@tensorix/metahub 0.5.1 → 0.5.3

package/dist/edge-worker.js

@@ -69,14 +69,38 @@ function normalizeRow(row) {
 // src/core/errors.ts
 class MhError extends Error {
   code;
-  constructor(code, message) {
+  i18n;
+  constructor(code, message, i18n) {
     super(message);
     this.code = code;
+    this.i18n = i18n;
     this.name = "MhError";
   }
 }
+function interpolateMsg(s, params) {
+  return params ? s.replace(/\{(\w+)\}/g, (m, k) => (k in params) ? String(params[k]) : m) : s;
+}
+function mhError(code, key, params) {
+  return new MhError(code, interpolateMsg(key, params), { key, params });
+}
+var SQLITE_BUSY_RE = /^SQLITE_(BUSY|LOCKED)/;
+function isSqliteBusy(e) {
+  if (!(e instanceof Error))
+    return false;
+  const code = e.code;
+  if (typeof code === "string" && SQLITE_BUSY_RE.test(code))
+    return true;
+  return e.message === "database is locked";
+}
+function asMhError(e) {
+  if (e instanceof MhError)
+    return e;
+  if (isSqliteBusy(e))
+    return mhError("busy", "数据库正被另一个进程写入，请稍后重试");
+  return null;
+}
 function errorCode(e) {
-  return e instanceof MhError ? e.code : undefined;
+  return asMhError(e)?.code;
 }
 
 // src/core/sync/http-status.ts
@@ -87,7 +111,9 @@ var STATUS = {
   stale: 409,
   conflict: 409,
   auth: 401,
-  rate_limited: 429
+  rate_limited: 429,
+  busy: 503,
+  clock_skew: 409
 };
 function httpStatusForCode(code) {
   return code ? STATUS[code] ?? 400 : 400;
@@ -132,6 +158,12 @@ function idKind(id) {
   return KINDS.has(prefix) ? prefix : null;
 }
 
+// src/core/driver.ts
+function writeTx(db, fn) {
+  const tx = db.transaction(fn);
+  return (tx.immediate ?? tx)();
+}
+
 // src/core/node.ts
 function getNodeId(db) {
   const row = db.query("SELECT value FROM meta WHERE key = 'node_id'").get();
@@ -144,6 +176,13 @@ function getNodeId(db) {
 
 // src/core/hlc.ts
 var MAX_HLC_COUNTER = 65535;
+var HLC_MAX_SKEW_MS = 5 * 60000;
+function hlcSkewBound(now) {
+  return formatHlc({ millis: now + HLC_MAX_SKEW_MS, counter: MAX_HLC_COUNTER, node: "~~~~~~~~" });
+}
+function isSkewedHlc(hlc, now) {
+  return hlc > hlcSkewBound(now);
+}
 function carryCounter(millis, counter) {
   if (counter <= MAX_HLC_COUNTER)
     return { millis, counter };
@@ -174,6 +213,8 @@ function writeLast(db, h) {
 }
 function nextHlc(db, node, now = Date.now()) {
   const last = readLast(db, node);
+  if (last.millis > now + HLC_MAX_SKEW_MS)
+    throw mhError("clock_skew", "本机逻辑时钟比系统时间超前 {min} 分钟（系统时钟曾被调错，或收到过时钟错误设备的数据），运行 mh repair --clock 修复", { min: Math.ceil((last.millis - now) / 60000) });
   const millis = Math.max(last.millis, now);
   const counter = millis === last.millis ? last.counter + 1 : 0;
   const h = { ...carryCounter(millis, counter), node };
@@ -185,6 +226,8 @@ function observeHlc(db, node, remote, now = Date.now()) {
   const r = parseHlc(remote);
   if (!Number.isFinite(r.millis) || !Number.isFinite(r.counter))
     return;
+  if (r.millis > now + HLC_MAX_SKEW_MS)
+    return;
   const millis = Math.max(last.millis, r.millis, now);
   let counter;
   if (millis === last.millis && millis === r.millis)
@@ -299,6 +342,39 @@ function lcs(a, b) {
   return pairs;
 }
 
+// src/core/history-cache.ts
+var caches = new WeakMap;
+function dropDoc(c, docId) {
+  const e = c.docs.get(docId);
+  if (!e)
+    return;
+  c.docs.delete(docId);
+  for (const b of e.blockIds)
+    if (c.blockToDoc.get(b) === docId)
+      c.blockToDoc.delete(b);
+}
+function noteChange(db, dataset, rowId, col, value) {
+  const c = caches.get(db);
+  if (!c)
+    return;
+  if (dataset === "documents") {
+    dropDoc(c, rowId);
+    return;
+  }
+  if (dataset !== "doc_blocks")
+    return;
+  const owner = c.blockToDoc.get(rowId);
+  if (owner)
+    dropDoc(c, owner);
+  if (col === "doc_id" && value) {
+    try {
+      const target = JSON.parse(value);
+      if (typeof target === "string")
+        dropDoc(c, target);
+    } catch {}
+  }
+}
+
 // src/core/intent-retention.ts
 var DAY_MS = 24 * 60 * 60 * 1000;
 var DROP_ENVELOPE_RETENTION_MS = 30 * DAY_MS;
@@ -338,27 +414,27 @@ function withNodeId(node, fn) {
     currentNodeOverride = prev;
   }
 }
-function withChangeGroup(label, fn) {
+function withChangeGroup(db, label, fn) {
   if (currentTxn !== null)
     return fn();
   currentTxn = (currentActor ? currentActor + "/" : "") + (label ? label + ":" : "") + randomSuffix(8);
   try {
-    return fn();
+    return writeTx(db, fn);
   } finally {
     currentTxn = null;
   }
 }
-function withTxnId(txn, fn) {
+function withTxnId(db, txn, fn) {
   const prev = currentTxn;
   currentTxn = txn;
   try {
-    return fn();
+    return writeTx(db, fn);
   } finally {
     currentTxn = prev;
   }
 }
 function grouped(fn, label = null) {
-  return (...args) => withChangeGroup(label, () => fn(...args));
+  return (db, ...args) => withChangeGroup(db, label, () => fn(db, ...args));
 }
 var DOMAIN = {
   databases: {
@@ -411,6 +487,10 @@ var DOMAIN = {
   blob_policy: {
     table: "blob_policy",
     cols: new Set(["full_nodes", "redundancy", "__deleted"])
+  },
+  nodes: {
+    table: "nodes",
+    cols: new Set(["label", "platform", "form", "app", "first_seen", "__deleted"])
   }
 };
 var RECORD_META = new Set(["database_id", "created_hlc", "order_key", "__deleted"]);
@@ -428,7 +508,8 @@ var NOT_NULL_ZERO_COLS = new Set([
   "sites:spa",
   "site_channels:__deleted",
   "site_files:__deleted",
-  "blob_policy:__deleted"
+  "blob_policy:__deleted",
+  "nodes:__deleted"
 ]);
 function decodeMaterializeValue(dataset, col, valueJson) {
   if (valueJson !== null)
@@ -475,6 +556,16 @@ function materialize(db, dataset, rowId, col, valueJson) {
     }
     return;
   }
+  if (dataset === "databases" && col.startsWith("meta.")) {
+    ensureRow(db, "databases", rowId);
+    const key = col.slice(5);
+    if (valueJson === null) {
+      db.query(`UPDATE databases SET meta = json_remove(coalesce(meta, '{}'), '$."' || ? || '"') WHERE id = ?`).run(key, rowId);
+    } else {
+      db.query(`UPDATE databases SET meta = json_set(coalesce(meta, '{}'), '$."' || ? || '"', json(?)) WHERE id = ?`).run(key, valueJson, rowId);
+    }
+    return;
+  }
   const d = DOMAIN[dataset];
   if (!d || !d.cols.has(col))
     return;
@@ -492,6 +583,8 @@ function materialize(db, dataset, rowId, col, valueJson) {
 function applyChange(db, c) {
   const inserted = db.query("INSERT OR IGNORE INTO crdt_changes (hlc, node_id, dataset, row_id, col, value, txn) VALUES (?, ?, ?, ?, ?, ?, ?)").run(c.hlc, c.node_id, c.dataset, c.row_id, c.col, c.value, c.txn ?? null).changes > 0;
   const cur = db.query("SELECT MAX(hlc) AS h FROM crdt_changes WHERE dataset = ? AND row_id = ? AND col = ?").get(c.dataset, c.row_id, c.col);
+  if (inserted)
+    noteChange(db, c.dataset, c.row_id, c.col, c.value);
   if (cur.h !== c.hlc)
     return { inserted, winner: false };
   try {
@@ -505,30 +598,41 @@ function applyChange(db, c) {
   return { inserted, winner: true };
 }
 function emit(db, dataset, rowId, col, value) {
-  const node = currentNodeOverride ?? getNodeId(db);
-  const change = {
-    hlc: nextHlc(db, node),
-    node_id: node,
-    dataset,
-    row_id: rowId,
-    col,
-    value: value === undefined ? null : JSON.stringify(value),
-    txn: currentTxn
+  const mint = () => {
+    const node = currentNodeOverride ?? getNodeId(db);
+    const change = {
+      hlc: nextHlc(db, node),
+      node_id: node,
+      dataset,
+      row_id: rowId,
+      col,
+      value: value === undefined ? null : JSON.stringify(value),
+      txn: currentTxn
+    };
+    applyChange(db, change);
+    return change;
   };
-  applyChange(db, change);
-  return change;
+  return currentTxn !== null ? mint() : writeTx(db, mint);
 }
 function ingest(db, changes, opts = {}) {
+  return ingestDetailed(db, changes, opts).received;
+}
+function ingestDetailed(db, changes, opts = {}) {
   const now = opts.now ?? Date.now();
   pruneExpiredIntentReceipts(db, now);
   const node = getNodeId(db);
   let received = 0;
   let poisoned = 0;
-  const tx = db.transaction((cs) => {
-    for (const c of cs) {
+  const skewed = {};
+  const tx = () => {
+    for (const c of changes) {
       if (isExpiredIntentReceipt(c, now))
         continue;
-      observeHlc(db, node, c.hlc);
+      if (isSkewedHlc(c.hlc, now)) {
+        skewed[c.node_id] = (skewed[c.node_id] ?? 0) + 1;
+        continue;
+      }
+      observeHlc(db, node, c.hlc, now);
       try {
         if (applyChange(db, c).inserted)
           received++;
@@ -537,11 +641,13 @@ function ingest(db, changes, opts = {}) {
         console.error(`[ingest] skipped a change that failed to apply (dataset=${c.dataset} col=${c.col} row=${c.row_id}): ${e.message}`);
       }
     }
-  });
-  tx(changes);
+  };
+  writeTx(db, tx);
   if (poisoned)
     console.error(`[ingest] ${poisoned} change(s) skipped this batch (see above)`);
-  return received;
+  for (const [n, k] of Object.entries(skewed))
+    console.error(`[ingest] refused ${k} change(s) from node ${n}: stamped more than 5 min in the future (that device should run mh repair --clock)`);
+  return { received, skewed };
 }
 
 // src/core/indexing.ts
@@ -1199,7 +1305,19 @@ var DATABASE_SELECT = DATABASE_COLS.join(", ");
 function rowOut(r) {
   if (!r)
     return null;
-  return { ...r, meta: r.meta === null ? null : JSON.parse(r.meta) };
+  const meta = r.meta === null ? null : JSON.parse(r.meta);
+  return { ...r, meta: meta && Object.keys(meta).length ? meta : null };
+}
+function emitMetaPatch(db, id, cur, patch) {
+  for (const [k, v] of Object.entries(patch)) {
+    if (k.includes("."))
+      throw new MhError("invalid_input", `meta key must not contain ".": ${k}`);
+    const next = v === undefined ? null : v;
+    const prev = cur && k in cur ? cur[k] : null;
+    if (JSON.stringify(prev ?? null) === JSON.stringify(next ?? null))
+      continue;
+    emit(db, "databases", id, `meta.${k}`, next === null ? undefined : next);
+  }
 }
 var createDatabase = grouped(function createDatabase(db, opts) {
   const id = newId("db", opts.name);
@@ -1219,7 +1337,9 @@ var updateDatabase = grouped(function updateDatabase(db, id, fields) {
   if (fields.meta !== undefined) {
     if (fields.meta !== null && (typeof fields.meta !== "object" || Array.isArray(fields.meta)))
       throw new MhError("invalid_input", "meta must be a JSON object or null");
-    emit(db, "databases", id, "meta", fields.meta);
+    const cur = getDatabase(db, id).meta;
+    const patch = fields.meta ?? Object.fromEntries(Object.keys(cur ?? {}).map((k) => [k, null]));
+    emitMetaPatch(db, id, cur, patch);
   }
   return getDatabase(db, id);
 });
@@ -1233,8 +1353,7 @@ var duplicateDatabase = grouped(function duplicateDatabase(db, id, opts = {}) {
   });
   if (src.meta !== null) {
     const { collapsed: _hidden, ...meta } = src.meta;
-    if (Object.keys(meta).length)
-      emit(db, "databases", dup.id, "meta", meta);
+    emitMetaPatch(db, dup.id, null, meta);
   }
   const propIdMap = new Map;
   const selfRelNew = new Set;
@@ -1558,8 +1677,151 @@ function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
+// src/core/sync/locale.ts
+var LANG_COOKIE = "mh-lang";
+var isLocale = (v) => v === "zh-CN" || v === "en";
+function localeFromTags(tags) {
+  if (!tags || tags.length === 0)
+    return "zh-CN";
+  for (const tag of tags) {
+    if (!tag)
+      continue;
+    if (/^zh\b/i.test(tag))
+      return "zh-CN";
+    if (/^en\b/i.test(tag))
+      return "en";
+  }
+  return "en";
+}
+function localeFromAcceptLanguage(header) {
+  if (!header)
+    return "zh-CN";
+  return localeFromTags(header.split(",").map((s) => s.split(";")[0].trim()));
+}
+function localeFromCookie(header) {
+  if (!header)
+    return null;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0)
+      continue;
+    if (part.slice(0, eq).trim() !== LANG_COOKIE)
+      continue;
+    const v = decodeURIComponent(part.slice(eq + 1).trim());
+    return isLocale(v) ? v : null;
+  }
+  return null;
+}
+function pickLocale(req) {
+  return localeFromCookie(req.headers.get("cookie")) ?? localeFromAcceptLanguage(req.headers.get("accept-language"));
+}
+
+// src/core/sync/page-messages.ts
+var EN = {
+  "本机逻辑时钟比系统时间超前 {min} 分钟（系统时钟曾被调错，或收到过时钟错误设备的数据），运行 mh repair --clock 修复": "This device's logical clock is {min} min ahead of wall time (the system clock was wrong, or data arrived from a device with a wrong clock); run mh repair --clock",
+  "数据库正被另一个进程写入，请稍后重试": "The database is being written by another process; retry shortly",
+  "通过 metahub 分享": "Shared via metahub",
+  "由 metahub 托管": "Hosted by metahub",
+  "（空文档）": "(empty document)",
+  文档: "Document",
+  表格: "Table",
+  编辑: "Edit",
+  编辑文档: "Edit document",
+  保存: "Save",
+  "保存中…": "Saving…",
+  保存失败: "Save failed",
+  "已保存 ✓": "Saved ✓",
+  "可编辑文本/数字/URL/日期单元格，失焦自动保存": "Text, number, URL and date cells are editable; changes save on blur",
+  "编辑站点文件（文本文件可在线编辑；保存即对所有访问者生效）。": "Edit site files (text files can be edited here; saving applies to every visitor).",
+  "（暂无文件）": "(no files yet)",
+  "预览 ↗": "Preview ↗",
+  "（二进制文件，不可在线编辑）": "(binary file, cannot be edited here)",
+  "{name} · 文件": "{name} · Files",
+  "\uD83D\uDD12 此分享受口令保护": "\uD83D\uDD12 This share is protected by a passcode",
+  "口令错误，请重试。": "Wrong passcode, try again.",
+  口令: "Passcode",
+  解锁: "Unlock",
+  受保护的分享: "Protected share",
+  复制全文: "Copy all",
+  已复制: "Copied",
+  复制失败: "Copy failed",
+  站点尚未同步: "Site not synced yet",
+  "分享方设备上线同步后即可访问。": "Available once the sharing device comes online and syncs.",
+  页面不存在: "Page not found",
+  "这个站点里没有这个页面或文件。": "This site has no such page or file.",
+  资源暂不可用: "Resource temporarily unavailable",
+  "文件内容尚未同步到房间，请稍后重试。": "The file content has not synced to the room yet. Try again later.",
+  "文件的内容暂时无法取得，请稍后重试。": "The file content cannot be retrieved right now. Try again later.",
+  站点不存在: "Site not found",
+  "没有名为 “{name}” 的站点。": "There is no site named “{name}”.",
+  返回站点首页: "Back to site home",
+  "验证访问令牌 · metahub": "Verify access token · metahub",
+  输入访问令牌: "Enter the access token",
+  "此服务器已开启访问保护。在已登录设备的「设置 → 设备与授权」获取登录链接或二维码,或在服务器上运行 {cmd}。": "This server requires an access token. Get a login link or QR code from Settings → Devices on a signed-in device, or run {cmd} on the server.",
+  粘贴访问令牌或登录链接: "Paste the access token or login link",
+  显示令牌: "Show token",
+  隐藏令牌: "Hide token",
+  解锁并进入: "Unlock and enter",
+  "请输入访问令牌。": "Enter the access token.",
+  "验证中…": "Verifying…",
+  "令牌无效,请检查后重试。": "Invalid token. Check it and try again.",
+  "登录已过期,请重新输入令牌。": "Session expired. Enter the token again.",
+  附件已失效: "Attachment unavailable",
+  链接缺少分享数据: "The link is missing share data",
+  请输入分享口令: "Enter the share passcode",
+  链接缺少密钥: "The link is missing its key",
+  口令错误或链接已失效: "Wrong passcode or the link has expired",
+  链接已失效或密钥不正确: "The link has expired or the key is wrong",
+  分享: "Share",
+  正在加载: "Loading",
+  "✅ 已授权": "✅ Authorized",
+  "可以关闭此标签页，回到 MetaHub 继续部署。": "You can close this tab and return to MetaHub to continue deploying.",
+  站点入口健康响应过大: "Site entry health response is too large",
+  站点入口不能指向云平台元数据服务: "Site entry must not point at a cloud metadata service",
+  "Desktop sidecar 仅用于本机预览；请启动带鉴权的 mh --server，或使用 Edge": "The desktop sidecar is for local preview only; start an authenticated mh --server, or use Edge",
+  "站点入口健康检查失败（HTTP {status}）": "Site entry health check failed (HTTP {status})",
+  站点入口健康响应无效: "Site entry health response is invalid",
+  "站点入口节点不匹配（期望 {expected}，实际 {actual}）；这是防误配检查，不是身份认证": "Site entry node mismatch (expected {expected}, got {actual}); this is a misconfiguration guard, not authentication",
+  "目标设备版本不支持定向发布渠道；请先升级该设备，再重新验证入口": "The target device does not support targeted publishing channels; upgrade it, then verify the entry again",
+  "无法验证站点入口：连接超时": "Could not verify the site entry: connection timed out",
+  "无法验证站点入口：{msg}": "Could not verify the site entry: {msg}",
+  "请先在“设置 → 站点托管”配置并验证当前设备的公网或局域网入口": "Configure and verify this device's public or LAN entry under Settings → Site hosting first",
+  "配对设备缺少节点身份，重新配对后再试": "The paired device has no node identity; pair again and retry",
+  "该站点仍在等待目标设备确认回滚，请先重试回滚": "This site is still waiting for the target device to confirm the rollback; retry the rollback first",
+  配对设备同步失败: "Sync with the paired device failed",
+  没有待确认的站点回滚: "No site rollback is awaiting confirmation",
+  "目标配对设备不存在，请重新配对后重试": "The target paired device does not exist; pair again and retry",
+  站点渠道已不存在: "The site channel no longer exists",
+  "OAuth 流程不存在或已过期，请重新登录": "The OAuth flow does not exist or has expired; sign in again",
+  "OAuth 流程不存在或已过期，请重试": "The OAuth flow does not exist or has expired; try again",
+  "Cloudflare 授权失败": "Cloudflare authorization failed",
+  "Cloudflare 授权尚未完成，请稍候": "Cloudflare authorization is not finished yet; please wait",
+  "缺少 Cloudflare 账号 id": "Missing Cloudflare account id",
+  "缺少 Cloudflare 凭据（请先登录或提供 API Token）": "Missing Cloudflare credentials (sign in first or provide an API token)",
+  "Cloudflare 授权失败：{detail}": "Cloudflare authorization failed: {detail}",
+  "未返回 access token": "no access token returned",
+  "无法连接 Cloudflare 授权服务：{msg}": "Could not reach the Cloudflare authorization service: {msg}",
+  "Cloudflare 令牌交换失败（HTTP {status}）": "Cloudflare token exchange failed (HTTP {status})",
+  "无法读取 Cloudflare 账号列表：{msg}": "Could not read the Cloudflare account list: {msg}",
+  "读取 Cloudflare 账号失败（HTTP {status}）": "Reading Cloudflare accounts failed (HTTP {status})",
+  "未配置 Cloudflare OAuth 客户端，请改用 API Token 部署": "No Cloudflare OAuth client is configured; deploy with an API token instead",
+  "Cloudflare 授权超时，请重试": "Cloudflare authorization timed out; try again",
+  "Cloudflare 授权被拒绝：{detail}": "Cloudflare authorization was denied: {detail}",
+  "OAuth state 不匹配，疑似伪造回调，已中止": "OAuth state mismatch; the callback looks forged, aborted",
+  "Cloudflare 未返回授权码": "Cloudflare did not return an authorization code",
+  "请输入完整的 http(s) 地址": "Enter a complete http(s) address",
+  "站点入口只支持 HTTP 或 HTTPS": "Site entry supports HTTP or HTTPS only",
+  "站点入口不能包含凭据、查询参数或片段": "Site entry must not contain credentials, query parameters or fragments",
+  "站点入口必须是域名根地址，不能包含路径": "Site entry must be a domain root without a path",
+  站点入口必须是可访问的主机地址: "Site entry must be a reachable host address",
+  "公网入口必须使用 HTTPS；HTTP 仅允许本机或局域网地址": "A public entry must use HTTPS; HTTP is only allowed for local or LAN addresses"
+};
+function pm(locale, key, params) {
+  const s = locale === "en" ? EN[key] : key;
+  return params ? s.replace(/\{(\w+)\}/g, (m, k) => (k in params) ? String(params[k]) : m) : s;
+}
+
 // src/core/guest-intent.ts
-var HLC_SKEW_MS = 5 * 60000;
 var INTENT_ID_RE = /^[A-Za-z0-9._-]{1,64}$/;
 var RECEIPT_COL = "result";
 function applyGuestIntent(db, policy, session, intent, opts) {
@@ -1571,7 +1833,7 @@ function applyGuestIntent(db, policy, session, intent, opts) {
     kind: policy.audience,
     guestNode: session.guestNode
   };
-  const tx = db.transaction(() => {
+  return writeTx(db, () => {
     const prepared = prepareIntent(db, policy, principal, intent, opts.clock);
     const txn = intentTxnPrefix(session.guestNode, intent.intentId) + prepared.fingerprint;
     const receipt = readReceipt(db, session.guestNode, intent.intentId, acceptedNow);
@@ -1591,7 +1853,6 @@ function applyGuestIntent(db, policy, session, intent, opts) {
       return applySubmitted(db, policy, principal, intent, prepared, txn, acceptedNow);
     return applyAuthority(db, policy, principal, intent, prepared, txn, acceptedNow);
   });
-  return tx();
 }
 function prepareIntent(db, policy, principal, intent, clock) {
   if (typeof intent.payload !== "object" || intent.payload === null || Array.isArray(intent.payload))
@@ -1629,7 +1890,7 @@ function prepareIntent(db, policy, principal, intent, clock) {
   };
 }
 function applyAuthority(db, policy, principal, intent, prepared, txn, acceptedNow) {
-  return withTxnId(txn, () => withNodeId(principal.guestNode, () => {
+  return withTxnId(db, txn, () => withNodeId(principal.guestNode, () => {
     if (intent.action === "createRecord")
       assertGuestCreateCapacity(db, prepared.database, policy.limits);
     const current = intent.action === "createRecord" ? createRecordPrepared(db, prepared.database, prepared.cells) : updateRecordPrepared(db, intent.recordId, prepared.cells);
@@ -1753,7 +2014,7 @@ function isRecordRow(value) {
 }
 function clampMillis(submittedAt, now) {
   const safeNow = Math.max(0, Math.trunc(Number.isFinite(now) ? now : Date.now()));
-  const ceil = safeNow + HLC_SKEW_MS;
+  const ceil = safeNow + HLC_MAX_SKEW_MS;
   if (!Number.isFinite(submittedAt))
     return safeNow;
   return Math.max(0, Math.min(Math.trunc(submittedAt), ceil));
@@ -2509,6 +2770,22 @@ CREATE TABLE IF NOT EXISTS blob_policy (
   redundancy  TEXT,              -- 'all' | 'any'
   __deleted   INTEGER NOT NULL DEFAULT 0
 );
+
+-- Synced device roster (system tier, see tables.ts): one row per node id, written
+-- by the device itself on open (describeSelf) and by anyone who renames it.
+-- Replicates so every device shows the same name and icon for a peer — the only
+-- record a purely bucket-joined device leaves besides its oplog stream. Each
+-- column is its own LWW register, so a rename and a platform refresh never
+-- clobber each other. meta.node_label survives as a node-local read fallback.
+CREATE TABLE IF NOT EXISTS nodes (
+  id          TEXT PRIMARY KEY,  -- node_id
+  label       TEXT,              -- shared display name; any device may set it
+  platform    TEXT,              -- macos | windows | linux | ios | android | web
+  form        TEXT,              -- laptop | desktop | phone | server | browser
+  app         TEXT,              -- cli | server | desktop | web
+  first_seen  INTEGER,           -- epoch ms of the device's first self-description
+  __deleted   INTEGER NOT NULL DEFAULT 0
+);
 `;
 var FTS_SCHEMA = `
 CREATE VIRTUAL TABLE IF NOT EXISTS search_fts USING fts5(
@@ -2769,25 +3046,6 @@ var editDocument = grouped(function editDocument(db, id, opts) {
     throw new MhError("invalid_input", `anchor not found: no match for --old`);
   if (count > 1 && !opts.replaceAll)
     throw new MhError("ambiguous", `${count} matches for --old; add surrounding context or use --replace-all`);
-  if (!opts.old.includes(`
-
-`)) {
-    const affected = blocks.filter((b) => b.text.includes(opts.old));
-    const next = affected.map((b) => opts.replaceAll ? b.text.replaceAll(opts.old, () => opts.new) : b.text.replace(opts.old, () => opts.new));
-    if (next.every((t) => t.length > 0 && !t.includes(`
-
-`))) {
-      const targets = opts.replaceAll ? affected : affected.slice(0, 1);
-      let wrote = false;
-      targets.forEach((b, i) => {
-        if (next[i] !== b.text) {
-          emit(db, "doc_blocks", b.id, "text", next[i]);
-          wrote = true;
-        }
-      });
-      return { id, changed: wrote, replaced: opts.replaceAll ? count : 1, version: documentVersion(db, id) };
-    }
-  }
   const newBody = opts.replaceAll ? body.replaceAll(opts.old, () => opts.new) : body.replace(opts.old, () => opts.new);
   reconcileBody(db, id, newBody);
   return { id, changed: newBody !== body, replaced: opts.replaceAll ? count : 1, version: documentVersion(db, id) };
@@ -2884,7 +3142,7 @@ function readPolicy(db) {
   return { fullNodes, redundancy };
 }
 var setFullNodes = (db, nodeIds) => {
-  withChangeGroup(null, () => {
+  withChangeGroup(db, null, () => {
     const seen = new Set;
     const list = nodeIds.filter((n) => n && !seen.has(n) && seen.add(n) != null);
     emit(db, "blob_policy", POLICY_ID, "full_nodes", list);
@@ -2938,7 +3196,7 @@ function migrateRecords(db) {
     db.exec("ALTER TABLE records ADD COLUMN order_key TEXT");
   if (!tableExists3(db, "record_values"))
     return;
-  const tx = db.transaction(() => {
+  writeTx(db, () => {
     db.exec(`
       UPDATE records SET data = coalesce((
         SELECT json_group_object(rv.property_id, json(rv.value))
@@ -2949,7 +3207,6 @@ function migrateRecords(db) {
     db.exec("DROP TABLE record_values");
     backfillRecordOrderKeys(db);
   });
-  tx();
   backfillRecordOrderKeys(db);
 }
 function migrateShares(db) {
@@ -3007,7 +3264,7 @@ function migrateOplog(db) {
 function migrateCrdtChangesSeq(db) {
   if (hasColumn(db, "crdt_changes", "seq"))
     return;
-  const tx = db.transaction(() => {
+  writeTx(db, () => {
     db.exec(`
       DROP TABLE IF EXISTS crdt_changes_new;
       CREATE TABLE crdt_changes_new (
@@ -3037,7 +3294,6 @@ function migrateCrdtChangesSeq(db) {
     if (tableExists3(db, "peers"))
       db.exec("UPDATE peers SET push_cursor = 0, pull_cursor = 0");
   });
-  tx();
 }
 function migrateStoragePeerUrls(db) {
   if (!tableExists3(db, "peers"))
@@ -3070,7 +3326,7 @@ function migrateStoragePeerUrls(db) {
   if (renames.length === 0)
     return;
   const map = new Map(renames.map(({ oldUrl, newUrl }) => [oldUrl, newUrl]));
-  const tx = db.transaction(() => {
+  writeTx(db, () => {
     for (const { oldUrl, newUrl } of renames) {
       if (tableExists3(db, "storage_cursors"))
         db.query("UPDATE storage_cursors SET peer_url = ? WHERE peer_url = ?").run(newUrl, oldUrl);
@@ -3082,7 +3338,6 @@ function migrateStoragePeerUrls(db) {
         setFullNodes(db, fullNodes.map((n) => map.get(n) ?? n));
     }
   });
-  tx();
 }
 function migrateDatabases(db) {
   if (hasColumn(db, "databases", "meta"))
@@ -3125,21 +3380,27 @@ function migrateSitesAccess(db) {
     backfill("public_grants", "NULL");
   }
 }
-var SITE_CHANNELS_REPLAY_KEY = "site_channels_replay_seq";
-function migrateSiteChannels(db) {
-  if (!tableExists3(db, "site_channels"))
+function replayDataset(db, dataset) {
+  if (!tableExists3(db, dataset))
     return;
-  const wm = db.query("SELECT value FROM meta WHERE key = ?").get(SITE_CHANNELS_REPLAY_KEY);
+  const key = `${dataset}_replay_seq`;
+  const wm = db.query("SELECT value FROM meta WHERE key = ?").get(key);
   const since = wm ? Number(wm.value) : 0;
   const changes = db.query(`SELECT seq, ${CHANGE_SELECT} FROM crdt_changes
-       WHERE dataset = 'site_channels' AND seq > ? ORDER BY seq`).all(since);
+       WHERE dataset = ? AND seq > ? ORDER BY seq`).all(dataset, since);
   if (changes.length === 0)
     return;
-  db.transaction((rows) => {
-    for (const change of rows)
+  writeTx(db, () => {
+    for (const change of changes)
       applyChange(db, change);
-    db.query("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(SITE_CHANNELS_REPLAY_KEY, String(rows[rows.length - 1].seq));
-  })(changes);
+    db.query("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, String(changes[changes.length - 1].seq));
+  });
+}
+function migrateSiteChannels(db) {
+  replayDataset(db, "site_channels");
+}
+function migrateNodes(db) {
+  replayDataset(db, "nodes");
 }
 function initSchema(db) {
   runSchema(db);
@@ -3155,6 +3416,7 @@ function initSchema(db) {
   migrateShares(db);
   migrateSitesAccess(db);
   migrateSiteChannels(db);
+  migrateNodes(db);
 }
 
 // src/core/sync/partition.ts
@@ -3240,12 +3502,11 @@ function roomMissingBlobs(db, limit = NEED_BLOBS_LIMIT) {
   return rows.map((r) => r.hash);
 }
 function roomPutBlobChunk(db, hash, idx, total, bytes) {
-  const tx = db.transaction(() => {
+  writeTx(db, () => {
     if (idx === 0)
       db.query("DELETE FROM room_blobs WHERE hash = ?").run(hash);
     db.query("INSERT OR REPLACE INTO room_blobs (hash, idx, total, bytes) VALUES (?, ?, ?, ?)").run(hash, idx, total, bytes);
   });
-  tx();
 }
 function roomBlobBytes(db, hash) {
   const rows = db.query("SELECT idx, total, bytes FROM room_blobs WHERE hash = ? ORDER BY idx").all(hash);
@@ -3275,6 +3536,7 @@ function evictRow(db, key, ackSeq, guestBase) {
   if (!table)
     return;
   db.query(`DELETE FROM ${table} WHERE id = ?`).run(key.row_id);
+  noteChange(db, key.dataset, key.row_id, "", null);
   db.query(`DELETE FROM crdt_changes WHERE dataset = ? AND row_id = ?
      AND NOT (${GUEST_NODE_SQL} AND seq > ?)`).run(key.dataset, key.row_id, guestBase, guestBase, ackSeq);
   const remaining = db.query("SELECT 1 FROM crdt_changes WHERE dataset = ? AND row_id = ? LIMIT 1").get(key.dataset, key.row_id) != null;
@@ -3291,6 +3553,7 @@ function sweepEvictPending(db, ackSeq, guestBase) {
       db.query("DELETE FROM evict_pending WHERE dataset = ? AND row_id = ?").run(k.dataset, k.row_id);
       continue;
     }
+    noteChange(db, k.dataset, k.row_id, "", null);
     db.query(`DELETE FROM crdt_changes WHERE dataset = ? AND row_id = ? AND seq <= ? AND (${GUEST_NODE_SQL})`).run(k.dataset, k.row_id, ackSeq, guestBase, guestBase);
     const remaining = db.query("SELECT 1 FROM crdt_changes WHERE dataset = ? AND row_id = ? LIMIT 1").get(k.dataset, k.row_id) != null;
     if (!remaining)
@@ -3624,9 +3887,9 @@ function createRoomFetch(deps) {
     if (req.method !== "GET")
       return plain404();
     if (locked) {
-      return wantsHtml(req) ? new Response(unlockPage(cfg, false), { headers: HTML }) : json({ error: "unauthorized" }, 401);
+      return wantsHtml(req) ? new Response(unlockPage(pickLocale(req), cfg, false), { headers: HTML }) : json({ error: "unauthorized" }, 401);
     }
-    return serveRoomFile(db, cfg, sub);
+    return serveRoomFile(db, cfg, sub, pickLocale(req));
   };
 }
 async function handleUnlock(db, cfg, req, url) {
@@ -3640,20 +3903,20 @@ async function handleUnlock(db, cfg, req, url) {
   }
   const ok = !cfg.pwHash || !cfg.pwSalt ? true : await verifyPasswordVerifier(cfg.pwHash, cfg.pwSalt, pw);
   if (!ok)
-    return new Response(unlockPage(cfg, true), { headers: HTML, status: 401 });
+    return new Response(unlockPage(pickLocale(req), cfg, true), { headers: HTML, status: 401 });
   const minted = await mintRoomSession(db, cfg, url);
   return new Response(null, {
     status: 303,
     headers: { location: `/r/${cfg.slug}/`, "set-cookie": minted.cookie }
   });
 }
-function serveRoomFile(db, cfg, path) {
+function serveRoomFile(db, cfg, path, locale) {
   const site = db.query("SELECT id, spa FROM sites WHERE __deleted = 0 ORDER BY created_hlc LIMIT 1").get();
   if (!site)
-    return roomMessagePage("站点尚未同步", "分享方设备上线同步后即可访问。", 404);
+    return roomMessagePage(locale, pm(locale, "站点尚未同步"), pm(locale, "分享方设备上线同步后即可访问。"), 404);
   const resolved = resolveSiteFileRow(db, site.id, path, { spa: site.spa === 1 });
   if (!resolved)
-    return roomMessagePage("页面不存在", "这个站点里没有这个页面或文件。", 404);
+    return roomMessagePage(locale, pm(locale, "页面不存在"), pm(locale, "这个站点里没有这个页面或文件。"), 404);
   const { row, status } = resolved;
   const headers = {
     "content-type": row.content_type,
@@ -3669,7 +3932,7 @@ function serveRoomFile(db, cfg, path) {
   }
   const bytes = row.content ? roomBlobBytes(db, row.content) : null;
   if (!bytes)
-    return roomMessagePage("资源暂不可用", "文件内容尚未同步到房间，请稍后重试。", 404);
+    return roomMessagePage(locale, pm(locale, "资源暂不可用"), pm(locale, "文件内容尚未同步到房间，请稍后重试。"), 404);
   const body = new Uint8Array(bytes.byteLength);
   body.set(bytes);
   return new Response(body.buffer, { status, headers });
@@ -3688,28 +3951,28 @@ var PAGE_CSS = `
   .muted{color:var(--muted);font-size:14px}
   h1{font-size:20px;margin:0 0 10px;text-align:center}
   footer{margin-top:34px;color:var(--muted);font-size:12px;text-align:center}`;
-function unlockPage(cfg, error) {
-  return `<!doctype html><html lang="zh"><head>
+function unlockPage(locale, cfg, error) {
+  return `<!doctype html><html lang="${locale}"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="robots" content="noindex"><title>受保护的分享</title>
+<meta name="robots" content="noindex"><title>${escapeHtml(pm(locale, "受保护的分享"))}</title>
 <style>${PAGE_CSS}</style></head><body><main>
 <form method="post" action="/r/${escapeHtml(cfg.slug)}/unlock" class="pw">
-  <h1>\uD83D\uDD12 此分享受口令保护</h1>
-  ${error ? '<p class="err">口令错误，请重试。</p>' : ""}
-  <input type="password" name="password" placeholder="口令" autofocus autocomplete="current-password">
-  <button type="submit">解锁</button>
+  <h1>${escapeHtml(pm(locale, "\uD83D\uDD12 此分享受口令保护"))}</h1>
+  ${error ? `<p class="err">${escapeHtml(pm(locale, "口令错误，请重试。"))}</p>` : ""}
+  <input type="password" name="password" placeholder="${escapeHtml(pm(locale, "口令"))}" autofocus autocomplete="current-password">
+  <button type="submit">${escapeHtml(pm(locale, "解锁"))}</button>
 </form>
-<footer>通过 metahub 分享</footer>
+<footer>${escapeHtml(pm(locale, "通过 metahub 分享"))}</footer>
 </main></body></html>`;
 }
-function roomMessagePage(title, detail, status) {
-  const html = `<!doctype html><html lang="zh"><head>
+function roomMessagePage(locale, title, detail, status) {
+  const html = `<!doctype html><html lang="${locale}"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="robots" content="noindex"><title>${escapeHtml(title)}</title>
 <style>${PAGE_CSS}</style></head><body><main>
 <h1>${escapeHtml(title)}</h1>
 <p class="muted" style="text-align:center">${escapeHtml(detail)}</p>
-<footer>由 metahub 托管</footer>
+<footer>${escapeHtml(pm(locale, "由 metahub 托管"))}</footer>
 </main></body></html>`;
   return new Response(html, { status, headers: { ...HTML, "cache-control": "no-store" } });
 }