@tensorix/metahub 0.3.2 → 0.4.0

package/dist/core/sites-core.d.ts

@@ -1,11 +1,21 @@
 import type { DbDriver } from "./driver.ts";
+import { type GrantSet } from "./grants-core.ts";
 export interface SiteRow {
     id: string;
     name: string;
     title: string | null;
     created_hlc: string;
+    /** Access register: exactly "public" = served without a token. Synced, so a
+     *  peer can write ANY string here — never read it directly, go through
+     *  isSitePublic (default-deny). */
+    visibility: string | null;
+    /** 1 = SPA fallback: extension-less misses serve index.html (status 200). */
+    spa: number;
+    /** Serialized GrantSet for the anonymous /sites/<name>/api/* surface. Synced
+     *  register — never read raw, always through parseGrantSet (default-deny). */
+    public_grants: string | null;
 }
-export declare const SITE_COLS: readonly ["id", "name", "title", "created_hlc"];
+export declare const SITE_COLS: readonly ["id", "name", "title", "created_hlc", "visibility", "spa", "public_grants"];
 export type FileEncoding = "utf8" | "base64" | "blob";
 export interface SiteFileRow {
     id: string;
@@ -16,8 +26,14 @@ export interface SiteFileRow {
     /** Inline text/base64, or a blob hash when encoding === "blob". */
     content: string | null;
 }
-/** Manifest entry — file metadata without the (potentially large) content. */
-export type SiteFileSummary = Omit<SiteFileRow, "content">;
+/** Manifest entry — file metadata without the (potentially large) content.
+ *  `size` is derived at query time (see listFiles), never stored. */
+export type SiteFileSummary = Omit<SiteFileRow, "content"> & {
+    /** Served byte size: exact for utf8, ~exact for base64 (padding ignored),
+     *  blob_cache lookup for blobs — null when the blob bytes aren't held
+     *  locally (e.g. a browser replica, or an evicted cache entry). */
+    size: number | null;
+};
 export declare const SITE_FILE_COLS: readonly ["id", "site_id", "path", "content_type", "encoding", "content"];
 export declare const SITE_FILE_SELECT: string;
 /** Guess a content type from a file path's extension; default octet-stream. */
@@ -38,7 +54,23 @@ export declare function normalizeSiteName(raw: string): string;
  * matter how the path was typed or percent-encoded. May return "" (caller decides).
  */
 export declare function normalizeSitePath(raw: string): string;
+/**
+ * THE public/private decision point — every serve surface must route through
+ * here (default-deny). `visibility` is a synced CRDT register: any peer
+ * (including a malicious or future-versioned one) can write arbitrary strings
+ * into it, so only the exact string "public" opens the site; "PUBLIC", "true",
+ * garbage, and NULL all mean private.
+ */
+export declare function isSitePublic(site: Pick<SiteRow, "visibility">): boolean;
 export declare function getSite(db: DbDriver, id: string): SiteRow | null;
+export type SiteLifecycle = "live" | "tombstoned" | "absent";
+/** Three-state existence probe. Repair/reconcile logic must act on positive
+ * tombstone evidence only: `absent` can mean the row simply has not replicated
+ * to this node yet, so destructive reactions to it would tear down state that
+ * is alive elsewhere. A half-materialized row (columns still NULL from
+ * out-of-order ingest) reads as `live` — the conservative answer for
+ * revocation decisions. */
+export declare function siteLifecycle(db: DbDriver, id: string): SiteLifecycle;
 /** Most recently created live site with this name (URL routing). */
 export declare function getSiteByName(db: DbDriver, name: string): SiteRow | null;
 export declare function listSites(db: DbDriver): SiteRow[];
@@ -56,7 +88,32 @@ export declare function getFileRow(db: DbDriver, siteId: string, path: string):
     encoding: FileEncoding;
     content: string | null;
 } | null;
+/**
+ * Resolve a request path to the row that should be served, GitHub-Pages style:
+ * "" / trailing "/" → index.html (same order as getFileRow: index resolution
+ * first, then normalization); a miss falls back to the site's own `404.html`
+ * (served with status 404) when it exists; a pure miss returns null (caller
+ * renders its built-in 404). Shared by every serve surface — server, share,
+ * browser replica (db-worker siteFile op), and the service worker — so online
+ * and offline 404 behavior stay identical.
+ *
+ * `opts.spa` (the sites.spa column): a miss on a path whose last segment has no
+ * extension falls back to index.html with status 200 — client-side routes like
+ * /sites/app/settings/profile render the app shell, while a missing asset
+ * (app.js, logo.png) still 404s honestly instead of serving HTML to a <script>.
+ * The SPA fallback runs before the 404.html fallback.
+ */
+export declare function resolveSiteFileRow(db: DbDriver, siteId: string, path: string, opts?: {
+    spa?: boolean;
+}): {
+    row: Pick<SiteFileRow, "content_type" | "encoding" | "content">;
+    status: 200 | 404;
+} | null;
 export declare function listFiles(db: DbDriver, siteId: string): SiteFileSummary[];
+/** The listFiles size derivation for one already-loaded row (the upload route
+ *  returns the row it just wrote and must report the same size the manifest
+ *  will). Kept in lockstep with the SQL CASE above. */
+export declare function fileSizeOf(db: DbDriver, row: Pick<SiteFileRow, "encoding" | "content">): number | null;
 /** Binaries at or below this size store inline (base64); larger need a blob. */
 export declare const INLINE_LIMIT: number;
 /** Text-ish types store as readable utf8; everything else is binary. */
@@ -66,20 +123,50 @@ export declare function isTextType(contentType: string): boolean;
  *  into the oplog, keeping replicas lean. */
 export declare function isImageType(contentType: string): boolean;
 export declare function toBytes(data: string | Uint8Array | ArrayBuffer): Uint8Array;
+/** Portable base64 (no Buffer): for inline small-binary file content. */
+export declare function bytesToBase64(bytes: Uint8Array): string;
+/** Portable base64 decode (no Buffer) — inverse of bytesToBase64. */
+export declare function base64ToBytes(b64: string): Uint8Array;
 export declare const createSite: (db: DbDriver, opts: {
     name: string;
     title?: string;
+    visibility?: "public" | "private";
 }) => SiteRow;
-/** Rename a site and/or change its title. Guards against duplicate names. */
+/** Rename a site, change its title, and/or set visibility / SPA mode.
+ *  Guards against duplicate names; visibility only accepts public|private. */
 export declare const updateSite: (db: DbDriver, id: string, opts: {
     name?: string;
     title?: string;
+    visibility?: "public" | "private";
+    spa?: boolean;
 }) => SiteRow;
+/**
+ * Set (or clear, with null) a site's public data grants. The set is validated
+ * loudly here (this is the LOCAL write path — a peer can still sync junk, which
+ * readers default-deny via parseGrantSet) and stored in canonical serialized
+ * form. Grants only take effect while the site is visibility:public; setting
+ * them on a private site is allowed (they arm when the site goes public).
+ */
+export declare const setSitePublicGrants: (db: DbDriver, siteId: string, grants: GrantSet | null) => SiteRow;
 export declare const deleteSite: (db: DbDriver, id: string) => boolean;
 /** Stable id for a (site, path) pair so re-uploads merge instead of duplicate. */
 export declare function fileIdFor(db: DbDriver, siteId: string, path: string): string | null;
-/** Emit the register writes for one file (shared by inline + blob put paths). */
-export declare function writeFileRow(db: DbDriver, siteId: string, cleanPath: string, contentType: string, encoding: FileEncoding, content: string): SiteFileRow;
+/**
+ * The live row at (site, path) when it already stores exactly this
+ * content_type/encoding/content triple — the skip-unchanged probe. Tombstoned
+ * rows never match (re-uploading the same bytes must still un-delete). putFile's
+ * blob branch also calls this with the content hash *before* touching the blob
+ * store, so an unchanged re-publish never re-marks a flushed blob as pending.
+ */
+export declare function liveFileRowIfSame(db: DbDriver, siteId: string, cleanPath: string, contentType: string, encoding: FileEncoding, content: string): SiteFileRow | null;
+/** Emit the register writes for one file (shared by inline + blob put paths).
+ *  Skip-unchanged: when a live row already stores exactly this triple, nothing
+ *  is emitted and the row returns with `changed: false` — an idempotent
+ *  re-publish adds zero oplog rows on every peer. A tombstoned row always
+ *  rewrites (`changed: true`) so same-byte re-uploads still un-delete. */
+export declare function writeFileRow(db: DbDriver, siteId: string, cleanPath: string, contentType: string, encoding: FileEncoding, content: string): SiteFileRow & {
+    changed: boolean;
+};
 /**
  * Upload/replace one file inline (utf8 text or small base64 binary) — portable,
  * so the browser replica authors sites offline. Binaries over INLINE_LIMIT need
@@ -88,8 +175,14 @@ export declare function writeFileRow(db: DbDriver, siteId: string, cleanPath: st
 export declare function putFileInline(db: DbDriver, siteId: string, path: string, opts: {
     data: string | Uint8Array | ArrayBuffer;
     contentType?: string;
-}): SiteFileRow;
+}): SiteFileRow & {
+    changed: boolean;
+};
 export declare const deleteFile: (db: DbDriver, siteId: string, path: string) => boolean;
+/** Live-file counts for ALL sites in one GROUP BY (walks idx_site_files_site) —
+ *  the site list uses this instead of a per-site fileCount N+1. Sites with no
+ *  live files have no entry; callers default to 0. */
+export declare function fileCounts(db: DbDriver): Map<string, number>;
 /** Count of live files per site (for the management list's file_count). */
 export declare function fileCount(db: DbDriver, siteId: string): number;
 //# sourceMappingURL=sites-core.d.ts.map

package/dist/core/sites-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites-core.d.ts","sourceRoot":"","sources":["../../src/core/sites-core.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM5C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,SAAS,iDAAkD,CAAC;AAIzE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAE3D,eAAO,MAAM,cAAc,2EAEjB,CAAC;AAEX,eAAO,MAAM,gBAAgB,QAA4B,CAAC;AA4D1D,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAID,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIhE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAcxE;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAIjD;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAWjF;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CAMzE;AAQD,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAAa,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED;;6CAE6C;AAC7C,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAG3E;AASD,eAAO,MAAM,UAAU;UAEP,MAAM;YAAU,MAAM;aASpC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,UAAU;WAGN,MAAM;YAAU,MAAM;aAWrC,CAAC;AAEH,eAAO,MAAM,UAAU,uCAQrB,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAC1B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CAeb;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,WAAW,CAoBb;AAED,eAAO,MAAM,UAAU,yDAarB,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D"}
+{"version":3,"file":"sites-core.d.ts","sourceRoot":"","sources":["../../src/core/sites-core.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5C,OAAO,EAA4C,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE3F,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB;;uCAEmC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ;kFAC8E;IAC9E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,eAAO,MAAM,SAAS,uFAAwF,CAAC;AAI/G,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;qEACqE;AACrE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG;IAC3D;;uEAEmE;IACnE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,cAAc,2EAEjB,CAAC;AAEX,eAAO,MAAM,gBAAgB,QAA4B,CAAC;AA4D1D,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,OAAO,CAEvE;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIhE;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE7D;;;;;2BAK2B;AAC3B,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,aAAa,CAMrE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAcxE;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAIjD;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAOjF;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B;IAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,GAAG,IAAI,CAmB/F;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CAkBzE;AAED;;uDAEuD;AACvD,wBAAgB,UAAU,CACxB,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,SAAS,CAAC,GAC7C,MAAM,GAAG,IAAI,CAQf;AAQD,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAAa,CAAC;AAEvC,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED;;6CAE6C;AAC7C,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAG3E;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIvD;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKrD;AASD,eAAO,MAAM,UAAU;UAEP,MAAM;YAAU,MAAM;iBAAe,QAAQ,GAAG,SAAS;aAWvE,CAAC;AAEH;8EAC8E;AAC9E,eAAO,MAAM,UAAU;WAGN,MAAM;YAAU,MAAM;iBAAe,QAAQ,GAAG,SAAS;UAAQ,OAAO;aAcvF,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,oEAS9B,CAAC;AAEH,eAAO,MAAM,UAAU,uCAQrB,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,GAAG,IAAI,CAUpB;AAED;;;;0EAI0E;AAC1E,wBAAgB,YAAY,CAC1B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAoBpC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,WAAW,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAoBpC;AAED,eAAO,MAAM,UAAU,yDAarB,CAAC;AAEH;;sDAEsD;AACtD,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAK5D;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D"}

package/dist/core/sites.d.ts

@@ -1,5 +1,5 @@
 import type { DbDriver } from "./driver.ts";
-import { type SiteFileRow } from "./sites-core.ts";
+import { type SiteFileRow, type FileEncoding } from "./sites-core.ts";
 export * from "./sites-core.ts";
 /** Upload or replace one file. utf8 text and small binaries ride the oplog via
  *  putFileInline (portable); binaries over the inline limit offload to the
@@ -7,10 +7,73 @@ export * from "./sites-core.ts";
 export declare function putFile(db: DbDriver, siteId: string, path: string, opts: {
     data: string | Uint8Array | ArrayBuffer;
     contentType?: string;
-}): Promise<SiteFileRow>;
+}): Promise<SiteFileRow & {
+    changed: boolean;
+}>;
+export interface PublishResult {
+    uploaded: string[];
+    unchanged: string[];
+    pruned: string[];
+}
+/**
+ * Publish a local directory into a site: every file under `dir` uploads via
+ * putFile, whose skip-unchanged probe makes a re-publish idempotent (zero
+ * oplog rows for files whose bytes didn't change). With `prune`, live remote
+ * paths that no longer exist locally are deleted afterwards (mirror mode) —
+ * opt-in because deletes are destructive, and reported in full as evidence.
+ *
+ * Uploads run through a small worker pool (default 8). This is safe because
+ * putFile's oplog writes happen synchronously inside withChangeGroup — its
+ * await points are only file reads and blob-store writes — so change groups
+ * from concurrent workers never interleave. Result arrays are path-sorted for
+ * stable output.
+ */
+export declare function publishDirectory(db: DbDriver, siteId: string, dir: string, opts?: {
+    prune?: boolean;
+    concurrency?: number;
+}): Promise<PublishResult>;
+/** Decode a file row to its served bytes. utf8/base64 decode inline; a blob
+ *  hash resolves on demand (local cache → HTTP peer → bucket) so a published
+ *  asset whose local bytes were cache-evicted still serves from a bucket/peer
+ *  instead of 404ing, consistent with /blob. resolveBlob touches the LRU on a
+ *  local hit and caches any remote fetch. Bounded so a slow source can't hang
+ *  the serve path (null on timeout; an in-flight fetch still finishes and
+ *  populates the cache for the next request). */
+export declare function decodeFileRow(db: DbDriver, row: Pick<SiteFileRow, "encoding" | "content">): Promise<Uint8Array | null>;
 /** Resolve a file to served bytes + content type. "" / trailing "/" → index.html. */
 export declare function getFileForServe(db: DbDriver, siteId: string, path: string): Promise<{
     contentType: string;
     bytes: Uint8Array;
 } | null>;
+/**
+ * HTTP-serve metadata for one request path: the resolved row (index.html /
+ * 404.html rules from resolveSiteFileRow), its serve status, and a weak ETag —
+ * WITHOUT decoding content. The ETag comes from what the register already
+ * holds, so an If-None-Match hit can 304 before resolveBlob's (worst-case 5s)
+ * peer/bucket fan-out ever runs:
+ *   - blob rows: the content field IS the content hash — use it directly;
+ *   - utf8/base64 rows: Bun.hash over encoding + content (the encoding prefix
+ *     keeps a text file and a base64 file with equal stored strings distinct).
+ * Weak (W/) because the same content may be re-encoded across
+ * representations, and we never serve byte-range requests off it.
+ */
+export declare function getFileMetaForServe(db: DbDriver, siteId: string, path: string, opts?: {
+    spa?: boolean;
+}): {
+    row: Pick<SiteFileRow, "content_type" | "encoding" | "content">;
+    status: 200 | 404;
+    etag: string;
+} | null;
+/**
+ * Cache-Control for a served site file. Everything is `private` today (every
+ * caller passes isPublic=false — served pages sit behind the master token or a
+ * capability slug, neither of which may enter a shared cache); the isPublic
+ * branch is pre-wired for Batch 4's visibility:public sites, where a CDN /
+ * reverse proxy may cache.
+ *   - HTML: no-cache — always revalidate (ETag/304) so a republish shows up on
+ *     the next navigation;
+ *   - inline text assets (css/js/json…): short TTL + stale-while-revalidate;
+ *   - blob assets: content-addressed and big — cache a while.
+ */
+export declare function siteCacheControl(contentType: string, encoding: FileEncoding, isPublic: boolean): string;
 //# sourceMappingURL=sites.d.ts.map

package/dist/core/sites.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../src/core/sites.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EACL,KAAK,WAAW,EAUjB,MAAM,iBAAiB,CAAC;AAezB,cAAc,iBAAiB,CAAC;AAEhC;;yEAEyE;AACzE,wBAAsB,OAAO,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,WAAW,CAAC,CAetB;AASD,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAuB5D"}
+{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../src/core/sites.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EAelB,MAAM,iBAAiB,CAAC;AAezB,cAAc,iBAAiB,CAAC;AAQhC;;yEAEyE;AACzE,wBAAsB,OAAO,CAC3B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAyB7C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAAC,aAAa,CAAC,CA8CxB;AASD;;;;;;iDAMiD;AACjD,wBAAsB,aAAa,CACjC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,SAAS,CAAC,GAC7C,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAQ5B;AAED,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAM5D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B;IACD,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,IAAI,CAYP;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,OAAO,GAChB,MAAM,CAWR"}

package/dist/core/sync/anti-abuse.d.ts

@@ -0,0 +1,26 @@
+/** Constant-time string equality (length leaks, content never). Shared by the
+ *  edge owner-token check and the password-verifier compare. */
+export declare function timingSafeEq(a: string, b: string): boolean;
+export type VerifyTurnstile = (secret: string, token: string, ip: string | null) => Promise<boolean>;
+/** Cloudflare Turnstile siteverify. Fails closed on any network/parse error —
+ *  including the 5s timeout: this runs on the guest-write request path, so a
+ *  hung siteverify endpoint must 401 fast, not pile up handlers/sockets. */
+export declare const siteverify: VerifyTurnstile;
+/** The per-grant anti-abuse secrets (a subset of edge-config's DropKnobs and the
+ *  edge D1 `drops` row — structurally compatible with both). */
+export interface AntiAbuseKnobs {
+    turnstileSecret?: string | null;
+    passwordVerifier?: string | null;
+}
+/**
+ * Throw MhError("auth") if the request fails the grant's configured anti-abuse
+ * knobs; no knobs → no-op (open submission). Reads the same headers the drop SDK
+ * sends: `x-turnstile-token` (verified via siteverify) and `x-drop-pass` (the
+ * PBKDF2 verifier the page derived from (password, published salt), compared
+ * constant-time — the password itself never travels).
+ */
+export declare function assertAntiAbuse(knobs: AntiAbuseKnobs | null | undefined, req: Request, opts?: {
+    verifyTurnstile?: VerifyTurnstile;
+    ip?: string | null;
+}): Promise<void>;
+//# sourceMappingURL=anti-abuse.d.ts.map

package/dist/core/sync/anti-abuse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anti-abuse.d.ts","sourceRoot":"","sources":["../../../src/core/sync/anti-abuse.ts"],"names":[],"mappings":"AAWA;gEACgE;AAChE,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO1D;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAErG;;4EAE4E;AAC5E,eAAO,MAAM,UAAU,EAAE,eAaxB,CAAC;AAEF;gEACgE;AAChE,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACxC,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,eAAe,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/core/sync/auth.d.ts

@@ -1,4 +1,5 @@
 import type { Database } from "bun:sqlite";
+import { injectRuntimeTag } from "../inject-runtime.ts";
 export interface AuthConfig {
     debug: boolean;
     staticToken: string | null;
@@ -16,6 +17,13 @@ export interface AuthConfig {
  */
 export declare function queryTokenCookie(req: Request, url: URL, cfg: AuthConfig): string | null;
 export declare function extractToken(req: Request, url: URL): string | null;
+/** An EXPLICITLY presented credential (Bearer header or ?token=) — never the
+ *  ambient cookie. State-changing /api requests require this: /sites/ pages
+ *  run same-origin, so their fetches ride the owner's mh_token cookie
+ *  automatically; requiring an explicit token closes that ambient-authority
+ *  write path without touching cookie-only GET sub-resources (img,
+ *  EventSource) that cannot carry headers. */
+export declare function explicitToken(req: Request, url: URL): string | null;
 /** Whether auth is on at all (so the gate runs and the fetch shim is injected). */
 export declare function authActive(cfg: AuthConfig): boolean;
 /** The currently-valid token and its expiry, or null when auth is off. */
@@ -42,13 +50,23 @@ export declare function renewToken(req: Request, url: URL, cfg: AuthConfig): {
 export declare function wantsHtml(req: Request): boolean;
 declare const HTML_HEADERS: {
     "content-type": string;
+    "referrer-policy": string;
 };
 /** Self-contained token gate: themed to match the WebUI (light/dark, metahub
  *  mark), validates the token before entering, and stores it to localStorage +
  *  cookie on success. No stylesheet/bundle — it runs inside the auth gate. */
 export declare function unlockPage(): string;
-/** Insert the runtime into an HTML document (right after <head>, else prepend). */
-export declare function injectShim(html: string): string;
+/**
+ * The injected page runtime (built from src/webui/runtime.ts, served at
+ * /mh-runtime.js). Carries what the old inline fetch shim did — same-origin
+ * Bearer attach + transparent 401 renewal — plus the offline machinery:
+ * service-worker registration and the local-replica RPC bridge that lets
+ * hosted site pages read/write hub data with no network. Loaded synchronously
+ * (classic script, head-first) so fetch is wrapped before page code runs.
+ * The tag + insertion rule live in core/inject-runtime.ts, shared with the
+ * service worker's and offline bootstrap's injectors.
+ */
+export { injectRuntimeTag as injectShim };
 /** Inject the page runtime into HTML responses. Unconditional (unlike the old
  *  token-only shim): the offline bridge matters even in --debug mode where
  *  auth is off — the token half simply no-ops without a stored token.
@@ -57,6 +75,16 @@ export declare function injectShim(html: string): string;
  *  query param, persist that token as the mh_token cookie on this HTML response
  *  so the browser's follow-up asset requests (/webui.css, /webui.js) carry it. */
 export declare function withShim(res: Response, cfg: AuthConfig, req?: Request, url?: URL): Promise<Response>;
+/** A `?token=` navigation must not leave the credential in the address bar
+ *  (bookmarks, screenshots, same-origin Referer, logs): persist the cookie,
+ *  then 302 to the same URL with the token stripped. Only HTML navigations —
+ *  API calls carrying ?token= are left alone. Returns null when not applicable. */
+export declare function tokenStripRedirect(req: Request, url: URL, cfg: AuthConfig): Response | null;
+/** Cookie ambient authority is READ-ONLY: a state-changing /api request must
+ *  present its credential explicitly (Bearer/query). Same-origin site pages
+ *  otherwise mutate the workspace on the owner's cookie without ever holding
+ *  the token. Returns the 401 to serve, or null to continue. */
+export declare function cookieMutationRejection(req: Request, url: URL, cfg: AuthConfig): Response | null;
 export declare function unauthorized(): Response;
 export { HTML_HEADERS };
 //# sourceMappingURL=auth.d.ts.map

package/dist/core/sync/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/sync/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAMvF;AAYD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAI9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAO/F;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,UAAU,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUvC;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/C;AAED,QAAA,MAAM,YAAY;;CAAiD,CAAC;AA0FpE;;8EAE8E;AAC9E,wBAAgB,UAAU,IAAI,MAAM,CAoHnC;AAYD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;;;;kFAMkF;AAClF,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,OAAO,EACb,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAEvC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/sync/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AASxD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAMvF;AAYD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAIlE;AAED;;;;;8CAK8C;AAC9C,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAInE;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAI9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAO/F;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,UAAU,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUvC;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/C;AAKD,QAAA,MAAM,YAAY;;;CAGjB,CAAC;AA0FF;;8EAE8E;AAC9E,wBAAgB,UAAU,IAAI,MAAM,CAoHnC;AAED;;;;;;;;;GASG;AACH,OAAO,EAAE,gBAAgB,IAAI,UAAU,EAAE,CAAC;AAE1C;;;;;;kFAMkF;AAClF,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,OAAO,EACb,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,QAAQ,CAAC,CAenB;AAED;;;mFAGmF;AACnF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,GAAG,QAAQ,GAAG,IAAI,CAW3F;AAED;;;gEAGgE;AAChE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,UAAU,GACd,QAAQ,GAAG,IAAI,CAMjB;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAEvC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/core/sync/blob-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blob-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/blob-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAkDvE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqBrF;AAgBD,eAAO,MAAM,UAAU,EAAE,KAAK,EAoE7B,CAAC"}
+{"version":3,"file":"blob-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/blob-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAmDvE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAwBrF;AAgBD,eAAO,MAAM,UAAU,EAAE,KAAK,EAoE7B,CAAC"}

package/dist/core/sync/cf-api.d.ts

@@ -0,0 +1,54 @@
+import type { CfApiTarget } from "./edge-config.ts";
+/** Does the named Worker script exist? Used to prevent adopting or overwriting
+ *  a same-name script that this deployment did not create. */
+export declare function workerDeployment(cfg: CfApiTarget): Promise<{
+    exists: boolean;
+    deploymentId: string | null;
+}>;
+export declare function workerExists(cfg: CfApiTarget): Promise<boolean>;
+/** Does the named D1 database exist? */
+export declare function d1Exists(cfg: CfApiTarget): Promise<boolean>;
+export interface D1DatabaseSummary {
+    id: string;
+    name: string;
+    createdAt: string | null;
+}
+/** Exact-name lookup used only by the crash-resume path. D1's API accepts a
+ * name filter but we still filter the result exactly before adopting it. */
+export declare function d1DatabasesByName(cfg: Pick<CfApiTarget, "accountId" | "apiToken">, name: string): Promise<D1DatabaseSummary[]>;
+/** Does the named R2 bucket exist? */
+export declare function r2BucketExists(cfg: Pick<CfApiTarget, "accountId" | "apiToken">, name: string): Promise<boolean>;
+/** Create the named R2 bucket. Mirrors createD1Database's stance: a same-name
+ *  bucket that already exists is refused, never silently adopted (mh only
+ *  touches resources this flow itself named and created; the resume path in
+ *  edge-service tolerates its OWN half-finished creation via the persisted
+ *  progress record, not here). */
+export declare function createR2Bucket(cfg: Pick<CfApiTarget, "accountId" | "apiToken">, name: string): Promise<void>;
+/** The account's S3 endpoint for R2 (path-style; isVirtualHostedStyle
+ *  auto-detects false for it). */
+export declare function r2Endpoint(accountId: string): string;
+/** Run SQL against the D1 database (schema migration). Statements are sent one
+ *  at a time so a mid-script failure reports the exact statement. */
+export declare function d1Exec(cfg: CfApiTarget, sqlScript: string): Promise<void>;
+/** Upload the edge worker module (multipart metadata + script). Declarative
+ *  `exports` + `keep_bindings:["secret_text"]` so a re-deploy never wipes the
+ *  OWNER_TOKEN secret set separately below. */
+export declare function uploadEdgeWorker(cfg: CfApiTarget, script: string, deploymentId: string): Promise<void>;
+/** Set a secret on the worker via the dedicated secrets endpoint (spike ⑥
+ *  recommendation: script re-deploys then never carry the secret in metadata). */
+export declare function putWorkerSecret(cfg: CfApiTarget, name: string, text: string): Promise<void>;
+/** The account's workers.dev subdomain — derives the worker's default endpoint. */
+export declare function workersDevSubdomain(cfg: CfApiTarget): Promise<string>;
+/** Create a dedicated D1 database and return its stable UUID. Cloudflare's
+ *  conflict response is surfaced loudly; callers never adopt a same-name DB. */
+export declare function createD1Database(cfg: Pick<CfApiTarget, "accountId" | "apiToken">, name: string): Promise<{
+    id: string;
+    name: string;
+}>;
+/** Return the account workers.dev subdomain, or null when none exists yet. */
+export declare function maybeWorkersDevSubdomain(cfg: CfApiTarget): Promise<string | null>;
+/** Create the account-level workers.dev subdomain. */
+export declare function createWorkersDevSubdomain(cfg: CfApiTarget, subdomain: string): Promise<string>;
+/** Publish a script on the account's workers.dev domain. */
+export declare function enableWorkerSubdomain(cfg: CfApiTarget): Promise<void>;
+//# sourceMappingURL=cf-api.d.ts.map

package/dist/core/sync/cf-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-api.d.ts","sourceRoot":"","sources":["../../../src/core/sync/cf-api.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAqCpD;8DAC8D;AAC9D,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAc3D;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAErE;AAED,wCAAwC;AACxC,wBAAsB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAKjE;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;4EAC4E;AAC5E,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAC,EAChD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAgB9B;AAQD,sCAAsC;AACtC,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAC,EAChD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;kCAIkC;AAClC,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAC,EAChD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;kCACkC;AAClC,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;qEACqE;AACrE,wBAAsB,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY/E;AAED;;+CAE+C;AAC/C,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;kFACkF;AAClF,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjG;AAED,mFAAmF;AACnF,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3E;AAED;gFACgF;AAChF,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAC,EAChD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBvC;AAED,8EAA8E;AAC9E,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASvF;AAED,sDAAsD;AACtD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,4DAA4D;AAC5D,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAW3E"}

package/dist/core/sync/cf-oauth.d.ts

@@ -0,0 +1,91 @@
+/** Registered OAuth client id, resolved from two layers in order:
+ *
+ *  1. `METAHUB_CF_OAUTH_CLIENT_ID` — a *runtime* env var. Self-hosters who
+ *     register their own private client set this on the machine; it works on
+ *     any install, shipped binaries included, and always wins.
+ *  2. `MH_BUILD_CF_OAUTH_CLIENT_ID` — *baked in at build time*. The bundler
+ *     inlines every `MH_BUILD_*` reference as a string literal (`--env
+ *     'MH_BUILD_*'` in scripts/build.ts, scripts/compile-binaries.ts and
+ *     apps/desktop/scripts/build-sidecars.ts), so official builds carry the id
+ *     even though the end user's machine has no such variable. It is a
+ *     deliberately *different* name from (1) — sharing one name would let the
+ *     inliner freeze the override into a constant and kill layer 1.
+ *
+ *  Both empty (a from-source run, or a fork that never registered a client) →
+ *  OAuth login is unavailable and callers fall back to manual token entry. */
+export declare const CF_OAUTH_CLIENT_ID: string;
+/** Minimal scopes the Edge deploy needs, using Cloudflare's self-managed OAuth
+ *  scope identifiers (dotted, e.g. `d1.write` — NOT the wrangler `d1:write`
+ *  style). Both read + write are requested for Workers Scripts and D1 because
+ *  the deploy pipeline does GETs (existence checks, workers.dev subdomain
+ *  lookup) as well as writes. `account-settings.read` backs account discovery.
+ *  NOTE: the account-level /workers/subdomain PUT is assumed covered by
+ *  workers-scripts.write (no dedicated subdomain scope exists); if a deploy
+ *  fails there with a permission error, add the missing scope here + in the
+ *  registered client. */
+export declare const CF_OAUTH_SCOPES: string[];
+export interface CfToken {
+    accessToken: string;
+    refreshToken: string | null;
+    expiresIn: number | null;
+}
+export interface CfAccount {
+    id: string;
+    name: string;
+}
+/** Is OAuth login available (a client id is configured)? */
+export declare function cfOAuthConfigured(clientId?: string): boolean;
+/** Generate a PKCE verifier + S256 challenge. verifier is 32 random bytes
+ *  base64url-encoded (43 chars, ~256 bits); challenge = base64url(SHA-256(verifier)). */
+export declare function pkce(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+export declare function buildAuthUrl(p: {
+    clientId: string;
+    redirectUri: string;
+    challenge: string;
+    state: string;
+    scopes: string[];
+    authEndpoint?: string;
+}): string;
+export declare function buildTokenRequestBody(p: {
+    clientId: string;
+    code: string;
+    verifier: string;
+    redirectUri: string;
+}): string;
+/** Parse the token endpoint's JSON response into a CfToken. */
+export declare function parseTokenResponse(data: unknown): CfToken;
+/** Parse a Cloudflare /accounts result into id/name pairs. */
+export declare function parseAccounts(data: unknown): CfAccount[];
+/** Discover the accounts the token can act on, so the user need not paste an
+ *  Account ID. Single account → auto-select; multiple → caller prompts. */
+export declare function discoverAccounts(accessToken: string): Promise<CfAccount[]>;
+/** Open a URL in the user's default browser (best-effort; caller should also
+ *  print the URL as a fallback). */
+export declare function openBrowser(url: string): void;
+export interface CfLoginHandle {
+    /** Consent URL to open in a browser. */
+    authUrl: string;
+    /** The loopback redirect the temporary listener is bound to. */
+    redirectUri: string;
+    /** Resolves once the browser redirect is caught and the code is exchanged.
+     *  Rejects on state mismatch, user-denied consent, timeout, or exchange error.
+     *  Always tears down the listener. */
+    waitForToken(): Promise<CfToken>;
+    /** Tear down the listener without waiting (e.g. modal closed). */
+    cancel(): void;
+}
+/** Start an OAuth login: bind a temporary loopback listener, build the consent
+ *  URL. The caller opens `authUrl` (CLI/desktop) or hands it to the browser
+ *  (WebUI), then awaits `waitForToken()`. Endpoints/clientId are injectable for
+ *  tests. */
+export declare function startCfLogin(opts?: {
+    clientId?: string;
+    scopes?: string[];
+    authEndpoint?: string;
+    tokenEndpoint?: string;
+    timeoutMs?: number;
+}): Promise<CfLoginHandle>;
+//# sourceMappingURL=cf-oauth.d.ts.map

package/dist/core/sync/cf-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-oauth.d.ts","sourceRoot":"","sources":["../../../src/core/sync/cf-oauth.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;;;;8EAc8E;AAC9E,eAAO,MAAM,kBAAkB,QAC0D,CAAC;AAM1F;;;;;;;;yBAQyB;AACzB,eAAO,MAAM,eAAe,UAW3B,CAAC;AAKF,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,QAAQ,SAAqB,GAAG,OAAO,CAExE;AAID;yFACyF;AACzF,wBAAsB,IAAI,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAM7E;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAYT;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAQT;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAezD;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,EAAE,CAKxD;AA2BD;2EAC2E;AAC3E,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAYhF;AAED;oCACoC;AACpC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAY7C;AAED,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB;;0CAEsC;IACtC,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,kEAAkE;IAClE,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;;aAGa;AACb,wBAAsB,YAAY,CAAC,IAAI,GAAE;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAyE9B"}

package/dist/core/sync/client.d.ts

@@ -1,4 +1,5 @@
 import type { DbDriver } from "../driver.ts";
+import { type Change } from "../crdt.ts";
 export interface SyncResult {
     pushed: number;
     pulled: number;
@@ -17,7 +18,18 @@ export interface SyncOpts {
     pullLimit?: number;
     /** Datasets this replica opts out of (partial replica, e.g. site_files). */
     excludeDatasets?: string[];
+    /** Hard transport budget. Every sync is bounded even when the peer accepts
+     * the TCP connection but never replies. */
+    timeoutMs?: number;
 }
+/** After a pull, advance the push cursor across the CONTIGUOUS prefix of
+ * newly-appended oplog rows that came out of this round's response: the peer
+ * obviously holds what it just sent us, so those rows must not count as
+ * "unpushed" (they made status surfaces flash BEHIND after every successful
+ * pull, until the next round skipped them). The walk stops at the first row
+ * NOT in the response — e.g. a concurrent local write — which genuinely is
+ * unpushed and must keep the peer looking behind. Exported for tests. */
+export declare function advanceAckedPrefix(db: DbDriver, fromSeq: number, received: Change[]): number;
 /**
  * Run one push/pull round against a peer server. A single round is bidirectional
  * (pushes local changes, pulls remote ones). The token defaults to the credential

package/dist/core/sync/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/core/sync/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAyB7C,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;0EAGsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAQ,GAAG,MAAW,GAC3B,OAAO,CAAC,UAAU,CAAC,CAqCrB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/core/sync/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAA2B,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAuBlE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;0EAGsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;+CAC2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAKD;;;;;;yEAMyE;AACzE,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAgB5F;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAQ,GAAG,MAAW,GAC3B,OAAO,CAAC,UAAU,CAAC,CA2CrB"}

package/dist/core/sync/data-map-db.d.ts

@@ -0,0 +1,8 @@
+import type { DbDriver } from "../driver.ts";
+import { type DataPlace, type DataMapState } from "../data-map.ts";
+export interface DataMap {
+    state: DataMapState;
+    places: DataPlace[];
+}
+export declare function dataMap(db: DbDriver): DataMap;
+//# sourceMappingURL=data-map-db.d.ts.map

package/dist/core/sync/data-map-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-map-db.d.ts","sourceRoot":"","sources":["../../../src/core/sync/data-map-db.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAMxB,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAwD7C"}