9965609
@@ -45,6 +45,39 @@
the MCP endpoint and the terminal are for forge accounts.
Everything is real: notes live in SQLite under `FORGE_APP_DATA`. A preview
of a pull gets a copy of production data; production is the default branch.
## Shared folders
A **shared folder** is a folder of a git repository on the forge — say
`docs/` of `ben/brainstorm` — that you and the people you invite write in
together. Everything else in the app stays yours alone: a shared folder's
notes never appear in anyone's own vault, search or graph, and its members
never see yours.
- **Connect one** (app admins): sidebar → *Vaults* → *Share a repo folder*,
  then name, `owner/repo`, branch and folder. It reads the folder at once.
  Use a plain repository, not an app's: every save is a commit.
- **Invite**: the folder's people icon → *Join link*. Anyone signed in (forge
  or email account) who opens it joins. Turn the link off afterwards, make a
  new one, or remove people there. Members can leave.
- **Inside**: the sidebar shows the repo's folder tree. Links, backlinks,
  tags, search, the graph and daily notes work as in your vault, within the
  folder. Name a new note `ideas/Pricing` to put it in `ideas/`; the File
  panel moves a note to another folder. Front matter (`---` … `---`) reads
  as properties, and its `tags` are tags.
- **Git**: every note is a `.md` file. Edits commit a few seconds after you
  stop typing (one commit for a burst, naming who wrote); renames and moves
  move the file; removing a note removes it. Anything pushed to the folder
  (from a laptop, VS Code, Obsidian) shows up within a minute, or at once
  with *Sync now*. A note changed in both places keeps the app's words and
  saves the repository's beside it as `<title> (repo copy)` — nothing is
  lost.
- **Two people, one note**: the second save is refused when the note moved
  on underneath it, and the editor asks: *Load theirs* or *Keep mine*.
Commits are made with `NOTES_REPO_TOKEN` (Settings → App → Environment), a
forge token that may write those repositories; without it there are no
shared folders. Commits are authored as that token's owner.
## Claude can use it too
`POST /mcp` is an MCP server with `list_notes`, `search_notes`,
@@ -2,7 +2,8 @@
  "roles": {
    "anon": { "above": [], "held": { "by": "everyone" } },
    "user": { "above": ["anon"], "held": { "by": "identity", "role": "user" } },
    "author": { "above": ["user"], "held": { "by": "row", "column": "author_id" } },
    "member": { "above": ["user"], "held": { "by": "row", "column": "member_id" } },
    "author": { "above": ["member"], "held": { "by": "row", "column": "author_id" } },
    "admin": { "above": ["user"], "held": { "by": "identity", "role": "admin" } }
  },
  "resources": {
@@ -10,10 +11,10 @@
      "api": "/api/notes",
      "can": {
        "create": "user",
        "read": "author",
        "update": "author",
        "delete": "author",
        "list": "author"
        "read": "member",
        "update": "member",
        "delete": "member",
        "list": "member"
      }
    },
    "audit": {
@@ -8,7 +8,7 @@
  "paths": {
    "/api/notes": {
      "get": {
        "summary": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first.",
        "summary": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first. With `space`, a shared folder's instead.",
        "operationId": "getApiNotes",
        "parameters": [
          {
@@ -20,6 +20,13 @@
              "maximum": 5000
            }
          },
          {
            "name": "space",
            "in": "query",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "q",
            "in": "query",
@@ -31,7 +38,7 @@
        ],
        "responses": {
          "200": {
            "description": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first.",
            "description": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first. With `space`, a shared folder's instead.",
            "content": {
              "application/json": {
                "schema": {
@@ -57,7 +64,7 @@
        "x-contract": {
          "resource": "note",
          "verb": "list",
          "least": "author"
          "least": "member"
        }
      },
      "post": {
@@ -79,6 +86,14 @@
                    "type": "string",
                    "maxLength": 200000,
                    "description": "Markdown."
                  },
                  "space": {
                    "type": "integer",
                    "description": "A shared folder you are in, to add the note there instead of your vault."
                  },
                  "folder": {
                    "type": "string",
                    "description": "In a shared folder: the folder to put it in (`ideas/q4`)."
                  }
                }
              }
@@ -153,7 +168,7 @@
        "x-contract": {
          "resource": "note",
          "verb": "read",
          "least": "author"
          "least": "member"
        }
      },
      "patch": {
@@ -188,6 +203,15 @@
                  },
                  "pinned": {
                    "type": "boolean"
                  },
                  "folder": {
                    "type": "string",
                    "description": "A shared note's folder: moves its file."
                  },
                  "base": {
                    "type": "string",
                    "format": "date-time",
                    "description": "The updated_at you edited from; when someone has saved since, new words are refused with 409."
                  }
                }
              }
@@ -235,6 +259,13 @@
                        "updated_at": {
                          "type": "string",
                          "format": "date-time"
                        },
                        "path": {
                          "type": [
                            "string",
                            "null"
                          ],
                          "description": "A shared folder's note: its file in the repository. Null for a note of your own."
                        }
                      },
                      "required": [
@@ -278,7 +309,7 @@
        "x-contract": {
          "resource": "note",
          "verb": "update",
          "least": "author"
          "least": "member"
        }
      },
      "delete": {
@@ -327,7 +358,7 @@
        "x-contract": {
          "resource": "note",
          "verb": "delete",
          "least": "author"
          "least": "member"
        }
      }
    },
@@ -570,6 +601,13 @@
          "updated_at": {
            "type": "string",
            "format": "date-time"
          },
          "path": {
            "type": [
              "string",
              "null"
            ],
            "description": "A shared folder's note: its file in the repository. Null for a note of your own."
          }
        },
        "required": [
@@ -185,6 +185,7 @@
export async function deleteAccount(
  const notes = db.transaction(() => {
    const gone = db.query("DELETE FROM note WHERE author_id = ?1").run(`acct:${id}`).changes;
    db.query("DELETE FROM session WHERE account_id = ?1").run(id);
    db.query("DELETE FROM space_member WHERE who_id = ?1").run(`acct:${id}`);
    db.query("DELETE FROM account WHERE id = ?1").run(id);
    return gone;
  })();
@@ -10,6 +10,19 @@
import type { Database } from "bun:sqlite";
import { record, type AuditRow } from "./audit.ts";
import { permit } from "./contract.ts";
import { emit } from "./live.ts";
import {
  cleanFolder,
  cleanSegment,
  edited,
  fileOf,
  folderOf,
  getSpace,
  isMember,
  spaceOf,
  spaceVault,
  tellSpace,
  type Space,
} from "./spaces.ts";
import { relink, search } from "./vault.ts";
import type { Who } from "./who.ts";
@@ -22,9 +35,14 @@
export interface Note {
  readonly author_name: string;
  readonly created_at: string;
  readonly updated_at: string;
  /** A shared note's file in its repository; null for a note of your own. */
  readonly path: string | null;
  /** Where the repository last had it, and the git blob it had (src/sync.ts). */
  readonly synced_path: string | null;
  readonly synced_oid: string | null;
}
export type Failure = "signin_required" | "forbidden" | "not_found" | "invalid";
export type Failure = "signin_required" | "forbidden" | "not_found" | "invalid" | "conflict";
export type Result<T> =
  | { ok: true; value: T }
  | { ok: false; error: Failure; message: string };
@@ -67,11 +85,31 @@
const audited = <T extends { readonly id: number }>(
  return result;
};
/** Whose vault a change belongs to: its live events reach only them. */
const tell = (type: string, note: Note): void => {
  emit(type, { id: note.id, title: note.title, updated_at: note.updated_at }, note.author_id);
/** Whose vault a change belongs to: its live events reach only them — or, in a shared folder, its members. */
const tell = (db: Database, type: string, note: Note): void => {
  const data = { id: note.id, title: note.title, updated_at: note.updated_at };
  const space = spaceOf(note.author_id);
  if (space === undefined) emit(type, data, note.author_id);
  else tellSpace(db, space, type, data);
};
/**
 * The vault `who` means: their own, or — named by `space` — a shared
 * folder they are in. Every vault query takes the answer's `vault` where
 * it once took `who.id`, which is all a shared folder needs.
 */
function vaultFor(
  db: Database,
  who: Who,
  space: number | undefined,
): Result<{ vault: string; space?: Space }> {
  if (who.role === "anon") return fail("signin_required", "Sign in to open your notes.");
  if (space === undefined) return ok({ vault: who.id });
  const found = getSpace(db, who, space);
  if (!found.ok) return found;
  return ok({ vault: spaceVault(space), space: found.value });
}
/**
 * A title, as the vault keeps it: trimmed, one line, and free of the
 * characters a [[link]] uses to say something else (`[ ] | # ^`).
@@ -99,7 +137,7 @@
const checkBody = (body: string): Result<string> =>
export function listNotes(
  db: Database,
  who: Who,
  input: { limit?: number } = {},
  input: { limit?: number; space?: number } = {},
): Result<Note[]> {
  const limit = Math.min(
    Math.max(Math.trunc(input.limit ?? VAULT_MAX) || VAULT_MAX, 1),
@@ -108,12 +146,14 @@
export function listNotes(
  const may = permit(who, "note", "list");
  if (may === "no" || who.role === "anon")
    return refuse(who, "Sign in to open your notes.", "You may not see these notes.");
  const vault = vaultFor(db, who, input.space);
  if (!vault.ok) return vault;
  return ok(
    db
      .query<Note, [string, number]>(
        "SELECT * FROM note WHERE author_id = ?1 ORDER BY pinned DESC, updated_at DESC, id DESC LIMIT ?2",
      )
      .all(who.id, limit),
      .all(vault.value.vault, limit),
  );
}
@@ -136,48 +176,85 @@
const titleTaken = (db: Database, authorId: string, title: string, except = -1):
    )
    .get(authorId, title, except) !== null;
export const addNote = (
  db: Database,
  who: Who,
  input: { title?: string; body?: string },
): Result<Note> =>
/** What a new note may say: in a shared folder, also which folder (or a title `folder/Title`). */
export interface NewNote {
  readonly title?: string;
  readonly body?: string;
  readonly space?: number;
  readonly folder?: string;
}
export const addNote = (db: Database, who: Who, input: NewNote): Result<Note> =>
  audited(db, who, "note", "create", undefined, add(db, who, input));
function add(
  db: Database,
  who: Who,
  input: { title?: string; body?: string },
): Result<Note> {
/** A shared note's title and folder: its title is a file name, and `a/b/Title` puts it in a folder. */
function placeOf(input: { title: string; folder?: string }): Result<{ title: string; folder: string }> {
  const cut = input.title.lastIndexOf("/");
  const title = cleanSegment(cut < 0 ? input.title : input.title.slice(cut + 1));
  if (!title.ok) return title;
  const folder = cleanFolder(
    [input.folder ?? "", cut < 0 ? "" : input.title.slice(0, cut)].filter((f) => f !== "").join("/"),
  );
  if (!folder.ok) return folder;
  return ok({ title: title.value, folder: folder.value });
}
function add(db: Database, who: Who, input: NewNote): Result<Note> {
  // The table decides; the type only learns it here: whoever may create is
  // signed in, and carries a name to write beside the note.
  if (who.role === "anon" || permit(who, "note", "create") !== "yes")
    return refuse(who, "Sign in to add a note.", "You may not add a note.");
  const where = vaultFor(db, who, input.space);
  if (!where.ok) return where;
  const { vault, space } = where.value;
  const body = checkBody(input.body ?? "");
  if (!body.ok) return body;
  const count = db
    .query<{ n: number }, [string]>("SELECT count(*) AS n FROM note WHERE author_id = ?1")
    .get(who.id)!.n;
    .get(vault)!.n;
  if (count >= VAULT_MAX)
    return fail("invalid", `A vault holds at most ${VAULT_MAX.toLocaleString("en")} notes.`);
  let title: string;
  if (input.title === undefined || input.title.trim() === "")
    title = freeTitle(db, who.id, "Untitled");
  else {
  let folder = "";
  if (input.title === undefined || input.title.trim() === "" || input.title.trim().endsWith("/")) {
    if (space !== undefined) {
      const at = cleanFolder(`${input.folder ?? ""}/${input.title ?? ""}`);
      if (!at.ok) return at;
      folder = at.value;
    }
    title = freeTitle(db, vault, "Untitled");
  } else if (space !== undefined) {
    const place = placeOf({ title: input.title, ...(input.folder === undefined ? {} : { folder: input.folder }) });
    if (!place.ok) return place;
    title = place.value.title;
    folder = place.value.folder;
  } else {
    const clean = cleanTitle(input.title);
    if (!clean.ok) return clean;
    if (titleTaken(db, who.id, clean.value))
      return fail("invalid", `A note called “${clean.value}” already exists.`);
    title = clean.value;
  }
  if (titleTaken(db, vault, title))
    return fail("invalid", `A note called “${title}” already exists.`);
  const path = space === undefined ? null : fileOf(space, folder, title);
  if (path !== null && pathTaken(db, vault, path))
    return fail("invalid", `There is already a file at ${path}.`);
  const note = db
    .query<Note, [string, string, string, string]>(
      "INSERT INTO note (title, body, author_id, author_name) VALUES (?1, ?2, ?3, ?4) RETURNING *",
    .query<Note, [string, string, string, string, string | null]>(
      "INSERT INTO note (title, body, author_id, author_name, path) VALUES (?1, ?2, ?3, ?4, ?5) RETURNING *",
    )
    .get(title, body.value, who.id, who.name)!;
  tell("note.added", note);
    .get(title, body.value, vault, who.name, path)!;
  tell(db, "note.added", note);
  if (space !== undefined) edited(space.id);
  return ok(note);
}
const pathTaken = (db: Database, vault: string, path: string, except = -1): boolean =>
  db
    .query<{ id: number }, [string, string, number]>(
      "SELECT id FROM note WHERE author_id = ?1 AND path = ?2 COLLATE NOCASE AND id != ?3",
    )
    .get(vault, path, except) !== null;
/**
 * One note, for `who` to do `verb` to. The door is asked before the row is
 * looked for, so whoever may not is told that and never learns whether the
@@ -196,8 +273,17 @@
function noteFor(
  // With no row to show, the door is asked about a row of their own: whoever
  // could not pass even then is refused, and learns nothing about what
  // exists; whoever could is told there is no such note.
  // A shared note is its folder's: whoever is in the folder is the row's
  // member, which is what the table gives a shared note's verbs to.
  const space = note === null ? undefined : spaceOf(note.author_id);
  const row: Readonly<Record<string, unknown>> =
    note === null ? { author_id: who.role === "anon" ? null : who.id } : { ...note };
    note === null
      ? { author_id: who.role === "anon" ? null : who.id }
      : {
          ...note,
          member_id:
            space !== undefined && who.role !== "anon" && isMember(db, space, who) ? who.id : null,
        };
  if (permit(who, "note", verb, row) !== "yes")
    return refuse(who, said.signIn, said.no);
  if (note !== null) return ok(note);
@@ -217,20 +303,22 @@
export function getNote(
  });
}
/** A note in the asker's vault by its title, any case. */
/** A note in the asker's vault (or a shared folder of theirs) by its title, any case. */
export function findNote(
  db: Database,
  who: Who,
  input: { title: string },
  input: { title: string; space?: number },
): Result<Note> {
  if (who.role === "anon")
    return fail("signin_required", "Sign in to open your notes.");
  const title = input.title.replace(/\s+/g, " ").trim();
  const where = vaultFor(db, who, input.space);
  if (!where.ok) return where;
  // In a shared folder `ideas/Pricing` names the note Pricing.
  const raw = input.space === undefined ? input.title : input.title.slice(input.title.lastIndexOf("/") + 1);
  const title = raw.replace(/\s+/g, " ").trim();
  const note = db
    .query<Note, [string, string]>(
      "SELECT * FROM note WHERE author_id = ?1 AND title = ?2 COLLATE NOCASE",
    )
    .get(who.id, title);
    .get(where.value.vault, title);
  if (note === null) return fail("not_found", `No note called “${title}”.`);
  return getNote(db, who, { id: note.id });
}
@@ -239,12 +327,12 @@
export function findNote(
export function openOrCreate(
  db: Database,
  who: Who,
  input: { title: string; body?: string },
  input: { title: string; body?: string; space?: number; folder?: string },
): Result<Note & { created: boolean }> {
  const found = findNote(db, who, input);
  if (found.ok) return ok({ ...found.value, created: false });
  if (found.error !== "not_found") return found;
  const made = addNote(db, who, { title: input.title, body: input.body ?? "" });
  const made = addNote(db, who, { ...input, body: input.body ?? "" });
  return made.ok ? ok({ ...made.value, created: true }) : made;
}
@@ -253,6 +341,14 @@
export interface Change {
  readonly title?: string;
  readonly body?: string;
  readonly pinned?: boolean;
  /** A shared note's folder, relative to its space's: a move. */
  readonly folder?: string;
  /**
   * The `updated_at` the change was written against. When the note has
   * moved on since — someone else saved it — new words or a new title are
   * refused as a `conflict` rather than written over theirs.
   */
  readonly base?: string;
}
export const updateNote = (
@@ -278,9 +374,19 @@
function update(
  });
  if (!found.ok) return found;
  const before = found.value;
  const spaceId = spaceOf(before.author_id);
  const space = spaceId === undefined ? undefined : getSpace(db, who, spaceId);
  if (space !== undefined && !space.ok) return space;
  if (
    input.base !== undefined &&
    input.base !== before.updated_at &&
    ((input.body !== undefined && input.body !== before.body) ||
      (input.title !== undefined && input.title !== before.title))
  )
    return fail("conflict", `${before.author_name} saved this note while you were writing.`);
  let title = before.title;
  if (input.title !== undefined) {
    const clean = cleanTitle(input.title);
    const clean = space === undefined ? cleanTitle(input.title) : cleanSegment(input.title);
    if (!clean.ok) return clean;
    if (titleTaken(db, before.author_id, clean.value, before.id))
      return fail("invalid", `A note called “${clean.value}” already exists.`);
@@ -293,17 +399,43 @@
function update(
    body = checked.value;
  }
  const pinned = input.pinned === undefined ? before.pinned : input.pinned ? 1 : 0;
  if (title === before.title && body === before.body && pinned === before.pinned)
  // A shared note's file follows its title, and its folder when it moves.
  let path = before.path;
  if (space !== undefined && before.path !== null) {
    let folder = folderOf(space.value, before.path);
    if (input.folder !== undefined) {
      const clean = cleanFolder(input.folder);
      if (!clean.ok) return clean;
      folder = clean.value;
    }
    // A file whose name was never its title (two files of one name, read
    // from the repository) keeps its name until it is renamed or moved.
    path =
      title === before.title && input.folder === undefined ? before.path : fileOf(space.value, folder, title);
    if (path !== before.path && pathTaken(db, before.author_id, path, before.id))
      return fail("invalid", `There is already a file at ${path}.`);
  }
  if (title === before.title && body === before.body && pinned === before.pinned && path === before.path)
    return ok({ ...before, relinked: 0 });
  const renamed = title.toLowerCase() !== before.title.toLowerCase();
  const touched: Note[] = [];
  // In a shared folder the name beside a note is whoever wrote in it last.
  const by = space !== undefined && who.role !== "anon" ? who.name : before.author_name;
  const note = db.transaction(() => {
    const saved = db
      .query<Note, [string, string, number, number, number]>(
        // A pin is not an edit: only new words or a new title move a note up by recency.
        "UPDATE note SET title = ?1, body = ?2, pinned = ?3, updated_at = CASE WHEN ?5 THEN strftime('%Y-%m-%dT%H:%M:%fZ', 'now') ELSE updated_at END WHERE id = ?4 RETURNING *",
      .query<Note, [string, string, number, number, number, string | null, string]>(
        // A pin is not an edit: only new words, a new title or a move move a note up by recency.
        "UPDATE note SET title = ?1, body = ?2, pinned = ?3, path = ?6, author_name = CASE WHEN ?5 THEN ?7 ELSE author_name END, updated_at = CASE WHEN ?5 THEN strftime('%Y-%m-%dT%H:%M:%fZ', 'now') ELSE updated_at END WHERE id = ?4 RETURNING *",
      )
      .get(title, body, pinned, before.id, title !== before.title || body !== before.body ? 1 : 0)!;
      .get(
        title,
        body,
        pinned,
        before.id,
        title !== before.title || body !== before.body || path !== before.path ? 1 : 0,
        path,
        by,
      )!;
    if (renamed || title !== before.title)
      for (const other of db
        .query<Note, [string, number]>("SELECT * FROM note WHERE author_id = ?1 AND id != ?2")
@@ -320,8 +452,9 @@
function update(
      }
    return saved;
  })();
  tell("note.changed", note);
  for (const other of touched) tell("note.changed", other);
  tell(db, "note.changed", note);
  for (const other of touched) tell(db, "note.changed", other);
  if (spaceId !== undefined) edited(spaceId);
  return ok({ ...note, relinked: touched.length });
}
@@ -342,18 +475,29 @@
function remove(
    no: "Only the author can remove a note.",
  });
  if (!found.ok) return found;
  db.query("DELETE FROM note WHERE id = ?1").run(found.value.id);
  emit("note.removed", { id: found.value.id }, found.value.author_id);
  return ok({ id: found.value.id });
  const note = found.value;
  const space = spaceOf(note.author_id);
  db.transaction(() => {
    db.query("DELETE FROM note WHERE id = ?1").run(note.id);
    // The repository still has its file until the next commit takes it away.
    if (space !== undefined && note.synced_path !== null)
      db.query("INSERT OR IGNORE INTO space_gone (space_id, path) VALUES (?1, ?2)").run(space, note.synced_path);
  })();
  if (space === undefined) emit("note.removed", { id: note.id }, note.author_id);
  else {
    tellSpace(db, space, "note.removed", { id: note.id });
    edited(space);
  }
  return ok({ id: note.id });
}
/** Search the asker's vault (see `vault.search` for the language). */
export function searchNotes(
  db: Database,
  who: Who,
  input: { q: string; limit?: number },
  input: { q: string; limit?: number; space?: number },
): Result<{ id: number; title: string; snippet: string; updated_at: string }[]> {
  const vault = listNotes(db, who);
  const vault = listNotes(db, who, input.space === undefined ? {} : { space: input.space });
  if (!vault.ok) return vault;
  const limit = Math.min(Math.max(Math.trunc(input.limit ?? 50) || 50, 1), 500);
  return ok(
@@ -73,6 +73,45 @@
export const migrations: string[] = [
    expires_at TEXT NOT NULL
  )`,
  `CREATE INDEX session_account ON session (account_id)`,
  // Shared folders (src/spaces.ts): a folder of a git repository that its
  // members write in together. Its notes are ordinary notes whose vault is
  // the space — author_id `space:<id>` — so every vault query holds as it
  // is; `path` is the note's file in the repository, and the synced_* pair
  // is what the repository last had (src/sync.ts), so a difference is an
  // edit not committed yet.
  `CREATE TABLE space (
    id INTEGER PRIMARY KEY,
    name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 80),
    repo TEXT NOT NULL,
    branch TEXT NOT NULL,
    folder TEXT NOT NULL,
    owner_id TEXT NOT NULL,
    owner_name TEXT NOT NULL,
    join_code TEXT UNIQUE,
    head TEXT,
    synced_at TEXT,
    sync_error TEXT,
    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
  )`,
  `CREATE TABLE space_member (
    space_id INTEGER NOT NULL REFERENCES space (id) ON DELETE CASCADE,
    who_id TEXT NOT NULL,
    who_name TEXT NOT NULL,
    joined_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
    PRIMARY KEY (space_id, who_id)
  )`,
  `CREATE INDEX space_member_who ON space_member (who_id)`,
  `ALTER TABLE note ADD COLUMN path TEXT`,
  `ALTER TABLE note ADD COLUMN synced_path TEXT`,
  `ALTER TABLE note ADD COLUMN synced_oid TEXT`,
  `CREATE UNIQUE INDEX note_path ON note (author_id, path) WHERE path IS NOT NULL`,
  // A shared note removed here whose file the repository still has: the
  // next commit deletes it.
  `CREATE TABLE space_gone (
    space_id INTEGER NOT NULL REFERENCES space (id) ON DELETE CASCADE,
    path TEXT NOT NULL,
    PRIMARY KEY (space_id, path)
  )`,
];
export function openDb(dir = dataDir): Database {
@@ -30,3 +30,11 @@
export const publicOrigin: string = new URL(
export const forgeUrl: string | undefined = process.env.FORGE_URL;
/** The key the forge signs identities with (`who.ts`). Unset, everyone is anonymous. */
export const identityKey: string = process.env.FORGE_APP_IDENTITY_KEY ?? "";
/** The forge's JSON API, for shared folders (`src/sync.ts`). */
export const forgeApi: string | undefined =
  process.env.FORGE_API_URL ?? (forgeUrl === undefined ? undefined : `${forgeUrl.replace(/\/+$/, "")}/api/v1`);
/**
 * A forge token that may write the repositories shared folders keep their
 * notes in (Settings → App → Environment). Unset, there are no shared folders.
 */
export const repoToken: string | undefined = process.env.NOTES_REPO_TOKEN?.trim() || undefined;
@@ -8,8 +8,10 @@
import { isAccount, type Account } from "./accounts.ts";
import { canDelete, type Note } from "./actions.ts";
import { commit, description, env, publicOrigin, title, where } from "./env.ts";
import { commit, description, env, forgeUrl, publicOrigin, title, where } from "./env.ts";
import { asset, escape } from "./http.ts";
import { folderOf, spaceHref, type Member, type Space } from "./spaces.ts";
import { unsynced } from "./sync.ts";
import { token, tokensHref } from "./tokens.ts";
import {
  backlinks,
@@ -29,7 +31,7 @@
import type { Who } from "./who.ts";
const data = (id: string, value: unknown, live = ""): string =>
  `<script type="application/json" id="${id}"${live ? ` data-live="${live}"` : ""}>${JSON.stringify(value).replace(/</g, "\\u003c")}</script>`;
const CHANGES = "note.added note.removed note.changed";
const CHANGES = "note.added note.removed note.changed space.changed space.synced";
/**
 * The frame every page shares: the tokens and the look, and what a link
@@ -73,7 +75,8 @@
${body}
}
/** Signed out: what this is, and the ways in. */
export function landing(notice?: string): string {
export function landing(notice?: string, to = "/"): string {
  const next = to === "/" ? "" : `?to=${encodeURIComponent(to)}`;
  return layout(
    `<div class="landing">
  <div class="landing-card">
@@ -81,10 +84,10 @@
export function landing(notice?: string): string {
    <h1>${escape(title)}</h1>
    <p class="lede">A private vault for your thinking. Markdown notes, linked with <code>[[double brackets]]</code>, with backlinks, tags and a graph of how it all connects.</p>
    <div class="row center">
      <a class="button button-big" href="/signup">Create your vault</a>
      <a class="button button-big button-quiet" href="/login">Log in</a>
      <a class="button button-big" href="/signup${next}">Create your vault</a>
      <a class="button button-big button-quiet" href="/login${next}">Log in</a>
    </div>
    <p class="muted small">Have a forge account? <a href="/__forge/signin?to=/">Sign in with the forge</a>.</p>
    <p class="muted small">Have a forge account? <a href="/__forge/signin?to=${escape(to)}">Sign in with the forge</a>.</p>
    <p class="muted small">Your notes are yours alone — nobody else who uses this app can read them.</p>
  </div>
  ${toast(notice)}
@@ -101,11 +104,16 @@
export function authPage(input: {
  email?: string;
  name?: string;
  needsCode: boolean;
  /** Where to land afterwards: a join link, when that is what brought them. */
  to?: string;
}): string {
  const signup = input.mode === "signup";
  const to = input.to ?? "/";
  const next = to === "/" ? "" : `?to=${encodeURIComponent(to)}`;
  return layout(
    `<div class="landing">
  <form class="landing-card auth" method="post" action="/${input.mode}">
    ${to === "/" ? "" : `<input type="hidden" name="to" value="${escape(to)}">`}
    <a class="mark" href="/" aria-label="Back">${glyph}</a>
    <h1>${signup ? "Create your vault" : "Welcome back"}</h1>
    ${input.notice === undefined ? "" : `<p class="auth-error" role="alert">${escape(input.notice)}</p>`}
@@ -115,7 +123,7 @@
export function authPage(input: {
    ${signup && input.needsCode ? `<label class="field"><span>Sign-up code</span><input class="input" name="code" required autocomplete="off"></label>` : ""}
    ${signup ? `<p class="muted small">At least 8 characters. There's no email reset, so keep it somewhere safe.</p>` : ""}
    <button class="button button-big button-wide">${signup ? "Create account" : "Log in"}</button>
    <p class="muted small">${signup ? `Already have one? <a href="/login">Log in</a>` : `New here? <a href="/signup">Create a vault</a>`} · <a href="/__forge/signin?to=/">Forge sign-in</a></p>
    <p class="muted small">${signup ? `Already have one? <a href="/login${next}">Log in</a>` : `New here? <a href="/signup${next}">Create a vault</a>`} · <a href="/__forge/signin?to=${escape(to)}">Forge sign-in</a></p>
  </form>
</div>`,
    `/${input.mode}`,
@@ -140,14 +148,70 @@
const icon = {
  theme: `<svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="8"/><path d="M12 4a8 8 0 0 0 0 16z" fill="currentColor"/></svg>`,
  user: `<svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="8" r="4"/><path d="M4 21c1.5-4 4.5-6 8-6s6.5 2 8 6"/></svg>`,
  download: `<svg viewBox="0 0 24 24" aria-hidden="true"><path d="M12 4v11M7 10l5 5 5-5M5 20h14"/></svg>`,
  folder: `<svg viewBox="0 0 24 24" aria-hidden="true"><path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/></svg>`,
  people: `<svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="9" cy="8" r="3.2"/><circle cx="17" cy="9" r="2.6"/><path d="M3 20c1-3.5 3.4-5 6-5s5 1.5 6 5M15 15.3c2.6-.4 4.8 1 5.6 3.7"/></svg>`,
  gear: `<svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="3"/><path d="M12 3v3M12 18v3M3 12h3M18 12h3M5.6 5.6l2.1 2.1M16.3 16.3l2.1 2.1M5.6 18.4l2.1-2.1M16.3 7.7l2.1-2.1"/></svg>`,
};
interface Shell {
export interface Shell {
  readonly who: Who & { role: "user" | "admin" };
  readonly vault: readonly Note[];
  readonly active?: Note | undefined;
  readonly notice?: string | undefined;
  readonly query?: string;
  /** The shared folder this page is in; none for your own vault. */
  readonly space?: Space | undefined;
  /** Every shared folder you are in, for the switcher. */
  readonly spaces: readonly Space[];
}
/** Where a vault's own pages are: `""` for yours, `/s/<id>` for a shared folder. */
const baseOf = (s: Pick<Shell, "space">): string => (s.space === undefined ? "" : spaceHref(s.space.id));
/** What the vault is called in a page's crumbs. */
const vaultName = (s: Pick<Shell, "space">): string => (s.space === undefined ? "Vault" : s.space.name);
/** The switcher: your vault, then every shared folder you are in. */
function vaults(s: Shell): string {
  if (s.spaces.length === 0 && s.who.role !== "admin") return "";
  const row = (href: string, label: string, here: boolean, glyphs: string) =>
    `<li><a class="file${here ? " is-active" : ""}" href="${href}"${here ? ' aria-current="true"' : ""}><span class="file-title">${glyphs}${escape(label)}</span></a></li>`;
  return `<p class="section">Vaults</p><ul class="file-list vaults">
    ${row("/", "My notes", s.space === undefined, "")}
    ${s.spaces.map((sp) => row(spaceHref(sp.id), sp.name, s.space?.id === sp.id, icon.folder)).join("")}
    ${s.who.role === "admin" ? `<li><a class="file muted" href="/spaces/new"><span class="file-title">${icon.plus}Share a repo folder</span></a></li>` : ""}
  </ul>`;
}
/** A shared folder's notes as its folders hold them: a tree, folders first, A to Z. */
function tree(s: Shell, row: (n: Note) => string): string {
  interface Dir { dirs: Map<string, Dir>; notes: Note[] }
  const root: Dir = { dirs: new Map(), notes: [] };
  for (const n of s.vault) {
    let at = root;
    const folder = n.path === null || s.space === undefined ? "" : folderOf(s.space, n.path);
    for (const part of folder === "" ? [] : folder.split("/")) {
      if (!at.dirs.has(part)) at.dirs.set(part, { dirs: new Map(), notes: [] });
      at = at.dirs.get(part)!;
    }
    at.notes.push(n);
  }
  const holds = (d: Dir): boolean => d.notes.some((n) => n.id === s.active?.id) || [...d.dirs.values()].some(holds);
  const draw = (d: Dir, path: string): string =>
    `${[...d.dirs]
      .sort(([a], [b]) => a.localeCompare(b))
      .map(
        ([name, sub]) =>
          `<li><details class="folder" data-folder="${escape(path + name)}"${holds(sub) || sub.dirs.size + sub.notes.length < 12 ? " open" : ""}><summary>${icon.folder}<span>${escape(name)}</span></summary><ul class="file-list">${draw(sub, `${path}${name}/`)}</ul></details></li>`,
      )
      .join("")}${[...d.notes].sort((a, b) => a.title.localeCompare(b.title)).map(row).join("")}`;
  return `<ul class="file-list">${draw(root, "")}</ul>`;
}
/** How a shared folder stands with its repository, for the foot of the sidebar. */
function syncLine(space: Space): string {
  const repo = forgeUrl === undefined ? escape(space.repo) : `<a href="${escape(`${forgeUrl.replace(/\/+$/, "")}/${space.repo}`)}" target="_blank" rel="noopener noreferrer">${escape(space.repo)}</a>`;
  const when = space.synced_at === null ? "not synced yet" : `synced ${ago(space.synced_at)}${ago(space.synced_at) === "now" ? "" : " ago"}`;
  return `<p class="sync-line small${space.sync_error === null ? " muted" : " is-error"}" title="${escape(space.sync_error ?? `${space.branch}:${space.folder || "/"}`)}">${repo}/${escape(space.folder)} · ${space.sync_error === null ? when : "sync failed — see settings"}</p>`;
}
/** The left: making notes, finding them, and every one of them. */
@@ -157,30 +221,42 @@
function left(s: Shell): string {
  const row = (n: Note) =>
    `<li><a class="file${s.active?.id === n.id ? " is-active" : ""}" href="${hrefOf(n)}"${s.active?.id === n.id ? ' aria-current="page"' : ""} data-title="${escape(n.title.toLowerCase())}"><span class="file-title">${escape(n.title)}</span><time class="file-when" datetime="${escape(n.updated_at)}">${ago(n.updated_at)}</time></a></li>`;
  const tagList = tagCounts(s.vault);
  return `<aside class="left" id="left" aria-label="Your notes">
  const base = baseOf(s);
  return `<aside class="left" id="left" aria-label="${s.space === undefined ? "Your notes" : escape(s.space.name)}">
  <div class="left-head">
    <a class="brand" href="/">${glyph}<span>${escape(title)}</span></a>
    <button type="button" class="icon-button" data-action="theme" aria-label="Switch theme" title="Theme">${icon.theme}</button>
  </div>
  <div class="actions">
    <form method="post" action="/new"><button class="button button-wide" title="New note (Alt N)">${icon.plus}<span>New note</span></button></form>
    <form method="post" action="/daily"><input type="hidden" name="tz" value="0"><button class="icon-button" aria-label="Today's note" title="Today's note (⌘⇧D)">${icon.today}</button></form>
    <a class="icon-button" href="/graph" aria-label="Graph" title="Graph (⌘G)">${icon.graph}</a>
    <form method="post" action="${base}/new">${s.space !== undefined && s.active?.path ? `<input type="hidden" name="folder" value="${escape(folderOf(s.space, s.active.path))}">` : ""}<button class="button button-wide" title="New note (Alt N)">${icon.plus}<span>New note</span></button></form>
    <form method="post" action="${base}/daily" data-daily><input type="hidden" name="tz" value="0"><button class="icon-button" aria-label="Today's note" title="Today's note (⌘⇧D)">${icon.today}</button></form>
    <a class="icon-button" href="${base}/graph" aria-label="Graph" title="Graph (⌘G)">${icon.graph}</a>
    ${s.space === undefined ? "" : `<a class="icon-button" href="${base}/settings" aria-label="Sharing and sync" title="Sharing and sync">${icon.people}</a>`}
  </div>
  <form class="find" method="get" action="/search" role="search">
  <form class="find" method="get" action="${base}/search" role="search">
    ${icon.search}
    <input class="input input-find" type="search" name="q" value="${escape(s.query ?? "")}" placeholder="Search or filter…" aria-label="Search notes" autocomplete="off" data-filter>
    <kbd class="hint">⌘K</kbd>
  </form>
  <nav class="files" id="files" data-live="${CHANGES}">
    ${vaults(s)}
    ${s.vault.length === 0 ? `<p class="muted small pad">No notes yet.</p>` : ""}
    ${pinned.length > 0 ? `<p class="section">Pinned</p><ul class="file-list">${pinned.map(row).join("")}</ul>` : ""}
    ${rest.length > 0 ? `<p class="section">${pinned.length > 0 ? "Notes" : `Notes <span class="count">${rest.length}</span>`}</p><ul class="file-list">${rest.map(row).join("")}</ul>` : ""}
    ${tagList.length > 0 ? `<p class="section">Tags</p><div class="tag-cloud">${tagList.map((t) => `<a class="tag" href="/search?q=${encodeURIComponent(`#${t.tag}`)}">#${escape(t.tag)}<span class="count">${t.count}</span></a>`).join("")}</div>` : ""}
    ${
      s.space !== undefined
        ? s.vault.length > 0
          ? `<p class="section">Files <span class="count">${s.vault.length}</span></p>${tree(s, row)}`
          : ""
        : rest.length > 0
          ? `<p class="section">${pinned.length > 0 ? "Notes" : `Notes <span class="count">${rest.length}</span>`}</p><ul class="file-list">${rest.map(row).join("")}</ul>`
          : ""
    }
    ${tagList.length > 0 ? `<p class="section">Tags</p><div class="tag-cloud">${tagList.map((t) => `<a class="tag" href="${base}/search?q=${encodeURIComponent(`#${t.tag}`)}">#${escape(t.tag)}<span class="count">${t.count}</span></a>`).join("")}</div>` : ""}
    ${s.space === undefined ? "" : syncLine(s.space)}
  </nav>
  <div class="left-foot">
    <span class="you" title="${escape(where)}${commit ? ` · ${escape(commit)}` : ""}">${escape(s.who.name)}${env === "production" ? "" : ` · <span class="pill">${escape(where)}</span>`}</span>
    <a class="icon-button" href="/export" aria-label="Download every note" title="Download everything">${icon.download}</a>
    ${s.space === undefined ? `<a class="icon-button" href="/export" aria-label="Download every note" title="Download everything">${icon.download}</a>` : ""}
    ${
      isAccount(s.who)
        ? `<a class="icon-button" href="/account" aria-label="Your account" title="Account">${icon.user}</a><form method="post" action="/logout"><button class="button button-quiet">Log out</button></form>`
@@ -191,7 +267,9 @@
function left(s: Shell): string {
}
/** The right: the note's shape and its neighbours. */
function right(note: Note, vault: readonly Note[]): string {
function right(s: Shell, note: Note): string {
  const vault = s.vault;
  const base = baseOf(s);
  const outline = headings(note.body);
  const back = backlinks(note, vault);
  const out = outgoing(note, vault);
@@ -214,10 +292,11 @@
function right(note: Note, vault: readonly Note[]): string {
  </section>
  <section class="panel">
    <h2 class="section">Links <span class="count">${out.found.length + out.missing.length}</span></h2>
    ${out.found.length + out.missing.length === 0 ? `<p class="muted small">No links out.</p>` : `<ul class="link-list">${out.found.map((n) => `<li><a href="${hrefOf(n)}">${escape(n.title)}</a></li>`).join("")}${out.missing.map((t) => `<li><a class="unresolved" href="/open?title=${encodeURIComponent(t)}" data-title="${escape(t)}">${escape(t)}</a></li>`).join("")}</ul>`}
    ${out.found.length + out.missing.length === 0 ? `<p class="muted small">No links out.</p>` : `<ul class="link-list">${out.found.map((n) => `<li><a href="${hrefOf(n)}">${escape(n.title)}</a></li>`).join("")}${out.missing.map((t) => `<li><a class="unresolved" href="${base}/open?title=${encodeURIComponent(t)}" data-title="${escape(t)}">${escape(t)}</a></li>`).join("")}</ul>`}
  </section>
  ${outline.length > 0 ? `<section class="panel"><h2 class="section">Outline</h2><ol class="outline">${outline.map((h) => `<li class="depth-${Math.min(h.level - 1, 5)}"><a href="#${escape(h.id)}">${escape(h.text)}</a></li>`).join("")}</ol></section>` : ""}
  ${mine.length > 0 ? `<section class="panel"><h2 class="section">Tags</h2><div class="tag-cloud">${mine.map((t) => `<a class="tag" href="/search?q=${encodeURIComponent(`#${t}`)}">#${escape(t)}</a>`).join("")}</div></section>` : ""}
  ${mine.length > 0 ? `<section class="panel"><h2 class="section">Tags</h2><div class="tag-cloud">${mine.map((t) => `<a class="tag" href="${base}/search?q=${encodeURIComponent(`#${t}`)}">#${escape(t)}</a>`).join("")}</div></section>` : ""}
  ${s.space === undefined || note.path === null ? "" : filepanel(s.space, note as Note & { path: string })}
  <section class="panel meta muted small">
    <p>Created <time datetime="${escape(note.created_at)}">${long(note.created_at)}</time></p>
    <p>${words(note.body)} words · ${note.body.length.toLocaleString("en")} characters</p>
@@ -241,7 +320,7 @@
function shell(s: Shell, center: string, rightSide = ""): string {
  </div>
</div>
<ul class="suggest" id="suggest" role="listbox" hidden></ul>
${data("vault", s.vault.map((n) => ({ id: n.id, title: n.title, updated_at: n.updated_at })), CHANGES)}
${data("vault", s.vault.map((n) => ({ id: n.id, title: n.title, updated_at: n.updated_at })), CHANGES).replace(' id="vault"', ` id="vault" data-base="${baseOf(s)}"${s.space === undefined ? "" : ` data-space="${s.space.id}"`}`)}
${toast(s.notice)}`;
}
@@ -255,6 +334,7 @@
const toolbar = (s: Shell, crumbs: string, tools = ""): string => `<header class
/** One note, open: the editor and the reading view side by side. */
export function notePage(s: Shell & { active: Note }): string {
  const note = s.active;
  const base = baseOf(s);
  const tools = `<div class="segmented" role="group" aria-label="View">
      <button type="button" data-mode="edit" aria-pressed="false" title="Edit">Edit</button>
      <button type="button" data-mode="split" aria-pressed="false" title="Edit and read side by side" class="only-wide">Split</button>
@@ -264,19 +344,21 @@
export function notePage(s: Shell & { active: Note }): string {
    <form method="post" action="/n/${note.id}/pin"><input type="hidden" name="pinned" value="${note.pinned === 1 ? "0" : "1"}"><button class="icon-button${note.pinned === 1 ? " is-on" : ""}" aria-label="${note.pinned === 1 ? "Unpin" : "Pin"}" title="${note.pinned === 1 ? "Unpin" : "Pin to the top"}" aria-pressed="${note.pinned === 1}">${icon.pin}</button></form>
    <a class="icon-button" href="/n/${note.id}/raw" aria-label="Download as markdown" title="Download .md">${icon.download}</a>
    ${canDelete(s.who, note) ? `<form method="post" action="/n/${note.id}/delete" data-confirm="Delete “${escape(note.title)}”? This cannot be undone."><button class="icon-button danger" aria-label="Delete note" title="Delete">${icon.trash}</button></form>` : ""}`;
  const center = `${toolbar(s, `<a href="/">Vault</a><span aria-hidden="true">/</span><span class="crumb-here">${escape(note.title)}</span>`, tools)}
  const folder = s.space === undefined || note.path === null ? "" : folderOf(s.space, note.path);
  const crumbs = [`<a href="${base || "/"}">${escape(vaultName(s))}</a>`, ...(folder === "" ? [] : folder.split("/").map((f) => `<span>${escape(f)}</span>`)), `<span class="crumb-here">${escape(note.title)}</span>`].join(`<span aria-hidden="true">/</span>`);
  const center = `${toolbar(s, crumbs, tools)}
  <form class="editor" id="editor" method="post" action="/n/${note.id}" data-id="${note.id}" data-updated="${escape(note.updated_at)}">
    <div class="sheet">
      <input class="title-input" id="title" name="title" value="${escape(note.title)}" aria-label="Title" maxlength="200" autocomplete="off" spellcheck="false">
      <div class="panes" id="panes" data-mode="${note.body.trim() === "" ? "edit" : "split"}">
        <textarea class="source" id="source" name="body" aria-label="Note, in markdown" placeholder="Start writing. [[Link]] other notes, #tag this one…" spellcheck="true">${escape(note.body)}</textarea>
        <article class="md preview" id="preview" aria-label="Reading view">${renderNote(note.body, s.vault) || `<p class="muted">Nothing here yet.</p>`}</article>
        <article class="md preview" id="preview" aria-label="Reading view">${renderNote(note.body, s.vault, base) || `<p class="muted">Nothing here yet.</p>`}</article>
      </div>
      <noscript><p class="row"><button class="button">Save</button></p></noscript>
    </div>
  </form>
  ${graphData(s.vault)}`;
  return layout(shell(s, center, right(note, s.vault)), hrefOf(note), {
  return layout(shell(s, center, right(s, note)), hrefOf(note), {
    name: note.title,
    kind: "page app-page",
    scripts: ["app.js", "graph.js"],
@@ -285,6 +367,7 @@
export function notePage(s: Shell & { active: Note }): string {
/** An empty vault: two ways to begin. */
export function emptyPage(s: Shell): string {
  if (s.space !== undefined) return emptySpace(s, s.space);
  const center = `${toolbar(s, `<span class="crumb-here">Vault</span>`)}
  <div class="empty-state">
    <div class="mark" aria-hidden="true">${glyph}</div>
@@ -300,13 +383,14 @@
export function emptyPage(s: Shell): string {
/** A link to a note that isn't written yet. */
export function missingPage(s: Shell & { title: string }): string {
  const center = `${toolbar(s, `<a href="/">Vault</a><span aria-hidden="true">/</span><span class="crumb-here">${escape(s.title)}</span>`)}
  const base = baseOf(s);
  const center = `${toolbar(s, `<a href="${base || "/"}">${escape(vaultName(s))}</a><span aria-hidden="true">/</span><span class="crumb-here">${escape(s.title)}</span>`)}
  <div class="empty-state">
    <h1>“${escape(s.title)}” doesn't exist yet</h1>
    <p class="muted">A link points here, but nothing's been written.</p>
    <form method="post" action="/open"><input type="hidden" name="title" value="${escape(s.title)}"><button class="button button-big">Create it</button></form>
    <form method="post" action="${base}/open"><input type="hidden" name="title" value="${escape(s.title)}"><button class="button button-big">Create it</button></form>
  </div>`;
  return layout(shell(s, center), "/open", { name: s.title, kind: "page app-page", scripts: ["app.js"] });
  return layout(shell(s, center), `${base}/open`, { name: s.title, kind: "page app-page", scripts: ["app.js"] });
}
/** What a search found. */
@@ -324,25 +408,25 @@
export function searchPage(s: Shell & { query: string; hits: readonly Hit<Note>[
    }
    return html;
  };
  const center = `${toolbar(s, `<a href="/">Vault</a><span aria-hidden="true">/</span><span class="crumb-here">Search</span>`)}
  const center = `${toolbar(s, `<a href="${baseOf(s) || "/"}">${escape(vaultName(s))}</a><span aria-hidden="true">/</span><span class="crumb-here">Search</span>`)}
  <div class="sheet results">
    <h1 class="results-head">${s.hits.length} ${s.hits.length === 1 ? "note" : "notes"} for <q>${escape(s.query)}</q></h1>
    ${s.hits.length === 0 ? `<p class="muted">Nothing matches. Try fewer words, or <code>#tag</code>.</p>` : `<ul class="hits">${s.hits.map((h) => `<li><a href="${hrefOf(h.note)}"><b>${mark(h.note.title)}</b><span class="muted">${mark(h.snippet)}</span></a></li>`).join("")}</ul>`}
  </div>`;
  return layout(shell(s, center), "/search", { name: `Search: ${s.query}`, kind: "page app-page", scripts: ["app.js"] });
  return layout(shell(s, center), `${baseOf(s)}/search`, { name: `Search: ${s.query}`, kind: "page app-page", scripts: ["app.js"] });
}
/** The whole vault, as a graph. */
export function graphPage(s: Shell): string {
  const g = graph(s.vault);
  if (g.nodes.length === 0) return emptyPage(s);
  const center = `${toolbar(s, `<a href="/">Vault</a><span aria-hidden="true">/</span><span class="crumb-here">Graph</span>`, `<span class="muted small">${g.nodes.length} notes · ${g.edges.length} links</span>`)}
  const center = `${toolbar(s, `<a href="${baseOf(s) || "/"}">${escape(vaultName(s))}</a><span aria-hidden="true">/</span><span class="crumb-here">Graph</span>`, `<span class="muted small">${g.nodes.length} notes · ${g.edges.length} links</span>`)}
  <div class="graph-stage">
    <canvas class="big-graph" data-graph="all" aria-label="Every note, and the links between them"></canvas>
    <p class="graph-help muted small">Drag to move · scroll or pinch to zoom · click a note to open it</p>
  </div>
  ${graphData(s.vault)}`;
  return layout(shell(s, center), "/graph", { name: "Graph", kind: "page app-page graph-page", scripts: ["app.js", "graph.js"] });
  return layout(shell(s, center), `${baseOf(s)}/graph`, { name: "Graph", kind: "page app-page graph-page", scripts: ["app.js", "graph.js"] });
}
/** An email account: who you are, a new password, or leaving. */
@@ -369,6 +453,114 @@
export function accountPage(s: Shell & { account: Account }): string {
  return layout(shell(s, center), "/account", { name: "Account", kind: "page app-page", scripts: ["app.js"] });
}
/** A shared note's file: where it is, who wrote last, whether the repository has it yet, and moving it. */
function filepanel(space: Space, note: Note & { path: string }): string {
  return `<section class="panel">
    <h2 class="section">File</h2>
    <p class="small file-path"><code>${escape(note.path)}</code></p>
    <p class="muted small">Last written by ${escape(note.author_name)} · ${unsynced(note) ? "waiting to commit" : "committed"}</p>
    <form class="move" method="post" action="/n/${note.id}/move">
      <label class="field"><span class="small">Folder</span><input class="input" name="folder" value="${escape(folderOf(space, note.path))}" placeholder="(top of ${escape(space.folder || "the repository")})" autocomplete="off"></label>
      <button class="button button-quiet">Move</button>
    </form>
  </section>`;
}
/** A shared folder with nothing in it yet. */
function emptySpace(s: Shell, space: Space): string {
  const base = spaceHref(space.id);
  const center = `${toolbar(s, `<span class="crumb-here">${escape(space.name)}</span>`)}
  <div class="empty-state">
    <div class="mark" aria-hidden="true">${icon.folder}</div>
    <h1>${escape(space.name)} is empty</h1>
    <p class="muted">Notes written here are committed to <code>${escape(space.repo)}</code> in <code>${escape(space.folder || "/")}</code> — and markdown pushed there shows up here.</p>
    ${space.sync_error === null ? "" : `<p class="auth-error" role="alert">${escape(space.sync_error)}</p>`}
    <div class="row center">
      <form method="post" action="${base}/new"><button class="button button-big">New note</button></form>
      <a class="button button-big button-quiet" href="${base}/settings">Invite someone</a>
    </div>
  </div>`;
  return layout(shell(s, center), base, { name: space.name, kind: "page app-page", scripts: ["app.js"] });
}
/** A shared folder's settings: who is in, the join link, and the repository. */
export function spacePage(s: Shell & { space: Space; members: readonly Member[] }): string {
  const space = s.space;
  const base = spaceHref(space.id);
  const mine = space.owner_id === s.who.id;
  const link = space.join_code === null ? null : `${publicOrigin}/join/${space.join_code}`;
  const center = `${toolbar(s, `<a href="${base}">${escape(space.name)}</a><span aria-hidden="true">/</span><span class="crumb-here">Sharing</span>`)}
  <div class="sheet results" id="space-settings" data-live="space.changed space.synced">
    <h1 class="results-head">${escape(space.name)}</h1>
    <p class="muted"><code>${escape(space.repo)}</code> · branch <code>${escape(space.branch)}</code> · folder <code>${escape(space.folder || "/")}</code></p>
    <section class="settings">
      <h2 class="section">Repository</h2>
      ${space.sync_error === null ? `<p class="muted small">${space.synced_at === null ? "Not synced yet." : `Synced ${ago(space.synced_at)}${ago(space.synced_at) === "now" ? "" : " ago"}${space.head === null ? "" : ` at <code>${escape(space.head.slice(0, 7))}</code>`}.`} Edits commit a few seconds after you stop typing; pushes to the repository show up within a minute.</p>` : `<p class="auth-error" role="alert">Last sync failed: ${escape(space.sync_error)}</p>`}
      <form method="post" action="${base}/sync"><button class="button">Sync now</button></form>
    </section>
    <section class="settings">
      <h2 class="section">People <span class="count">${s.members.length}</span></h2>
      <ul class="people">${s.members
        .map(
          (m) => `<li><span>${escape(m.who_name)}${m.who_id === space.owner_id ? ` <span class="pill">owner</span>` : ""}${m.who_id === s.who.id ? ` <span class="muted small">(you)</span>` : ""}</span>${
            mine && m.who_id !== space.owner_id
              ? `<form method="post" action="${base}/remove" data-confirm="Remove ${escape(m.who_name)} from ${escape(space.name)}?"><input type="hidden" name="member" value="${escape(m.who_id)}"><button class="button button-quiet">Remove</button></form>`
              : ""
          }</li>`,
        )
        .join("")}</ul>
    </section>
    ${
      mine
        ? `<section class="settings">
      <h2 class="section">Join link</h2>
      ${
        link === null
          ? `<p class="muted small">The link is off: nobody new can join.</p><form method="post" action="${base}/link"><input type="hidden" name="on" value="1"><button class="button">Make a join link</button></form>`
          : `<p class="muted small">Anyone signed in to notes who opens this joins <b>${escape(space.name)}</b> — and sees only this folder, never your own notes. Send it to who you're working with, then turn it off.</p>
      <input class="input join-link" value="${escape(link)}" readonly aria-label="Join link" data-select>
      <div class="row">
        <form method="post" action="${base}/link"><input type="hidden" name="on" value="0"><button class="button button-quiet">Turn the link off</button></form>
        <form method="post" action="${base}/link" data-confirm="Make a new link? The old one stops working."><input type="hidden" name="on" value="1"><button class="button button-quiet">New link</button></form>
      </div>`
      }
    </section>
    <form class="settings" method="post" action="${base}/delete" data-confirm="Stop sharing ${escape(space.name)}? Everyone loses it here. The repository keeps every file.">
      <h2 class="section">Stop sharing</h2>
      <p class="muted small">Removes the folder from notes for everyone. Nothing in the repository is touched.</p>
      <button class="button button-danger">Stop sharing</button>
    </form>`
        : `<form class="settings" method="post" action="${base}/leave" data-confirm="Leave ${escape(space.name)}?">
      <h2 class="section">Leave</h2>
      <p class="muted small">You won't see this folder any more, until someone sends you a join link again.</p>
      <button class="button button-danger">Leave</button>
    </form>`
    }
  </div>`;
  return layout(shell(s, center), `${base}/settings`, { name: `${space.name} · Sharing`, kind: "page app-page", scripts: ["app.js"] });
}
/** Connecting a repository folder: an admin's form. */
export function newSpacePage(s: Shell & { form?: { name: string; repo: string; branch: string; folder: string } }): string {
  const f = s.form ?? { name: "", repo: "", branch: "main", folder: "docs" };
  const center = `${toolbar(s, `<a href="/">Vault</a><span aria-hidden="true">/</span><span class="crumb-here">Share a repo folder</span>`)}
  <div class="sheet results">
    <h1 class="results-head">Share a repo folder</h1>
    <p class="muted">A folder of a repository on the forge becomes a vault you write in with others. Every note is a markdown file there; edits here are commits, and pushes there show up here. Use a plain repository, not an app's — every save is a commit to the branch.</p>
    <form class="settings" method="post" action="/spaces">
      <label class="field"><span>Name</span><input class="input" name="name" value="${escape(f.name)}" required maxlength="80" placeholder="Brainstorm" autofocus></label>
      <label class="field"><span>Repository</span><input class="input" name="repo" value="${escape(f.repo)}" required placeholder="owner/name" autocomplete="off"></label>
      <label class="field"><span>Branch</span><input class="input" name="branch" value="${escape(f.branch)}" required autocomplete="off"></label>
      <label class="field"><span>Folder <span class="muted">(empty for the whole repository)</span></span><input class="input" name="folder" value="${escape(f.folder)}" autocomplete="off"></label>
      <button class="button">Connect and read it</button>
    </form>
  </div>`;
  return layout(shell(s, center), "/spaces/new", { name: "Share a repo folder", kind: "page app-page", scripts: ["app.js"] });
}
/** The graph's data, for any page that draws one. */
export const graphData = (vault: readonly Note[]): string => data("graph", graph(vault), CHANGES);
@@ -66,9 +66,25 @@
import {
  graphPage,
  landing,
  missingPage,
  newSpacePage,
  notePage,
  searchPage,
  spacePage,
} from "./page.ts";
import {
  createSpace,
  deleteSpace,
  getSpace,
  joinSpace,
  members,
  mySpaces,
  removeMember,
  setLink,
  spaceHref,
  spaceOf,
  type Space,
} from "./spaces.ts";
import { syncSpace, type Forge } from "./sync.ts";
import { tokensCss } from "./tokens.ts";
import { allow } from "./security.ts";
import { search } from "./vault.ts";
@@ -90,6 +106,8 @@
export interface Context {
  readonly db: Database;
  readonly who: Who;
  readonly params: Record<string, string>;
  /** Where shared folders commit; absent, there are none to make. */
  readonly forge?: Forge | undefined;
}
/** A JSON Schema, as plain data. */
@@ -126,6 +144,10 @@
export const NOTE: Schema = {
    author_name: { type: "string" },
    created_at: { type: "string", format: "date-time" },
    updated_at: { type: "string", format: "date-time" },
    path: {
      type: ["string", "null"],
      description: "A shared folder's note: its file in the repository. Null for a note of your own.",
    },
  },
  required: [
    "id",
@@ -147,6 +169,8 @@
const NOTE_NEW: Schema = {
      description: "Unique in your vault; “Untitled” when left out.",
    },
    body: { type: "string", maxLength: BODY_MAX, description: "Markdown." },
    space: { type: "integer", description: "A shared folder you are in, to add the note there instead of your vault." },
    folder: { type: "string", description: "In a shared folder: the folder to put it in (`ideas/q4`)." },
  },
};
const NOTE_CHANGE: Schema = {
@@ -160,6 +184,12 @@
const NOTE_CHANGE: Schema = {
    },
    body: { type: "string", maxLength: BODY_MAX },
    pinned: { type: "boolean" },
    folder: { type: "string", description: "A shared note's folder: moves its file." },
    base: {
      type: "string",
      format: "date-time",
      description: "The updated_at you edited from; when someone has saved since, new words are refused with 409.",
    },
  },
};
export const AUDIT_ROW: Schema = {
@@ -196,6 +226,7 @@
const STATUS: Record<Failure, number> = {
  forbidden: 403,
  not_found: 404,
  invalid: 422,
  conflict: 409,
};
/** A result as JSON: the value, or `{ error, message }` with the matching status. */
@@ -219,23 +250,169 @@
const change = (id: number, body: Record<string, unknown>): Change => ({
  ...(typeof body.title === "string" ? { title: body.title } : {}),
  ...(typeof body.body === "string" ? { body: body.body } : {}),
  ...(typeof body.pinned === "boolean" ? { pinned: body.pinned } : {}),
  ...(typeof body.folder === "string" ? { folder: body.folder } : {}),
  ...(typeof body.base === "string" ? { base: body.base } : {}),
});
/** The vault around a page: who is signed in, and every note of theirs. */
function vaultOf(c: Context):
  | { who: Who & { role: "user" | "admin" }; vault: Note[]; notice?: string; clear: Record<string, string> }
  | Response {
interface Around {
  who: Who & { role: "user" | "admin" };
  vault: Note[];
  notice?: string;
  clear: Record<string, string>;
  space?: Space;
  spaces: Space[];
}
/**
 * The vault around a page: who is signed in, every note of theirs — or of
 * the shared folder `space`, when the page is in one — and the folders
 * they are in, for the switcher.
 */
function vaultOf(c: Context, space?: number): Around | Response {
  const { notice, clear } = readNotice(c.request);
  if (c.who.role === "anon") return html(landing(notice), 200, clear);
  const vault = listNotes(c.db, c.who);
  let found: Space | undefined;
  if (space !== undefined) {
    const got = getSpace(c.db, c.who, space);
    if (!got.ok) return go("/", got.message);
    found = got.value;
  }
  const vault = listNotes(c.db, c.who, space === undefined ? {} : { space });
  return {
    who: c.who,
    vault: vault.ok ? vault.value : [],
    ...(notice === undefined ? {} : { notice }),
    clear,
    ...(found === undefined ? {} : { space: found }),
    spaces: mySpaces(c.db, c.who),
  };
}
/** The shared folder a page's path names (`/s/:sid/…`); none for your own vault. */
const sidOf = (c: Context): number | undefined =>
  c.params.sid === undefined ? undefined : Number(c.params.sid);
/** A vault's own address: `""` for yours, `/s/<id>` for a shared folder. */
const baseFor = (space: number | undefined): string => (space === undefined ? "" : spaceHref(space));
/** Where sign-in may send someone afterwards: back to the join link that brought them, or home. */
export const safeTo = (to: string | null | undefined): string =>
  typeof to === "string" && /^\/join\/[\w-]{8,64}$/.test(to) ? to : "/";
/**
 * The pages every vault has — its home, search, graph, following a link,
 * a new note, today's note — once for your own (`""`) and once for a
 * shared folder (`/s/:sid`). The same handlers, a different vault.
 */
function vaultRoutes(prefix: string): Route[] {
  return [
    {
      method: "GET",
      path: prefix || "/",
      handle: (c) => {
        const v = vaultOf(c, sidOf(c));
        if (v instanceof Response) return v;
        const first = v.vault.reduce<Note | undefined>(
          (latest, n) => (latest === undefined || n.updated_at > latest.updated_at ? n : latest),
          undefined,
        );
        // The vault opens on the note you were last writing.
        if (first !== undefined && v.notice === undefined) return go(toNote(first));
        if (first !== undefined) return html(notePage({ ...v, active: first }), 200, v.clear);
        return html(emptyPage(v), 200, v.clear);
      },
    },
    {
      method: "POST",
      path: `${prefix}/new`,
      handle: async (c) => {
        const form = await readForm(c.request);
        if (form === undefined) return text("too large", 413);
        const title = String(form.get("title") ?? "");
        const folder = String(form.get("folder") ?? "");
        const space = sidOf(c);
        return done(
          addNote(c.db, c.who, {
            ...(title === "" ? {} : { title }),
            ...(space === undefined ? {} : { space, folder }),
          }),
          toNote,
          baseFor(space) || "/",
        );
      },
    },
    {
      method: "POST",
      path: `${prefix}/daily`,
      handle: async (c) => {
        const form = await readForm(c.request);
        if (form === undefined) return text("too large", 413);
        const tz = Number(form.get("tz") ?? 0);
        const day = today(Number.isFinite(tz) && Math.abs(tz) <= 840 ? tz : 0);
        const space = sidOf(c);
        return done(
          openOrCreate(c.db, c.who, { title: day, body: `# ${day}\n\n`, ...(space === undefined ? {} : { space }) }),
          toNote,
          baseFor(space) || "/",
        );
      },
    },
    {
      method: "GET",
      path: `${prefix}/open`,
      handle: (c) => {
        const v = vaultOf(c, sidOf(c));
        if (v instanceof Response) return v;
        const title = (c.url.searchParams.get("title") ?? "").trim();
        const found = v.vault.find((n) => n.title.toLowerCase() === title.toLowerCase());
        if (found !== undefined) return go(toNote(found));
        if (title === "") return go(baseFor(sidOf(c)) || "/");
        return html(missingPage({ ...v, title }), 200, v.clear);
      },
    },
    {
      method: "POST",
      path: `${prefix}/open`,
      handle: async (c) => {
        const form = await readForm(c.request);
        if (form === undefined) return text("too large", 413);
        const space = sidOf(c);
        return done(
          openOrCreate(c.db, c.who, { title: String(form.get("title") ?? ""), ...(space === undefined ? {} : { space }) }),
          toNote,
          baseFor(space) || "/",
        );
      },
    },
    {
      method: "GET",
      path: `${prefix}/search`,
      handle: (c) => {
        const v = vaultOf(c, sidOf(c));
        if (v instanceof Response) return v;
        const query = (c.url.searchParams.get("q") ?? "").slice(0, 500).trim();
        if (query === "") return go(baseFor(sidOf(c)) || "/");
        return html(searchPage({ ...v, query, hits: search(v.vault, query) }), 200, v.clear);
      },
    },
    {
      method: "GET",
      path: `${prefix}/graph`,
      handle: (c) => {
        const v = vaultOf(c, sidOf(c));
        if (v instanceof Response) return v;
        return html(graphPage(v), 200, v.clear);
      },
    },
  ];
}
/** A shared folder's own page, for one of its members — or the way home. */
function spaceAround(c: Context): (Around & { space: Space }) | Response {
  const v = vaultOf(c, sidOf(c));
  if (v instanceof Response) return v;
  if (v.space === undefined) return go("/");
  return v as Around & { space: Space };
}
/** A whole number from the query, or undefined. */
const whole = (value: string | null): number | undefined =>
  value !== null && /^\d+$/.test(value) ? Number(value) : undefined;
@@ -247,30 +424,18 @@
const openapi = existsSync(OPENAPI) ? readFileSync(OPENAPI, "utf8") : undefined;
export const routes: readonly Route[] = [
  // The pages. Signed out, the way in; signed in, the vault. Forms post and
  // land where they lead, so every page works without JavaScript.
  {
    method: "GET",
    path: "/",
    handle: (c) => {
      const v = vaultOf(c);
      if (v instanceof Response) return v;
      const first = v.vault.reduce<Note | undefined>(
        (latest, n) => (latest === undefined || n.updated_at > latest.updated_at ? n : latest),
        undefined,
      );
      // The vault opens on the note you were last writing.
      if (first !== undefined && v.notice === undefined) return go(toNote(first));
      if (first !== undefined) return html(notePage({ ...v, active: first }), 200, v.clear);
      return html(emptyPage(v), 200, v.clear);
    },
  },
  ...vaultRoutes(""),
  ...vaultRoutes("/s/:sid"),
  {
    method: "GET",
    path: "/n/:id",
    handle: (c) => {
      const v = vaultOf(c);
      if (v instanceof Response) return v;
      if (c.who.role === "anon") return vaultOf(c) as Response;
      const note = getNote(c.db, c.who, { id: Number(c.params.id) });
      if (!note.ok) return go("/", note.message);
      // A shared note is shown in its folder.
      const v = vaultOf(c, spaceOf(note.value.author_id));
      if (v instanceof Response) return v;
      return html(notePage({ ...v, active: note.value }), 200, v.clear);
    },
  },
@@ -307,6 +472,16 @@
export const routes: readonly Route[] = [
      );
    },
  },
  {
    method: "POST",
    path: "/n/:id/move",
    handle: async (c) => {
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      const id = Number(c.params.id);
      return done(updateNote(c.db, c.who, { id, folder: String(form.get("folder") ?? "") }), toNote, toNote({ id }));
    },
  },
  {
    method: "POST",
    path: "/n/:id/pin",
@@ -324,28 +499,136 @@
export const routes: readonly Route[] = [
  {
    method: "POST",
    path: "/n/:id/delete",
    handle: (c) =>
      done(deleteNote(c.db, c.who, { id: Number(c.params.id) }), () => "/"),
    handle: (c) => {
      const note = getNote(c.db, c.who, { id: Number(c.params.id) });
      const back = note.ok ? baseFor(spaceOf(note.value.author_id)) || "/" : "/";
      return done(deleteNote(c.db, c.who, { id: Number(c.params.id) }), () => back);
    },
  },
  // Shared folders: connecting one, joining one, and running one.
  {
    method: "POST",
    path: "/new",
    handle: async (c) => {
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      const title = String(form.get("title") ?? "");
      return done(addNote(c.db, c.who, title === "" ? {} : { title }), toNote);
    method: "GET",
    path: "/spaces/new",
    handle: (c) => {
      const v = vaultOf(c);
      if (v instanceof Response) return v;
      if (c.who.role !== "admin") return go("/", "Only an app admin can connect a repository.");
      if (c.forge === undefined) return go("/", "Shared folders need NOTES_REPO_TOKEN set in the app's environment.");
      return html(newSpacePage(v), 200, v.clear);
    },
  },
  {
    method: "POST",
    path: "/daily",
    path: "/spaces",
    handle: async (c) => {
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      const tz = Number(form.get("tz") ?? 0);
      const day = today(Number.isFinite(tz) && Math.abs(tz) <= 840 ? tz : 0);
      return done(openOrCreate(c.db, c.who, { title: day, body: `# ${day}\n\n` }), toNote);
      const input = {
        name: String(form.get("name") ?? ""),
        repo: String(form.get("repo") ?? ""),
        branch: String(form.get("branch") ?? ""),
        folder: String(form.get("folder") ?? ""),
      };
      const again = (notice: string) => {
        const v = vaultOf(c);
        return v instanceof Response ? v : html(newSpacePage({ ...v, notice, form: input }), 422);
      };
      if (c.forge === undefined) return again("Shared folders need NOTES_REPO_TOKEN set in the app's environment.");
      const made = createSpace(c.db, c.who, input);
      if (!made.ok) return made.error === "invalid" ? again(made.message) : go("/", made.message);
      // Read it now, so it opens with its notes — and a wrong name is said at once.
      try {
        const read = await syncSpace(c.db, c.forge, made.value.id);
        return go(spaceHref(made.value.id), `Connected — ${read.pulled} ${read.pulled === 1 ? "note" : "notes"} read from ${made.value.repo}.`);
      } catch (e) {
        deleteSpace(c.db, c.who, { id: made.value.id });
        return again(`Couldn't read ${made.value.repo}: ${e instanceof Error ? e.message : String(e)}`);
      }
    },
  },
  {
    method: "GET",
    path: "/join/:code",
    handle: (c) => {
      const to = `/join/${c.params.code ?? ""}`;
      if (c.who.role === "anon")
        return html(landing("Sign in (or make an account) to join the shared folder.", safeTo(to)), 200);
      const joined = joinSpace(c.db, c.who, { code: c.params.code ?? "" });
      if (!joined.ok) return go("/", joined.message);
      return go(spaceHref(joined.value.id), `You're in ${joined.value.name}.`);
    },
  },
  {
    method: "GET",
    path: "/s/:sid/settings",
    handle: (c) => {
      const v = spaceAround(c);
      if (v instanceof Response) return v;
      return html(spacePage({ ...v, members: members(c.db, v.space.id) }), 200, v.clear);
    },
  },
  {
    method: "POST",
    path: "/s/:sid/sync",
    handle: async (c) => {
      const v = spaceAround(c);
      if (v instanceof Response) return v;
      const back = `${spaceHref(v.space.id)}/settings`;
      if (c.forge === undefined) return go(back, "Shared folders need NOTES_REPO_TOKEN set in the app's environment.");
      try {
        const r = await syncSpace(c.db, c.forge, v.space.id);
        const said = [
          r.pulled > 0 ? `${r.pulled} from the repository` : "",
          r.pushed > 0 ? `${r.pushed} ${r.pushed === 1 ? "file" : "files"} committed` : "",
          r.copies > 0 ? `${r.copies} kept as repo copies` : "",
        ].filter((x) => x !== "");
        return go(back, said.length === 0 ? "Already in step." : `Synced: ${said.join(", ")}.`);
      } catch (e) {
        return go(back, `Sync failed: ${e instanceof Error ? e.message : String(e)}`);
      }
    },
  },
  {
    method: "POST",
    path: "/s/:sid/link",
    handle: async (c) => {
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      const id = Number(c.params.sid);
      const on = form.get("on") === "1";
      return done(setLink(c.db, c.who, { id, on }), () => `${spaceHref(id)}/settings`, `${spaceHref(id)}/settings`);
    },
  },
  {
    method: "POST",
    path: "/s/:sid/remove",
    handle: async (c) => {
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      const id = Number(c.params.sid);
      return done(
        removeMember(c.db, c.who, { id, member: String(form.get("member") ?? "") }),
        () => `${spaceHref(id)}/settings`,
        `${spaceHref(id)}/settings`,
      );
    },
  },
  {
    method: "POST",
    path: "/s/:sid/leave",
    handle: (c) => {
      const id = Number(c.params.sid);
      if (c.who.role === "anon") return go("/");
      return done(removeMember(c.db, c.who, { id, member: c.who.id }), () => "/", `${spaceHref(id)}/settings`);
    },
  },
  {
    method: "POST",
    path: "/s/:sid/delete",
    handle: (c) => {
      const id = Number(c.params.sid);
      return done(deleteSpace(c.db, c.who, { id }), () => "/", `${spaceHref(id)}/settings`);
    },
  },
  {
@@ -354,48 +637,6 @@
export const routes: readonly Route[] = [
    handle: (c) =>
      done(openOrCreate(c.db, c.who, { title: "Welcome", body: WELCOME }), toNote),
  },
  {
    method: "GET",
    path: "/open",
    handle: (c) => {
      const v = vaultOf(c);
      if (v instanceof Response) return v;
      const title = (c.url.searchParams.get("title") ?? "").trim();
      const found = v.vault.find((n) => n.title.toLowerCase() === title.toLowerCase());
      if (found !== undefined) return go(toNote(found));
      if (title === "") return go("/");
      return html(missingPage({ ...v, title }), 200, v.clear);
    },
  },
  {
    method: "POST",
    path: "/open",
    handle: async (c) => {
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      return done(openOrCreate(c.db, c.who, { title: String(form.get("title") ?? "") }), toNote);
    },
  },
  {
    method: "GET",
    path: "/search",
    handle: (c) => {
      const v = vaultOf(c);
      if (v instanceof Response) return v;
      const query = (c.url.searchParams.get("q") ?? "").slice(0, 500).trim();
      if (query === "") return go("/");
      return html(searchPage({ ...v, query, hits: search(v.vault, query) }), 200, v.clear);
    },
  },
  {
    method: "GET",
    path: "/graph",
    handle: (c) => {
      const v = vaultOf(c);
      if (v instanceof Response) return v;
      return html(graphPage(v), 200, v.clear);
    },
  },
  {
    method: "GET",
    path: "/export",
@@ -437,7 +678,7 @@
export const routes: readonly Route[] = [
    handle: (c) => {
      if (c.who.role !== "anon") return go("/");
      const { notice, clear } = readNotice(c.request);
      return html(authPage({ mode: "signup", notice, needsCode: (process.env.NOTES_SIGNUP_CODE ?? "") !== "" }), 200, clear);
      return html(authPage({ mode: "signup", notice, needsCode: (process.env.NOTES_SIGNUP_CODE ?? "") !== "", to: safeTo(c.url.searchParams.get("to")) }), 200, clear);
    },
  },
  {
@@ -448,8 +689,9 @@
export const routes: readonly Route[] = [
      if (form === undefined) return text("too large", 413);
      const email = String(form.get("email") ?? "");
      const name = String(form.get("name") ?? "");
      const to = safeTo(String(form.get("to") ?? ""));
      const again = (notice: string, status = 422) =>
        html(authPage({ mode: "signup", notice, email, name, needsCode: (process.env.NOTES_SIGNUP_CODE ?? "") !== "" }), status);
        html(authPage({ mode: "signup", notice, email, name, needsCode: (process.env.NOTES_SIGNUP_CODE ?? "") !== "", to }), status);
      if (!allow("signup", SIGNUP_ALL)) return again("Lots of people are signing up right now — try again in a few minutes.", 429);
      const made = await signUp(c.db, {
        email,
@@ -458,7 +700,7 @@
export const routes: readonly Route[] = [
        code: String(form.get("code") ?? ""),
      });
      if (!made.ok) return again(made.message, made.error === "forbidden" ? 403 : 422);
      return go("/", undefined, [session(made.value.token)]);
      return go(to, undefined, [session(made.value.token)]);
    },
  },
  {
@@ -467,7 +709,7 @@
export const routes: readonly Route[] = [
    handle: (c) => {
      if (c.who.role !== "anon") return go("/");
      const { notice, clear } = readNotice(c.request);
      return html(authPage({ mode: "login", notice, needsCode: false }), 200, clear);
      return html(authPage({ mode: "login", notice, needsCode: false, to: safeTo(c.url.searchParams.get("to")) }), 200, clear);
    },
  },
  {
@@ -477,13 +719,14 @@
export const routes: readonly Route[] = [
      const form = await readForm(c.request);
      if (form === undefined) return text("too large", 413);
      const email = String(form.get("email") ?? "");
      const to = safeTo(String(form.get("to") ?? ""));
      const again = (notice: string, status: number) =>
        html(authPage({ mode: "login", notice, email, needsCode: false }), status);
        html(authPage({ mode: "login", notice, email, needsCode: false, to }), status);
      if (!allow(`login:${email.trim().toLowerCase()}`, LOGIN_PER_EMAIL) || !allow("login", LOGIN_ALL))
        return again("Too many tries. Wait a minute and try again.", 429);
      const inside = await logIn(c.db, { email, password: String(form.get("password") ?? "") });
      if (!inside.ok) return again(inside.message, 401);
      return go("/", undefined, [session(inside.value.token)]);
      return go(to, undefined, [session(inside.value.token)]);
    },
  },
  {
@@ -542,10 +785,14 @@
export const routes: readonly Route[] = [
    handle: (c) => {
      const q = c.url.searchParams.get("q");
      const limit = whole(c.url.searchParams.get("limit"));
      if (q === null || q.trim() === "")
        return answer(listNotes(c.db, c.who, limit === undefined ? {} : { limit }));
      const space = whole(c.url.searchParams.get("space"));
      const scope = {
        ...(limit === undefined ? {} : { limit }),
        ...(space === undefined ? {} : { space }),
      };
      if (q === null || q.trim() === "") return answer(listNotes(c.db, c.who, scope));
      // A search answers the same notes, best match first.
      const hits = searchNotes(c.db, c.who, { q, ...(limit === undefined ? {} : { limit }) });
      const hits = searchNotes(c.db, c.who, { q, ...scope });
      if (!hits.ok) return answer(hits);
      const notes = hits.value
        .map((h) => getNote(c.db, c.who, { id: h.id }))
@@ -554,9 +801,10 @@
export const routes: readonly Route[] = [
    },
    api: {
      summary:
        "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first.",
        "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first. With `space`, a shared folder's instead.",
      query: {
        limit: { type: "integer", minimum: 1, maximum: 5000 },
        space: { type: "integer" },
        q: { type: "string", maxLength: 500 },
      },
      answer: list(NOTE),
@@ -573,6 +821,8 @@
export const routes: readonly Route[] = [
        addNote(c.db, c.who, {
          ...(typeof f.title === "string" ? { title: f.title } : {}),
          ...(typeof f.body === "string" ? { body: f.body } : {}),
          ...(typeof f.space === "number" ? { space: f.space } : {}),
          ...(typeof f.folder === "string" ? { folder: f.folder } : {}),
        }),
        201,
      );
@@ -8,12 +8,13 @@
 */
import { openDb } from "./db.ts";
import { dataDir, identityKey, title, where } from "./env.ts";
import { dataDir, forgeApi, identityKey, repoToken, title, where } from "./env.ts";
import { sessionWho } from "./accounts.ts";
import { html, readCookie, text } from "./http.ts";
import { SESSION_COOKIE } from "./routes.ts";
import { match } from "./routes.ts";
import { door } from "./security.ts";
import { httpForge, startSync, type Forge } from "./sync.ts";
import { who } from "./who.ts";
import { traceServe } from "./otel.ts";
@@ -22,11 +23,14 @@
export interface ServeOptions {
  readonly hostname?: string | undefined;
  readonly dataDir: string;
  readonly identityKey: string;
  /** Where shared folders commit; without one there are none. */
  readonly forge?: Forge | undefined;
}
export function serve(options: ServeOptions) {
  const db = openDb(options.dataDir);
  return Bun.serve(traceServe({
  const stopSync = startSync(db, options.forge);
  const server = Bun.serve(traceServe({
    port: options.port,
    hostname: options.hostname ?? "127.0.0.1",
    // A connection that says nothing for a minute is dropped. The event
@@ -57,6 +61,7 @@
export function serve(options: ServeOptions) {
        db,
        who: me,
        params: found.params,
        forge: options.forge,
      });
      return head(request, response);
    },
@@ -68,6 +73,12 @@
export function serve(options: ServeOptions) {
      return html("<h1>Something went wrong</h1>", 500);
    },
  }));
  const stop = server.stop.bind(server);
  server.stop = (force?: boolean) => {
    stopSync();
    return stop(force);
  };
  return server;
}
// HEAD is GET without the body: a health check sees the app up.
@@ -82,6 +93,7 @@
if (import.meta.main) {
    hostname: process.env.HOST,
    dataDir,
    identityKey,
    forge: repoToken === undefined || forgeApi === undefined ? undefined : httpForge(forgeApi, repoToken),
  });
  console.log(
    `${title} listening on http://${server.hostname}:${server.port} (${where})`,
@@ -0,0 +1,114 @@
import { afterAll, expect, test } from "bun:test";
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { serve } from "./server.ts";
import { blobOid, type Forge } from "./sync.ts";
import { sign } from "./who.ts";
// A shared folder through the doors a person uses: connect, invite, join,
// write, see the file — with a repository in memory behind the forge's API.
const files = new Map<string, string>([["docs/Welcome.md", "Hello from git. [[Plan]]"]]);
let head = "c0";
const forge: Forge = {
  head: async () => head,
  list: async (_r, _ref, path) => {
    const prefix = path === "" ? "" : `${path}/`;
    const seen = new Map<string, { name: string; type: string; oid: string; size: number }>();
    for (const [p, c] of files) {
      if (!p.startsWith(prefix)) continue;
      const rest = p.slice(prefix.length);
      const name = rest.split("/")[0]!;
      seen.set(name, rest.includes("/") ? { name, type: "tree", oid: "t", size: -1 } : { name, type: "blob", oid: blobOid(c), size: c.length });
    }
    return [...seen.values()];
  },
  read: async (_r, _ref, path) => files.get(path)!,
  commit: async (_r, _b, _m, changes) => {
    for (const f of changes) f.content === null ? files.delete(f.path) : files.set(f.path, f.content);
    head = `c${Number(head.slice(1)) + 1}`;
    return head;
  },
};
const KEY = "k";
const server = serve({ port: 0, dataDir: mkdtempSync(join(tmpdir(), "app-shared-")), identityKey: KEY, forge });
const base = `http://${server.hostname}:${server.port}`;
afterAll(() => server.stop(true));
const as = (id: string, name: string, role: "user" | "admin" = "user"): Record<string, string> => {
  const identity = `${id}|${name}|${role}|${Date.now() + 60_000}`;
  return { "x-forge-identity": identity, "x-forge-signature": sign(identity, KEY) };
};
const ben = as("1", "ben", "admin");
const sam = as("2", "sam");
const same = { origin: base, "sec-fetch-site": "same-origin" };
const get = (path: string, who: Record<string, string> = {}) =>
  fetch(base + path, { headers: { ...who, accept: "text/html" }, redirect: "manual" });
const post = (path: string, form: Record<string, string>, who: Record<string, string>) =>
  fetch(base + path, {
    method: "POST",
    headers: { ...who, ...same, "content-type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams(form).toString(),
    redirect: "manual",
  });
test("connect a folder, invite someone by link, and write in it together", async () => {
  // Only an admin may connect a repository.
  expect((await post("/spaces", { name: "X", repo: "ben/x" }, sam)).headers.get("location")).toBe("/");
  const made = await post("/spaces", { name: "Brainstorm", repo: "ben/brainstorm", branch: "main", folder: "docs" }, ben);
  expect(made.status).toBe(303);
  const at = made.headers.get("location")!;
  expect(at).toMatch(/^\/s\/\d+$/);
  const sid = Number(at.slice(3));
  // It opens on what the repository had.
  const home = await get(at, ben);
  expect(home.status).toBe(303);
  const page = await (await get(home.headers.get("location")!, ben)).text();
  expect(page).toContain("Hello from git.");
  expect(page).toContain(`href="/s/${sid}/open?title=Plan"`);
  expect(page).toContain("docs/Welcome.md");
  // Sam can't see it — until the join link.
  expect((await get(at, sam)).headers.get("location")).toBe("/");
  const settings = await (await get(`${at}/settings`, ben)).text();
  const link = /value="https?:\/\/[^"]*(\/join\/[\w-]+)"/.exec(settings)![1]!;
  // Signed out, the link asks you to sign in and remembers where you were going.
  const guest = await (await get(link)).text();
  expect(guest).toContain(`/login?to=${encodeURIComponent(link)}`);
  const joined = await get(link, sam);
  expect(joined.headers.get("location")).toBe(at);
  // Sam writes a note into a folder; it's a file in the repository after a sync.
  const note = await fetch(`${base}/api/notes`, {
    method: "POST",
    headers: { ...sam, ...same, "content-type": "application/json" },
    body: JSON.stringify({ title: "ideas/Plan", body: "Ship it.", space: sid }),
  });
  expect(note.status).toBe(201);
  const made2 = (await note.json()) as { id: number; path: string; updated_at: string };
  expect(made2.path).toBe("docs/ideas/Plan.md");
  const synced = await post(`${at}/sync`, {}, sam);
  expect(synced.headers.get("location")).toBe(`${at}/settings`);
  expect(files.get("docs/ideas/Plan.md")).toBe("Ship it.");
  // Two people, one note: the second save written against an old version is refused.
  const patch = (who: Record<string, string>, body: string, b: string) =>
    fetch(`${base}/api/notes/${made2.id}`, {
      method: "PATCH",
      headers: { ...who, ...same, "content-type": "application/json" },
      body: JSON.stringify({ body, base: b }),
    });
  await Bun.sleep(3);
  expect((await patch(ben, "Ben's take", made2.updated_at)).status).toBe(200);
  const late = await patch(sam, "Sam's take", made2.updated_at);
  expect(late.status).toBe(409);
  expect(((await late.json()) as { message: string }).message).toContain("ben");
  // Ben's own vault is still Ben's alone, and doesn't hold the shared notes.
  const mine = (await (await fetch(`${base}/api/notes`, { headers: ben })).json()) as unknown[];
  expect(mine).toEqual([]);
  const theirs = (await (await fetch(`${base}/api/notes?space=${sid}`, { headers: sam })).json()) as { title: string }[];
  expect(theirs.map((n) => n.title).sort()).toEqual(["Plan", "Welcome"]);
});
@@ -0,0 +1,252 @@
import { expect, test } from "bun:test";
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { addNote, deleteNote, getNote, listNotes, searchNotes, updateNote } from "./actions.ts";
import { openDb } from "./db.ts";
import {
  cleanFolder,
  createSpace,
  deleteSpace,
  fileOf,
  folderOf,
  joinSpace,
  mySpaces,
  removeMember,
  setLink,
} from "./spaces.ts";
import { blobOid, syncSpace, type Entry, type Forge } from "./sync.ts";
// @ts-ignore — plain JS, shared with the browser.
import * as md from "../static/md.js";
import type { Who } from "./who.ts";
const db = openDb(mkdtempSync(join(tmpdir(), "app-spaces-")));
const ben: Who = { role: "admin", id: "1", name: "ben" };
const sam: Who = { role: "user", id: "acct:7", name: "sam" };
const eve: Who = { role: "user", id: "9", name: "eve" };
const must = <T>(r: { ok: true; value: T } | { ok: false; message: string }): T => {
  if (!r.ok) throw new Error(r.message);
  return r.value;
};
/** A repository in memory, behind the same four calls the forge answers. */
function fakeForge(files: Record<string, string> = {}) {
  const tree = new Map(Object.entries(files));
  let head = tree.size === 0 ? null : "c0";
  let n = 0;
  const commits: { message: string; files: { path: string; content: string | null }[] }[] = [];
  const forge: Forge = {
    async head() {
      return head;
    },
    async list(_repo, _ref, path) {
      const prefix = path === "" ? "" : `${path}/`;
      const seen = new Map<string, Entry>();
      for (const [p, content] of tree) {
        if (!p.startsWith(prefix)) continue;
        const rest = p.slice(prefix.length);
        const name = rest.split("/")[0]!;
        if (rest.includes("/")) seen.set(name, { name, type: "tree", oid: `t-${name}`, size: -1 });
        else seen.set(name, { name, type: "blob", oid: blobOid(content), size: content.length });
      }
      return seen.size === 0 && path !== "" ? null : [...seen.values()];
    },
    async read(_repo, _ref, path) {
      const content = tree.get(path);
      if (content === undefined) throw new Error(`no ${path}`);
      return content;
    },
    async commit(_repo, _branch, message, changes) {
      for (const f of changes) f.content === null ? tree.delete(f.path) : tree.set(f.path, f.content);
      commits.push({ message, files: changes });
      head = `c${++n}`;
      return head;
    },
  };
  return {
    forge,
    tree,
    commits,
    /** Someone pushes to the repository, outside the app. */
    push(changes: Record<string, string | null>) {
      for (const [p, c] of Object.entries(changes)) c === null ? tree.delete(p) : tree.set(p, c);
      head = `x${++n}`;
    },
  };
}
test("only an app admin connects a repository; a join link lets someone in, and only into that folder", () => {
  const refused = createSpace(db, sam, { name: "Nope", repo: "sam/x", folder: "docs" });
  expect(refused.ok).toBe(false);
  if (!refused.ok) expect(refused.error).toBe("forbidden");
  expect(createSpace(db, ben, { name: "Bad", repo: "not a repo" }).ok).toBe(false);
  expect(createSpace(db, ben, { name: "Bad", repo: "ben/x", folder: "../etc" }).ok).toBe(false);
  const space = must(createSpace(db, ben, { name: "Brainstorm", repo: "ben/brainstorm", folder: "/docs/" }));
  expect(space.folder).toBe("docs");
  expect(space.branch).toBe("main");
  expect(mySpaces(db, ben).map((s) => s.id)).toEqual([space.id]);
  expect(mySpaces(db, sam)).toEqual([]);
  const mine = must(addNote(db, ben, { title: "My own thoughts" }));
  const shared = must(addNote(db, ben, { title: "Pricing", space: space.id }));
  expect(shared.path).toBe("docs/Pricing.md");
  // A stranger can't see the folder or its notes, by id or by list.
  expect(getNote(db, sam, { id: shared.id }).ok).toBe(false);
  expect(listNotes(db, sam, { space: space.id }).ok).toBe(false);
  expect(addNote(db, sam, { title: "sneaky", space: space.id }).ok).toBe(false);
  must(joinSpace(db, sam, { code: space.join_code! }));
  expect(must(listNotes(db, sam, { space: space.id })).map((n) => n.title)).toEqual(["Pricing"]);
  expect(getNote(db, sam, { id: shared.id }).ok).toBe(true);
  // …and still nothing of Ben's own.
  expect(getNote(db, sam, { id: mine.id }).ok).toBe(false);
  expect(must(listNotes(db, sam)).map((n) => n.id)).not.toContain(mine.id);
  // Shared notes never show in anyone's own vault, Ben's included.
  expect(must(listNotes(db, ben)).map((n) => n.id)).not.toContain(shared.id);
  expect(must(searchNotes(db, ben, { q: "Pricing" }))).toEqual([]);
  expect(must(searchNotes(db, sam, { q: "Pricing", space: space.id })).length).toBe(1);
  // Sam writes; the note says so.
  const edited = must(updateNote(db, sam, { id: shared.id, body: "per seat?" }));
  expect(edited.author_name).toBe("sam");
  // The link off, nobody new gets in; the owner removes a member; the owner can't be removed.
  const off = must(setLink(db, ben, { id: space.id, on: false }));
  expect(joinSpace(db, eve, { code: space.join_code! }).ok).toBe(false);
  expect(off.join_code).toBeNull();
  expect(setLink(db, sam, { id: space.id, on: true }).ok).toBe(false);
  expect(removeMember(db, sam, { id: space.id, member: ben.id }).ok).toBe(false);
  must(removeMember(db, ben, { id: space.id, member: sam.id }));
  expect(getNote(db, sam, { id: shared.id }).ok).toBe(false);
  must(deleteSpace(db, ben, { id: space.id }));
  expect(getNote(db, ben, { id: shared.id }).ok).toBe(false);
  expect(getNote(db, ben, { id: mine.id }).ok).toBe(true);
});
test("a shared note's title is a file name, its folder a path; renames and moves carry the file", () => {
  const space = must(createSpace(db, ben, { name: "Paths", repo: "ben/paths", folder: "docs" }));
  expect(addNote(db, ben, { title: "a:b", space: space.id }).ok).toBe(false);
  const deep = must(addNote(db, ben, { title: "ideas/q4/Launch", space: space.id }));
  expect(deep.title).toBe("Launch");
  expect(deep.path).toBe("docs/ideas/q4/Launch.md");
  expect(folderOf(space, deep.path!)).toBe("ideas/q4");
  const renamed = must(updateNote(db, ben, { id: deep.id, title: "Launch plan" }));
  expect(renamed.path).toBe("docs/ideas/q4/Launch plan.md");
  const moved = must(updateNote(db, ben, { id: deep.id, folder: "archive" }));
  expect(moved.path).toBe("docs/archive/Launch plan.md");
  expect(must(updateNote(db, ben, { id: deep.id, folder: "" })).path).toBe("docs/Launch plan.md");
  expect(cleanFolder(" a / b ").ok && must(cleanFolder(" a / b "))).toBe("a/b");
  expect(fileOf({ folder: "" }, "", "Top")).toBe("Top.md");
});
test("someone else saved first: new words are a conflict, not an overwrite", async () => {
  const space = must(createSpace(db, ben, { name: "Race", repo: "ben/race" }));
  must(joinSpace(db, sam, { code: space.join_code! }));
  const note = must(addNote(db, ben, { title: "Plan", space: space.id, body: "v1" }));
  await Bun.sleep(3); // updated_at is to the millisecond
  const theirs = must(updateNote(db, sam, { id: note.id, body: "sam's v2", base: note.updated_at }));
  const mine = updateNote(db, ben, { id: note.id, body: "ben's v2", base: note.updated_at });
  expect(mine.ok).toBe(false);
  if (!mine.ok) expect(mine.error).toBe("conflict");
  expect(must(getNote(db, ben, { id: note.id })).body).toBe("sam's v2");
  // Written against what is there now, it goes through.
  expect(must(updateNote(db, ben, { id: note.id, body: "ben's v3", base: theirs.updated_at })).body).toBe("ben's v3");
});
test("sync reads the folder, commits what is written here, and takes what is pushed there", async () => {
  const repo = fakeForge({
    "README.md": "# not in the folder",
    "docs/Ideas.md": "---\ntags: [brainstorm, q4]\n---\nSee [[Pricing]].",
    "docs/research/Pricing.md": "per seat? #money",
    "docs/research/chart.png": "binary",
    "docs/.obsidian/workspace.md": "editor settings",
  });
  const space = must(createSpace(db, ben, { name: "Synced", repo: "ben/synced", folder: "docs" }));
  const first = await syncSpace(db, repo.forge, space.id);
  expect(first.pulled).toBe(2);
  const notes = () => must(listNotes(db, ben, { space: space.id }));
  const byTitle = (t: string) => notes().find((n) => n.title === t)!;
  expect(notes().map((n) => n.path).sort()).toEqual(["docs/Ideas.md", "docs/research/Pricing.md"]);
  expect(md.tags(byTitle("Ideas").body).sort()).toEqual(["brainstorm", "q4"]);
  // Nothing changed here, so nothing is committed.
  expect((await syncSpace(db, repo.forge, space.id)).pushed).toBe(0);
  expect(repo.commits).toEqual([]);
  // Written, made, renamed and removed here → one commit.
  must(updateNote(db, ben, { id: byTitle("Ideas").id, body: "See [[Pricing]] and [[Naming]]." }));
  must(addNote(db, ben, { title: "Naming", space: space.id, folder: "research", body: "names" }));
  must(updateNote(db, ben, { id: byTitle("Pricing").id, title: "Pricing model" }));
  const wrote = await syncSpace(db, repo.forge, space.id);
  expect(repo.commits.length).toBe(1);
  expect(repo.commits[0]!.message).toContain("Written in notes by ben");
  expect(wrote.pushed).toBe(4);
  expect([...repo.tree.keys()].sort()).toEqual([
    "README.md",
    "docs/.obsidian/workspace.md",
    "docs/Ideas.md",
    "docs/research/Naming.md",
    "docs/research/Pricing model.md",
    "docs/research/chart.png",
  ]);
  expect(repo.tree.get("docs/Ideas.md")).toBe("See [[Pricing model]] and [[Naming]].");
  // The next read finds our own commit and changes nothing.
  expect((await syncSpace(db, repo.forge, space.id)).pulled).toBe(0);
  must(deleteNote(db, ben, { id: byTitle("Naming").id }));
  await syncSpace(db, repo.forge, space.id);
  expect(repo.tree.has("docs/research/Naming.md")).toBe(false);
  // Someone pushes: a change, a new file, a removal.
  repo.push({
    "docs/Ideas.md": "Rewritten on a laptop.",
    "docs/meetings/2026-10-13.md": "# Kickoff",
    "docs/research/Pricing model.md": null,
  });
  const read = await syncSpace(db, repo.forge, space.id);
  expect(read.pulled).toBe(3);
  expect(byTitle("Ideas").body).toBe("Rewritten on a laptop.");
  expect(byTitle("Ideas").author_name).toBe("the repository");
  expect(byTitle("2026-10-13").path).toBe("docs/meetings/2026-10-13.md");
  expect(notes().some((n) => n.title === "Pricing model")).toBe(false);
  expect(repo.commits.length).toBe(2);
});
test("edited in both places: ours is committed, theirs is kept beside it — nothing is lost", async () => {
  const repo = fakeForge({ "Plan.md": "v1" });
  const space = must(createSpace(db, ben, { name: "Both", repo: "ben/both" }));
  await syncSpace(db, repo.forge, space.id);
  const plan = must(listNotes(db, ben, { space: space.id }))[0]!;
  must(updateNote(db, ben, { id: plan.id, body: "ours" }));
  repo.push({ "Plan.md": "theirs" });
  const r = await syncSpace(db, repo.forge, space.id);
  expect(r.copies).toBe(1);
  expect(repo.tree.get("Plan.md")).toBe("ours");
  expect(repo.tree.get("Plan (repo copy).md")).toBe("theirs");
  const titles = must(listNotes(db, ben, { space: space.id })).map((n) => n.title).sort();
  expect(titles).toEqual(["Plan", "Plan (repo copy)"]);
});
test("a repository that can't be read is said, and the space remembers why", async () => {
  const space = must(createSpace(db, ben, { name: "Broken", repo: "ben/gone" }));
  const broken: Forge = {
    ...fakeForge().forge,
    head: async () => {
      throw new Error("No repository ben/gone — or the token can't see it.");
    },
  };
  await expect(syncSpace(db, broken, space.id)).rejects.toThrow("No repository");
  const row = mySpaces(db, ben).find((s) => s.id === space.id)!;
  expect(row.sync_error).toContain("No repository");
});
test("properties at the top of a note read as properties, not as a rule and a paragraph", () => {
  const html = md.render("---\ntitle: Plan\ntags:\n  - a\n  - b\n---\n# Body", {});
  expect(html).toContain('<dl class="properties">');
  expect(html).toContain("<dd>a, b</dd>");
  expect(html).not.toContain("<hr>");
  expect(md.tags("---\ntags: x, y\n---\n#z")).toEqual(["x", "y", "z"]);
  expect(md.render("[[Missing]] #t", { base: "/s/3" })).toContain('href="/s/3/open?title=Missing"');
});
@@ -0,0 +1,261 @@
/**
 * Shared folders. A space is a folder of a git repository on the forge —
 * `docs/` of `ben/brainstorm`, say — that its members write in together.
 * Its notes are ordinary notes whose vault is the space (author_id
 * `space:<id>`), so links, backlinks, tags, search and the graph work in it
 * exactly as they do in a personal vault, and never reach across: a
 * personal vault and a space share nothing. Each note keeps its file's
 * path, and `src/sync.ts` keeps the folder and the repository in step.
 *
 * Who is in: the person who made it (an app admin — the repository token
 * is theirs, so nobody else may point it at a repository), and whoever
 * opened its join link while it was on. The owner can turn the link off,
 * make a new one, and remove members; a member can leave.
 */
import type { Database } from "bun:sqlite";
import { randomBytes } from "node:crypto";
import { emit } from "./live.ts";
import type { Failure, Result } from "./actions.ts";
import type { Who } from "./who.ts";
export interface Space {
  readonly id: number;
  readonly name: string;
  /** `owner/name` on the forge. */
  readonly repo: string;
  readonly branch: string;
  /** The folder in the repository the notes live in, `""` for its root. */
  readonly folder: string;
  readonly owner_id: string;
  readonly owner_name: string;
  readonly join_code: string | null;
  /** The commit the notes were last read from. */
  readonly head: string | null;
  readonly synced_at: string | null;
  readonly sync_error: string | null;
  readonly created_at: string;
}
export interface Member {
  readonly who_id: string;
  readonly who_name: string;
  readonly joined_at: string;
}
const ok = <T>(value: T): Result<T> => ({ ok: true, value });
const fail = <T>(error: Failure, message: string): Result<T> => ({ ok: false, error, message });
/** The vault a space's notes are kept in: what their author_id says. */
export const spaceVault = (id: number): string => `space:${id}`;
/** The space a vault is, when it is one. */
export const spaceOf = (vault: string): number | undefined => {
  const m = /^space:(\d+)$/.exec(vault);
  return m === null ? undefined : Number(m[1]);
};
/** A space's address in the app. */
export const spaceHref = (id: number): string => `/s/${id}`;
export const findSpace = (db: Database, id: number): Space | undefined =>
  Number.isInteger(id)
    ? (db.query<Space, [number]>("SELECT * FROM space WHERE id = ?1").get(id) ?? undefined)
    : undefined;
export const isMember = (db: Database, id: number, who: Who): boolean =>
  who.role !== "anon" &&
  db
    .query<{ n: number }, [number, string]>(
      "SELECT 1 AS n FROM space_member WHERE space_id = ?1 AND who_id = ?2",
    )
    .get(id, who.id) !== null;
export const members = (db: Database, id: number): Member[] =>
  db
    .query<Member, [number]>(
      "SELECT who_id, who_name, joined_at FROM space_member WHERE space_id = ?1 ORDER BY joined_at, who_name",
    )
    .all(id);
/** Tell every member of a space what changed in it. */
export function tellSpace(db: Database, id: number, type: string, data: unknown): void {
  for (const m of members(db, id)) emit(type, data, m.who_id);
}
/** The spaces `who` is in, by name. */
export const mySpaces = (db: Database, who: Who): Space[] =>
  who.role === "anon"
    ? []
    : db
        .query<Space, [string]>(
          "SELECT s.* FROM space s JOIN space_member m ON m.space_id = s.id WHERE m.who_id = ?1 ORDER BY s.name COLLATE NOCASE",
        )
        .all(who.id);
/** A space, for one of its members. */
export function getSpace(db: Database, who: Who, id: number): Result<Space> {
  if (who.role === "anon") return fail("signin_required", "Sign in to open this folder.");
  const space = findSpace(db, id);
  // Whoever is not in it learns nothing about whether it exists.
  if (space === undefined || !isMember(db, id, who)) return fail("not_found", "No such shared folder.");
  return ok(space);
}
/** A space, for its owner. */
function owned(db: Database, who: Who, id: number): Result<Space> {
  const space = getSpace(db, who, id);
  if (!space.ok) return space;
  if (who.role === "anon" || space.value.owner_id !== who.id)
    return fail("forbidden", "Only the folder's owner can do that.");
  return space;
}
const code = (): string => randomBytes(18).toString("base64url");
// What a repository, branch and folder may be called: the forge's own rules, roughly.
const REPO = /^[\w.-]+\/[\w.-]+$/;
const BRANCH = /^(?!-)(?!.*\.\.)[\w./-]{1,100}$/;
/** A file or folder name a note can have: one segment, nothing a filesystem or a link would trip on. */
export function cleanSegment(raw: string): Result<string> {
  const s = raw.replace(/\s+/g, " ").trim();
  if (s === "" || s.length > 120) return fail("invalid", "A name is 1 to 120 characters.");
  if (s.startsWith(".")) return fail("invalid", "A name cannot start with a dot.");
  if (/[\/\\:*?"<>|\[\]#^\u0000-\u001f]/.test(s))
    return fail("invalid", "A name cannot hold / \\ : * ? \" < > | [ ] # or ^.");
  return ok(s);
}
/** A folder path, `a/b`: each segment clean, no empty ones. `""` is the top. */
export function cleanFolder(raw: string): Result<string> {
  const parts = raw.split("/").map((p) => p.trim()).filter((p) => p !== "");
  const out: string[] = [];
  for (const p of parts) {
    const clean = cleanSegment(p);
    if (!clean.ok) return clean;
    out.push(clean.value);
  }
  return ok(out.join("/"));
}
const join = (...parts: string[]): string => parts.filter((p) => p !== "").join("/");
/** The file a note titled `title` in `folder` (relative to the space's own) is kept in. */
export const fileOf = (space: Pick<Space, "folder">, folder: string, title: string): string =>
  join(space.folder, folder, `${title}.md`);
/** The folder a file is in, relative to the space's own. */
export function folderOf(space: Pick<Space, "folder">, path: string): string {
  const dir = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
  if (space.folder === "") return dir;
  return dir === space.folder ? "" : dir.slice(space.folder.length + 1);
}
/** A file's note title: its name, without `.md`. */
export const titleOfPath = (path: string): string =>
  path.slice(path.lastIndexOf("/") + 1).replace(/\.md$/i, "");
/** Make a space: an app admin points it at a repository folder, and is its first member. */
export function createSpace(
  db: Database,
  who: Who,
  input: { name: string; repo: string; branch?: string; folder?: string },
): Result<Space> {
  if (who.role === "anon") return fail("signin_required", "Sign in to make a shared folder.");
  if (who.role !== "admin")
    return fail("forbidden", "Only an app admin can connect a repository — it is written to with their token.");
  const name = input.name.replace(/\s+/g, " ").trim();
  if (name === "" || name.length > 80) return fail("invalid", "A name is 1 to 80 characters.");
  const repo = input.repo.trim().replace(/^\/+|\/+$/g, "");
  if (!REPO.test(repo)) return fail("invalid", "The repository is owner/name, as on the forge.");
  const branch = (input.branch ?? "").trim() || "main";
  if (!BRANCH.test(branch)) return fail("invalid", "That is not a branch name.");
  const folder = cleanFolder(input.folder ?? "");
  if (!folder.ok) return folder;
  const taken = db
    .query<{ id: number }, [string, string, string]>(
      "SELECT id FROM space WHERE repo = ?1 AND branch = ?2 AND folder = ?3",
    )
    .get(repo, branch, folder.value);
  if (taken !== null) return fail("invalid", "That folder is already shared here.");
  const space = db.transaction(() => {
    const made = db
      .query<Space, [string, string, string, string, string, string, string]>(
        "INSERT INTO space (name, repo, branch, folder, owner_id, owner_name, join_code) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7) RETURNING *",
      )
      .get(name, repo, branch, folder.value, who.id, who.name, code())!;
    db.query("INSERT INTO space_member (space_id, who_id, who_name) VALUES (?1, ?2, ?3)").run(
      made.id,
      who.id,
      who.name,
    );
    return made;
  })();
  return ok(space);
}
/** Open a join link: whoever is signed in becomes a member. */
export function joinSpace(db: Database, who: Who, input: { code: string }): Result<Space> {
  if (who.role === "anon") return fail("signin_required", "Sign in, then open the link again.");
  const space =
    input.code === ""
      ? null
      : db.query<Space, [string]>("SELECT * FROM space WHERE join_code = ?1").get(input.code);
  if (space === null) return fail("not_found", "That link has been turned off, or was never one.");
  db.query(
    "INSERT INTO space_member (space_id, who_id, who_name) VALUES (?1, ?2, ?3) ON CONFLICT (space_id, who_id) DO UPDATE SET who_name = excluded.who_name",
  ).run(space.id, who.id, who.name);
  tellSpace(db, space.id, "space.changed", { id: space.id });
  return ok(space);
}
/** Turn the join link off, or on with a new address (the old one stops working). */
export function setLink(db: Database, who: Who, input: { id: number; on: boolean }): Result<Space> {
  const space = owned(db, who, input.id);
  if (!space.ok) return space;
  return ok(
    db
      .query<Space, [string | null, number]>("UPDATE space SET join_code = ?1 WHERE id = ?2 RETURNING *")
      .get(input.on ? code() : null, input.id)!,
  );
}
/** The owner removes a member, or a member leaves. The owner stays. */
export function removeMember(
  db: Database,
  who: Who,
  input: { id: number; member: string },
): Result<{ id: number }> {
  const space = getSpace(db, who, input.id);
  if (!space.ok) return space;
  if (who.role === "anon") return fail("signin_required", "Sign in first.");
  const self = input.member === who.id;
  if (!self && space.value.owner_id !== who.id)
    return fail("forbidden", "Only the folder's owner can remove someone.");
  if (input.member === space.value.owner_id)
    return fail("invalid", "The owner can't leave their own folder — delete it instead.");
  db.query("DELETE FROM space_member WHERE space_id = ?1 AND who_id = ?2").run(input.id, input.member);
  emit("space.changed", { id: input.id }, input.member);
  tellSpace(db, input.id, "space.changed", { id: input.id });
  return ok({ id: input.id });
}
/** Stop sharing: the space and its copy of the notes go; the repository keeps every file. */
export function deleteSpace(db: Database, who: Who, input: { id: number }): Result<{ id: number }> {
  const space = owned(db, who, input.id);
  if (!space.ok) return space;
  const everyone = members(db, input.id);
  db.transaction(() => {
    db.query("DELETE FROM note WHERE author_id = ?1").run(spaceVault(input.id));
    db.query("DELETE FROM space WHERE id = ?1").run(input.id);
  })();
  for (const m of everyone) emit("space.changed", { id: input.id }, m.who_id);
  return ok({ id: input.id });
}
// A change to a space's notes is a commit owed: `src/sync.ts` listens here
// (and actions call `edited`) so the two never import each other.
let onEdit: (id: number) => void = () => {};
export const whenEdited = (listen: (id: number) => void): void => {
  onEdit = listen;
};
export const edited = (id: number): void => onEdit(id);
@@ -0,0 +1,359 @@
/**
 * A shared folder and its repository, kept in step. The notes live here,
 * so the page is as quick as a personal vault; the repository is where
 * they are kept, so they are plain markdown files anyone can clone, push
 * to, or open in another editor.
 *
 * One pass (`syncSpace`) reads, then writes:
 *
 *   read   when the branch has moved since the last read, walk the folder
 *          and take every file that changed. A note nobody has touched
 *          here takes the repository's words; a note edited here *and*
 *          there keeps ours, and the repository's version is kept beside
 *          it as "<title> (repo copy)" — nothing is ever lost.
 *   write  whatever was written, renamed, moved or removed here since,
 *          as one commit.
 *
 * A note knows what the repository last had (synced_path and the git blob
 * of its words, synced_oid), so "changed here" is a comparison, never a
 * flag to forget. Commits go through the forge's API with a token
 * (NOTES_REPO_TOKEN): the app's own token reads only.
 *
 * Writes are owed, not immediate: a change waits a few seconds for the
 * next (typing is many saves), and a slow trickle still commits within
 * MAX_WAIT_MS. Every space is also read once a minute.
 */
import type { Database } from "bun:sqlite";
import { createHash } from "node:crypto";
import type { Note } from "./actions.ts";
import { BODY_MAX } from "./actions.ts";
import { findSpace, spaceVault, tellSpace, titleOfPath, whenEdited, type Space } from "./spaces.ts";
/** The git blob id of some words: what `git hash-object` says of the file. */
export function blobOid(text: string): string {
  const bytes = Buffer.from(text, "utf8");
  return createHash("sha1").update(`blob ${bytes.length}\0`).update(bytes).digest("hex");
}
export interface Entry {
  readonly name: string;
  readonly type: "blob" | "tree" | string;
  readonly oid: string;
  readonly size: number;
}
/** The forge, as much of it as a shared folder needs. */
export interface Forge {
  /** The commit at the tip of a branch; null when there is none yet. */
  head(repo: string, branch: string): Promise<string | null>;
  /** A folder's entries at a commit; null when it doesn't exist. */
  list(repo: string, ref: string, path: string): Promise<Entry[] | null>;
  /** A file's words at a commit. */
  read(repo: string, ref: string, path: string): Promise<string>;
  /** Write and remove files (`content: null`) as one commit on `branch`. */
  commit(
    repo: string,
    branch: string,
    message: string,
    files: { path: string; content: string | null }[],
  ): Promise<string>;
}
type Fetch = (input: string, init?: RequestInit) => Promise<Response>;
/** The forge's JSON API (`<forge>/api/v1`), as a token that may write the repositories. */
export function httpForge(api: string, token: string, fetch: Fetch = globalThis.fetch): Forge {
  const base = api.replace(/\/+$/, "");
  const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
  const at = (repo: string, rest: string) => `${base}/repos/${repo}/${rest}`;
  const path = (p: string) => p.split("/").map(encodeURIComponent).join("/");
  const failed = async (r: Response, what: string): Promise<never> => {
    throw new Error(`${what}: HTTP ${r.status} ${(await r.text()).slice(0, 200)}`);
  };
  return {
    async head(repo, branch) {
      const r = await fetch(at(repo, `commits?ref=${encodeURIComponent(branch)}&limit=1`), { headers });
      if (r.status === 404) throw new Error(`No repository ${repo} — or the token can't see it.`);
      if (!r.ok) return failed(r, "read the branch");
      const log = (await r.json()) as { oid?: string }[];
      return log[0]?.oid ?? null;
    },
    async list(repo, ref, p) {
      const r = await fetch(at(repo, `contents${p === "" ? "" : `/${path(p)}`}?ref=${encodeURIComponent(ref)}`), {
        headers,
      });
      if (r.status === 404) return null;
      if (!r.ok) return failed(r, `list ${p || "/"}`);
      const answer = (await r.json()) as { type?: string; entries?: Entry[] };
      return answer.type === "dir" ? (answer.entries ?? []) : null;
    },
    async read(repo, ref, p) {
      const r = await fetch(at(repo, `contents/${path(p)}?ref=${encodeURIComponent(ref)}`), { headers });
      if (!r.ok) return failed(r, `read ${p}`);
      const answer = (await r.json()) as { encoding?: string; content?: string };
      const content = answer.content ?? "";
      return answer.encoding === "base64" ? Buffer.from(content, "base64").toString("utf8") : content;
    },
    async commit(repo, branch, message, files) {
      const r = await fetch(at(repo, "edits"), {
        method: "POST",
        headers,
        body: JSON.stringify({ branch, message, files }),
      });
      if (!r.ok) return failed(r, "commit");
      const answer = (await r.json()) as { commit?: { commitOid?: string; oid?: string } | string };
      const c = answer.commit;
      return typeof c === "string" ? c : (c?.commitOid ?? c?.oid ?? "");
    },
  };
}
/** Folders a vault never holds: git's, and editors' own settings (`.obsidian`, `.vscode`). */
const hidden = (name: string): boolean => name.startsWith(".") || name === "node_modules";
/** Every markdown file under `folder`, path → blob id. */
async function walk(forge: Forge, space: Space, ref: string): Promise<Map<string, Entry>> {
  const files = new Map<string, Entry>();
  const visit = async (dir: string, depth: number): Promise<void> => {
    if (depth > 12) return;
    const entries = await forge.list(space.repo, ref, dir);
    for (const e of entries ?? []) {
      if (hidden(e.name)) continue;
      const p = dir === "" ? e.name : `${dir}/${e.name}`;
      if (e.type === "tree") await visit(p, depth + 1);
      else if (e.type === "blob" && /\.md$/i.test(e.name) && e.size <= BODY_MAX) files.set(p, e);
    }
  };
  await visit(space.folder, 0);
  return files;
}
const NOW = "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
const notesOf = (db: Database, space: Space): Note[] =>
  db.query<Note, [string]>("SELECT * FROM note WHERE author_id = ?1").all(spaceVault(space.id));
/** Whether the note has words, a name or a place the repository hasn't been given yet. */
export const unsynced = (n: Note): boolean =>
  n.path !== null && (n.synced_path === null || n.synced_path !== n.path || n.synced_oid !== blobOid(n.body));
/** A title nobody in the vault has yet: `base`, else `base 2`, `base 3`, … */
function freeTitle(db: Database, vault: string, base: string): string {
  const taken = (t: string) =>
    db
      .query<{ id: number }, [string, string]>("SELECT id FROM note WHERE author_id = ?1 AND title = ?2 COLLATE NOCASE")
      .get(vault, t) !== null;
  if (!taken(base)) return base;
  for (let n = 2; ; n++) if (!taken(`${base} ${n}`)) return `${base} ${n}`;
}
export interface Report {
  /** Notes taken from the repository: new, changed, removed. */
  readonly pulled: number;
  /** Files the commit wrote or removed. */
  readonly pushed: number;
  /** Repository versions kept beside a note edited in both places. */
  readonly copies: number;
  readonly commit?: string;
}
/** Read what the repository has that we don't — when the branch has moved. */
async function pull(db: Database, forge: Forge, space: Space, head: string | null): Promise<{ pulled: number; copies: number }> {
  if (head === null || head === space.head) return { pulled: 0, copies: 0 };
  const vault = spaceVault(space.id);
  const files = await walk(forge, space, head);
  const notes = notesOf(db, space);
  const bySynced = new Map(notes.filter((n) => n.synced_path !== null).map((n) => [n.synced_path!, n]));
  const byPath = new Map(notes.filter((n) => n.path !== null).map((n) => [n.path!.toLowerCase(), n]));
  const gone = new Set(
    db
      .query<{ path: string }, [number]>("SELECT path FROM space_gone WHERE space_id = ?1")
      .all(space.id)
      .map((g) => g.path),
  );
  // Read every changed file first, then write them all at once.
  const wanted = [...files].filter(([p, e]) => bySynced.get(p)?.synced_oid !== e.oid && !gone.has(p));
  const words = new Map<string, string>();
  for (const [p] of wanted) words.set(p, await forge.read(space.repo, head, p));
  let pulled = 0;
  let copies = 0;
  const changed: Note[] = [];
  const removed: number[] = [];
  db.transaction(() => {
    const keepCopy = (note: Note, body: string) => {
      const title = freeTitle(db, vault, `${note.title} (repo copy)`);
      const dir = note.path!.includes("/") ? note.path!.slice(0, note.path!.lastIndexOf("/") + 1) : "";
      changed.push(
        db
          .query<Note, [string, string, string, string]>(
            "INSERT INTO note (title, body, author_id, author_name, path) VALUES (?1, ?2, ?3, 'the repository', ?4) RETURNING *",
          )
          .get(title, body, vault, `${dir}${title}.md`)!,
      );
      copies++;
    };
    for (const [p, entry] of files) {
      if (gone.has(p)) continue;
      const known = bySynced.get(p);
      if (known !== undefined && known.synced_oid === entry.oid) continue;
      const body = words.get(p)!;
      // Made here and there under one name before either had seen the other.
      const twin = known ?? (byPath.get(p.toLowerCase())?.synced_path === null ? byPath.get(p.toLowerCase()) : undefined);
      if (twin !== undefined) {
        // Ours wins only when its words changed here too; a rename alone takes theirs.
        const ours = blobOid(twin.body) !== twin.synced_oid && twin.body !== body;
        if (ours) keepCopy(twin, body);
        changed.push(
          db
            .query<Note, [string, string, string, number]>(
              ours
                ? "UPDATE note SET synced_path = ?2, synced_oid = ?3 WHERE id = ?4 RETURNING *"
                : `UPDATE note SET body = ?1, synced_path = ?2, synced_oid = ?3, author_name = 'the repository', updated_at = ${NOW} WHERE id = ?4 RETURNING *`,
            )
            .get(body, p, entry.oid, twin.id)!,
        );
        if (!ours) pulled++;
        continue;
      }
      // A note here moved onto this name while the repository wrote its own
      // file there: keep theirs beside it.
      const squatter = byPath.get(p.toLowerCase());
      if (squatter !== undefined) {
        keepCopy(squatter, body);
        continue;
      }
      // A file new to us: a note, titled by its name (or, when another
      // folder already has that name, by its name and a number).
      const title = freeTitle(db, vault, titleOfPath(p).replace(/[\[\]|#^\\]/g, " ").trim() || "Untitled");
      changed.push(
        db
          .query<Note, [string, string, string, string]>(
            "INSERT INTO note (title, body, author_id, author_name, path, synced_path, synced_oid) VALUES (?1, ?2, ?3, 'the repository', ?4, ?4, ?5) RETURNING *",
          )
          .get(title, body, vault, p, entry.oid)!,
      );
      pulled++;
    }
    // Files the repository no longer has: gone here too, unless edited here
    // since — then they are written back.
    for (const n of notes) {
      if (n.synced_path === null || files.has(n.synced_path)) continue;
      if (unsynced(n)) db.query("UPDATE note SET synced_path = NULL, synced_oid = NULL WHERE id = ?1").run(n.id);
      else {
        db.query("DELETE FROM note WHERE id = ?1").run(n.id);
        removed.push(n.id);
        pulled++;
      }
    }
    for (const p of gone) if (!files.has(p)) db.query("DELETE FROM space_gone WHERE space_id = ?1 AND path = ?2").run(space.id, p);
    db.query("UPDATE space SET head = ?1 WHERE id = ?2").run(head, space.id);
  })();
  for (const n of changed) tellSpace(db, space.id, "note.changed", { id: n.id, title: n.title, updated_at: n.updated_at });
  for (const id of removed) tellSpace(db, space.id, "note.removed", { id });
  return { pulled, copies };
}
/** Commit whatever was written here since the repository last heard. */
async function push(db: Database, forge: Forge, space: Space): Promise<{ pushed: number; commit?: string }> {
  const notes = notesOf(db, space).filter(unsynced);
  const gone = db
    .query<{ path: string }, [number]>("SELECT path FROM space_gone WHERE space_id = ?1")
    .all(space.id)
    .map((g) => g.path);
  if (notes.length === 0 && gone.length === 0) return { pushed: 0 };
  const writes = new Map<string, string | null>();
  for (const n of notes) writes.set(n.path!, n.body);
  // A rename or a move leaves its old file behind; a removal takes its file.
  for (const n of notes) if (n.synced_path !== null && n.synced_path !== n.path && !writes.has(n.synced_path)) writes.set(n.synced_path, null);
  for (const p of gone) if (!writes.has(p)) writes.set(p, null);
  const files = [...writes].map(([path, content]) => ({ path, content }));
  const written = notes.map((n) => n.title);
  const who = [...new Set(notes.map((n) => n.author_name))].filter((n) => n !== "the repository");
  const subject =
    written.length === 0
      ? `notes: remove ${gone.length} ${gone.length === 1 ? "note" : "notes"}`
      : `notes: ${written.slice(0, 3).join(", ")}${written.length > 3 ? ` and ${written.length - 3} more` : ""}${gone.length > 0 ? `, removed ${gone.length}` : ""}`;
  const message = `${subject}${who.length > 0 ? `\n\nWritten in notes by ${who.join(", ")}.` : ""}`;
  const commit = await forge.commit(space.repo, space.branch, message, files);
  db.transaction(() => {
    for (const n of notes)
      db.query("UPDATE note SET synced_path = ?1, synced_oid = ?2 WHERE id = ?3").run(n.path, blobOid(n.body), n.id);
    for (const p of gone) db.query("DELETE FROM space_gone WHERE space_id = ?1 AND path = ?2").run(space.id, p);
  })();
  // The head stays where it was read: someone may have pushed just before
  // this commit landed on top of theirs, and the next read must see it.
  // Files of ours it finds unchanged (their blob is the one we wrote).
  return { pushed: files.length, commit };
}
const running = new Map<number, Promise<Report>>();
/** One pass for one space: read, then write. Passes for a space never overlap. */
export function syncSpace(db: Database, forge: Forge, id: number): Promise<Report> {
  const before = running.get(id) ?? Promise.resolve(undefined);
  const pass = before
    .catch(() => undefined)
    .then(async (): Promise<Report> => {
      const space = findSpace(db, id);
      if (space === undefined) return { pulled: 0, pushed: 0, copies: 0 };
      try {
        const head = await forge.head(space.repo, space.branch);
        const read = await pull(db, forge, space, head);
        const wrote = await push(db, forge, findSpace(db, id) ?? space);
        db.query(`UPDATE space SET synced_at = ${NOW}, sync_error = NULL WHERE id = ?1`).run(id);
        if (read.pulled + read.copies + wrote.pushed > 0) tellSpace(db, id, "space.synced", { id });
        return { ...read, pushed: wrote.pushed, ...(wrote.commit === undefined ? {} : { commit: wrote.commit }) };
      } catch (e) {
        const message = e instanceof Error ? e.message : String(e);
        db.query(`UPDATE space SET synced_at = ${NOW}, sync_error = ?1 WHERE id = ?2`).run(message.slice(0, 500), id);
        tellSpace(db, id, "space.synced", { id });
        throw e;
      }
    });
  running.set(id, pass);
  void pass.finally(() => {
    if (running.get(id) === pass) running.delete(id);
  }).catch(() => {});
  return pass;
}
export const WAIT_MS = 4_000;
export const MAX_WAIT_MS = 20_000;
export const EVERY_MS = 60_000;
/**
 * Keep every space in step from now on: a pass a moment after each edit,
 * and one a minute for whatever was pushed to the repository. Returns the
 * way to stop.
 */
export function startSync(db: Database, forge: Forge | undefined): () => void {
  if (forge === undefined) return () => {};
  const timers = new Map<number, { timer: ReturnType<typeof setTimeout>; first: number }>();
  const quiet = (id: number) => syncSpace(db, forge, id).catch(() => {});
  whenEdited((id) => {
    const owed = timers.get(id);
    const first = owed?.first ?? Date.now();
    if (owed !== undefined) clearTimeout(owed.timer);
    const wait = Math.max(0, Math.min(WAIT_MS, first + MAX_WAIT_MS - Date.now()));
    timers.set(id, {
      first,
      timer: setTimeout(() => {
        timers.delete(id);
        void quiet(id);
      }, wait),
    });
  });
  const all = () => {
    for (const { id } of db.query<{ id: number }, []>("SELECT id FROM space").all()) void quiet(id);
  };
  const minute = setInterval(all, EVERY_MS);
  setTimeout(all, 1_000);
  return () => {
    clearInterval(minute);
    for (const t of timers.values()) clearTimeout(t.timer);
    whenEdited(() => {});
  };
}
@@ -44,9 +44,11 @@
export const hrefOf = (note: { readonly id: number }): string => `/n/${note.id}`
export function renderNote(
  body: string,
  notes: readonly VaultNote[],
  base = "",
): string {
  const titles = byTitle(notes);
  return md.render(body, {
    base,
    resolve: (title: string) => {
      const found = titles.get(key(title));
      return found === undefined ? null : hrefOf(found);
@@ -191,7 +193,7 @@
export function relink(body: string, from: string, to: string): string {
/** A plain-text preview of a note's first words, for lists. */
export function excerpt(body: string, max = 120): string {
  const text = body
  const text = (md.frontmatter(body)?.body ?? body)
    .replace(/^(```|~~~)[\s\S]*?^\1/gm, "")
    .replace(/^#{1,6}\s+/gm, "")
    .replace(/\[\[([^\]|]+)\|([^\]]+)\]\]/g, "$2")
@@ -1189,3 +1189,99 @@
form {
    animation: none;
  }
}
/* ── Shared folders ─────────────────────────────────────────────────── */
.file-title svg,
.folder summary svg {
  width: 1em;
  height: 1em;
  margin-right: var(--space-1);
  vertical-align: -0.125em;
  fill: none;
  stroke: currentColor;
  stroke-width: 1.8;
  stroke-linejoin: round;
}
.folder > summary {
  display: flex;
  align-items: center;
  min-height: 2rem;
  padding: var(--space-1) var(--space-2);
  border-radius: var(--radius-sm);
  color: var(--color-muted);
  font-weight: 600;
  cursor: pointer;
  list-style: none;
}
.folder > summary::-webkit-details-marker {
  display: none;
}
.folder > summary:hover {
  background: var(--color-hover);
}
.folder > .file-list {
  margin-left: var(--space-3);
  padding-left: var(--space-1);
  border-left: 1px solid var(--color-line);
}
.sync-line {
  margin: var(--space-4) var(--space-2) 0;
  overflow-wrap: anywhere;
}
.sync-line.is-error {
  color: var(--color-danger);
}
.file-path code {
  overflow-wrap: anywhere;
}
.move {
  display: flex;
  align-items: end;
  gap: var(--space-2);
}
.move .field {
  flex: 1;
  min-width: 0;
}
.people {
  list-style: none;
  margin: 0 0 var(--space-3);
  padding: 0;
}
.people li {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: var(--space-2);
  min-height: 2.5rem;
  border-bottom: 1px solid var(--color-line);
}
.join-link {
  width: 100%;
  margin-bottom: var(--space-2);
  font-family: var(--font-mono);
  font-size: var(--text-sm);
}
.join-link[data-copied="true"] {
  border-color: var(--color-accent);
}
#collide {
  display: inline-flex;
  gap: var(--space-1);
}
.md .properties {
  display: grid;
  grid-template-columns: max-content 1fr;
  gap: var(--space-1) var(--space-3);
  margin: 0 0 var(--space-4);
  padding: var(--space-2) var(--space-3);
  border: 1px solid var(--color-line);
  border-radius: var(--radius-sm);
  font-size: var(--text-sm);
}
.md .properties dt {
  color: var(--color-muted);
}
.md .properties dd {
  margin: 0;
}
@@ -25,6 +25,12 @@
const store = {
  },
};
/** Where this vault's pages are: "" for yours, /s/<id> for a shared folder. */
const base = $("#vault")?.dataset.base ?? "";
const space = $("#vault")?.dataset.space;
/** In a shared folder, new notes go in the folder of the note you are in. */
const folder = () => $('form[action$="/new"] input[name="folder"]')?.value ?? "";
/** The vault's titles, as the page last heard them. */
function vault() {
  try {
@@ -45,12 +51,15 @@
async function createNote(title) {
  const r = await fetch("/api/notes", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify(title ? { title } : {}),
    body: JSON.stringify({
      ...(title ? { title } : {}),
      ...(space ? { space: Number(space), folder: folder() } : {}),
    }),
  });
  if (r.ok) {
    const note = await r.json();
    await go(`/n/${note.id}`);
  } else if (title) location.href = `/open?title=${encodeURIComponent(title)}`;
  } else if (title) location.href = `${base}/open?title=${encodeURIComponent(title)}`;
}
// ── Theme ─────────────────────────────────────────────────────────────
@@ -81,6 +90,15 @@
document.addEventListener("click", (e) => {
});
// ── Small things every page does ─────────────────────────────────────
// A join link selects itself, and is copied, when you click it.
document.addEventListener("click", (e) => {
  const box = e.target.closest?.("[data-select]");
  if (!box) return;
  box.select();
  navigator.clipboard?.writeText(box.value).then(() => {
    box.dataset.copied = "true";
  }, () => {});
});
for (const tz of $$('input[name="tz"]')) tz.value = String(new Date().getTimezoneOffset());
document.addEventListener("submit", (e) => {
  const message = e.target.dataset?.confirm;
@@ -228,10 +246,10 @@
document.addEventListener("keydown", (e) => {
    palette?.hidden === false ? closePalette() : openPalette();
  } else if (mod(e) && e.shiftKey && e.key.toLowerCase() === "d") {
    e.preventDefault();
    $('form[action="/daily"]')?.requestSubmit();
    $("form[data-daily]")?.requestSubmit();
  } else if (mod(e) && !e.shiftKey && e.key === "g") {
    e.preventDefault();
    go("/graph");
    go(`${base}/graph`);
  } else if (e.altKey && e.code === "KeyN") {
    e.preventDefault();
    createNote();
@@ -270,6 +288,8 @@
function editor(form) {
  let timer;
  let saving = null;
  let frame = 0;
  // Someone else saved while you were writing: nothing saves until you choose.
  let held = false;
  // Views: edit, split (side by side, on a wide screen), read. ⌘E flips
  // between reading and the last way you were writing.
@@ -310,7 +330,7 @@
function editor(form) {
  function draw() {
    cancelAnimationFrame(frame);
    frame = requestAnimationFrame(() => {
      preview.innerHTML = render(source.value, { resolve: resolver() }) || '<p class="muted">Nothing here yet.</p>';
      preview.innerHTML = render(source.value, { resolve: resolver(), base }) || '<p class="muted">Nothing here yet.</p>';
    });
  }
@@ -322,12 +342,14 @@
function editor(form) {
  }
  function changed() {
    dirty = titleEl.value !== saved.title || source.value !== saved.body;
    if (held) return;
    say(dirty ? "Editing…" : "Saved");
    clearTimeout(timer);
    if (dirty) timer = setTimeout(save, 600);
  }
  async function save() {
    clearTimeout(timer);
    if (held) return;
    if (saving) await saving;
    const body = {};
    const t = titleEl.value.trim();
@@ -338,6 +360,7 @@
function editor(form) {
      return;
    }
    say("Saving…");
    body.base = saved.updated;
    saving = (async () => {
      try {
        const r = await fetch(`/api/notes/${id}`, {
@@ -352,6 +375,8 @@
function editor(form) {
          if (body.title !== undefined) renamed(answer);
          say(dirty ? "Editing…" : answer.relinked ? `Saved · updated links in ${answer.relinked} ${answer.relinked === 1 ? "note" : "notes"}` : "Saved");
          if (dirty) timer = setTimeout(save, 600);
        } else if (r.status === 409) {
          collide(answer.message ?? "Someone else saved this note while you were writing.");
        } else if (r.status === 422 && body.title !== undefined) {
          say(answer.message ?? "That title can't be used.", "error");
          // Keep the words: save them under the old title.
@@ -374,6 +399,51 @@
function editor(form) {
    return saving;
  }
  flush = save;
  // Two people, one note: theirs is saved, yours is on screen. Say so, and
  // let the writer choose — never write over either without asking.
  function collide(message) {
    held = true;
    say(message, "error");
    if ($("#collide")) return;
    const bar = document.createElement("span");
    bar.id = "collide";
    bar.className = "row";
    const button = (label, act) => {
      const b = document.createElement("button");
      b.type = "button";
      b.className = "button button-quiet";
      b.textContent = label;
      b.addEventListener("click", act);
      bar.append(b);
    };
    const latest = async () => {
      const r = await fetch(`/api/notes/${id}`);
      return r.ok ? r.json() : null;
    };
    button("Load theirs", async () => {
      const note = await latest();
      if (!note) return;
      bar.remove();
      held = false;
      saved = { title: note.title, body: note.body, updated: note.updated_at };
      source.value = note.body;
      titleEl.value = note.title;
      renamed(note);
      dirty = false;
      draw();
      say("Loaded their version");
    });
    button("Keep mine", async () => {
      const note = await latest();
      if (!note) return;
      bar.remove();
      held = false;
      saved = { ...saved, updated: note.updated_at };
      save();
    });
    status?.after(bar);
  }
  function renamed(note) {
    const here = $(".crumb-here");
    if (here) here.textContent = note.title;
@@ -396,8 +466,9 @@
function editor(form) {
  });
  addEventListener("beforeunload", (e) => {
    if (!dirty) return;
    if (held) return e.preventDefault();
    // Best effort on the way out; the prompt covers what keepalive cannot carry.
    const body = JSON.stringify({ body: source.value, ...(titleEl.value.trim() !== saved.title && titleEl.value.trim() ? { title: titleEl.value.trim() } : {}) });
    const body = JSON.stringify({ body: source.value, base: saved.updated, ...(titleEl.value.trim() !== saved.title && titleEl.value.trim() ? { title: titleEl.value.trim() } : {}) });
    if (body.length < 60_000)
      fetch(`/api/notes/${id}`, { method: "PATCH", headers: { "content-type": "application/json" }, body, keepalive: true });
    else e.preventDefault();
@@ -406,7 +477,9 @@
function editor(form) {
  // Someone (another tab, a script, Claude over MCP) changed this note:
  // take their words if you have none of your own in flight.
  document.addEventListener("live:note.changed", async (e) => {
    if (String(e.detail.id) !== id || e.detail.updated_at === saved.updated || dirty || saving) return;
    if (String(e.detail.id) !== id || e.detail.updated_at === saved.updated || saving) return;
    // Mid-sentence when theirs arrives: don't wait for the save to find out.
    if (dirty) return collide("Someone else just saved this note.");
    const r = await fetch(`/api/notes/${id}`);
    if (!r.ok) return;
    const note = await r.json();
@@ -423,7 +496,7 @@
function editor(form) {
  document.addEventListener("live:note.removed", (e) => {
    if (String(e.detail.id) === id) {
      dirty = false;
      location.href = "/";
      location.href = base || "/";
    }
  });
  document.addEventListener("live:swapped", () => draw());
@@ -49,10 +49,47 @@
export function links(md) {
  return out;
}
/** The tags a note carries, lower-cased, once each, without the #. @param {string} md */
/**
 * A note's properties: the YAML-ish block between `---` lines at the very
 * top, the way Obsidian (and every static-site generator) writes it. Only
 * what a person reads is understood — `key: value`, `key: [a, b]` and a
 * key followed by `- item` lines — and the rest of the note is its body.
 * @param {string} md
 * @returns {{ props: [string, string[]][], body: string } | null}
 */
export function frontmatter(md) {
  const m = /^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(md);
  if (!m) return null;
  /** @type {[string, string[]][]} */
  const props = [];
  for (const line of m[1].split(/\r?\n/)) {
    const item = /^\s+-\s+(.*)$/.exec(line);
    if (item && props.length > 0) {
      props[props.length - 1][1].push(unquote(item[1]));
      continue;
    }
    const kv = /^([\w][\w .-]*?)\s*:\s*(.*)$/.exec(line);
    if (!kv) continue;
    const value = kv[2].trim();
    const listed = /^\[(.*)\]$/.exec(value);
    props.push([kv[1], listed ? listed[1].split(",").map(unquote).filter((v) => v !== "") : value === "" ? [] : [unquote(value)]]);
  }
  return { props, body: md.slice(m[0].length) };
}
/** @param {string} s */
const unquote = (s) => s.trim().replace(/^(["'])(.*)\1$/, "$2");
/** The tags a note carries, lower-cased, once each, without the #: in its words and in its `tags` property. @param {string} md */
export function tags(md) {
  const out = new Set();
  for (const m of prose(md).matchAll(TAG)) out.add(m[2].toLowerCase());
  const fm = frontmatter(md);
  for (const [key, values] of fm?.props ?? [])
    if (/^tags?$/i.test(key))
      for (const v of values.flatMap((v) => v.split(/[\s,]+/))) {
        const tag = v.replace(/^#/, "").toLowerCase();
        if (/^[\p{L}\p{N}_/-]*[\p{L}_/-][\p{L}\p{N}_/-]*$/u.test(tag)) out.add(tag);
      }
  for (const m of prose(fm?.body ?? md).matchAll(TAG)) out.add(m[2].toLowerCase());
  return [...out];
}
@@ -99,7 +136,7 @@
function marks(s, o) {
      const anchor = heading ? `#${slug(heading)}` : "";
      return hold(
        href === null
          ? `<a class="wikilink unresolved" href="/open?title=${encodeURIComponent(name)}" data-title="${escapeHtml(name)}">${shown}</a>`
          ? `<a class="wikilink unresolved" href="${o.base}/open?title=${encodeURIComponent(name)}" data-title="${escapeHtml(name)}">${shown}</a>`
          : `<a class="wikilink${embed ? " embed" : ""}" href="${escapeHtml(href)}${anchor}" data-title="${escapeHtml(name)}">${shown}</a>`,
      );
    })
@@ -112,7 +149,7 @@
function marks(s, o) {
      lead + hold(`<a href="${url}" rel="noopener noreferrer" target="_blank">${url}</a>`),
    )
    .replace(TAG, (_, lead, tag) =>
      lead + hold(`<a class="tag" href="/search?q=${encodeURIComponent(`#${unescapeHtml(tag)}`)}">#${tag}</a>`),
      lead + hold(`<a class="tag" href="${o.base}/search?q=${encodeURIComponent(`#${unescapeHtml(tag)}`)}">#${tag}</a>`),
    );
  s = s
    .replace(/\*\*(?=\S)([^*]*?\S)\*\*/g, "<strong>$1</strong>")
@@ -125,9 +162,11 @@
function marks(s, o) {
}
/**
 * @typedef {{ resolve: (title: string) => string | null }} Options
 * @typedef {{ resolve: (title: string) => string | null, base: string }} Options
 * `resolve` turns a linked note's title into its address, or null when no
 * such note exists yet (the link is drawn as one to create).
 * such note exists yet (the link is drawn as one to create). `base` is the
 * vault's own address (`""` for yours, `/s/<id>` for a shared one), where a
 * link to a note not written yet, or a tag, goes looking.
 */
const CALLOUTS = new Set(["note", "info", "tip", "success", "question", "warning", "danger", "bug", "example", "quote", "abstract", "todo", "failure"]);
@@ -138,8 +177,14 @@
const CALLOUTS = new Set(["note", "info", "tip", "success", "question", "warning
 * @param {Partial<Options>} [options]
 */
export function render(md, options = {}) {
  const o = { resolve: options.resolve ?? (() => null) };
  return blocks(md.replace(/\r\n?/g, "\n").split("\n"), o);
  const o = { resolve: options.resolve ?? (() => null), base: options.base ?? "" };
  const text = md.replace(/\r\n?/g, "\n");
  const fm = frontmatter(text);
  if (fm === null) return blocks(text.split("\n"), o);
  const props = fm.props
    .map(([k, v]) => `<dt>${escapeHtml(k)}</dt><dd>${v.map((x) => inline(escapeHtml(x), o)).join(", ") || "—"}</dd>`)
    .join("");
  return `${props === "" ? "" : `<dl class="properties">${props}</dl>\n`}${blocks(fm.body.split("\n"), o)}`;
}
/** @param {string[]} lines @param {Options} o */
		@@ -45,6 +45,39 @@ the MCP endpoint and the terminal are for forge accounts.
45	45	Everything is real: notes live in SQLite under `FORGE_APP_DATA`. A preview
46	46	of a pull gets a copy of production data; production is the default branch.
47	47
	48	## Shared folders
	49
	50	A shared folder is a folder of a git repository on the forge — say
	51	`docs/` of `ben/brainstorm` — that you and the people you invite write in
	52	together. Everything else in the app stays yours alone: a shared folder's
	53	notes never appear in anyone's own vault, search or graph, and its members
	54	never see yours.
	55
	56	- Connect one (app admins): sidebar → Vaults → Share a repo folder,
	57	then name, `owner/repo`, branch and folder. It reads the folder at once.
	58	Use a plain repository, not an app's: every save is a commit.
	59	- Invite: the folder's people icon → Join link. Anyone signed in (forge
	60	or email account) who opens it joins. Turn the link off afterwards, make a
	61	new one, or remove people there. Members can leave.
	62	- Inside: the sidebar shows the repo's folder tree. Links, backlinks,
	63	tags, search, the graph and daily notes work as in your vault, within the
	64	folder. Name a new note `ideas/Pricing` to put it in `ideas/`; the File
	65	panel moves a note to another folder. Front matter (`---` … `---`) reads
	66	as properties, and its `tags` are tags.
	67	- Git: every note is a `.md` file. Edits commit a few seconds after you
	68	stop typing (one commit for a burst, naming who wrote); renames and moves
	69	move the file; removing a note removes it. Anything pushed to the folder
	70	(from a laptop, VS Code, Obsidian) shows up within a minute, or at once
	71	with Sync now. A note changed in both places keeps the app's words and
	72	saves the repository's beside it as `<title> (repo copy)` — nothing is
	73	lost.
	74	- Two people, one note: the second save is refused when the note moved
	75	on underneath it, and the editor asks: Load theirs or Keep mine.
	76
	77	Commits are made with `NOTES_REPO_TOKEN` (Settings → App → Environment), a
	78	forge token that may write those repositories; without it there are no
	79	shared folders. Commits are authored as that token's owner.
	80
48	81	## Claude can use it too
49	82
50	83	`POST /mcp` is an MCP server with `list_notes`, `search_notes`,
		@@ -2,7 +2,8 @@
2	2	"roles": {
3	3	"anon": { "above": [], "held": { "by": "everyone" } },
4	4	"user": { "above": ["anon"], "held": { "by": "identity", "role": "user" } },
5		"author": { "above": ["user"], "held": { "by": "row", "column": "author_id" } },
	5	"member": { "above": ["user"], "held": { "by": "row", "column": "member_id" } },
	6	"author": { "above": ["member"], "held": { "by": "row", "column": "author_id" } },
6	7	"admin": { "above": ["user"], "held": { "by": "identity", "role": "admin" } }
7	8	},
8	9	"resources": {
		@@ -10,10 +11,10 @@
10	11	"api": "/api/notes",
11	12	"can": {
12	13	"create": "user",
13		"read": "author",
14		"update": "author",
15		"delete": "author",
16		"list": "author"
	14	"read": "member",
	15	"update": "member",
	16	"delete": "member",
	17	"list": "member"
17	18	}
18	19	},
19	20	"audit": {
		@@ -8,7 +8,7 @@
8	8	"paths": {
9	9	"/api/notes": {
10	10	"get": {
11		"summary": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first.",
	11	"summary": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first. With `space`, a shared folder's instead.",
12	12	"operationId": "getApiNotes",
13	13	"parameters": [
14	14	{
		@@ -20,6 +20,13 @@
20	20	"maximum": 5000
21	21	}
22	22	},
	23	{
	24	"name": "space",
	25	"in": "query",
	26	"schema": {
	27	"type": "integer"
	28	}
	29	},
23	30	{
24	31	"name": "q",
25	32	"in": "query",
		@@ -31,7 +38,7 @@
31	38	],
32	39	"responses": {
33	40	"200": {
34		"description": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first.",
	41	"description": "Your notes, pinned first then most recently changed; with `q`, the ones a search finds (words, \"a phrase\", #tag), best first. With `space`, a shared folder's instead.",
35	42	"content": {
36	43	"application/json": {
37	44	"schema": {
		@@ -57,7 +64,7 @@
57	64	"x-contract": {
58	65	"resource": "note",
59	66	"verb": "list",
60		"least": "author"
	67	"least": "member"
61	68	}
62	69	},
63	70	"post": {
		@@ -79,6 +86,14 @@
79	86	"type": "string",
80	87	"maxLength": 200000,
81	88	"description": "Markdown."
	89	},
	90	"space": {
	91	"type": "integer",
	92	"description": "A shared folder you are in, to add the note there instead of your vault."
	93	},
	94	"folder": {
	95	"type": "string",
	96	"description": "In a shared folder: the folder to put it in (`ideas/q4`)."
82	97	}
83	98	}
84	99	}
		@@ -153,7 +168,7 @@
153	168	"x-contract": {
154	169	"resource": "note",
155	170	"verb": "read",
156		"least": "author"
	171	"least": "member"
157	172	}
158	173	},
159	174	"patch": {
		@@ -188,6 +203,15 @@
188	203	},
189	204	"pinned": {
190	205	"type": "boolean"
	206	},
	207	"folder": {
	208	"type": "string",
	209	"description": "A shared note's folder: moves its file."
	210	},
	211	"base": {
	212	"type": "string",
	213	"format": "date-time",
	214	"description": "The updated_at you edited from; when someone has saved since, new words are refused with 409."
191	215	}
192	216	}
193	217	}
		@@ -235,6 +259,13 @@
235	259	"updated_at": {
236	260	"type": "string",
237	261	"format": "date-time"
	262	},
	263	"path": {
	264	"type": [
	265	"string",
	266	"null"
	267	],
	268	"description": "A shared folder's note: its file in the repository. Null for a note of your own."
238	269	}
239	270	},
240	271	"required": [
		@@ -278,7 +309,7 @@
278	309	"x-contract": {
279	310	"resource": "note",
280	311	"verb": "update",
281		"least": "author"
	312	"least": "member"
282	313	}
283	314	},
284	315	"delete": {
		@@ -327,7 +358,7 @@
327	358	"x-contract": {
328	359	"resource": "note",
329	360	"verb": "delete",
330		"least": "author"
	361	"least": "member"
331	362	}
332	363	}
333	364	},
		@@ -570,6 +601,13 @@
570	601	"updated_at": {
571	602	"type": "string",
572	603	"format": "date-time"
	604	},
	605	"path": {
	606	"type": [
	607	"string",
	608	"null"
	609	],
	610	"description": "A shared folder's note: its file in the repository. Null for a note of your own."
573	611	}
574	612	},
575	613	"required": [
		@@ -185,6 +185,7 @@ export async function deleteAccount(
185	185	const notes = db.transaction(() => {
186	186	const gone = db.query("DELETE FROM note WHERE author_id = ?1").run(`acct:${id}`).changes;
187	187	db.query("DELETE FROM session WHERE account_id = ?1").run(id);
	188	db.query("DELETE FROM space_member WHERE who_id = ?1").run(`acct:${id}`);
188	189	db.query("DELETE FROM account WHERE id = ?1").run(id);
189	190	return gone;
190	191	})();
		@@ -10,6 +10,19 @@ import type { Database } from "bun:sqlite";
10	10	import { record, type AuditRow } from "./audit.ts";
11	11	import { permit } from "./contract.ts";
12	12	import { emit } from "./live.ts";
	13	import {
	14	cleanFolder,
	15	cleanSegment,
	16	edited,
	17	fileOf,
	18	folderOf,
	19	getSpace,
	20	isMember,
	21	spaceOf,
	22	spaceVault,
	23	tellSpace,
	24	type Space,
	25	} from "./spaces.ts";
13	26	import { relink, search } from "./vault.ts";
14	27	import type { Who } from "./who.ts";
15	28
		@@ -22,9 +35,14 @@ export interface Note {
22	35	readonly author_name: string;
23	36	readonly created_at: string;
24	37	readonly updated_at: string;
	38	/** A shared note's file in its repository; null for a note of your own. */
	39	readonly path: string \| null;
	40	/** Where the repository last had it, and the git blob it had (src/sync.ts). */
	41	readonly synced_path: string \| null;
	42	readonly synced_oid: string \| null;
25	43	}
26	44
27		export type Failure = "signin_required" \| "forbidden" \| "not_found" \| "invalid";
	45	export type Failure = "signin_required" \| "forbidden" \| "not_found" \| "invalid" \| "conflict";
28	46	export type Result<T> =
29	47	\| { ok: true; value: T }
30	48	\| { ok: false; error: Failure; message: string };
		@@ -67,11 +85,31 @@ const audited = <T extends { readonly id: number }>(
67	85	return result;
68	86	};
69	87
70		/** Whose vault a change belongs to: its live events reach only them. */
71		const tell = (type: string, note: Note): void => {
72		emit(type, { id: note.id, title: note.title, updated_at: note.updated_at }, note.author_id);
	88	/** Whose vault a change belongs to: its live events reach only them — or, in a shared folder, its members. */
	89	const tell = (db: Database, type: string, note: Note): void => {
	90	const data = { id: note.id, title: note.title, updated_at: note.updated_at };
	91	const space = spaceOf(note.author_id);
	92	if (space === undefined) emit(type, data, note.author_id);
	93	else tellSpace(db, space, type, data);
73	94	};
74	95
	96	/**
	97	* The vault `who` means: their own, or — named by `space` — a shared
	98	* folder they are in. Every vault query takes the answer's `vault` where
	99	* it once took `who.id`, which is all a shared folder needs.
	100	*/
	101	function vaultFor(
	102	db: Database,
	103	who: Who,
	104	space: number \| undefined,
	105	): Result<{ vault: string; space?: Space }> {
	106	if (who.role === "anon") return fail("signin_required", "Sign in to open your notes.");
	107	if (space === undefined) return ok({ vault: who.id });
	108	const found = getSpace(db, who, space);
	109	if (!found.ok) return found;
	110	return ok({ vault: spaceVault(space), space: found.value });
	111	}
	112
75	113	/**
76	114	* A title, as the vault keeps it: trimmed, one line, and free of the
77	115	* characters a [[link]] uses to say something else (`[ ] \| # ^`).
		@@ -99,7 +137,7 @@ const checkBody = (body: string): Result<string> =>
99	137	export function listNotes(
100	138	db: Database,
101	139	who: Who,
102		input: { limit?: number } = {},
	140	input: { limit?: number; space?: number } = {},
103	141	): Result<Note[]> {
104	142	const limit = Math.min(
105	143	Math.max(Math.trunc(input.limit ?? VAULT_MAX) \|\| VAULT_MAX, 1),
		@@ -108,12 +146,14 @@ export function listNotes(
108	146	const may = permit(who, "note", "list");
109	147	if (may === "no" \|\| who.role === "anon")
110	148	return refuse(who, "Sign in to open your notes.", "You may not see these notes.");
	149	const vault = vaultFor(db, who, input.space);
	150	if (!vault.ok) return vault;
111	151	return ok(
112	152	db
113	153	.query<Note, [string, number]>(
114	154	"SELECT * FROM note WHERE author_id = ?1 ORDER BY pinned DESC, updated_at DESC, id DESC LIMIT ?2",
115	155	)
116		.all(who.id, limit),
	156	.all(vault.value.vault, limit),
117	157	);
118	158	}
119	159
		@@ -136,48 +176,85 @@ const titleTaken = (db: Database, authorId: string, title: string, except = -1):
136	176	)
137	177	.get(authorId, title, except) !== null;
138	178
139		export const addNote = (
140		db: Database,
141		who: Who,
142		input: { title?: string; body?: string },
143		): Result<Note> =>
	179	/** What a new note may say: in a shared folder, also which folder (or a title `folder/Title`). */
	180	export interface NewNote {
	181	readonly title?: string;
	182	readonly body?: string;
	183	readonly space?: number;
	184	readonly folder?: string;
	185	}
	186
	187	export const addNote = (db: Database, who: Who, input: NewNote): Result<Note> =>
144	188	audited(db, who, "note", "create", undefined, add(db, who, input));
145	189
146		function add(
147		db: Database,
148		who: Who,
149		input: { title?: string; body?: string },
150		): Result<Note> {
	190	/** A shared note's title and folder: its title is a file name, and `a/b/Title` puts it in a folder. */
	191	function placeOf(input: { title: string; folder?: string }): Result<{ title: string; folder: string }> {
	192	const cut = input.title.lastIndexOf("/");
	193	const title = cleanSegment(cut < 0 ? input.title : input.title.slice(cut + 1));
	194	if (!title.ok) return title;
	195	const folder = cleanFolder(
	196	[input.folder ?? "", cut < 0 ? "" : input.title.slice(0, cut)].filter((f) => f !== "").join("/"),
	197	);
	198	if (!folder.ok) return folder;
	199	return ok({ title: title.value, folder: folder.value });
	200	}
	201
	202	function add(db: Database, who: Who, input: NewNote): Result<Note> {
151	203	// The table decides; the type only learns it here: whoever may create is
152	204	// signed in, and carries a name to write beside the note.
153	205	if (who.role === "anon" \|\| permit(who, "note", "create") !== "yes")
154	206	return refuse(who, "Sign in to add a note.", "You may not add a note.");
	207	const where = vaultFor(db, who, input.space);
	208	if (!where.ok) return where;
	209	const { vault, space } = where.value;
155	210	const body = checkBody(input.body ?? "");
156	211	if (!body.ok) return body;
157	212	const count = db
158	213	.query<{ n: number }, [string]>("SELECT count(*) AS n FROM note WHERE author_id = ?1")
159		.get(who.id)!.n;
	214	.get(vault)!.n;
160	215	if (count >= VAULT_MAX)
161	216	return fail("invalid", `A vault holds at most ${VAULT_MAX.toLocaleString("en")} notes.`);
162	217	let title: string;
163		if (input.title === undefined \|\| input.title.trim() === "")
164		title = freeTitle(db, who.id, "Untitled");
165		else {
	218	let folder = "";
	219	if (input.title === undefined \|\| input.title.trim() === "" \|\| input.title.trim().endsWith("/")) {
	220	if (space !== undefined) {
	221	const at = cleanFolder(`${input.folder ?? ""}/${input.title ?? ""}`);
	222	if (!at.ok) return at;
	223	folder = at.value;
	224	}
	225	title = freeTitle(db, vault, "Untitled");
	226	} else if (space !== undefined) {
	227	const place = placeOf({ title: input.title, ...(input.folder === undefined ? {} : { folder: input.folder }) });
	228	if (!place.ok) return place;
	229	title = place.value.title;
	230	folder = place.value.folder;
	231	} else {
166	232	const clean = cleanTitle(input.title);
167	233	if (!clean.ok) return clean;
168		if (titleTaken(db, who.id, clean.value))
169		return fail("invalid", `A note called “${clean.value}” already exists.`);
170	234	title = clean.value;
171	235	}
	236	if (titleTaken(db, vault, title))
	237	return fail("invalid", `A note called “${title}” already exists.`);
	238	const path = space === undefined ? null : fileOf(space, folder, title);
	239	if (path !== null && pathTaken(db, vault, path))
	240	return fail("invalid", `There is already a file at ${path}.`);
172	241	const note = db
173		.query<Note, [string, string, string, string]>(
174		"INSERT INTO note (title, body, author_id, author_name) VALUES (?1, ?2, ?3, ?4) RETURNING *",
	242	.query<Note, [string, string, string, string, string \| null]>(
	243	"INSERT INTO note (title, body, author_id, author_name, path) VALUES (?1, ?2, ?3, ?4, ?5) RETURNING *",
175	244	)
176		.get(title, body.value, who.id, who.name)!;
177		tell("note.added", note);
	245	.get(title, body.value, vault, who.name, path)!;
	246	tell(db, "note.added", note);
	247	if (space !== undefined) edited(space.id);
178	248	return ok(note);
179	249	}
180	250
	251	const pathTaken = (db: Database, vault: string, path: string, except = -1): boolean =>
	252	db
	253	.query<{ id: number }, [string, string, number]>(
	254	"SELECT id FROM note WHERE author_id = ?1 AND path = ?2 COLLATE NOCASE AND id != ?3",
	255	)
	256	.get(vault, path, except) !== null;
	257
181	258	/**
182	259	* One note, for `who` to do `verb` to. The door is asked before the row is
183	260	* looked for, so whoever may not is told that and never learns whether the
		@@ -196,8 +273,17 @@ function noteFor(
196	273	// With no row to show, the door is asked about a row of their own: whoever
197	274	// could not pass even then is refused, and learns nothing about what
198	275	// exists; whoever could is told there is no such note.
	276	// A shared note is its folder's: whoever is in the folder is the row's
	277	// member, which is what the table gives a shared note's verbs to.
	278	const space = note === null ? undefined : spaceOf(note.author_id);
199	279	const row: Readonly<Record<string, unknown>> =
200		note === null ? { author_id: who.role === "anon" ? null : who.id } : { ...note };
	280	note === null
	281	? { author_id: who.role === "anon" ? null : who.id }
	282	: {
	283	...note,
	284	member_id:
	285	space !== undefined && who.role !== "anon" && isMember(db, space, who) ? who.id : null,
	286	};
201	287	if (permit(who, "note", verb, row) !== "yes")
202	288	return refuse(who, said.signIn, said.no);
203	289	if (note !== null) return ok(note);
		@@ -217,20 +303,22 @@ export function getNote(
217	303	});
218	304	}
219	305
220		/** A note in the asker's vault by its title, any case. */
	306	/** A note in the asker's vault (or a shared folder of theirs) by its title, any case. */
221	307	export function findNote(
222	308	db: Database,
223	309	who: Who,
224		input: { title: string },
	310	input: { title: string; space?: number },
225	311	): Result<Note> {
226		if (who.role === "anon")
227		return fail("signin_required", "Sign in to open your notes.");
228		const title = input.title.replace(/\s+/g, " ").trim();
	312	const where = vaultFor(db, who, input.space);
	313	if (!where.ok) return where;
	314	// In a shared folder `ideas/Pricing` names the note Pricing.
	315	const raw = input.space === undefined ? input.title : input.title.slice(input.title.lastIndexOf("/") + 1);
	316	const title = raw.replace(/\s+/g, " ").trim();
229	317	const note = db
230	318	.query<Note, [string, string]>(
231	319	"SELECT * FROM note WHERE author_id = ?1 AND title = ?2 COLLATE NOCASE",
232	320	)
233		.get(who.id, title);
	321	.get(where.value.vault, title);
234	322	if (note === null) return fail("not_found", `No note called “${title}”.`);
235	323	return getNote(db, who, { id: note.id });
236	324	}
		@@ -239,12 +327,12 @@ export function findNote(
239	327	export function openOrCreate(
240	328	db: Database,
241	329	who: Who,
242		input: { title: string; body?: string },
	330	input: { title: string; body?: string; space?: number; folder?: string },
243	331	): Result<Note & { created: boolean }> {
244	332	const found = findNote(db, who, input);
245	333	if (found.ok) return ok({ ...found.value, created: false });
246	334	if (found.error !== "not_found") return found;
247		const made = addNote(db, who, { title: input.title, body: input.body ?? "" });
	335	const made = addNote(db, who, { ...input, body: input.body ?? "" });
248	336	return made.ok ? ok({ ...made.value, created: true }) : made;
249	337	}
250	338
		@@ -253,6 +341,14 @@ export interface Change {
253	341	readonly title?: string;
254	342	readonly body?: string;
255	343	readonly pinned?: boolean;
	344	/** A shared note's folder, relative to its space's: a move. */
	345	readonly folder?: string;
	346	/**
	347	* The `updated_at` the change was written against. When the note has
	348	* moved on since — someone else saved it — new words or a new title are
	349	* refused as a `conflict` rather than written over theirs.
	350	*/
	351	readonly base?: string;
256	352	}
257	353
258	354	export const updateNote = (
		@@ -278,9 +374,19 @@ function update(
278	374	});
279	375	if (!found.ok) return found;
280	376	const before = found.value;
	377	const spaceId = spaceOf(before.author_id);
	378	const space = spaceId === undefined ? undefined : getSpace(db, who, spaceId);
	379	if (space !== undefined && !space.ok) return space;
	380	if (
	381	input.base !== undefined &&
	382	input.base !== before.updated_at &&
	383	((input.body !== undefined && input.body !== before.body) \|\|
	384	(input.title !== undefined && input.title !== before.title))
	385	)
	386	return fail("conflict", `${before.author_name} saved this note while you were writing.`);
281	387	let title = before.title;
282	388	if (input.title !== undefined) {
283		const clean = cleanTitle(input.title);
	389	const clean = space === undefined ? cleanTitle(input.title) : cleanSegment(input.title);
284	390	if (!clean.ok) return clean;
285	391	if (titleTaken(db, before.author_id, clean.value, before.id))
286	392	return fail("invalid", `A note called “${clean.value}” already exists.`);
		@@ -293,17 +399,43 @@ function update(
293	399	body = checked.value;
294	400	}
295	401	const pinned = input.pinned === undefined ? before.pinned : input.pinned ? 1 : 0;
296		if (title === before.title && body === before.body && pinned === before.pinned)
	402	// A shared note's file follows its title, and its folder when it moves.
	403	let path = before.path;
	404	if (space !== undefined && before.path !== null) {
	405	let folder = folderOf(space.value, before.path);
	406	if (input.folder !== undefined) {
	407	const clean = cleanFolder(input.folder);
	408	if (!clean.ok) return clean;
	409	folder = clean.value;
	410	}
	411	// A file whose name was never its title (two files of one name, read
	412	// from the repository) keeps its name until it is renamed or moved.
	413	path =
	414	title === before.title && input.folder === undefined ? before.path : fileOf(space.value, folder, title);
	415	if (path !== before.path && pathTaken(db, before.author_id, path, before.id))
	416	return fail("invalid", `There is already a file at ${path}.`);
	417	}
	418	if (title === before.title && body === before.body && pinned === before.pinned && path === before.path)
297	419	return ok({ ...before, relinked: 0 });
298	420	const renamed = title.toLowerCase() !== before.title.toLowerCase();
299	421	const touched: Note[] = [];
	422	// In a shared folder the name beside a note is whoever wrote in it last.
	423	const by = space !== undefined && who.role !== "anon" ? who.name : before.author_name;
300	424	const note = db.transaction(() => {
301	425	const saved = db
302		.query<Note, [string, string, number, number, number]>(
303		// A pin is not an edit: only new words or a new title move a note up by recency.
304		"UPDATE note SET title = ?1, body = ?2, pinned = ?3, updated_at = CASE WHEN ?5 THEN strftime('%Y-%m-%dT%H:%M:%fZ', 'now') ELSE updated_at END WHERE id = ?4 RETURNING *",
	426	.query<Note, [string, string, number, number, number, string \| null, string]>(
	427	// A pin is not an edit: only new words, a new title or a move move a note up by recency.
	428	"UPDATE note SET title = ?1, body = ?2, pinned = ?3, path = ?6, author_name = CASE WHEN ?5 THEN ?7 ELSE author_name END, updated_at = CASE WHEN ?5 THEN strftime('%Y-%m-%dT%H:%M:%fZ', 'now') ELSE updated_at END WHERE id = ?4 RETURNING *",
305	429	)
306		.get(title, body, pinned, before.id, title !== before.title \|\| body !== before.body ? 1 : 0)!;
	430	.get(
	431	title,
	432	body,
	433	pinned,
	434	before.id,
	435	title !== before.title \|\| body !== before.body \|\| path !== before.path ? 1 : 0,
	436	path,
	437	by,
	438	)!;
307	439	if (renamed \|\| title !== before.title)
308	440	for (const other of db
309	441	.query<Note, [string, number]>("SELECT * FROM note WHERE author_id = ?1 AND id != ?2")
		@@ -320,8 +452,9 @@ function update(
320	452	}
321	453	return saved;
322	454	})();
323		tell("note.changed", note);
324		for (const other of touched) tell("note.changed", other);
	455	tell(db, "note.changed", note);
	456	for (const other of touched) tell(db, "note.changed", other);
	457	if (spaceId !== undefined) edited(spaceId);
325	458	return ok({ ...note, relinked: touched.length });
326	459	}
327	460
		@@ -342,18 +475,29 @@ function remove(
342	475	no: "Only the author can remove a note.",
343	476	});
344	477	if (!found.ok) return found;
345		db.query("DELETE FROM note WHERE id = ?1").run(found.value.id);
346		emit("note.removed", { id: found.value.id }, found.value.author_id);
347		return ok({ id: found.value.id });
	478	const note = found.value;
	479	const space = spaceOf(note.author_id);
	480	db.transaction(() => {
	481	db.query("DELETE FROM note WHERE id = ?1").run(note.id);
	482	// The repository still has its file until the next commit takes it away.
	483	if (space !== undefined && note.synced_path !== null)
	484	db.query("INSERT OR IGNORE INTO space_gone (space_id, path) VALUES (?1, ?2)").run(space, note.synced_path);
	485	})();
	486	if (space === undefined) emit("note.removed", { id: note.id }, note.author_id);
	487	else {
	488	tellSpace(db, space, "note.removed", { id: note.id });
	489	edited(space);
	490	}
	491	return ok({ id: note.id });
348	492	}
349	493
350	494	/** Search the asker's vault (see `vault.search` for the language). */
351	495	export function searchNotes(
352	496	db: Database,
353	497	who: Who,
354		input: { q: string; limit?: number },
	498	input: { q: string; limit?: number; space?: number },
355	499	): Result<{ id: number; title: string; snippet: string; updated_at: string }[]> {
356		const vault = listNotes(db, who);
	500	const vault = listNotes(db, who, input.space === undefined ? {} : { space: input.space });
357	501	if (!vault.ok) return vault;
358	502	const limit = Math.min(Math.max(Math.trunc(input.limit ?? 50) \|\| 50, 1), 500);
359	503	return ok(
		@@ -73,6 +73,45 @@ export const migrations: string[] = [
73	73	expires_at TEXT NOT NULL
74	74	)`,
75	75	`CREATE INDEX session_account ON session (account_id)`,
	76	// Shared folders (src/spaces.ts): a folder of a git repository that its
	77	// members write in together. Its notes are ordinary notes whose vault is
	78	// the space — author_id `space:<id>` — so every vault query holds as it
	79	// is; `path` is the note's file in the repository, and the synced_* pair
	80	// is what the repository last had (src/sync.ts), so a difference is an
	81	// edit not committed yet.
	82	`CREATE TABLE space (
	83	id INTEGER PRIMARY KEY,
	84	name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 80),
	85	repo TEXT NOT NULL,
	86	branch TEXT NOT NULL,
	87	folder TEXT NOT NULL,
	88	owner_id TEXT NOT NULL,
	89	owner_name TEXT NOT NULL,
	90	join_code TEXT UNIQUE,
	91	head TEXT,
	92	synced_at TEXT,
	93	sync_error TEXT,
	94	created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
	95	)`,
	96	`CREATE TABLE space_member (
	97	space_id INTEGER NOT NULL REFERENCES space (id) ON DELETE CASCADE,
	98	who_id TEXT NOT NULL,
	99	who_name TEXT NOT NULL,
	100	joined_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
	101	PRIMARY KEY (space_id, who_id)
	102	)`,
	103	`CREATE INDEX space_member_who ON space_member (who_id)`,
	104	`ALTER TABLE note ADD COLUMN path TEXT`,
	105	`ALTER TABLE note ADD COLUMN synced_path TEXT`,
	106	`ALTER TABLE note ADD COLUMN synced_oid TEXT`,
	107	`CREATE UNIQUE INDEX note_path ON note (author_id, path) WHERE path IS NOT NULL`,
	108	// A shared note removed here whose file the repository still has: the
	109	// next commit deletes it.
	110	`CREATE TABLE space_gone (
	111	space_id INTEGER NOT NULL REFERENCES space (id) ON DELETE CASCADE,
	112	path TEXT NOT NULL,
	113	PRIMARY KEY (space_id, path)
	114	)`,
76	115	];
77	116
78	117	export function openDb(dir = dataDir): Database {
		@@ -30,3 +30,11 @@ export const publicOrigin: string = new URL(
30	30	export const forgeUrl: string \| undefined = process.env.FORGE_URL;
31	31	/** The key the forge signs identities with (`who.ts`). Unset, everyone is anonymous. */
32	32	export const identityKey: string = process.env.FORGE_APP_IDENTITY_KEY ?? "";
	33	/** The forge's JSON API, for shared folders (`src/sync.ts`). */
	34	export const forgeApi: string \| undefined =
	35	process.env.FORGE_API_URL ?? (forgeUrl === undefined ? undefined : `${forgeUrl.replace(/\/+$/, "")}/api/v1`);
	36	/**
	37	* A forge token that may write the repositories shared folders keep their
	38	* notes in (Settings → App → Environment). Unset, there are no shared folders.
	39	*/
	40	export const repoToken: string \| undefined = process.env.NOTES_REPO_TOKEN?.trim() \|\| undefined;
		@@ -8,12 +8,13 @@
8	8	*/
9	9
10	10	import { openDb } from "./db.ts";
11		import { dataDir, identityKey, title, where } from "./env.ts";
	11	import { dataDir, forgeApi, identityKey, repoToken, title, where } from "./env.ts";
12	12	import { sessionWho } from "./accounts.ts";
13	13	import { html, readCookie, text } from "./http.ts";
14	14	import { SESSION_COOKIE } from "./routes.ts";
15	15	import { match } from "./routes.ts";
16	16	import { door } from "./security.ts";
	17	import { httpForge, startSync, type Forge } from "./sync.ts";
17	18	import { who } from "./who.ts";
18	19	import { traceServe } from "./otel.ts";
19	20
		@@ -22,11 +23,14 @@ export interface ServeOptions {
22	23	readonly hostname?: string \| undefined;
23	24	readonly dataDir: string;
24	25	readonly identityKey: string;
	26	/** Where shared folders commit; without one there are none. */
	27	readonly forge?: Forge \| undefined;
25	28	}
26	29
27	30	export function serve(options: ServeOptions) {
28	31	const db = openDb(options.dataDir);
29		return Bun.serve(traceServe({
	32	const stopSync = startSync(db, options.forge);
	33	const server = Bun.serve(traceServe({
30	34	port: options.port,
31	35	hostname: options.hostname ?? "127.0.0.1",
32	36	// A connection that says nothing for a minute is dropped. The event
		@@ -57,6 +61,7 @@ export function serve(options: ServeOptions) {
57	61	db,
58	62	who: me,
59	63	params: found.params,
	64	forge: options.forge,
60	65	});
61	66	return head(request, response);
62	67	},
		@@ -68,6 +73,12 @@ export function serve(options: ServeOptions) {
68	73	return html("<h1>Something went wrong</h1>", 500);
69	74	},
70	75	}));
	76	const stop = server.stop.bind(server);
	77	server.stop = (force?: boolean) => {
	78	stopSync();
	79	return stop(force);
	80	};
	81	return server;
71	82	}
72	83
73	84	// HEAD is GET without the body: a health check sees the app up.
		@@ -82,6 +93,7 @@ if (import.meta.main) {
82	93	hostname: process.env.HOST,
83	94	dataDir,
84	95	identityKey,
	96	forge: repoToken === undefined \|\| forgeApi === undefined ? undefined : httpForge(forgeApi, repoToken),
85	97	});
86	98	console.log(
87	99	`${title} listening on http://${server.hostname}:${server.port} (${where})`,
		@@ -0,0 +1,114 @@
	1	import { afterAll, expect, test } from "bun:test";
	2	import { mkdtempSync } from "node:fs";
	3	import { tmpdir } from "node:os";
	4	import { join } from "node:path";
	5	import { serve } from "./server.ts";
	6	import { blobOid, type Forge } from "./sync.ts";
	7	import { sign } from "./who.ts";
	8
	9	// A shared folder through the doors a person uses: connect, invite, join,
	10	// write, see the file — with a repository in memory behind the forge's API.
	11	const files = new Map<string, string>([["docs/Welcome.md", "Hello from git. [[Plan]]"]]);
	12	let head = "c0";
	13	const forge: Forge = {
	14	head: async () => head,
	15	list: async (_r, _ref, path) => {
	16	const prefix = path === "" ? "" : `${path}/`;
	17	const seen = new Map<string, { name: string; type: string; oid: string; size: number }>();
	18	for (const [p, c] of files) {
	19	if (!p.startsWith(prefix)) continue;
	20	const rest = p.slice(prefix.length);
	21	const name = rest.split("/")[0]!;
	22	seen.set(name, rest.includes("/") ? { name, type: "tree", oid: "t", size: -1 } : { name, type: "blob", oid: blobOid(c), size: c.length });
	23	}
	24	return [...seen.values()];
	25	},
	26	read: async (_r, _ref, path) => files.get(path)!,
	27	commit: async (_r, _b, _m, changes) => {
	28	for (const f of changes) f.content === null ? files.delete(f.path) : files.set(f.path, f.content);
	29	head = `c${Number(head.slice(1)) + 1}`;
	30	return head;
	31	},
	32	};
	33
	34	const KEY = "k";
	35	const server = serve({ port: 0, dataDir: mkdtempSync(join(tmpdir(), "app-shared-")), identityKey: KEY, forge });
	36	const base = `http://${server.hostname}:${server.port}`;
	37	afterAll(() => server.stop(true));
	38
	39	const as = (id: string, name: string, role: "user" \| "admin" = "user"): Record<string, string> => {
	40	const identity = `${id}\|${name}\|${role}\|${Date.now() + 60_000}`;
	41	return { "x-forge-identity": identity, "x-forge-signature": sign(identity, KEY) };
	42	};
	43	const ben = as("1", "ben", "admin");
	44	const sam = as("2", "sam");
	45	const same = { origin: base, "sec-fetch-site": "same-origin" };
	46	const get = (path: string, who: Record<string, string> = {}) =>
	47	fetch(base + path, { headers: { ...who, accept: "text/html" }, redirect: "manual" });
	48	const post = (path: string, form: Record<string, string>, who: Record<string, string>) =>
	49	fetch(base + path, {
	50	method: "POST",
	51	headers: { ...who, ...same, "content-type": "application/x-www-form-urlencoded" },
	52	body: new URLSearchParams(form).toString(),
	53	redirect: "manual",
	54	});
	55
	56	test("connect a folder, invite someone by link, and write in it together", async () => {
	57	// Only an admin may connect a repository.
	58	expect((await post("/spaces", { name: "X", repo: "ben/x" }, sam)).headers.get("location")).toBe("/");
	59	const made = await post("/spaces", { name: "Brainstorm", repo: "ben/brainstorm", branch: "main", folder: "docs" }, ben);
	60	expect(made.status).toBe(303);
	61	const at = made.headers.get("location")!;
	62	expect(at).toMatch(/^\/s\/\d+$/);
	63	const sid = Number(at.slice(3));
	64
	65	// It opens on what the repository had.
	66	const home = await get(at, ben);
	67	expect(home.status).toBe(303);
	68	const page = await (await get(home.headers.get("location")!, ben)).text();
	69	expect(page).toContain("Hello from git.");
	70	expect(page).toContain(`href="/s/${sid}/open?title=Plan"`);
	71	expect(page).toContain("docs/Welcome.md");
	72
	73	// Sam can't see it — until the join link.
	74	expect((await get(at, sam)).headers.get("location")).toBe("/");
	75	const settings = await (await get(`${at}/settings`, ben)).text();
	76	const link = /value="https?:\/\/[^"]*(\/join\/[\w-]+)"/.exec(settings)![1]!;
	77	// Signed out, the link asks you to sign in and remembers where you were going.
	78	const guest = await (await get(link)).text();
	79	expect(guest).toContain(`/login?to=${encodeURIComponent(link)}`);
	80	const joined = await get(link, sam);
	81	expect(joined.headers.get("location")).toBe(at);
	82
	83	// Sam writes a note into a folder; it's a file in the repository after a sync.
	84	const note = await fetch(`${base}/api/notes`, {
	85	method: "POST",
	86	headers: { ...sam, ...same, "content-type": "application/json" },
	87	body: JSON.stringify({ title: "ideas/Plan", body: "Ship it.", space: sid }),
	88	});
	89	expect(note.status).toBe(201);
	90	const made2 = (await note.json()) as { id: number; path: string; updated_at: string };
	91	expect(made2.path).toBe("docs/ideas/Plan.md");
	92	const synced = await post(`${at}/sync`, {}, sam);
	93	expect(synced.headers.get("location")).toBe(`${at}/settings`);
	94	expect(files.get("docs/ideas/Plan.md")).toBe("Ship it.");
	95
	96	// Two people, one note: the second save written against an old version is refused.
	97	const patch = (who: Record<string, string>, body: string, b: string) =>
	98	fetch(`${base}/api/notes/${made2.id}`, {
	99	method: "PATCH",
	100	headers: { ...who, ...same, "content-type": "application/json" },
	101	body: JSON.stringify({ body, base: b }),
	102	});
	103	await Bun.sleep(3);
	104	expect((await patch(ben, "Ben's take", made2.updated_at)).status).toBe(200);
	105	const late = await patch(sam, "Sam's take", made2.updated_at);
	106	expect(late.status).toBe(409);
	107	expect(((await late.json()) as { message: string }).message).toContain("ben");
	108
	109	// Ben's own vault is still Ben's alone, and doesn't hold the shared notes.
	110	const mine = (await (await fetch(`${base}/api/notes`, { headers: ben })).json()) as unknown[];
	111	expect(mine).toEqual([]);
	112	const theirs = (await (await fetch(`${base}/api/notes?space=${sid}`, { headers: sam })).json()) as { title: string }[];
	113	expect(theirs.map((n) => n.title).sort()).toEqual(["Plan", "Welcome"]);
	114	});
		@@ -0,0 +1,252 @@
	1	import { expect, test } from "bun:test";
	2	import { mkdtempSync } from "node:fs";
	3	import { tmpdir } from "node:os";
	4	import { join } from "node:path";
	5	import { addNote, deleteNote, getNote, listNotes, searchNotes, updateNote } from "./actions.ts";
	6	import { openDb } from "./db.ts";
	7	import {
	8	cleanFolder,
	9	createSpace,
	10	deleteSpace,
	11	fileOf,
	12	folderOf,
	13	joinSpace,
	14	mySpaces,
	15	removeMember,
	16	setLink,
	17	} from "./spaces.ts";
	18	import { blobOid, syncSpace, type Entry, type Forge } from "./sync.ts";
	19	// @ts-ignore — plain JS, shared with the browser.
	20	import * as md from "../static/md.js";
	21	import type { Who } from "./who.ts";
	22
	23	const db = openDb(mkdtempSync(join(tmpdir(), "app-spaces-")));
	24	const ben: Who = { role: "admin", id: "1", name: "ben" };
	25	const sam: Who = { role: "user", id: "acct:7", name: "sam" };
	26	const eve: Who = { role: "user", id: "9", name: "eve" };
	27
	28	const must = <T>(r: { ok: true; value: T } \| { ok: false; message: string }): T => {
	29	if (!r.ok) throw new Error(r.message);
	30	return r.value;
	31	};
	32
	33	/** A repository in memory, behind the same four calls the forge answers. */
	34	function fakeForge(files: Record<string, string> = {}) {
	35	const tree = new Map(Object.entries(files));
	36	let head = tree.size === 0 ? null : "c0";
	37	let n = 0;
	38	const commits: { message: string; files: { path: string; content: string \| null }[] }[] = [];
	39	const forge: Forge = {
	40	async head() {
	41	return head;
	42	},
	43	async list(_repo, _ref, path) {
	44	const prefix = path === "" ? "" : `${path}/`;
	45	const seen = new Map<string, Entry>();
	46	for (const [p, content] of tree) {
	47	if (!p.startsWith(prefix)) continue;
	48	const rest = p.slice(prefix.length);
	49	const name = rest.split("/")[0]!;
	50	if (rest.includes("/")) seen.set(name, { name, type: "tree", oid: `t-${name}`, size: -1 });
	51	else seen.set(name, { name, type: "blob", oid: blobOid(content), size: content.length });
	52	}
	53	return seen.size === 0 && path !== "" ? null : [...seen.values()];
	54	},
	55	async read(_repo, _ref, path) {
	56	const content = tree.get(path);
	57	if (content === undefined) throw new Error(`no ${path}`);
	58	return content;
	59	},
	60	async commit(_repo, _branch, message, changes) {
	61	for (const f of changes) f.content === null ? tree.delete(f.path) : tree.set(f.path, f.content);
	62	commits.push({ message, files: changes });
	63	head = `c${++n}`;
	64	return head;
	65	},
	66	};
	67	return {
	68	forge,
	69	tree,
	70	commits,
	71	/** Someone pushes to the repository, outside the app. */
	72	push(changes: Record<string, string \| null>) {
	73	for (const [p, c] of Object.entries(changes)) c === null ? tree.delete(p) : tree.set(p, c);
	74	head = `x${++n}`;
	75	},
	76	};
	77	}
	78
	79	test("only an app admin connects a repository; a join link lets someone in, and only into that folder", () => {
	80	const refused = createSpace(db, sam, { name: "Nope", repo: "sam/x", folder: "docs" });
	81	expect(refused.ok).toBe(false);
	82	if (!refused.ok) expect(refused.error).toBe("forbidden");
	83	expect(createSpace(db, ben, { name: "Bad", repo: "not a repo" }).ok).toBe(false);
	84	expect(createSpace(db, ben, { name: "Bad", repo: "ben/x", folder: "../etc" }).ok).toBe(false);
	85
	86	const space = must(createSpace(db, ben, { name: "Brainstorm", repo: "ben/brainstorm", folder: "/docs/" }));
	87	expect(space.folder).toBe("docs");
	88	expect(space.branch).toBe("main");
	89	expect(mySpaces(db, ben).map((s) => s.id)).toEqual([space.id]);
	90	expect(mySpaces(db, sam)).toEqual([]);
	91
	92	const mine = must(addNote(db, ben, { title: "My own thoughts" }));
	93	const shared = must(addNote(db, ben, { title: "Pricing", space: space.id }));
	94	expect(shared.path).toBe("docs/Pricing.md");
	95	// A stranger can't see the folder or its notes, by id or by list.
	96	expect(getNote(db, sam, { id: shared.id }).ok).toBe(false);
	97	expect(listNotes(db, sam, { space: space.id }).ok).toBe(false);
	98	expect(addNote(db, sam, { title: "sneaky", space: space.id }).ok).toBe(false);
	99
	100	must(joinSpace(db, sam, { code: space.join_code! }));
	101	expect(must(listNotes(db, sam, { space: space.id })).map((n) => n.title)).toEqual(["Pricing"]);
	102	expect(getNote(db, sam, { id: shared.id }).ok).toBe(true);
	103	// …and still nothing of Ben's own.
	104	expect(getNote(db, sam, { id: mine.id }).ok).toBe(false);
	105	expect(must(listNotes(db, sam)).map((n) => n.id)).not.toContain(mine.id);
	106	// Shared notes never show in anyone's own vault, Ben's included.
	107	expect(must(listNotes(db, ben)).map((n) => n.id)).not.toContain(shared.id);
	108	expect(must(searchNotes(db, ben, { q: "Pricing" }))).toEqual([]);
	109	expect(must(searchNotes(db, sam, { q: "Pricing", space: space.id })).length).toBe(1);
	110
	111	// Sam writes; the note says so.
	112	const edited = must(updateNote(db, sam, { id: shared.id, body: "per seat?" }));
	113	expect(edited.author_name).toBe("sam");
	114
	115	// The link off, nobody new gets in; the owner removes a member; the owner can't be removed.
	116	const off = must(setLink(db, ben, { id: space.id, on: false }));
	117	expect(joinSpace(db, eve, { code: space.join_code! }).ok).toBe(false);
	118	expect(off.join_code).toBeNull();
	119	expect(setLink(db, sam, { id: space.id, on: true }).ok).toBe(false);
	120	expect(removeMember(db, sam, { id: space.id, member: ben.id }).ok).toBe(false);
	121	must(removeMember(db, ben, { id: space.id, member: sam.id }));
	122	expect(getNote(db, sam, { id: shared.id }).ok).toBe(false);
	123
	124	must(deleteSpace(db, ben, { id: space.id }));
	125	expect(getNote(db, ben, { id: shared.id }).ok).toBe(false);
	126	expect(getNote(db, ben, { id: mine.id }).ok).toBe(true);
	127	});
	128
	129	test("a shared note's title is a file name, its folder a path; renames and moves carry the file", () => {
	130	const space = must(createSpace(db, ben, { name: "Paths", repo: "ben/paths", folder: "docs" }));
	131	expect(addNote(db, ben, { title: "a:b", space: space.id }).ok).toBe(false);
	132	const deep = must(addNote(db, ben, { title: "ideas/q4/Launch", space: space.id }));
	133	expect(deep.title).toBe("Launch");
	134	expect(deep.path).toBe("docs/ideas/q4/Launch.md");
	135	expect(folderOf(space, deep.path!)).toBe("ideas/q4");
	136	const renamed = must(updateNote(db, ben, { id: deep.id, title: "Launch plan" }));
	137	expect(renamed.path).toBe("docs/ideas/q4/Launch plan.md");
	138	const moved = must(updateNote(db, ben, { id: deep.id, folder: "archive" }));
	139	expect(moved.path).toBe("docs/archive/Launch plan.md");
	140	expect(must(updateNote(db, ben, { id: deep.id, folder: "" })).path).toBe("docs/Launch plan.md");
	141	expect(cleanFolder(" a / b ").ok && must(cleanFolder(" a / b "))).toBe("a/b");
	142	expect(fileOf({ folder: "" }, "", "Top")).toBe("Top.md");
	143	});
	144
	145	test("someone else saved first: new words are a conflict, not an overwrite", async () => {
	146	const space = must(createSpace(db, ben, { name: "Race", repo: "ben/race" }));
	147	must(joinSpace(db, sam, { code: space.join_code! }));
	148	const note = must(addNote(db, ben, { title: "Plan", space: space.id, body: "v1" }));
	149	await Bun.sleep(3); // updated_at is to the millisecond
	150	const theirs = must(updateNote(db, sam, { id: note.id, body: "sam's v2", base: note.updated_at }));
	151	const mine = updateNote(db, ben, { id: note.id, body: "ben's v2", base: note.updated_at });
	152	expect(mine.ok).toBe(false);
	153	if (!mine.ok) expect(mine.error).toBe("conflict");
	154	expect(must(getNote(db, ben, { id: note.id })).body).toBe("sam's v2");
	155	// Written against what is there now, it goes through.
	156	expect(must(updateNote(db, ben, { id: note.id, body: "ben's v3", base: theirs.updated_at })).body).toBe("ben's v3");
	157	});
	158
	159	test("sync reads the folder, commits what is written here, and takes what is pushed there", async () => {
	160	const repo = fakeForge({
	161	"README.md": "# not in the folder",
	162	"docs/Ideas.md": "---\ntags: [brainstorm, q4]\n---\nSee [[Pricing]].",
	163	"docs/research/Pricing.md": "per seat? #money",
	164	"docs/research/chart.png": "binary",
	165	"docs/.obsidian/workspace.md": "editor settings",
	166	});
	167	const space = must(createSpace(db, ben, { name: "Synced", repo: "ben/synced", folder: "docs" }));
	168	const first = await syncSpace(db, repo.forge, space.id);
	169	expect(first.pulled).toBe(2);
	170	const notes = () => must(listNotes(db, ben, { space: space.id }));
	171	const byTitle = (t: string) => notes().find((n) => n.title === t)!;
	172	expect(notes().map((n) => n.path).sort()).toEqual(["docs/Ideas.md", "docs/research/Pricing.md"]);
	173	expect(md.tags(byTitle("Ideas").body).sort()).toEqual(["brainstorm", "q4"]);
	174	// Nothing changed here, so nothing is committed.
	175	expect((await syncSpace(db, repo.forge, space.id)).pushed).toBe(0);
	176	expect(repo.commits).toEqual([]);
	177
	178	// Written, made, renamed and removed here → one commit.
	179	must(updateNote(db, ben, { id: byTitle("Ideas").id, body: "See [[Pricing]] and [[Naming]]." }));
	180	must(addNote(db, ben, { title: "Naming", space: space.id, folder: "research", body: "names" }));
	181	must(updateNote(db, ben, { id: byTitle("Pricing").id, title: "Pricing model" }));
	182	const wrote = await syncSpace(db, repo.forge, space.id);
	183	expect(repo.commits.length).toBe(1);
	184	expect(repo.commits[0]!.message).toContain("Written in notes by ben");
	185	expect(wrote.pushed).toBe(4);
	186	expect([...repo.tree.keys()].sort()).toEqual([
	187	"README.md",
	188	"docs/.obsidian/workspace.md",
	189	"docs/Ideas.md",
	190	"docs/research/Naming.md",
	191	"docs/research/Pricing model.md",
	192	"docs/research/chart.png",
	193	]);
	194	expect(repo.tree.get("docs/Ideas.md")).toBe("See [[Pricing model]] and [[Naming]].");
	195	// The next read finds our own commit and changes nothing.
	196	expect((await syncSpace(db, repo.forge, space.id)).pulled).toBe(0);
	197
	198	must(deleteNote(db, ben, { id: byTitle("Naming").id }));
	199	await syncSpace(db, repo.forge, space.id);
	200	expect(repo.tree.has("docs/research/Naming.md")).toBe(false);
	201
	202	// Someone pushes: a change, a new file, a removal.
	203	repo.push({
	204	"docs/Ideas.md": "Rewritten on a laptop.",
	205	"docs/meetings/2026-10-13.md": "# Kickoff",
	206	"docs/research/Pricing model.md": null,
	207	});
	208	const read = await syncSpace(db, repo.forge, space.id);
	209	expect(read.pulled).toBe(3);
	210	expect(byTitle("Ideas").body).toBe("Rewritten on a laptop.");
	211	expect(byTitle("Ideas").author_name).toBe("the repository");
	212	expect(byTitle("2026-10-13").path).toBe("docs/meetings/2026-10-13.md");
	213	expect(notes().some((n) => n.title === "Pricing model")).toBe(false);
	214	expect(repo.commits.length).toBe(2);
	215	});
	216
	217	test("edited in both places: ours is committed, theirs is kept beside it — nothing is lost", async () => {
	218	const repo = fakeForge({ "Plan.md": "v1" });
	219	const space = must(createSpace(db, ben, { name: "Both", repo: "ben/both" }));
	220	await syncSpace(db, repo.forge, space.id);
	221	const plan = must(listNotes(db, ben, { space: space.id }))[0]!;
	222	must(updateNote(db, ben, { id: plan.id, body: "ours" }));
	223	repo.push({ "Plan.md": "theirs" });
	224	const r = await syncSpace(db, repo.forge, space.id);
	225	expect(r.copies).toBe(1);
	226	expect(repo.tree.get("Plan.md")).toBe("ours");
	227	expect(repo.tree.get("Plan (repo copy).md")).toBe("theirs");
	228	const titles = must(listNotes(db, ben, { space: space.id })).map((n) => n.title).sort();
	229	expect(titles).toEqual(["Plan", "Plan (repo copy)"]);
	230	});
	231
	232	test("a repository that can't be read is said, and the space remembers why", async () => {
	233	const space = must(createSpace(db, ben, { name: "Broken", repo: "ben/gone" }));
	234	const broken: Forge = {
	235	...fakeForge().forge,
	236	head: async () => {
	237	throw new Error("No repository ben/gone — or the token can't see it.");
	238	},
	239	};
	240	await expect(syncSpace(db, broken, space.id)).rejects.toThrow("No repository");
	241	const row = mySpaces(db, ben).find((s) => s.id === space.id)!;
	242	expect(row.sync_error).toContain("No repository");
	243	});
	244
	245	test("properties at the top of a note read as properties, not as a rule and a paragraph", () => {
	246	const html = md.render("---\ntitle: Plan\ntags:\n - a\n - b\n---\n# Body", {});
	247	expect(html).toContain('<dl class="properties">');
	248	expect(html).toContain("<dd>a, b</dd>");
	249	expect(html).not.toContain("<hr>");
	250	expect(md.tags("---\ntags: x, y\n---\n#z")).toEqual(["x", "y", "z"]);
	251	expect(md.render("[[Missing]] #t", { base: "/s/3" })).toContain('href="/s/3/open?title=Missing"');
	252	});