@tensorix/metahub 0.3.2 → 0.4.0

package/dist/core/sync/devices.d.ts

@@ -0,0 +1,65 @@
+import type { DbDriver } from "../driver.ts";
+/** One way a device is connected to this node. */
+export interface DeviceChannel {
+    /** paired_out = an outbound peer row here; grant_in = a credential we issued
+     *  to it; oplog = its changes reached us (bucket or historic sync). */
+    kind: "paired_out" | "grant_in" | "oplog" | "bucket_presence";
+    /** peer url (paired_out) / full grant token (grant_in; surfaces mask it) /
+     *  "" (oplog). */
+    ref: string;
+    lastSeenAt: number | null;
+    /** Future expiry of a currently-live publisher lease. It is not a
+     * last-activity timestamp and must not be rendered as one. */
+    leaseLiveUntil?: number | null;
+    transport?: "http" | "s3" | "room";
+}
+/**
+ * yes           — one-click: revoke the grant and/or remove the peer row.
+ * bucket_rotate — only reachable through the shared bucket key: cutting it off
+ *                 means rotating the bucket credentials (rotateStoragePeer).
+ * unknown       — only historical authorship is known; no destructive action
+ *                 can yet be tied to the right credential.
+ * none          — this device itself, or nothing to revoke.
+ */
+export type Revocable = "yes" | "bucket_rotate" | "unknown" | "none";
+export interface DeviceView {
+    /** null: a grant that never learned its peer's node id (one-directional). */
+    nodeId: string | null;
+    label: string | null;
+    self: boolean;
+    channels: DeviceChannel[];
+    lastActivityAt: number | null;
+    revocable: Revocable;
+    /** Why the revocation verdict is safe to show. Unknown deliberately prevents
+     *  an unrelated configured bucket from being blamed for a historical oplog
+     *  author. */
+    revocationConfidence: "confirmed" | "unknown" | "none";
+    /** What a revoke would act on: peer url, bucket url, or a grant-token PREFIX
+     *  (8 chars — never the full credential; masked at the source). */
+    revocationSources: string[];
+}
+/** Fold the three stores into one per-device list: self first, then by most
+ *  recent activity. Purely local reads — same answer offline. */
+export declare function listDevices(db: DbDriver): DeviceView[];
+export interface BucketPresence {
+    nodeId: string;
+    /** The node's own segment stream exists under oplog/ in this bucket. */
+    inBucket: boolean;
+    /** Publisher heartbeat expiry when live (≈ "recently online"), else null. */
+    leaseLiveUntil: number | null;
+}
+export interface BucketPresenceResult {
+    url: string;
+    nodes?: BucketPresence[];
+    error?: string;
+}
+/** Refine an offline roster with online bucket evidence. Only an explicit
+ * stream/lease match may produce bucket_rotate; absence or refresh failure
+ * remains unknown because the oplog author might have arrived via old HTTP
+ * pairing or a bucket no longer attached here. */
+export declare function resolveDevicePresence(devices: DeviceView[], buckets: BucketPresenceResult[]): DeviceView[];
+/** Online refresh for one bucket: which nodes' streams live in it and whose
+ *  publisher heartbeat is fresh. Resolves the honest classification for devices
+ *  the offline listing could only call "通过存储桶或历史同步". */
+export declare function refreshBucketPresence(db: DbDriver, url: string): Promise<BucketPresence[]>;
+//# sourceMappingURL=devices.d.ts.map

package/dist/core/sync/devices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.d.ts","sourceRoot":"","sources":["../../../src/core/sync/devices.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAa7C,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B;2EACuE;IACvE,IAAI,EAAE,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,iBAAiB,CAAC;IAC9D;sBACkB;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;kEAC8D;IAC9D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB;;kBAEc;IACd,oBAAoB,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IACvD;uEACmE;IACnE,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;iEACiE;AACjE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,GAAG,UAAU,EAAE,CAqFtD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,QAAQ,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;kDAGkD;AAClD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,oBAAoB,EAAE,GAC9B,UAAU,EAAE,CAsCd;AAED;;wDAEwD;AACxD,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA4BhG"}

package/dist/core/sync/drop-host.d.ts

@@ -0,0 +1,40 @@
+export interface DropRegistration {
+    turnstile_sitekey?: string | null;
+    turnstile_secret?: string | null;
+    password_salt?: string | null;
+    password_verifier?: string | null;
+    max_envelopes?: number;
+    max_bytes?: number;
+}
+export interface DropEnvelopeRow {
+    /** Host-side monotonically increasing row id — the pull/ack cursor. */
+    id: number;
+    /** The stored envelope JSON (validated by drop-protocol on the owner side). */
+    envelope: unknown;
+}
+export interface DropStats {
+    drop_id: string;
+    envelopes: number;
+    bytes: number;
+    max_envelopes: number;
+    max_bytes: number;
+}
+export interface DropHostApi {
+    register(dropId: string, reg: DropRegistration): Promise<void>;
+    unregister(dropId: string): Promise<boolean>;
+    listEnvelopes(dropId: string, afterId: number, limit: number): Promise<DropEnvelopeRow[]>;
+    ackEnvelopes(dropId: string, ids: number[]): Promise<number>;
+    stats(dropId: string): Promise<DropStats>;
+    health(): Promise<{
+        ok: boolean;
+        version?: string;
+    }>;
+    ownerHealth(): Promise<{
+        ok: boolean;
+        version?: string;
+    }>;
+}
+/** HTTP implementation against an inbox host base URL + drt_ owner secret.
+ *  `fetcher` is injectable so tests drive the edge worker handler in-process. */
+export declare function httpDropHost(endpoint: string, token: string, fetcher?: typeof fetch): DropHostApi;
+//# sourceMappingURL=drop-host.d.ts.map

package/dist/core/sync/drop-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-host.d.ts","sourceRoot":"","sources":["../../../src/core/sync/drop-host.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,+EAA+E;IAC/E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1F,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,WAAW,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AASD;iFACiF;AACjF,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAAO,KAAa,GAC5B,WAAW,CA0Db"}

package/dist/core/sync/drop-keys.d.ts

@@ -0,0 +1,64 @@
+import type { DbDriver } from "../driver.ts";
+import { type S3Config, type StorageClient } from "./storage.ts";
+export interface DropKeyRecord {
+    key_id: string;
+    /** base64 raw uncompressed P-256 public point — published in mh-drop.json. */
+    pk: string;
+    /** base64 private key: encryptBytes(masterKey, pkcs8) when `wrapped`, else raw pkcs8. */
+    sk: string;
+    wrapped: boolean;
+    created_at: number;
+    retired: boolean;
+}
+export interface DropKeyring {
+    v: 1;
+    keys: DropKeyRecord[];
+}
+export declare function getLocalDropKeyring(db: DbDriver): DropKeyring | null;
+export declare function saveLocalDropKeyring(db: DbDriver, kr: DropKeyring): void;
+/** The bucket a drop keyring anchors to: the first enabled ENCRYPTED s3 peer.
+ *  A plaintext bucket is deliberately not used — a raw private key must never
+ *  sit on third-party storage, so no-encrypted-bucket behaves like no bucket
+ *  (keyring stays local-only). `client` is lazy so callers that only need the
+ *  peer identity (push-cursor ack gate) never construct an S3 client. */
+export interface DropBucket {
+    peerUrl: string;
+    config: S3Config;
+    base: string;
+    keyPath: string;
+    masterKey: Uint8Array;
+    client: () => StorageClient;
+}
+export declare function dropBucketFor(db: DbDriver): DropBucket | null;
+export declare function activeDropKey(kr: DropKeyring): DropKeyRecord;
+export declare function findDropKey(kr: DropKeyring, keyId: string): DropKeyRecord | undefined;
+/** Decrypt a key record's private half to raw PKCS#8 bytes. A wrapped key needs
+ *  the bucket's master key; a mismatched master key fails the GCM tag → auth. */
+export declare function dropKeySecret(db: DbDriver, key: DropKeyRecord, opts?: {
+    bucket?: DropBucket | null;
+}): Promise<Uint8Array>;
+/**
+ * Load (or first-provision) the drop keyring. Bucket attached → the bucket
+ * object is authoritative: adopt it when present; otherwise upload ours with
+ * If-None-Match and adopt the winner on a lost first-create race (the exact
+ * provisionMasterKey pattern). No bucket → local meta only.
+ */
+export declare function ensureDropKeys(db: DbDriver, opts?: {
+    bucket?: DropBucket | null;
+}): Promise<DropKeyring>;
+/**
+ * Rotate: append a fresh active key; every currently-active key becomes
+ * retired (kept, so in-flight envelopes still open). With `purgeRetired`, keys
+ * that were ALREADY retired before this call are dropped — the just-retired
+ * generation always survives one rotation, so a rotate can never orphan mail
+ * sealed a second earlier.
+ */
+export declare function rotateDropKeys(db: DbDriver, opts?: {
+    purgeRetired?: boolean;
+    bucket?: DropBucket | null;
+}): Promise<{
+    keyring: DropKeyring;
+    active: DropKeyRecord;
+    purged: string[];
+}>;
+//# sourceMappingURL=drop-keys.d.ts.map

package/dist/core/sync/drop-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-keys.d.ts","sourceRoot":"","sources":["../../../src/core/sync/drop-keys.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAItB,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,yFAAyF;IACzF,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AAcD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,GAAG,WAAW,GAAG,IAAI,CAWpE;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,GAAG,IAAI,CAIxE;AAID;;;;yEAIyE;AACzE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE,MAAM,aAAa,CAAC;CAC7B;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,GAAG,UAAU,GAAG,IAAI,CAoB7D;AAqFD,wBAAgB,aAAa,CAAC,EAAE,EAAE,WAAW,GAAG,aAAa,CAK5D;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErF;AAED;iFACiF;AACjF,wBAAsB,aAAa,CACjC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;CAAO,GACxC,OAAO,CAAC,UAAU,CAAC,CAMrB;AAID;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;CAAO,GACxC,OAAO,CAAC,WAAW,CAAC,CA4DtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;CAAO,GAChE,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAiB5E"}

package/dist/core/sync/drop-protocol.d.ts

@@ -0,0 +1,94 @@
+import type { DbDriver } from "../driver.ts";
+import type { Change } from "../crdt.ts";
+import { type GrantSet } from "../grants-core.ts";
+import type { GuestIntent } from "../guest-intent.ts";
+import { SEAL_ENC } from "./seal.ts";
+/** Hard ceiling a serialized envelope may weigh (edge enforces 413 above it). */
+export declare const DROP_ENVELOPE_MAX_BYTES: number;
+/** Reject any change whose HLC claims to be further in the future than this —
+ *  ingest() observeHlc's every change unconditionally, so an unclamped remote
+ *  timestamp would permanently poison the local clock (design.md §7 red line 6). */
+export declare const DROP_HLC_SKEW_MS: number;
+/** Inbox guest identity: "g" + 8 base36, minted per visitor, localStorage-persisted.
+ *  9 chars total — structurally distinct from real 8-char node ids. */
+export declare const GUEST_NODE_RE: RegExp;
+export interface DropEnvelope {
+    v: 1;
+    /** "e" + 16 base36 — replay-stable identity; also keys the txn rewrite. */
+    envelope_id: string;
+    /** The drop this was addressed to (site id today; "sh_"+slug reserved). */
+    drop_id: string;
+    enc: typeof SEAL_ENC;
+    /** Which recipient key sealed it (drop-keys keyring key_id). */
+    key_id: string;
+    /** base64(MH-SEAL-P256 sealed DropPayload JSON). */
+    sealed: string;
+    /** Sender wall clock, epoch ms (informational only — never trusted). */
+    created_at: number;
+}
+export interface DropPayload {
+    v: 1;
+    /** The visitor's guest node id ("g"+8) — every change must be signed by it. */
+    guest_node: string;
+    /** Pre-signed ops in oplog row format, authored under guest_node's mini-HLC. */
+    changes: Change[];
+    meta?: Record<string, unknown>;
+}
+/** Payload v2: high-level GuestIntents instead of pre-signed Change[]. The
+ *  browser no longer mints HLC/oplog rows — the owner's applyGuestIntent does,
+ *  on the guest's own timeline at each intent's (clamped) submittedAt. Idempotent
+ *  on intentId (a replay under a new envelope_id is a no-op). This is where the
+ *  guest-clock-minting attack surface (NaN-HLC, seed offsets) stops existing. */
+export interface DropPayloadV2 {
+    v: 2;
+    guest_node: string;
+    intents: GuestIntent[];
+    meta?: Record<string, unknown>;
+}
+/** Either wire version — decodeDropPayload returns this; callers discriminate on `v`. */
+export type AnyDropPayload = DropPayload | DropPayloadV2;
+export declare function newEnvelopeId(): string;
+export declare function newGuestNode(): string;
+export declare function encodeDropPayload(payload: AnyDropPayload): Uint8Array;
+export declare function decodeDropPayload(bytes: Uint8Array): AnyDropPayload;
+/** Structural check on an envelope as it comes off the edge host. */
+export declare function parseDropEnvelope(raw: unknown): DropEnvelope;
+/** Seal a payload into a complete envelope (sender side — the SDK). */
+export declare function sealDropEnvelope(opts: {
+    dropId: string;
+    keyId: string;
+    /** Recipient public key, raw uncompressed P-256 point. */
+    pk: Uint8Array;
+    payload: AnyDropPayload;
+    now?: number;
+}): Promise<DropEnvelope>;
+/** Decrypt + decode an envelope with one keyring key (owner side). Wrong key /
+ *  tampered ciphertext → MhError("auth") from openSealed. */
+export declare function openDropEnvelope(env: DropEnvelope, key: {
+    pk: Uint8Array;
+    sk: Uint8Array;
+}): Promise<AnyDropPayload>;
+/** Validate a v2 payload's guest identity before its intents are applied
+ *  (mirrors checkDropPayload's guest_node guard; per-intent authorization +
+ *  minting is applyGuestIntent's job in drop-pull). */
+export declare function checkDropIntents(ownNode: string, payload: DropPayloadV2): DropPayloadV2;
+/**
+ * The write-inbox isolation layer: validate a decrypted payload BEFORE any of
+ * it touches the oplog. Any violation throws (MhError) and the WHOLE envelope
+ * is rejected — a form submission is atomic, partial ingest would strand half
+ * a row. Checks, in order:
+ *   1. guest_node has the inbox shape ("g"+8) and is not this node's own id —
+ *      an envelope can never impersonate a real device;
+ *   2. changes is non-empty;
+ *   3. HLC clamp: every change's millis ≤ now + 5min (clock-poisoning guard —
+ *      this is the one check that lives HERE rather than in grants-core,
+ *      because it is clock hygiene, not authorization);
+ *   4. grant semantics via grants-core.checkGuestChanges (records-only, node
+ *      segment match, granted tables/ops, coercible property types — blob-
+ *      carrying types refused, value coercion, size/row ceilings).
+ * Returns the changes with txn force-rewritten to "drop:"+envelope_id, so
+ * replays are stable (oplog UNIQUE dedups) and history can group + roll back
+ * by envelope.
+ */
+export declare function checkDropPayload(db: DbDriver, set: GrantSet, ownNode: string, envelopeId: string, payload: DropPayload, now?: number): Change[];
+//# sourceMappingURL=drop-protocol.d.ts.map

package/dist/core/sync/drop-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-protocol.d.ts","sourceRoot":"","sources":["../../../src/core/sync/drop-protocol.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAqB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAoB,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIvD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAY,CAAC;AACjD;;oFAEoF;AACpF,eAAO,MAAM,gBAAgB,QAAa,CAAC;AAC3C;uEACuE;AACvE,eAAO,MAAM,aAAa,QAAmB,CAAC;AAI9C,MAAM,WAAW,YAAY;IAC3B,CAAC,EAAE,CAAC,CAAC;IACL,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,QAAQ,CAAC;IACrB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;iFAIiF;AACjF,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC;AAEzD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAID,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,CAErE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAanE;AAuCD,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAgB5D;AAED,uEAAuE;AACvE,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,EAAE,EAAE,UAAU,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,YAAY,CAAC,CAWxB;AAED;6DAC6D;AAC7D,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GACtC,OAAO,CAAC,cAAc,CAAC,CAGzB;AAED;;uDAEuD;AACvD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,aAAa,CAKvF;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,WAAW,EACpB,GAAG,SAAa,GACf,MAAM,EAAE,CAkBV"}

package/dist/core/sync/drop-pull.d.ts

@@ -0,0 +1,67 @@
+import type { DbDriver } from "../driver.ts";
+import type { Change } from "../crdt.ts";
+import { type SiteRow } from "../sites-core.ts";
+import { type DropHostApi } from "./drop-host.ts";
+/** Live sites that expose a `create` grant — exactly the sites the auto-wiring
+ *  registers as drops, so this derivation IS the drop inventory (no extra
+ *  registry to keep in sync). */
+export declare function dropWiredSites(db: DbDriver): SiteRow[];
+export interface DropPullDropSummary {
+    drop_id: string;
+    site: string;
+    /** Envelopes fetched this round. */
+    fetched: number;
+    /** New oplog rows gained (ingest's honest "received" count). */
+    ingested: number;
+    acked: number;
+    rejected: number;
+    /** Valid + ingested but ack deferred to a later round (bucket gate). */
+    deferred: number;
+    /** Held (NOT acked, NOT deleted) because opening failed on OUR side — a local
+     *  key/bucket fault, not bad mail. Retried on a later, fixed pull; never lost. */
+    held: number;
+    /** Payload-version breakdown of the envelopes ingested this round — drives the
+     *  drain metric for the v1→v2 migration (mh edge status). */
+    v1: number;
+    v2: number;
+}
+export interface DropPullSummary {
+    skipped?: "no_edge" | "no_sites" | "no_keys" | "not_publisher";
+    drops: DropPullDropSummary[];
+    fetched: number;
+    ingested: number;
+    acked: number;
+    rejected: number;
+    deferred: number;
+    held: number;
+    v1: number;
+    v2: number;
+}
+/** Ack watermark of a payload's ops, keyed by their register coordinates —
+ *  (dataset,row_id,col) plus `hlc >= theirs`, i.e. each op counts as accounted
+ *  for when it either LANDED (exact row present; the oplog UNIQUE tuple, so a
+ *  new-id replay resolves to the ORIGINAL seq and acks instead of deferring
+ *  forever) or was SUPERSEDED (a newer register write exists — LWW-moot, incl.
+ *  a long-deferred envelope whose op was compacted away, or one applyChange
+ *  rejected because a newer winner already made it un-materializable).
+ *  Returns null unless EVERY op is accounted for: a partial ingest (one change
+ *  skipped as poison) must NOT ack the envelope — the caller holds it and
+ *  retries, because ack+delete would permanently lose that guest write.
+ *  (Known limit: a held-partial envelope re-pulled after its landed sibling
+ *  passed the push cursor takes the envelopeMaxSeq fast path and acks — the txn
+ *  probe can't know the sealed payload's op count. Partial ingest is
+ *  constructively unreachable via checkDropPayload today; this gate is the
+ *  same-round backstop. Exported for the gate's unit tests.) */
+export declare function changesMaxSeq(db: DbDriver, changes: Change[]): number | null;
+/**
+ * One pull round over every wired drop. With a bucket attached the round rides
+ * the publisher lease (only the elected device pays the poll — correctness
+ * never depends on it, double pulls converge); `ignoreLease` (manual
+ * `mh edge pull`) skips that economy.
+ */
+export declare function pullDropsOnce(db: DbDriver, opts?: {
+    host?: DropHostApi;
+    ignoreLease?: boolean;
+    now?: () => number;
+}): Promise<DropPullSummary>;
+//# sourceMappingURL=drop-pull.d.ts.map

package/dist/core/sync/drop-pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-pull.d.ts","sourceRoot":"","sources":["../../../src/core/sync/drop-pull.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAOzC,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAqBhE;;iCAEiC;AACjC,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAItD;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB;sFACkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb;iEAC6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAC/D,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACZ;AA2BD;;;;;;;;;;;;;;gEAcgE;AAChE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAU5E;AA2DD;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GAC3E,OAAO,CAAC,eAAe,CAAC,CAqL1B"}

package/dist/core/sync/drop-wire.d.ts

@@ -0,0 +1,39 @@
+import type { DbDriver } from "../driver.ts";
+import { type SiteRow } from "../sites-core.ts";
+import { type DropHostApi } from "./drop-host.ts";
+/** Reserved site file the SDK auto-discovers. publishDirectory's --prune
+ *  deliberately skips it (sites.ts) so a mirror re-publish can't sever the
+ *  wiring between two grant commands. */
+export declare const DROP_CONFIG_PATH = "mh-drop.json";
+/** Reserved deployment manifest the SDK reads for EXPLICIT channel selection
+ *  (mode + endpoints + policy revision) instead of guessing from 401/network.
+ *  Published alongside mh-drop.json; --prune skips it too. */
+export declare const MANIFEST_PATH = "mh-manifest.json";
+/** The reserved files the grant/edge wiring owns — never pruned by a mirror
+ *  publish (they'd be re-created immediately: pure delete/recreate oplog churn). */
+export declare const RESERVED_SITE_FILES: ReadonlySet<string>;
+export interface DropWireResult {
+    site: string;
+    name: string;
+    /** create grant present AND edge configured — the drop transport is live. */
+    wired: boolean;
+    /** What happened to mh-drop.json. */
+    file: "written" | "unchanged" | "removed" | "none";
+    /** Host registration outcome; null when none was attempted. */
+    registered: boolean | null;
+    registerError?: string;
+    /** Which transport create-grant submissions ride (null: no create grant). */
+    transport: "edge" | "server" | null;
+}
+export declare function siteHasCreateGrant(site: Pick<SiteRow, "public_grants">): boolean;
+/**
+ * Reconcile one site's drop wiring with its grants + the edge config. File
+ * writes are idempotent (writeFileRow skip-unchanged: zero oplog rows when
+ * nothing changed); host registration is re-PUT every time (idempotent upsert)
+ * and failures are reported, not thrown — a temporarily unreachable edge must
+ * not fail the grant/publish command that triggered the wiring.
+ */
+export declare function syncDropWiring(db: DbDriver, site: SiteRow, opts?: {
+    host?: DropHostApi;
+}): Promise<DropWireResult>;
+//# sourceMappingURL=drop-wire.d.ts.map

package/dist/core/sync/drop-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-wire.d.ts","sourceRoot":"","sources":["../../../src/core/sync/drop-wire.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,OAAO,EAA6B,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGhE;;yCAEyC;AACzC,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C;;8DAE8D;AAC9D,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAEhD;oFACoF;AACpF,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAA8C,CAAC;AAEnG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,qCAAqC;IACrC,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IACnD,+DAA+D;IAC/D,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG,OAAO,CAEhF;AAgED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,WAAW,CAAA;CAAO,GAChC,OAAO,CAAC,cAAc,CAAC,CAqEzB"}

package/dist/core/sync/e2ee.d.ts

@@ -10,6 +10,9 @@ export interface KeyEnvelope {
 }
 export declare function toB64(bytes: Uint8Array): string;
 export declare function fromB64(b64: string): Uint8Array;
+/** base64url (RFC 4648 §5, unpadded) of raw bytes — for OAuth PKCE verifiers and
+ *  SHA-256 challenges, where the value travels in a URL query. */
+export declare function toB64url(bytes: Uint8Array): string;
 /** A fresh random 256-bit master key (raw bytes). */
 export declare function generateMasterKey(): Uint8Array;
 /** Wrap the master key under a passphrase-derived KEK → bucket keys/main.json. */

package/dist/core/sync/e2ee.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"e2ee.d.ts","sourceRoot":"","sources":["../../../src/core/sync/e2ee.ts"],"names":[],"mappings":"AAkCA,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAK/C;AAID,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,UAAU,CAE9C;AAmBD,kFAAkF;AAClF,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBhG;AAED;2EAC2E;AAC3E,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAc/F;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAc5F;AAWD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUjG;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAU/F"}
+{"version":3,"file":"e2ee.d.ts","sourceRoot":"","sources":["../../../src/core/sync/e2ee.ts"],"names":[],"mappings":"AAkCA,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAK/C;AAED;kEACkE;AAClE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAElD;AAID,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,UAAU,CAE9C;AAmBD,kFAAkF;AAClF,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBhG;AAED;2EAC2E;AAC3E,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAc/F;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAc5F;AAWD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUjG;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAU/F"}

package/dist/core/sync/edge-config.d.ts

@@ -0,0 +1,77 @@
+import type { DbDriver } from "../driver.ts";
+/** Shared without importing the Worker bundle into browser/Node clients. */
+export declare const EXPECTED_EDGE_WORKER_VERSION = "3";
+export type EdgeCapability = "inbox" | "room";
+/** Persisted Cloudflare resource identity. Deliberately excludes the account
+ *  API token: deploy/upgrade callers must supply that ephemeral credential. */
+export interface CfEdgeTarget {
+    accountId: string;
+    workerName: string;
+    d1Id: string;
+    d1Name?: string;
+    workersSubdomain?: string;
+    /** Non-secret marker also uploaded with the Worker, used to distinguish a
+     * resumable deployment from an unrelated same-name script. */
+    deploymentId?: string;
+}
+export interface CfApiTarget extends CfEdgeTarget {
+    apiToken: string;
+}
+export interface EdgeConfig {
+    /** Base URL of the inbox host (workers.dev URL, or any compatible host). */
+    endpoint: string;
+    /** Owner secret ("drt_…") — independent of the master token so a leaked
+     *  inbox credential can only read/ack ciphertext mail, nothing else. */
+    token: string;
+    /** Third-party inbox hosts need not implement MetaHub Room APIs. */
+    capabilities?: EdgeCapability[];
+    /** Present when the host is a CF worker managed by `mh edge deploy`. */
+    cf?: CfEdgeTarget;
+    /** EDGE_WORKER_VERSION at last deploy — `mh edge status` alignment check. */
+    deployedVersion?: string;
+}
+export declare function getEdgeConfig(db: DbDriver): EdgeConfig | null;
+export declare function setEdgeConfig(db: DbDriver, cfg: EdgeConfig | null): void;
+export declare function edgeCapabilities(cfg: EdgeConfig): EdgeCapability[];
+export type EdgeDeployStep = "creating_d1" | "creating_subdomain" | "uploading_worker" | "migrating_d1" | "setting_secret" | "enabling_subdomain";
+export interface EdgeDeployProgress {
+    accountId: string;
+    workerName: string;
+    d1Name: string;
+    d1Id?: string;
+    workersSubdomain?: string;
+    deploymentId: string;
+    startedAt: number;
+    step: EdgeDeployStep;
+    updatedAt: number;
+}
+export declare function getEdgeDeployProgress(db: DbDriver): EdgeDeployProgress | null;
+export declare function setEdgeDeployProgress(db: DbDriver, progress: EdgeDeployProgress | null): void;
+/** In-flight R2 bucket provisioning (edge-service provisionR2Bucket). Persisted
+ *  BEFORE the remote create so a crash mid-flight can prove on re-run that the
+ *  half-created bucket is OURS to adopt (the R2 API has no ownership marker). */
+export interface R2ProvisionProgress {
+    accountId: string;
+    bucketName: string;
+    startedAt: number;
+}
+export declare function getR2ProvisionProgress(db: DbDriver): R2ProvisionProgress | null;
+export declare function setR2ProvisionProgress(db: DbDriver, progress: R2ProvisionProgress | null): void;
+/**
+ * Per-site anti-abuse knobs, set on `mh site grant … --turnstile/--password`.
+ * They gate BOTH guest-write transports of the same grant: the write-inbox
+ * (enforced at the edge worker) and the server's realtime granted endpoint.
+ * The password itself is never stored — only a PBKDF2 salt (published in
+ * mh-drop.json so the page can derive the verifier) and the verifier (sent to
+ * the edge registration for constant-time comparison).
+ */
+export interface DropKnobs {
+    turnstileSitekey?: string;
+    /** Turnstile SECRET key — needed by the edge for siteverify; never published. */
+    turnstileSecret?: string;
+    passwordSalt?: string;
+    passwordVerifier?: string;
+}
+export declare function getDropKnobs(db: DbDriver, siteId: string): DropKnobs | null;
+export declare function setDropKnobs(db: DbDriver, siteId: string, knobs: DropKnobs | null): void;
+//# sourceMappingURL=edge-config.d.ts.map

package/dist/core/sync/edge-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-config.d.ts","sourceRoot":"","sources":["../../../src/core/sync/edge-config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9C;+EAC+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;kEAC8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;4EACwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,wEAAwE;IACxE,EAAE,CAAC,EAAE,YAAY,CAAC;IAClB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAuBD,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,GAAG,UAAU,GAAG,IAAI,CA2B7D;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAOxE;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,EAAE,CAElE;AAED,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,oBAAoB,GACpB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,kBAAkB,GAAG,IAAI,CAwB7E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE7F;AAED;;iFAEiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,GAAG,mBAAmB,GAAG,IAAI,CAU/E;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE/F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAQ3E;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI,CAGxF"}

package/dist/core/sync/edge-connect.d.ts

@@ -0,0 +1,13 @@
+import { type EdgeCapability } from "./edge-config.ts";
+export type EdgeConnectionMode = "edge" | "inbox";
+export interface VerifiedEdgeConnection {
+    endpoint: string;
+    token: string;
+    version: string | undefined;
+    capabilities: EdgeCapability[];
+}
+/** Portable connection validation shared by Bun server/CLI and the OPFS
+ * browser worker. `edge` means our versioned Worker with Rooms; `inbox` keeps
+ * the historical third-party protocol-host contract. */
+export declare function verifyEdgeConnection(endpointInput: string, tokenInput: string, mode: EdgeConnectionMode): Promise<VerifiedEdgeConnection>;
+//# sourceMappingURL=edge-connect.d.ts.map

package/dist/core/sync/edge-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-connect.d.ts","sourceRoot":"","sources":["../../../src/core/sync/edge-connect.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGrF,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,YAAY,EAAE,cAAc,EAAE,CAAC;CAChC;AAED;;wDAEwD;AACxD,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,sBAAsB,CAAC,CA8BjC"}

package/dist/core/sync/edge-service.d.ts

@@ -0,0 +1,100 @@
+import type { DbDriver } from "../driver.ts";
+import { getEdgeDeployProgress } from "./edge-config.ts";
+export interface EdgeDeployInput {
+    accountId: string;
+    apiToken: string;
+    workerName?: string;
+    d1Name?: string;
+    workersSubdomain?: string;
+    /** Required acknowledgment for the account-scoped remote mutations. */
+    confirmed: boolean;
+}
+export interface EdgeDeployResult {
+    status: "deployed";
+    endpoint: string;
+    workerName: string;
+    d1Id: string;
+    d1Name: string;
+    version: string;
+    keyId: string;
+    wired: {
+        site: string;
+        registered: boolean;
+        error?: string;
+    }[];
+    warnings: string[];
+}
+export declare function defaultEdgeNames(db: DbDriver): {
+    workerName: string;
+    d1Name: string;
+    workersSubdomain: string;
+    r2BucketName: string;
+};
+export interface R2ProvisionInput {
+    accountId: string;
+    apiToken: string;
+    bucketName?: string;
+    /** Required acknowledgment for the account-scoped remote creation. */
+    confirmed: boolean;
+}
+export interface R2ProvisionResult {
+    status: "created" | "adopted";
+    bucketName: string;
+    /** S3 endpoint to attach with (path-style, region "auto"). */
+    endpoint: string;
+    /** Dashboard page where the user mints the S3 credentials. */
+    credentialsUrl: string;
+}
+export declare function defaultR2BucketName(db: DbDriver): string;
+export declare function provisionR2Bucket(db: DbDriver, input: R2ProvisionInput): Promise<R2ProvisionResult>;
+/** Create/upgrade a dedicated Worker+D1. Progress is persisted before every
+ * remote effect, while the API token exists only in this stack frame. */
+export declare function deployEdge(db: DbDriver, input: EdgeDeployInput, workerScript: string): Promise<EdgeDeployResult>;
+export interface EdgeConnectResult extends EdgeStatus {
+    status: "connected";
+    wired: {
+        site: string;
+        registered: boolean;
+        error?: string;
+    }[];
+    warnings: string[];
+}
+export declare function connectEdge(db: DbDriver, endpointInput: string, token: string): Promise<EdgeConnectResult>;
+/** CLI-only compatibility path for any host implementing the inbox protocol.
+ * It deliberately does not claim Room capability or require our Worker version. */
+export declare function connectInboxHost(db: DbDriver, endpointInput: string, token: string): Promise<EdgeConnectResult>;
+export interface EdgeRoomStatus {
+    slug: string;
+    url: string;
+    status: string | null;
+    lastSuccessAt: number | null;
+    error: string | null;
+}
+export interface EdgeStatus {
+    configured: boolean;
+    endpoint?: string;
+    version?: string | null;
+    expectedVersion: string;
+    aligned: boolean;
+    reachable: boolean;
+    error?: string;
+    managed: boolean;
+    deployment?: {
+        accountId: string;
+        workerName: string;
+        d1Name: string;
+        workersSubdomain: string;
+    };
+    rooms: EdgeRoomStatus[];
+    defaults: ReturnType<typeof defaultEdgeNames>;
+    pending: ReturnType<typeof getEdgeDeployProgress>;
+    capabilities?: ("inbox" | "room")[];
+    wired?: {
+        site: string;
+        registered: boolean;
+        error?: string;
+    }[];
+}
+export declare function edgeStatus(db: DbDriver): Promise<EdgeStatus>;
+export declare function disconnectEdge(db: DbDriver): void;
+//# sourceMappingURL=edge-service.d.ts.map

package/dist/core/sync/edge-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-service.d.ts","sourceRoot":"","sources":["../../../src/core/sync/edge-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAEL,qBAAqB,EAQtB,MAAM,kBAAkB,CAAC;AAyB1B,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB,CAQA;AAgBD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAExD;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CA8B5B;AAED;yEACyE;AACzE,wBAAsB,UAAU,CAC9B,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA8J3B;AAUD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED;mFACmF;AACnF,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,EACZ,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAoBD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,QAAQ,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;IAC9C,OAAO,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;IAClD,YAAY,CAAC,EAAE,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjE;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAuElE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAMjD"}