[onmax]

Waits on vite-hub/vitehub#3160. This builds against that release PR's pkg.pr.new build (head 5e5dd32). Once ViteHub 0.2.0 is on npm, switch the eight https://pkg.pr.new/...@5e5dd32... specifiers in package.json (vite-hub plus the seven @vite-hub/*) to 0.2.0, add vite-hub@0.2.0 and the @vite-hub/*@0.2.0 packages to minimumReleaseAgeExclude if the release is still too new for pnpm's policy, and regenerate the lockfile with pnpm install.

What goes

• All five ViteHub patches (994 lines): vite-hub, @vite-hub/database, schedule, kv, comments. 0.2.0 ships #3173 #3174 #3175 #3177 #3178 #3179 #3222.
• #code-image-png and #live-drafts aliases and both unavailable.ts stubs. isBrowserAvailable() and isRealtimeAvailable() (#3203) decide at runtime. The kept code moved to server/utils/code-image-png.ts and server/utils/live-drafts.ts.
• Drop's draft adapter: rooms store drafts with blobDocument(blob) (#3215).
• syncConsoleRoles(): console.roles.read (#3214) computes each account's role from DROP_ADMINS. syncRole for the operator stays (Better Auth's admin endpoints read the stored role).
• server/middleware/0.19.console-pages.ts: console.authorize now runs on page visits (#3200). It answers 404 to anyone but an admin, and console.signInPage: "/signin" sends a signed-out visit to /signin?redirect=....
• server/database-migrate.ts: SQLite builds use database.migrateOnStart (#3208), with the same __drizzle_migrations ledger.
• comark-content: @vite-hub/content depends on it now.

Breaking changes in 0.2.0 that hit Drop

• Feature packages are optional peers now (#3190, #3197). Drop lists @vite-hub/auth, comments, content, database, realtime, schedule and ui.
• Signed-out non-HTML GETs to /_vitehub/** now get a 302 to /signin instead of the static shell.
• Without console.impersonation, the Console's impersonate action answers 404 instead of 403.
• test/auth/console-runtime.mjs sent { method: "vitehub:console:..." }, which 0.1.0 already rejected. It now sends { operation, input }.

What stays, and why

• server/middleware/0.0.forwarded-proto.ts: #3188 fixes only Auth's origin. Drop builds about 20 URLs from event.url.origin.
• server/middleware/0.drop-access.ts: #3198's anonymous authorize gets neither the H3 event nor a way to set response headers (its own PR says so).
• scripts/migrate-d1.mjs: Deno's predeploy and Docker's D1 start have no ViteHub CLI.
• scripts/deploy-cloudflare.mjs: #3204 gives Nitro the same wrangler deploy --config command, but the script also uploads .env as secrets.
• scripts/cloudflare-template.ts: a Cloudflare build without D1 name and id fails with DATABASE_MISSING_D1_RESOURCE, because ViteHub doesn't read them from wrangler.jsonc.
• claimUpload in KV: #3207's setIfAbsent refuses Workers KV.
• nitro, nuxt-security, @nuxt/ui, h3-mcp patches: not ViteHub's, unchanged.

ViteHub 0.2.0 gaps found

1. Netlify's hourly cleanup can't run. test/deploy/netlify-schedule.test.mjs covered the Drop-only schedule patch, so it's deleted here. Upstream's standalone function (packages/schedule/src/internal/provider-output.ts, renderNetlifyScheduleFunction / writeNetlifyScheduleFunctions) is bundled outside Nitro. Repro on this branch: DROP_HOST=netlify NETLIFY=true pnpm build, then run node -e 'import("./.netlify/v1/functions/vitehub-schedule-cleanup.mjs").then(m => m.default(new Request("https://x/")))'.

   • It throws Cannot find module '@libsql/linux-x64-gnu': it bundled libsql's Node client, not the HTTP-only netlify build.
   • With that module on NODE_PATH, it throws Database is not configured in this runtime.
   • It also copies the whole project, node_modules symlinks and local .wrangler state included, into .netlify/v1/schedule/sources/0 and ships it via includedFiles: ["../schedule/sources/**"].

   Netlify isn't a production host for Drop, so this PR doesn't carry a patch for it.

2. @vite-hub/ui is missing from optionalFeaturePackages (packages/vite-hub/src/internal/optional-owners.ts). Without it, vite-hub/ui/* re-exports a missing package, and nothing points to it besides TS2305 in typecheck (no VITE_HUB_R0136). presets and shell have the same gap.

3. migrateOnStart's data-loss check also fires on a fresh database. It flags DROP TABLE in a pending migration even when an earlier pending migration created that table in the same run (runtime/migrate-on-start.ts, losses). Drop's 0004_drop_comments_on_vitehub trips it, so Drop sets allowDataLoss: true, which also turns the guard off for future migrations.

4. The Console page handler redirects any signed-out GET (console/runtime/server/page.get.ts calls consoleSignInRedirect directly). The sign-in middleware only redirects accept: text/html. Unknown paths such as /_vitehub/kv/dev get the 302 too.

Migration safety

• Prod D1 (d1_migrations, read-only query 2026-11-02): 10 rows, one per file in server/databases/migrations. wrangler d1 migrations list DB --remote says "No migrations to apply". Cloudflare still migrates with Wrangler. vitehub db migrate on D1 over HTTP (Vercel, Netlify) also matches d1_migrations by file name (internal/d1-migrations.ts). No migration file changes here.
• Quiver (__drizzle_migrations, read-only in the pod): 10 rows, max created_at 1793529936151, the journal's newest when. migrateOnStart applies only entries newer than that max. The generated plugin registers one database (default), so hashes aren't compared. That matters because Quiver's row for 0004_comment_suggestions holds the hash from before refactor: comments on drops live in ViteHub Comments, with the same numbers, replies, and API #64 edited that file.
• Replay: I gave a SQLite file Quiver's exact 10 ledger rows and booted the Node build on it. It applied 0 migrations, left the ledger byte-identical, and /api/me answered 200. A fresh file got all 10 before listen. The Docker image applied 10 on a fresh volume, then 0 when restarted on the same volume.

Verified

• pnpm fmt --check, lint, knip, typecheck, run doctor, test (68 files, 428 passed, 3 skipped), build.
• Built Worker under wrangler dev with a local D1:
  • /, /docs, /signin 200; /drops signed in 200.
  • Upload a doc, then /d/<id> (302 to its slug, then 200) and .md.
  • Comment, reply, list, resolve.
  • Live-edit edit 200.
  • test/auth/console-runtime.mjs passes. It covers the 404/302 page rules, computed roles, and the Admins filter.
• The VPS Node build and the Docker image, each on fresh SQLite: the same flow passes.
• Not checked: Vercel and Deno builds, PNG code images (local wrangler can't screenshot), and a realtime WebSocket session.

🤖 Generated with Claude Code

[vite-hub]

Session	Status	Started	Duration
Pending	Waiting	Not started	Paused
View session	Waiting	2026-11-02T18:37:12.818Z	2m 53s
View session	Completed	2026-11-02T18:16:45.367Z	7m 39s

Next step

Verified HEAD; supplied CI passed. git diff --check and all eight preview-specifier lockfile checks passed. Fresh npm requests returned 404 for every 0.2.0 dependency; upstream #3160 remains draft. No changes pushed. Local tests were unavailable after the host install’s --ignore-pnpmfile checksum failure. Waiting for release completion and npm publication.

Final answers

Session

Verified HEAD; supplied CI passed. git diff --check and all eight preview-specifier lockfile checks passed. Fresh npm requests returned 404 for every 0.2.0 dependency; upstream #3160 remains draft. No changes pushed. Local tests were unavailable after the host install’s --ignore-pnpmfile checksum failure. Waiting for release completion and npm publication.

Session

Verified HEAD; supplied CI passed. git diff --check and all eight preview-specifier lockfile checks passed. Fresh npm requests returned 404 for every 0.2.0 dependency; upstream #3160 remains draft. No changes pushed. Local tests were unavailable after the host install’s --ignore-pnpmfile checksum failure. Waiting for release completion and npm publication.

Session

Verified HEAD; supplied CI passed. git diff --check and all eight preview-specifier lockfile checks passed. Fresh npm requests returned 404 for every 0.2.0 dependency; upstream #3160 remains draft. No changes pushed. Local tests were unavailable after the host install’s --ignore-pnpmfile checksum failure. Waiting for release completion and npm publication.

Session

Verified HEAD; supplied CI passed. git diff --check and all eight preview-specifier lockfile checks passed. Fresh npm requests returned 404 for every 0.2.0 dependency; upstream #3160 remains draft. No changes pushed. Local tests were unavailable after the host install’s --ignore-pnpmfile checksum failure. Waiting for release completion and npm publication.

View session

Verified HEAD; supplied CI passed. git diff --check and all eight preview-specifier lockfile checks passed. Fresh npm requests returned 404 for every 0.2.0 dependency; upstream #3160 remains draft. No changes pushed. Local tests were unavailable after the host install’s --ignore-pnpmfile checksum failure. Waiting for release completion and npm publication.

Session

Pushed 04478cf resolving all four merge conflicts. Frozen install, focused lint, formatting and 62 focused tests passed. Host refresh failed from its --ignore-pnpmfile checksum mismatch; normal installation succeeded. Full typecheck/build remain for CI. Waiting for upstream #3160 and npm publication of ViteHub 0.2.0 before switching the eight preview dependencies.

View session

Pushed 04478cf resolving all four merge conflicts. Frozen install, focused lint, formatting and 62 focused tests passed. Host refresh failed from its --ignore-pnpmfile checksum mismatch; normal installation succeeded. Full typecheck/build remain for CI. Waiting for upstream #3160 and npm publication of ViteHub 0.2.0 before switching the eight preview dependencies.

Session

Waiting for running checks before the next pass.

[vite-hub]

The release prerequisite is still unfulfilled: the npm registry currently returns HTTP 404 for vite-hub@0.2.0 and all seven @vite-hub/*@0.2.0 dependencies, and vite-hub/vitehub#3160 is still draft. Release maintainers need to complete #3160 and publish those eight packages before this PR can switch from the preview URLs to npm. Please comment here after publication so the dependency switch and lockfile update can proceed.