@tensorix/metahub 0.3.2 → 0.4.0

package/dist/core/sync/room-protocol.d.ts

@@ -0,0 +1,130 @@
+import type { DbDriver } from "../driver.ts";
+import { type Change } from "../crdt.ts";
+import type { RecordRow } from "../records.ts";
+import { type RowKey } from "./partition.ts";
+export declare const ROOM_PROTOCOL_VERSION = 1;
+export type ShareState = "active" | "expired";
+/** Owner → room, one sync round. `changes` is the partition increment plus
+ *  full-row winner baselines for rows that just entered (overlap is fine —
+ *  the room oplog's UNIQUE dedups). `since` is the room-side seq cursor for
+ *  the guest-op pull AND the ack that lets the room GC deferred guest oplog
+ *  rows of evicted rows. `members`, when present, is the authoritative member
+ *  key set (digest-mismatch reconciliation): the room locally deletes every
+ *  partition row not listed. */
+export interface OwnerSyncRequest {
+    protocol: number;
+    mh_version?: string;
+    node_id: string;
+    since: number;
+    changes: Change[];
+    evict: RowKey[];
+    members?: RowKey[];
+    digest?: string;
+}
+/** Room → owner. `changes` are guest-authored ops after `since` (never any
+ *  other author), paged — `more` says the page was truncated and the owner
+ *  should sync again promptly. `need_baseline` lists rows the room holds
+ *  incompletely (orphaned by a shadow split) for the owner to re-judge.
+ *  `need_blobs` lists site-file blob hashes the room lacks (chunked upload
+ *  channel, /owner/blob). */
+export interface OwnerSyncResponse {
+    protocol: number;
+    node_id: string;
+    changes: Change[];
+    cursor: number;
+    /** The guest pull was truncated at the page limit — more rows are queued. */
+    more?: boolean;
+    need_baseline: RowKey[];
+    need_blobs: string[];
+    digest?: string;
+    share_state: ShareState;
+}
+export interface RoomConfig {
+    slug: string;
+    /** The room's own node identity (meta.node_id) — clock owner, never an author. */
+    roomNode: string;
+    /** The share's base guest node id; per-visitor sub ids are `<base>-<rand6>`. */
+    guestBase: string;
+    /** Serialized GrantSet snapshot (read through parseGrantSet, default-deny). */
+    grants: string;
+    pwHash?: string | null;
+    pwSalt?: string | null;
+    expiresAt?: number | null;
+    state: ShareState;
+}
+export interface RoomProvision {
+    slug: string;
+    guestBase: string;
+    grants: string;
+    pwHash?: string | null;
+    pwSalt?: string | null;
+    expiresAt?: number | null;
+    /** Defaults to `room-<slug>`. */
+    roomNode?: string;
+}
+/** Bring a fresh (or reopened) room database to shape and store its config.
+ *  Idempotent; re-provisioning updates the config but keeps the node identity
+ *  and clock (HLCs already issued must stay monotonic). */
+export declare function initRoomDb(db: DbDriver, prov: RoomProvision): RoomConfig;
+export declare function readRoomConfig(db: DbDriver): RoomConfig;
+/** Flip the share state (revocation propagates as "expired"; the physical
+ *  destroy — DO deleteAll — is the C2 host's job). */
+export declare function setRoomState(db: DbDriver, state: ShareState): void;
+/** Refresh the grants snapshot (owner re-granted; takes effect immediately
+ *  for guest writes — pulls/pushes are unaffected, the owner re-scopes those). */
+export declare function setRoomGrants(db: DbDriver, grants: string): void;
+export declare function roomExpired(cfg: RoomConfig, now?: number): boolean;
+/** Chunk size cap enforced at the upload endpoint (DO row limit is ~2MB). */
+export declare const ROOM_BLOB_CHUNK_LIMIT: number;
+/** Blob hashes referenced by live site_files rows with no complete chunk set. */
+export declare function roomMissingBlobs(db: DbDriver, limit?: number): string[];
+/** Store one uploaded chunk. Chunk 0 resets the hash (a re-upload with a
+ *  different chunking never leaves a stale mixed set behind). */
+export declare function roomPutBlobChunk(db: DbDriver, hash: string, idx: number, total: number, bytes: Uint8Array): void;
+/** Reassemble a blob's bytes, or null while the chunk set is incomplete. */
+export declare function roomBlobBytes(db: DbDriver, hash: string): Uint8Array | null;
+/**
+ * One owner sync round, room side. Order matters:
+ *   1. ingest the owner's changes (idempotent — baseline/increment overlap and
+ *      retried requests dedup on the oplog UNIQUE);
+ *   2. compute the guest-op pull BEFORE any eviction GC, so an evict racing an
+ *      undelivered guest op still delivers it this round;
+ *   3. membership reset (when `members` rides along) then explicit evicts —
+ *      local physical deletion, deferred for unacked guest ops;
+ *   4. sweep deferred evictions now covered by `since`;
+ *   5. orphan detection → need_baseline;
+ *   6. digest, echoed only when the owner attached one (anti-entropy rounds).
+ */
+export declare function handleOwnerSync(roomDb: DbDriver, req: OwnerSyncRequest, cfg?: RoomConfig): OwnerSyncResponse;
+/** A guest write intent (final decision 1: intents, not pre-signed ops — the
+ *  room's clock is the time authority; the write shape mirrors share-serve).
+ *  The wire form the room WS accepts; mapped to the shared GuestIntent in
+ *  handleGuestWrite. `intentId`/`submittedAt` are optional (new SDK sends them
+ *  for retry-idempotency; older clients omit and the server synthesizes). */
+export interface GuestWriteIntent {
+    op: "createRecord" | "updateRecord";
+    /** Database ref (id or granted name) — createRecord. */
+    db?: string;
+    /** Record id — updateRecord (or client-minted id on createRecord). */
+    record?: string;
+    values: Record<string, unknown>;
+    intentId?: string;
+    submittedAt?: number;
+}
+export interface RoomGuestSession {
+    /** Per-visitor guest sub id, minted at unlock (mintRoomGuestSub). */
+    sub: string;
+}
+/** Mint a per-visitor guest sub id (`<base>-<rand6>`) — same shape as
+ *  share-serve's session subs, so per-visitor rollback and the base-prefix
+ *  bulk predicate work identically for room-authored writes. */
+export declare function mintRoomGuestSub(cfg: RoomConfig): string;
+/**
+ * Apply one guest intent inside the room. Access gating (expiry + guest-node
+ * validity) is enforced here; authorization, guardrails and the write itself go
+ * through the shared applyGuestIntent executor (the same one the server share
+ * endpoints and — from Stage 4 — drop replay use). Authority clock: the room's
+ * persisted clock stamps the HLC, with the session's sub id as the author node.
+ */
+export declare function handleGuestWrite(roomDb: DbDriver, cfg: RoomConfig, session: RoomGuestSession, intent: GuestWriteIntent): RecordRow;
+//# sourceMappingURL=room-protocol.d.ts.map

package/dist/core/sync/room-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-protocol.d.ts","sourceRoot":"","sources":["../../../src/core/sync/room-protocol.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAS9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAiD,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE5F,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9C;;;;;;gCAMgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;6BAK6B;AAC7B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,CAAC;CACzB;AA4BD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;2DAE2D;AAC3D,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,GAAG,UAAU,CAuBxE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,UAAU,CAMvD;AAMD;sDACsD;AACtD,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAGlE;AAED;kFACkF;AAClF,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAGhE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,SAAa,GAAG,OAAO,CAEtE;AAUD,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,SAAmB,GAAG,MAAM,EAAE,CAajF;AAED;iEACiE;AACjE,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAChB,IAAI,CAQN;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAe3E;AA8ID;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,QAAQ,EAChB,GAAG,EAAE,gBAAgB,EACrB,GAAG,GAAE,UAAmC,GACvC,iBAAiB,CAsDnB;AAID;;;;6EAI6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,cAAc,GAAG,cAAc,CAAC;IACpC,wDAAwD;IACxD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;gEAEgE;AAChE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,QAAQ,EAChB,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,gBAAgB,GACvB,SAAS,CAeX"}

package/dist/core/sync/room-serve.d.ts

@@ -0,0 +1,38 @@
+import type { DbDriver } from "../driver.ts";
+import { type RoomConfig } from "./room-protocol.ts";
+export interface RoomHostDeps {
+    db: DbDriver;
+    /** The edge owner secret ("drt_…"); empty/undefined denies every owner route. */
+    ownerToken: string | undefined;
+    /** Broadcast a data-changed poke to connected guests (WS fan-out). */
+    poke?: (seq: number) => void;
+    /** Physical destruction — DO: deleteAll + close sockets; tests: drop the db. */
+    destroy: () => void | Promise<void>;
+    /** Schedule (epoch ms) / clear (null) the expiry self-destruct alarm. */
+    setAlarm?: (at: number | null) => void | Promise<void>;
+    /** Cede CPU so a frozen workerd clock can advance (HLC counter headroom —
+     *  DO shell passes scheduler.wait(1)). Optional belt-and-braces: hlc.ts's
+     *  carry-into-millis already keeps overflow correct without it. */
+    yieldClock?: () => Promise<void>;
+}
+/** Session context for a WebSocket upgrade: null = refuse (unprovisioned /
+ *  expired / password-locked without a session). A cookieless connection to an
+ *  unlocked room gets a fresh per-connection sub (P2 WS writes attribute to it). */
+export declare function roomWsSession(db: DbDriver, req: Request): Promise<{
+    cfg: RoomConfig;
+    sub: string;
+} | null>;
+export interface RoomWsOutcome {
+    /** JSON reply for THIS socket, or null (nothing to say). */
+    reply: string | null;
+    /** Broadcast a poke to every connected guest. */
+    poke: boolean;
+    seq: number;
+}
+/** Handle one guest WS message: `{type:"write", intent, id?}` applies a write
+ *  intent through handleGuestWrite (grants + guardrails + room-stamped HLC)
+ *  and answers `{type:"result"|"error", id, …}`. Ping/pong is the host's
+ *  auto-response pair and never reaches here. */
+export declare function roomWsMessage(db: DbDriver, sub: string, raw: string): Promise<RoomWsOutcome>;
+export declare function createRoomFetch(deps: RoomHostDeps): (req: Request) => Promise<Response>;
+//# sourceMappingURL=room-serve.d.ts.map

package/dist/core/sync/room-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/room-serve.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAiB7C,OAAO,EAWL,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAM5B,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAC;IACb,iFAAiF;IACjF,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sEAAsE;IACtE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,gFAAgF;IAChF,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;uEAEmE;IACnE,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAkHD;;oFAEoF;AACpF,wBAAsB,aAAa,CACjC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAMlD;AAID,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;iDAGiD;AACjD,wBAAsB,aAAa,CACjC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,aAAa,CAAC,CA4CxB;AAID,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAyIvF"}

package/dist/core/sync/room-url.d.ts

@@ -0,0 +1,4 @@
+import type { RoomPeerConfig } from "./peers.ts";
+/** Guest-facing Room URL shared by Bun services and the browser worker. */
+export declare function roomUrlOf(config: Pick<RoomPeerConfig, "base" | "slug">): string;
+//# sourceMappingURL=room-url.d.ts.map

package/dist/core/sync/room-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-url.d.ts","sourceRoot":"","sources":["../../../src/core/sync/room-url.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAE/E"}

package/dist/core/sync/routes.d.ts

@@ -4,6 +4,9 @@ import type { Database } from "bun:sqlite";
 export interface RouteCtx {
     db: Database;
     node: string;
+    /** Desktop's unauthenticated loopback sidecar may preview locally but must
+     *  never be accepted as a LAN/public hosting origin. */
+    allowRemoteSiteHosting?: boolean;
 }
 /** Turn a thrown handler error into a JSON response: `{error, code?}` with a
  *  semantic status, so HTTP clients can dispatch on `code` like CLI users
@@ -15,7 +18,7 @@ export declare function errorResponse(e: unknown): Response;
  * in /docs automatically — no generate step, no separate spec file.
  */
 export interface Route {
-    method: "GET" | "POST" | "PATCH" | "DELETE";
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
     path: string;
     summary: string;
     request?: ZodType;

package/dist/core/sync/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAe3C,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAeD;;8BAE8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMlD;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACxE;AAiCD,eAAO,MAAM,MAAM,EAAE,KAAK,EAAmE,CAAC"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgB3C,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;4DACwD;IACxD,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAgBD;;8BAE8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMlD;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACxE;AAsCD,eAAO,MAAM,MAAM,EAAE,KAAK,EAAmE,CAAC"}

package/dist/core/sync/seal.d.ts

@@ -0,0 +1,22 @@
+export declare const SEAL_ENC = "sealed-p256";
+export interface SealKeypair {
+    /** Raw uncompressed public point (65 bytes) — what mh-drop.json publishes. */
+    publicKey: Uint8Array;
+    /** PKCS#8 private key — wrapped with the master key before it leaves the device. */
+    privateKey: Uint8Array;
+}
+/** A fresh P-256 keypair for a drop recipient. Independent generation is a
+ *  design decision, not a shortcut: WebCrypto cannot derive a P-256 keypair
+ *  from a seed, so "derive from the master key" is technically impossible. */
+export declare function generateSealKeypair(): Promise<SealKeypair>;
+/** Seal plaintext to a recipient's raw P-256 public key (anonymous sender). */
+export declare function seal(recipientPkRaw: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
+/**
+ * Open a sealed box with the recipient's PKCS#8 private key (+ its raw public
+ * key, which the keyring stores alongside — needed to rebuild the KDF info).
+ * EVERY failure mode — truncated input, bad ephemeral point, wrong key,
+ * tampered ciphertext — answers with the same MhError("auth"), so a caller
+ * can't distinguish "wrong key" from "corrupted": both mean "not for you".
+ */
+export declare function openSealed(privateKeyPkcs8: Uint8Array, recipientPkRaw: Uint8Array, sealed: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=seal.d.ts.map

package/dist/core/sync/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/core/sync/seal.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,QAAQ,gBAAgB,CAAC;AAyBtC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,SAAS,EAAE,UAAU,CAAC;IACtB,oFAAoF;IACpF,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;8EAE8E;AAC9E,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,WAAW,CAAC,CAMhE;AAqBD,+EAA+E;AAC/E,wBAAsB,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CASjG;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,eAAe,EAAE,UAAU,EAC3B,cAAc,EAAE,UAAU,EAC1B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAerB"}

package/dist/core/sync/server.d.ts

@@ -40,6 +40,12 @@ export interface ServerOptions {
     syncIntervalMs?: number;
     /** Master switch for the auto-sync timer. Falls back to stored config. */
     autoSync?: boolean;
+    /** Disable LAN/public site-base verification for an unauthenticated
+     *  loopback-only shell such as the Desktop sidecar. */
+    allowRemoteSiteHosting?: boolean;
+    /** Desktop's debug sidecar: reject DNS-rebinding hosts and cross-site
+     * mutations even though the token gate is intentionally disabled. */
+    loopbackUiOnly?: boolean;
     /** Browser UI plug-in point. Core ships no UI; callers (CLI, desktop
      *  sidecar) inject the WebUI's asset handler + data API routes here.
      *  Omitted = a headless sync/sites server. */
@@ -60,6 +66,7 @@ export interface UiHandler {
     /** The UI's data API routes, merged into the route registry (and /docs). */
     routes: Route[];
 }
+export declare function loopbackUiRejection(req: Request, port: number): Response | null;
 /** Start the CRDT sync server. It is just another node backed by ~/.metahub. */
 export declare function startServer(opts?: ServerOptions): RunningServer;
 //# sourceMappingURL=server.d.ts.map

package/dist/core/sync/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAmBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CAqPnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAuBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;2DACuD;IACvD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;yEACqE;IACrE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAe/E;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CAsUnE"}

package/dist/core/sync/share-actions.d.ts

@@ -5,6 +5,8 @@ export interface CreateShareRequest {
     ref: string;
     permission?: SharePermission;
     transport?: "server" | "s3";
+    /** Hosting surface for server shares. room provisions an always-on Edge room. */
+    hosting?: "server" | "room";
     password?: string | null;
     /** Server: any duration (ms); null = never. s3: clamped to ≤7d; default 7d. */
     expiresMs?: number | null;
@@ -16,12 +18,18 @@ export interface CreateShareRequest {
     bucketUrl?: string | null;
     /** s3 only: the static viewer base for the link. */
     viewerBase?: string;
+    /** Serialized GrantSet enabling /share/<slug>/api/* (server transport only —
+     *  a presigned static export has no API surface). */
+    grants?: string | null;
+    /** Idempotency key used when a paired node creates the share remotely. */
+    requestId?: string | null;
 }
 export interface CreatedShare {
     slug: string;
     kind: ShareKind;
     permission: SharePermission;
     transport: "server" | "s3";
+    hosting: "server" | "room" | "s3";
     /** Full link to copy (server: served_base/share/slug; s3: viewer link). */
     url: string;
     expiresAt: number | null;
@@ -38,32 +46,73 @@ export interface ShareListItem {
     permission: string;
     transport: "server" | "s3";
     source: string;
-    sourceKind: "server" | "peer" | "bucket";
+    sourceKind: "server" | "peer" | "room" | "bucket";
+    /** Paired node that owns this share; present only in aggregated listings so
+     *  management actions can be routed back to the correct device. */
+    sourceUrl?: string;
+    /** Where the share is actually served from: this/a server, an always-on DO
+     *  room (server share + kind='room' peer), or a bucket export. */
+    hosting?: "server" | "room" | "s3";
     expiresAt: number | null;
     hasPassword: boolean;
     /** server: ready-to-copy link; s3: omitted (use renew to mint a fresh one). */
     url?: string;
+    lifecycle?: "active" | "provisioning" | "cleanup_pending";
+    /** s3 only: when the snapshot content was last exported (≠ link expiry). */
+    contentUpdatedAt?: number;
 }
 /** s3 bucket peers (no secrets) for a transport picker. */
 export declare function listShareBuckets(db: DbDriver): {
     url: string;
     label: string;
 }[];
-/** Paired HTTP peer servers (a share can be created on / served by them). */
+/** Paired HTTP peer servers (a share can be created on / served by them).
+ *  Room peers are deliberately excluded: they are Edge destinations, not
+ *  devices a user can select as a hosting node. */
 export declare function listShareServers(db: DbDriver): {
     url: string;
     label: string;
+    enabled: boolean;
+    lastStatus: string | null;
+    lastSuccessAt: number | null;
 }[];
+/** The legal-combination matrix in ONE place. Every rule names the conflict and
+ *  the way out, so surfaces (CLI flags, WebUI selects, remote peers) fail the
+ *  same way instead of each scattering its own throws. */
+export declare function assertShareCombo(req: {
+    kind: ShareKind;
+    transport: "server" | "s3";
+    hosting: "server" | "room";
+    permission: SharePermission;
+    hasGrants: boolean;
+}): void;
 /** Resolve, validate, and create (server local / server remote / s3 bucket) a share. */
 export declare function createShareAction(db: DbDriver, req: CreateShareRequest): Promise<CreatedShare>;
+/** This node's server-share rows only (sync, no network) — the bucket-free
+ *  subset of listSharesLocal. Site reachability and CLI listings use it so a
+ *  local derivation never waits on an S3 scan. */
+export declare function listServerSharesLocal(db: DbDriver, targetId?: string): ShareListItem[];
 /** Local listing (server rows + each attached bucket) — NO peer fan-out (so the
  *  /api/shares endpoint a peer calls can't recurse). Optional target filter. */
 export declare function listSharesLocal(db: DbDriver, targetId?: string): Promise<ShareListItem[]>;
+export declare function createdShareByRequestId(db: DbDriver, requestId: string): CreatedShare | null;
+export declare function revokeShareByRequestId(db: DbDriver, requestId: string): Promise<RevokeShareResult>;
 /** Aggregated listing for CLI/WebUI: local ∪ each paired peer's /api/shares
  *  (best-effort, bounded), deduped by slug. Optional target filter. */
 export declare function listSharesAggregated(db: DbDriver, targetId?: string): Promise<ShareListItem[]>;
-/** Revoke: local server row → delete it; else a bucket holds it → delete objects. */
-export declare function revokeShareAction(db: DbDriver, slug: string): Promise<boolean>;
-/** Renew an s3 share (re-presign, mint a fresh ≤7d link). */
-export declare function renewShareAction(db: DbDriver, slug: string, viewerBaseOverride?: string): Promise<CreatedShare>;
+/** Revoke: local server row → delete it (cascading the share's room, if one is
+ *  provisioned — final decision 3: the room's lifecycle is the share's); else a
+ *  bucket holds it → delete objects. */
+export interface RevokeShareResult {
+    ok: boolean;
+    status: "revoked" | "cleanup_pending" | "not_found";
+}
+export declare function revokeShareAction(db: DbDriver, slug: string): Promise<RevokeShareResult>;
+/** Renew an s3 share's LINK. Default is re-presign only — the snapshot content
+ *  is untouched, so "renew" means exactly what it says. Pass
+ *  `refreshContent: true` for the explicit "update the snapshot from current
+ *  data AND renew" action (the old implicit behavior). */
+export declare function renewShareAction(db: DbDriver, slug: string, viewerBaseOverride?: string, opts?: {
+    refreshContent?: boolean;
+}): Promise<CreatedShare>;
 //# sourceMappingURL=share-actions.d.ts.map

package/dist/core/sync/share-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share-actions.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-actions.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAQ7C,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AActB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,SAAS,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;6EAEyE;IACzE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAiCD,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/E;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/E;AAiCD,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0FpG;AAED;gFACgF;AAChF,wBAAsB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAsC/F;AAED;uEACuE;AACvE,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAepG;AAYD,qFAAqF;AACrF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWpF;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBrH"}
+{"version":3,"file":"share-actions.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-actions.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAY7C,OAAO,EAQL,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAkCtB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,SAAS,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC5B,iFAAiF;IACjF,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;6EAEyE;IACzE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;yDACqD;IACrD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;IAClD;uEACmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;sEACkE;IAClE,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,QAAQ,GAAG,cAAc,GAAG,iBAAiB,CAAC;IAC1D,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAgED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAI/E;AAED;;mDAEmD;AACnD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,EAAE,CAUF;AAyCD;;0DAE0D;AAC1D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IACpC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,IAAI,CAgBP;AAED,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAqOpG;AAED;;kDAEkD;AAClD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CA4CtF;AAED;gFACgF;AAChF,wBAAsB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAwB/F;AAED,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,GAChB,YAAY,GAAG,IAAI,CA2BrB;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAG5B;AAED;uEACuE;AACvE,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAqBpG;AAeD;;wCAEwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,iBAAiB,GAAG,WAAW,CAAC;CACrD;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0C9F;AAED;;;0DAG0D;AAC1D,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,MAAM,EACZ,kBAAkB,CAAC,EAAE,MAAM,EAC3B,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,OAAO,CAAC,YAAY,CAAC,CAsBvB"}

package/dist/core/sync/share-export.d.ts

@@ -38,6 +38,10 @@ export interface BucketShareMeta {
     key: string;
     /** base64 salt (password shares); the link carries this, viewer derives the key. */
     salt?: string;
+    /** epoch ms the snapshot CONTENT was last (re-)exported. Distinct from
+     *  presign_exp: re-signing the link does not touch this. Older metas lack the
+     *  field — readers fall back to created_at. */
+    content_updated_at?: number;
 }
 export interface BucketShareLink {
     manifestUrl: string;
@@ -64,6 +68,16 @@ export declare function createBucketShare(db: DbDriver, opts: {
  *  stored per-share key, re-upload + re-presign, refresh meta.json. Works for
  *  password shares too (the key is stored master-encrypted). */
 export declare function renewBucketShare(db: DbDriver, config: S3Config, slug: string, expiresSec?: number): Promise<BucketShareLink>;
+/** Rewrite ONLY the presigned blob URLs inside a decrypted manifest — content
+ *  untouched. Pure over the presign callback (unit-testable). */
+export declare function refreshManifestUrls(manifest: ShareManifest, presign: (hash: string) => Promise<string>): Promise<ShareManifest>;
+/** Re-presign an object-storage share WITHOUT touching its content: decrypt
+ *  the stored manifest, refresh the embedded blob URLs, re-encrypt in place.
+ *  No live data is read and no blob bytes are re-uploaded — recipients keep
+ *  seeing the same snapshot (content_updated_at stays put). This is what
+ *  "renew the link" means; re-exporting current data is a separate, explicit
+ *  action (renewBucketShare). */
+export declare function represignBucketShare(config: S3Config, slug: string, expiresSec?: number): Promise<BucketShareLink>;
 /** List all object-storage shares in a bucket (decrypts each meta.json). */
 export declare function listBucketShares(config: S3Config): Promise<BucketShareMeta[]>;
 /** Delete a bucket share's objects. meta.json is deleted FIRST so the share

package/dist/core/sync/share-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share-export.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-export.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAO7C,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW/D,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;4CAC4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAyGD;;uEAEuE;AACvE,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,eAAe,CAAC,CA0C1B;AAED;;gEAEgE;AAChE,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,SAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAanF;AAED;qEACqE;AACrE,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5F"}
+{"version":3,"file":"share-export.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-export.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAU7C,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAWhF,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;4CAC4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;mDAE+C;IAC/C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAsHD;;uEAEuE;AACvE,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,eAAe,CAAC,CA2C1B;AAED;;gEAEgE;AAChE,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,SAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAED;iEACiE;AACjE,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACzC,OAAO,CAAC,aAAa,CAAC,CAMxB;AAED;;;;;iCAKiC;AACjC,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,SAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAiC1B;AAED,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAanF;AAED;qEACqE;AACrE,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5F"}

package/dist/core/sync/share-render.d.ts

@@ -1,7 +1,15 @@
-export declare function escapeHtml(s: string): string;
+import { escapeHtml } from "./html-escape.ts";
+export { escapeHtml };
 export interface RenderOpts {
     /** Rewrite a `/blob/<hash>` URL to a reachable one (scoped endpoint or data URL). */
     rewriteBlob?: (url: string) => string;
+    /** Resolve a `[[doc_x]]` internal reference to its current title. Absent (or
+     *  returning null) the reference renders as its alias/id. Share pages render
+     *  doclinks as inert text either way: auto-linking to the target's own share
+     *  would extend one share's capability with another's. */
+    resolveDocLink?: (id: string) => {
+        title: string;
+    } | null;
 }
 /** Inline Markdown → HTML: a pure function of the shared tokenizer. Gaps are
  *  escaped text; each token maps to one tag shape (the parity test's oracle

package/dist/core/sync/share-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share-render.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-render.ts"],"names":[],"mappings":"AA6BA,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM5C;AAED,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC;AAED;;mCAEmC;AACnC,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAuCvE;AAyBD,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CA+JxE"}
+{"version":3,"file":"share-render.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-render.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC;;;8DAG0D;IAC1D,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC3D;AAED;;mCAEmC;AACnC,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CA8CvE;AAyBD,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CA+JxE"}

package/dist/core/sync/share-serve.d.ts

@@ -1,3 +1,7 @@
 import type { RouteCtx } from "./routes.ts";
-export declare function serveShare(req: Request, ctx: RouteCtx): Promise<Response | null>;
+export interface ServeShareOpts {
+    /** Client IP — rate-limit fallback key for cookieless callers. */
+    ip?: string | null;
+}
+export declare function serveShare(req: Request, ctx: RouteCtx, opts?: ServeShareOpts): Promise<Response | null>;
 //# sourceMappingURL=share-serve.d.ts.map

package/dist/core/sync/share-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-serve.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAmC5C,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkCtF"}
+{"version":3,"file":"share-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/share-serve.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAwC5C,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAmC1B"}

package/dist/core/sync/site-channel-reconcile.d.ts

@@ -0,0 +1,26 @@
+import type { DbDriver } from "../driver.ts";
+/** Prefix marking an observation written because the controller's node-local
+ * share row (the capability secret) is missing. The reconciler clears it once
+ * the row reappears; surfaces show the channel as errored, never as revoked. */
+export declare const CONTROLLER_STATE_MISSING = "controller_state_missing";
+/** Apply synced desired-state changes whose node-local secret is owned here.
+ * Other devices may revoke an Edge link without receiving the account token:
+ * they sync desired_state=revoked; the controller performs teardown when it
+ * next comes online and records a local observation.
+ *
+ * Revocations are emitted on POSITIVE evidence only:
+ * - a replicated site tombstone (older clients delete sites without knowing
+ *   about channels) revokes the orphaned channels;
+ * - an ABSENT site row means "not replicated here yet" and is left untouched;
+ * - a missing node-local share row is an error observation, not a revocation;
+ * - share expiry never revokes or deletes — serving refuses expired links,
+ *   but the share stays manageable (renewable) per the status contract.
+ * The "revoked" observation likewise requires teardown evidence: an absent
+ * Room record is cleanup_pending, never a fabricated destroy confirmation. */
+/** Reconcile without ever throwing: channel maintenance is LOCAL housekeeping
+ * and must not turn an otherwise-successful data sync (or an already-committed
+ * delete) into a reported failure. Returns the error message for callers that
+ * surface warnings, null on success. */
+export declare function reconcileSiteChannelsQuietly(db: DbDriver): Promise<string | null>;
+export declare function reconcileSiteChannels(db: DbDriver): Promise<void>;
+//# sourceMappingURL=site-channel-reconcile.d.ts.map

package/dist/core/sync/site-channel-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-channel-reconcile.d.ts","sourceRoot":"","sources":["../../../src/core/sync/site-channel-reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAa7C;;gFAEgF;AAChF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;8EAa8E;AAC9E;;;wCAGwC;AACxC,wBAAsB,4BAA4B,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASvF;AAED,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA2FvE"}

package/dist/core/sync/site-publish-recovery.d.ts

@@ -0,0 +1,32 @@
+import type { DbDriver } from "../driver.ts";
+export interface SitePublishState {
+    siteId: string;
+    targetBase: string;
+    url: string;
+    status: "ready" | "syncing";
+    updatedAt: number;
+}
+/** Node-local safety record: a private rollback has been emitted locally but
+ * the target peer has not yet acknowledged a cursor that includes it. */
+export interface PendingSiteRollback {
+    siteId: string;
+    peerUrl: string;
+    targetUrl: string;
+    requiredSeq: number;
+    createdAt: number;
+    lastError: string;
+}
+export declare function listPendingSiteRollbacks(db: DbDriver): PendingSiteRollback[];
+export declare function getPendingSiteRollback(db: DbDriver, siteId: string, peerUrl: string): PendingSiteRollback | null;
+export declare function putPendingSiteRollback(db: DbDriver, pending: PendingSiteRollback): PendingSiteRollback;
+export declare function updatePendingSiteRollbackError(db: DbDriver, siteId: string, peerUrl: string, error: string): PendingSiteRollback | null;
+export declare function removePendingSiteRollback(db: DbDriver, siteId: string, peerUrl: string): boolean;
+/** A successful HTTP-peer sync advances push_cursor to the highest local CRDT
+ * sequence included in the request. That cursor is the durable proof that the
+ * compensating private write reached the target. */
+export declare function clearCoveredSiteRollbacks(db: DbDriver, peerUrl: string): number;
+export declare function latestLocalSeq(db: DbDriver): number;
+export declare function listSitePublishStates(db: DbDriver): SitePublishState[];
+export declare function putSitePublishState(db: DbDriver, state: SitePublishState): SitePublishState;
+export declare function removeSitePublishStates(db: DbDriver, siteId: string): number;
+//# sourceMappingURL=site-publish-recovery.d.ts.map

package/dist/core/sync/site-publish-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-publish-recovery.d.ts","sourceRoot":"","sources":["../../../src/core/sync/site-publish-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;yEACyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAmCD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,QAAQ,GAAG,mBAAmB,EAAE,CAE5E;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,mBAAmB,GAAG,IAAI,CAE5B;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,mBAAmB,GAC3B,mBAAmB,CAOrB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,mBAAmB,GAAG,IAAI,CAO5B;AAED,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAMT;AAED;;oDAEoD;AACpD,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAW/E;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAKnD;AAkCD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,gBAAgB,EAAE,CAEtE;AAED,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,gBAAgB,GACtB,gBAAgB,CAOlB;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E"}

package/dist/core/sync/site-reachability.d.ts

@@ -0,0 +1,13 @@
+import type { DbDriver } from "../driver.ts";
+import { type SiteChannel, type SiteState } from "../site-channels.ts";
+import { type SitePublicAccessState } from "../site-channel-store.ts";
+export interface SiteReachability {
+    siteId: string;
+    visibility: "public" | "private";
+    state: SiteState;
+    channels: SiteChannel[];
+    /** Unified public-access decision (serve/config/anomaly) for this node. */
+    publicAccess: SitePublicAccessState;
+}
+export declare function siteReachability(db: DbDriver, siteId: string): SiteReachability;
+//# sourceMappingURL=site-reachability.d.ts.map

package/dist/core/sync/site-reachability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-reachability.d.ts","sourceRoot":"","sources":["../../../src/core/sync/site-reachability.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IACjC,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,2EAA2E;IAC3E,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAkB/E"}

package/dist/core/sync/sites-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAqDvE,eAAO,MAAM,WAAW,EAAE,KAAK,EAwE9B,CAAC"}
+{"version":3,"file":"sites-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAoHvE,eAAO,MAAM,WAAW,EAAE,KAAK,EAmH9B,CAAC"}

package/dist/core/sync/sites-serve.d.ts

@@ -1,3 +1,26 @@
+import type { DbDriver } from "../driver.ts";
 import type { RouteCtx } from "./routes.ts";
-export declare function serveSite(req: Request, ctx: RouteCtx): Promise<Response | null>;
+import { type AuthConfig } from "./auth.ts";
+/** Host wiring serveSite can't do itself: the request's client IP (rate-limit
+ *  key material) and an in-process forwarder into the main /api route table
+ *  (token-holders under /sites/<name>/api/* get the FULL API). */
+export interface ServeSiteOpts {
+    ip?: string | null;
+    forwardApi?: (req: Request) => Promise<Response>;
+}
+export declare function serveSite(req: Request, ctx: RouteCtx, auth: AuthConfig, opts?: ServeSiteOpts): Promise<Response | null>;
+/**
+ * Serve one file of a resolved site: ETag/304 negotiation → decode → response
+ * with content-type + cache headers. Shared by /sites/<name>/ (above) and the
+ * token-exempt /share/<slug>/ site path (share-serve.ts) so both surfaces agree
+ * on caching and 404 behavior. This function never injects the runtime — the
+ * /sites/ caller adds it (withShim) only on the authenticated private branch.
+ * `isPublic` selects the Cache-Control scope: only a visibility:public site may
+ * pass true (share responses stay `private` always — the slug IS the
+ * capability and must never enter a shared cache).
+ */
+export declare function serveSiteFile(req: Request, db: DbDriver, siteId: string, path: string, opts?: {
+    spa?: boolean;
+    isPublic?: boolean;
+}): Promise<Response>;
 //# sourceMappingURL=sites-serve.d.ts.map

package/dist/core/sync/sites-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAQ5C,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBrF"}
+{"version":3,"file":"sites-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAmB5C,OAAO,EACL,KAAK,UAAU,EAShB,MAAM,WAAW,CAAC;AAwBnB;;kEAEkE;AAClE,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClD;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0G1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,OAAO,CAAC,QAAQ,CAAC,CA8BnB"}