy(policy, current, projection);
+}
+function responseForPolicy(policy, current, projection) {
+  return grantAllows(policy.grants, current.database_id, "read") ? current : projection;
+}
+function submittedProjection(recordId, databaseId, cells) {
+  const values = {};
+  const byId = {};
+  for (const { prop, value } of cells) {
+    values[prop.name] = value;
+    byId[prop.id] = value;
+  }
+  return { id: recordId, database_id: databaseId, values, cells: byId };
+}
+function makeReceipt(action, prepared, recordId, result) {
+  return {
+    v: 1,
+    action,
+    fingerprint: prepared.fingerprint,
+    databaseId: prepared.database.id,
+    recordId,
+    result
+  };
+}
+function writeReceiptAt(db, guestNode, intentId, receipt, txn, acceptedNow) {
+  const millis = clampMillis(acceptedNow, acceptedNow);
+  const change = {
+    hlc: formatHlc({
+      millis,
+      counter: seedCounter(db, guestNode, millis),
+      node: guestNode
+    }),
+    node_id: guestNode,
+    dataset: INTENT_RECEIPT_DATASET,
+    row_id: receiptRowId(guestNode, intentId),
+    col: RECEIPT_COL,
+    value: JSON.stringify(receipt),
+    txn
+  };
+  ingest(db, [change], { now: millis });
+}
+function readReceipt(db, guestNode, intentId, now) {
+  const row = db.query(`SELECT hlc, value, node_id, txn FROM crdt_changes
+       WHERE dataset = ? AND row_id = ? AND col = ?
+       ORDER BY hlc DESC LIMIT 1`).get(INTENT_RECEIPT_DATASET, receiptRowId(guestNode, intentId), RECEIPT_COL);
+  if (!row)
+    return null;
+  if (isExpiredIntentReceipt({ dataset: INTENT_RECEIPT_DATASET, hlc: row.hlc }, now))
+    return null;
+  try {
+    const receipt = JSON.parse(row.value ?? "");
+    if (row.node_id !== guestNode || receipt.v !== 1 || receipt.action !== "createRecord" && receipt.action !== "updateRecord" || typeof receipt.fingerprint !== "string" || !/^[0-9a-f]{16}$/.test(receipt.fingerprint) || row.txn !== intentTxnPrefix(guestNode, intentId) + receipt.fingerprint || typeof receipt.databaseId !== "string" || typeof receipt.recordId !== "string" || !isRecordRow(receipt.result) || receipt.result.id !== receipt.recordId || receipt.result.database_id !== receipt.databaseId)
+      throw new Error("invalid receipt");
+    return receipt;
+  } catch {
+    throw new MhError("conflict", "intent receipt is invalid");
+  }
+}
+function isRecordRow(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const row = value;
+  return typeof row.id === "string" && typeof row.database_id === "string" && !!row.values && typeof row.values === "object" && !Array.isArray(row.values) && !!row.cells && typeof row.cells === "object" && !Array.isArray(row.cells);
+}
+function clampMillis(submittedAt, now) {
+  const safeNow2 = Math.max(0, Math.trunc(Number.isFinite(now) ? now : Date.now()));
+  const ceil = safeNow2 + HLC_SKEW_MS;
+  if (!Number.isFinite(submittedAt))
+    return safeNow2;
+  return Math.max(0, Math.min(Math.trunc(submittedAt), ceil));
+}
+function seedCounter(db, node, millis) {
+  const prefix = String(millis).padStart(15, "0") + "-";
+  const row = db.query("SELECT MAX(hlc) AS h FROM crdt_changes WHERE node_id = ? AND hlc LIKE ? || '%'").get(node, prefix);
+  return row.h ? parseHlc(row.h).counter + 1 : 0;
+}
+function intentTxnPrefix(guestNode, intentId) {
+  return `intent:${encodeURIComponent(guestNode)}:${intentId}:`;
+}
+function receiptRowId(guestNode, intentId) {
+  return `${encodeURIComponent(guestNode)}:${intentId}`;
+}
+function recordIdEverUsed(db, rowId) {
+  if (db.query("SELECT 1 AS ok FROM records WHERE id = ? LIMIT 1").get(rowId) != null)
+    return true;
+  return db.query("SELECT 1 AS ok FROM crdt_changes WHERE dataset = 'records' AND row_id = ? LIMIT 1").get(rowId) != null;
+}
+function fingerprintIntent(action, databaseId, recordId, cells) {
+  const canonical = stableStringify({
+    action,
+    databaseId,
+    recordId,
+    cells: [...cells].sort((a, b) => a.prop.id < b.prop.id ? -1 : a.prop.id > b.prop.id ? 1 : 0).map((cell) => [cell.prop.id, cell.value])
+  });
+  return fnv1a64Hex(canonical);
+}
+function stableStringify(value) {
+  if (Array.isArray(value))
+    return "[" + value.map(stableStringify).join(",") + "]";
+  if (value && typeof value === "object") {
+    const obj = value;
+    return "{" + Object.keys(obj).sort().map((key) => JSON.stringify(key) + ":" + stableStringify(obj[key])).join(",") + "}";
+  }
+  return JSON.stringify(value) ?? "null";
+}
+
+// src/core/sync/anti-abuse.ts
+function timingSafeEq(a, b) {
+  const ab2 = new TextEncoder().encode(a);
+  const bb = new TextEncoder().encode(b);
+  let diff = ab2.length ^ bb.length;
+  const n = Math.max(ab2.length, bb.length);
+  for (let i = 0;i < n; i++)
+    diff |= (ab2[i] ?? 0) ^ (bb[i] ?? 0);
+  return diff === 0;
+}
+var siteverify = async (secret, token, ip) => {
+  try {
+    const res = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ secret, response: token, ...ip ? { remoteip: ip } : {} }),
+      signal: AbortSignal.timeout(5000)
+    });
+    const data = await res.json();
+    return data?.success === true;
+  } catch {
+    return false;
+  }
+};
+async function assertAntiAbuse(knobs, req, opts = {}) {
+  if (!knobs)
+    return;
+  if (knobs.turnstileSecret) {
+    const verify = opts.verifyTurnstile ?? siteverify;
+    const token = req.headers.get("x-turnstile-token") ?? "";
+    if (!token || !await verify(knobs.turnstileSecret, token, opts.ip ?? null))
+      throw new MhError("auth", "turnstile verification failed");
+  }
+  if (knobs.passwordVerifier) {
+    const pass = req.headers.get("x-drop-pass") ?? "";
+    if (!pass || !timingSafeEq(pass, knobs.passwordVerifier))
+      throw new MhError("auth", "password required");
+  }
+}
+
+// src/core/sync/grants-routes.ts
+var LIST_LIMIT_DEFAULT = 100;
+var LIST_LIMIT_MAX = 500;
+function grantedDepsFromPolicy(policy, host) {
+  const gate = policy.writeGate;
+  const gated = policy.audience === "public" && !!(gate.turnstile?.secret || gate.password);
+  return {
+    db: host.db,
+    set: policy.grants,
+    principal: host.principal,
+    allow: host.allow,
+    beforeWrite: gated ? () => assertAntiAbuse({ turnstileSecret: gate.turnstile?.secret, passwordVerifier: gate.password?.verifierB64 }, host.req, { verifyTurnstile: host.verifyTurnstile, ip: host.ip ?? null }) : undefined
+  };
+}
+function errJson(e) {
+  const { body, status } = errorBody(e);
+  return Response.json(body, { status });
+}
+function tooMany() {
+  return Response.json({ error: "too many requests — slow down", code: "rate_limited" }, { status: 429 });
+}
+function needParam(url, key) {
+  const v = url.searchParams.get(key);
+  if (!v)
+    throw new MhError("invalid_input", `missing query param: ${key}`);
+  return v;
+}
+async function guestJsonBody(req) {
+  const text = await req.text();
+  if (new TextEncoder().encode(text).byteLength > GUEST_LIMITS.maxBodyBytes)
+    throw new MhError("invalid_input", `payload too large (max ${GUEST_LIMITS.maxBodyBytes} bytes)`);
+  let parsed;
+  try {
+    parsed = JSON.parse(text || "{}");
+  } catch {
+    throw new MhError("invalid_input", "body must be JSON");
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+    throw new MhError("invalid_input", "body must be a JSON object of {column: value}");
+  return parsed;
+}
+function readWriteBody(body) {
+  const wrap = body["$intent"];
+  if (wrap && typeof wrap === "object" && !Array.isArray(wrap) && "values" in body) {
+    const meta = wrap;
+    const values = body["values"];
+    if (typeof values !== "object" || values === null || Array.isArray(values))
+      throw new MhError("invalid_input", "intent values must be a JSON object");
+    if (typeof meta.id !== "string")
+      throw new MhError("invalid_input", "intent id must be a string");
+    return {
+      intentId: meta.id,
+      submittedAt: Number.isFinite(meta.submittedAt) ? meta.submittedAt : Date.now(),
+      values
+    };
+  }
+  return { intentId: "srv_" + randomSuffix(16), submittedAt: Date.now(), values: body };
+}
+function authorityPolicy(deps) {
+  return {
+    audience: deps.principal.kind,
+    grants: deps.set,
+    writeGate: {},
+    limits: GUEST_LIMITS,
+    revision: 0,
+    expiresAt: null,
+    guestBase: deps.principal.guestNode
+  };
+}
+async function serveGrantedApi(req, sub, deps) {
+  const { db, set, principal } = deps;
+  const url = new URL(req.url);
+  try {
+    if (req.method === "GET") {
+      if (!deps.allow("read"))
+        return tooMany();
+      if (sub === "records") {
+        const dbRow = authorizeDbRef(db, set, needParam(url, "db"), "read");
+        const rawLimit = Number(url.searchParams.get("limit") ?? NaN);
+        const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(Math.floor(rawLimit), LIST_LIMIT_MAX)) : LIST_LIMIT_DEFAULT;
+        const sort = url.searchParams.get("sort") ?? undefined;
+        return Response.json(listRecords(db, dbRow.id, { sort, limit }));
+      }
+      if (sub === "record") {
+        return Response.json(authorizeRecord(db, set, needParam(url, "id"), "read"));
+      }
+      if (sub === "properties") {
+        const dbRow = authorizeDbRef(db, set, needParam(url, "db"), "read");
+        return Response.json(listProperties(db, dbRow.id));
+      }
+    }
+    if (req.method === "POST" && sub === "records") {
+      if (!deps.allow("write"))
+        return tooMany();
+      if (deps.beforeWrite)
+        await deps.beforeWrite();
+      const { intentId, submittedAt, values } = readWriteBody(await guestJsonBody(req));
+      const intent = {
+        intentId,
+        action: "createRecord",
+        table: needParam(url, "db"),
+        payload: values,
+        submittedAt
+      };
+      return Response.json(applyGuestIntent(db, authorityPolicy(deps), { guestNode: principal.guestNode }, intent, {
+        clock: "authority"
+      }));
+    }
+    if (req.method === "PATCH" && sub === "record") {
+      if (!deps.allow("write"))
+        return tooMany();
+      if (deps.beforeWrite)
+        await deps.beforeWrite();
+      const { intentId, submittedAt, values } = readWriteBody(await guestJsonBody(req));
+      const intent = {
+        intentId,
+        action: "updateRecord",
+        recordId: needParam(url, "id"),
+        payload: values,
+        submittedAt
+      };
+      return Response.json(applyGuestIntent(db, authorityPolicy(deps), { guestNode: principal.guestNode }, intent, {
+        clock: "authority"
+      }));
+    }
+    return Response.json({ error: "not found" }, { status: 404 });
+  } catch (e) {
+    return errJson(e);
+  }
+}
+
+// src/core/sync/rate-limit.ts
+class FixedWindowLimiter {
+  maxEntries;
+  hits = new Map;
+  constructor(maxEntries = 1e4) {
+    this.maxEntries = maxEntries;
+  }
+  allow(bucket, key, limit, windowMs = 60000, now = Date.now()) {
+    const k = `${bucket}\x00${key}`;
+    const cur = this.hits.get(k);
+    if (!cur || now >= cur.resetAt) {
+      if (!cur && this.hits.size >= this.maxEntries)
+        this.evict(now);
+      this.hits.delete(k);
+      this.hits.set(k, { count: 1, resetAt: now + windowMs });
+      return limit >= 1;
+    }
+    cur.count++;
+    return cur.count <= limit;
+  }
+  evict(now) {
+    for (const [k, v] of this.hits) {
+      if (now >= v.resetAt)
+        this.hits.delete(k);
+    }
+    while (this.hits.size >= this.maxEntries) {
+      const oldest = this.hits.keys().next();
+      if (oldest.done)
+        break;
+      this.hits.delete(oldest.value);
+    }
+  }
+  get size() {
+    return this.hits.size;
+  }
+}
+var rateLimiter = new FixedWindowLimiter;
+var SHARE_LIMIT = 240;
+
+// src/core/sites-core.ts
+var SITE_COLS = ["id", "name", "title", "created_hlc", "visibility", "spa", "public_grants"];
+var SITE_SELECT = SITE_COLS.join(", ");
+var SITE_FILE_COLS = [
+  "id",
+  "site_id",
+  "path",
+  "content_type",
+  "encoding",
+  "content"
+];
+var SITE_FILE_SELECT = SITE_FILE_COLS.join(", ");
+function normalizeSiteName(raw) {
+  const slug = raw.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!slug)
+    throw new MhError("invalid_input", `invalid site name: ${JSON.stringify(raw)}`);
+  return slug;
+}
+function normalizeSitePath(raw) {
+  const segs = [];
+  for (const seg of raw.split("/")) {
+    if (seg === "" || seg === ".")
+      continue;
+    if (seg === "..")
+      segs.pop();
+    else
+      segs.push(seg);
+  }
+  return segs.join("/");
+}
+function getSite(db, id) {
+  return db.query(`SELECT ${SITE_SELECT} FROM sites WHERE id = ? AND __deleted = 0`).get(id);
+}
+function getSiteByName(db, name) {
+  let slug;
+  try {
+    slug = normalizeSiteName(name);
+  } catch {
+    return null;
+  }
+  return db.query(`SELECT ${SITE_SELECT} FROM sites WHERE name = ? AND __deleted = 0 ORDER BY created_hlc DESC LIMIT 1`).get(slug);
+}
+function fileRowAtPath(db, siteId, p) {
+  return db.query("SELECT content_type, encoding, content FROM site_files WHERE site_id = ? AND path = ? AND __deleted = 0 ORDER BY created_hlc LIMIT 1").get(siteId, p);
+}
+function resolveSiteFileRow(db, siteId, path, opts = {}) {
+  const withIndex = path === "" || path.endsWith("/") ? `${path}index.html` : path;
+  const p = normalizeSitePath(withIndex);
+  if (p) {
+    const row = fileRowAtPath(db, siteId, p);
+    if (row)
+      return { row, status: 200 };
+  }
+  if (opts.spa) {
+    const last = path.split("/").pop() ?? "";
+    if (!/\.[a-z0-9]+$/i.test(last)) {
+      const idx = fileRowAtPath(db, siteId, "index.html");
+      if (idx)
+        return { row: idx, status: 200 };
+    }
+  }
+  const nf = fileRowAtPath(db, siteId, "404.html");
+  if (nf)
+    return { row: nf, status: 404 };
+  return null;
+}
+var INLINE_LIMIT = 256 * 1024;
+function base64ToBytes(b64) {
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0;i < bin.length; i++)
+    bytes[i] = bin.charCodeAt(i);
+  return bytes;
+}
+function assertVisibility(v) {
+  if (v !== "public" && v !== "private")
+    throw new MhError("invalid_input", `visibility must be "public" or "private", got ${JSON.stringify(v)}`);
+}
+var createSite = grouped(function createSite2(db, opts) {
+  const name = normalizeSiteName(opts.name);
+  if (getSiteByName(db, name))
+    throw new MhError("conflict", `site name already exists: ${name}`);
+  if (opts.visibility !== undefined)
+    assertVisibility(opts.visibility);
+  const id = newId("site", name);
+  const first = emit(db, "sites", id, "name", name);
+  emit(db, "sites", id, "created_hlc", first.hlc);
+  if (opts.title !== undefined)
+    emit(db, "sites", id, "title", opts.title);
+  if (opts.visibility !== undefined)
+    emit(db, "sites", id, "visibility", opts.visibility);
+  return getSite(db, id);
+});
+var updateSite = grouped(function updateSite2(db, id, opts) {
+  if (!getSite(db, id))
+    throw new MhError("not_found", `no such site: ${id}`);
+  if (opts.visibility !== undefined)
+    assertVisibility(opts.visibility);
+  if (opts.name !== undefined) {
+    const name = normalizeSiteName(opts.name);
+    const dup = getSiteByName(db, name);
+    if (dup && dup.id !== id)
+      throw new MhError("conflict", `site name already exists: ${name}`);
+    emit(db, "sites", id, "name", name);
+  }
+  if (opts.title !== undefined)
+    emit(db, "sites", id, "title", opts.title);
+  if (opts.visibility !== undefined)
+    emit(db, "sites", id, "visibility", opts.visibility);
+  if (opts.spa !== undefined)
+    emit(db, "sites", id, "spa", opts.spa ? 1 : 0);
+  return getSite(db, id);
+});
+var setSitePublicGrants = grouped(function setSitePublicGrants2(db, siteId, grants) {
+  if (!getSite(db, siteId))
+    throw new MhError("not_found", `no such site: ${siteId}`);
+  const value = grants == null ? null : serializeGrantSet(validateGrantSetInput(grants));
+  emit(db, "sites", siteId, "public_grants", value);
+  return getSite(db, siteId);
+});
+var deleteSite = grouped(function deleteSite2(db, id) {
+  if (!getSite(db, id))
+    return false;
+  const files = db.query("SELECT id FROM site_files WHERE site_id = ? AND __deleted = 0").all(id);
+  for (const f of files)
+    emit(db, "site_files", f.id, "__deleted", 1);
+  emit(db, "sites", id, "__deleted", 1);
+  return true;
+});
+function fileIdFor(db, siteId, path) {
+  const row = db.query("SELECT id FROM site_files WHERE site_id = ? AND path = ? ORDER BY created_hlc LIMIT 1").get(siteId, path);
+  return row?.id ?? null;
+}
+var deleteFile = grouped(function deleteFile2(db, siteId, path) {
+  const id = fileIdFor(db, siteId, normalizeSitePath(path));
+  if (!id)
+    return false;
+  const live = db.query("SELECT __deleted AS d FROM site_files WHERE id = ?").get(id);
+  if (!live || live.d)
+    return false;
+  emit(db, "site_files", id, "__deleted", 1);
+  return true;
+});
+
+// src/core/sync/guest-session.ts
+function toHex(b) {
+  let s = "";
+  for (const x of b)
+    s += x.toString(16).padStart(2, "0");
+  return s;
+}
+async function hmacHex(secret, msg) {
+  const enc = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(msg));
+  return toHex(new Uint8Array(sig));
+}
+function timingSafeStr(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function readCookie(header, name) {
+  if (!header)
+    return null;
+  for (const part of header.split(";")) {
+    const [k, ...v] = part.trim().split("=");
+    if (k === name)
+      return decodeURIComponent(v.join("="));
+  }
+  return null;
+}
+async function readGuestSession(scope, cookieHeader, now = Date.now()) {
+  const raw = readCookie(cookieHeader, scope.cookieName);
+  if (!raw)
+    return null;
+  const [expStr, sub, mac] = raw.split(".");
+  if (expStr === undefined || sub === undefined || mac === undefined)
+    return null;
+  const exp = Number(expStr);
+  if (!Number.isFinite(exp) || now > exp)
+    return null;
+  const expect = await hmacHex(scope.secret, `${scope.scopeKey}:${exp}:${sub}`);
+  return timingSafeStr(expect, mac) ? { exp, sub } : null;
+}
+async function mintGuestSession(scope, opts) {
+  const exp = Date.now() + Math.max(0, opts.ttlMs);
+  const mac = await hmacHex(scope.secret, `${scope.scopeKey}:${exp}:${opts.sub}`);
+  const cookie = `${scope.cookieName}=${exp}.${opts.sub}.${mac}; Path=${opts.path}; HttpOnly; SameSite=Strict; Max-Age=${Math.floor((exp - Date.now()) / 1000)}` + (opts.secure ? "; Secure" : "");
+  return { sub: opts.sub, exp, cookie };
+}
+
+// src/core/schema.ts
+var CORE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS meta (
+  key   TEXT PRIMARY KEY,
+  value TEXT
+);
+
+-- CRDT oplog: one row per field assignment. Source of truth for sync.
+-- txn groups the changes of one logical mutation for history rendering
+-- (nullable: legacy rows and changes from pre-txn peers have none).
+--
+-- seq is an explicit AUTOINCREMENT id used as the replication cursor. It must
+-- be a declared INTEGER PRIMARY KEY (not the implicit rowid): VACUUM renumbers
+-- the rowids of tables that lack one, which would shift them below a peer's
+-- stored push/pull cursor and silently strand every write in the gap.
+-- AUTOINCREMENT additionally guarantees ids are never reused. The
+-- (dataset,row_id,col,hlc) tuple stays UNIQUE so applyChange's INSERT OR IGNORE
+-- dedup is unchanged. Legacy databases are rebuilt into this shape by
+-- migrateCrdtChangesSeq (schema-init.ts).
+CREATE TABLE IF NOT EXISTS crdt_changes (
+  seq     INTEGER PRIMARY KEY AUTOINCREMENT,
+  hlc     TEXT NOT NULL,
+  node_id TEXT NOT NULL,
+  dataset TEXT NOT NULL,
+  row_id  TEXT NOT NULL,
+  col     TEXT NOT NULL,
+  value   TEXT,
+  txn     TEXT,
+  UNIQUE (dataset, row_id, col, hlc)
+);
+CREATE INDEX IF NOT EXISTS idx_changes_hlc ON crdt_changes(hlc);
+-- GuestIntent idempotency probes by txn prefix on every guest write. Keep the
+-- sparse legacy/null majority out of the index.
+CREATE INDEX IF NOT EXISTS idx_changes_txn ON crdt_changes(txn)
+  WHERE txn IS NOT NULL;
+-- Receipt GC is age-based and runs on every intent/sync maintenance path.
+CREATE INDEX IF NOT EXISTS idx_changes_intent_receipt_hlc ON crdt_changes(hlc)
+  WHERE dataset = 'intent_receipts';
+-- migrateSiteChannels replays only the tail past its watermark on every open;
+-- partial index keeps that probe off a full-table scan (site_channels rows are
+-- a tiny minority of the oplog).
+CREATE INDEX IF NOT EXISTS idx_changes_site_channels_seq ON crdt_changes(seq)
+  WHERE dataset = 'site_channels';
+-- Serves history's "every block ever attached to this doc" lookup. Partial so
+-- it never indexes the large values other datasets carry (e.g. site file bodies).
+CREATE INDEX IF NOT EXISTS idx_changes_docref ON crdt_changes(value)
+  WHERE dataset = 'doc_blocks' AND col = 'doc_id';
+
+-- Per-peer replication cursors (crdt_changes.seq: AUTOINCREMENT, monotonic in
+-- insertion order and stable across VACUUM, so no change is ever skipped
+-- regardless of HLC/clock skew). Outbound side of
+-- a pairing: "token" is the credential the *remote* issued to us (sent as a
+-- Bearer header when we sync to them). See migratePeers in db.ts for the columns
+-- added to legacy databases.
+--
+-- kind selects the transport: 'http' (POST /sync to a peer server, the classic
+-- path) or 's3' (an S3-compatible bucket used as dumb store-and-forward — see
+-- sync/storage.ts). For 's3' peers url is a synthetic key (s3://<bucket>/<prefix>)
+-- and config holds the bucket settings + credentials + master key as JSON.
+-- Like the rest of peers, config is local-only and never enters the CRDT oplog.
+CREATE TABLE IF NOT EXISTS peers (
+  url          TEXT PRIMARY KEY,
+  pull_cursor  INTEGER NOT NULL DEFAULT 0,
+  push_cursor  INTEGER NOT NULL DEFAULT 0,
+  token        TEXT,
+  label        TEXT,
+  node_id      TEXT,
+  enabled      INTEGER NOT NULL DEFAULT 1,
+  last_sync_at INTEGER,
+  last_success_at INTEGER,
+  last_status  TEXT,
+  last_error   TEXT,
+  kind         TEXT NOT NULL DEFAULT 'http',
+  config       TEXT
+);
+
+-- Per-(storage-peer, remote-node) pull progress: the key of the last oplog
+-- segment we consumed from that node's bucket prefix. HTTP peers use the single
+-- pull_cursor above; storage peers need one cursor per remote node because each
+-- node publishes its own segment stream under its own prefix. last_key is a
+-- bucket object key (lexicographically ordered = chronological), so LIST
+-- start-after resumes exactly where we left off.
+CREATE TABLE IF NOT EXISTS storage_cursors (
+  peer_url TEXT NOT NULL,
+  node_id  TEXT NOT NULL,
+  last_key TEXT,
+  PRIMARY KEY (peer_url, node_id)
+);
+
+-- Owner-side shadow of a room partition (sync/partition.ts): which (dataset,
+-- row_id) pairs THIS node last told a given room peer about. Node-local like
+-- peers/storage_cursors — deliberately absent from crdt.ts's DOMAIN map, never
+-- in the oplog, never synced (each device keeps its own shadow; cross-device
+-- shadow splits are healed by the room protocol's need_baseline/digest layers,
+-- not by syncing shadows). peer_key is the peers.url of a kind='room' row.
+CREATE TABLE IF NOT EXISTS room_rows (
+  peer_key TEXT NOT NULL,
+  dataset  TEXT NOT NULL,
+  row_id   TEXT NOT NULL,
+  PRIMARY KEY (peer_key, dataset, row_id)
+);
+
+-- Inbound side of a pairing: credentials *we* issued to remote devices. A peer
+-- presents one of these on /sync; acceptsSyncToken() checks it alongside the
+-- managed master token. Revoke by deleting the row.
+CREATE TABLE IF NOT EXISTS peer_grants (
+  token      TEXT PRIMARY KEY,
+  peer_url   TEXT,
+  node_id    TEXT,
+  created_at INTEGER
+);
+
+-- One-time pairing codes minted by "mh config peer code" / POST /api/pair/new.
+-- Short-lived and single-use: redeemed during the pairing handshake, then the
+-- two devices exchange durable peer_grants. used/exp gate redemption.
+CREATE TABLE IF NOT EXISTS pairing_codes (
+  code       TEXT PRIMARY KEY,
+  exp        INTEGER NOT NULL,
+  used       INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER
+);
+
+-- Public capability links to a doc / database / site. Like peers and blob_cache
+-- this is node-local and deliberately ABSENT from crdt.ts's DOMAIN map, so it
+-- never enters the oplog and never syncs — a share is a property of the access
+-- point that minted it, not of the workspace. slug is the unguessable capability
+-- in the URL (/share/<slug>). transport selects how it's served: 'server' (the
+-- token-exempt /share endpoint on this node) or 's3' (a presigned static export
+-- under <prefix>/shares/<slug> in a bucket). permission 'edit' is server-only:
+-- a presigned static object can't accept writes. guest_node_id attributes every
+-- edit made through an edit-share to one synthetic node (see crdt.ts withNodeId).
+-- pw_hash/pw_salt: server path stores a PBKDF2 verifier; the s3 path is E2EE so
+-- only pw_salt travels (in the link) and decryption happens in the viewer.
+CREATE TABLE IF NOT EXISTS shares (
+  slug             TEXT PRIMARY KEY,
+  kind             TEXT NOT NULL,   -- 'doc' | 'database' | 'site'
+  target_id        TEXT NOT NULL,   -- documents.id / databases.id / sites.id
+  permission       TEXT NOT NULL,   -- 'view' | 'edit'
+  transport        TEXT NOT NULL,   -- 'server' | 's3'
+  pw_salt          TEXT,            -- base64; null = no password
+  pw_hash          TEXT,            -- base64 PBKDF2 verifier (server path only)
+  expires_at       INTEGER,         -- epoch ms; null = never
+  guest_node_id    TEXT,            -- synthetic node id for edit shares (null for view)
+  served_base      TEXT,            -- reachable base URL chosen at creation (link / source label)
+  s3_peer_url      TEXT,            -- vestigial (s3 shares live in the bucket, not here)
+  s3_object_prefix TEXT,            -- vestigial
+  s3_presign_exp   INTEGER,         -- vestigial
+  s3_key_b64       TEXT,            -- vestigial
+  created_at       INTEGER NOT NULL,
+  request_id       TEXT,            -- idempotency key for remote share creation
+  grants           TEXT             -- serialized GrantSet for /share/<slug>/api/* (node-local like the
+                                    -- rest of the row: revoking the share kills the grants with it)
+);
+CREATE INDEX IF NOT EXISTS idx_shares_target ON shares(target_id);
+
+CREATE TABLE IF NOT EXISTS databases (
+  id          TEXT PRIMARY KEY,
+  name        TEXT,
+  icon        TEXT,
+  meta        TEXT,               -- JSON: generic replicated metadata (e.g. UI flags), one LWW register
+  created_hlc TEXT,
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS properties (
+  id          TEXT PRIMARY KEY,
+  database_id TEXT,
+  name        TEXT,
+  type        TEXT,
+  config      TEXT,
+  position    REAL,
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_properties_db ON properties(database_id);
+
+-- One row per record. Field cells live in the data JSON object, keyed by
+-- property id (rename-safe). Each (record,property) is still an independent
+-- CRDT register in the oplog; materialize() folds the winner into data via
+-- json_set/json_remove. Hot fields get expression indexes on data->>'propid'
+-- (see indexing.ts) so filter/sort/limit push down to SQL.
+CREATE TABLE IF NOT EXISTS records (
+  id          TEXT PRIMARY KEY,
+  database_id TEXT,
+  created_hlc TEXT,
+  order_key   TEXT,
+  data        TEXT NOT NULL DEFAULT '{}',
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_records_db_hlc ON records(database_id, created_hlc);
+
+CREATE TABLE IF NOT EXISTS documents (
+  id          TEXT PRIMARY KEY,
+  title       TEXT,
+  body        TEXT,        -- materialized cache: serialized from doc_blocks
+  database_id TEXT,
+  parent_id   TEXT,
+  created_hlc TEXT,
+  order_key   TEXT,        -- fractional index among siblings (same parent_id); ties broken by created_hlc,id
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
+
+-- Document body as an ordered list of blocks; each (block,field) is an
+-- independent CRDT register so concurrent edits to different blocks merge.
+-- order_key is a fractional index (ties broken by id) giving display order.
+CREATE TABLE IF NOT EXISTS doc_blocks (
+  id          TEXT PRIMARY KEY,
+  doc_id      TEXT,
+  text        TEXT,
+  order_key   TEXT,
+  blank_after INTEGER NOT NULL DEFAULT 0,  -- extra blank lines kept after this block (user spacing)
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_doc_blocks_doc ON doc_blocks(doc_id);
+
+-- A named static site (Supabase-Storage-style bucket). Served at /sites/<name>/.
+CREATE TABLE IF NOT EXISTS sites (
+  id          TEXT PRIMARY KEY,
+  name        TEXT,        -- URL slug; resolved by getSiteByName
+  title       TEXT,
+  created_hlc TEXT,
+  visibility  TEXT,        -- exactly 'public' = token-free serving; anything else = private (isSitePublic)
+  spa         INTEGER NOT NULL DEFAULT 0,  -- 1 = extension-less misses fall back to index.html
+  public_grants TEXT,      -- serialized GrantSet for anonymous /sites/<name>/api/*; synced register,
+                           -- readers MUST go through parseGrantSet (default-deny on any junk)
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
+
+-- Synced desired-state control plane for each way a site is reachable. Access
+-- policy and hosting are separate axes; controller_node_id names the node that
+-- owns any node-local secret/cleanup work. Runtime success is NOT synced here
+-- (see node-local site_channel_observations below).
+CREATE TABLE IF NOT EXISTS site_channels (
+  id                 TEXT PRIMARY KEY,
+  site_id            TEXT,
+  audience           TEXT, -- 'public' | 'link'
+  hosting            TEXT, -- 'device' | 'edge'
+  controller_node_id TEXT,
+  target_ref         TEXT, -- serving node id (device) / capability slug (edge)
+  canonical_url      TEXT,
+  policy_json        TEXT,
+  desired_state      TEXT, -- 'active' | 'revoked'
+  created_hlc        TEXT,
+  __deleted          INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_site_channels_site ON site_channels(site_id);
+
+-- What THIS node has actually observed while applying a channel's desired
+-- state. Never replicated: readiness/errors are node-relative facts.
+CREATE TABLE IF NOT EXISTS site_channel_observations (
+  channel_id       TEXT PRIMARY KEY,
+  status           TEXT NOT NULL,
+  last_verified_at INTEGER,
+  last_error       TEXT
+);
+
+-- One row per file in a site. content holds inline utf8/base64 text, or a blob
+-- hash (see cache.ts) when encoding = 'blob'. (site_id, path) maps to a stable
+-- id so re-uploads merge as a CRDT register instead of duplicating.
+CREATE TABLE IF NOT EXISTS site_files (
+  id           TEXT PRIMARY KEY,
+  site_id      TEXT,
+  path         TEXT,
+  content_type TEXT,
+  encoding     TEXT,       -- 'utf8' | 'base64' | 'blob'
+  content      TEXT,
+  created_hlc  TEXT,
+  __deleted    INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_site_files_site ON site_files(site_id);
+
+-- Node-local blob cache ledger (NOT synced, like peers/storage_cursors): one row
+-- per blob byte-file held in cache.ts's content-addressed store (~/.metahub/cache).
+-- Gives the bare hash-named files the metadata clearing/stats need. hash is the
+-- canonical content key (sha256 truncated to 32 hex; legacy 64-hex coexist).
+-- pending = bytes produced HERE not yet confirmed flushed to a durable anchor
+-- (bucket) — the only blobs a device must protect; never auto-evicted/cleared.
+-- pending=0 means a flushed production OR an acquired cache, both safely
+-- clearable (re-fetchable). This local fact replaces the old SYNCED blob_presence
+-- table — clearing is now purely local/offline. See blobs.ts / 22-blob-sync.
+CREATE TABLE IF NOT EXISTS blob_cache (
+  hash         TEXT PRIMARY KEY,
+  size         INTEGER NOT NULL,
+  content_type TEXT,
+  last_access  INTEGER,
+  pinned       INTEGER NOT NULL DEFAULT 0, -- node-local: never auto-evicted / cleared
+  pending      INTEGER NOT NULL DEFAULT 1, -- produced here, not yet flushed to anchor
+  anchored     INTEGER NOT NULL DEFAULT 0  -- node-local: last verify confirmed a designated anchor holds it (per redundancy). Drives isClearable; reset on policy change
+);
+
+-- Node-local ledger of write-inbox envelopes the ingest isolation layer refused
+-- (drop-pull.ts): the reason is recorded here, then the envelope is deleted from
+-- the edge host (invalid mail never occupies inbox capacity). NOT synced — like
+-- peers/blob_cache, this is a fact about what THIS node saw, not workspace data.
+CREATE TABLE IF NOT EXISTS drop_rejects (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  drop_id     TEXT NOT NULL,
+  envelope_id TEXT,
+  reason      TEXT NOT NULL,
+  created_at  INTEGER NOT NULL
+);
+
+-- Synced workspace policy (single row "default"): which nodes are designated
+-- full-blob libraries — the durable anchor in no-bucket topologies (they pull
+-- everything and never clear). full_nodes is a JSON array of node_id; redundancy
+-- is retained but unused since clearing moved to the local pending model.
+CREATE TABLE IF NOT EXISTS blob_policy (
+  id          TEXT PRIMARY KEY,  -- always "default"
+  full_nodes  TEXT,              -- JSON array of node_id
+  redundancy  TEXT,              -- 'all' | 'any'
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
+`;
+var FTS_SCHEMA = `
+CREATE VIRTUAL TABLE IF NOT EXISTS search_fts USING fts5(
+  kind UNINDEXED,
+  id UNINDEXED,
+  database_id UNINDEXED,
+  title,
+  body
+);
+`;
+
+// src/core/documents.ts
+var DOCUMENT_COLS = [
+  "id",
+  "title",
+  "body",
+  "database_id",
+  "parent_id",
+  "created_hlc",
+  "order_key"
+];
+var DOCUMENT_SELECT = DOCUMENT_COLS.join(", ");
+var DOC_SUMMARY_COLS = [
+  "id",
+  "title",
+  "database_id",
+  "parent_id",
+  "created_hlc",
+  "order_key"
+];
+var DOC_SUMMARY_SELECT = DOC_SUMMARY_COLS.join(", ");
+function liveBlocks(db, docId) {
+  return db.query("SELECT id, text, order_key, blank_after FROM doc_blocks WHERE doc_id = ? AND __deleted = 0 ORDER BY order_key, id").all(docId);
+}
+function makeBlockId(text) {
+  return newId("blk", text.split(`
+`, 1)[0] ?? "");
+}
+function emitBlock(db, docId, fields) {
+  const id = makeBlockId(fields.text);
+  emit(db, "doc_blocks", id, "doc_id", docId);
+  emit(db, "doc_blocks", id, "order_key", fields.order_key);
+  if (fields.blankAfter)
+    emit(db, "doc_blocks", id, "blank_after", fields.blankAfter);
+  emit(db, "doc_blocks", id, "text", fields.text);
+}
+function insertBlocks(db, docId, blocks, after, before) {
+  const keys = keysBetween(after, before, blocks.length);
+  blocks.forEach((b, i) => emitBlock(db, docId, { text: b.text, order_key: keys[i], blankAfter: b.blankAfter }));
+}
+function ensureBlocks(db, docId) {
+  if (db.query("SELECT 1 AS x FROM doc_blocks WHERE doc_id = ? LIMIT 1").get(docId))
+    return;
+  const row = db.query("SELECT body FROM documents WHERE id = ?").get(docId);
+  const blocks = parseDocBlocks(row?.body ?? "");
+  if (blocks.length)
+    insertBlocks(db, docId, blocks, null, null);
+}
+function reconcileBody(db, docId, body) {
+  const old = liveBlocks(db, docId);
+  const next = parseDocBlocks(body);
+  const plan = reconcile(old.map((b) => b.text), next.map((b) => b.text));
+  for (const oi of plan.deleted)
+    emit(db, "doc_blocks", old[oi].id, "__deleted", 1);
+  const { items } = plan;
+  let i = 0;
+  while (i < items.length) {
+    const it = items[i];
+    if ("keep" in it) {
+      const oldB = old[it.keep];
+      const want = next[i].blankAfter;
+      if ((oldB.blank_after ?? 0) !== want)
+        emit(db, "doc_blocks", oldB.id, "blank_after", want);
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < items.length && "insert" in items[j])
+      j++;
+    const left = i > 0 ? old[items[i - 1].keep].order_key : null;
+    const right = j < items.length ? old[items[j].keep].order_key : null;
+    insertBlocks(db, docId, next.slice(i, j), left, right);
+    i = j;
+  }
+}
+function documentVersion(db, id) {
+  const row = db.query(`SELECT MAX(hlc) AS h FROM crdt_changes
+       WHERE (dataset = 'documents' AND row_id = ?)
+          OR (dataset = 'doc_blocks' AND row_id IN (SELECT id FROM doc_blocks WHERE doc_id = ?))`).get(id, id);
+  return row.h ?? "";
+}
+var createDocument = grouped(function createDocument2(db, opts) {
+  const id = newId("doc", opts.title);
+  const first = emit(db, "documents", id, "title", opts.title);
+  emit(db, "documents", id, "created_hlc", first.hlc);
+  if (opts.database_id !== undefined)
+    emit(db, "documents", id, "database_id", opts.database_id);
+  if (opts.parent_id !== undefined)
+    emit(db, "documents", id, "parent_id", opts.parent_id);
+  placeInSiblings(db, id, opts.parent_id ?? null);
+  if (opts.body !== undefined) {
+    const blocks = parseDocBlocks(opts.body);
+    if (blocks.length)
+      insertBlocks(db, id, blocks, null, null);
+  }
+  return getDocument(db, id);
+});
+function getDocument(db, id) {
+  return db.query(`SELECT ${DOCUMENT_SELECT} FROM documents WHERE id = ? AND __deleted = 0`).get(id);
+}
+var ORDER_BY = "ORDER BY order_key IS NULL, order_key, created_hlc, id";
+function siblingWhere(parentId) {
+  return parentId === null ? { clause: "parent_id IS NULL", args: [] } : { clause: "parent_id = ?", args: [parentId] };
+}
+function canEmitOrderKeys2(db) {
+  return tableExists2(db, "meta") && tableExists2(db, "crdt_changes");
+}
+function tableExists2(db, table) {
+  return db.query("SELECT 1 AS ok FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function lastSiblingOrderKey(db, parentId, excludeId) {
+  const w = siblingWhere(parentId);
+  const exclude = excludeId ? " AND id <> ?" : "";
+  const row = db.query(`SELECT order_key FROM documents WHERE ${w.clause}${exclude}
+       AND __deleted = 0 AND order_key IS NOT NULL
+       ORDER BY order_key DESC, id DESC LIMIT 1`).get(...w.args, ...excludeId ? [excludeId] : []);
+  return row?.order_key ?? null;
+}
+function orderedSiblings(db, parentId) {
+  const w = siblingWhere(parentId);
+  return db.query(`SELECT id, order_key FROM documents WHERE ${w.clause} AND __deleted = 0 ${ORDER_BY}`).all(...w.args);
+}
+function rebalanceSiblings(db, parentId) {
+  const rows = orderedSiblings(db, parentId);
+  const keys = keysBetween(null, null, rows.length);
+  rows.forEach((row, i) => {
+    if (row.order_key !== keys[i])
+      emit(db, "documents", row.id, "order_key", keys[i]);
+  });
+}
+function backfillSiblings(db, parentId) {
+  const emitChange = canEmitOrderKeys2(db);
+  const w = siblingWhere(parentId);
+  const missing = db.query(`SELECT id FROM documents WHERE ${w.clause} AND __deleted = 0 AND order_key IS NULL
+       ORDER BY created_hlc, id`).all(...w.args);
+  if (!missing.length)
+    return;
+  const keys = keysBetween(lastSiblingOrderKey(db, parentId), null, missing.length);
+  missing.forEach((row, i) => {
+    if (emitChange)
+      emit(db, "documents", row.id, "order_key", keys[i]);
+    else
+      db.query("UPDATE documents SET order_key = ? WHERE id = ?").run(keys[i], row.id);
+  });
+}
+var backfillDocumentOrderKeys = grouped(function backfillDocumentOrderKeys2(db) {
+  const parents = db.query("SELECT DISTINCT parent_id FROM documents WHERE __deleted = 0 AND order_key IS NULL").all();
+  for (const p of parents)
+    backfillSiblings(db, p.parent_id);
+});
+function placeInSiblings(db, id, parentId, anchor) {
+  let cur = parentId;
+  while (cur) {
+    if (cur === id)
+      throw new MhError("invalid_input", `cannot set parent_id: would create a cycle (${id})`);
+    cur = getDocument(db, cur)?.parent_id ?? null;
+  }
+  const current = getDocument(db, id);
+  if (current && (current.parent_id ?? null) !== parentId)
+    emit(db, "documents", id, "parent_id", parentId);
+  let key;
+  if (!anchor) {
+    key = keyBetween(lastSiblingOrderKey(db, parentId, id), null);
+  } else {
+    backfillSiblings(db, parentId);
+    const neighbors = () => {
+      const rows = orderedSiblings(db, parentId).filter((r) => r.id !== id);
+      const to = rows.findIndex((r) => r.id === anchor.targetId);
+      if (to < 0)
+        throw new MhError("not_found", `no such target document: ${anchor.targetId}`);
+      return anchor.where === "before" ? [rows[to - 1]?.order_key ?? null, rows[to].order_key] : [rows[to].order_key, rows[to + 1]?.order_key ?? null];
+    };
+    let [left, right] = neighbors();
+    if (left !== null && right !== null && left >= right) {
+      rebalanceSiblings(db, parentId);
+      [left, right] = neighbors();
+    }
+    key = keyBetween(left, right);
+  }
+  emit(db, "documents", id, "order_key", key);
+}
+var moveDocument = grouped(function moveDocument2(db, id, targetId, where) {
+  const src = getDocument(db, id);
+  if (!src)
+    throw new MhError("not_found", `no such document: ${id}`);
+  if (id === targetId)
+    return src;
+  const target = getDocument(db, targetId);
+  if (!target)
+    throw new MhError("not_found", `no such target document: ${targetId}`);
+  if (where === "into")
+    placeInSiblings(db, id, targetId);
+  else
+    placeInSiblings(db, id, target.parent_id, { targetId, where });
+  return getDocument(db, id);
+});
+var duplicateDocument = grouped(function duplicateDocument2(db, id, opts = {}) {
+  const src = getDocument(db, id);
+  if (!src)
+    throw new MhError("not_found", `no such document: ${id}`);
+  ensureBlocks(db, id);
+  const blocks = liveBlocks(db, id);
+  const parentId = opts.parentId !== undefined ? opts.parentId : src.parent_id;
+  const dup = createDocument(db, {
+    title: opts.title ?? src.title,
+    database_id: src.database_id ?? undefined,
+    parent_id: parentId ?? undefined
+  });
+  if (blocks.length)
+    insertBlocks(db, dup.id, blocks.map((b) => ({ text: b.text, blankAfter: b.blank_after })), null, null);
+  if (parentId === src.parent_id)
+    moveDocument(db, dup.id, src.id, "after");
+  return getDocument(db, dup.id);
+});
+var updateDocument = grouped(function updateDocument2(db, id, fields, opts = {}) {
+  const doc = getDocument(db, id);
+  if (!doc)
+    throw new MhError("not_found", `no such document: ${id}`);
+  if (opts.ifMatch !== undefined && documentVersion(db, id) !== opts.ifMatch)
+    throw new MhError("stale", `stale: document changed since ${opts.ifMatch}; re-read first`);
+  if (fields.title !== undefined && fields.title !== (doc.title ?? ""))
+    emit(db, "documents", id, "title", fields.title);
+  if (fields.database_id !== undefined && fields.database_id !== (doc.database_id ?? null))
+    emit(db, "documents", id, "database_id", fields.database_id);
+  if (fields.parent_id !== undefined) {
+    const next = fields.parent_id ?? null;
+    if ((getDocument(db, id).parent_id ?? null) !== next)
+      placeInSiblings(db, id, next);
+  }
+  if (fields.body !== undefined) {
+    ensureBlocks(db, id);
+    reconcileBody(db, id, fields.body);
+  }
+  return getDocument(db, id);
+});
+var editDocument = grouped(function editDocument2(db, id, opts) {
+  if (!getDocument(db, id))
+    throw new MhError("not_found", `no such document: ${id}`);
+  if (opts.ifMatch !== undefined && documentVersion(db, id) !== opts.ifMatch)
+    throw new MhError("stale", `stale: document changed since ${opts.ifMatch}; re-read first`);
+  if (opts.old === "")
+    throw new MhError("invalid_input", "--old must not be empty");
+  ensureBlocks(db, id);
+  const blocks = liveBlocks(db, id);
+  const body = serializeDocBlocks(blocks.map((b) => ({ text: b.text, blankAfter: b.blank_after })));
+  const count = countOccurrences(body, opts.old);
+  if (count === 0)
+    throw new MhError("invalid_input", `anchor not found: no match for --old`);
+  if (count > 1 && !opts.replaceAll)
+    throw new MhError("ambiguous", `${count} matches for --old; add surrounding context or use --replace-all`);
+  if (!opts.old.includes(`
+
+`)) {
+    const affected = blocks.filter((b) => b.text.includes(opts.old));
+    const next = affected.map((b) => opts.replaceAll ? b.text.replaceAll(opts.old, () => opts.new) : b.text.replace(opts.old, () => opts.new));
+    if (next.every((t) => t.length > 0 && !t.includes(`
+
+`))) {
+      const targets = opts.replaceAll ? affected : affected.slice(0, 1);
+      let wrote = false;
+      targets.forEach((b, i) => {
+        if (next[i] !== b.text) {
+          emit(db, "doc_blocks", b.id, "text", next[i]);
+          wrote = true;
+        }
+      });
+      return { id, changed: wrote, replaced: opts.replaceAll ? count : 1, version: documentVersion(db, id) };
+    }
+  }
+  const newBody = opts.replaceAll ? body.replaceAll(opts.old, () => opts.new) : body.replace(opts.old, () => opts.new);
+  reconcileBody(db, id, newBody);
+  return { id, changed: newBody !== body, replaced: opts.replaceAll ? count : 1, version: documentVersion(db, id) };
+});
+var editDocumentBatch = grouped(function editDocumentBatch2(db, id, opts) {
+  if (!getDocument(db, id))
+    throw new MhError("not_found", `no such document: ${id}`);
+  if (opts.edits.length === 0)
+    throw new MhError("invalid_input", "no edits given");
+  if (opts.ifMatch !== undefined && documentVersion(db, id) !== opts.ifMatch)
+    throw new MhError("stale", `stale: document changed since ${opts.ifMatch}; re-read first`);
+  ensureBlocks(db, id);
+  const orig = serializeDocBlocks(liveBlocks(db, id).map((b) => ({ text: b.text, blankAfter: b.blank_after })));
+  let body = orig;
+  let total = 0;
+  opts.edits.forEach((e, i) => {
+    if (e.old === "")
+      throw new MhError("invalid_input", `edit[${i}]: old must not be empty`);
+    const count = countOccurrences(body, e.old);
+    if (count === 0)
+      throw new MhError("invalid_input", `edit[${i}]: anchor not found: no match for old`);
+    if (count > 1 && !e.replaceAll)
+      throw new MhError("ambiguous", `edit[${i}]: ${count} matches for old; add surrounding context or set replaceAll`);
+    const repl = e.new ?? "";
+    body = e.replaceAll ? body.replaceAll(e.old, () => repl) : body.replace(e.old, () => repl);
+    total += e.replaceAll ? count : 1;
+  });
+  if (body !== orig)
+    reconcileBody(db, id, body);
+  return { id, changed: body !== orig, replaced: total, version: documentVersion(db, id) };
+});
+var appendDocument = grouped(function appendDocument2(db, id, body) {
+  if (!getDocument(db, id))
+    throw new MhError("not_found", `no such document: ${id}`);
+  ensureBlocks(db, id);
+  const next = parseDocBlocks(body);
+  if (next.length) {
+    const blocks = liveBlocks(db, id);
+    const last = blocks.length ? blocks[blocks.length - 1].order_key : null;
+    insertBlocks(db, id, next, last, null);
+  }
+  return { id, changed: next.length > 0, replaced: next.length, version: documentVersion(db, id) };
+});
+var prependDocument = grouped(function prependDocument2(db, id, body) {
+  if (!getDocument(db, id))
+    throw new MhError("not_found", `no such document: ${id}`);
+  ensureBlocks(db, id);
+  const next = parseDocBlocks(body);
+  if (next.length) {
+    const blocks = liveBlocks(db, id);
+    const first = blocks.length ? blocks[0].order_key : null;
+    insertBlocks(db, id, next, null, first);
+  }
+  return { id, changed: next.length > 0, replaced: next.length, version: documentVersion(db, id) };
+});
+var deleteDocument = grouped(function deleteDocument2(db, id) {
+  if (!getDocument(db, id))
+    return false;
+  emit(db, "documents", id, "__deleted", 1);
+  for (const b of liveChildIds(db, "doc_blocks", "doc_id", id))
+    emit(db, "doc_blocks", b, "__deleted", 1);
+  for (const c of liveChildIds(db, "documents", "parent_id", id))
+    emit(db, "documents", c, "parent_id", null);
+  return true;
+});
+function liveChildIds(db, table, col, parentId) {
+  return db.query(`SELECT id FROM ${table} WHERE ${col} = ? AND __deleted = 0`).all(parentId).map((r) => r.id);
+}
+function countOccurrences(haystack, needle) {
+  if (needle === "")
+    return 0;
+  let n = 0;
+  let i = haystack.indexOf(needle);
+  while (i !== -1) {
+    n++;
+    i = haystack.indexOf(needle, i + needle.length);
+  }
+  return n;
+}
+
+// src/core/blobs-core.ts
+var POLICY_ID = "default";
+function readPolicy(db) {
+  const row = db.query("SELECT full_nodes, redundancy FROM blob_policy WHERE id = ? AND __deleted = 0").get(POLICY_ID);
+  let fullNodes = [];
+  if (row?.full_nodes) {
+    try {
+      const parsed = JSON.parse(row.full_nodes);
+      if (Array.isArray(parsed))
+        fullNodes = parsed.filter((n) => typeof n === "string");
+    } catch {}
+  }
+  const redundancy = row?.redundancy === "any" ? "any" : "all";
+  return { fullNodes, redundancy };
+}
+var setFullNodes = (db, nodeIds) => {
+  withChangeGroup(null, () => {
+    const seen = new Set;
+    const list = nodeIds.filter((n) => n && !seen.has(n) && seen.add(n) != null);
+    emit(db, "blob_policy", POLICY_ID, "full_nodes", list);
+    const cur = readPolicy(db);
+    if (cur.redundancy == null)
+      emit(db, "blob_policy", POLICY_ID, "redundancy", "all");
+  });
+  invalidateAnchored(db);
+};
+function invalidateAnchored(db) {
+  db.query("UPDATE blob_cache SET anchored = 0").run();
+  db.query("DELETE FROM meta WHERE key = ?").run(BLOB_VERIFIED_AT_KEY);
+}
+var BLOB_VERIFIED_AT_KEY = "blob_verified_at";
+
+// src/core/sync/storage-url.ts
+var DEFAULT_STORAGE_PREFIX = "metahub";
+var DEFAULT_PORT = { "https:": "443", "http:": "80" };
+function storageEndpointHost(endpoint) {
+  try {
+    const u = new URL(endpoint);
+    const port = u.port && u.port !== DEFAULT_PORT[u.protocol] ? `:${u.port}` : "";
+    return u.hostname + port;
+  } catch {
+    return endpoint.trim().replace(/^[a-z]+:\/\//i, "").replace(/\/.*$/, "").replace(/:(80|443)$/, "");
+  }
+}
+function storageUrl(endpoint, bucket, prefix) {
+  const p = prefix?.trim() || DEFAULT_STORAGE_PREFIX;
+  return `s3://${storageEndpointHost(endpoint)}/${bucket}/${p}`;
+}
+
+// src/core/schema-init.ts
+function runSchema(db) {
+  db.exec(CORE_SCHEMA);
+  try {
+    db.exec(FTS_SCHEMA);
+  } catch {}
+}
+function hasColumn(db, table, column) {
+  const cols = db.query(`PRAGMA table_info(${table})`).all();
+  return cols.some((c) => c.name === column);
+}
+function tableExists3(db, table) {
+  return db.query("SELECT 1 AS ok FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function migrateRecords(db) {
+  if (!hasColumn(db, "records", "data"))
+    db.exec("ALTER TABLE records ADD COLUMN data TEXT NOT NULL DEFAULT '{}'");
+  if (!hasColumn(db, "records", "order_key"))
+    db.exec("ALTER TABLE records ADD COLUMN order_key TEXT");
+  if (!tableExists3(db, "record_values"))
+    return;
+  const tx = db.transaction(() => {
+    db.exec(`
+      UPDATE records SET data = coalesce((
+        SELECT json_group_object(rv.property_id, json(rv.value))
+        FROM record_values rv WHERE rv.record_id = records.id
+      ), '{}')
+      WHERE id IN (SELECT DISTINCT record_id FROM record_values);
+    `);
+    db.exec("DROP TABLE record_values");
+    backfillRecordOrderKeys(db);
+  });
+  tx();
+  backfillRecordOrderKeys(db);
+}
+function migrateShares(db) {
+  if (!hasColumn(db, "shares", "served_base"))
+    db.exec("ALTER TABLE shares ADD COLUMN served_base TEXT");
+  if (!hasColumn(db, "shares", "grants"))
+    db.exec("ALTER TABLE shares ADD COLUMN grants TEXT");
+  if (!hasColumn(db, "shares", "request_id"))
+    db.exec("ALTER TABLE shares ADD COLUMN request_id TEXT");
+  db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_shares_request_id ON shares(request_id) WHERE request_id IS NOT NULL");
+}
+function migratePeers(db) {
+  const add = [
+    ["token", "TEXT"],
+    ["label", "TEXT"],
+    ["node_id", "TEXT"],
+    ["enabled", "INTEGER NOT NULL DEFAULT 1"],
+    ["last_sync_at", "INTEGER"],
+    ["last_success_at", "INTEGER"],
+    ["last_status", "TEXT"],
+    ["last_error", "TEXT"],
+    ["kind", "TEXT NOT NULL DEFAULT 'http'"],
+    ["config", "TEXT"]
+  ];
+  for (const [col, decl] of add) {
+    if (!hasColumn(db, "peers", col))
+      db.exec(`ALTER TABLE peers ADD COLUMN ${col} ${decl}`);
+  }
+  db.exec("UPDATE peers SET last_success_at = last_sync_at " + "WHERE last_success_at IS NULL AND last_status = 'ok' AND last_sync_at IS NOT NULL");
+}
+function migrateDocBlocks(db) {
+  if (!hasColumn(db, "doc_blocks", "blank_after"))
+    db.exec("ALTER TABLE doc_blocks ADD COLUMN blank_after INTEGER NOT NULL DEFAULT 0");
+}
+function migrateBlobCache(db) {
+  if (!hasColumn(db, "blob_cache", "pinned"))
+    db.exec("ALTER TABLE blob_cache ADD COLUMN pinned INTEGER NOT NULL DEFAULT 0");
+  if (!hasColumn(db, "blob_cache", "pending"))
+    db.exec("ALTER TABLE blob_cache ADD COLUMN pending INTEGER NOT NULL DEFAULT 1");
+  if (!hasColumn(db, "blob_cache", "anchored"))
+    db.exec("ALTER TABLE blob_cache ADD COLUMN anchored INTEGER NOT NULL DEFAULT 0");
+  db.exec("DROP TABLE IF EXISTS blob_presence");
+}
+function migrateDocuments(db) {
+  if (!hasColumn(db, "documents", "order_key"))
+    db.exec("ALTER TABLE documents ADD COLUMN order_key TEXT");
+  backfillDocumentOrderKeys(db);
+}
+function migrateOplog(db) {
+  if (!hasColumn(db, "crdt_changes", "txn"))
+    db.exec("ALTER TABLE crdt_changes ADD COLUMN txn TEXT");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_changes_txn ON crdt_changes(txn) WHERE txn IS NOT NULL");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_changes_intent_receipt_hlc ON crdt_changes(hlc) WHERE dataset = 'intent_receipts'");
+}
+function migrateCrdtChangesSeq(db) {
+  if (hasColumn(db, "crdt_changes", "seq"))
+    return;
+  const tx = db.transaction(() => {
+    db.exec(`
+      DROP TABLE IF EXISTS crdt_changes_new;
+      CREATE TABLE crdt_changes_new (
+        seq     INTEGER PRIMARY KEY AUTOINCREMENT,
+        hlc     TEXT NOT NULL,
+        node_id TEXT NOT NULL,
+        dataset TEXT NOT NULL,
+        row_id  TEXT NOT NULL,
+        col     TEXT NOT NULL,
+        value   TEXT,
+        txn     TEXT,
+        UNIQUE (dataset, row_id, col, hlc)
+      );
+      INSERT INTO crdt_changes_new (seq, hlc, node_id, dataset, row_id, col, value, txn)
+        SELECT rowid, hlc, node_id, dataset, row_id, col, value, txn
+        FROM crdt_changes ORDER BY rowid;
+      DROP TABLE crdt_changes;
+      ALTER TABLE crdt_changes_new RENAME TO crdt_changes;
+      CREATE INDEX IF NOT EXISTS idx_changes_hlc ON crdt_changes(hlc);
+      CREATE INDEX IF NOT EXISTS idx_changes_txn ON crdt_changes(txn)
+        WHERE txn IS NOT NULL;
+      CREATE INDEX IF NOT EXISTS idx_changes_intent_receipt_hlc ON crdt_changes(hlc)
+        WHERE dataset = 'intent_receipts';
+      CREATE INDEX IF NOT EXISTS idx_changes_docref ON crdt_changes(value)
+        WHERE dataset = 'doc_blocks' AND col = 'doc_id';
+    `);
+    if (tableExists3(db, "peers"))
+      db.exec("UPDATE peers SET push_cursor = 0, pull_cursor = 0");
+  });
+  tx();
+}
+function migrateStoragePeerUrls(db) {
+  if (!tableExists3(db, "peers"))
+    return;
+  const rows = db.query("SELECT url, config FROM peers WHERE kind = 's3' AND config IS NOT NULL").all();
+  if (rows.length === 0)
+    return;
+  const renames = [];
+  const claimed = new Set;
+  for (const r of rows) {
+    let cfg;
+    try {
+      cfg = JSON.parse(r.config);
+    } catch {
+      continue;
+    }
+    if (!cfg.endpoint || !cfg.bucket || !cfg.prefix)
+      continue;
+    const newUrl = storageUrl(cfg.endpoint, cfg.bucket, cfg.prefix);
+    if (newUrl === r.url) {
+      claimed.add(newUrl);
+      continue;
+    }
+    if (claimed.has(newUrl) || db.query("SELECT 1 FROM peers WHERE url = ?").get(newUrl) || tableExists3(db, "storage_cursors") && db.query("SELECT 1 FROM storage_cursors WHERE peer_url = ?").get(newUrl)) {
+      continue;
+    }
+    claimed.add(newUrl);
+    renames.push({ oldUrl: r.url, newUrl });
+  }
+  if (renames.length === 0)
+    return;
+  const map = new Map(renames.map(({ oldUrl, newUrl }) => [oldUrl, newUrl]));
+  const tx = db.transaction(() => {
+    for (const { oldUrl, newUrl } of renames) {
+      if (tableExists3(db, "storage_cursors"))
+        db.query("UPDATE storage_cursors SET peer_url = ? WHERE peer_url = ?").run(newUrl, oldUrl);
+      db.query("UPDATE peers SET url = ? WHERE url = ?").run(newUrl, oldUrl);
+    }
+    if (tableExists3(db, "blob_policy")) {
+      const fullNodes = readPolicy(db).fullNodes;
+      if (fullNodes.some((n) => map.has(n)))
+        setFullNodes(db, fullNodes.map((n) => map.get(n) ?? n));
+    }
+  });
+  tx();
+}
+function migrateDatabases(db) {
+  if (hasColumn(db, "databases", "meta"))
+    return;
+  db.exec("ALTER TABLE databases ADD COLUMN meta TEXT");
+  db.exec(`
+    UPDATE databases SET meta = (
+      SELECT c.value FROM crdt_changes c
+      WHERE c.dataset = 'databases' AND c.col = 'meta' AND c.row_id = databases.id
+      ORDER BY c.hlc DESC LIMIT 1
+    )
+    WHERE id IN (
+      SELECT DISTINCT row_id FROM crdt_changes WHERE dataset = 'databases' AND col = 'meta'
+    )
+  `);
+}
+function migrateSitesAccess(db) {
+  const backfill = (col, fallback) => {
+    db.exec(`
+      UPDATE sites SET ${col} = COALESCE((
+        SELECT json_extract(c.value, '$') FROM crdt_changes c
+        WHERE c.dataset = 'sites' AND c.col = '${col}' AND c.row_id = sites.id
+        ORDER BY c.hlc DESC LIMIT 1
+      ), ${fallback})
+      WHERE id IN (
+        SELECT DISTINCT row_id FROM crdt_changes WHERE dataset = 'sites' AND col = '${col}'
+      )
+    `);
+  };
+  if (!hasColumn(db, "sites", "visibility")) {
+    db.exec("ALTER TABLE sites ADD COLUMN visibility TEXT");
+    backfill("visibility", "NULL");
+  }
+  if (!hasColumn(db, "sites", "spa")) {
+    db.exec("ALTER TABLE sites ADD COLUMN spa INTEGER NOT NULL DEFAULT 0");
+    backfill("spa", "0");
+  }
+  if (!hasColumn(db, "sites", "public_grants")) {
+    db.exec("ALTER TABLE sites ADD COLUMN public_grants TEXT");
+    backfill("public_grants", "NULL");
+  }
+}
+var SITE_CHANNELS_REPLAY_KEY = "site_channels_replay_seq";
+function migrateSiteChannels(db) {
+  if (!tableExists3(db, "site_channels"))
+    return;
+  const wm = db.query("SELECT value FROM meta WHERE key = ?").get(SITE_CHANNELS_REPLAY_KEY);
+  const since = wm ? Number(wm.value) : 0;
+  const changes = db.query(`SELECT seq, ${CHANGE_SELECT} FROM crdt_changes
+       WHERE dataset = 'site_channels' AND seq > ? ORDER BY seq`).all(since);
+  if (changes.length === 0)
+    return;
+  db.transaction((rows) => {
+    for (const change of rows)
+      applyChange(db, change);
+    db.query("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(SITE_CHANNELS_REPLAY_KEY, String(rows[rows.length - 1].seq));
+  })(changes);
+}
+function initSchema(db) {
+  runSchema(db);
+  migrateOplog(db);
+  migrateDatabases(db);
+  migrateCrdtChangesSeq(db);
+  migrateRecords(db);
+  migratePeers(db);
+  migrateStoragePeerUrls(db);
+  migrateDocBlocks(db);
+  migrateDocuments(db);
+  migrateBlobCache(db);
+  migrateShares(db);
+  migrateSitesAccess(db);
+  migrateSiteChannels(db);
+}
+
+// src/core/sync/partition.ts
+var PARTITION_DATASETS = [
+  "databases",
+  "properties",
+  "records",
+  "sites",
+  "site_files"
+];
+var CHANGE_SELECT_Q = CHANGE_COLS.map((c) => "c." + c).join(", ");
+function allWinners(db) {
+  const excluded = [...OPLOG_ONLY_DATASETS];
+  const exclusion = excluded.length ? `c.dataset NOT IN (${excluded.map(() => "?").join(", ")}) AND` : "";
+  return db.query(`SELECT ${CHANGE_SELECT} FROM crdt_changes c
+       WHERE ${exclusion} NOT EXISTS (
+         SELECT 1 FROM crdt_changes k
+         WHERE k.dataset = c.dataset AND k.row_id = c.row_id AND k.col = c.col AND k.hlc > c.hlc
+       )`).all(...excluded);
+}
+function winnersDigest(rows) {
+  const keys = rows.map((r) => `${r.dataset}\x00${r.row_id}\x00${r.col}\x00${r.hlc}`).sort();
+  return fnv1a64Hex(keys.map((key) => key + "\x1E").join(""));
+}
+
+// src/core/sync/room-protocol.ts
+var ROOM_PROTOCOL_VERSION = 1;
+var ROOM_SCHEMA = `
+CREATE TABLE IF NOT EXISTS room_config (
+  key   TEXT PRIMARY KEY,
+  value TEXT
+);
+CREATE TABLE IF NOT EXISTS evict_pending (
+  dataset TEXT NOT NULL,
+  row_id  TEXT NOT NULL,
+  PRIMARY KEY (dataset, row_id)
+);
+CREATE TABLE IF NOT EXISTS room_blobs (
+  hash  TEXT NOT NULL,
+  idx   INTEGER NOT NULL,
+  total INTEGER NOT NULL,
+  bytes BLOB NOT NULL,
+  PRIMARY KEY (hash, idx)
+);
+`;
+function initRoomDb(db, prov) {
+  initSchema(db);
+  db.exec(ROOM_SCHEMA);
+  const roomNode = prov.roomNode ?? `room-${prov.slug}`;
+  db.query("INSERT INTO meta (key, value) VALUES ('node_id', ?) ON CONFLICT(key) DO NOTHING").run(roomNode);
+  const cfg = {
+    slug: prov.slug,
+    roomNode: db.query("SELECT value FROM meta WHERE key = 'node_id'").get().value,
+    guestBase: prov.guestBase,
+    grants: prov.grants,
+    pwHash: prov.pwHash ?? null,
+    pwSalt: prov.pwSalt ?? null,
+    expiresAt: prov.expiresAt ?? null,
+    state: "active"
+  };
+  db.query("INSERT INTO room_config (key, value) VALUES ('config', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(JSON.stringify(cfg));
+  return cfg;
+}
+function readRoomConfig(db) {
+  const row = db.query("SELECT value FROM room_config WHERE key = 'config'").get();
+  if (!row)
+    throw new MhError("not_found", "room is not provisioned");
+  return JSON.parse(row.value);
+}
+function roomExpired(cfg, now = Date.now()) {
+  return cfg.state === "expired" || cfg.expiresAt != null && now > cfg.expiresAt;
+}
+var NEED_BLOBS_LIMIT = 32;
+var ROOM_BLOB_CHUNK_LIMIT = 1024 * 1024;
+function roomMissingBlobs(db, limit = NEED_BLOBS_LIMIT) {
+  const rows = db.query(`SELECT DISTINCT content AS hash FROM site_files
+       WHERE encoding = 'blob' AND __deleted = 0 AND content IS NOT NULL
+         AND NOT EXISTS (
+           SELECT 1 FROM room_blobs b WHERE b.hash = site_files.content AND b.idx = 0
+             AND (SELECT COUNT(*) FROM room_blobs c WHERE c.hash = b.hash) = b.total
+         )
+       ORDER BY hash LIMIT ?`).all(limit);
+  return rows.map((r) => r.hash);
+}
+function roomPutBlobChunk(db, hash, idx, total, bytes) {
+  const tx = db.transaction(() => {
+    if (idx === 0)
+      db.query("DELETE FROM room_blobs WHERE hash = ?").run(hash);
+    db.query("INSERT OR REPLACE INTO room_blobs (hash, idx, total, bytes) VALUES (?, ?, ?, ?)").run(hash, idx, total, bytes);
+  });
+  tx();
+}
+function roomBlobBytes(db, hash) {
+  const rows = db.query("SELECT idx, total, bytes FROM room_blobs WHERE hash = ? ORDER BY idx").all(hash);
+  if (rows.length === 0 || rows.length !== rows[0].total)
+    return null;
+  const parts = rows.map((r) => r.bytes instanceof Uint8Array ? r.bytes : new Uint8Array(r.bytes));
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.byteLength, 0));
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.byteLength;
+  }
+  return out;
+}
+function sweepRoomBlobs(db) {
+  db.query(`DELETE FROM room_blobs WHERE hash NOT IN (
+       SELECT content FROM site_files WHERE encoding = 'blob' AND __deleted = 0 AND content IS NOT NULL
+     )`).run();
+}
+var GUEST_NODE_SQL = "(node_id = ? OR node_id LIKE ? || '-%')";
+function isGuestNode(base, node) {
+  return node === base || node.startsWith(base + "-");
+}
+var STATE_TABLE = Object.fromEntries(PARTITION_DATASETS.map((d) => [d, d]));
+function evictRow(db, key, ackSeq, guestBase) {
+  const table = STATE_TABLE[key.dataset];
+  if (!table)
+    return;
+  db.query(`DELETE FROM ${table} WHERE id = ?`).run(key.row_id);
+  db.query(`DELETE FROM crdt_changes WHERE dataset = ? AND row_id = ?
+     AND NOT (${GUEST_NODE_SQL} AND seq > ?)`).run(key.dataset, key.row_id, guestBase, guestBase, ackSeq);
+  const remaining = db.query("SELECT 1 FROM crdt_changes WHERE dataset = ? AND row_id = ? LIMIT 1").get(key.dataset, key.row_id) != null;
+  if (remaining)
+    db.query("INSERT OR IGNORE INTO evict_pending (dataset, row_id) VALUES (?, ?)").run(key.dataset, key.row_id);
+  else
+    db.query("DELETE FROM evict_pending WHERE dataset = ? AND row_id = ?").run(key.dataset, key.row_id);
+}
+function sweepEvictPending(db, ackSeq, guestBase) {
+  const pending = db.query("SELECT dataset, row_id FROM evict_pending").all();
+  for (const k of pending) {
+    const table = STATE_TABLE[k.dataset];
+    if (table && db.query(`SELECT 1 FROM ${table} WHERE id = ? LIMIT 1`).get(k.row_id) != null) {
+      db.query("DELETE FROM evict_pending WHERE dataset = ? AND row_id = ?").run(k.dataset, k.row_id);
+      continue;
+    }
+    db.query(`DELETE FROM crdt_changes WHERE dataset = ? AND row_id = ? AND seq <= ? AND (${GUEST_NODE_SQL})`).run(k.dataset, k.row_id, ackSeq, guestBase, guestBase);
+    const remaining = db.query("SELECT 1 FROM crdt_changes WHERE dataset = ? AND row_id = ? LIMIT 1").get(k.dataset, k.row_id) != null;
+    if (!remaining)
+      db.query("DELETE FROM evict_pending WHERE dataset = ? AND row_id = ?").run(k.dataset, k.row_id);
+  }
+}
+var GUEST_PULL_LIMIT = 1000;
+function guestChangesAfterSeq(db, seq, guestBase, limit = GUEST_PULL_LIMIT) {
+  const rows = db.query(`SELECT seq AS __seq, ${CHANGE_COLS.join(", ")} FROM crdt_changes
+       WHERE seq > ? AND ${GUEST_NODE_SQL}
+         AND (dataset != ? OR hlc >= ?)
+       ORDER BY seq LIMIT ?`).all(seq, guestBase, guestBase, INTENT_RECEIPT_DATASET, intentReceiptCutoffHlc(), limit);
+  const more = rows.length >= limit;
+  let cursor;
+  if (more) {
+    cursor = rows[rows.length - 1].__seq;
+  } else {
+    const top = db.query("SELECT MAX(seq) AS m FROM crdt_changes").get();
+    cursor = Math.max(seq, top.m ?? seq);
+  }
+  return { changes: rows.map(({ __seq: _s, ...c }) => c), cursor, more };
+}
+function orphanRows(db) {
+  return db.query(`SELECT 'records' AS dataset, id AS row_id FROM records WHERE database_id IS NULL
+       UNION ALL SELECT 'properties', id FROM properties WHERE database_id IS NULL
+       UNION ALL SELECT 'site_files', id FROM site_files WHERE site_id IS NULL
+       ORDER BY dataset, row_id`).all();
+}
+function handleOwnerSync(roomDb, req, cfg = readRoomConfig(roomDb)) {
+  if (req.protocol !== ROOM_PROTOCOL_VERSION)
+    throw new MhError("conflict", `room speaks protocol ${ROOM_PROTOCOL_VERSION}, owner sent ${req.protocol} — upgrade required`);
+  if (roomExpired(cfg)) {
+    return {
+      protocol: ROOM_PROTOCOL_VERSION,
+      node_id: cfg.roomNode,
+      changes: [],
+      cursor: req.since,
+      need_baseline: [],
+      need_blobs: [],
+      share_state: "expired"
+    };
+  }
+  const tx = roomDb.transaction(() => {
+    ingest(roomDb, req.changes);
+    const pull = guestChangesAfterSeq(roomDb, req.since, cfg.guestBase);
+    if (req.members) {
+      const keep = new Set(req.members.map((k) => `${k.dataset}\x00${k.row_id}`));
+      const held = roomDb.query(`SELECT DISTINCT dataset, row_id FROM crdt_changes
+           WHERE dataset IN (${PARTITION_DATASETS.map(() => "?").join(", ")})`).all(...PARTITION_DATASETS);
+      for (const k of held) {
+        if (!keep.has(`${k.dataset}\x00${k.row_id}`))
+          evictRow(roomDb, k, req.since, cfg.guestBase);
+      }
+    }
+    for (const k of req.evict)
+      evictRow(roomDb, k, req.since, cfg.guestBase);
+    sweepEvictPending(roomDb, req.since, cfg.guestBase);
+    sweepRoomBlobs(roomDb);
+    return {
+      protocol: ROOM_PROTOCOL_VERSION,
+      node_id: cfg.roomNode,
+      changes: pull.changes,
+      cursor: pull.cursor,
+      more: pull.more || undefined,
+      need_baseline: orphanRows(roomDb),
+      need_blobs: roomMissingBlobs(roomDb),
+      digest: req.digest !== undefined ? winnersDigest(allWinners(roomDb)) : undefined,
+      share_state: "active"
+    };
+  });
+  return tx();
+}
+function mintRoomGuestSub(cfg) {
+  return `${cfg.guestBase}-${randomSuffix(6)}`;
+}
+function handleGuestWrite(roomDb, cfg, session, intent) {
+  if (roomExpired(cfg))
+    throw new MhError("auth", "unauthorized");
+  if (!session.sub || !isGuestNode(cfg.guestBase, session.sub))
+    throw new MhError("auth", "unauthorized");
+  if (intent.op !== "createRecord" && intent.op !== "updateRecord")
+    throw new MhError("invalid_input", `unknown intent op ${JSON.stringify(intent.op)}`);
+  const gi = {
+    intentId: intent.intentId || randomSuffix(16),
+    action: intent.op,
+    table: intent.db,
+    recordId: intent.record,
+    payload: intent.values,
+    submittedAt: Number.isFinite(intent.submittedAt) ? intent.submittedAt : Date.now()
+  };
+  return applyGuestIntent(roomDb, policyForRoom(cfg), { guestNode: session.sub }, gi, { clock: "authority" });
+}
+
+// src/core/sync/room-serve.ts
+var HTML = { "content-type": "text/html; charset=utf-8" };
+var HASH_RE = /^[0-9a-f]{16,64}$/;
+var ROOM_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+function json(data, status = 200) {
+  return Response.json(data, { status });
+}
+function errJson2(e) {
+  const { body, status } = errorBody(e);
+  return json(body, status);
+}
+function plain404() {
+  return new Response("not found", { status: 404 });
+}
+function wantsHtml(req) {
+  return (req.headers.get("accept") ?? "").includes("text/html");
+}
+function isOwner(req, ownerToken) {
+  if (!ownerToken)
+    return false;
+  const h = req.headers.get("authorization") ?? "";
+  return h.startsWith("Bearer ") && timingSafeStr(h.slice(7), ownerToken);
+}
+function tryConfig(db) {
+  try {
+    return readRoomConfig(db);
+  } catch {
+    return null;
+  }
+}
+function maxSeq(db) {
+  try {
+    const row = db.query("SELECT MAX(seq) AS m FROM crdt_changes").get();
+    return row?.m ?? 0;
+  } catch {
+    return 0;
+  }
+}
+async function hlcHeadroom(db, deps) {
+  if (!deps.yieldClock)
+    return;
+  const row = db.query("SELECT value FROM meta WHERE key = 'hlc'").get();
+  if (!row)
+    return;
+  const counter = parseInt(row.value.slice(16, 20), 16);
+  if (Number.isFinite(counter) && counter > 61440)
+    await deps.yieldClock();
+}
+function roomSecret(db) {
+  const read = () => db.query("SELECT value FROM room_config WHERE key = 'cookie_secret'").get();
+  const row = read();
+  if (row)
+    return row.value;
+  db.query("INSERT INTO room_config (key, value) VALUES ('cookie_secret', ?) ON CONFLICT(key) DO NOTHING").run(randomSuffix(32));
+  return read().value;
+}
+function roomSessionScope(db, cfg) {
+  return { secret: roomSecret(db), cookieName: "mh_room_" + cfg.slug, scopeKey: cfg.slug };
+}
+function sessionTtl(cfg) {
+  return cfg.expiresAt == null ? ROOM_SESSION_TTL_MS : Math.min(ROOM_SESSION_TTL_MS, Math.max(0, cfg.expiresAt - Date.now()));
+}
+async function readRoomSession(db, cfg, req) {
+  return readGuestSession(roomSessionScope(db, cfg), req.headers.get("cookie"));
+}
+async function mintRoomSession(db, cfg, url) {
+  const minted = await mintGuestSession(roomSessionScope(db, cfg), {
+    sub: mintRoomGuestSub(cfg),
+    ttlMs: sessionTtl(cfg),
+    path: `/r/${cfg.slug}`,
+    secure: url.protocol === "https:"
+  });
+  return { sub: minted.sub, cookie: minted.cookie };
+}
+function withSetCookie(res, setCookie) {
+  if (!setCookie)
+    return res;
+  const headers = new Headers(res.headers);
+  headers.append("set-cookie", setCookie);
+  return new Response(res.body, { status: res.status, headers });
+}
+async function roomWsSession(db, req) {
+  const cfg = tryConfig(db);
+  if (!cfg || roomExpired(cfg))
+    return null;
+  const sess = await readRoomSession(db, cfg, req);
+  if (cfg.pwHash && !sess)
+    return null;
+  return { cfg, sub: sess?.sub || mintRoomGuestSub(cfg) };
+}
+async function roomWsMessage(db, sub, raw) {
+  let msg;
+  try {
+    msg = JSON.parse(raw);
+  } catch {
+    return {
+      reply: JSON.stringify({ type: "error", error: "malformed message", code: "invalid_input" }),
+      poke: false,
+      seq: 0
+    };
+  }
+  const id = msg?.id;
+  if (msg?.type !== "write" || typeof msg.intent !== "object" || msg.intent === null) {
+    return {
+      reply: JSON.stringify({ type: "error", id, error: "unknown message type", code: "invalid_input" }),
+      poke: false,
+      seq: 0
+    };
+  }
+  const cfg = tryConfig(db);
+  if (!cfg) {
+    return {
+      reply: JSON.stringify({ type: "error", id, error: "unauthorized", code: "auth" }),
+      poke: false,
+      seq: 0
+    };
+  }
+  try {
+    const record = db.transaction(() => handleGuestWrite(db, cfg, { sub }, msg.intent))();
+    return { reply: JSON.stringify({ type: "result", id, record }), poke: true, seq: maxSeq(db) };
+  } catch (e) {
+    return {
+      reply: JSON.stringify({
+        type: "error",
+        id,
+        error: e instanceof Error ? e.message : String(e),
+        code: errorCode(e)
+      }),
+      poke: false,
+      seq: 0
+    };
+  }
+}
+function createRoomFetch(deps) {
+  const { db } = deps;
+  return async (req) => {
+    const url = new URL(req.url);
+    const m = /^\/r\/([^/]+)(\/.*)?$/.exec(url.pathname);
+    if (!m)
+      return plain404();
+    const pathSlug = safeDecode(m[1]);
+    if (pathSlug === null)
+      return plain404();
+    if (m[2] === undefined) {
+      return new Response(null, { status: 301, headers: { location: `/r/${m[1]}/` } });
+    }
+    const sub = safeDecode(m[2].slice(1));
+    if (sub === null)
+      return plain404();
+    if (sub === "owner" || sub.startsWith("owner/")) {
+      if (!isOwner(req, deps.ownerToken))
+        return json({ error: "unauthorized", code: "auth" }, 401);
+      if (req.method !== "POST")
+        return json({ error: "not found", code: "not_found" }, 404);
+      if (sub === "owner/provision") {
+        const body = await req.json().catch(() => null);
+        if (!body || typeof body.guestBase !== "string" || body.guestBase === "")
+          return json({ error: "provision needs a guestBase", code: "invalid_input" }, 400);
+        const str = (v) => typeof v === "string" && v !== "" ? v : null;
+        const cfg3 = initRoomDb(db, {
+          slug: typeof body.slug === "string" && body.slug !== "" ? body.slug : pathSlug,
+          guestBase: body.guestBase,
+          grants: str(body.grants) ?? "",
+          pwHash: str(body.pwHash),
+          pwSalt: str(body.pwSalt),
+          expiresAt: typeof body.expiresAt === "number" ? body.expiresAt : null
+        });
+        await deps.setAlarm?.(cfg3.expiresAt ?? null);
+        return json({ slug: cfg3.slug, room_node: cfg3.roomNode, provisioned: true });
+      }
+      const cfg2 = tryConfig(db);
+      if (!cfg2)
+        return json({ error: "room is not provisioned", code: "not_found" }, 404);
+      if (sub === "owner/sync") {
+        const body = await req.json().catch(() => null);
+        if (!body || typeof body.protocol !== "number" || !Array.isArray(body.changes))
+          return json({ error: "malformed sync request", code: "invalid_input" }, 400);
+        await hlcHeadroom(db, deps);
+        try {
+          const resp = handleOwnerSync(db, body, cfg2);
+          if (resp.share_state === "active" && body.changes.length > 0)
+            deps.poke?.(maxSeq(db));
+          return json(resp);
+        } catch (e) {
+          return errJson2(e);
+        }
+      }
+      const blob = /^owner\/blob\/([^/]+)$/.exec(sub);
+      if (blob) {
+        const hash = blob[1].toLowerCase();
+        if (!HASH_RE.test(hash))
+          return json({ error: "bad blob hash", code: "invalid_input" }, 400);
+        const idx = Math.floor(Number(url.searchParams.get("idx") ?? 0));
+        const total = Math.floor(Number(url.searchParams.get("total") ?? 1));
+        if (!Number.isFinite(idx) || !Number.isFinite(total) || idx < 0 || total < 1 || idx >= total || total > 4096)
+          return json({ error: "bad chunk indices", code: "invalid_input" }, 400);
+        const bytes = new Uint8Array(await req.arrayBuffer());
+        if (bytes.byteLength === 0 || bytes.byteLength > ROOM_BLOB_CHUNK_LIMIT)
+          return json({ error: `chunk must be 1..${ROOM_BLOB_CHUNK_LIMIT} bytes`, code: "invalid_input" }, 400);
+        roomPutBlobChunk(db, hash, idx, total, bytes);
+        return json({ hash, idx, total, bytes: bytes.byteLength });
+      }
+      if (sub === "owner/destroy") {
+        await deps.setAlarm?.(null);
+        await deps.destroy();
+        return json({ destroyed: true });
+      }
+      return json({ error: "not found", code: "not_found" }, 404);
+    }
+    const cfg = tryConfig(db);
+    if (!cfg || roomExpired(cfg))
+      return plain404();
+    if (sub === "unlock" && req.method === "POST")
+      return handleUnlock(db, cfg, req, url);
+    if (sub === "ws")
+      return new Response("upgrade required", { status: 426 });
+    const session = await readRoomSession(db, cfg, req);
+    const locked = !!cfg.pwHash && !session;
+    if (sub === "api" || sub.startsWith("api/")) {
+      if (locked)
+        return json({ error: "unauthorized" }, 401);
+      const gs = session?.sub ? { sub: session.sub, setCookie: null } : await (async () => {
+        const minted = await mintRoomSession(db, cfg, url);
+        return { sub: minted.sub, setCookie: minted.cookie };
+      })();
+      const key = gs.setCookie ? req.headers.get("cf-connecting-ip") ?? "?" : gs.sub;
+      const res = await serveGrantedApi(req, sub === "api" ? "" : sub.slice("api/".length), grantedDepsFromPolicy(policyForRoom(cfg), {
+        db,
+        principal: { kind: "share", guestNode: gs.sub || cfg.guestBase },
+        allow: () => rateLimiter.allow("room-api", `${cfg.slug}:${key}`, SHARE_LIMIT),
+        req,
+        ip: req.headers.get("cf-connecting-ip")
+      }));
+      if (req.method !== "GET" && res.ok)
+        deps.poke?.(maxSeq(db));
+      return withSetCookie(res, gs.setCookie);
+    }
+    if (req.method !== "GET")
+      return plain404();
+    if (locked) {
+      return wantsHtml(req) ? new Response(unlockPage(cfg, false), { headers: HTML }) : json({ error: "unauthorized" }, 401);
+    }
+    return serveRoomFile(db, cfg, sub);
+  };
+}
+async function handleUnlock(db, cfg, req, url) {
+  let pw = "";
+  const ct = req.headers.get("content-type") ?? "";
+  if (ct.includes("application/json")) {
+    pw = String((await req.json().catch(() => ({}))).password ?? "");
+  } else {
+    const form = await req.formData().catch(() => null);
+    pw = form ? String(form.get("password") ?? "") : "";
+  }
+  const ok = !cfg.pwHash || !cfg.pwSalt ? true : await verifyPasswordVerifier(cfg.pwHash, cfg.pwSalt, pw);
+  if (!ok)
+    return new Response(unlockPage(cfg, true), { headers: HTML, status: 401 });
+  const minted = await mintRoomSession(db, cfg, url);
+  return new Response(null, {
+    status: 303,
+    headers: { location: `/r/${cfg.slug}/`, "set-cookie": minted.cookie }
+  });
+}
+function serveRoomFile(db, cfg, path) {
+  const site = db.query("SELECT id, spa FROM sites WHERE __deleted = 0 ORDER BY created_hlc LIMIT 1").get();
+  if (!site)
+    return roomMessagePage("站点尚未同步", "分享方设备上线同步后即可访问。", 404);
+  const resolved = resolveSiteFileRow(db, site.id, path, { spa: site.spa === 1 });
+  if (!resolved)
+    return roomMessagePage("页面不存在", "这个站点里没有这个页面或文件。", 404);
+  const { row, status } = resolved;
+  const headers = {
+    "content-type": row.content_type,
+    "cache-control": row.content_type.startsWith("text/html") ? "private, no-cache" : "private, max-age=300"
+  };
+  if (row.encoding === "utf8")
+    return new Response(row.content ?? "", { status, headers });
+  if (row.encoding === "base64") {
+    const bytes2 = base64ToBytes(row.content ?? "");
+    const body2 = new Uint8Array(bytes2.byteLength);
+    body2.set(bytes2);
+    return new Response(body2.buffer, { status, headers });
+  }
+  const bytes = row.content ? roomBlobBytes(db, row.content) : null;
+  if (!bytes)
+    return roomMessagePage("资源暂不可用", "文件内容尚未同步到房间，请稍后重试。", 404);
+  const body = new Uint8Array(bytes.byteLength);
+  body.set(bytes);
+  return new Response(body.buffer, { status, headers });
+}
+var PAGE_CSS = `
+  :root{--bg:#ffffff;--fg:#1f2328;--muted:#6e7781;--line:#d0d7de;--accent:#0969da;--card:#f6f8fa}
+  @media (prefers-color-scheme: dark){:root{--bg:#0d1117;--fg:#e6edf3;--muted:#8b949e;--line:#30363d;--accent:#4493f8;--card:#161b22}}
+  *{box-sizing:border-box}
+  body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.65 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Microsoft YaHei",sans-serif;
+    min-height:100dvh;display:flex;align-items:center;justify-content:center;padding:24px}
+  main{max-width:420px;width:100%}
+  form.pw{display:flex;flex-direction:column;gap:12px}
+  form.pw input{padding:9px;border:1px solid var(--line);border-radius:7px;background:var(--card);color:var(--fg)}
+  form.pw button{padding:9px;border:0;border-radius:7px;background:var(--accent);color:#fff;cursor:pointer}
+  .err{color:#f85149;font-size:13px;margin:0}
+  .muted{color:var(--muted);font-size:14px}
+  h1{font-size:20px;margin:0 0 10px;text-align:center}
+  footer{margin-top:34px;color:var(--muted);font-size:12px;text-align:center}`;
+function unlockPage(cfg, error) {
+  return `<!doctype html><html lang="zh"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex"><title>受保护的分享</title>
+<style>${PAGE_CSS}</style></head><body><main>
+<form method="post" action="/r/${escapeHtml(cfg.slug)}/unlock" class="pw">
+  <h1>\uD83D\uDD12 此分享受口令保护</h1>
+  ${error ? '<p class="err">口令错误，请重试。</p>' : ""}
+  <input type="password" name="password" placeholder="口令" autofocus autocomplete="current-password">
+  <button type="submit">解锁</button>
+</form>
+<footer>通过 metahub 分享</footer>
+</main></body></html>`;
+}
+function roomMessagePage(title, detail, status) {
+  const html = `<!doctype html><html lang="zh"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex"><title>${escapeHtml(title)}</title>
+<style>${PAGE_CSS}</style></head><body><main>
+<h1>${escapeHtml(title)}</h1>
+<p class="muted" style="text-align:center">${escapeHtml(detail)}</p>
+<footer>由 metahub 托管</footer>
+</main></body></html>`;
+  return new Response(html, { status, headers: { ...HTML, "cache-control": "no-store" } });
+}
+
+// src/workers/room.ts
+var g = globalThis;
+
+class MhRoom {
+  state;
+  db;
+  handler;
+  constructor(state, env) {
+    this.state = state;
+    this.db = new DoSqlDriver(state.storage);
+    this.handler = createRoomFetch({
+      db: this.db,
+      ownerToken: env.OWNER_TOKEN,
+      poke: (seq) => this.broadcast(seq),
+      destroy: async () => {
+        for (const ws of this.state.getWebSockets()) {
+          try {
+            ws.close(1001, "room destroyed");
+          } catch {}
+        }
+        await this.state.storage.deleteAlarm?.();
+        await this.state.storage.deleteAll();
+      },
+      setAlarm: async (at) => {
+        if (at == null)
+          await this.state.storage.deleteAlarm?.();
+        else
+          await this.state.storage.setAlarm(at);
+      },
+      yieldClock: async () => {
+        const scheduler = g.scheduler;
+        if (scheduler?.wait)
+          await scheduler.wait(1);
+      }
+    });
+    state.blockConcurrencyWhile?.(async () => {});
+    const Pair = g.WebSocketRequestResponsePair;
+    if (Pair && state.setWebSocketAutoResponse) {
+      state.setWebSocketAutoResponse(new Pair("ping", "pong"));
+    }
+  }
+  async fetch(req) {
+    const url = new URL(req.url);
+    if (/^\/r\/[^/]+\/ws$/.test(url.pathname) && (req.headers.get("upgrade") ?? "").toLowerCase() === "websocket")
+      return this.upgrade(req);
+    return this.handler(req);
+  }
+  async upgrade(req) {
+    const sess = await roomWsSession(this.db, req);
+    if (!sess)
+      return new Response("not found", { status: 404 });
+    const PairCtor = g.WebSocketPair;
+    if (!PairCtor)
+      return new Response("websockets unavailable", { status: 501 });
+    const pair = new PairCtor;
+    const client = pair[0];
+    const server = pair[1];
+    this.state.acceptWebSocket(server);
+    server.serializeAttachment?.({ sub: sess.sub });
+    return new Response(null, {
+      status: 101,
+      webSocket: client
+    });
+  }
+  async webSocketMessage(ws, message) {
+    if (typeof message !== "string")
+      return;
+    const att = ws.deserializeAttachment?.() ?? {};
+    const out = await roomWsMessage(this.db, att.sub ?? "", message);
+    if (out.reply) {
+      try {
+        ws.send(out.reply);
+      } catch {}
+    }
+    if (out.poke)
+      this.broadcast(out.seq);
+  }
+  async alarm() {
+    let cfg;
+    try {
+      cfg = readRoomConfig(this.db);
+    } catch {
+      await this.state.storage.deleteAll();
+      return;
+    }
+    if (!roomExpired(cfg)) {
+      const next = cfg.expiresAt != null ? Math.max(Date.now() + 1000, cfg.expiresAt) : Date.now() + 60000;
+      await this.state.storage.setAlarm(next);
+      return;
+    }
+    for (const ws of this.state.getWebSockets()) {
+      try {
+        ws.close(1001, "room expired");
+      } catch {}
+    }
+    await this.state.storage.deleteAll();
+  }
+  broadcast(seq) {
+    const msg = JSON.stringify({ type: "poke", seq });
+    for (const ws of this.state.getWebSockets()) {
+      try {
+        ws.send(msg);
+      } catch {}
+    }
+  }
+}
+// src/core/sync/edge-config.ts
+var EXPECTED_EDGE_WORKER_VERSION = "3";
+
+// src/workers/edge-worker.ts
+var EDGE_WORKER_VERSION = EXPECTED_EDGE_WORKER_VERSION;
+var EDGE_WORKER_MARKER = "mh-edge-worker";
+var DROP_DEFAULT_MAX_ENVELOPES = 2000;
+var DROP_DEFAULT_MAX_BYTES = 20 * 1024 * 1024;
+var DROP_ENVELOPE_LIMIT_BYTES = 64 * 1024;
+var LIST_LIMIT_DEFAULT2 = 100;
+var LIST_LIMIT_MAX2 = 500;
+var EDGE_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS drops (
+  drop_id           TEXT PRIMARY KEY,
+  turnstile_sitekey TEXT,
+  turnstile_secret  TEXT,
+  password_salt     TEXT,
+  password_verifier TEXT,
+  max_envelopes     INTEGER NOT NULL DEFAULT ${DROP_DEFAULT_MAX_ENVELOPES},
+  max_bytes         INTEGER NOT NULL DEFAULT ${DROP_DEFAULT_MAX_BYTES},
+  created_at        INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS envelopes (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  drop_id     TEXT NOT NULL,
+  envelope_id TEXT NOT NULL,
+  body        TEXT NOT NULL,
+  bytes       INTEGER NOT NULL,
+  created_at  INTEGER NOT NULL,
+  UNIQUE (drop_id, envelope_id)
+);
+CREATE INDEX IF NOT EXISTS idx_envelopes_drop ON envelopes(drop_id, id);
+CREATE INDEX IF NOT EXISTS idx_envelopes_drop_created ON envelopes(drop_id, created_at);
+`;
+function json2(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function err(status, code, message) {
+  return json2({ error: message, code }, status);
+}
+function isOwner2(req, ownerToken) {
+  if (!ownerToken)
+    return false;
+  const h = req.headers.get("authorization") ?? "";
+  return h.startsWith("Bearer ") && timingSafeEq(h.slice(7), ownerToken);
+}
+function createInboxFetch(deps) {
+  const { sql } = deps;
+  const now = deps.now ?? (() => Date.now());
+  const getDrop = async (dropId) => {
+    const rows = await sql.all("SELECT * FROM drops WHERE drop_id = ?", [dropId]);
+    return rows[0] ?? null;
+  };
+  const pruneExpired = async (dropId, currentTime) => {
+    await sql.run("DELETE FROM envelopes WHERE drop_id = ? AND created_at < ?", [dropId, Math.max(0, currentTime - DROP_ENVELOPE_RETENTION_MS)]);
+  };
+  return async (req) => {
+    const url = new URL(req.url);
+    if (req.method === "GET" && url.pathname === "/health") {
+      return json2({ ok: true, service: EDGE_WORKER_MARKER, version: EDGE_WORKER_VERSION });
+    }
+    if (req.method === "GET" && url.pathname === "/owner/health") {
+      if (!isOwner2(req, deps.ownerToken))
+        return err(401, "auth", "unauthorized");
+      return json2({ ok: true, service: EDGE_WORKER_MARKER, version: EDGE_WORKER_VERSION });
+    }
+    const m = /^\/v1\/inbox\/([^/]+)(?:\/(envelopes|stats))?$/.exec(url.pathname);
+    if (!m)
+      return err(404, "not_found", "not found");
+    const dropId = safeDecode(m[1]);
+    if (dropId === null)
+      return err(400, "invalid_input", "malformed drop id");
+    const sub = m[2] ?? null;
+    if (req.method === "POST" && sub === "envelopes") {
+      const drop = await getDrop(dropId);
+      if (!drop)
+        return err(404, "not_found", "no such drop");
+      const t = now();
+      await pruneExpired(dropId, t);
+      const text = await req.text();
+      const bytes = new TextEncoder().encode(text).byteLength;
+      if (bytes > DROP_ENVELOPE_LIMIT_BYTES)
+        return err(413, "invalid_input", `envelope too large (max ${DROP_ENVELOPE_LIMIT_BYTES} bytes)`);
+      let env;
+      try {
+        env = JSON.parse(text);
+      } catch {
+        return err(400, "invalid_input", "body must be a JSON envelope");
+      }
+      if (!env || env.v !== 1 || typeof env.envelope_id !== "string" || env.envelope_id === "" || env.envelope_id.length > 64 || typeof env.sealed !== "string" || env.drop_id !== dropId)
+        return err(400, "invalid_input", "malformed envelope");
+      try {
+        await assertAntiAbuse({ turnstileSecret: drop.turnstile_secret, passwordVerifier: drop.password_verifier }, req, { verifyTurnstile: deps.verifyTurnstile, ip: req.headers.get("cf-connecting-ip") });
+      } catch (e) {
+        return err(401, "auth", e.message);
+      }
+      const ins = await sql.run(`INSERT OR IGNORE INTO envelopes (drop_id, envelope_id, body, bytes, created_at)
+         SELECT ?, ?, ?, ?, ?
+         WHERE (SELECT COUNT(*) FROM envelopes WHERE drop_id = ?) < ?
+           AND (SELECT COALESCE(SUM(bytes), 0) FROM envelopes WHERE drop_id = ?) + ? <= ?`, [dropId, env.envelope_id, text, bytes, t, dropId, drop.max_envelopes, dropId, bytes, drop.max_bytes]);
+      if (ins.changes === 0) {
+        const dup = await sql.all("SELECT 1 AS x FROM envelopes WHERE drop_id = ? AND envelope_id = ?", [
+          dropId,
+          env.envelope_id
+        ]);
+        if (dup.length > 0)
+          return json2({ envelope_id: env.envelope_id, server_time: t, duplicate: true });
+        return err(429, "drop_full", "drop is full — try again later");
+      }
+      return json2({ envelope_id: env.envelope_id, server_time: t });
+    }
+    if (!isOwner2(req, deps.ownerToken))
+      return err(401, "auth", "unauthorized");
+    if (sub === null && req.method === "PUT") {
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        body = {};
+      }
+      const s = (k) => typeof body[k] === "string" && body[k] !== "" ? body[k] : null;
+      const n = (k, dflt) => typeof body[k] === "number" && body[k] > 0 ? Math.floor(body[k]) : dflt;
+      await sql.run(`INSERT INTO drops (drop_id, turnstile_sitekey, turnstile_secret, password_salt, password_verifier, max_envelopes, max_bytes, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(drop_id) DO UPDATE SET
+           turnstile_sitekey = excluded.turnstile_sitekey,
+           turnstile_secret  = excluded.turnstile_secret,
+           password_salt     = excluded.password_salt,
+           password_verifier = excluded.password_verifier,
+           max_envelopes     = excluded.max_envelopes,
+           max_bytes         = excluded.max_bytes`, [
+        dropId,
+        s("turnstile_sitekey"),
+        s("turnstile_secret"),
+        s("password_salt"),
+        s("password_verifier"),
+        n("max_envelopes", DROP_DEFAULT_MAX_ENVELOPES),
+        n("max_bytes", DROP_DEFAULT_MAX_BYTES),
+        now()
+      ]);
+      return json2({ drop_id: dropId, registered: true });
+    }
+    if (sub === null && req.method === "DELETE") {
+      await sql.run("DELETE FROM envelopes WHERE drop_id = ?", [dropId]);
+      const r = await sql.run("DELETE FROM drops WHERE drop_id = ?", [dropId]);
+      return json2({ drop_id: dropId, deleted: r.changes > 0 });
+    }
+    if (sub === "envelopes" && req.method === "GET") {
+      if (!await getDrop(dropId))
+        return err(404, "not_found", "no such drop");
+      await pruneExpired(dropId, now());
+      const afterId = Math.max(0, Number(url.searchParams.get("after_id") ?? 0) || 0);
+      const rawLimit = Number(url.searchParams.get("limit") ?? NaN);
+      const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(Math.floor(rawLimit), LIST_LIMIT_MAX2)) : LIST_LIMIT_DEFAULT2;
+      const rows = await sql.all("SELECT id, body FROM envelopes WHERE drop_id = ? AND id > ? ORDER BY id LIMIT ?", [dropId, afterId, limit]);
+      return json2({
+        rows: rows.map((r) => {
+          let envelope;
+          try {
+            envelope = JSON.parse(r.body);
+          } catch {
+            envelope = null;
+          }
+          return { id: r.id, envelope };
+        })
+      });
+    }
+    if (sub === "envelopes" && req.method === "DELETE") {
+      let ids;
+      try {
+        ids = (await req.json())?.ids;
+      } catch {
+        ids = null;
+      }
+      if (!Array.isArray(ids) || !ids.every((x) => typeof x === "number"))
+        return err(400, "invalid_input", "body must be {ids: number[]}");
+      if (ids.length === 0)
+        return json2({ deleted: 0 });
+      const marks = ids.map(() => "?").join(", ");
+      const r = await sql.run(`DELETE FROM envelopes WHERE drop_id = ? AND id IN (${marks})`, [
+        dropId,
+        ...ids
+      ]);
+      return json2({ deleted: r.changes });
+    }
+    if (sub === "stats" && req.method === "GET") {
+      const drop = await getDrop(dropId);
+      if (!drop)
+        return err(404, "not_found", "no such drop");
+      await pruneExpired(dropId, now());
+      const rows = await sql.all("SELECT COUNT(*) AS n, COALESCE(SUM(bytes), 0) AS b FROM envelopes WHERE drop_id = ?", [dropId]);
+      return json2({
+        drop_id: dropId,
+        envelopes: rows[0]?.n ?? 0,
+        bytes: rows[0]?.b ?? 0,
+        max_envelopes: drop.max_envelopes,
+        max_bytes: drop.max_bytes
+      });
+    }
+    return err(404, "not_found", "not found");
+  };
+}
+var OWNER_CORS = {
+  "access-control-allow-origin": "*",
+  "access-control-allow-methods": "GET, POST, PUT, DELETE, OPTIONS",
+  "access-control-allow-headers": "authorization, content-type",
+  "access-control-max-age": "86400"
+};
+function isOwnerCorsPath(pathname) {
+  return pathname === "/health" || pathname === "/owner/health" || /^\/v1\/inbox\/[^/]+(?:\/(?:stats|envelopes))?$/.test(pathname) || /^\/r\/[^/]+\/owner(?:\/|$)/.test(pathname);
+}
+function corsResponse(res) {
+  if (res.status === 101)
+    return res;
+  const headers = new Headers(res.headers);
+  for (const [k, v] of Object.entries(OWNER_CORS))
+    headers.set(k, v);
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+}
+function d1Sql(db) {
+  return {
+    async all(sql, params = []) {
+      const r = await db.prepare(sql).bind(...params).all();
+      return r.results ?? [];
+    },
+    async run(sql, params = []) {
+      const r = await db.prepare(sql).bind(...params).run();
+      return { changes: r.meta?.changes ?? 0 };
+    }
+  };
+}
+var edge_worker_default = {
+  async fetch(req, env) {
+    const path = new URL(req.url).pathname;
+    const cors = isOwnerCorsPath(path);
+    if (cors && req.method === "OPTIONS")
+      return new Response(null, { status: 204, headers: OWNER_CORS });
+    const room = /^\/r\/([^/]+)/.exec(new URL(req.url).pathname);
+    if (room && env.ROOM) {
+      const slug = safeDecode(room[1]);
+      if (slug === null)
+        return new Response("bad request", { status: 400 });
+      const id = env.ROOM.idFromName(slug);
+      const res2 = await env.ROOM.get(id).fetch(req);
+      return cors ? corsResponse(res2) : res2;
+    }
+    const res = await createInboxFetch({ sql: d1Sql(env.DB), ownerToken: env.OWNER_TOKEN })(req);
+    return cors ? corsResponse(res) : res;
+  }
+};
+export {
+  edge_worker_default as default,
+  createInboxFetch,
+  MhRoom,
+  EDGE_WORKER_VERSION,
+  EDGE_WORKER_MARKER,
+  EDGE_SCHEMA_SQL,
+  DROP_ENVELOPE_LIMIT_BYTES,
+  DROP_DEFAULT_MAX_ENVELOPES,
+  DROP_DEFAULT_MAX_BYTES
+};