chore: bump version to 0.21.9

The PWA manifest icons were a generic pretzel emoji on a dark background,
not matching the app's pixel-art pretzel favicon. Regenerated from the
favicon.svg source.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/bump.yml

@@ -70,9 +70,6 @@ jobs:
             type=semver,pattern={{major}}.{{minor}},value=${{ needs.bump.outputs.tag }}
             type=raw,value=latest
 
-      - name: Set up QEMU (for multi-platform builds)
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -87,11 +84,9 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
 

.github/workflows/release.yml

@@ -30,9 +30,6 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest
 
-      - name: Set up QEMU (for multi-platform builds)
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -47,11 +44,9 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
 

.github/workflows/screenshots.yml

@@ -1,47 +0,0 @@
-name: Screenshots
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  screenshots:
-    name: Capture Landing Page Screenshots
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: latest
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: Install Playwright with system deps
-        run: pnpm exec playwright install --with-deps chromium
-
-      - name: Build app
-        run: pnpm build
-        env:
-          DATABASE_URL: ./data/screenshots.db
-
-      - name: Capture screenshots
-        run: pnpm exec tsx scripts/screenshots.ts
-        env:
-          DATABASE_URL: ./data/screenshots.db
-
-      - name: Commit and push
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add website/assets/screenshot-*.png
-          git diff --cached --quiet && echo "No changes" && exit 0
-          git commit -m "chore: update landing page screenshots [skip ci]"
-          git push

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   crumbs:
-    image: ghcr.io/bretzel-app/crumbs:0.22.3
+    image: ghcr.io/bretzel-app/crumbs:0.21.8
     container_name: crumbs
     ports:
       - "3000:3000"

docs/API.md

@@ -410,114 +410,6 @@ Owner can remove anyone. Collaborator can only remove self (leave). Use `userId=
 
 ---
 
-## Sharing
-
-### `POST /api/notes/{id}/share`
-
-Create a public share link
-
-Owner-only. Creates a public share URL for the note. Idempotent — returns existing token if already shared.
-
-**Parameters:**
-
-| Name | In | Type | Required | Description |
-|------|----|------|----------|-------------|
-| `id` | path | string | yes |  |
-
-**Response:** `201`
-
-```json
-{
-  "token": "token",
-  "url": "url"
-}
-```
-
-**Errors:** `404` Note not found or not owner
-
----
-
-### `DELETE /api/notes/{id}/share`
-
-Revoke a public share link
-
-Owner-only. Removes the public share link for the note.
-
-**Parameters:**
-
-| Name | In | Type | Required | Description |
-|------|----|------|----------|-------------|
-| `id` | path | string | yes |  |
-
-**Response:** `204`
-
-**Errors:** `404` Note not found or not owner
-
----
-
-### `GET /api/shared/{token}`
-
-Get a shared note (public)
-
-No authentication required. Returns the note content for a valid share token. Rate limited to 60 requests per minute per IP.
-
-> No authentication required.
-
-**Parameters:**
-
-| Name | In | Type | Required | Description |
-|------|----|------|----------|-------------|
-| `token` | path | string | yes |  |
-
-**Response:** `200`
-
-```json
-{
-  "title": "title",
-  "content": "content",
-  "checklistMode": true,
-  "color": "default",
-  "attachments": [
-    {
-      "id": "id",
-      "filename": "filename",
-      "mimeType": "mimeType",
-      "size": 1,
-      "featured": true,
-      "createdAt": "2025-01-01T00:00:00.000Z"
-    }
-  ],
-  "createdAt": "2025-01-01T00:00:00.000Z",
-  "updatedAt": "2025-01-01T00:00:00.000Z"
-}
-```
-
-**Errors:** `404` Invalid token or note is trashed, `429` Rate limit exceeded
-
----
-
-### `GET /api/shared/{token}/attachment/{attachmentId}`
-
-Get an attachment from a shared note (public)
-
-No authentication required. Serves image binary for an attachment belonging to the shared note. Rate limited.
-
-> No authentication required.
-
-**Parameters:**
-
-| Name | In | Type | Required | Description |
-|------|----|------|----------|-------------|
-| `token` | path | string | yes |  |
-| `attachmentId` | path | string | yes |  |
-| `thumb` | query | string | no | Set to '1' to get the thumbnail version (1) |
-
-**Response:** `200`
-
-**Errors:** `404` Invalid token, note trashed, or attachment not found, `429` Rate limit exceeded
-
----
-
 ## Users
 
 ### `GET /api/users/search`

docs/ARCHITECTURE.md

@@ -100,7 +100,6 @@ Key tables:
 - `api_keys` - MCP API keys (SHA-256 hashed, prefix for display)
 - `note_collaborators` - Sharing relationships (noteId + userId + addedBy)
 - `note_user_state` - Per-user pin/archive/sortOrder for shared notes
-- `shared_notes` - Public share links (noteId → token, 1:1 with cascade delete)
 - `sync_log` - Sync operation history
 
 ### Collaboration Access Control

docs/FEATURES.md

@@ -81,20 +81,13 @@
 - Permanently delete from trash
 
 ### Note Sharing / Collaboration
-- **Public link sharing**: share any note via a public URL — no login required for viewers
-  - Toggle public link on/off from the share dialog
-  - Copy shareable URL with one click
-  - Read-only public page with full markdown/checklist/image rendering
-  - Public links are automatically invalidated when a note is trashed
-  - Rate-limited public endpoints (60 req/min per IP)
-  - Globe icon on note cards indicates a public link is active
 - Share notes with other users on the same instance
 - User search autocomplete for adding collaborators
 - Full collaboration: both owner and collaborators can edit content, color, and checklist mode
 - Per-user state: pin, archive, and sort order are independent per user
 - Owner-only actions: trash, delete, share/unshare
-- Sharing indicator on note cards (Globe for public, Users for collaborators-only)
-- Hover popover showing sharing status and collaborator names
+- Collaborator indicator (Users icon) on shared note cards
+- Hover popover showing collaborator names
 - Share dialog accessible from editor toolbar
 - Collaborators can leave shared notes
 - Shared notes appear mixed in main list alongside owned notes

docs/openapi.yaml

@@ -237,104 +237,6 @@ paths:
               schema:
                 $ref: '#/components/schemas/Success'
 
-  /api/notes/{id}/share:
-    parameters:
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-    post:
-      summary: Create a public share link
-      description: Owner-only. Creates a public share URL for the note. Idempotent — returns existing token if already shared.
-      tags: [Sharing]
-      responses:
-        '201':
-          description: Share link created
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  token:
-                    type: string
-                  url:
-                    type: string
-                    format: uri
-        '404':
-          description: Note not found or not owner
-    delete:
-      summary: Revoke a public share link
-      description: Owner-only. Removes the public share link for the note.
-      tags: [Sharing]
-      responses:
-        '204':
-          description: Share link revoked
-        '404':
-          description: Note not found or not owner
-
-  /api/shared/{token}:
-    parameters:
-      - name: token
-        in: path
-        required: true
-        schema:
-          type: string
-    get:
-      summary: Get a shared note (public)
-      description: No authentication required. Returns the note content for a valid share token. Rate limited to 60 requests per minute per IP.
-      tags: [Sharing]
-      security: []
-      responses:
-        '200':
-          description: Shared note data
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/SharedNoteData'
-        '404':
-          description: Invalid token or note is trashed
-        '429':
-          description: Rate limit exceeded
-
-  /api/shared/{token}/attachment/{attachmentId}:
-    parameters:
-      - name: token
-        in: path
-        required: true
-        schema:
-          type: string
-      - name: attachmentId
-        in: path
-        required: true
-        schema:
-          type: string
-    get:
-      summary: Get an attachment from a shared note (public)
-      description: No authentication required. Serves image binary for an attachment belonging to the shared note. Rate limited.
-      tags: [Sharing]
-      security: []
-      parameters:
-        - name: thumb
-          in: query
-          schema:
-            type: string
-            enum: ['1']
-          description: Set to '1' to get the thumbnail version
-      responses:
-        '200':
-          description: Image binary
-          content:
-            image/*:
-              schema:
-                type: string
-                format: binary
-        '404':
-          description: Invalid token, note trashed, or attachment not found
-        '429':
-          description: Rate limit exceeded
-
   /api/users/search:
     get:
       summary: Search users
@@ -618,47 +520,6 @@ components:
       description: API key (crumbs_...)
 
   schemas:
-    PublicAttachment:
-      type: object
-      description: Sanitized attachment metadata for public sharing (no server paths)
-      properties:
-        id:
-          type: string
-        filename:
-          type: string
-        mimeType:
-          type: string
-        size:
-          type: integer
-        featured:
-          type: boolean
-        createdAt:
-          type: string
-          format: date-time
-
-    SharedNoteData:
-      type: object
-      properties:
-        title:
-          type: string
-        content:
-          type: string
-        checklistMode:
-          type: boolean
-        color:
-          type: string
-          enum: [default, coral, peach, sand, mint, sage, fog, storm, dusk, blossom, clay, chalk]
-        attachments:
-          type: array
-          items:
-            $ref: '#/components/schemas/PublicAttachment'
-        createdAt:
-          type: string
-          format: date-time
-        updatedAt:
-          type: string
-          format: date-time
-
     Success:
       type: object
       properties:

docs/superpowers/specs/2026-03-20-public-note-sharing-design.md

@@ -1,232 +0,0 @@
-# Public Note Sharing — Design Spec
-
-**Issue**: [#7 — Public links and shared notes](https://github.com/bretzel-app/crumbs/issues/7)
-**Date**: 2026-03-20
-
-## Overview
-
-Allow sharing individual notes via a public URL that anyone can view without authentication. Read-only sharing via unguessable tokens. Integrates into the existing ShareDialog alongside collaborator management.
-
-## Decisions
-
-| Decision | Choice | Rationale |
-|---|---|---|
-| Share UI location | Inside existing ShareDialog | One "Share" entry point for all sharing (public + collaborators) |
-| Expiry | Deferred to future version | Simpler v1; active/revoked toggle only |
-| Rate limiting | In-memory per-IP | Lightweight, resets on restart; token entropy handles enumeration |
-| Architecture | Separated shares-service | Follows collaborators-service pattern; clean module boundary |
-| Sharing icon | Globe (public) or Users (collaborators) | Single icon slot; tooltip shows combined sharing state |
-
-## Schema
-
-New `sharedNotes` table in `src/lib/server/db/schema.ts`:
-
-```typescript
-export const sharedNotes = sqliteTable('shared_notes', {
-  noteId: text('note_id').primaryKey().references(() => notes.id, { onDelete: 'cascade' }),
-  token: text('token').notNull().unique(),
-  createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
-  expiresAt: integer('expires_at', { mode: 'timestamp' }), // NULL = no expiry, reserved for future use
-});
-```
-
-- `noteId` as primary key — one share per note, no separate `id` needed
-- `integer` timestamps with `mode: 'timestamp'` — matches all other tables in the schema
-- `createdAt` set in service layer (`new Date()`), not via SQL default
-- CASCADE delete — deleting the note removes the share
-- Token: `nanoid(21)` — ~128 bits of entropy
-- No update to `deleteUser()` needed — shares cascade through notes (foreign keys enabled via `PRAGMA foreign_keys = ON` in db connection)
-
-## Types
-
-Add to `src/lib/types/index.ts`:
-
-```typescript
-export interface NoteShare {
-  noteId: string;
-  token: string;
-  createdAt: Date;
-  expiresAt: Date | null;
-}
-```
-
-Extend the `Note` interface:
-
-```typescript
-export interface Note {
-  // ...existing fields
-  shareToken?: string; // populated during hydration if a public share exists
-}
-```
-
-## Service Layer
-
-New file: `src/lib/server/shares-service.ts`
-
-| Function | Params | Returns | Description |
-|---|---|---|---|
-| `createShare` | `db, noteId, userId` | `{ token }` | Verify ownership, generate nanoid(21), insert row, return token. If share already exists, return existing token. |
-| `revokeShare` | `db, noteId, userId` | `void` | Verify ownership, delete share row |
-| `getShareByNoteId` | `db, noteId` | `NoteShare \| null` | Return share if exists (for ShareDialog) |
-| `getSharedNote` | `db, token` | `SharedNoteData \| null` | Public — fetch note by token, return null if trashed or not found |
-| `fetchSharesForNotes` | `db, noteIds` | `Map<string, string>` | Batch fetch — returns Map of noteId → token for hydration (only token needed for NoteCard indicator) |
-
-`SharedNoteData` type (returned to public viewers):
-
-```typescript
-interface SharedNoteData {
-  title: string;
-  content: string;
-  checklistMode: boolean;
-  color: NoteColor;
-  attachments: Attachment[];
-  createdAt: Date;
-  updatedAt: Date;
-}
-```
-
-## API Endpoints
-
-### `POST /api/notes/[id]/share`
-
-- **Auth**: Required (owner only)
-- **Body**: None
-- **Response**: `{ token: string, url: string }`
-- **Behavior**: Creates share or returns existing one. URL constructed from request origin + `/s/${token}`
-
-### `DELETE /api/notes/[id]/share`
-
-- **Auth**: Required (owner only)
-- **Response**: `204 No Content`
-- **Behavior**: Deletes share row. Link immediately returns 404.
-
-### `GET /api/shared/[token]`
-
-- **Auth**: None (public)
-- **Rate limit**: 60 requests/min per IP (in-memory)
-- **Response**: `SharedNoteData` JSON
-- **Error cases**:
-  - Invalid/unknown token → 404
-  - Note is trashed → 404
-  - Rate limited → 429
-
-### `GET /api/shared/[token]/attachment/[attachmentId]`
-
-- **Auth**: None (public)
-- **Rate limit**: Same as above
-- **Response**: Image binary (proxied from attachment storage)
-- **Behavior**: Verify attachment belongs to the shared note, then serve
-
-## Routes
-
-```
-src/routes/
-  (share)/
-    +layout.svelte       # Minimal layout: parchment bg, centered, no app chrome
-    s/[token]/
-      +page.server.ts    # Load shared note by token via shares-service
-      +page.svelte       # Read-only note renderer
-```
-
-### Auth Middleware
-
-Add `/s/` and `/api/shared` to `PUBLIC_PATHS` in `src/hooks.server.ts`. Both are needed — `/s/` for the public page route, `/api/shared` for the public API endpoints.
-
-### Public Page Design
-
-- Parchment background (`--bg-base`)
-- Centered content card (`--bg-surface`, `--border-subtle`, `--card-shadow`)
-- Note title in JetBrains Mono
-- Rendered markdown content or checklist (read-only)
-- Inline images from attachments
-- No tags, no edit controls, no sidebar, no navigation
-- Footer: "POWERED BY CRUMBS" in Press Start 2P pixel font, links to project
-
-## UI Components
-
-### ShareDialog Changes
-
-Add a "Public link" section **above** the existing collaborators section:
-
-**Inactive state:**
-- Globe icon + "Public link" label + toggle switch (off)
-- Subtitle: "Anyone with the link can view this note (read-only)"
-
-**Active state:**
-- Globe icon + "Public link" label + toggle switch (on, gold)
-- URL input (readonly) + "Copy" button
-- Subtitle: "Toggle off to revoke access. The link will return a 404."
-- Border highlight in `--primary` gold
-
-Toggle on → calls `POST /api/notes/[id]/share`, displays URL
-Toggle off → calls `DELETE /api/notes/[id]/share`, hides URL
-Copy button → clipboard API, brief "Copied!" feedback
-
-### NoteCard Share Indicator
-
-Single icon slot in top-right of NoteCard (replaces showing both icons):
-
-| State | Icon | Color |
-|---|---|---|
-| Public link active | `Globe` (Lucide) | `--primary` gold |
-| Collaborators only | `Users` (Lucide) | `--text-muted` |
-| Both | `Globe` (Lucide) | `--primary` gold |
-| Neither | No icon | — |
-
-**Hover tooltip** shows combined sharing info regardless of which icon is displayed:
-- "Shared publicly via link" (if public share exists)
-- "Shared with N collaborator(s)" (if collaborators exist)
-- Both lines if both exist
-
-### NoteEditor Share Button
-
-Existing Share button behavior unchanged. The Globe/Users icon logic from NoteCard also applies to the editor toolbar button to indicate current sharing state.
-
-## Rate Limiting
-
-New file: `src/lib/server/ip-rate-limit.ts` — separate from the existing DB-backed `rate-limit.ts` (which is login-specific).
-
-```typescript
-// In-memory store: Map<IP, { count: number, windowStart: number }>
-// 60 requests per minute per IP
-// Applied to GET /api/shared/[token] and GET /api/shared/[token]/attachment/[id]
-```
-
-Resets on server restart. No database table needed.
-
-## Hydration
-
-`hydrateNotes()` in `notes-service.ts` must be updated to call `fetchSharesForNotes()` and populate `shareToken` on each note. This follows the existing pattern where `hydrateNotes` already batch-fetches tags, attachments, and collaborators.
-
-## Security
-
-- Tokens are unguessable: nanoid(21) = ~128 bits of entropy
-- `/s/` and `/api/shared` routes bypass auth middleware — only these prefixes
-- Trashed notes return 404 even if share token is valid
-- Only note owners can create/revoke shares — collaborators cannot
-- No user information exposed on public page (no username, no email, no tags)
-- Rate limiting prevents brute-force enumeration
-- Attachments served through share-specific route (validates attachment belongs to shared note)
-
-## Out of Scope (v1)
-
-- Expiry dates / auto-expire
-- Password-protected shares
-- Edit access through share links
-- Share analytics / view counts
-- Email notifications for share events
-- E2EE interaction (no E2EE exists)
-
-## Acceptance Criteria
-
-- [ ] Share toggle in ShareDialog creates/revokes public link
-- [ ] Unique nanoid(21) token generated per shared note
-- [ ] Public `/s/[token]` route renders note without auth
-- [ ] Copy link to clipboard with feedback
-- [ ] Revoke share → link returns 404
-- [ ] Globe indicator on NoteCard for publicly shared notes
-- [ ] Combined tooltip showing all sharing state
-- [ ] Trashed notes return 404 even if shared
-- [ ] Minimal, parchment-styled public page with "Powered by Crumbs"
-- [ ] In-memory rate limiting on public endpoints
-- [ ] Attachments accessible on public page

docs/superpowers/specs/2026-03-20-screenshot-automation-design.md

@@ -1,322 +0,0 @@
-# Screenshot Automation for Landing Page
-
-## Overview
-
-A Playwright-based script that seeds the Crumbs app with bretzel-themed demo data, captures 10 screenshots (7 desktop + 3 mobile) for the landing page, and commits them. Triggered manually via a GitHub Actions workflow.
-
-## Architecture
-
-```
-scripts/
-  screenshots.ts          # Main orchestrator: seed + capture
-  fixtures/
-    bretzel-pixel.ts      # Generates a pixel-art bretzel PNG programmatically
-```
-
-Single script (`scripts/screenshots.ts`) that:
-1. Spawns the preview server as a child process (`pnpm preview --port 4173`), same approach as `playwright.config.ts` uses for e2e tests. The app uses `@sveltejs/adapter-node`, so `vite preview` import won't work — must spawn via CLI.
-2. Deletes any existing screenshot DB to start fresh
-3. Seeds data via API calls (setup admin, login, create notes/users/keys)
-4. Navigates to each view and captures screenshots at specific viewports
-5. Saves PNGs directly to `website/assets/`
-6. Kills the preview server in `finally` block
-
-## Seed Data — Bretzel Universe
-
-### Users
-
-| User | Email | Role | Purpose |
-|------|-------|------|---------|
-| Bretzel Admin | admin@bretzel.app | admin | Main user, owns all notes |
-| Alice Chen | alice@bretzel.app | user | Collaborator for sharing screenshot |
-
-### Tags
-
-Passed explicitly in the `tags` array of each `POST /api/notes` request body: `baking`, `bretzel`, `dev`, `devops`, `homelab`, `personal`, `reading`, `weekend`. Tags are NOT auto-parsed from hashtags in content — they must be provided as a separate field.
-
-### Notes
-
-| # | Title | Color | Mode | Tags | Pinned | Special |
-|---|-------|-------|------|------|--------|---------|
-| 1 | Bretzel Ingredients | sand | checklist | #baking, #bretzel | yes | Checklist items (see below) |
-| 2 | Self-Hosting Stack | fog | rich text | #homelab, #devops | no | Homelab list (see below) |
-| 3 | Back to Retro Gaming | peach | rich text | #reading, #personal | no | Retro gaming note |
-| 4 | The Best Software Is the Software You Own | coral | rich text | #personal, #bretzel | no | Self-hosting manifesto |
-| 5 | Weekend Plans | mint | rich text | #personal, #weekend | no | Casual weekend plans |
-| 6 | Ancient Flute Harmonica Discovered | chalk | rich text | #reading | no | Quirky news note |
-| 7 | Baking code for the... | clay | checklist | #dev, #bretzel | no | Dev/baking crossover |
-
-### Note Content Details
-
-**Bretzel Ingredients** (checklist):
-- [x] 500g bread flour
-- [x] 300ml warm water
-- [x] 10g salt
-- [ ] 7g dry yeast
-- [ ] 30g butter (softened)
-- [ ] Baking soda for the bath
-- [ ] Coarse salt for topping
-
-**Self-Hosting Stack** (rich text — used for editor screenshot):
-```
-Current homelab setup:
-
-**Crumbs** — notes (obviously)
-**42** — holiday budget tracking
-**Dokploy** — deployment platform
-**Outline** — team wiki
-**Navidrome** — music streaming
-**Vaultwarden** — passwords
-**Nextcloud** — files & calendar
-**Plausible** — analytics
-
-Everything below daily reverse proxy.
-```
-
-**The Best Software Is the Software You Own** (rich text):
-```
-Self-host everything. Trust no cloud.
-
-The best software is the software you own.
-Your data. Your server. Your rules.
-
-If it can't run on your hardware, it's not really yours.
-```
-
-**Back to Retro Gaming** (rich text):
-```
-Games to replay this summer:
-
-Chrono Trigger (SNES) — best RPG ever made
-The Legend of Zelda: Link's Awakening (GB)
-Castlevania: Symphony of the Night (PS1)
-Advance Wars (GBA)
-Final Fantasy Tactics (PS1)
-
-The pixel art era was peak game design.
-```
-
-**Weekend Plans** (rich text):
-```
-Saturday:
-- Farmer's market (get sourdough starter)
-- Fix the Dokploy SSL cert renewal
-- Bake a batch of bretzels
-
-Sunday:
-- Retro gaming marathon
-- Update the self-hosting stack
-- Plan next trip on 42
-```
-
-**Ancient Flute Harmonica Discovered** (rich text):
-```
-Archaeologists found a 40,000-year-old flute carved from vulture bone.
-
-The oldest known musical instrument.
-Imagine the first song ever played.
-```
-
-**Baking code for the...** (checklist):
-```
-- [x] Set up CI/CD pipeline
-- [x] Write the CRDT sync logic
-- [ ] Bake the docker image
-- [ ] Deploy to the homelab
-- [ ] Celebrate with a bretzel
-```
-
-### Image Attachments
-
-**Pixel-art bretzel image** (`scripts/fixtures/bretzel-pixel.ts`):
-- Generated programmatically as a PNG using raw pixel data (no external dependencies)
-- ~64x64 pixel grid, bretzel shape in warm browns (#C8860A gold, #8B6914 dark, #F0E6D3 parchment bg)
-- Attached as featured image to "Bretzel Ingredients" note
-- Also create a second smaller image attached to the same note (e.g. a pixel-art salt shaker or oven) for visual variety
-
-### Version History
-
-Send 4-5 `PATCH /api/notes/:id` calls to "Self-Hosting Stack" with varying content. Version history entries are created as a side-effect of each PATCH — there is no explicit "create version" endpoint. Each version adds or changes a tool in the stack, so the diff is meaningful when viewed in the history panel.
-
-### API Keys
-
-Create via API after seeding:
-| Name | Purpose |
-|------|---------|
-| Claude Code | For MCP integration screenshot |
-| N8N | For automation screenshot |
-
-## Screenshot Capture Plan
-
-### Desktop (1280x800)
-
-| # | Filename | View | Capture Steps |
-|---|----------|------|---------------|
-| 1 | screenshot-grid.png | Home grid | Navigate to `/`, wait for notes to render, ensure sidebar is expanded with tags visible |
-| 2 | screenshot-editor.png | Note editor | Click "Self-Hosting Stack" note, wait for editor to open with content and toolbar visible |
-| 3 | screenshot-checklist.png | Checklist mode | Click "Bretzel Ingredients" note, wait for checklist items with checkboxes visible |
-| 4 | screenshot-sharing.png | Share dialog | Open a note, click share button, wait for ShareDialog with "Alice Chen" listed as collaborator |
-| 5 | screenshot-history.png | Version history | Open "Self-Hosting Stack", click history button, select a middle version in the list, wait for preview panel |
-| 6 | screenshot-attachments.png | Attachments | Open "Bretzel Ingredients" note (has featured bretzel image), ensure image thumbnails and featured strip visible |
-| 7 | screenshot-api.png | Settings > API/MCP | Navigate to `/settings/mcp`, wait for API keys list ("Claude Code", "N8N") and MCP config JSON block |
-
-### Mobile (390x844)
-
-| # | Filename | View | Capture Steps |
-|---|----------|------|---------------|
-| 1 | screenshot-mobile-grid.png | Home grid | Navigate to `/`, wait for notes in mobile layout (no sidebar, tags as horizontal pills) |
-| 2 | screenshot-mobile-editor.png | Note editor | Open "Self-Hosting Stack" note, wait for mobile editor |
-| 3 | screenshot-mobile-checklist.png | Checklist | Open "Bretzel Ingredients" note, wait for mobile checklist view |
-
-### Capture Settings
-- Format: PNG
-- Full page: false (viewport only)
-- Animations disabled via `page.emulateMedia({ reducedMotion: 'reduce' })` to avoid capturing mid-animation
-- Wait for `networkidle` after each navigation before capturing
-
-## GitHub Actions Workflow
-
-**File**: `.github/workflows/screenshots.yml`
-
-```yaml
-name: Screenshots
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  screenshots:
-    name: Capture Landing Page Screenshots
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: latest
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: Install Playwright browsers and system deps
-        run: pnpm exec playwright install --with-deps chromium
-
-      - name: Build app
-        run: pnpm build
-        env:
-          DATABASE_URL: ./data/screenshots.db
-
-      - name: Capture screenshots
-        run: pnpm exec tsx scripts/screenshots.ts
-        env:
-          DATABASE_URL: ./data/screenshots.db
-
-      - name: Commit screenshots
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add website/assets/screenshot-*.png
-          git diff --cached --quiet && echo "No screenshot changes" && exit 0
-          git commit -m "chore: update landing page screenshots [skip ci]"
-          git push origin main
-```
-
-## Script Structure
-
-```typescript
-// scripts/screenshots.ts
-
-import { chromium, type Page } from 'playwright';
-import { spawn, type ChildProcess } from 'child_process';
-import { generateBretzelPixelArt } from './fixtures/bretzel-pixel';
-
-const BASE = 'http://localhost:4173';
-const DESKTOP = { width: 1280, height: 800 };
-const MOBILE = { width: 390, height: 844 };
-const OUTPUT = 'website/assets';
-
-async function main() {
-  // 1. Start preview server (spawn child process, wait for port 4173)
-  const server = await startPreviewServer();
-
-  // 2. Launch browser
-  const browser = await chromium.launch();
-
-  try {
-    // 3. Seed data (desktop context — API calls work at any viewport)
-    const seedContext = await browser.newContext({ viewport: DESKTOP });
-    const seedPage = await seedContext.newPage();
-    await seed(seedPage);
-
-    // 4. Desktop screenshots
-    await captureDesktop(seedPage);
-    await seedContext.close();
-
-    // 5. Mobile screenshots
-    const mobileContext = await browser.newContext({ viewport: MOBILE });
-    const mobilePage = await mobileContext.newPage();
-    await login(mobilePage);
-    await captureMobile(mobilePage);
-    await mobileContext.close();
-  } finally {
-    await browser.close();
-    server.close();
-  }
-}
-
-async function seed(page: Page) {
-  // Setup admin via POST /api/auth/setup
-  // Login via POST /api/auth/login (sets session cookie on page context)
-  // Create notes via POST /api/notes (with content, color, tags:string[], pinned, checklistMode)
-  //   → capture note IDs from responses for later use
-  // Create collaborator user via POST /api/admin/users
-  //   → capture alice.id (numeric) from response
-  // Share a note via POST /api/notes/:id/collaborators { userId: alice.id }
-  // Create version history: PATCH /api/notes/:id × 4-5 with varying content
-  // Upload pixel-art bretzel image via POST /api/notes/:id/attachments (multipart form)
-  // Create API keys via POST /api/settings/api-keys { name: "Claude Code" } and { name: "N8N" }
-}
-
-async function captureDesktop(page: Page) {
-  // D1: Grid view
-  // D2: Editor (Self-Hosting Stack)
-  // D3: Checklist (Bretzel Ingredients)
-  // D4: Sharing dialog
-  // D5: Version history
-  // D6: Attachments
-  // D7: API/MCP settings
-}
-
-async function captureMobile(page: Page) {
-  // M1: Grid view
-  // M2: Editor
-  // M3: Checklist
-}
-```
-
-## Landing Page Updates
-
-After the screenshots are generated, `website/index.html` needs updating:
-- Add new screenshot entries for: checklist, sharing, history, attachments, API
-- Update alt text and labels
-- Hero image stays as `screenshot-grid.png`
-- Mobile section adds checklist screenshot, replaces sidebar screenshot
-
-## Dependencies
-
-No new dependencies. Uses:
-- `playwright` (already in devDependencies for e2e tests)
-- `tsx` (already in devDependencies for other scripts)
-- Node.js built-in `fs`, `path`, `Buffer` for pixel-art PNG generation
-- SvelteKit's preview server (spawned as child process via `pnpm preview`)
-
-## Open Questions
-
-None — all decisions resolved during brainstorming.

drizzle/0003_uneven_tomorrow_man.sql

@@ -1,23 +0,0 @@
-CREATE TABLE `note_versions` (
-	`id` text PRIMARY KEY NOT NULL,
-	`note_id` text NOT NULL,
-	`version` integer NOT NULL,
-	`title` text DEFAULT '' NOT NULL,
-	`content` text DEFAULT '' NOT NULL,
-	`checklist_mode` integer DEFAULT false NOT NULL,
-	`color` text DEFAULT 'default' NOT NULL,
-	`created_at` integer NOT NULL,
-	FOREIGN KEY (`note_id`) REFERENCES `notes`(`id`) ON UPDATE no action ON DELETE cascade
-);
---> statement-breakpoint
-CREATE INDEX `note_versions_note_id_idx` ON `note_versions` (`note_id`);--> statement-breakpoint
-CREATE UNIQUE INDEX `note_versions_note_id_version_unique` ON `note_versions` (`note_id`,`version`);--> statement-breakpoint
-CREATE TABLE `shared_notes` (
-	`note_id` text PRIMARY KEY NOT NULL,
-	`token` text NOT NULL,
-	`created_at` integer NOT NULL,
-	`expires_at` integer,
-	FOREIGN KEY (`note_id`) REFERENCES `notes`(`id`) ON UPDATE no action ON DELETE cascade
-);
---> statement-breakpoint
-CREATE UNIQUE INDEX `shared_notes_token_unique` ON `shared_notes` (`token`);

drizzle/meta/_journal.json

@@ -22,13 +22,6 @@
       "when": 1773150888301,
       "tag": "0002_deep_black_widow",
       "breakpoints": true
-    },
-    {
-      "idx": 3,
-      "version": "6",
-      "when": 1774037379518,
-      "tag": "0003_uneven_tomorrow_man",
-      "breakpoints": true
     }
   ]
 }

package.json

@@ -1,7 +1,7 @@
 {
   "name": "crumbs",
   "private": true,
-  "version": "0.22.3",
+  "version": "0.21.9",
   "type": "module",
   "license": "MIT",
   "author": "Bretzel (https://bretzel.app)",
@@ -12,8 +12,7 @@
   },
   "scripts": {
     "dev": "vite dev",
-    "build": "npx tsx scripts/generate-openapi.ts && vite build",
-    "openapi": "npx tsx scripts/generate-openapi.ts",
+    "build": "vite build",
     "preview": "vite preview",
     "prepare": "svelte-kit sync || echo ''",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
@@ -55,7 +54,6 @@
     "idb": "^8.0.3",
     "lucide-svelte": "^0.577.0",
     "markdown-it": "^14.1.1",
-    "nanoid": "^5.1.7",
     "node-diff3": "^3.2.0",
     "nodemailer": "^8.0.2",
     "svelte-dnd-action": "^0.9.69",

pnpm-lock.yaml

@@ -80,9 +80,6 @@ importers:
       markdown-it:
         specifier: ^14.1.1
         version: 14.1.1
-      nanoid:
-        specifier: ^5.1.7
-        version: 5.1.7
       node-diff3:
         specifier: ^3.2.0
         version: 3.2.0
@@ -3001,11 +2998,6 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
-  nanoid@5.1.7:
-    resolution: {integrity: sha512-ua3NDgISf6jdwezAheMOk4mbE1LXjm1DfMUDMuJf4AqxLFK3ccGpgWizwa5YV7Yz9EpXwEaWoRXSb/BnV0t5dQ==}
-    engines: {node: ^18 || >=20}
-    hasBin: true
-
   napi-build-utils@2.0.0:
     resolution: {integrity: sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==}
 
@@ -6791,8 +6783,6 @@ snapshots:
 
   nanoid@3.3.11: {}
 
-  nanoid@5.1.7: {}
-
   napi-build-utils@2.0.0: {}
 
   negotiator@1.0.0: {}

scripts/generate-openapi.ts

@@ -1,147 +0,0 @@
-/**
- * Auto-generates an OpenAPI spec from the SvelteKit route tree.
- *
- * Scans all +server.ts files under src/routes/api/ for exported HTTP methods and
- * builds a minimal OpenAPI 3.1 spec at static/.well-known/openapi.json.
- *
- * Usage: npx tsx scripts/generate-openapi.ts
- */
-
-import { readFileSync, writeFileSync, mkdirSync, readdirSync, statSync } from 'fs';
-import { resolve, relative, dirname, join } from 'path';
-
-const ROOT = process.cwd();
-const ROUTES_DIR = resolve(ROOT, 'src/routes/api');
-const OUTPUT = resolve(ROOT, 'static/api/openapi.json');
-
-const pkg = JSON.parse(readFileSync(resolve(ROOT, 'package.json'), 'utf-8'));
-
-function walkDir(dir: string): string[] {
-	const results: string[] = [];
-	for (const entry of readdirSync(dir)) {
-		const full = join(dir, entry);
-		if (statSync(full).isDirectory()) {
-			results.push(...walkDir(full));
-		} else if (entry === '+server.ts') {
-			results.push(full);
-		}
-	}
-	return results;
-}
-
-const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const;
-const METHOD_RE = new RegExp(`export\\s+const\\s+(${HTTP_METHODS.join('|')})`, 'g');
-
-function svelteKitPathToOpenAPI(filePath: string): string {
-	const rel = relative(ROUTES_DIR, dirname(filePath));
-	const segments = rel === '' ? [] : rel.split('/');
-	const apiPath =
-		'/api/' +
-		segments
-			.map((s) => {
-				const match = s.match(/^\[(.+)\]$/);
-				return match ? `{${match[1]}}` : s;
-			})
-			.join('/');
-	return apiPath;
-}
-
-function extractMethods(filePath: string): string[] {
-	const content = readFileSync(filePath, 'utf-8');
-	const methods: string[] = [];
-	let match;
-	while ((match = METHOD_RE.exec(content)) !== null) {
-		methods.push(match[1].toLowerCase());
-	}
-	METHOD_RE.lastIndex = 0;
-	return methods;
-}
-
-function inferTag(path: string): string {
-	const first = path.replace('/api/', '').split('/')[0];
-	return first.charAt(0).toUpperCase() + first.slice(1);
-}
-
-function extractPathParams(path: string) {
-	const params: { name: string; in: string; required: boolean; schema: { type: string } }[] = [];
-	const re = /\{(\w+)\}/g;
-	let match;
-	while ((match = re.exec(path)) !== null) {
-		params.push({ name: match[1], in: 'path', required: true, schema: { type: 'string' } });
-	}
-	return params;
-}
-
-const files = walkDir(ROUTES_DIR);
-const paths: Record<string, Record<string, unknown>> = {};
-
-for (const fullPath of files) {
-	const apiPath = svelteKitPathToOpenAPI(fullPath);
-	const methods = extractMethods(fullPath);
-
-	if (methods.length === 0) continue;
-
-	const pathParams = extractPathParams(apiPath);
-	const pathEntry: Record<string, unknown> = {};
-
-	if (pathParams.length > 0) {
-		pathEntry.parameters = pathParams;
-	}
-
-	for (const method of methods) {
-		const operation: Record<string, unknown> = {
-			tags: [inferTag(apiPath)],
-			responses: {
-				'200': { description: 'Success' }
-			}
-		};
-
-		if (['post', 'put', 'patch'].includes(method)) {
-			operation.requestBody = {
-				content: {
-					'application/json': {
-						schema: { type: 'object' }
-					}
-				}
-			};
-		}
-
-		pathEntry[method] = operation;
-	}
-
-	paths[apiPath] = pathEntry;
-}
-
-const sortedPaths: Record<string, Record<string, unknown>> = {};
-for (const key of Object.keys(paths).sort()) {
-	sortedPaths[key] = paths[key];
-}
-
-const spec = {
-	openapi: '3.1.0',
-	info: {
-		title: `${pkg.name.charAt(0).toUpperCase() + pkg.name.slice(1)} API`,
-		description: `Auto-generated API spec for ${pkg.name}`,
-		version: pkg.version,
-		contact: {
-			name: 'Bretzel',
-			url: 'https://bretzel.app'
-		}
-	},
-	servers: [{ url: '/', description: 'Current instance' }],
-	security: [{ sessionCookie: [] }],
-	paths: sortedPaths,
-	components: {
-		securitySchemes: {
-			sessionCookie: {
-				type: 'apiKey',
-				in: 'cookie',
-				name: 'session'
-			}
-		}
-	}
-};
-
-mkdirSync(dirname(OUTPUT), { recursive: true });
-writeFileSync(OUTPUT, JSON.stringify(spec, null, 2) + '\n');
-console.log(`Generated ${relative(ROOT, OUTPUT)} with ${Object.keys(paths).length} paths`);

scripts/screenshots.ts

@@ -1,110 +0,0 @@
-import { chromium } from '@playwright/test';
-import { spawn, type ChildProcess } from 'child_process';
-import { existsSync, unlinkSync, mkdirSync } from 'fs';
-import { seed, login } from './screenshots/seed';
-import { captureDesktop, captureMobile } from './screenshots/capture';
-import {
-	BASE_URL,
-	SCREENSHOT_DB,
-	DESKTOP_VIEWPORT,
-	MOBILE_VIEWPORT,
-	OUTPUT_DIR
-} from './screenshots/constants';
-
-function cleanDatabase(): void {
-	for (const ext of ['', '-journal', '-wal', '-shm']) {
-		const path = `${SCREENSHOT_DB}${ext}`;
-		if (existsSync(path)) {
-			unlinkSync(path);
-			console.log(`  deleted ${path}`);
-		}
-	}
-}
-
-async function waitForServer(url: string, timeoutMs: number): Promise<void> {
-	const start = Date.now();
-	while (Date.now() - start < timeoutMs) {
-		try {
-			const res = await fetch(url);
-			if (res.ok || res.status === 302) return;
-		} catch {
-			// Server not ready yet
-		}
-		await new Promise((r) => setTimeout(r, 500));
-	}
-	throw new Error(`Server not reachable at ${url} after ${timeoutMs}ms`);
-}
-
-function startServer(): Promise<ChildProcess> {
-	return new Promise((resolve, reject) => {
-		const dir = SCREENSHOT_DB.substring(0, SCREENSHOT_DB.lastIndexOf('/'));
-		if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-
-		const server = spawn('pnpm', ['preview', '--port', '4173'], {
-			env: { ...process.env, DATABASE_URL: SCREENSHOT_DB, NODE_ENV: 'production' },
-			stdio: 'pipe'
-		});
-
-		server.on('error', reject);
-		server.on('exit', (code) => {
-			if (code !== null && code !== 0) reject(new Error(`Server exited with code ${code}`));
-		});
-
-		// Poll until server responds (stdout detection is unreliable in CI)
-		waitForServer(BASE_URL, 60_000)
-			.then(() => resolve(server))
-			.catch(reject);
-	});
-}
-
-async function main(): Promise<void> {
-	console.log('Screenshot automation starting...\n');
-
-	// 1. Clean DB
-	console.log('Cleaning database...');
-	cleanDatabase();
-
-	// 2. Ensure output dir exists
-	if (!existsSync(OUTPUT_DIR)) mkdirSync(OUTPUT_DIR, { recursive: true });
-
-	// 3. Start preview server
-	console.log('Starting preview server...');
-	const server = await startServer();
-	console.log('Server ready.\n');
-
-	const browser = await chromium.launch();
-
-	try {
-		// 4. Seed data (in desktop context)
-		console.log('Seeding data...');
-		const desktopContext = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
-		const desktopPage = await desktopContext.newPage();
-		await seed(desktopPage);
-		console.log('Seed complete.\n');
-
-		// 5. Desktop screenshots
-		await captureDesktop(desktopPage);
-		await desktopContext.close();
-		console.log('');
-
-		// 6. Mobile screenshots (fresh context with mobile viewport)
-		const mobileContext = await browser.newContext({ viewport: MOBILE_VIEWPORT });
-		const mobilePage = await mobileContext.newPage();
-		await login(mobilePage);
-		await captureMobile(mobilePage);
-		await mobileContext.close();
-
-		console.log('\nAll screenshots captured successfully!');
-	} finally {
-		await browser.close();
-		server.kill('SIGTERM');
-		// Force exit — pnpm spawns vite as a grandchild process that
-		// server.kill() doesn't reach, leaving the CI job hanging
-		process.exit(0);
-	}
-}
-
-main().catch((err) => {
-	console.error('Screenshot automation failed:', err);
-	process.exit(1);
-});

scripts/screenshots/capture.ts

@@ -1,103 +0,0 @@
-import type { Page, Locator } from '@playwright/test';
-import { join } from 'path';
-import { BASE_URL, OUTPUT_DIR } from './constants';
-
-async function screenshot(page: Page, name: string): Promise<void> {
-	await page.screenshot({ path: join(OUTPUT_DIR, name), type: 'png' });
-	console.log(`  captured ${name}`);
-}
-
-async function waitForApp(page: Page): Promise<void> {
-	await page.waitForLoadState('networkidle');
-	await page.waitForTimeout(300);
-}
-
-/** Click a note card by its title (targets the h3 inside note-card to avoid content substring matches) */
-function noteCard(page: Page, title: string): Locator {
-	return page.locator('[data-testid="note-card"]', { has: page.locator('h3', { hasText: title }) });
-}
-
-export async function captureDesktop(page: Page): Promise<void> {
-	await page.emulateMedia({ reducedMotion: 'reduce' });
-	console.log('Capturing desktop screenshots...');
-
-	// D1: Grid view (also used as hero)
-	await page.goto(BASE_URL);
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-grid.png');
-
-	// D2: Rich text editor — open "Self-Hosting Stack"
-	await noteCard(page, 'Self-Hosting Stack').click();
-	await page.waitForSelector('[data-testid="note-editor"]');
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-editor.png');
-	await page.getByTestId('close-editor-btn').click();
-	await waitForApp(page);
-
-	// D3: Checklist — open "Bretzel Ingredients"
-	await noteCard(page, 'Bretzel Ingredients').click();
-	await page.waitForSelector('[data-testid="note-editor"]');
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-checklist.png');
-	await page.getByTestId('close-editor-btn').click();
-	await waitForApp(page);
-
-	// D4: Sharing dialog — open "Weekend Plans", click share
-	await noteCard(page, 'Weekend Plans').click();
-	await page.waitForSelector('[data-testid="note-editor"]');
-	await page.getByTestId('share-toggle').click();
-	await page.waitForSelector('[data-testid="share-dialog"]');
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-sharing.png');
-	await page.getByTestId('share-dialog-overlay').click({ position: { x: 10, y: 10 } });
-	await page.getByTestId('close-editor-btn').click();
-	await waitForApp(page);
-
-	// D5: Version history — open "Self-Hosting Stack", click history
-	await noteCard(page, 'Self-Hosting Stack').click();
-	await page.waitForSelector('[data-testid="note-editor"]');
-	await page.getByTestId('history-toggle').click();
-	await page.waitForSelector('[data-testid="history-panel"]');
-	// Wait for version items to load from API
-	await page.waitForSelector('[data-testid="version-item"]', { timeout: 10_000 });
-	const versionItems = page.getByTestId('version-item');
-	if ((await versionItems.count()) > 1) {
-		await versionItems.nth(1).click();
-	}
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-history.png');
-	// Close history panel first (overlay blocks close-editor-btn)
-	await page.getByTestId('close-history-btn').click();
-	await waitForApp(page);
-	await page.getByTestId('close-editor-btn').click();
-	await waitForApp(page);
-
-	// D6: API/MCP settings
-	await page.goto(`${BASE_URL}/settings/mcp`);
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-api.png');
-}
-
-export async function captureMobile(page: Page): Promise<void> {
-	await page.emulateMedia({ reducedMotion: 'reduce' });
-	console.log('Capturing mobile screenshots...');
-
-	// M1: Mobile grid view
-	await page.goto(BASE_URL);
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-mobile-grid.png');
-
-	// M2: Mobile editor — open "Self-Hosting Stack"
-	await noteCard(page, 'Self-Hosting Stack').click();
-	await page.waitForSelector('[data-testid="note-editor"]');
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-mobile-editor.png');
-	await page.getByTestId('close-editor-btn').click();
-	await waitForApp(page);
-
-	// M3: Mobile checklist — open "Bretzel Ingredients"
-	await noteCard(page, 'Bretzel Ingredients').click();
-	await page.waitForSelector('[data-testid="note-editor"]');
-	await waitForApp(page);
-	await screenshot(page, 'screenshot-mobile-checklist.png');
-}

scripts/screenshots/constants.ts

@@ -1,18 +0,0 @@
-export const BASE_URL = 'http://localhost:4173';
-export const SCREENSHOT_DB = './data/screenshots.db';
-export const OUTPUT_DIR = 'website/assets';
-
-export const DESKTOP_VIEWPORT = { width: 1280, height: 800 };
-export const MOBILE_VIEWPORT = { width: 390, height: 844 };
-
-export const ADMIN = {
-	email: 'admin@bretzel.app',
-	displayName: 'Bretzel Admin',
-	password: 'bretzel2026!'
-};
-
-export const COLLABORATOR = {
-	email: 'salzig@bretzel.app',
-	displayName: 'Salzig Bretzel',
-	password: 'salzig2026!!'
-};

scripts/screenshots/seed.ts

@@ -1,271 +0,0 @@
-import type { Page } from '@playwright/test';
-import { BASE_URL, ADMIN, COLLABORATOR } from './constants';
-
-type HttpMethod = 'post' | 'patch' | 'get' | 'delete';
-
-async function api(page: Page, method: HttpMethod, path: string, data?: unknown) {
-	const res = await page.request[method](
-		`${BASE_URL}${path}`,
-		data !== undefined ? { data } : undefined
-	);
-	if (!res.ok()) {
-		throw new Error(`${method.toUpperCase()} ${path} failed: ${res.status()} ${await res.text()}`);
-	}
-	const text = await res.text();
-	return text ? JSON.parse(text) : {};
-}
-
-interface NoteData {
-	key: string;
-	title: string;
-	content: string;
-	color: string;
-	pinned?: boolean;
-	checklistMode?: boolean;
-}
-
-function getNotesData(): NoteData[] {
-	// Created in reverse display order so newest (first created) appears last
-	// and the grid reads naturally top-left to bottom-right
-	return [
-		{
-			key: 'bakingcode',
-			title: 'Crumbs v0.23 Release',
-			content: `- [x] CRDT sync logic
-- [x] MCP server integration
-- [ ] Bake the Docker image
-- [ ] Deploy to the homelab
-- [ ] Celebrate with a bretzel`,
-			color: 'clay',
-			checklistMode: true
-		},
-		{
-			key: 'coding-music',
-			title: 'Coding Playlists',
-			content: `Curated on **Navidrome** for maximum focus.
-
-### Late Night Focus
-
-1. *Tycho* — Dive (ambient electronic)
-2. *Boards of Canada* — Music Has the Right to Children
-3. *Nujabes* — Modal Soul
-4. *C418* — Minecraft Volume Alpha
-
-### Saturday Baking
-
-For slow mornings in the kitchen:
-
-1. *Khruangbin* — Con Todo El Mundo
-2. *Tatsuro Yamashita* — For You
-
-#music #personal`,
-			color: 'chalk'
-		},
-		{
-			key: 'weekend',
-			title: 'Weekend Plans',
-			content: `### Saturday
-
-- Farmer's market — get sourdough starter
-- Fix the Dokploy SSL cert renewal
-- Bake a batch of bretzels
-
-### Sunday
-
-- Retro gaming marathon on *RetroAssembly*
-- Update the self-hosting stack
-- Plan next trip on **42**
-
-> A weekend well spent brings a week of content.
-
-#personal #weekend`,
-			color: 'mint'
-		},
-		{
-			key: 'manifesto',
-			title: '',
-			content: `The best software is the software you **own**. Self-host everything. Trust no cloud. 🥨
-
-#personal #selfhosting`,
-			color: 'coral'
-		},
-		{
-			key: 'retro',
-			title: 'Back to Retro Gaming',
-			content: `Games running on **RetroAssembly** this summer:
-
-- **Chrono Trigger** (SNES) — best RPG ever made
-- **Link's Awakening** (GB) — pure portable magic
-- **Symphony of the Night** (PS1) — the *definitive* Metroidvania
-- **Advance Wars** (GBA) — turn-based perfection
-- **Final Fantasy Tactics** (PS1) — political intrigue + job system
-
-> The pixel art era was peak game design.
-
-#gaming #retro`,
-			color: 'peach'
-		},
-		{
-			key: 'selfhosting',
-			title: 'Self-Hosting Stack',
-			content: `All services running behind **Caddy** reverse proxy on a single Hetzner VPS.
-
-### Core Services
-
-- **Crumbs** — notes *(obviously)*
-- **Dokploy** — deployment platform
-- **Outline** — team wiki
-
-### Monitoring
-
-> Everything that can break *will* break at 3 AM on a Sunday.
-
-Just getting started. More to come.
-
-#homelab #devops`,
-			color: 'fog'
-		},
-		{
-			key: 'bretzel',
-			title: 'Bretzel Ingredients',
-			content: `- [x] 500g bread flour
-- [x] 300ml warm water
-- [x] 10g salt
-- [ ] 7g dry yeast
-- [ ] 30g butter (softened)
-- [ ] Baking soda for the bath
-- [ ] Coarse salt for topping`,
-			color: 'sand',
-			checklistMode: true
-		}
-	];
-}
-
-function getVersionHistoryContents(): string[] {
-	return [
-		// Version 2: Add Navidrome + RetroAssembly
-		`All services running behind **Caddy** reverse proxy on a single Hetzner VPS.
-
-### Core Services
-
-- **Crumbs** — notes *(obviously)*
-- **Dokploy** — deployment platform
-- **Outline** — team wiki
-- **Navidrome** — music streaming
-- **RetroAssembly** — retro game emulation
-
-### Monitoring
-
-> Everything that can break *will* break at 3 AM on a Sunday.
-
-Growing the stack.
-
-#homelab #devops`,
-
-		// Version 3: Add 42 + Umami
-		`All services running behind **Caddy** reverse proxy on a single Hetzner VPS.
-
-### Core Services
-
-- **Crumbs** — notes *(obviously)*
-- **42** — holiday budget tracking
-- **Dokploy** — deployment platform
-- **Outline** — team wiki
-- **Navidrome** — music streaming
-- **RetroAssembly** — retro game emulation
-- **Umami** — privacy-first analytics
-
-### Monitoring
-
-> Everything that can break *will* break at 3 AM on a Sunday.
-
-The stack is getting serious.
-
-#homelab #devops`,
-
-		// Version 4: Final version
-		`All services running behind **Caddy** reverse proxy on a single Hetzner VPS.
-
-### Core Services
-
-- **Crumbs** — notes *(obviously)*
-- **42** — holiday budget tracking
-- **Dokploy** — deployment platform
-- **Outline** — team wiki
-- **Navidrome** — music streaming
-- **RetroAssembly** — retro game emulation
-- **Umami** — privacy-first analytics
-
-### Monitoring
-
-> Everything that can break *will* break at 3 AM on a Sunday.
-
-Everything below daily reverse proxy. The dream stack is *almost* complete.
-
-#homelab #devops`
-	];
-}
-
-export async function seed(page: Page): Promise<void> {
-	// 1. Setup admin (sets session cookie)
-	await api(page, 'post', '/api/auth/setup', {
-		email: ADMIN.email,
-		displayName: ADMIN.displayName,
-		password: ADMIN.password
-	});
-	console.log('  admin created');
-
-	// 2. Create collaborator user
-	const alice = await api(page, 'post', '/api/admin/users', {
-		email: COLLABORATOR.email,
-		displayName: COLLABORATOR.displayName,
-		password: COLLABORATOR.password,
-		role: 'user'
-	});
-	const aliceId: number = alice.id;
-	console.log('  collaborator created (id:', aliceId, ')');
-
-	// 3. Create notes (order matters — newest appear first in grid)
-	const noteData = getNotesData();
-	const noteIds: Record<string, string> = {};
-	for (const note of noteData) {
-		const created = await api(page, 'post', '/api/notes', {
-			title: note.title,
-			content: note.content,
-			color: note.color,
-			pinned: note.pinned ?? false,
-			checklistMode: note.checklistMode ?? false
-		});
-		noteIds[note.key] = created.id;
-		console.log('  note created:', note.title);
-	}
-
-	// 4. Share "Weekend Plans" with Alice
-	await api(page, 'post', `/api/notes/${noteIds['weekend']}/collaborators`, {
-		userId: aliceId
-	});
-	console.log('  shared "Weekend Plans" with Alice');
-
-	// 5. Create version history for "Self-Hosting Stack"
-	const versionContents = getVersionHistoryContents();
-	for (let i = 0; i < versionContents.length; i++) {
-		await api(page, 'patch', `/api/notes/${noteIds['selfhosting']}`, {
-			content: versionContents[i]
-		});
-		console.log(`  version ${i + 2} created for "Self-Hosting Stack"`);
-	}
-
-	// 6. Create API keys
-	await api(page, 'post', '/api/settings/api-keys', { name: 'Claude Code' });
-	await api(page, 'post', '/api/settings/api-keys', { name: 'N8N' });
-	console.log('  API keys created');
-}
-
-export async function login(page: Page): Promise<void> {
-	await page.goto(`${BASE_URL}/login`);
-	await page.getByTestId('email-input').fill(ADMIN.email);
-	await page.getByTestId('password-input').fill(ADMIN.password);
-	await page.getByTestId('login-btn').click();
-	await page.waitForURL('**/');
-	await page.waitForLoadState('networkidle');
-}

src/hooks.server.ts

@@ -8,9 +8,7 @@ const PUBLIC_PATHS = [
 	'/setup',
 	'/api/auth/login',
 	'/api/auth/setup',
-	'/api/auth/oauth',
-	'/s/',
-	'/api/shared'
+	'/api/auth/oauth'
 ];
 
 export const handle: Handle = async ({ event, resolve }) => {

src/lib/components/NoteCard.svelte

@@ -4,7 +4,6 @@
 	import { togglePin, trashNote, archiveNote, unarchiveNote, restoreNote, deleteNote, leaveNote, currentFilter } from '$lib/stores/notes.js';
 	import ImageLightbox from './ImageLightbox.svelte';
 	import CollaboratorPopover from './CollaboratorPopover.svelte';
-	import SharingIndicator from './SharingIndicator.svelte';
 	import type { Note } from '$lib/types/index.js';
 	import Undo2 from 'lucide-svelte/icons/undo-2';
 	import Trash2 from 'lucide-svelte/icons/trash-2';
@@ -63,7 +62,7 @@
 
 <!-- svelte-ignore a11y_no_noninteractive_element_to_interactive_role -->
 <article
-	class="group relative cursor-pointer rounded-sm border border-[var(--border-subtle)] p-4 outline-none transition-all hover:border-[var(--primary)] shadow-[var(--card-shadow)] hover:shadow-[var(--card-shadow-hover)] max-h-[17rem] overflow-hidden {fullHeight ? 'h-full' : ''}"
+	class="group relative cursor-pointer rounded-sm border border-[var(--border-subtle)] p-4 outline-none transition-all hover:border-[var(--primary)] shadow-[var(--card-shadow)] hover:shadow-[var(--card-shadow-hover)] {fullHeight ? 'h-full' : ''}"
 	style={cardStyle}
 	onclick={() => onEdit(note)}
 	onkeydown={(e) => e.key === 'Enter' && onEdit(note)}
@@ -102,11 +101,10 @@
 
 	<!-- Status indicators (top-right) -->
 	<div class="absolute top-1.5 right-1.5 flex items-center gap-0.5">
-		{#if note.shareToken || (note.isShared && note.collaborators)}
-			<SharingIndicator
-				shareToken={note.shareToken}
-				collaborators={note.collaborators ?? []}
-				isOwner={note.isOwner ?? true}
+		{#if note.isShared && note.collaborators}
+			<CollaboratorPopover
+				collaborators={note.collaborators}
+				ownerName={note.isOwner ? 'You' : undefined}
 			/>
 		{/if}
 		{#if note.pinned}

src/lib/components/NoteEditor.svelte

@@ -21,7 +21,6 @@
 	import FileText from 'lucide-svelte/icons/file-text';
 	import UserPlus from 'lucide-svelte/icons/user-plus';
 	import Users from 'lucide-svelte/icons/users';
-	import Globe from 'lucide-svelte/icons/globe';
 	import History from 'lucide-svelte/icons/history';
 
 	interface Props {
@@ -71,16 +70,14 @@
 	let showHistory = $state(false);
 	// svelte-ignore state_referenced_locally
 	let collaboratorsList = $state<Collaborator[]>(note?.collaborators ?? []);
-	// svelte-ignore state_referenced_locally
-	let currentShareToken = $state<string | undefined>(note?.shareToken);
 	const isOwner = $derived(note?.isOwner !== false);
 	const isShared = $derived(collaboratorsList.length > 0);
-	const hasPublicLink = $derived(!!currentShareToken);
 	// Use displayName from first user or 'You' for owner
 	const ownerName = $derived(isOwner ? 'You' : 'Owner');
 
 	function handleCollaboratorsUpdate(updated: Collaborator[]) {
 		collaboratorsList = updated;
+		// Update the note in the store
 		if (noteId) {
 			notes.update((list) =>
 				list.map((n) =>
@@ -92,19 +89,6 @@
 		}
 	}
 
-	function handleShareUpdate(token: string | null) {
-		currentShareToken = token ?? undefined;
-		if (noteId) {
-			notes.update((list) =>
-				list.map((n) =>
-					n.id === noteId
-						? { ...n, shareToken: token ?? undefined }
-						: n
-				)
-			);
-		}
-	}
-
 	async function toggleShareDialog() {
 		if (currentlyNew) {
 			const id = await autoSave();
@@ -417,9 +401,7 @@
 						title="Share note"
 						data-testid="share-toggle"
 					>
-						{#if hasPublicLink}
-							<Globe class="h-5 w-5 text-[var(--primary)]" />
-						{:else if isShared}
+						{#if isShared}
 							<Users class="h-5 w-5 text-[var(--primary)]" />
 						{:else}
 							<UserPlus class="h-5 w-5" />
@@ -460,10 +442,8 @@
 		noteId={noteId}
 		collaborators={collaboratorsList}
 		{ownerName}
-		shareToken={currentShareToken}
 		onClose={() => (showShareDialog = false)}
 		onUpdate={handleCollaboratorsUpdate}
-		onShareUpdate={handleShareUpdate}
 	/>
 {/if}
 

src/lib/components/ShareDialog.svelte

@@ -3,12 +3,7 @@
 	import X from 'lucide-svelte/icons/x';
 	import UserMinus from 'lucide-svelte/icons/user-minus';
 	import Search from 'lucide-svelte/icons/search';
-	import Globe from 'lucide-svelte/icons/globe';
-	import Link from 'lucide-svelte/icons/link';
-	import Copy from 'lucide-svelte/icons/copy';
-	import Check from 'lucide-svelte/icons/check';
 	import { showToast } from '$lib/stores/toast.js';
-	import { page } from '$app/state';
 
 	interface UserResult {
 		id: number;
@@ -20,61 +15,17 @@
 		noteId: string;
 		collaborators: Collaborator[];
 		ownerName: string;
-		shareToken?: string;
 		onClose: () => void;
 		onUpdate: (collaborators: Collaborator[]) => void;
-		onShareUpdate: (token: string | null) => void;
 	}
 
-	const { noteId, collaborators, ownerName, shareToken, onClose, onUpdate, onShareUpdate }: Props = $props();
+	const { noteId, collaborators, ownerName, onClose, onUpdate }: Props = $props();
 
-	let publicShareToken = $state(shareToken ?? null);
-	let copying = $state(false);
-	let togglingShare = $state(false);
 	let searchQuery = $state('');
 	let searchResults = $state<UserResult[]>([]);
 	let isSearching = $state(false);
 	let searchTimeout: ReturnType<typeof setTimeout> | undefined;
 
-	const shareUrl = $derived(publicShareToken ? `${page.url.origin}/s/${publicShareToken}` : null);
-
-	async function togglePublicShare() {
-		togglingShare = true;
-		try {
-			if (publicShareToken) {
-				const res = await fetch(`/api/notes/${noteId}/share`, { method: 'DELETE' });
-				if (res.ok) {
-					publicShareToken = null;
-					onShareUpdate(null);
-					showToast('Public link removed', 'success');
-				}
-			} else {
-				const res = await fetch(`/api/notes/${noteId}/share`, { method: 'POST' });
-				if (res.ok) {
-					const data = await res.json();
-					publicShareToken = data.token;
-					onShareUpdate(data.token);
-					showToast('Public link created', 'success');
-				}
-			}
-		} catch {
-			showToast('Failed to update share link', 'error');
-		} finally {
-			togglingShare = false;
-		}
-	}
-
-	async function copyShareUrl() {
-		if (!shareUrl) return;
-		try {
-			await navigator.clipboard.writeText(shareUrl);
-			copying = true;
-			setTimeout(() => (copying = false), 2000);
-		} catch {
-			showToast('Failed to copy link', 'error');
-		}
-	}
-
 	function handleSearch(query: string) {
 		clearTimeout(searchTimeout);
 		if (!query.trim()) {
@@ -87,6 +38,7 @@
 				const res = await fetch(`/api/users/search?q=${encodeURIComponent(query)}`);
 				if (res.ok) {
 					const users: UserResult[] = await res.json();
+					// Filter out existing collaborators
 					const collabIds = new Set(collaborators.map((c) => c.userId));
 					searchResults = users.filter((u) => !collabIds.has(u.id));
 				}
@@ -171,60 +123,6 @@
 			</button>
 		</div>
 
-		<!-- Public link section -->
-		<div class="px-4 pt-3 pb-3" data-testid="public-link-section">
-			<div
-				class="rounded-sm border p-3 transition-colors {publicShareToken
-					? 'border-[var(--primary)] bg-[var(--primary)]/5'
-					: 'border-[var(--border-subtle)]'}"
-			>
-				<div class="flex items-center justify-between">
-					<div class="flex items-center gap-2">
-						<Globe class="h-4 w-4 {publicShareToken ? 'text-[var(--primary)]' : 'text-[var(--text-muted)]'}" />
-						<span class="text-sm font-medium text-[var(--text)]">Public link</span>
-					</div>
-					<button
-						onclick={togglePublicShare}
-						disabled={togglingShare}
-						class="relative h-5 w-9 rounded-sm transition-colors {publicShareToken
-							? 'bg-[var(--primary)]'
-							: 'bg-[var(--border-subtle)]'}"
-						title={publicShareToken ? 'Disable public link' : 'Enable public link'}
-						data-testid="public-share-toggle"
-					>
-						<span
-							class="absolute top-0.5 h-4 w-4 rounded-sm bg-[var(--bg-surface)] shadow-[1px_1px_0px_var(--border-subtle)] transition-all {publicShareToken
-								? 'left-[1.125rem]'
-								: 'left-0.5'}"
-						></span>
-					</button>
-				</div>
-
-				{#if publicShareToken && shareUrl}
-					<div class="mt-2 flex items-center gap-1" data-testid="share-url-container">
-						<div class="flex min-w-0 flex-1 items-center gap-1.5 rounded-sm border border-[var(--border-subtle)] bg-[var(--bg-base)] px-2 py-1.5">
-							<Link class="h-3 w-3 shrink-0 text-[var(--text-muted)]" />
-							<span class="truncate text-xs text-[var(--text-muted)]" data-testid="share-url-text">{shareUrl}</span>
-						</div>
-						<button
-							onclick={copyShareUrl}
-							class="shrink-0 rounded-sm border border-[var(--border-subtle)] p-1.5 hover:border-[var(--primary)] hover:bg-[var(--primary)]/5 transition-colors"
-							title="Copy link"
-							data-testid="copy-share-url-btn"
-						>
-							{#if copying}
-								<Check class="h-4 w-4 text-[var(--success-text)]" />
-							{:else}
-								<Copy class="h-4 w-4 text-[var(--text-muted)]" />
-							{/if}
-						</button>
-					</div>
-				{/if}
-			</div>
-		</div>
-
-		<div class="border-t border-[var(--border-subtle)]"></div>
-
 		<!-- Search input -->
 		<div class="relative px-4 pt-3">
 			<div class="relative">

src/lib/components/SharingIndicator.svelte

@@ -1,95 +0,0 @@
-<script lang="ts">
-	import type { Collaborator } from '$lib/types/index.js';
-	import Globe from 'lucide-svelte/icons/globe';
-	import Users from 'lucide-svelte/icons/users';
-
-	interface Props {
-		shareToken?: string;
-		collaborators: Collaborator[];
-		isOwner: boolean;
-	}
-
-	const { shareToken, collaborators, isOwner }: Props = $props();
-
-	let showPopover = $state(false);
-	let hoverTimeout: ReturnType<typeof setTimeout> | undefined;
-
-	const hasPublicLink = $derived(!!shareToken);
-	const hasCollaborators = $derived(collaborators.length > 0);
-
-	const tooltipLines = $derived.by(() => {
-		const lines: string[] = [];
-		if (hasPublicLink) lines.push('Shared publicly via link');
-		if (hasCollaborators) {
-			lines.push(`Shared with ${collaborators.length} collaborator${collaborators.length > 1 ? 's' : ''}`);
-		}
-		return lines;
-	});
-
-	function handleMouseEnter() {
-		hoverTimeout = setTimeout(() => {
-			showPopover = true;
-		}, 150);
-	}
-
-	function handleMouseLeave() {
-		clearTimeout(hoverTimeout);
-		showPopover = false;
-	}
-
-	function handleClick(e: Event) {
-		e.stopPropagation();
-		showPopover = !showPopover;
-	}
-</script>
-
-<!-- svelte-ignore a11y_no_static_element_interactions -->
-<div
-	class="relative inline-flex"
-	onmouseenter={handleMouseEnter}
-	onmouseleave={handleMouseLeave}
->
-	<button
-		type="button"
-		class="rounded-sm p-1 {hasPublicLink ? 'text-[var(--primary)]' : 'text-[var(--text-muted)]'} hover:text-[var(--primary)]"
-		title={tooltipLines.join(', ')}
-		aria-label={tooltipLines.join(', ')}
-		onclick={handleClick}
-		data-testid="sharing-indicator"
-	>
-		{#if hasPublicLink}
-			<Globe class="h-4 w-4" />
-		{:else}
-			<Users class="h-4 w-4" />
-		{/if}
-	</button>
-
-	{#if showPopover}
-		<div
-			class="absolute right-0 bottom-full z-20 mb-1 min-w-[180px] rounded-sm border border-[var(--border-subtle)] bg-[var(--bg-surface)] p-2 shadow-[var(--card-shadow)] animate-[fade-in_150ms_ease-out]"
-			data-testid="sharing-popover"
-		>
-			{#if hasPublicLink}
-				<div class="mb-1 flex items-center gap-1.5">
-					<Globe class="h-3 w-3 text-[var(--primary)]" />
-					<span class="text-xs font-semibold text-[var(--primary)]">Public link active</span>
-				</div>
-			{/if}
-			{#if hasCollaborators}
-				<p class="mb-1 text-xs font-semibold text-[var(--text-muted)]">Shared with</p>
-				<ul class="space-y-0.5">
-					{#if isOwner}
-						<li class="text-xs text-[var(--text)]">
-							You <span class="text-[var(--text-muted)]">(Owner)</span>
-						</li>
-					{/if}
-					{#each collaborators as collab}
-						<li class="text-xs text-[var(--text)]">
-							{collab.displayName || collab.email}
-						</li>
-					{/each}
-				</ul>
-			{/if}
-		</div>
-	{/if}
-</div>

src/lib/server/auth.ts

@@ -236,11 +236,6 @@ export async function deleteUser(userId: number): Promise<void> {
 		.run(userId, userId);
 	sqlite.prepare('DELETE FROM sync_log WHERE user_id = ?').run(userId);
 	sqlite.prepare('DELETE FROM attachments WHERE user_id = ?').run(userId);
-	sqlite
-		.prepare(
-			'DELETE FROM shared_notes WHERE note_id IN (SELECT id FROM notes WHERE user_id = ?)'
-		)
-		.run(userId);
 	sqlite
 		.prepare(
 			'DELETE FROM note_tags WHERE note_id IN (SELECT id FROM notes WHERE user_id = ?)'

src/lib/server/db/index.ts

@@ -124,13 +124,6 @@ sqlite.exec(`
 		updated_at INTEGER NOT NULL
 	);
 
-	CREATE TABLE IF NOT EXISTS shared_notes (
-		note_id TEXT PRIMARY KEY REFERENCES notes(id) ON DELETE CASCADE,
-		token TEXT NOT NULL UNIQUE,
-		created_at INTEGER NOT NULL,
-		expires_at INTEGER
-	);
-
 	CREATE TABLE IF NOT EXISTS note_versions (
 		id TEXT PRIMARY KEY,
 		note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,

src/lib/server/db/schema.ts

@@ -190,15 +190,6 @@ export const userPreferences = sqliteTable(
 	(table) => [uniqueIndex('user_preferences_user_key_unique').on(table.userId, table.key)]
 );
 
-export const sharedNotes = sqliteTable('shared_notes', {
-	noteId: text('note_id')
-		.primaryKey()
-		.references(() => notes.id, { onDelete: 'cascade' }),
-	token: text('token').notNull().unique(),
-	createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
-	expiresAt: integer('expires_at', { mode: 'timestamp' })
-});
-
 export const noteVersions = sqliteTable(
 	'note_versions',
 	{

src/lib/server/db/test-helpers.ts

@@ -137,13 +137,6 @@ export function createTestDb(options?: { seedUser?: boolean }) {
 		);
 		CREATE UNIQUE INDEX user_preferences_user_key_unique ON user_preferences(user_id, key);
 
-		CREATE TABLE shared_notes (
-			note_id TEXT PRIMARY KEY REFERENCES notes(id) ON DELETE CASCADE,
-			token TEXT NOT NULL UNIQUE,
-			created_at INTEGER NOT NULL,
-			expires_at INTEGER
-		);
-
 		CREATE TABLE note_versions (
 			id TEXT PRIMARY KEY,
 			note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,

src/lib/server/ip-rate-limit.test.ts

@@ -1,46 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-// We need to re-import for each test to get a fresh module state
-let checkIpRateLimit: (ip: string) => boolean;
-
-beforeEach(async () => {
-	vi.resetModules();
-	const mod = await import('./ip-rate-limit.js');
-	checkIpRateLimit = mod.checkIpRateLimit;
-});
-
-describe('checkIpRateLimit', () => {
-	it('allows requests under the limit', () => {
-		for (let i = 0; i < 60; i++) {
-			expect(checkIpRateLimit('1.2.3.4')).toBe(true);
-		}
-	});
-
-	it('blocks requests over the limit', () => {
-		for (let i = 0; i < 60; i++) {
-			checkIpRateLimit('1.2.3.4');
-		}
-		expect(checkIpRateLimit('1.2.3.4')).toBe(false);
-	});
-
-	it('tracks different IPs independently', () => {
-		for (let i = 0; i < 60; i++) {
-			checkIpRateLimit('1.1.1.1');
-		}
-		expect(checkIpRateLimit('1.1.1.1')).toBe(false);
-		expect(checkIpRateLimit('2.2.2.2')).toBe(true);
-	});
-
-	it('resets after the window expires', () => {
-		vi.useFakeTimers();
-		for (let i = 0; i < 60; i++) {
-			checkIpRateLimit('1.2.3.4');
-		}
-		expect(checkIpRateLimit('1.2.3.4')).toBe(false);
-
-		// Advance past the 1-minute window
-		vi.advanceTimersByTime(61_000);
-		expect(checkIpRateLimit('1.2.3.4')).toBe(true);
-		vi.useRealTimers();
-	});
-});

src/lib/server/ip-rate-limit.ts

@@ -1,30 +0,0 @@
-const store = new Map<string, { count: number; windowStart: number }>();
-const WINDOW_MS = 60_000; // 1 minute
-const MAX_REQUESTS = 60;
-const MAX_ENTRIES = 10_000;
-let cleanupCounter = 0;
-
-export function checkIpRateLimit(ip: string): boolean {
-	const now = Date.now();
-	const entry = store.get(ip);
-	if (!entry || now - entry.windowStart > WINDOW_MS) {
-		store.set(ip, { count: 1, windowStart: now });
-		pruneIfNeeded(now);
-		return true;
-	}
-	entry.count++;
-	return entry.count <= MAX_REQUESTS;
-}
-
-function pruneIfNeeded(now: number) {
-	cleanupCounter++;
-	if (cleanupCounter < 100 || store.size < MAX_ENTRIES) {
-		return;
-	}
-	cleanupCounter = 0;
-	for (const [key, entry] of store) {
-		if (now - entry.windowStart > WINDOW_MS) {
-			store.delete(key);
-		}
-	}
-}

src/lib/server/notes-service.ts

@@ -6,7 +6,6 @@ import { extractTags } from '$lib/utils/tags.js';
 import { fetchTagsForNotes, syncNoteTags } from './tags.js';
 import { fetchAttachmentsForNotes } from './attachments.js';
 import { fetchCollaboratorsForNotes } from './collaborators.js';
-import { fetchSharesForNotes } from './shares-service.js';
 import { canAccessNote } from './api-utils.js';
 import { createSnapshot } from './versions-service.js';
 import { mergeContent } from '$lib/utils/content-merge.js';
@@ -34,7 +33,6 @@ function hydrateNotes(db: Db, noteRows: NoteRow[], userId: number) {
 	const tagMap = fetchTagsForNotes(db, noteIds);
 	const attachmentMap = fetchAttachmentsForNotes(db, noteIds);
 	const collabMap = fetchCollaboratorsForNotes(db, noteIds);
-	const shareMap = fetchSharesForNotes(db, noteIds);
 
 	return noteRows.map((note) => {
 		const collaborators = collabMap.get(note.id) ?? [];
@@ -46,8 +44,7 @@ function hydrateNotes(db: Db, noteRows: NoteRow[], userId: number) {
 			attachments: attachmentMap.get(note.id) ?? [],
 			collaborators,
 			isOwner,
-			isShared,
-			shareToken: shareMap.get(note.id) ?? undefined
+			isShared
 		};
 	});
 }

src/lib/server/shares-service.test.ts

@@ -1,167 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest';
-import { createTestDb } from './db/test-helpers.js';
-import { notes, users, attachments } from './db/schema.js';
-import type { Db } from './db/index.js';
-import {
-	fetchSharesForNotes,
-	createShare,
-	revokeShare,
-	getShareByNoteId,
-	getSharedNote
-} from './shares-service.js';
-
-let db: Db;
-
-const OWNER_ID = 1;
-
-function seedUsers() {
-	db.insert(users)
-		.values([
-			{
-				email: 'owner@test.com',
-				displayName: 'Owner',
-				role: 'admin',
-				authProvider: 'password',
-				createdAt: new Date()
-			}
-		])
-		.run();
-}
-
-function seedNote(
-	id: string,
-	overrides: Partial<typeof notes.$inferInsert> = {}
-) {
-	const now = new Date();
-	db.insert(notes)
-		.values({
-			id,
-			userId: OWNER_ID,
-			title: 'Test Note',
-			content: 'Test content',
-			createdAt: now,
-			updatedAt: now,
-			...overrides
-		})
-		.run();
-	return id;
-}
-
-beforeEach(() => {
-	const result = createTestDb();
-	db = result.db;
-	seedUsers();
-});
-
-describe('createShare', () => {
-	it('creates a share and returns a token', () => {
-		seedNote('note-1');
-		const { token } = createShare(db, 'note-1', OWNER_ID);
-		expect(token).toBeDefined();
-		expect(token.length).toBe(21);
-	});
-
-	it('returns the same token on duplicate creation (idempotent)', () => {
-		seedNote('note-1');
-		const first = createShare(db, 'note-1', OWNER_ID);
-		const second = createShare(db, 'note-1', OWNER_ID);
-		expect(first.token).toBe(second.token);
-	});
-
-	it('throws 404 for non-existent note', () => {
-		expect(() => createShare(db, 'nonexistent', OWNER_ID)).toThrow();
-	});
-});
-
-describe('revokeShare', () => {
-	it('removes the share token', () => {
-		seedNote('note-1');
-		createShare(db, 'note-1', OWNER_ID);
-		revokeShare(db, 'note-1', OWNER_ID);
-		const share = getShareByNoteId(db, 'note-1');
-		expect(share).toBeNull();
-	});
-});
-
-describe('getShareByNoteId', () => {
-	it('returns null when no share exists', () => {
-		seedNote('note-1');
-		expect(getShareByNoteId(db, 'note-1')).toBeNull();
-	});
-
-	it('returns share when one exists', () => {
-		seedNote('note-1');
-		const { token } = createShare(db, 'note-1', OWNER_ID);
-		const share = getShareByNoteId(db, 'note-1');
-		expect(share).not.toBeNull();
-		expect(share!.token).toBe(token);
-	});
-});
-
-describe('getSharedNote', () => {
-	it('returns note data for valid token', () => {
-		seedNote('note-1', { title: 'Shared Title', content: 'Shared content' });
-		const { token } = createShare(db, 'note-1', OWNER_ID);
-
-		const data = getSharedNote(db, token);
-		expect(data).not.toBeNull();
-		expect(data!.title).toBe('Shared Title');
-		expect(data!.content).toBe('Shared content');
-	});
-
-	it('returns null for trashed note', () => {
-		seedNote('note-1', { trashed: true });
-		const { token } = createShare(db, 'note-1', OWNER_ID);
-
-		expect(getSharedNote(db, token)).toBeNull();
-	});
-
-	it('returns null for invalid token', () => {
-		expect(getSharedNote(db, 'invalid-token')).toBeNull();
-	});
-
-	it('includes attachments', () => {
-		seedNote('note-1');
-		db.insert(attachments)
-			.values({
-				id: 'att-1',
-				userId: OWNER_ID,
-				noteId: 'note-1',
-				filename: 'image.png',
-				mimeType: 'image/png',
-				size: 1024,
-				path: '/data/attachments/att-1.png',
-				createdAt: new Date()
-			})
-			.run();
-		const { token } = createShare(db, 'note-1', OWNER_ID);
-
-		const data = getSharedNote(db, token);
-		expect(data!.attachments).toHaveLength(1);
-		expect(data!.attachments[0].filename).toBe('image.png');
-		// Verify server paths are not exposed
-		expect(data!.attachments[0]).not.toHaveProperty('path');
-		expect(data!.attachments[0]).not.toHaveProperty('thumbnailPath');
-	});
-});
-
-describe('fetchSharesForNotes', () => {
-	it('returns empty map for no notes', () => {
-		const result = fetchSharesForNotes(db, []);
-		expect(result.size).toBe(0);
-	});
-
-	it('returns tokens for shared notes', () => {
-		seedNote('note-1');
-		seedNote('note-2');
-		seedNote('note-3');
-		const { token: token1 } = createShare(db, 'note-1', OWNER_ID);
-		const { token: token2 } = createShare(db, 'note-2', OWNER_ID);
-
-		const result = fetchSharesForNotes(db, ['note-1', 'note-2', 'note-3']);
-		expect(result.size).toBe(2);
-		expect(result.get('note-1')).toBe(token1);
-		expect(result.get('note-2')).toBe(token2);
-		expect(result.get('note-3')).toBeUndefined();
-	});
-});

src/lib/server/shares-service.ts

@@ -1,117 +0,0 @@
-import type { Db } from './db/index.js';
-import { sharedNotes, notes, attachments } from './db/schema.js';
-import { eq, and, inArray } from 'drizzle-orm';
-import { nanoid } from 'nanoid';
-import { requireNoteOwnership } from './api-utils.js';
-import type { SharedNoteData } from '$lib/types/index.js';
-
-/**
- * Batch fetch share tokens for multiple notes.
- * Returns a Map of noteId → token.
- */
-export function fetchSharesForNotes(db: Db, noteIds: string[]): Map<string, string> {
-	if (noteIds.length === 0) return new Map();
-
-	const rows = db
-		.select({ noteId: sharedNotes.noteId, token: sharedNotes.token })
-		.from(sharedNotes)
-		.where(inArray(sharedNotes.noteId, noteIds))
-		.all();
-
-	const map = new Map<string, string>();
-	for (const row of rows) {
-		map.set(row.noteId, row.token);
-	}
-	return map;
-}
-
-/**
- * Create a public share link for a note. Idempotent — returns existing token if already shared.
- */
-export function createShare(db: Db, noteId: string, userId: number): { token: string } {
-	requireNoteOwnership(db, noteId, userId);
-
-	const existing = db
-		.select({ token: sharedNotes.token })
-		.from(sharedNotes)
-		.where(eq(sharedNotes.noteId, noteId))
-		.get();
-
-	if (existing) return { token: existing.token };
-
-	const token = nanoid(21);
-	db.insert(sharedNotes)
-		.values({ noteId, token, createdAt: new Date() })
-		.run();
-
-	return { token };
-}
-
-/**
- * Revoke a public share link for a note.
- */
-export function revokeShare(db: Db, noteId: string, userId: number): void {
-	requireNoteOwnership(db, noteId, userId);
-
-	db.delete(sharedNotes)
-		.where(eq(sharedNotes.noteId, noteId))
-		.run();
-}
-
-/**
- * Get share info for a specific note.
- */
-export function getShareByNoteId(db: Db, noteId: string) {
-	return db
-		.select()
-		.from(sharedNotes)
-		.where(eq(sharedNotes.noteId, noteId))
-		.get() ?? null;
-}
-
-/**
- * Get a shared note by its public token. Returns null if note is trashed or token is invalid.
- */
-export function getSharedNote(db: Db, token: string): (SharedNoteData & { noteId: string }) | null {
-	const share = db
-		.select()
-		.from(sharedNotes)
-		.where(eq(sharedNotes.token, token))
-		.get();
-
-	if (!share) return null;
-
-	const note = db
-		.select()
-		.from(notes)
-		.where(and(eq(notes.id, share.noteId), eq(notes.trashed, false)))
-		.get();
-
-	if (!note) return null;
-
-	const noteAttachments = db
-		.select()
-		.from(attachments)
-		.where(eq(attachments.noteId, share.noteId))
-		.all();
-
-	const publicAttachments = noteAttachments.map((a) => ({
-		id: a.id,
-		filename: a.filename,
-		mimeType: a.mimeType,
-		size: a.size,
-		featured: a.featured,
-		createdAt: a.createdAt
-	}));
-
-	return {
-		noteId: note.id,
-		title: note.title,
-		content: note.content,
-		checklistMode: note.checklistMode,
-		color: note.color as SharedNoteData['color'],
-		attachments: publicAttachments,
-		createdAt: note.createdAt,
-		updatedAt: note.updatedAt
-	};
-}

src/lib/types/index.ts

@@ -17,7 +17,6 @@ export interface Note {
 	collaborators?: Collaborator[];
 	isOwner?: boolean;
 	isShared?: boolean;
-	shareToken?: string;
 }
 
 export interface Collaborator {
@@ -119,31 +118,5 @@ export interface NoteVersion {
 	createdAt: Date;
 }
 
-export interface NoteShare {
-	noteId: string;
-	token: string;
-	createdAt: Date;
-	expiresAt: Date | null;
-}
-
-export interface PublicAttachment {
-	id: string;
-	filename: string;
-	mimeType: string;
-	size: number;
-	featured: boolean;
-	createdAt: Date;
-}
-
-export interface SharedNoteData {
-	title: string;
-	content: string;
-	checklistMode: boolean;
-	color: NoteColor;
-	attachments: PublicAttachment[];
-	createdAt: Date;
-	updatedAt: Date;
-}
-
 export type { UserPreferences } from './preferences.js';
 export { DEFAULT_PREFERENCES, BOOLEAN_PREF_KEYS } from './preferences.js';

src/routes/(app)/settings/about/+page.svelte

@@ -35,8 +35,8 @@
 				href="https://bretzel.app"
 				target="_blank"
 				rel="noopener noreferrer"
-				class="text-[var(--primary)] underline hover:text-[var(--primary-hover)]">bretzel.app</a
-			> universe.
+				class="text-[var(--primary)] underline hover:text-[var(--primary-hover)]">Bretzel</a
+			> family of apps.
 		</p>
 	</section>
 

src/routes/(share)/+error.svelte

@@ -1,17 +0,0 @@
-<script lang="ts">
-	import { page } from '$app/state';
-</script>
-
-<svelte:head>
-	<title>Not Found - Crumbs</title>
-</svelte:head>
-
-<div class="w-full max-w-sm rounded-sm border border-[var(--border)] bg-[var(--bg-surface)] p-8 text-center">
-	<img src="/favicon.svg" alt="Crumbs" class="mx-auto h-12 w-12" />
-	<h1 class="mt-4 font-['Press_Start_2P'] text-xl text-[var(--primary)]">
-		{page.status}
-	</h1>
-	<p class="mt-4 text-sm text-[var(--text-muted)]">
-		{page.error?.message ?? 'This shared note does not exist or has been removed.'}
-	</p>
-</div>

src/routes/(share)/+layout.svelte

@@ -1,7 +0,0 @@
-<script lang="ts">
-	let { children } = $props();
-</script>
-
-<div class="flex min-h-screen items-center justify-center bg-[var(--bg-base)] text-[var(--text)]">
-	{@render children()}
-</div>

src/routes/(share)/s/[token]/+page.server.ts

@@ -1,28 +0,0 @@
-import { error } from '@sveltejs/kit';
-import type { PageServerLoad } from './$types.js';
-import { getSharedNote } from '$lib/server/shares-service.js';
-import { checkIpRateLimit } from '$lib/server/ip-rate-limit.js';
-import { db } from '$lib/server/db/index.js';
-
-export const load: PageServerLoad = async ({ params, getClientAddress }) => {
-	const ip = getClientAddress();
-	if (!checkIpRateLimit(ip)) {
-		throw error(429, 'Too many requests');
-	}
-
-	const data = getSharedNote(db, params.token);
-	if (!data) {
-		throw error(404, 'This shared note does not exist or has been removed.');
-	}
-
-	return {
-		token: params.token,
-		title: data.title,
-		content: data.content,
-		checklistMode: data.checklistMode,
-		color: data.color,
-		attachments: data.attachments,
-		createdAt: data.createdAt,
-		updatedAt: data.updatedAt
-	};
-};

src/routes/(share)/s/[token]/+page.svelte

@@ -1,123 +0,0 @@
-<script lang="ts">
-	import { NOTE_COLORS } from '$lib/utils/colors.js';
-	import { renderMarkdown } from '$lib/utils/markdown.js';
-	import type { NoteColor, PublicAttachment } from '$lib/types/index.js';
-
-	interface ChecklistItem {
-		text: string;
-		checked: boolean;
-	}
-
-	const { data } = $props();
-
-	const noteColor = data.color as NoteColor;
-	const bgColor = NOTE_COLORS[noteColor]?.bg ?? NOTE_COLORS.default.bg;
-
-	const renderedContent = renderMarkdown(data.content);
-
-	const checklistItems: ChecklistItem[] = data.checklistMode
-		? data.content
-				.split('\n')
-				.filter((l: string) => l.trim())
-				.map((line: string) => ({
-					text: line.replace(/^- \[[ x]\] /, ''),
-					checked: line.startsWith('- [x] ')
-				}))
-		: [];
-
-	const activeChecklistItems = checklistItems.filter((i) => !i.checked);
-	const doneChecklistItems = checklistItems.filter((i) => i.checked);
-	const sortedChecklistItems = [...activeChecklistItems, ...doneChecklistItems];
-
-	const imageAttachments = (data.attachments as PublicAttachment[]).filter((a) =>
-		a.mimeType.startsWith('image/')
-	);
-
-	function formatDate(date: Date | string) {
-		return new Date(date).toLocaleDateString('en-US', {
-			year: 'numeric',
-			month: 'short',
-			day: 'numeric'
-		});
-	}
-</script>
-
-<svelte:head>
-	<title>{data.title || 'Shared Note'} — Crumbs</title>
-	<meta name="description" content={data.content.slice(0, 160)} />
-</svelte:head>
-
-<div class="mx-4 w-full max-w-2xl py-10">
-	<article
-		class="rounded-sm border border-[var(--border-subtle)] shadow-[var(--card-shadow)] overflow-hidden"
-		style="background-color: {bgColor}"
-		data-testid="shared-note"
-	>
-		<div class="px-6 py-5">
-			{#if data.title}
-				<h1 class="mb-4 text-xl font-semibold text-[var(--text)]" data-testid="shared-note-title">
-					{data.title}
-				</h1>
-			{/if}
-
-			{#if data.checklistMode && checklistItems.length > 0}
-				<ul class="space-y-2" data-testid="shared-note-checklist">
-					{#each sortedChecklistItems as item}
-						<li
-							class="flex items-start gap-2 text-sm {item.checked
-								? 'text-[var(--text-muted)] line-through'
-								: 'text-[var(--text)]'}"
-						>
-							<input
-								type="checkbox"
-								checked={item.checked}
-								disabled
-								class="mt-0.5 h-3.5 w-3.5 shrink-0 rounded border-[var(--border-subtle)]"
-							/>
-							<span class="break-words min-w-0">{item.text}</span>
-						</li>
-					{/each}
-				</ul>
-			{:else if data.content}
-				<div
-					class="prose prose-sm max-w-none text-[var(--text)]"
-					data-testid="shared-note-content"
-				>
-					{@html renderedContent}
-				</div>
-			{/if}
-
-			{#if imageAttachments.length > 0}
-				<div class="mt-4 grid grid-cols-2 gap-2" data-testid="shared-note-images">
-					{#each imageAttachments as attachment}
-						<img
-							src="/api/shared/{data.token}/attachment/{attachment.id}"
-							alt={attachment.filename}
-							class="w-full rounded-sm border border-[var(--border-subtle)]"
-							loading="lazy"
-						/>
-					{/each}
-				</div>
-			{/if}
-		</div>
-
-		<div
-			class="flex items-center justify-between border-t border-[var(--border-subtle)] px-6 py-3"
-		>
-			<span class="text-xs text-[var(--text-muted)]">
-				{formatDate(data.updatedAt)}
-			</span>
-		</div>
-	</article>
-
-	<div class="mt-6 text-center">
-		<a
-			href="https://crumbs.bretzel.app"
-			target="_blank"
-			rel="noopener noreferrer"
-			class="font-['Press_Start_2P'] text-[8px] tracking-wider text-[var(--text-muted)] hover:text-[var(--primary)] transition-colors"
-		>
-			POWERED BY CRUMBS
-		</a>
-	</div>
-</div>

src/routes/api/notes/[id]/share/+server.ts

@@ -1,17 +0,0 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from './$types.js';
-import { getUserId } from '$lib/server/api-utils.js';
-import { createShare, revokeShare } from '$lib/server/shares-service.js';
-import { db } from '$lib/server/db/index.js';
-
-export const POST: RequestHandler = async ({ params, url, ...event }) => {
-	const userId = getUserId(event);
-	const { token } = createShare(db, params.id, userId);
-	return json({ token, url: `${url.origin}/s/${token}` }, { status: 201 });
-};
-
-export const DELETE: RequestHandler = async ({ params, ...event }) => {
-	const userId = getUserId(event);
-	revokeShare(db, params.id, userId);
-	return new Response(null, { status: 204 });
-};

src/routes/api/shared/[token]/+server.ts

@@ -1,20 +0,0 @@
-import { json, error } from '@sveltejs/kit';
-import type { RequestHandler } from './$types.js';
-import { getSharedNote } from '$lib/server/shares-service.js';
-import { checkIpRateLimit } from '$lib/server/ip-rate-limit.js';
-import { db } from '$lib/server/db/index.js';
-
-export const GET: RequestHandler = async ({ params, getClientAddress }) => {
-	const ip = getClientAddress();
-	if (!checkIpRateLimit(ip)) {
-		throw error(429, 'Too many requests');
-	}
-
-	const data = getSharedNote(db, params.token);
-	if (!data) {
-		throw error(404, 'Not found');
-	}
-
-	const { noteId: _, ...publicData } = data;
-	return json(publicData);
-};

src/routes/api/shared/[token]/attachment/[attachmentId]/+server.ts

@@ -1,37 +0,0 @@
-import { error } from '@sveltejs/kit';
-import type { RequestHandler } from './$types.js';
-import { getSharedNote } from '$lib/server/shares-service.js';
-import { getAttachment } from '$lib/server/attachments.js';
-import { checkIpRateLimit } from '$lib/server/ip-rate-limit.js';
-import { db } from '$lib/server/db/index.js';
-import { readFile } from 'fs/promises';
-
-export const GET: RequestHandler = async ({ params, url, getClientAddress }) => {
-	const ip = getClientAddress();
-	if (!checkIpRateLimit(ip)) {
-		throw error(429, 'Too many requests');
-	}
-
-	const data = getSharedNote(db, params.token);
-	if (!data) {
-		throw error(404, 'Not found');
-	}
-
-	const attachment = await getAttachment(db, params.attachmentId, data.noteId);
-	if (!attachment) {
-		throw error(404, 'Attachment not found');
-	}
-
-	const wantThumb = url.searchParams.get('thumb') === '1';
-	const filePath = wantThumb && attachment.thumbnailPath ? attachment.thumbnailPath : attachment.path;
-	const mimeType = wantThumb && attachment.thumbnailPath ? 'image/webp' : attachment.mimeType;
-
-	const buffer = await readFile(filePath);
-	return new Response(buffer, {
-		headers: {
-			'Content-Type': mimeType,
-			'Content-Disposition': `inline; filename="${attachment.filename}"`,
-			'Cache-Control': 'public, max-age=3600'
-		}
-	});
-};

static/api/openapi.json

@@ -1,796 +0,0 @@
-{
-  "openapi": "3.1.0",
-  "info": {
-    "title": "Crumbs API",
-    "description": "Auto-generated API spec for crumbs",
-    "version": "0.21.9",
-    "contact": {
-      "name": "Bretzel",
-      "url": "https://bretzel.app"
-    }
-  },
-  "servers": [
-    {
-      "url": "/",
-      "description": "Current instance"
-    }
-  ],
-  "security": [
-    {
-      "sessionCookie": []
-    }
-  ],
-  "paths": {
-    "/api/admin/users": {
-      "get": {
-        "tags": [
-          "Admin"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "post": {
-        "tags": [
-          "Admin"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/admin/users/{id}": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "patch": {
-        "tags": [
-          "Admin"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      },
-      "delete": {
-        "tags": [
-          "Admin"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/auth/account": {
-      "delete": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/auth/login": {
-      "post": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/auth/logout": {
-      "post": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/auth/oauth/{provider}": {
-      "parameters": [
-        {
-          "name": "provider",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "get": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/auth/oauth/{provider}/callback": {
-      "parameters": [
-        {
-          "name": "provider",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "get": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/auth/password": {
-      "put": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/auth/profile": {
-      "put": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/auth/sessions": {
-      "get": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "delete": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/auth/setup": {
-      "post": {
-        "tags": [
-          "Auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/mcp": {
-      "post": {
-        "tags": [
-          "Mcp"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      },
-      "get": {
-        "tags": [
-          "Mcp"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "delete": {
-        "tags": [
-          "Mcp"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/notes": {
-      "get": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "post": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/notes/reorder": {
-      "post": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/notes/{id}": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "get": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "patch": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      },
-      "delete": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/notes/{id}/attachments": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "get": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "post": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      },
-      "patch": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      },
-      "delete": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/notes/{id}/collaborators": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "get": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "post": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      },
-      "delete": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/notes/{id}/versions": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "get": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/notes/{id}/versions/{versionId}": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        },
-        {
-          "name": "versionId",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "get": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/notes/{id}/versions/{versionId}/restore": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        },
-        {
-          "name": "versionId",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "post": {
-        "tags": [
-          "Notes"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/preferences": {
-      "get": {
-        "tags": [
-          "Preferences"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "put": {
-        "tags": [
-          "Preferences"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/search": {
-      "get": {
-        "tags": [
-          "Search"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/settings/api-keys": {
-      "get": {
-        "tags": [
-          "Settings"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      },
-      "post": {
-        "tags": [
-          "Settings"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/settings/api-keys/{id}": {
-      "parameters": [
-        {
-          "name": "id",
-          "in": "path",
-          "required": true,
-          "schema": {
-            "type": "string"
-          }
-        }
-      ],
-      "delete": {
-        "tags": [
-          "Settings"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/sync": {
-      "post": {
-        "tags": [
-          "Sync"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        },
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object"
-              }
-            }
-          }
-        }
-      },
-      "get": {
-        "tags": [
-          "Sync"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/tags": {
-      "get": {
-        "tags": [
-          "Tags"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    },
-    "/api/users/search": {
-      "get": {
-        "tags": [
-          "Users"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success"
-          }
-        }
-      }
-    }
-  },
-  "components": {
-    "securitySchemes": {
-      "sessionCookie": {
-        "type": "apiKey",
-        "in": "cookie",
-        "name": "session"
-      }
-    }
-  }
-}

tests/e2e/public-sharing.spec.ts

@@ -1,150 +0,0 @@
-import { test, expect, noteCard } from './helpers/fixtures.js';
-import type { Page } from '@playwright/test';
-
-/**
- * Create a note via API and return it.
- */
-async function createNoteViaApi(page: Page, title: string, content = 'Public share content') {
-	const res = await page.request.post('/api/notes', {
-		data: { title, content }
-	});
-	return res.json();
-}
-
-/**
- * Create a public share link for a note via API and return the token.
- */
-async function createShareViaApi(page: Page, noteId: string): Promise<string> {
-	const res = await page.request.post(`/api/notes/${noteId}/share`);
-	const data = await res.json();
-	return data.token;
-}
-
-test.describe('Public Note Sharing', () => {
-	test('Scenario: User creates a public share link', async ({
-		authenticatedPage: page
-	}) => {
-		// Given a note titled "Public Test" exists
-		const note = await createNoteViaApi(page, 'Public Test', 'Hello world');
-		await page.reload();
-		await page.waitForLoadState('networkidle');
-
-		// When the owner opens the share dialog and enables the public link
-		await noteCard(page, 'Public Test').click();
-		await page.getByTestId('share-toggle').click();
-		await expect(page.getByTestId('share-dialog')).toBeVisible();
-		await page.getByTestId('public-share-toggle').click();
-
-		// Then a share URL is displayed
-		await expect(page.getByTestId('share-url-container')).toBeVisible({ timeout: 5000 });
-		const urlText = await page.getByTestId('share-url-text').textContent();
-		expect(urlText).toContain('/s/');
-	});
-
-	test('Scenario: Public page renders note content without auth', async ({
-		authenticatedPage: page,
-		browser
-	}) => {
-		// Given a publicly shared note exists
-		const note = await createNoteViaApi(page, 'Shared Publicly', 'This is **public** content');
-		const token = await createShareViaApi(page, note.id);
-
-		// When an unauthenticated user visits the share URL
-		const context = await browser.newContext();
-		const publicPage = await context.newPage();
-		await publicPage.goto(`/s/${token}`);
-
-		// Then the note content is rendered
-		await expect(publicPage.getByTestId('shared-note')).toBeVisible();
-		await expect(publicPage.getByTestId('shared-note-title')).toHaveText('Shared Publicly');
-		await expect(publicPage.getByTestId('shared-note-content')).toContainText('public');
-
-		await context.close();
-	});
-
-	test('Scenario: User revokes share and link returns 404', async ({
-		authenticatedPage: page,
-		browser
-	}) => {
-		// Given a publicly shared note exists
-		const note = await createNoteViaApi(page, 'Revoke Test', 'Will be revoked');
-		const token = await createShareViaApi(page, note.id);
-
-		// And the public page is accessible
-		const context = await browser.newContext();
-		const publicPage = await context.newPage();
-		await publicPage.goto(`/s/${token}`);
-		await expect(publicPage.getByTestId('shared-note')).toBeVisible();
-
-		// When the owner revokes the share
-		const revokeRes = await page.request.delete(`/api/notes/${note.id}/share`);
-		expect(revokeRes.status()).toBe(204);
-
-		// Then the public page returns 404
-		const res = await publicPage.request.get(`/api/shared/${token}`);
-		expect(res.status()).toBe(404);
-
-		await context.close();
-	});
-
-	test('Scenario: Trashed note share link returns 404', async ({
-		authenticatedPage: page
-	}) => {
-		// Given a publicly shared note that is then trashed
-		const note = await createNoteViaApi(page, 'Trash Share Test', 'Will be trashed');
-		const token = await createShareViaApi(page, note.id);
-
-		// When the note is trashed
-		await page.request.patch(`/api/notes/${note.id}`, {
-			data: { trashed: true }
-		});
-
-		// Then the shared API returns 404
-		const res = await page.request.get(`/api/shared/${token}`);
-		expect(res.status()).toBe(404);
-	});
-
-	test('Scenario: Globe icon appears on shared note card', async ({
-		authenticatedPage: page
-	}) => {
-		// Given a note with a public share link
-		const note = await createNoteViaApi(page, 'Globe Icon Test');
-		await createShareViaApi(page, note.id);
-
-		// When the user views the notes list
-		await page.reload();
-		await page.waitForLoadState('networkidle');
-
-		// Then the note card shows a sharing indicator
-		const card = noteCard(page, 'Globe Icon Test');
-		await expect(card).toBeVisible();
-		await expect(card.getByTestId('sharing-indicator')).toBeVisible();
-	});
-
-	test('Scenario: Copy link button copies to clipboard', async ({
-		authenticatedPage: page
-	}) => {
-		// Given a note with a public share link
-		const note = await createNoteViaApi(page, 'Copy Link Test');
-		await createShareViaApi(page, note.id);
-		await page.reload();
-		await page.waitForLoadState('networkidle');
-
-		// When the owner opens the share dialog
-		await noteCard(page, 'Copy Link Test').click();
-		await page.getByTestId('share-toggle').click();
-		await expect(page.getByTestId('share-dialog')).toBeVisible();
-
-		// Then the share URL is already visible (token was created via API)
-		await expect(page.getByTestId('share-url-container')).toBeVisible({ timeout: 5000 });
-
-		// And clicking copy shows the check icon
-		// Grant clipboard permissions for the test
-		await page.context().grantPermissions(['clipboard-read', 'clipboard-write']);
-		await page.getByTestId('copy-share-url-btn').click();
-
-		// The clipboard should contain the share URL
-		const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-		expect(clipboardText).toContain('/s/');
-	});
-});

tests/e2e/sharing.spec.ts

@@ -54,8 +54,8 @@ test.describe('Note Sharing', () => {
 		await page.getByTestId('share-dialog-overlay').click({ position: { x: 10, y: 10 } });
 		await page.getByTestId('close-editor-btn').click();
 
-		// Then the owner sees a sharing indicator
-		await expect(noteCard(page, 'Share Test').getByTestId('sharing-indicator')).toBeVisible();
+		// Then the owner sees a collaborator indicator
+		await expect(noteCard(page, 'Share Test').getByTestId('collaborator-indicator')).toBeVisible();
 
 		// And the collaborator sees the shared note in their list
 		await collabPage.reload();

website/index.html

@@ -173,7 +173,7 @@
 						<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="18" cy="5" r="3"/><circle cx="6" cy="12" r="3"/><circle cx="18" cy="19" r="3"/><line x1="8.59" y1="13.51" x2="15.42" y2="17.49"/><line x1="15.41" y1="6.51" x2="8.59" y2="10.49"/></svg>
 					</div>
 					<h3>Note Sharing</h3>
-					<p>Share notes via public link or with other users. Full collaboration with per-user pins and archives.</p>
+					<p>Share notes with other users on your instance. Full collaboration with per-user pins and archives.</p>
 				</div>
 
 				<!-- Version History -->
@@ -208,39 +208,27 @@
 					<div class="screenshot-label">Notes grid view</div>
 				</div>
 				<div class="screenshot-card animate-in delay-2">
-					<img src="assets/screenshot-editor.png" alt="Rich text editor with formatting toolbar and self-hosting stack note" width="1280" height="800" loading="lazy">
+					<img src="assets/screenshot-editor.png" alt="Rich text editor with formatting toolbar" width="1280" height="800" loading="lazy">
 					<div class="screenshot-label">Rich text editor</div>
 				</div>
 				<div class="screenshot-card animate-in delay-3">
-					<img src="assets/screenshot-checklist.png" alt="Checklist note with bretzel ingredients and checkboxes" width="1280" height="800" loading="lazy">
-					<div class="screenshot-label">Checklist mode</div>
-				</div>
-				<div class="screenshot-card animate-in delay-4">
-					<img src="assets/screenshot-sharing.png" alt="Share dialog with collaborator management" width="1280" height="800" loading="lazy">
-					<div class="screenshot-label">Note sharing</div>
-				</div>
-				<div class="screenshot-card animate-in delay-5">
-					<img src="assets/screenshot-history.png" alt="Note version history with side-by-side preview" width="1280" height="800" loading="lazy">
-					<div class="screenshot-label">Version history</div>
-				</div>
-				<div class="screenshot-card animate-in delay-6">
-					<img src="assets/screenshot-api.png" alt="API keys and MCP client configuration for Claude Code" width="1280" height="800" loading="lazy">
-					<div class="screenshot-label">API & MCP</div>
+					<img src="assets/screenshot-tags.png" alt="Tag filtering showing bretzel-tagged notes" width="1280" height="800" loading="lazy">
+					<div class="screenshot-label">Tag filtering</div>
 				</div>
 			</div>
 			<h3 class="screenshots-subtitle animate-in">Mobile</h3>
 			<div class="screenshots-grid screenshots-grid-mobile">
 				<div class="screenshot-card screenshot-card-mobile animate-in delay-1">
-					<img src="assets/screenshot-mobile-grid.png" alt="Mobile notes grid with tags and colorful cards" width="390" height="844" loading="lazy">
+					<img src="assets/screenshot-mobile-grid.png" alt="Mobile grid view with notes and tags" width="390" height="844" loading="lazy">
 					<div class="screenshot-label">Notes view</div>
 				</div>
 				<div class="screenshot-card screenshot-card-mobile animate-in delay-2">
-					<img src="assets/screenshot-mobile-editor.png" alt="Mobile rich text editor with self-hosting stack note" width="390" height="844" loading="lazy">
-					<div class="screenshot-label">Rich text editor</div>
+					<img src="assets/screenshot-mobile-editor.png" alt="Mobile checklist editor" width="390" height="844" loading="lazy">
+					<div class="screenshot-label">Checklist editor</div>
 				</div>
 				<div class="screenshot-card screenshot-card-mobile animate-in delay-3">
-					<img src="assets/screenshot-mobile-checklist.png" alt="Mobile checklist with bretzel ingredients" width="390" height="844" loading="lazy">
-					<div class="screenshot-label">Checklist mode</div>
+					<img src="assets/screenshot-mobile-sidebar.png" alt="Mobile sidebar with tags" width="390" height="844" loading="lazy">
+					<div class="screenshot-label">Sidebar & tags</div>
 				</div>
 			</div>
 		</div>
@@ -292,7 +280,7 @@
 				<li><a href="https://github.com/bretzel-app/crumbs/blob/main/docs/DEPLOYMENT.md" target="_blank" rel="noopener">Docs</a></li>
 				<li><a href="https://github.com/bretzel-app/crumbs/blob/main/LICENSE" target="_blank" rel="noopener">License</a></li>
 			</ul>
-			<span class="footer-version">v0.22.3</span>
+			<span class="footer-version">v0.21.9</span>
 		</div>
 	</footer>