most-box 0.1.1 → 0.1.2

package/server/src/index.js

@@ -14,11 +14,12 @@ import Corestore from 'corestore'
 import Hyperdrive from 'hyperdrive'
 import b4a from 'b4a'
 import crypto from 'node:crypto'
-import { CID } from 'multiformats/cid'
 import fs from 'node:fs'
 import path from 'node:path'
 
 import { calculateCid, parseMostLink } from './core/cid.js'
+import { normalizeChannelAttachment } from './core/channelAttachment.js'
+import { getCidInfo } from './core/cidTopic.js'
 import {
   sanitizeFilename,
   validateAndSanitizePath,
@@ -34,6 +35,7 @@ import {
   IntegrityError,
   PermissionError,
   ConflictError,
+  StorageCapacityError,
   EngineNotInitializedError,
 } from './utils/errors.js'
 import {
@@ -66,6 +68,30 @@ import {
 
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
 
+function normalizeOwnerAddress(address) {
+  const value = String(address || '').trim()
+  return /^0x[a-fA-F0-9]{40}$/.test(value) ? value.toLowerCase() : ''
+}
+
+function createOfflineSwarm() {
+  return {
+    connections: new Set(),
+    keyPair: {
+      publicKey: crypto.randomBytes(32),
+    },
+    on() {},
+    join() {
+      return {}
+    },
+    leave() {
+      return Promise.resolve()
+    },
+    destroy() {
+      return Promise.resolve()
+    },
+  }
+}
+
 export class MostBoxEngine extends EventEmitter {
   #store = null
   #swarm = null
@@ -78,11 +104,13 @@ export class MostBoxEngine extends EventEmitter {
   #activeDownloads = new Map()
   #drivePromises = new Map()
   #fileDiscoveries = new Map()
+  #fileMonitors = new Map()
   #seedStates = new Map()
   #holdingResumeTask = null
 
   #channels = []
   #channelCores = new Map()
+  #channelLocalCoreKey = new Map()
   #channelDiscoveries = new Map()
   #channelChatDiscoveries = new Map()
   #channelPeers = new Map()
@@ -94,7 +122,9 @@ export class MostBoxEngine extends EventEmitter {
    * @param {object} options - 配置选项
    * @param {string} options.dataPath - 存储 P2P 数据的路径（必填）
    * @param {string} [options.downloadPath] - 默认下载路径（可选，默认为 dataPath/downloads）
-   * @param {number} [options.maxFileSize] - 最大文件大小（字节）（默认：100GB）
+   * @param {number} [options.maxFileSize] - 最大文件大小（字节）（默认：10GB）
+   * @param {number} [options.capacityBytes] - 节点存储容量上限（字节）（默认：100GB）
+   * @param {boolean} [options.disableNetwork] - 测试用：跳过真实 Hyperswarm 网络
    */
   constructor(options) {
     super()
@@ -108,7 +138,9 @@ export class MostBoxEngine extends EventEmitter {
       downloadPath:
         options.downloadPath || path.join(options.dataPath, 'downloads'),
       maxFileSize: options.maxFileSize || MAX_FILE_SIZE,
+      capacityBytes: options.capacityBytes || 100 * 1024 * 1024 * 1024,
       downloadTimeout: options.downloadTimeout || DOWNLOAD_TIMEOUT,
+      disableNetwork: options.disableNetwork === true,
     }
   }
 
@@ -167,14 +199,19 @@ export class MostBoxEngine extends EventEmitter {
     }
 
     console.log(`[MostBox] Initializing Hyperswarm...`)
-    this.#swarm = new Hyperswarm({
-      maxPeers: MAX_PEERS,
-      bootstrap: SWARM_BOOTSTRAP,
-      firewall: () => false,
-      connectionKeepAlive: SWARM_KEEP_ALIVE_INTERVAL,
-      randomPunchInterval: SWARM_RANDOM_PUNCH_INTERVAL,
-      handshakeTimeout: CONNECTION_TIMEOUT,
-    })
+    if (this.#options.disableNetwork) {
+      this.#swarm = createOfflineSwarm()
+      this.#chatSwarm = createOfflineSwarm()
+    } else {
+      this.#swarm = new Hyperswarm({
+        maxPeers: MAX_PEERS,
+        bootstrap: SWARM_BOOTSTRAP,
+        firewall: () => false,
+        connectionKeepAlive: SWARM_KEEP_ALIVE_INTERVAL,
+        randomPunchInterval: SWARM_RANDOM_PUNCH_INTERVAL,
+        handshakeTimeout: CONNECTION_TIMEOUT,
+      })
+    }
 
     this.#swarm.on('error', err => {
       if (
@@ -200,14 +237,16 @@ export class MostBoxEngine extends EventEmitter {
       this.emit('connection', conn)
     })
 
-    this.#chatSwarm = new Hyperswarm({
-      maxPeers: MAX_PEERS,
-      bootstrap: SWARM_BOOTSTRAP,
-      firewall: () => false,
-      connectionKeepAlive: SWARM_KEEP_ALIVE_INTERVAL,
-      randomPunchInterval: SWARM_RANDOM_PUNCH_INTERVAL,
-      handshakeTimeout: CONNECTION_TIMEOUT,
-    })
+    if (!this.#options.disableNetwork) {
+      this.#chatSwarm = new Hyperswarm({
+        maxPeers: MAX_PEERS,
+        bootstrap: SWARM_BOOTSTRAP,
+        firewall: () => false,
+        connectionKeepAlive: SWARM_KEEP_ALIVE_INTERVAL,
+        randomPunchInterval: SWARM_RANDOM_PUNCH_INTERVAL,
+        handshakeTimeout: CONNECTION_TIMEOUT,
+      })
+    }
 
     this.#chatSwarm.on('error', err => {
       if (
@@ -265,9 +304,22 @@ export class MostBoxEngine extends EventEmitter {
           valueEncoding: 'json',
         })
         await core.ready()
-        this.#channelCores.set(channel.name, core)
+        const coreKeyHex = b4a.toString(core.key, 'hex')
+        if (!this.#channelCores.has(channel.name)) {
+          this.#channelCores.set(channel.name, new Map())
+        }
+        this.#channelCores.get(channel.name).set(coreKeyHex, core)
+        this.#channelLocalCoreKey.set(channel.name, coreKeyHex)
         this.#channelPeers.set(channel.name, new Map())
         this.#setupChannelAppendListener(core, channel.name)
+        const remoteCoreKeys = Array.isArray(channel.remoteCoreKeys)
+          ? channel.remoteCoreKeys
+          : []
+        for (const remoteCoreKey of remoteCoreKeys) {
+          if (remoteCoreKey && remoteCoreKey !== coreKeyHex) {
+            await this.#openRemoteChannelCore(channel.name, remoteCoreKey)
+          }
+        }
 
         const discoveryKey = b4a.from(channel.discoveryKey, 'hex')
         const chatDiscoveryKey = this.#generateChannelChatDiscoveryKey(
@@ -315,25 +367,16 @@ export class MostBoxEngine extends EventEmitter {
     }
     this.#activeDownloads.clear()
 
+    await Promise.allSettled(
+      [...this.#fileMonitors.values()].map(item => this.#closeFileMonitor(item))
+    )
+    this.#fileMonitors.clear()
     await Promise.allSettled([...this.#drives.values()].map(d => d.close()))
     this.#drives.clear()
     this.#fileDiscoveries.clear()
     this.#seedStates.clear()
     this.#holdingResumeTask = null
 
-    for (const core of this.#channelCores.values()) {
-      try {
-        await core.close()
-      } catch (err) {
-        console.warn('[MostBox] Failed to close channel core:', err.message)
-      }
-    }
-    this.#channelCores.clear()
-    this.#channelDiscoveries.clear()
-    this.#channelChatDiscoveries.clear()
-    this.#channelPeers.clear()
-    this.#channels = []
-
     if (this.#swarm) {
       await this.#swarm.destroy()
       this.#swarm = null
@@ -344,6 +387,22 @@ export class MostBoxEngine extends EventEmitter {
       this.#chatSwarm = null
     }
 
+    for (const [, coresMap] of this.#channelCores) {
+      for (const [, core] of coresMap) {
+        try {
+          await core.close()
+        } catch (err) {
+          console.warn('[MostBox] Failed to close channel core:', err.message)
+        }
+      }
+    }
+    this.#channelCores.clear()
+    this.#channelLocalCoreKey.clear()
+    this.#channelDiscoveries.clear()
+    this.#channelChatDiscoveries.clear()
+    this.#channelPeers.clear()
+    this.#channels = []
+
     if (this.#store) {
       await this.#store.close()
       this.#store = null
@@ -390,6 +449,7 @@ export class MostBoxEngine extends EventEmitter {
    */
   async publishFile(content, fileName, options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
     let cleanPath = null
     let safeFileName
@@ -429,6 +489,8 @@ export class MostBoxEngine extends EventEmitter {
       )
     }
 
+    this.#checkCapacity(fileSize)
+
     this.emit('publish:progress', {
       stage: 'calculating-cid',
       file: safeFileName,
@@ -442,7 +504,7 @@ export class MostBoxEngine extends EventEmitter {
 
     // 检查相同内容是否已存在
     const existingIndex = this.#publishedFiles.findIndex(
-      f => f.cid === cidString
+      f => f.cid === cidString && this.#recordMatchesOwner(f, ownerAddress)
     )
     if (existingIndex !== -1) {
       const existing = this.#publishedFiles[existingIndex]
@@ -457,7 +519,6 @@ export class MostBoxEngine extends EventEmitter {
         localPath: holdingLocalPath,
         driveName: name,
         source: 'published',
-        temporary: false,
       })
       return {
         cid: cidString,
@@ -475,10 +536,6 @@ export class MostBoxEngine extends EventEmitter {
         server: true,
         client: false,
       })
-      this.#swarm.join(drive.discoveryKey, {
-        server: true,
-        client: false,
-      })
     }
     await this.#joinCidTopicInternal(cidString, {
       server: true,
@@ -532,6 +589,7 @@ export class MostBoxEngine extends EventEmitter {
       driveName: name,
       publishedAt: new Date().toISOString(),
       starred: false,
+      ownerAddress,
     })
     this.#savePublishedMetadata()
     this.#upsertHolding({
@@ -541,7 +599,6 @@ export class MostBoxEngine extends EventEmitter {
       localPath: holdingLocalPath,
       driveName: name,
       source: 'published',
-      temporary: false,
     })
 
     const result = {
@@ -565,6 +622,7 @@ export class MostBoxEngine extends EventEmitter {
    */
   async downloadFile(link, taskId = null, options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
     taskId =
       taskId || `dl_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
@@ -585,10 +643,11 @@ export class MostBoxEngine extends EventEmitter {
       }
       const cidString = parsed.cid
       console.log(`[MostBox] Parsed CID: ${cidString}`)
-      const parsedCid = CID.parse(cidString)
       const { driveName: name } = this.#getCidInfo(cidString)
 
-      const existingFile = this.#publishedFiles.find(f => f.cid === cidString)
+      const existingFile = this.#publishedFiles.find(
+        f => f.cid === cidString && this.#recordMatchesOwner(f, ownerAddress)
+      )
       if (existingFile) {
         console.log(`[MostBox] File already exists: ${existingFile.fileName}`)
         const existingHolding = this.#holdings.find(
@@ -609,7 +668,6 @@ export class MostBoxEngine extends EventEmitter {
             existingHolding?.localPath || existingFile.localPath || null,
           driveName: existingFile.driveName || name,
           source: existingHolding?.source || 'published',
-          temporary: existingHolding?.temporary === true,
         })
         return {
           taskId,
@@ -632,18 +690,11 @@ export class MostBoxEngine extends EventEmitter {
         })
 
         this.emit('download:status', { taskId, status: 'connecting' })
-
-        console.log(`[MostBox] Joining swarm for drive discovery...`)
-        this.#swarm.join(drive.discoveryKey, {
-          server: true,
-          client: true,
-        })
-        console.log(`[MostBox] Swarm join requested`)
       } else {
         console.log(`[MostBox] Using existing drive: ${name}`)
       }
       await this.#joinCidTopicInternal(cidString, {
-        server: true,
+        server: false,
         client: true,
       })
 
@@ -717,6 +768,10 @@ export class MostBoxEngine extends EventEmitter {
           // 忽略
         }
 
+        if (totalBytes > 0) {
+          this.#checkCapacity(totalBytes)
+        }
+
         const savePath = path.join(targetDir, sanitizedFileName)
         fs.mkdirSync(path.dirname(savePath), { recursive: true })
         if (fs.existsSync(savePath)) {
@@ -826,13 +881,12 @@ export class MostBoxEngine extends EventEmitter {
         this.emit('download:status', { taskId, status: 'verifying' })
 
         const { cid: downloadedCid } = await calculateCid(savePath)
-        const expectedHash = b4a.toString(parsedCid.multihash.digest, 'hex')
-        const actualHash = b4a.toString(downloadedCid.multihash.digest, 'hex')
+        const downloadedCidString = downloadedCid.toString()
 
-        if (expectedHash !== actualHash) {
+        if (downloadedCidString !== cidString) {
           fs.unlinkSync(savePath)
           throw new IntegrityError(
-            `File content CID mismatch. File may be corrupted or tampered.`
+            `File content CID mismatch. Expected ${cidString}, got ${downloadedCidString}.`
           )
         }
 
@@ -848,7 +902,17 @@ export class MostBoxEngine extends EventEmitter {
             writeStream.on('error', reject)
             readStream.on('error', reject)
           })
+          const verifyEntry = await drive.entry(driveKey)
+          if (!verifyEntry || !verifyEntry.value || !verifyEntry.value.blob) {
+            throw new IntegrityError(
+              `Failed to write file to Hyperdrive for seeding: ${driveKey}`
+            )
+          }
         }
+        await this.#joinCidTopicInternal(cidString, {
+          server: true,
+          client: false,
+        })
 
         const result = {
           taskId,
@@ -858,7 +922,7 @@ export class MostBoxEngine extends EventEmitter {
 
         // 将下载的文件添加到已发布文件列表（displayName 用原始文件名）
         const existingIndex = this.#publishedFiles.findIndex(
-          f => f.cid === cidString
+          f => f.cid === cidString && this.#recordMatchesOwner(f, ownerAddress)
         )
         if (existingIndex !== -1) {
           const existing = this.#publishedFiles[existingIndex]
@@ -873,6 +937,7 @@ export class MostBoxEngine extends EventEmitter {
             driveName: name,
             publishedAt: new Date().toISOString(),
             starred: false,
+            ownerAddress,
           })
         }
         this.#savePublishedMetadata()
@@ -884,7 +949,6 @@ export class MostBoxEngine extends EventEmitter {
           localPath: savePath,
           driveName: name,
           source: 'downloaded',
-          temporary: true,
         })
 
         this.emit('download:success', result)
@@ -904,6 +968,7 @@ export class MostBoxEngine extends EventEmitter {
    */
   async checkDownloadAvailability(link, options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
     const timeout = options.timeout || DRIVE_ENTRY_TIMEOUT
     const parsed = parseMostLink(link)
@@ -913,7 +978,9 @@ export class MostBoxEngine extends EventEmitter {
 
     const cidString = parsed.cid
     const { driveName: name } = this.#getCidInfo(cidString)
-    const existingFile = this.#publishedFiles.find(f => f.cid === cidString)
+    const existingFile = this.#publishedFiles.find(
+      f => f.cid === cidString && this.#recordMatchesOwner(f, ownerAddress)
+    )
     if (existingFile) {
       return {
         available: true,
@@ -938,15 +1005,10 @@ export class MostBoxEngine extends EventEmitter {
         server: true,
         client: true,
       })
-
-      this.#swarm.join(drive.discoveryKey, {
-        server: true,
-        client: true,
-      })
     }
 
     await this.#joinCidTopicInternal(cidString, {
-      server: true,
+      server: false,
       client: true,
     })
 
@@ -984,6 +1046,11 @@ export class MostBoxEngine extends EventEmitter {
   listPublishedFiles(options = {}) {
     this.#ensureInitialized()
     let files = this.#publishedFiles
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+
+    if (ownerAddress) {
+      files = files.filter(f => this.#recordMatchesOwner(f, ownerAddress))
+    }
 
     if (options.starred === true) {
       files = files.filter(f => f.starred === true)
@@ -995,6 +1062,7 @@ export class MostBoxEngine extends EventEmitter {
       link: `most://${f.cid}?filename=${encodeURIComponent(f.fileName)}`,
       publishedAt: f.publishedAt,
       starred: f.starred || false,
+      ownerAddress: f.ownerAddress || '',
     }))
   }
 
@@ -1003,9 +1071,12 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} cid - 文件的 CID
    * @returns {object} 更新后的文件信息
    */
-  toggleStarred(cid) {
+  toggleStarred(cid, options = {}) {
     this.#ensureInitialized()
-    const index = this.#publishedFiles.findIndex(f => f.cid === cid)
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    const index = this.#publishedFiles.findIndex(
+      f => f.cid === cid && this.#recordMatchesOwner(f, ownerAddress)
+    )
     if (index === -1) {
       throw new Error('File not found')
     }
@@ -1022,9 +1093,12 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} cid - 要删除文件的 CID
    * @returns {Promise<Array>} 更新后的已发布文件列表
    */
-  async deletePublishedFile(cid) {
+  async deletePublishedFile(cid, options = {}) {
     this.#ensureInitialized()
-    const index = this.#publishedFiles.findIndex(f => f.cid === cid)
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    const index = this.#publishedFiles.findIndex(
+      f => f.cid === cid && this.#recordMatchesOwner(f, ownerAddress)
+    )
     if (index !== -1) {
       const fileRecord = this.#publishedFiles[index]
       const holding = this.#holdings.find(item => item.cid === fileRecord.cid)
@@ -1039,34 +1113,42 @@ export class MostBoxEngine extends EventEmitter {
         source: holding?.source || 'published',
         publishedAt: fileRecord.publishedAt,
         starred: fileRecord.starred || false,
+        ownerAddress: fileRecord.ownerAddress || ownerAddress,
         deletedAt: new Date().toISOString(),
       })
       this.#saveTrashMetadata()
 
-      await this.#leaveCidTopic(fileRecord.cid)
-      await this.#closeDriveForSeed(
-        fileRecord.driveName || this.#getCidInfo(fileRecord.cid).driveName
-      )
-      this.#removeHolding(fileRecord.cid)
-
       this.#publishedFiles.splice(index, 1)
       this.#savePublishedMetadata()
+
+      if (!this.#hasPublishedReference(fileRecord.cid)) {
+        await this.#leaveCidTopic(fileRecord.cid)
+        await this.#closeDriveForSeed(
+          fileRecord.driveName || this.#getCidInfo(fileRecord.cid).driveName
+        )
+        this.#removeHolding(fileRecord.cid)
+      }
     }
-    return this.listPublishedFiles()
+    return this.listPublishedFiles({ ownerAddress })
   }
 
   /**
    * 列出回收站中的所有文件
    * @returns {Array} 回收站文件
    */
-  listTrashFiles() {
+  listTrashFiles(options = {}) {
     this.#ensureInitialized()
-    return this.#trashFiles.map(f => ({
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    const files = ownerAddress
+      ? this.#trashFiles.filter(f => this.#recordMatchesOwner(f, ownerAddress))
+      : this.#trashFiles
+    return files.map(f => ({
       fileName: f.fileName,
       cid: f.cid,
       link: `most://${f.cid}?filename=${encodeURIComponent(f.fileName)}`,
       publishedAt: f.publishedAt,
       starred: f.starred || false,
+      ownerAddress: f.ownerAddress || '',
       deletedAt: f.deletedAt,
     }))
   }
@@ -1076,18 +1158,19 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} cid - 要恢复文件的 CID
    * @returns {Promise<Array>} 更新后的已发布文件列表
    */
-  async restoreTrashFile(cid) {
+  async restoreTrashFile(cid, options = {}) {
     this.#ensureInitialized()
-    const index = this.#trashFiles.findIndex(f => f.cid === cid)
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    const index = this.#trashFiles.findIndex(
+      f => f.cid === cid && this.#recordMatchesOwner(f, ownerAddress)
+    )
     if (index === -1) {
       throw new Error('File not found in trash')
     }
 
     const fileRecord = this.#trashFiles[index]
 
-    const parsedCid = CID.parse(fileRecord.cid)
-    const hashHex = b4a.toString(parsedCid.multihash.digest, 'hex')
-    const driveName = `drive-${hashHex}`
+    const { driveName } = this.#getCidInfo(fileRecord.cid)
 
     this.#publishedFiles.push({
       fileName: fileRecord.fileName,
@@ -1095,6 +1178,7 @@ export class MostBoxEngine extends EventEmitter {
       driveName,
       publishedAt: fileRecord.publishedAt,
       starred: fileRecord.starred || false,
+      ownerAddress: fileRecord.ownerAddress || ownerAddress,
     })
     this.#savePublishedMetadata()
 
@@ -1112,10 +1196,9 @@ export class MostBoxEngine extends EventEmitter {
       localPath: fileRecord.localPath || null,
       driveName,
       source: fileRecord.source || 'published',
-      temporary: fileRecord.source === 'downloaded',
     })
 
-    return this.listPublishedFiles()
+    return this.listPublishedFiles({ ownerAddress })
   }
 
   /**
@@ -1123,41 +1206,60 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} cid - 要永久删除文件的 CID
    * @returns {Promise<Array>} 更新后的回收站列表
    */
-  async permanentDeleteTrashFile(cid) {
+  async permanentDeleteTrashFile(cid, options = {}) {
     this.#ensureInitialized()
-    const index = this.#trashFiles.findIndex(f => f.cid === cid)
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    const index = this.#trashFiles.findIndex(
+      f => f.cid === cid && this.#recordMatchesOwner(f, ownerAddress)
+    )
     if (index !== -1) {
       const fileRecord = this.#trashFiles[index]
       const driveName =
         fileRecord.driveName || this.#getCidInfo(fileRecord.cid).driveName
 
-      try {
-        const drive = await this.#getOrCreateDrive(driveName)
-        await drive.del('/' + fileRecord.cid)
-      } catch {
-        // 文件可能不存在于驱动器中
-      }
-      await this.#closeDriveForSeed(driveName)
-
-      await this.#leaveCidTopic(fileRecord.cid)
-      this.#removeHolding(fileRecord.cid)
       this.#trashFiles.splice(index, 1)
       this.#saveTrashMetadata()
+
+      if (!this.#hasAnyUserReference(fileRecord.cid)) {
+        try {
+          const drive = await this.#getOrCreateDrive(driveName)
+          await drive.del('/' + fileRecord.cid)
+        } catch {
+          // 文件可能不存在于驱动器中
+        }
+        await this.#closeDriveForSeed(driveName)
+        await this.#leaveCidTopic(fileRecord.cid)
+        this.#removeHolding(fileRecord.cid)
+      }
     }
-    return this.listTrashFiles()
+    return this.listTrashFiles({ ownerAddress })
   }
 
   /**
    * 清空回收站 — 永久删除所有回收站文件
    * @returns {Promise<Array>} 清空后的回收站列表
    */
-  async emptyTrash() {
+  async emptyTrash(options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    const remainingTrash = []
+    const removedTrash = []
 
     for (const fileRecord of this.#trashFiles) {
+      if (ownerAddress && !this.#recordMatchesOwner(fileRecord, ownerAddress)) {
+        remainingTrash.push(fileRecord)
+        continue
+      }
+      removedTrash.push(fileRecord)
+    }
+
+    this.#trashFiles = remainingTrash
+    this.#saveTrashMetadata()
+
+    for (const fileRecord of removedTrash) {
+      if (this.#hasAnyUserReference(fileRecord.cid)) continue
       const driveName =
         fileRecord.driveName || this.#getCidInfo(fileRecord.cid).driveName
-
       try {
         const drive = await this.#getOrCreateDrive(driveName)
         await drive.del('/' + fileRecord.cid)
@@ -1169,18 +1271,16 @@ export class MostBoxEngine extends EventEmitter {
       this.#removeHolding(fileRecord.cid)
     }
 
-    this.#trashFiles = []
-    this.#saveTrashMetadata()
-
-    return []
+    return this.listTrashFiles({ ownerAddress })
   }
 
   /**
    * 获取存储统计信息
    * @returns {Promise<{ total: number, used: number, free: number, fileCount: number, trashCount: number }>}
    */
-  async getStorageStats() {
+  async getStorageStats(options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
     let totalSize = 0
     let freeSize = 0
@@ -1231,8 +1331,16 @@ export class MostBoxEngine extends EventEmitter {
       total: totalSize,
       used: usedSize,
       free: freeSize,
-      fileCount: this.#publishedFiles.length,
-      trashCount: this.#trashFiles.length,
+      fileCount: ownerAddress
+        ? this.#publishedFiles.filter(f =>
+            this.#recordMatchesOwner(f, ownerAddress)
+          ).length
+        : this.#publishedFiles.length,
+      trashCount: ownerAddress
+        ? this.#trashFiles.filter(f =>
+            this.#recordMatchesOwner(f, ownerAddress)
+          ).length
+        : this.#trashFiles.length,
     }
   }
 
@@ -1243,9 +1351,12 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} newFileName - 新文件路径
    * @returns {object} 更新后的文件信息
    */
-  moveFile(cid, newFileName) {
+  moveFile(cid, newFileName, options = {}) {
     this.#ensureInitialized()
-    const index = this.#publishedFiles.findIndex(f => f.cid === cid)
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    const index = this.#publishedFiles.findIndex(
+      f => f.cid === cid && this.#recordMatchesOwner(f, ownerAddress)
+    )
     if (index === -1) {
       throw new Error('File not found')
     }
@@ -1267,13 +1378,17 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} newPath - 新文件夹路径
    * @returns {object} 更新后的文件信息
    */
-  renameFolder(oldPath, newPath) {
+  renameFolder(oldPath, newPath, options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
     const prefix = oldPath + '/'
     const updatedFiles = []
 
     for (const file of this.#publishedFiles) {
-      if (file.fileName.startsWith(prefix)) {
+      if (
+        file.fileName.startsWith(prefix) &&
+        this.#recordMatchesOwner(file, ownerAddress)
+      ) {
         const remainder = file.fileName.substring(prefix.length)
         const newFileName = sanitizeFilename(
           remainder ? newPath + '/' + remainder : newPath
@@ -1324,8 +1439,114 @@ export class MostBoxEngine extends EventEmitter {
     this.#options.maxFileSize = Math.floor(parsed)
   }
 
-  getPublishedFiles() {
-    return this.#publishedFiles
+  getPublishedFiles(options = {}) {
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    return ownerAddress
+      ? this.#publishedFiles.filter(f =>
+          this.#recordMatchesOwner(f, ownerAddress)
+        )
+      : this.#publishedFiles
+  }
+
+  listUsers() {
+    this.#ensureInitialized()
+    const users = new Map()
+    const ensure = address => {
+      const ownerAddress = normalizeOwnerAddress(address)
+      if (!ownerAddress) return null
+      if (!users.has(ownerAddress)) {
+        users.set(ownerAddress, {
+          address: ownerAddress,
+          fileCount: 0,
+          trashCount: 0,
+          cidCount: 0,
+          cids: new Set(),
+        })
+      }
+      return users.get(ownerAddress)
+    }
+
+    for (const file of this.#publishedFiles) {
+      const entry = ensure(file.ownerAddress)
+      if (!entry) continue
+      entry.fileCount += 1
+      entry.cids.add(file.cid)
+    }
+    for (const file of this.#trashFiles) {
+      const entry = ensure(file.ownerAddress)
+      if (!entry) continue
+      entry.trashCount += 1
+      entry.cids.add(file.cid)
+    }
+
+    return [...users.values()].map(user => ({
+      address: user.address,
+      fileCount: user.fileCount,
+      trashCount: user.trashCount,
+      cidCount: user.cids.size,
+    }))
+  }
+
+  async clearUserData(ownerAddressInput) {
+    this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(ownerAddressInput)
+    if (!ownerAddress) {
+      throw new ValidationError('valid owner address is required')
+    }
+
+    const affectedCids = new Set()
+    const beforeFiles = this.#publishedFiles.length
+    const beforeTrash = this.#trashFiles.length
+
+    this.#publishedFiles = this.#publishedFiles.filter(file => {
+      if (this.#recordMatchesOwner(file, ownerAddress)) {
+        affectedCids.add(file.cid)
+        return false
+      }
+      return true
+    })
+    this.#trashFiles = this.#trashFiles.filter(file => {
+      if (this.#recordMatchesOwner(file, ownerAddress)) {
+        affectedCids.add(file.cid)
+        return false
+      }
+      return true
+    })
+    this.#channels = this.#channels
+      .map(channel => ({
+        ...channel,
+        members: Array.isArray(channel.members)
+          ? channel.members.filter(
+              member => normalizeOwnerAddress(member) !== ownerAddress
+            )
+          : [],
+      }))
+      .filter(channel => channel.members.length > 0)
+
+    this.#savePublishedMetadata()
+    this.#saveTrashMetadata()
+    this.#saveChannelsMetadata()
+
+    let removedReplicas = 0
+    for (const cid of affectedCids) {
+      if (this.#hasAnyUserReference(cid)) continue
+      const driveName = this.#getCidInfo(cid).driveName
+      try {
+        const drive = await this.#getOrCreateDrive(driveName)
+        await drive.del('/' + cid)
+      } catch {}
+      await this.#closeDriveForSeed(driveName)
+      await this.#leaveCidTopic(cid)
+      this.#removeHolding(cid)
+      removedReplicas += 1
+    }
+
+    return {
+      ownerAddress,
+      removedFiles: beforeFiles - this.#publishedFiles.length,
+      removedTrashFiles: beforeTrash - this.#trashFiles.length,
+      removedReplicas,
+    }
   }
 
   /**
@@ -1345,6 +1566,7 @@ export class MostBoxEngine extends EventEmitter {
         seedStatus: status,
         seedError: seedState?.error,
         seedStatusUpdatedAt: seedState?.updatedAt,
+        ...this.#getFileRuntimeStats(holding.cid),
         link: `most://${holding.cid}?filename=${encodeURIComponent(holding.fileName || holding.cid)}`,
       }
     })
@@ -1383,6 +1605,7 @@ export class MostBoxEngine extends EventEmitter {
       }
       const result = await this.downloadFile(input.link, input.taskId || null, {
         timeout: input.timeout,
+        ownerAddress: input.ownerAddress,
       })
       return {
         ...result,
@@ -1400,6 +1623,7 @@ export class MostBoxEngine extends EventEmitter {
     const link = `most://${cid}?filename=${encodeURIComponent(fileName)}`
     const result = await this.downloadFile(link, input.taskId || null, {
       timeout: input.timeout,
+      ownerAddress: input.ownerAddress,
     })
 
     return {
@@ -1447,10 +1671,20 @@ export class MostBoxEngine extends EventEmitter {
    * @param {number} [offset=0] - 读取起始位置
    * @param {number} [limit=10000] - 最大读取字节数
    */
-  async readFileContent(cid, offset = 0, limit = DEFAULT_READ_LIMIT) {
+  async readFileContent(
+    cid,
+    offset = 0,
+    limit = DEFAULT_READ_LIMIT,
+    options = {}
+  ) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
-    const fileRecord = this.#publishedFiles.find(f => f.cid === cid)
+    const fileRecord = this.#publishedFiles.find(
+      f =>
+        f.cid === cid &&
+        (options.public || this.#recordMatchesOwner(f, ownerAddress))
+    )
     if (!fileRecord) {
       throw new Error('File not found')
     }
@@ -1507,8 +1741,13 @@ export class MostBoxEngine extends EventEmitter {
    */
   async readFileRaw(cid, options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
-    const fileRecord = this.#publishedFiles.find(f => f.cid === cid)
+    const fileRecord = this.#publishedFiles.find(
+      f =>
+        f.cid === cid &&
+        (options.public || this.#recordMatchesOwner(f, ownerAddress))
+    )
     if (!fileRecord) {
       throw new Error('File not found')
     }
@@ -1592,8 +1831,9 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} [type='personal'] - 频道类型
    * @returns {Promise<{ name: string, key: string }>}
    */
-  async createChannel(name, type = 'personal') {
+  async createChannel(name, type = 'personal', options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
     if (!CHANNEL_NAME_REGEX.test(name)) {
       throw new Error('频道名只能包含字母、数字、下划线和连字符')
@@ -1607,6 +1847,13 @@ export class MostBoxEngine extends EventEmitter {
 
     const existing = this.#channels.find(c => c.name === name)
     if (existing) {
+      if (ownerAddress && !Array.isArray(existing.members)) {
+        existing.members = []
+      }
+      if (ownerAddress && !existing.members.includes(ownerAddress)) {
+        existing.members.push(ownerAddress)
+        this.#saveChannelsMetadata()
+      }
       return { name: existing.name, key: existing.coreKey }
     }
 
@@ -1633,10 +1880,18 @@ export class MostBoxEngine extends EventEmitter {
       coreKey: b4a.toString(core.key, 'hex'),
       createdAt: new Date().toISOString(),
       type,
+      ownerAddress,
+      members: ownerAddress ? [ownerAddress] : [],
+      remoteCoreKeys: [],
     }
 
     this.#channels.push(channelInfo)
-    this.#channelCores.set(name, core)
+    const coreKeyHex = b4a.toString(core.key, 'hex')
+    if (!this.#channelCores.has(name)) {
+      this.#channelCores.set(name, new Map())
+    }
+    this.#channelCores.get(name).set(coreKeyHex, core)
+    this.#channelLocalCoreKey.set(name, coreKeyHex)
     this.#channelPeers.set(name, new Map())
     this.#channelDiscoveries.set(name, appDiscovery)
     this.#channelChatDiscoveries.set(name, chatDiscovery)
@@ -1654,11 +1909,29 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} [coreKey] - 频道的 coreKey（加入他人创建的频道时必填）
    * @returns {Promise<{ name: string, key: string }>}
    */
-  async joinChannel(name, coreKey = null) {
+  async joinChannel(name, coreKey = null, options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
     const existing = this.#channels.find(c => c.name === name)
     if (existing) {
+      if (ownerAddress && !Array.isArray(existing.members)) {
+        existing.members = []
+      }
+      if (ownerAddress && !existing.members.includes(ownerAddress)) {
+        existing.members.push(ownerAddress)
+        this.#saveChannelsMetadata()
+      }
+      if (coreKey && coreKey !== existing.coreKey) {
+        if (!Array.isArray(existing.remoteCoreKeys)) {
+          existing.remoteCoreKeys = []
+        }
+        if (!existing.remoteCoreKeys.includes(coreKey)) {
+          existing.remoteCoreKeys.push(coreKey)
+          this.#saveChannelsMetadata()
+        }
+        await this.#openRemoteChannelCore(name, coreKey)
+      }
       return { name: existing.name, key: existing.coreKey }
     }
 
@@ -1667,11 +1940,13 @@ export class MostBoxEngine extends EventEmitter {
     }
 
     const ns = this.#store.namespace(`channel-${name}`)
-    const core = ns.get({
-      key: b4a.from(coreKey, 'hex'),
+    const remoteCoreKeyHex = b4a.toString(b4a.from(coreKey, 'hex'), 'hex')
+    const localCore = ns.get({
+      name: `messages-${this.getNodeId()}`,
       valueEncoding: 'json',
     })
-    await core.ready()
+    await localCore.ready()
+    const localCoreKeyHex = b4a.toString(localCore.key, 'hex')
 
     const discoveryKey = this.#generateChannelDiscoveryKey(name)
     const chatDiscoveryKey = this.#generateChannelChatDiscoveryKey(name)
@@ -1684,27 +1959,38 @@ export class MostBoxEngine extends EventEmitter {
       client: true,
     })
 
-    this.#setupChannelAppendListener(core, name)
+    this.#setupChannelAppendListener(localCore, name)
 
     const channelInfo = {
       name,
       discoveryKey: b4a.toString(discoveryKey, 'hex'),
-      coreKey,
+      coreKey: localCoreKeyHex,
       createdAt: new Date().toISOString(),
       type: 'group',
+      ownerAddress,
+      members: ownerAddress ? [ownerAddress] : [],
+      remoteCoreKeys:
+        remoteCoreKeyHex === localCoreKeyHex ? [] : [remoteCoreKeyHex],
     }
 
     this.#channels.push(channelInfo)
-    this.#channelCores.set(name, core)
+    if (!this.#channelCores.has(name)) {
+      this.#channelCores.set(name, new Map())
+    }
+    this.#channelCores.get(name).set(localCoreKeyHex, localCore)
+    this.#channelLocalCoreKey.set(name, localCoreKeyHex)
     this.#channelPeers.set(name, new Map())
     this.#channelDiscoveries.set(name, appDiscovery)
     this.#channelChatDiscoveries.set(name, chatDiscovery)
     this.#saveChannelsMetadata()
+    if (remoteCoreKeyHex !== localCoreKeyHex) {
+      await this.#openRemoteChannelCore(name, remoteCoreKeyHex)
+    }
 
     console.log(`[MostBox] Joined channel: ${name}`)
-    this.emit('channel:joined', { name, key: coreKey })
+    this.emit('channel:joined', { name, key: localCoreKeyHex })
 
-    return { name, key: coreKey }
+    return { name, key: localCoreKeyHex }
   }
 
   /**
@@ -1712,8 +1998,9 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} name - 频道名
    * @returns {Promise<string[]>} 剩余频道列表
    */
-  async leaveChannel(name) {
+  async leaveChannel(name, options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
     const index = this.#channels.findIndex(c => c.name === name)
     if (index === -1) {
@@ -1721,6 +2008,15 @@ export class MostBoxEngine extends EventEmitter {
     }
 
     const channel = this.#channels[index]
+    if (ownerAddress && Array.isArray(channel.members)) {
+      channel.members = channel.members.filter(
+        member => normalizeOwnerAddress(member) !== ownerAddress
+      )
+      if (channel.members.length > 0) {
+        this.#saveChannelsMetadata()
+        return this.listChannels({ ownerAddress })
+      }
+    }
 
     const appDiscovery = this.#channelDiscoveries.get(name)
     if (appDiscovery && this.#swarm) {
@@ -1745,18 +2041,21 @@ export class MostBoxEngine extends EventEmitter {
       })
     }
 
-    const core = this.#channelCores.get(name)
-    if (core) {
-      try {
-        await core.close()
-      } catch (err) {
-        console.warn(
-          `[MostBox] Failed to close channel core for ${name}:`,
-          err.message
-        )
+    const coresMap = this.#channelCores.get(name)
+    if (coresMap) {
+      for (const [, core] of coresMap) {
+        try {
+          await core.close()
+        } catch (err) {
+          console.warn(
+            `[MostBox] Failed to close channel core for ${name}:`,
+            err.message
+          )
+        }
       }
       this.#channelCores.delete(name)
     }
+    this.#channelLocalCoreKey.delete(name)
 
     this.#channelPeers.delete(name)
     this.#channels.splice(index, 1)
@@ -1765,23 +2064,61 @@ export class MostBoxEngine extends EventEmitter {
     console.log(`[MostBox] Left channel: ${name}`)
     this.emit('channel:left', { name })
 
-    return this.listChannels()
+    return this.listChannels({ ownerAddress })
+  }
+
+  setChannelRemark(name, remark, options = {}) {
+    this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
+    if (!ownerAddress) {
+      throw new Error('需要登录才能设置备注')
+    }
+
+    const channel = this.#channels.find(c => c.name === name)
+    if (!channel) {
+      throw new Error('频道不存在')
+    }
+
+    const trimmed = (remark || '').trim()
+    if (trimmed.length > 50) {
+      throw new Error('备注最多 50 个字符')
+    }
+
+    if (!channel.remarks) {
+      channel.remarks = {}
+    }
+
+    if (trimmed) {
+      channel.remarks[ownerAddress] = trimmed
+    } else {
+      delete channel.remarks[ownerAddress]
+    }
+
+    this.#saveChannelsMetadata()
+    return trimmed
   }
 
   /**
    * 列出所有频道
-   * @returns {Array<{ name: string, coreKey: string, createdAt: string, type: string, peerCount: number }>}
+   * @returns {Array<{ name: string, coreKey: string, createdAt: string, type: string, peerCount: number, remark: string }>}
    */
-  listChannels() {
+  listChannels(options = {}) {
     this.#ensureInitialized()
+    const ownerAddress = normalizeOwnerAddress(options.ownerAddress)
 
-    return this.#channels.map(c => ({
-      name: c.name,
-      coreKey: c.coreKey,
-      createdAt: c.createdAt,
-      type: c.type,
-      peerCount: (this.#channelPeers.get(c.name) || new Map()).size,
-    }))
+    return this.#channels
+      .filter(c => {
+        if (!ownerAddress) return true
+        return Array.isArray(c.members) && c.members.includes(ownerAddress)
+      })
+      .map(c => ({
+        name: c.name,
+        coreKey: c.coreKey,
+        createdAt: c.createdAt,
+        type: c.type,
+        peerCount: (this.#channelPeers.get(c.name) || new Map()).size,
+        remark: ownerAddress && c.remarks ? c.remarks[ownerAddress] || '' : '',
+      }))
   }
 
   /**
@@ -1794,29 +2131,48 @@ export class MostBoxEngine extends EventEmitter {
    */
   async getChannelMessages(name, options = {}) {
     this.#ensureInitialized()
+    this.#assertChannelMember(name, options.ownerAddress)
 
     const { limit = CHANNEL_MESSAGE_LIMIT, offset = 0 } = options
 
-    const core = this.#channelCores.get(name)
-    if (!core) {
+    const coresMap = this.#channelCores.get(name)
+    if (!coresMap || coresMap.size === 0) {
       throw new Error('频道未初始化')
     }
 
-    const messages = []
-    const total = core.length
-    const start = Math.max(0, total - offset - limit)
-    const end = total - offset
-
-    for (let i = start; i < end; i++) {
-      try {
-        const entry = await core.get(i)
-        messages.push(entry)
-      } catch {
-        break
+    const allMessages = []
+    for (const [coreKeyHex, core] of coresMap) {
+      for (let i = 0; i < core.length; i++) {
+        try {
+          const entry = await core.get(i)
+          if (entry && entry.type === 'message') {
+            allMessages.push({
+              ...entry,
+              _coreKey: coreKeyHex,
+              _index: i,
+            })
+          }
+        } catch {
+          break
+        }
       }
     }
 
-    return messages
+    const seen = new Set()
+    const unique = allMessages.filter(m => {
+      const key = `${m._coreKey}:${m.author}:${m.timestamp}:${m.content}`
+      if (seen.has(key)) return false
+      seen.add(key)
+      return true
+    })
+
+    unique.sort((a, b) => a.timestamp - b.timestamp)
+
+    const total = unique.length
+    const start = Math.max(0, total - offset - limit)
+    const end = total - offset
+
+    return unique.slice(start, end).map(({ _coreKey, _index, ...msg }) => msg)
   }
 
   /**
@@ -1825,14 +2181,18 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} content - 消息内容
    * @param {string} author - 作者 address
    * @param {string} authorName - 作者显示名
+   * @param {object} [options.attachment] - 附件元数据
    * @returns {Promise<object>}
    */
-  async sendMessage(name, content, author, authorName) {
+  async sendMessage(name, content, author, authorName, options = {}) {
     this.#ensureInitialized()
+    this.#assertChannelMember(name, options.ownerAddress)
 
-    const core = this.#channelCores.get(name)
+    const localKeyHex = this.#channelLocalCoreKey.get(name)
+    const coresMap = this.#channelCores.get(name)
+    const core = localKeyHex && coresMap ? coresMap.get(localKeyHex) : null
     if (!core) {
-      throw new Error('频道未初始化')
+      throw new Error('频道未初始化或无可写 core')
     }
 
     if (!content || !content.trim()) {
@@ -1843,6 +2203,10 @@ export class MostBoxEngine extends EventEmitter {
     if (trimmed.length > MAX_MESSAGE_LENGTH) {
       throw new Error(`消息内容不能超过 ${MAX_MESSAGE_LENGTH} 字符`)
     }
+    const attachment = normalizeChannelAttachment(options.attachment)
+    if (attachment && trimmed !== attachment.link) {
+      throw new ValidationError('attachment content must match link')
+    }
 
     const message = {
       type: 'message',
@@ -1851,11 +2215,12 @@ export class MostBoxEngine extends EventEmitter {
       content: trimmed,
       timestamp: Date.now(),
     }
+    if (attachment) {
+      message.attachment = attachment
+    }
 
     await core.append(message)
 
-    this.emit('channel:message', { channel: name, message })
-
     return message
   }
 
@@ -1864,8 +2229,9 @@ export class MostBoxEngine extends EventEmitter {
    * @param {string} name - 频道名
    * @returns {Array<{ peerId: string, authorName: string, lastSeen: number }>}
    */
-  getChannelPeers(name) {
+  getChannelPeers(name, options = {}) {
     this.#ensureInitialized()
+    this.#assertChannelMember(name, options.ownerAddress)
 
     const peers = this.#channelPeers.get(name)
     if (!peers) {
@@ -1922,27 +2288,26 @@ export class MostBoxEngine extends EventEmitter {
     }
   }
 
-  #getCidInfo(cid) {
-    try {
-      const parsedCid = CID.parse(cid)
-      const topic = b4a.from(parsedCid.multihash.digest)
-      if (topic.length !== 32) {
-        throw new ValidationError('CID digest must be 32 bytes')
-      }
-      const topicHex = b4a.toString(topic, 'hex')
-      return {
-        topic,
-        topicHex,
-        driveName: `drive-${topicHex}`,
-      }
-    } catch (err) {
-      if (err instanceof ValidationError) {
-        throw err
-      }
-      throw new ValidationError('Invalid CID format')
+  #assertChannelMember(name, ownerAddress) {
+    const normalizedOwner = normalizeOwnerAddress(ownerAddress)
+    if (!normalizedOwner) return
+
+    const channel = this.#channels.find(c => c.name === name)
+    if (!channel) {
+      throw new Error('频道不存在')
+    }
+    if (
+      !Array.isArray(channel.members) ||
+      !channel.members.includes(normalizedOwner)
+    ) {
+      throw new PermissionError('未加入该频道')
     }
   }
 
+  #getCidInfo(cid) {
+    return getCidInfo(cid)
+  }
+
   #setSeedState(cid, patch = {}) {
     const previous = this.#seedStates.get(cid) || {}
     const next = {
@@ -1962,6 +2327,111 @@ export class MostBoxEngine extends EventEmitter {
     }
   }
 
+  #getFileRuntimeStats(cid) {
+    const state = this.#fileMonitors.get(cid)
+    if (!state) {
+      return {
+        peerCount: 0,
+        lastServedAt: null,
+        totalServedBytes: 0,
+      }
+    }
+
+    return {
+      peerCount: state.peerCount || 0,
+      lastServedAt: state.lastServedAt || null,
+      totalServedBytes: state.totalServedBytes || 0,
+    }
+  }
+
+  async #ensureFileMonitor(cid, drive = null) {
+    const existing = this.#fileMonitors.get(cid)
+    if (existing) return existing
+
+    const { driveName } = this.#getCidInfo(cid)
+    const monitoredDrive = drive || (await this.#getOrCreateDrive(driveName))
+    const monitor = monitoredDrive.monitor('/' + cid)
+    const state = {
+      cid,
+      monitor,
+      peerCount: 0,
+      lastServedAt: null,
+      totalServedBytes: 0,
+      uploadBytes: 0,
+      uploadBlocks: 0,
+      lastMetricsEmittedAt: 0,
+      cleanup: null,
+    }
+    this.#fileMonitors.set(cid, state)
+
+    const emitMetrics = (force = false) => {
+      const now = Date.now()
+      if (!force && now - state.lastMetricsEmittedAt < 1000) return
+      state.lastMetricsEmittedAt = now
+      this.emit('seed:metrics', {
+        cid,
+        ...this.#getFileRuntimeStats(cid),
+      })
+    }
+
+    const updatePeerCount = () => {
+      const nextPeerCount = Number(monitor.peers) || 0
+      if (nextPeerCount !== state.peerCount) {
+        state.peerCount = nextPeerCount
+        emitMetrics(true)
+      }
+    }
+
+    const updateTransferStats = () => {
+      updatePeerCount()
+      const uploadStats = monitor.uploadStats || {}
+      const uploadBytes = Number(uploadStats.monitoringBytes) || 0
+      const uploadBlocks = Number(uploadStats.blocks) || 0
+      const servedMore =
+        uploadBytes > state.uploadBytes || uploadBlocks > state.uploadBlocks
+
+      if (servedMore) {
+        state.lastServedAt = new Date().toISOString()
+        state.totalServedBytes = uploadBytes
+      }
+
+      state.uploadBytes = uploadBytes
+      state.uploadBlocks = uploadBlocks
+      if (servedMore) emitMetrics()
+    }
+
+    monitor.on('update', updateTransferStats)
+    try {
+      await monitor.ready()
+      const blobs = monitor.blobs
+      const onPeerUpdate = () => {
+        updatePeerCount()
+      }
+      blobs?.core?.on('peer-add', onPeerUpdate)
+      blobs?.core?.on('peer-remove', onPeerUpdate)
+      state.cleanup = () => {
+        blobs?.core?.off('peer-add', onPeerUpdate)
+        blobs?.core?.off('peer-remove', onPeerUpdate)
+      }
+      updateTransferStats()
+    } catch (err) {
+      this.#fileMonitors.delete(cid)
+      monitor.off('update', updateTransferStats)
+      await monitor.close().catch(() => {})
+      throw err
+    }
+
+    return state
+  }
+
+  async #closeFileMonitor(state) {
+    if (!state) return
+    try {
+      state.cleanup?.()
+      await state.monitor.close()
+    } catch {}
+  }
+
   #resumeHoldingsInBackground() {
     if (this.#holdingResumeTask || this.#holdings.length === 0) {
       return
@@ -2028,7 +2498,6 @@ export class MostBoxEngine extends EventEmitter {
       topic: topicHex,
       driveName: record.driveName || driveName,
       source: record.source || 'manual',
-      temporary: record.temporary === true,
     }
   }
 
@@ -2049,6 +2518,12 @@ export class MostBoxEngine extends EventEmitter {
 
     this.#saveHoldingsMetadata()
     this.emit('holding:updated', next)
+    this.#ensureFileMonitor(next.cid).catch(err => {
+      this.#setSeedState(next.cid, {
+        status: 'error',
+        error: err.message,
+      })
+    })
     const seedState = this.#seedStates.get(next.cid)
     return {
       ...next,
@@ -2058,6 +2533,7 @@ export class MostBoxEngine extends EventEmitter {
         (this.#fileDiscoveries.has(next.cid) ? 'active' : 'queued'),
       seedError: seedState?.error,
       seedStatusUpdatedAt: seedState?.updatedAt,
+      ...this.#getFileRuntimeStats(next.cid),
     }
   }
 
@@ -2068,11 +2544,15 @@ export class MostBoxEngine extends EventEmitter {
       this.#saveHoldingsMetadata()
       this.emit('holding:removed', { cid })
     }
+    this.#closeFileMonitor(this.#fileMonitors.get(cid))
+    this.#fileMonitors.delete(cid)
     this.#clearSeedState(cid)
   }
 
   async #joinCidTopicInternal(cid, options = {}) {
     const { topic, topicHex, driveName } = this.#getCidInfo(cid)
+    const requestedServer = options.server !== false
+    const requestedClient = options.client === true
     this.#setSeedState(cid, {
       status: 'joining',
       topic: topicHex,
@@ -2081,33 +2561,60 @@ export class MostBoxEngine extends EventEmitter {
     })
 
     try {
-      await this.#getOrCreateDrive(driveName)
+      const drive = await this.#getOrCreateDrive(driveName)
 
       const existing = this.#fileDiscoveries.get(cid)
       if (existing) {
-        this.#setSeedState(cid, {
-          status: 'active',
-          topic: topicHex,
-          driveName,
-          error: undefined,
-        })
-        return {
-          cid,
-          topic: topicHex,
-          driveName,
-          joined: true,
+        const nextServer = existing.server || requestedServer
+        const nextClient = existing.client || requestedClient
+        const needsRoleUpgrade =
+          nextServer !== existing.server || nextClient !== existing.client
+
+        if (!needsRoleUpgrade) {
+          if (this.#holdings.some(holding => holding.cid === cid)) {
+            this.#ensureFileMonitor(cid, drive).catch(err => {
+              this.#setSeedState(cid, {
+                status: 'error',
+                error: err.message,
+              })
+            })
+          }
+          this.#setSeedState(cid, {
+            status: 'active',
+            topic: topicHex,
+            driveName,
+            error: undefined,
+          })
+          return {
+            cid,
+            topic: topicHex,
+            driveName,
+            joined: true,
+          }
         }
+
+        await this.#swarm.leave(topic).catch(err => {
+          console.warn(
+            `[MostBox] Failed to upgrade CID topic role for ${cid}:`,
+            err.message
+          )
+        })
+        this.#fileDiscoveries.delete(cid)
       }
 
+      const server = existing?.server || requestedServer
+      const client = existing?.client || requestedClient
       const discovery = this.#swarm.join(topic, {
-        server: options.server !== false,
-        client: options.client === true,
+        server,
+        client,
       })
 
       this.#fileDiscoveries.set(cid, {
         discovery,
         topic: topicHex,
         driveName,
+        server,
+        client,
       })
       this.#setSeedState(cid, {
         status: 'active',
@@ -2115,6 +2622,14 @@ export class MostBoxEngine extends EventEmitter {
         driveName,
         error: undefined,
       })
+      if (this.#holdings.some(holding => holding.cid === cid)) {
+        this.#ensureFileMonitor(cid, drive).catch(err => {
+          this.#setSeedState(cid, {
+            status: 'error',
+            error: err.message,
+          })
+        })
+      }
       this.emit('file:topic:joined', { cid, topic: topicHex, driveName })
 
       return {
@@ -2158,19 +2673,44 @@ export class MostBoxEngine extends EventEmitter {
       return null
     }
 
-    if (this.#swarm) {
-      this.#swarm.leave(drive.discoveryKey).catch(err => {
-        console.warn(
-          `[MostBox] Failed to leave drive discovery ${driveName}:`,
-          err.message
-        )
-      })
-    }
     await drive.close()
     this.#drives.delete(driveName)
     return drive
   }
 
+  #recordMatchesOwner(record, ownerAddress) {
+    const normalizedOwner = normalizeOwnerAddress(ownerAddress)
+    if (!normalizedOwner) return !record.ownerAddress
+    return normalizeOwnerAddress(record.ownerAddress) === normalizedOwner
+  }
+
+  #hasPublishedReference(cid) {
+    return this.#publishedFiles.some(file => file.cid === cid)
+  }
+
+  #hasAnyUserReference(cid) {
+    return (
+      this.#publishedFiles.some(file => file.cid === cid) ||
+      this.#trashFiles.some(file => file.cid === cid)
+    )
+  }
+
+  #getUsedBytes() {
+    return this.#holdings.reduce((sum, h) => sum + (h.size || 0), 0)
+  }
+
+  #checkCapacity(additionalBytes) {
+    const used = this.#getUsedBytes()
+    const capacity = this.#options.capacityBytes
+    if (used + additionalBytes > capacity) {
+      const usedGB = (used / (1024 * 1024 * 1024)).toFixed(2)
+      const capacityGB = (capacity / (1024 * 1024 * 1024)).toFixed(2)
+      throw new StorageCapacityError(
+        `Storage capacity exceeded: used ${usedGB} GB, capacity ${capacityGB} GB`
+      )
+    }
+  }
+
   async #getOrCreateDrive(name, _options = { server: true, client: false }) {
     if (this.#drives.has(name)) return this.#drives.get(name)
     if (this.#drivePromises.has(name)) return this.#drivePromises.get(name)
@@ -2193,11 +2733,6 @@ export class MostBoxEngine extends EventEmitter {
   }
 
   async #syncDrive(drive, timeout = DRIVE_SYNC_TIMEOUT) {
-    const done = drive.findingPeers()
-    this.#swarm
-      .join(drive.discoveryKey, { server: true, client: true })
-      .flushed()
-      .then(done, done)
     try {
       const updated = await Promise.race([
         drive.update(),
@@ -2384,15 +2919,57 @@ export class MostBoxEngine extends EventEmitter {
     })
   }
 
+  async #openRemoteChannelCore(channelName, coreKeyHex) {
+    const coresMap = this.#channelCores.get(channelName)
+    if (!coresMap) return
+    if (coresMap.has(coreKeyHex)) return
+
+    try {
+      const ns = this.#store.namespace(`channel-${channelName}`)
+      const core = ns.get({
+        key: b4a.from(coreKeyHex, 'hex'),
+        valueEncoding: 'json',
+      })
+      await core.ready()
+      const normalizedCoreKey = b4a.toString(core.key, 'hex')
+      coresMap.set(normalizedCoreKey, core)
+      this.#setupChannelAppendListener(core, channelName)
+      const channel = this.#channels.find(c => c.name === channelName)
+      if (channel && normalizedCoreKey !== channel.coreKey) {
+        if (!Array.isArray(channel.remoteCoreKeys)) {
+          channel.remoteCoreKeys = []
+        }
+        if (!channel.remoteCoreKeys.includes(normalizedCoreKey)) {
+          channel.remoteCoreKeys.push(normalizedCoreKey)
+          this.#saveChannelsMetadata()
+        }
+      }
+      console.log(
+        `[MostBox] Opened remote channel core ${normalizedCoreKey.slice(0, 8)}... for ${channelName}`
+      )
+    } catch (err) {
+      console.warn(
+        `[MostBox] Failed to open remote channel core for ${channelName}:`,
+        err.message
+      )
+    }
+  }
+
   async #handleChannelConnection(conn) {
     const stream = conn
     let connectedPeerId = null
 
+    const coreKeys = {}
+    for (const [name, localKeyHex] of this.#channelLocalCoreKey) {
+      coreKeys[name] = localKeyHex
+    }
+
     const helloMessage = JSON.stringify({
       type: 'channel-hello',
       peerId: this.getNodeId(),
       authorName: this.getNodeId().slice(0, 4),
       channels: this.#channels.map(c => c.name),
+      coreKeys,
     })
 
     try {
@@ -2417,6 +2994,17 @@ export class MostBoxEngine extends EventEmitter {
               })
             }
           }
+
+          if (msg.coreKeys && typeof msg.coreKeys === 'object') {
+            for (const [channelName, coreKeyHex] of Object.entries(
+              msg.coreKeys
+            )) {
+              if (this.#channelCores.has(channelName) && coreKeyHex) {
+                await this.#openRemoteChannelCore(channelName, coreKeyHex)
+              }
+            }
+          }
+
           this.emit('channel:peer:online', {
             peerId: msg.peerId,
             authorName: msg.authorName,