Merge main into stale-file protection integration

src/LiveSyncBaseCore.ts

@@ -38,6 +38,11 @@ export interface LiveSyncCoreFeatureViews {
     readonly replicationScheduling: ReplicationSchedulingControl;
 }
 
+export interface StartupDatabaseOptions {
+    readonly ignoreSuspending?: boolean;
+    readonly continueOnFileFailure?: boolean;
+}
+
 type CompatibilityReplicatorView = ReplicatorInstance & Partial<LiveSyncAbstractReplicator>;
 
 export class LiveSyncBaseCore<
@@ -78,7 +83,8 @@ export class LiveSyncBaseCore<
         ) => ServiceModules,
         extraModuleInitialiser: (core: LiveSyncBaseCore<T, TCommands>) => AbstractModule[],
         addOnsInitialiser: (core: LiveSyncBaseCore<T, TCommands>) => TCommands[],
-        featuresInitialiser: (core: LiveSyncBaseCore<T, TCommands>, coreFeatureViews: LiveSyncCoreFeatureViews) => void
+        featuresInitialiser: (core: LiveSyncBaseCore<T, TCommands>, coreFeatureViews: LiveSyncCoreFeatureViews) => void,
+        readonly startupDatabaseOptions: StartupDatabaseOptions = {}
     ) {
         this._services = serviceHub;
         this.registerReplicatorProviders();

src/apps/browser/BrowserP2PTransportSettings.svelte

@@ -1,105 +1,67 @@
 <script lang="ts">
     import { onMount } from "svelte";
+    import { upsertRemoteConfigurationInPlace } from "@vrtmrz/livesync-commonlib/remote-configurations";
+    import { REMOTE_P2P } from "@vrtmrz/livesync-commonlib/compat/common/types";
     import type { P2PSyncSetting } from "@vrtmrz/livesync-commonlib/compat/common/types";
-
     import type { P2PReplicatorPaneHost } from "@/features/P2PSync/P2PReplicator/P2PReplicatorPaneHost";
+    import TurnConfiguration from "@/features/P2PSync/TurnConfiguration.svelte";
+    import { validateManagedTurnSettings } from "@/integrations/turnSettings";
 
-    interface Props {
-        host: P2PReplicatorPaneHost;
-    }
-
-    let { host }: Props = $props();
+    let { host }: { host: P2PReplicatorPaneHost } = $props();
     const currentSettings = () => host.services.setting.currentSettings() as P2PSyncSetting;
-    const initialSettings = currentSettings();
-
-    let savedTurnServers = $state(initialSettings.P2P_turnServers);
-    let savedTurnUsername = $state(initialSettings.P2P_turnUsername);
-    let savedTurnCredential = $state(initialSettings.P2P_turnCredential);
-    let turnServers = $state(initialSettings.P2P_turnServers);
-    let turnUsername = $state(initialSettings.P2P_turnUsername);
-    let turnCredential = $state(initialSettings.P2P_turnCredential);
-
-    const isTurnServersModified = $derived(turnServers !== savedTurnServers);
-    const isTurnUsernameModified = $derived(turnUsername !== savedTurnUsername);
-    const isTurnCredentialModified = $derived(turnCredential !== savedTurnCredential);
-    const isModified = $derived(
-        isTurnServersModified || isTurnUsernameModified || isTurnCredentialModified
-    );
+    function turnSettings(settings: P2PSyncSetting) {
+        return {
+            P2P_roomID: settings.P2P_roomID,
+            P2P_turnServers: settings.P2P_turnServers,
+            P2P_turnUsername: settings.P2P_turnUsername,
+            P2P_turnCredential: settings.P2P_turnCredential,
+            P2P_managedType: settings.P2P_managedType,
+            P2P_managedId: settings.P2P_managedId,
+            P2P_managedToken: settings.P2P_managedToken,
+        };
+    }
+    let draft = $state(turnSettings(currentSettings()));
+    let saved = $state(JSON.stringify(turnSettings(currentSettings())));
+    const isModified = $derived(JSON.stringify(draft) !== saved);
+    const sourceError = $derived(validateManagedTurnSettings(draft));
+    const sourceNeedsRoom = $derived(!!draft.P2P_managedType && (draft.P2P_roomID ?? "").trim() === "");
 
     function loadSettings(settings: P2PSyncSetting): void {
-        savedTurnServers = settings.P2P_turnServers;
-        savedTurnUsername = settings.P2P_turnUsername;
-        savedTurnCredential = settings.P2P_turnCredential;
-        turnServers = savedTurnServers;
-        turnUsername = savedTurnUsername;
-        turnCredential = savedTurnCredential;
+        const next = turnSettings(settings);
+        draft = next;
+        saved = JSON.stringify(next);
     }
-
-    onMount(() =>
-        host.services.context.events.onEvent("setting-saved", (settings) => {
-            loadSettings(settings as P2PSyncSetting);
-        })
-    );
+    onMount(() => host.services.context.events.onEvent("setting-saved", () => loadSettings(currentSettings())));
 
     async function save(): Promise<void> {
-        await host.services.setting.applyPartial(
-            {
-                P2P_turnServers: turnServers,
-                P2P_turnUsername: turnUsername,
-                P2P_turnCredential: turnCredential,
-            },
-            true
-        );
+        if (sourceError || sourceNeedsRoom) return;
+        const values = $state.snapshot(draft);
+        await host.services.setting.updateSettings((settings) => {
+            const next = { ...settings, ...values, remoteConfigurations: { ...settings.remoteConfigurations } };
+            const profileId = settings.P2P_ActiveRemoteConfigurationId ||
+                (settings.remoteType === REMOTE_P2P ? settings.activeConfigurationId : "");
+            const selected = next.remoteConfigurations[profileId];
+            if (selected?.uri.startsWith("sls+p2p://")) {
+                upsertRemoteConfigurationInPlace(next, "p2p", { id: profileId, activateForP2P: true });
+            } else if (values.P2P_managedType) {
+                upsertRemoteConfigurationInPlace(next, "p2p", { activateForP2P: true });
+            }
+            return next;
+        }, true);
         loadSettings(currentSettings());
     }
-
-    function revert(): void {
-        turnServers = savedTurnServers;
-        turnUsername = savedTurnUsername;
-        turnCredential = savedTurnCredential;
-    }
 </script>
 
 <section class="browser-p2p-transport-settings">
     <details>
         <summary>Optional TURN server settings</summary>
-        <p>
-            Configure TURN only when a direct peer-to-peer connection cannot be established.
-        </p>
-        <label class:is-dirty={isTurnServersModified}>
-            <span>TURN Server URLs (comma-separated)</span>
-            <input
-                type="text"
-                placeholder="turn:turn.example.com:3478"
-                bind:value={turnServers}
-                autocomplete="off"
-                spellcheck="false"
-                autocorrect="off"
-            />
-        </label>
-        <label class:is-dirty={isTurnUsernameModified}>
-            <span>TURN Username</span>
-            <input
-                type="text"
-                placeholder="Enter TURN username"
-                bind:value={turnUsername}
-                autocomplete="off"
-            />
-        </label>
-        <label class:is-dirty={isTurnCredentialModified}>
-            <span>TURN Credential</span>
-            <input
-                type="password"
-                placeholder="Enter TURN credential"
-                bind:value={turnCredential}
-                autocomplete="new-password"
-            />
-        </label>
+        <p>Configure TURN only when a direct peer-to-peer connection cannot be established.</p>
+        <TurnConfiguration bind:settings={draft} />
         <div class="actions">
-            <button type="button" class="button mod-cta" disabled={!isModified} onclick={save}>
+            <button type="button" class="button mod-cta" disabled={!isModified || !!sourceError || sourceNeedsRoom} onclick={save}>
                 Save TURN settings
             </button>
-            <button type="button" class="button" disabled={!isModified} onclick={revert}>
+            <button type="button" class="button" disabled={!isModified} onclick={() => loadSettings(currentSettings())}>
                 Revert TURN settings
             </button>
         </div>
@@ -107,27 +69,7 @@
 </section>
 
 <style>
-    .browser-p2p-transport-settings {
-        margin-bottom: 1rem;
-    }
-    p {
-        margin: 0.75rem 0;
-    }
-    label {
-        display: grid;
-        gap: 0.25rem;
-        margin: 0.75rem 0;
-    }
-    label.is-dirty {
-        background-color: var(--background-modifier-error);
-    }
-    input {
-        box-sizing: border-box;
-        width: 100%;
-    }
-    .actions {
-        display: flex;
-        flex-wrap: wrap;
-        gap: 0.5rem;
-    }
+    .browser-p2p-transport-settings { margin-bottom: 1rem; }
+    p { margin: 0.75rem 0; }
+    .actions { display: flex; flex-wrap: wrap; gap: 0.5rem; }
 </style>

src/apps/cli/adapters/NodeFileSystemAdapter.ts

@@ -92,10 +92,9 @@ export class NodeFileSystemAdapter implements IFileSystemAdapter<NodeFile, NodeF
     }
 
     async getFiles(): Promise<NodeFile[]> {
-        if (this.fileCache.size === 0) {
-            await this.scanDirectory();
-        }
-        return Array.from(this.fileCache.values());
+        const files = new Map<string, NodeFile>();
+        await this.scanDirectoryInto("", files);
+        return Array.from(files.values());
     }
 
     async renameFile(file: NodeFile, newPath: string): Promise<NodeFile> {
@@ -147,6 +146,10 @@ export class NodeFileSystemAdapter implements IFileSystemAdapter<NodeFile, NodeF
      * Helper method to recursively scan directory and populate file cache
      */
     async scanDirectory(relativePath: string = ""): Promise<void> {
+        await this.scanDirectoryInto(relativePath, this.fileCache);
+    }
+
+    private async scanDirectoryInto(relativePath: string, files: Map<string, NodeFile>): Promise<void> {
         const fullPath = this.resolvePath(relativePath);
         try {
             const directoryStat = await this.storage.stat(relativePath);
@@ -160,10 +163,10 @@ export class NodeFileSystemAdapter implements IFileSystemAdapter<NodeFile, NodeF
                     path: entryPath as FilePath,
                     stat,
                 };
-                this.fileCache.set(entryPath, file);
+                files.set(entryPath, file);
             }
             for (const entryPath of entries.folders) {
-                await this.scanDirectory(entryPath);
+                await this.scanDirectoryInto(entryPath, files);
             }
         } catch (error) {
             // Directory doesn't exist or is not readable

src/apps/cli/adapters/NodeFileSystemAdapter.unit.spec.ts

@@ -0,0 +1,118 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { fsPromises as fs, os, path } from "@vrtmrz/livesync-commonlib/node";
+import { NodeFileSystemAdapter } from "./NodeFileSystemAdapter";
+
+describe("NodeFileSystemAdapter file enumeration", () => {
+    const tempDirs: string[] = [];
+    const paths = ["a.md", "folder/b.md", "folder/sub/c.md"];
+
+    async function createVault() {
+        const directory = await fs.mkdtemp(path.join(os.tmpdir(), "livesync-cli-enumeration-"));
+        tempDirs.push(directory);
+        for (const file of paths) {
+            await fs.mkdir(path.dirname(path.join(directory, file)), { recursive: true });
+            await fs.writeFile(path.join(directory, file), `content of ${file}`);
+        }
+        return { directory, adapter: new NodeFileSystemAdapter(directory) };
+    }
+
+    afterEach(async () => {
+        await Promise.all(tempDirs.splice(0).map((directory) => fs.rm(directory, { recursive: true, force: true })));
+    });
+
+    it("lists every file when one file was refreshed before the first enumeration", async () => {
+        const { adapter } = await createVault();
+
+        expect(await adapter.refreshFile("folder/b.md")).not.toBeNull();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+    });
+
+    it("lists every file after a path lookup without any replication", async () => {
+        const { adapter } = await createVault();
+
+        expect((await adapter.getAbstractFileByPath("folder/b.md"))?.path).toBe("folder/b.md");
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+    });
+
+    it("lists every file on the first enumeration without a prior path lookup", async () => {
+        const { adapter } = await createVault();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+    });
+
+    it("excludes a deleted file after its cache entry is refreshed", async () => {
+        const { directory, adapter } = await createVault();
+        await adapter.getFiles();
+
+        await fs.rm(path.join(directory, "folder/b.md"));
+        expect(await adapter.refreshFile("folder/b.md")).toBeNull();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(["a.md", "folder/sub/c.md"]);
+    });
+
+    it("reflects files added and deleted between enumerations", async () => {
+        const { directory, adapter } = await createVault();
+
+        expect((await adapter.getFiles()).map((file) => file.path).sort()).toEqual(paths);
+
+        await fs.rm(path.join(directory, "folder/b.md"));
+        const updatedContent = "updated content of a.md";
+        await fs.writeFile(path.join(directory, "a.md"), updatedContent);
+        await fs.writeFile(path.join(directory, "later.md"), "content of later.md");
+
+        const files = await adapter.getFiles();
+        expect(files.map((file) => file.path).sort()).toEqual(["a.md", "folder/sub/c.md", "later.md"]);
+        expect(files.find((file) => file.path === "a.md")?.stat.size).toBe(updatedContent.length);
+    });
+
+    it("returns complete listings from simultaneous calls", async () => {
+        const { adapter } = await createVault();
+
+        const originalStat = adapter.storage.stat.bind(adapter.storage);
+        let releaseFolderStat!: () => void;
+        const folderStatReleased = new Promise<void>((resolve) => {
+            releaseFolderStat = resolve;
+        });
+        let folderStatStarted!: () => void;
+        const folderStatStartedPromise = new Promise<void>((resolve) => {
+            folderStatStarted = resolve;
+        });
+        let pauseFolderStat = true;
+        const statSpy = vi.spyOn(adapter.storage, "stat").mockImplementation(async (relativePath) => {
+            const stat = await originalStat(relativePath);
+            if (pauseFolderStat && relativePath === "folder") {
+                pauseFolderStat = false;
+                folderStatStarted();
+                await folderStatReleased;
+            }
+            return stat;
+        });
+
+        const firstListing = adapter.getFiles();
+        let listings: Awaited<ReturnType<typeof adapter.getFiles>>[] | undefined;
+        try {
+            await folderStatStartedPromise;
+            const secondListing = adapter.getFiles();
+            const secondFiles = await secondListing;
+            releaseFolderStat();
+            const firstFiles = await firstListing;
+            listings = [secondFiles, firstFiles];
+        } finally {
+            releaseFolderStat();
+            statSpy.mockRestore();
+        }
+
+        if (!listings) throw new Error("Expected both concurrent listings to complete");
+        expect(listings.map((files) => files.map((file) => file.path).sort())).toEqual([paths, paths]);
+    });
+
+    it("returns an empty listing for an empty vault", async () => {
+        const directory = await fs.mkdtemp(path.join(os.tmpdir(), "livesync-cli-enumeration-empty-"));
+        tempDirs.push(directory);
+        const adapter = new NodeFileSystemAdapter(directory);
+
+        await expect(adapter.getFiles()).resolves.toEqual([]);
+    });
+});

src/apps/cli/commands/daemonCommand.unit.spec.ts

@@ -4,7 +4,7 @@ import { NO_INTERACTION } from "@vrtmrz/livesync-commonlib/replication";
 import { runCommand } from "./runCommand";
 import type { CLIOptions } from "./types";
 
-// Mock performFullScan so daemon tests don't require a real CouchDB connection.
+// Track explicit scans: database preparation owns the daemon startup scan.
 vi.mock("@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner", () => ({
     performFullScan: vi.fn(async () => true),
 }));
@@ -102,6 +102,7 @@ function createDaemonContext(core: ReturnType<typeof createCoreMock>) {
 describe("daemon command", () => {
     beforeEach(() => {
         vi.restoreAllMocks();
+        vi.mocked(offlineScanner.performFullScan).mockClear();
         vi.useFakeTimers();
     });
 
@@ -109,27 +110,16 @@ describe("daemon command", () => {
         vi.useRealTimers();
     });
 
-    it("calls performFullScan during startup", async () => {
+    it("does not repeat the startup scan after initial replication", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
-        await runCommand(makeDaemonOptions(), createDaemonContext(core));
+        expect(await runCommand(makeDaemonOptions(), createDaemonContext(core))).toBe(true);
 
-        expect(offlineScanner.performFullScan).toHaveBeenCalledTimes(1);
-    });
-
-    it("returns false when performFullScan fails", async () => {
-        const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(false);
-
-        const result = await runCommand(makeDaemonOptions(), createDaemonContext(core));
-
-        expect(result).toBe(false);
+        expect(offlineScanner.performFullScan).not.toHaveBeenCalled();
     });
 
     it("polling mode: calls setTimeout when interval option is set", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
         const setTimeoutSpy = vi.spyOn(globalThis, "setTimeout");
 
         const context = createDaemonContext(core);
@@ -143,7 +133,6 @@ describe("daemon command", () => {
 
     it("polling mode: applies settings with suspendFileWatching=false before setting interval", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(10), createDaemonContext(core));
 
@@ -156,7 +145,6 @@ describe("daemon command", () => {
 
     it("liveSync mode: calls applyPartial and applySettings", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
@@ -176,7 +164,6 @@ describe("daemon command", () => {
             liveSync: false,
             syncOnStart: false,
         }));
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         const result = await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
@@ -194,7 +181,6 @@ describe("daemon command", () => {
             liveSync: true,
             syncOnStart: false,
         }));
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
@@ -205,22 +191,21 @@ describe("daemon command", () => {
         expect(warningCalls.length).toBe(0);
     });
 
-    it("calls replicate before performFullScan", async () => {
+    it("completes initial replication before restoring automatic synchronisation", async () => {
         const core = createCoreMock();
         const callOrder: string[] = [];
         core.services.replication.replicateUnattended = vi.fn(async () => {
             callOrder.push("replicate");
             return { status: "completed" as const };
         });
-        vi.mocked(offlineScanner.performFullScan).mockImplementation(async () => {
-            callOrder.push("performFullScan");
-            return true;
+        core.services.control.applySettings.mockImplementation(async () => {
+            callOrder.push("restoreSettings");
         });
 
         const context = createDaemonContext(core);
         await runCommand(makeDaemonOptions(), context);
 
-        expect(callOrder).toEqual(["replicate", "performFullScan"]);
+        expect(callOrder).toEqual(["replicate", "restoreSettings"]);
         expect(core.services.replication.replicateUnattended).toHaveBeenCalledWith({
             trigger: "daemon",
             interaction: NO_INTERACTION,
@@ -234,12 +219,11 @@ describe("daemon command", () => {
             status: "failed" as const,
             error: new Error("initial replication failed"),
         }));
-        vi.mocked(offlineScanner.performFullScan).mockClear();
 
         const result = await runCommand(makeDaemonOptions(), createDaemonContext(core));
 
         expect(result).toBe(false);
-        // performFullScan should NOT have been called
+        expect(core.services.control.applySettings).not.toHaveBeenCalled();
         expect(offlineScanner.performFullScan).not.toHaveBeenCalled();
         expect(core.services.replication.replicateUnattended).toHaveBeenCalledWith({
             trigger: "daemon",
@@ -249,7 +233,6 @@ describe("daemon command", () => {
 
     it("polling mode: registers onUnload handler that clears timeout", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         await runCommand(makeDaemonOptions(10), createDaemonContext(core));
 
@@ -265,7 +248,6 @@ describe("daemon command", () => {
 
     it("polling backoff: interval escalates on failure, caps at 300000ms, then halves on recovery", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         // startup replicate (call 1) succeeds; poll calls 2–7 fail; call 8 succeeds.
         let callCount = 0;
@@ -320,7 +302,6 @@ describe("daemon command", () => {
 
     it("polling error handling: replicate rejection is caught and written to standard error", async () => {
         const core = createCoreMock();
-        vi.mocked(offlineScanner.performFullScan).mockResolvedValue(true);
 
         // Make replicate succeed on the initial call (startup), then fail on the poll.
         let callCount = 0;

src/apps/cli/commands/runCommand.ts

@@ -15,11 +15,6 @@ import { stripAllPrefixes } from "@vrtmrz/livesync-commonlib/compat/string_and_b
 import type { CLICommandContext, CLIOptions } from "./types";
 import { toArrayBuffer, toDatabaseRelativePath } from "./utils";
 import { collectPeers, openP2PHost, parseTimeoutSeconds, syncWithPeer } from "./p2p";
-import {
-    performFullScan,
-    VaultScanResults,
-} from "@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner";
-import { UnresolvedErrorManager } from "@vrtmrz/livesync-commonlib/compat/services/base/UnresolvedErrorManager";
 import { compatGlobal } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions";
 import { fsPromises as fs, path } from "@vrtmrz/livesync-commonlib/node";
 import { writeStderrLine, writeStdoutLine } from "@/apps/cli/cliOutput";
@@ -59,9 +54,9 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         // accept whatever configuration the remote has.
         await core.services.setting.applyPartial({ disableCheckingConfigMismatch: true }, true);
 
-        // 1. Replicate the configured remote into the local database so the
-        // mirror scan has content to work with.
-        log("Replicating from remote...");
+        // Database preparation has already reconciled the local database and Vault.
+        // Replicate before restoring automatic synchronisation.
+        log("Replicating with remote...");
         const replResult = await core.services.replication.replicateUnattended({
             trigger: "daemon",
             interaction: NO_INTERACTION,
@@ -73,17 +68,7 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
         replicationScheduling.markInitialOneShotSatisfied();
         log("Initial replication complete");
 
-        // 2. Mirror scan to reconcile PouchDB ↔ local filesystem.
-        const errorManager = new UnresolvedErrorManager(core.services.appLifecycle, core.services.context.events);
-        log("Running mirror scan...");
-        const scanOk = await performFullScan(core, log, errorManager, false, true);
-        if (!scanOk) {
-            writeStderrLine(standardIo, "[Daemon] Mirror scan failed, cannot continue");
-            return false;
-        }
-        log("Mirror scan complete");
-
-        // 3. Re-enable sync.
+        // Re-enable sync.
         const restoreSyncSettings = async () => {
             await core.services.setting.applyPartial(
                 {
@@ -530,9 +515,8 @@ export async function runCommand(options: CLIOptions, context: CLICommandContext
 
     if (options.command === "mirror") {
         writeStderrLine(standardIo, "[Command] mirror");
-        const log = (msg: unknown) => writeStderrLine(standardIo, `[Mirror] ${String(msg)}`);
-        const errorManager = new UnresolvedErrorManager(core.services.appLifecycle, core.services.context.events);
-        return (await performFullScan(core, log, errorManager, false, true)) === VaultScanResults.COMPLETED;
+        // Database preparation has already completed the mirror scan.
+        return true;
     }
 
     if (options.command === "remote-add") {

src/apps/cli/commands/runCommand.unit.spec.ts

@@ -419,6 +419,30 @@ describe("runCommand abnormal cases", () => {
         expect(appliedSettings.useIndexedDBAdapter).toBe(false);
     });
 
+    it("setup imports managed TURN through the existing encrypted URI", async () => {
+        const core = createCoreMock();
+        const profiles = {
+            turn: { id: "turn", name: "TURN", isEncrypted: false,
+                uri: "sls+p2p://room?managedType=CF&managedId=turn-key&token=private-token" },
+        };
+        const passphrase = "setup-passphrase";
+        const setupURI = await processSetting.encodeSettingsToSetupURI(
+            {
+                ...DEFAULT_SETTINGS,
+                remoteConfigurations: profiles,
+            },
+            passphrase
+        );
+        expect(setupURI.startsWith(configURIBase)).toBe(true);
+        expect(setupURI).not.toContain("private-token");
+        core.services.context.standardIo.prompt.mockResolvedValue(passphrase);
+        await runCommand(makeOptions("setup", [setupURI]), { ...context, core });
+        expect(core.services.setting.applyExternalSettings).toHaveBeenCalledWith(
+            expect.objectContaining({ remoteConfigurations: profiles }),
+            true
+        );
+    });
+
     it("setup rejects encoded URI when passphrase is wrong", async () => {
         const core = createCoreMock();
         const setupURI = await createSetupURI("correct-passphrase");

src/apps/cli/main.bootstrap.unit.spec.ts

@@ -0,0 +1,195 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as chokidar from "chokidar";
+import { ControlService } from "@vrtmrz/livesync-commonlib/compat/services/base/ControlService";
+import type { FilePathWithPrefix } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { ServiceFileHandler } from "@/serviceModules/FileHandler";
+import { ServiceFileAccessCLI } from "./serviceModules/ServiceFileAccessImpl";
+import { runCommand } from "./commands/runCommand";
+import { createDefaultCliSettings } from "./cliSettingsDefaults";
+import { main, type CliCommandRunner } from "./main";
+
+vi.mock("chokidar", { spy: true });
+
+function createStandardIoMock() {
+    return {
+        readStdin: vi.fn(async () => ""),
+        prompt: vi.fn(async () => ""),
+        writeStdout: vi.fn(),
+        writeStderr: vi.fn(),
+    };
+}
+
+describe("CLI database preparation", () => {
+    const originalArgv = process.argv.slice();
+    const originalExitCode = process.exitCode;
+    let directory: string;
+    let vaultPath: string;
+    let settingsPath: string;
+    let signalHandlers: Map<"SIGINT" | "SIGTERM", Set<NodeJS.SignalsListener>>;
+    let standardIo: ReturnType<typeof createStandardIoMock>;
+
+    beforeEach(async () => {
+        vi.mocked(chokidar.watch).mockClear();
+        directory = await mkdtemp(join(tmpdir(), "livesync-cli-bootstrap-"));
+        vaultPath = join(directory, "vault");
+        settingsPath = join(directory, "settings.json");
+        await mkdir(join(vaultPath, "notes"), { recursive: true });
+        await writeFile(join(vaultPath, "notes/local.md"), "local content");
+        await writeFile(settingsPath, JSON.stringify({ ...createDefaultCliSettings(), isConfigured: true }));
+        standardIo = createStandardIoMock();
+        signalHandlers = new Map(
+            (["SIGINT", "SIGTERM"] as const).map((signal) => [signal, new Set(process.listeners(signal))])
+        );
+        process.exitCode = undefined;
+        vi.spyOn(process, "exit").mockImplementation((code) => {
+            throw new Error(`__EXIT__:${code ?? 0}`);
+        });
+    });
+
+    afterEach(async () => {
+        for (const [signal, originalHandlers] of signalHandlers) {
+            for (const handler of process.listeners(signal)) {
+                if (!originalHandlers.has(handler)) process.removeListener(signal, handler);
+            }
+        }
+        process.argv = originalArgv.slice();
+        process.exitCode = originalExitCode;
+        vi.restoreAllMocks();
+        await rm(directory, { recursive: true, force: true });
+    });
+
+    async function start(command: "daemon" | "mirror" | "ls", runner: CliCommandRunner, exitCode = 1) {
+        process.argv = ["node", "livesync-cli", directory, "--vault", vaultPath, "--settings", settingsPath, command];
+        // Daemon probes return false so the real core unloads without keeping a daemon alive.
+        await expect(main(standardIo, runner)).rejects.toThrow(`__EXIT__:${exitCode}`);
+    }
+
+    it.each([
+        { command: "daemon" as const, suspendFileWatching: false },
+        { command: "mirror" as const, suspendFileWatching: false },
+        { command: "mirror" as const, suspendFileWatching: true },
+    ])(
+        "prepares the Vault before $command (watching suspended: $suspendFileWatching)",
+        async ({ command, suspendFileWatching }) => {
+            await writeFile(
+                settingsPath,
+                JSON.stringify({ ...createDefaultCliSettings(), isConfigured: true, suspendFileWatching })
+            );
+            await mkdir(join(vaultPath, ".livesync"));
+            await writeFile(join(vaultPath, ".livesync/ignore"), "*.tmp\n");
+            await writeFile(join(vaultPath, "notes/ignored.tmp"), "ignored");
+            const storedPaths: string[] = [];
+            let content: string | undefined;
+            const runner = vi.fn<CliCommandRunner>(async (_options, { core }) => {
+                for await (const doc of core.services.database.localDatabase.findAllNormalDocs()) {
+                    storedPaths.push(doc.path);
+                }
+                const file = await core.serviceModules.databaseFileAccess.fetch("notes/local.md" as FilePathWithPrefix);
+                content = file ? await file.body.text() : undefined;
+                return false;
+            });
+
+            await start(command, runner);
+
+            expect(runner).toHaveBeenCalledOnce();
+            expect(storedPaths).toEqual(["notes/local.md"]);
+            expect(content).toBe("local content");
+            expect(await readFile(join(vaultPath, "notes/local.md"), "utf-8")).toBe("local content");
+        }
+    );
+
+    it("runs the mirror scan once and exits without starting file watching", async () => {
+        const enumerate = vi.spyOn(ServiceFileAccessCLI.prototype, "getFiles");
+        const watch = vi.mocked(chokidar.watch);
+        const runner = vi.fn<CliCommandRunner>(runCommand);
+
+        await start("mirror", runner, 0);
+
+        expect(runner).toHaveBeenCalledOnce();
+        expect(enumerate).toHaveBeenCalledOnce();
+        expect(watch).not.toHaveBeenCalled();
+    });
+
+    it.each([
+        { command: "daemon" as const, commandRuns: true },
+        { command: "mirror" as const, commandRuns: false },
+    ])("handles an individual file failure during $command preparation", async ({ command, commandRuns }) => {
+        const store = vi
+            .spyOn(ServiceFileHandler.prototype, "storeFileToDB")
+            .mockRejectedValue(new Error("file failed"));
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+
+        await start(command, runner);
+
+        expect(store).toHaveBeenCalledOnce();
+        expect(runner).toHaveBeenCalledTimes(commandRuns ? 1 : 0);
+        expect(unload).toHaveBeenCalledOnce();
+        expect(await readFile(join(vaultPath, "notes/local.md"), "utf-8")).toBe("local content");
+    });
+
+    it("does not import vault files for standalone database commands", async () => {
+        const storedPaths: string[] = [];
+        const runner = vi.fn<CliCommandRunner>(async (_options, { core }) => {
+            for await (const doc of core.services.database.localDatabase.findAllNormalDocs()) {
+                storedPaths.push(doc.path);
+            }
+            return false;
+        });
+
+        await start("ls", runner);
+
+        expect(runner).toHaveBeenCalledOnce();
+        expect(storedPaths).toEqual([]);
+    });
+
+    it("unloads without starting the command when database preparation fails", async () => {
+        vi.spyOn(ControlService.prototype, "onReady").mockResolvedValue(false);
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+        const settingsBefore = await readFile(settingsPath, "utf-8");
+
+        await start("daemon", runner);
+
+        expect(runner).not.toHaveBeenCalled();
+        expect(unload).toHaveBeenCalledOnce();
+        expect(unload.mock.invocationCallOrder[0]).toBeLessThan(vi.mocked(process.exit).mock.invocationCallOrder[0]);
+        expect(process.exit).toHaveBeenCalledWith(1);
+        expect(await readFile(settingsPath, "utf-8")).toBe(settingsBefore);
+    });
+
+    it("stops the daemon when the startup scanner refuses a suspended Vault scan", async () => {
+        await writeFile(
+            settingsPath,
+            JSON.stringify({ ...createDefaultCliSettings(), isConfigured: true, suspendFileWatching: true })
+        );
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+
+        await start("daemon", runner);
+
+        expect(runner).not.toHaveBeenCalled();
+        expect(unload).toHaveBeenCalledOnce();
+        expect(process.exit).toHaveBeenCalledWith(1);
+    });
+
+    it("unloads when database preparation throws", async () => {
+        const ready = vi.spyOn(ControlService.prototype, "onReady").mockRejectedValue(new Error("scan failed"));
+        const unload = vi.spyOn(ControlService.prototype, "onUnload");
+        const runner = vi.fn<CliCommandRunner>(async () => false);
+
+        try {
+            await start("daemon", runner);
+
+            expect(runner).not.toHaveBeenCalled();
+            expect(unload).toHaveBeenCalledOnce();
+            expect(standardIo.writeStderr.mock.calls.flat().join("")).toContain("scan failed");
+        } finally {
+            const control = ready.mock.contexts[0];
+            if (unload.mock.calls.length === 0 && control instanceof ControlService) await control.onUnload();
+        }
+    });
+});

src/apps/cli/main.ts

@@ -1,6 +1,7 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 import { NodeServiceContext, NodeServiceHub } from "./services/NodeServiceHub";
 import { configureNodeLocalStorage, ensureGlobalNodeLocalStorage } from "./services/NodeLocalStorage";
-import { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
+import { LiveSyncBaseCore, type StartupDatabaseOptions } from "@/LiveSyncBaseCore";
 import { initialiseServiceModulesCLI } from "./serviceModules/CLIServiceModules";
 import {
     LOG_LEVEL_VERBOSE,
@@ -24,6 +25,7 @@ import { getPathFromUXFileInfo } from "@vrtmrz/livesync-commonlib/compat/common/
 import { stripAllPrefixes } from "@vrtmrz/livesync-commonlib/compat/string_and_binary/path";
 import { IgnoreRules } from "./serviceModules/IgnoreRules";
 import { useP2PReplicatorFeature, type UseP2PReplicatorResult } from "@vrtmrz/livesync-commonlib/p2p";
+import { useOfflineScanner } from "@vrtmrz/livesync-commonlib/compat/serviceFeatures/offlineScanner";
 import type { ReplicationSchedulingControl } from "@/serviceFeatures/replicationScheduling";
 import { createNodeStandardIo, fsPromises as fs, path } from "@vrtmrz/livesync-commonlib/node";
 import type { StandardIo } from "@vrtmrz/livesync-commonlib/context";
@@ -41,6 +43,27 @@ import {
 } from "./settingsPersistence";
 
 const SETTINGS_FILE = ".livesync/settings.json";
+
+interface CLIVaultSyncMode {
+    readonly watchFiles: boolean;
+    readonly reflectReplicationResults: boolean;
+    readonly startupDatabaseOptions: StartupDatabaseOptions;
+}
+
+// Commands which synchronise a physical Vault with the local database.
+const VAULT_SYNC_MODES: Readonly<Partial<Record<CLICommand, CLIVaultSyncMode>>> = {
+    daemon: {
+        watchFiles: true,
+        reflectReplicationResults: true,
+        startupDatabaseOptions: { ignoreSuspending: false, continueOnFileFailure: true },
+    },
+    mirror: {
+        watchFiles: false,
+        reflectReplicationResults: false,
+        startupDatabaseOptions: { ignoreSuspending: true, continueOnFileFailure: false },
+    },
+};
+
 ensureGlobalNodeLocalStorage();
 defaultLoggerEnv.minLogLevel = LOG_LEVEL_DEBUG;
 
@@ -296,6 +319,7 @@ export async function main(
     commandRunner: CliCommandRunner = runCommand
 ) {
     const options = parseArgs(standardIo);
+    const vaultSyncMode = VAULT_SYNC_MODES[options.command];
     if (options.interval && options.command !== "daemon") {
         writeStderrLine(
             standardIo,
@@ -357,9 +381,6 @@ export async function main(
 
     // Resolve vault path: mirror positional argument takes priority,
     // then --vault flag, otherwise fall back to databasePath.
-    // For daemon mode, enable chokidar file watching so the _changes feed picks up events.
-    // mirror runs a single full scan and doesn't need continuous watching.
-    const watchEnabled = options.command === "daemon";
     const vaultPath =
         options.command === "mirror" && options.commandArgs[0]
             ? path.resolve(options.commandArgs[0])
@@ -385,7 +406,7 @@ export async function main(
     infoLog(`Settings: ${settingsPath}`);
     infoLog("");
     let ignoreRules: IgnoreRules | undefined;
-    if (options.command === "daemon" || options.command === "mirror") {
+    if (vaultSyncMode) {
         ignoreRules = new IgnoreRules(vaultPath, (message, detail) => {
             if (detail === undefined) {
                 writeStderrLine(standardIo, message);
@@ -426,9 +447,8 @@ export async function main(
         }
         writeStderrLine(standardIo, prefix, message);
     }, true);
-    // Prevent replication result from being processed automatically in non-daemon commands.
-    // In daemon mode the default handler must run so changes are applied to the filesystem.
-    if (options.command !== "daemon") {
+    // Only modes which reflect replication results use the default filesystem handler.
+    if (!vaultSyncMode?.reflectReplicationResults) {
         serviceHubInstance.replication.processSynchroniseResult.addHandler(async () => {
             writeStderrLine(
                 standardIo,
@@ -489,14 +509,25 @@ export async function main(
     const core = new LiveSyncBaseCore(
         serviceHubInstance,
         (core: LiveSyncBaseCore<NodeServiceContext, never>, serviceHub: InjectableServiceHub<NodeServiceContext>) => {
-            return initialiseServiceModulesCLI(vaultPath, core, serviceHub, ignoreRules, watchEnabled);
+            return initialiseServiceModulesCLI(
+                vaultPath,
+                core,
+                serviceHub,
+                ignoreRules,
+                vaultSyncMode?.watchFiles ?? false
+            );
         },
         (core) => [],
         () => [], // No add-ons
         (core, coreFeatureViews) => {
             replicationScheduling = coreFeatureViews.replicationScheduling;
+            if (vaultSyncMode) {
+                useOfflineScanner(core);
+            }
             // Register P2P replicator feature.
-            p2pReplicator = useP2PReplicatorFeature(core);
+            p2pReplicator = useP2PReplicatorFeature(core, undefined, undefined, {
+                prepareP2PSettings: useP2PSettingsPreparation(core.services.API.webCompatFetch.bind(core.services.API)),
+            });
             // Add target filter to prevent internal files are handled
             core.services.vault.isTargetFile.addHandler(async (target) => {
                 const targetPath = stripAllPrefixes(getPathFromUXFileInfo(target));
@@ -512,7 +543,7 @@ export async function main(
                 return await Promise.resolve(true);
             }, -1 /* highest priority */);
 
-            // Apply user-defined ignore rules for daemon mode (lower priority, runs after dotfile check).
+            // Apply user-defined ignore rules after the dotfile check.
             if (ignoreRules) {
                 const rules = ignoreRules;
                 core.services.vault.isTargetFile.addHandler(async (target) => {
@@ -524,7 +555,8 @@ export async function main(
                     return true;
                 }, 0);
             }
-        }
+        },
+        vaultSyncMode?.startupDatabaseOptions
     );
     if (!replicationScheduling) {
         throw new Error("Replication scheduling was not provided during core feature composition.");
@@ -577,7 +609,7 @@ export async function main(
             : originalSettingsText;
 
         // Capture sync settings before suspendAllSync() clobbers them.
-        // Used by daemon mode to restore the correct sync behaviour after the mirror scan.
+        // Used by daemon mode to restore sync behaviour after initial replication.
         const settingsBeforeSuspend = cloneSettings(core.services.setting.currentSettings());
         const durableSettingsBeforeSuspend = cloneSettings(settingsBeforeSuspend);
         applyStoredSetting(durableSettingsBeforeSuspend, settingsAfterLoadText, "useIndexedDBAdapter");
@@ -592,7 +624,15 @@ export async function main(
         };
         await core.services.setting.suspendAllSync();
         const settingsAfterSuspend = cloneSettings(core.services.setting.currentSettings());
-        await core.services.control.onReady();
+        let readyResult = false;
+        try {
+            readyResult = await core.services.control.onReady();
+        } finally {
+            if (!readyResult) await core.services.control.onUnload();
+        }
+        if (!readyResult) {
+            throw new Error("Failed to initialise LiveSync.");
+        }
         const settingsBeforeCommand = cloneSettings(core.services.setting.currentSettings());
         const transientSettingKeys = changedSettingKeys(settingsBeforeSuspend, settingsAfterSuspend);
         for (const key of CLI_RUNTIME_ONLY_SETTING_KEYS) {

src/apps/cli/package.json

@@ -1,7 +1,7 @@
 {
     "name": "self-hosted-livesync-cli",
     "private": true,
-    "version": "1.0.28-cli",
+    "version": "1.0.29-cli",
     "main": "dist/index.cjs",
     "type": "module",
     "scripts": {
@@ -12,7 +12,7 @@
         "buildRun": "npm run build && npm run cli --",
         "build:docker": "docker build -f Dockerfile -t livesync-cli ../../..",
         "check": "tsc -p tsconfig.json",
-        "test:unit": "cd ../../.. && npx vitest run --config vitest.config.unit.ts src/apps/cli/main.unit.spec.ts src/apps/cli/settingsPersistence.unit.spec.ts src/apps/cli/commands/utils.unit.spec.ts src/apps/cli/commands/runCommand.unit.spec.ts src/apps/cli/commands/p2p.unit.spec.ts src/apps/cli/deploy/install.unit.spec.ts",
+        "test:unit": "cd ../../.. && npx vitest run --config vitest.config.unit.ts src/apps/cli/main.unit.spec.ts src/apps/cli/main.bootstrap.unit.spec.ts src/apps/cli/settingsPersistence.unit.spec.ts src/apps/cli/commands/utils.unit.spec.ts src/apps/cli/commands/runCommand.unit.spec.ts src/apps/cli/commands/daemonCommand.unit.spec.ts src/apps/cli/commands/p2p.unit.spec.ts src/apps/cli/deploy/install.unit.spec.ts src/apps/cli/adapters/NodeFileSystemAdapter.unit.spec.ts",
         "test:e2e:two-vaults": "bash test/test-e2e-two-vaults-with-docker-linux.sh",
         "test:e2e:two-vaults:common": "bash test/test-e2e-two-vaults-common.sh",
         "test:e2e:two-vaults:matrix": "bash test/test-e2e-two-vaults-matrix.sh",

src/apps/cli/test/test-helpers.sh

@@ -307,10 +307,19 @@ cli_test_wait_for_minio_bucket() {
     local delay_sec=2
     local i
     for ((i = 1; i <= retries; i++)); do
-        if docker run --rm --network host --entrypoint=/bin/sh minio/mc -c "mc alias set myminio $minio_endpoint $minio_access_key $minio_secret_key >/dev/null 2>&1 && mc ls myminio/$minio_bucket >/dev/null 2>&1"; then
+        if docker run --rm --network host --entrypoint=/bin/sh \
+            rustfs/rc:v0.1.35@sha256:adb45b56539006120f1d790bcc17ee5f9b4d93c1d7e71ed0a24f10267f9d6914 \
+            -c 'set -e
+rc alias set myminio "$1" "$2" "$3" >/dev/null 2>&1
+rc ls "myminio/$4" >/dev/null 2>&1
+' sh "$minio_endpoint" "$minio_access_key" "$minio_secret_key" "$minio_bucket"; then
             return 0
         fi
-        bucketName="$minio_bucket" bash "$CLI_DIR/util/minio-init.sh" >/dev/null 2>&1 || true
+        minioEndpoint="$minio_endpoint" \
+        accessKey="$minio_access_key" \
+        secretKey="$minio_secret_key" \
+        bucketName="$minio_bucket" \
+        bash "$CLI_DIR/util/minio-init.sh" >/dev/null 2>&1 || true
         sleep "$delay_sec"
     done
     return 1
@@ -323,26 +332,34 @@ cli_test_start_minio() {
     local minio_bucket="$4"
     local minio_init_ok=0
 
-    echo "[INFO] stopping leftover MinIO container if present"
+    echo "[INFO] stopping leftover RustFS container if present"
     cli_test_stop_minio
 
-    echo "[INFO] starting MinIO test container"
-    bucketName="$minio_bucket" bash "$CLI_DIR/util/minio-start.sh"
+    echo "[INFO] starting RustFS test container"
+    minioEndpoint="$minio_endpoint" \
+    accessKey="$minio_access_key" \
+    secretKey="$minio_secret_key" \
+    bucketName="$minio_bucket" \
+    bash "$CLI_DIR/util/minio-start.sh"
 
-    echo "[INFO] initialising MinIO test bucket: $minio_bucket"
+    echo "[INFO] initialising RustFS test bucket: $minio_bucket"
     for _ in 1 2 3 4 5; do
-        if bucketName="$minio_bucket" bash "$CLI_DIR/util/minio-init.sh"; then
+        if minioEndpoint="$minio_endpoint" \
+            accessKey="$minio_access_key" \
+            secretKey="$minio_secret_key" \
+            bucketName="$minio_bucket" \
+            bash "$CLI_DIR/util/minio-init.sh"; then
             minio_init_ok=1
             break
         fi
         sleep 2
     done
     if [[ "$minio_init_ok" != "1" ]]; then
-        echo "[FAIL] could not initialise MinIO bucket after retries: $minio_bucket" >&2
+        echo "[FAIL] could not initialise RustFS bucket after retries: $minio_bucket" >&2
         exit 1
     fi
     if ! cli_test_wait_for_minio_bucket "$minio_endpoint" "$minio_access_key" "$minio_secret_key" "$minio_bucket"; then
-        echo "[FAIL] MinIO bucket not ready: $minio_bucket" >&2
+        echo "[FAIL] RustFS bucket not ready: $minio_bucket" >&2
         exit 1
     fi
 }
@@ -359,4 +376,4 @@ display_test_info(){
 if [[ "${LIVESYNC_TEST_DOCKER:-0}" == "1" ]]; then
     # shellcheck source=/dev/null
     source "$(dirname "${BASH_SOURCE[0]}")/test-helpers-docker.sh"
-fi
+fi

src/apps/cli/testdeno/deno.json

@@ -5,6 +5,7 @@
         "test:p2p:compose": "deno run -A --no-check run-compose-p2p.ts",
         "test:local": "deno test --env-file=.test.env -A --no-check test-setup-put-cat.ts test-mirror.ts test-daemon.ts",
         "test:daemon": "deno test --env-file=.test.env -A --no-check test-daemon.ts",
+        "test:daemon-startup": "deno test --env-file=.test.env -A --no-check test-daemon-startup.ts",
         "test:decoupled-vault": "deno test --env-file=.test.env -A --no-check test-decoupled-vault.ts",
         "test:remote-commands": "deno test --env-file=.test.env -A --no-check test-remote-commands.ts",
         "test:settings-writeback": "deno test -A --no-check test-settings-writeback.ts",

src/apps/cli/testdeno/helpers/docker.ts

@@ -190,7 +190,7 @@ async function dockerOrFail(...args: string[]): Promise<string> {
 
 async function stopAndRemoveContainer(container: string): Promise<void> {
     await docker("stop", container).catch(() => {});
-    await docker("rm", container).catch(() => {});
+    await docker("rm", "-v", container).catch(() => {});
 }
 
 async function cleanupTrackedContainers(reason: string): Promise<void> {
@@ -327,8 +327,22 @@ const COUCHDB_CONTAINER = "couchdb-test";
 const COUCHDB_IMAGE = "couchdb:3.5.0";
 
 const MINIO_CONTAINER = "minio-test";
-const MINIO_IMAGE = "minio/minio";
-const MINIO_MC_IMAGE = "minio/mc";
+// RustFS provides the S3 backend for the existing MINIO test mode.
+const S3_IMAGE = "rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035";
+const S3_CLIENT_IMAGE = "rustfs/rc:v0.1.35@sha256:adb45b56539006120f1d790bcc17ee5f9b4d93c1d7e71ed0a24f10267f9d6914";
+const S3_BUCKET_CORS = `<CORSConfiguration>
+  <CORSRule>
+    <AllowedOrigin>*</AllowedOrigin>
+    <AllowedMethod>GET</AllowedMethod>
+    <AllowedMethod>PUT</AllowedMethod>
+    <AllowedMethod>POST</AllowedMethod>
+    <AllowedMethod>DELETE</AllowedMethod>
+    <AllowedMethod>HEAD</AllowedMethod>
+    <AllowedHeader>*</AllowedHeader>
+    <AllowedHeader>authorization</AllowedHeader>
+    <ExposeHeader>ETag</ExposeHeader>
+  </CORSRule>
+</CORSConfiguration>`;
 
 export async function stopCouchdb(): Promise<void> {
     await stopAndRemoveContainer(COUCHDB_CONTAINER);
@@ -454,7 +468,7 @@ export async function updateCouchdbDoc(
 }
 
 // ---------------------------------------------------------------------------
-// MinIO
+// S3 (RustFS)
 // ---------------------------------------------------------------------------
 
 function shQuote(value: string): string {
@@ -473,9 +487,10 @@ async function initMinioBucket(
     bucket: string
 ): Promise<boolean> {
     const cmd =
-        `mc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
-        `mc mb --ignore-existing myminio/${shQuote(bucket)} >/dev/null 2>&1`;
-    const r = await docker("run", "--rm", "--network", "host", "--entrypoint", "/bin/sh", MINIO_MC_IMAGE, "-c", cmd);
+        `rc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
+        `rc mb --ignore-existing myminio/${shQuote(bucket)} >/dev/null 2>&1 && ` +
+        `printf %s ${shQuote(S3_BUCKET_CORS)} | rc cors set myminio/${shQuote(bucket)} - >/dev/null 2>&1`;
+    const r = await docker("run", "--rm", "--network", "host", "--entrypoint", "/bin/sh", S3_CLIENT_IMAGE, "-c", cmd);
     return r.code === 0;
 }
 
@@ -487,8 +502,8 @@ async function waitForMinioBucket(
 ): Promise<void> {
     for (let i = 0; i < 30; i++) {
         const checkCmd =
-            `mc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
-            `mc ls myminio/${shQuote(bucket)} >/dev/null 2>&1`;
+            `rc alias set myminio ${shQuote(minioEndpoint)} ${shQuote(accessKey)} ${shQuote(secretKey)} >/dev/null 2>&1 && ` +
+            `rc ls myminio/${shQuote(bucket)} >/dev/null 2>&1`;
         const check = await docker(
             "run",
             "--rm",
@@ -498,7 +513,7 @@ async function waitForMinioBucket(
             "host",
             "--entrypoint",
             "/bin/sh",
-            MINIO_MC_IMAGE,
+            S3_CLIENT_IMAGE,
             "-c",
             checkCmd
         );
@@ -508,7 +523,7 @@ async function waitForMinioBucket(
         await initMinioBucket(minioEndpoint, accessKey, secretKey, bucket);
         await sleep(2000);
     }
-    throw new Error(`MinIO bucket not ready: ${bucket}`);
+    throw new Error(`S3 bucket not ready: ${bucket}`);
 }
 
 export async function startMinio(
@@ -517,10 +532,10 @@ export async function startMinio(
     secretKey: string,
     bucket: string
 ): Promise<void> {
-    console.log("[INFO] stopping leftover MinIO container if present");
+    console.log("[INFO] stopping leftover S3 test container if present");
     await stopMinio().catch(() => {});
 
-    console.log("[INFO] starting MinIO test container");
+    console.log("[INFO] starting RustFS test container");
     await dockerOrFail(
         "run",
         "-d",
@@ -532,20 +547,19 @@ export async function startMinio(
         "-p",
         "9001:9001",
         "-e",
-        `MINIO_ROOT_USER=${accessKey}`,
+        `RUSTFS_ACCESS_KEY=${accessKey}`,
         "-e",
-        `MINIO_ROOT_PASSWORD=${secretKey}`,
+        `RUSTFS_SECRET_KEY=${secretKey}`,
         "-e",
-        `MINIO_SERVER_URL=${minioEndpoint}`,
-        MINIO_IMAGE,
-        "server",
-        "/data",
-        "--console-address",
-        ":9001"
+        "RUSTFS_CONSOLE_ENABLE=true",
+        "-e",
+        "RUSTFS_CORS_ALLOWED_ORIGINS=*",
+        S3_IMAGE,
+        "/data"
     );
     trackContainer(MINIO_CONTAINER);
 
-    console.log(`[INFO] initialising MinIO test bucket: ${bucket}`);
+    console.log(`[INFO] initialising S3 test bucket: ${bucket}`);
     let initialised = false;
     for (let i = 0; i < 5; i++) {
         if (await initMinioBucket(minioEndpoint, accessKey, secretKey, bucket)) {
@@ -555,7 +569,7 @@ export async function startMinio(
         await sleep(2000);
     }
     if (!initialised) {
-        throw new Error(`Could not initialise MinIO bucket after retries: ${bucket}`);
+        throw new Error(`Could not initialise S3 bucket after retries: ${bucket}`);
     }
 
     await waitForMinioBucket(minioEndpoint, accessKey, secretKey, bucket);

src/apps/cli/testdeno/run-ci-suite.ts

@@ -4,6 +4,7 @@ const TASKS = [
     "test:setup-put-cat",
     "test:mirror",
     "test:daemon",
+    "test:daemon-startup",
     "test:push-pull",
     "test:decoupled-vault",
     "test:sync-two-local",

src/apps/cli/testdeno/test-daemon-startup.ts

@@ -0,0 +1,152 @@
+import { assertEquals } from "@std/assert";
+import { join } from "@std/path";
+import { TempDir } from "./helpers/temp.ts";
+import { runCliOrFail, runCliWithInputOrFail } from "./helpers/cli.ts";
+import { applyCouchdbSettings, initSettingsFile } from "./helpers/settings.ts";
+import { startCliInBackground, type BackgroundCliProcess } from "./helpers/backgroundCli.ts";
+import { startCouchdb, stopCouchdb } from "./helpers/docker.ts";
+
+function envOrDefault(keys: string[], fallback: string): string {
+    for (const key of keys) {
+        const value = Deno.env.get(key)?.trim();
+        if (value) return value;
+    }
+    return fallback;
+}
+
+function waitForTick(): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, 100));
+}
+
+async function waitForText(filePath: string, expected: string, timeoutMs = 45_000): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    let actual = "";
+    while (Date.now() < deadline) {
+        try {
+            actual = await Deno.readTextFile(filePath);
+            if (actual === expected) return;
+        } catch (error) {
+            if (!(error instanceof Deno.errors.NotFound)) throw error;
+        }
+        await waitForTick();
+    }
+    throw new Error(
+        `Timed out waiting for ${filePath} to contain ${JSON.stringify(expected)}; actual=${JSON.stringify(actual)}`
+    );
+}
+
+async function waitForMissing(filePath: string, timeoutMs = 45_000): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            await Deno.stat(filePath);
+        } catch (error) {
+            if (error instanceof Deno.errors.NotFound) return;
+            throw error;
+        }
+        await waitForTick();
+    }
+    throw new Error(`Timed out waiting for ${filePath} to be removed`);
+}
+
+async function stopDaemon(daemon: BackgroundCliProcess | undefined): Promise<void> {
+    if (!daemon) return;
+    await daemon.stop().catch(() => {});
+}
+
+Deno.test("daemon: startup scan uploads, reconciles, and reflects CouchDB files", async () => {
+    await using workDir = await TempDir.create("livesync-cli-daemon-startup");
+
+    const couchdbUri = envOrDefault(["COUCHDB_URI", "hostname"], "http://127.0.0.1:5989").replace(/\/$/, "");
+    const couchdbUser = envOrDefault(["COUCHDB_USER", "username"], "admin");
+    const couchdbPassword = envOrDefault(["COUCHDB_PASSWORD", "password"], "testpassword");
+    const dbPrefix = envOrDefault(["COUCHDB_DBNAME", "dbname"], "livesync-test-db-ci");
+    const dbname = `${dbPrefix}-daemon-startup-${Date.now()}-${Math.floor(Math.random() * 1_000_000)}`.toLowerCase();
+
+    const databaseA = workDir.join("database-a");
+    const databaseB = workDir.join("database-b");
+    const databaseC = workDir.join("database-c");
+    const vaultA = workDir.join("vault-a");
+    const vaultB = workDir.join("vault-b");
+    const vaultC = workDir.join("vault-c");
+    const settingsA = workDir.join("settings-a.json");
+    const settingsB = workDir.join("settings-b.json");
+    const settingsC = workDir.join("settings-c.json");
+
+    await Promise.all([
+        Deno.mkdir(databaseA, { recursive: true }),
+        Deno.mkdir(databaseB, { recursive: true }),
+        Deno.mkdir(databaseC, { recursive: true }),
+        Deno.mkdir(vaultA, { recursive: true }),
+        Deno.mkdir(vaultB, { recursive: true }),
+        Deno.mkdir(vaultC, { recursive: true }),
+    ]);
+
+    const startupPath = "notes/present-before-start.md";
+    const deletePath = "notes/deleted-while-stopped.md";
+    const remoteOnlyPath = "notes/remote-only.md";
+    const startupFileA = join(vaultA, startupPath);
+    const deleteFileA = join(vaultA, deletePath);
+    const startupFileB = join(vaultB, startupPath);
+    const deleteFileB = join(vaultB, deletePath);
+    const remoteOnlyFileB = join(vaultB, remoteOnlyPath);
+
+    await Deno.mkdir(join(vaultA, "notes"), { recursive: true });
+    await Deno.writeTextFile(startupFileA, "created before daemon startup\n");
+    const initialTime = new Date(Date.now() - 10_000);
+    await Deno.utime(startupFileA, initialTime, initialTime);
+    await Deno.writeTextFile(deleteFileA, "delete this after the first run\n");
+
+    let daemonA: BackgroundCliProcess | undefined;
+    let daemonB: BackgroundCliProcess | undefined;
+    try {
+        await startCouchdb(couchdbUri, couchdbUser, couchdbPassword, dbname);
+        for (const settings of [settingsA, settingsB, settingsC]) {
+            await initSettingsFile(settings);
+            await applyCouchdbSettings(settings, couchdbUri, couchdbUser, couchdbPassword, dbname, true);
+        }
+
+        // A pre-existing local file must be uploaded by the daemon's startup scan.
+        daemonA = startCliInBackground(databaseA, "--vault", vaultA, "--settings", settingsA, "daemon");
+        await daemonA.waitUntilContains("[Daemon] Initial replication complete", 45_000);
+
+        // A separate daemon proves that the first startup replication reached CouchDB
+        // and that remote files are reflected into its filesystem.
+        daemonB = startCliInBackground(databaseB, "--vault", vaultB, "--settings", settingsB, "daemon");
+        await daemonB.waitUntilContains("[Daemon] Initial replication complete", 45_000);
+        await waitForText(startupFileB, "created before daemon startup\n");
+        await waitForText(deleteFileB, "delete this after the first run\n");
+
+        // Changes made while A is stopped must be found by its next startup scan.
+        assertEquals(await daemonA.stop(), 0, daemonA.combined);
+        daemonA = undefined;
+        await Deno.writeTextFile(startupFileA, "edited while daemon was stopped\n");
+        await Deno.remove(deleteFileA);
+
+        daemonA = startCliInBackground(databaseA, "--vault", vaultA, "--settings", settingsA, "daemon");
+        await daemonA.waitUntilContains("[Daemon] Initial replication complete", 45_000);
+        await waitForText(startupFileB, "edited while daemon was stopped\n");
+        await waitForMissing(deleteFileB);
+
+        // Seed a file into a third local database without creating it in vault C.
+        // After C's finite sync, it exists only remotely from B's point of view.
+        await runCliWithInputOrFail(
+            "created in a different local database\n",
+            databaseC,
+            "--vault",
+            vaultC,
+            "--settings",
+            settingsC,
+            "put",
+            remoteOnlyPath
+        );
+        await runCliOrFail(databaseC, "--vault", vaultC, "--settings", settingsC, "sync");
+        await waitForText(remoteOnlyFileB, "created in a different local database\n");
+        assertEquals(await Deno.readTextFile(startupFileB), "edited while daemon was stopped\n");
+        assertEquals((await Deno.stat(remoteOnlyFileB)).isFile, true);
+    } finally {
+        await stopDaemon(daemonB);
+        await stopDaemon(daemonA);
+        await stopCouchdb().catch(() => {});
+    }
+});

src/apps/cli/testdeno/test-e2e-two-vaults-couchdb.ts

@@ -60,6 +60,32 @@ export async function runScenario(remoteType: RemoteType, encrypt: boolean): Pro
     }
 
     try {
+        if (remoteType === "MINIO") {
+            // The shared S3 fixture also serves the browser and real Obsidian tests.
+            const origin = "app://obsidian.md";
+            const requestedHeaders = ["authorization", "content-type", "x-amz-date", "x-amz-content-sha256"];
+            const preflight = await fetch(`${minioEndpoint}/${minioBucket}`, {
+                method: "OPTIONS",
+                headers: {
+                    Origin: origin,
+                    "Access-Control-Request-Method": "PUT",
+                    "Access-Control-Request-Headers": requestedHeaders.join(","),
+                },
+            });
+            await preflight.body?.cancel();
+            assert(preflight.ok, "The S3 fixture must accept browser preflight requests");
+            const allowedOrigin = preflight.headers.get("access-control-allow-origin");
+            assert(allowedOrigin === "*" || allowedOrigin === origin, "The S3 fixture must allow the Obsidian origin");
+            const allowedHeaders = (preflight.headers.get("access-control-allow-headers") ?? "")
+                .toLowerCase()
+                .split(",")
+                .map((header) => header.trim());
+            assert(allowedHeaders.includes("authorization"), "S3 CORS must explicitly allow the Authorization header");
+            assert(
+                preflight.headers.get("access-control-allow-methods")?.split(/,\s*/).includes("PUT"),
+                "S3 CORS must allow browser uploads"
+            );
+        }
         await initSettingsFile(settingsA);
         await initSettingsFile(settingsB);
         await applyRemoteSyncSettings(settingsA, {

src/apps/cli/testdeno/test_dev_deno.md

@@ -99,11 +99,12 @@ This file corresponds to settings helpers in `test-helpers.sh`.
 
 ### `helpers/docker.ts`
 
-- Starts, stops, and initialises CouchDB directly from Deno.
+- Starts, stops, and initialises CouchDB and RustFS directly from Deno.
 - Configures CouchDB via `fetch + retry`.
+- Initialises S3 buckets using the RustFS `rc` client, including CORS for signed browser requests.
 - Starts and stops the P2P relay through the same Docker runner.
 
-Both CouchDB and P2P relay flows are bash-independent.
+These flows do not require Bash on the host. The S3 matrix tasks, environment variables, and container name retain their existing `minio` names for compatibility; RustFS provides the test backend. The RustFS server and `rc` client images are pinned by version and digest.
 
 ### `helpers/backgroundCli.ts`
 
@@ -328,7 +329,7 @@ The GitHub Actions workflow `.github/workflows/cli-deno-tests.yml` runs automati
 
 ## Current limitations
 
-- MinIO startup and matrix coverage are ported. Current limits are elsewhere, not setup URI generation.
+- S3 startup and matrix coverage use RustFS. Current limits are elsewhere, not setup URI generation.
 
 ---
 

src/apps/cli/util/minio-init.sh

@@ -1,47 +1,24 @@
 #!/bin/bash
 set -e
-cat >/tmp/mybucket-rw.json <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": ["s3:GetBucketLocation","s3:ListBucket"],
-      "Resource": ["arn:aws:s3:::$bucketName"]
-    },
-    {
-      "Effect": "Allow",
-      "Action": ["s3:GetObject","s3:PutObject","s3:DeleteObject"],
-      "Resource": ["arn:aws:s3:::$bucketName/*"]
-    }
-  ]
-}
-EOF
-# echo "<CORSConfiguration>
-#   <CORSRule>
-#     <AllowedOrigin>http://localhost:63315</AllowedOrigin>
-#     <AllowedOrigin>http://localhost:63316</AllowedOrigin>
-#     <AllowedOrigin>http://localhost</AllowedOrigin>
-#     <AllowedMethod>GET</AllowedMethod>
-#     <AllowedMethod>PUT</AllowedMethod>
-#     <AllowedMethod>POST</AllowedMethod>
-#     <AllowedMethod>DELETE</AllowedMethod>
-#     <AllowedMethod>HEAD</AllowedMethod>
-#     <AllowedHeader>*</AllowedHeader>
-#   </CORSRule>
-# </CORSConfiguration>" > /tmp/cors.xml
-# docker run --rm --network host -v /tmp/mybucket-rw.json:/tmp/mybucket-rw.json --entrypoint=/bin/sh minio/mc -c "
-#   mc alias set myminio $minioEndpoint $username $password 
-#   mc mb --ignore-existing myminio/$bucketName
-#   mc admin policy create myminio my-custom-policy /tmp/mybucket-rw.json 
-#   echo 'Creating service account for user $username with access key $accessKey'
-#   mc admin user svcacct add --access-key '$accessKey' --secret-key '$secretKey' myminio '$username' 
-#   mc admin policy attach myminio my-custom-policy --user '$accessKey'
-#   echo 'Verifying policy and user creation:'
-#   mc admin user svcacct info myminio '$accessKey'
-# "
 
-docker run --rm --network host -v /tmp/mybucket-rw.json:/tmp/mybucket-rw.json --entrypoint=/bin/sh minio/mc -c "
-  mc alias set myminio $minioEndpoint $accessKey $secretKey 
-  mc mb --ignore-existing myminio/$bucketName
-"
+docker run --rm --network host --entrypoint=/bin/sh \
+  rustfs/rc:v0.1.35@sha256:adb45b56539006120f1d790bcc17ee5f9b4d93c1d7e71ed0a24f10267f9d6914 \
+  -c 'set -e
+rc alias set myminio "$1" "$2" "$3"
+rc mb --ignore-existing "myminio/$4"
+rc cors set "myminio/$4" - <<CORS
+<CORSConfiguration>
+  <CORSRule>
+    <AllowedOrigin>*</AllowedOrigin>
+    <AllowedMethod>GET</AllowedMethod>
+    <AllowedMethod>PUT</AllowedMethod>
+    <AllowedMethod>POST</AllowedMethod>
+    <AllowedMethod>DELETE</AllowedMethod>
+    <AllowedMethod>HEAD</AllowedMethod>
+    <AllowedHeader>*</AllowedHeader>
+    <AllowedHeader>authorization</AllowedHeader>
+    <ExposeHeader>ETag</ExposeHeader>
+  </CORSRule>
+</CORSConfiguration>
+CORS
+' sh "$minioEndpoint" "$accessKey" "$secretKey" "$bucketName"

src/apps/cli/util/minio-start.sh

@@ -1,2 +1,8 @@
 #!/bin/bash
-docker run -d --name minio-test -p 9000:9000 -p 9001:9001 -e MINIO_ROOT_USER=$accessKey -e MINIO_ROOT_PASSWORD=$secretKey -e MINIO_SERVER_URL=$minioEndpoint minio/minio server /data --console-address ':9001'
+docker run -d --name minio-test \
+  -p 9000:9000 -p 9001:9001 \
+  -e "RUSTFS_ACCESS_KEY=$accessKey" \
+  -e "RUSTFS_SECRET_KEY=$secretKey" \
+  -e "RUSTFS_CONSOLE_ENABLE=true" \
+  -e 'RUSTFS_CORS_ALLOWED_ORIGINS=*' \
+  rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035 /data

src/apps/cli/util/minio-stop.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
 docker stop minio-test
-docker rm minio-test
+docker rm -v minio-test

src/apps/webapp/WebAppRuntime.ts

@@ -1,3 +1,4 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 /** Browser runtime for Self-hosted LiveSync over the File System Access API. */
 
 import { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
@@ -217,7 +218,9 @@ export class WebAppRuntime {
                 useRedFlagFeatures(core);
                 useCheckRemoteSize(core);
                 useRemoteConfiguration(core);
-                this.p2p = useP2PReplicatorFeature(core);
+                this.p2p = useP2PReplicatorFeature(core, undefined, undefined, {
+                    prepareP2PSettings: useP2PSettingsPreparation(core.services.API.webCompatFetch.bind(core.services.API)),
+                });
                 this.paneHost = {
                     services: core.services,
                     p2p: this.p2p,

src/apps/webapp/package.json

@@ -1,7 +1,7 @@
 {
     "name": "livesync-webapp",
     "private": true,
-    "version": "1.0.28-webapp",
+    "version": "1.0.29-webapp",
     "type": "module",
     "description": "Browser-based Self-hosted LiveSync using FileSystem API",
     "scripts": {

src/apps/webpeer/package.json

@@ -1,7 +1,7 @@
 {
     "name": "webpeer",
     "private": true,
-    "version": "1.0.28-webpeer",
+    "version": "1.0.29-webpeer",
     "type": "module",
     "scripts": {
         "dev": "vite",

src/apps/webpeer/src/WebPeerRuntime.ts

@@ -1,3 +1,4 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 import { type P2PSyncSetting, SETTING_KEY_P2P_DEVICE_NAME } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import { compatGlobal } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions";
 import { EVENT_LAYOUT_READY } from "@vrtmrz/livesync-commonlib/compat/events/coreEvents";
@@ -70,9 +71,8 @@ export class WebPeerRuntime {
                 isScheduled: () => this.restartScheduled,
             },
         });
-        this.p2p = useP2PReplicatorFeature({
-            services: this.services,
-            serviceModules: {},
+        this.p2p = useP2PReplicatorFeature({ services: this.services, serviceModules: {} }, undefined, undefined, {
+            prepareP2PSettings: useP2PSettingsPreparation(this.services.API.webCompatFetch.bind(this.services.API)),
         });
         this.p2pLogCollector = new P2PLogCollector(this.events);
         this.paneHost = {

src/common/messages/LiveSyncProvisionalMessages.ts

@@ -7,6 +7,26 @@
  * remove it from this map in the same change.
  */
 export const liveSyncProvisionalEnglishMessages = {
+    "Configure TURN when a direct connection cannot be established or when you select TURN relay only.":
+        "Configure TURN when a direct connection cannot be established or when you select TURN relay only.",
+    "TURN configuration": "TURN configuration",
+    Manual: "Manual",
+    "Managed (Cloudflare)": "Managed (Cloudflare)",
+    "TURN Key ID": "TURN Key ID",
+    "TURN Key API Token": "TURN Key API Token",
+    "Unsupported TURN configuration": "Unsupported TURN configuration",
+    "The API token is saved with this profile and included in Setup URI and QR code sharing. Temporary TURN credentials are kept in memory only.":
+        "The API token is saved with this profile and included in Setup URI and QR code sharing. Temporary TURN credentials are kept in memory only.",
+    "TURN relay only requires a TURN server or a configured credential source under Advanced Settings.":
+        "TURN relay only requires a TURN server or a configured credential source under Advanced Settings.",
+    "TURN relay only requires TURN configuration. Connection path has been restored to Automatic.":
+        "TURN relay only requires TURN configuration. Connection path has been restored to Automatic.",
+    "Enter a TURN Key ID.": "Enter a TURN Key ID.",
+    "TURN Key ID contains unsupported characters.": "TURN Key ID contains unsupported characters.",
+    "Enter a TURN Key API Token.": "Enter a TURN Key API Token.",
+    "TURN Key API Token must use Bearer token syntax.": "TURN Key API Token must use Bearer token syntax.",
+    "The selected TURN configuration is not supported.": "The selected TURN configuration is not supported.",
+
     "Setup Complete: Preparing to Fetch from Another Device": "Setup Complete: Preparing to Fetch from Another Device",
     "The P2P connection has been configured successfully. The initial synchronisation data must now be fetched from an online source device.":
         "The P2P connection has been configured successfully. The initial synchronisation data must now be fetched from an online source device.",
@@ -28,8 +48,8 @@ export const liveSyncProvisionalEnglishMessages = {
         "The project's public signalling relay is a best-effort convenience operated by the project author. It does not store Vault contents, but signalling metadata may be visible to the relay. Availability and log retention are not guaranteed. You can replace it with your own Nostr-compatible relay.",
     "Learn more about P2P connections": "Learn more about P2P connections",
     "Learn more about signalling and TURN": "Learn more about signalling and TURN",
-    "TURN relays the encrypted WebRTC connection only when a direct path cannot be established. A TURN provider cannot read encrypted Vault contents, but it can observe connection metadata and traffic volume. Use a provider you trust.":
-        "TURN relays the encrypted WebRTC connection only when a direct path cannot be established. A TURN provider cannot read encrypted Vault contents, but it can observe connection metadata and traffic volume. Use a provider you trust.",
+    "WebRTC encrypts data between your devices, including when it passes through TURN. The TURN provider cannot read the transferred data. It can see network addresses and traffic volume.":
+        "WebRTC encrypts data between your devices, including when it passes through TURN. The TURN provider cannot read the transferred data. It can see network addresses and traffic volume.",
     "Connection compatibility": "Connection compatibility",
     "P2P message size": "P2P message size",
     Standard: "Standard",

src/common/reportTool.ts

@@ -1,3 +1,4 @@
+import { redactTurnSettingsForReport } from "./turnSettingsPrivacy";
 import { REMOTE_COUCHDB, REMOTE_MINIO } from "@vrtmrz/livesync-commonlib/compat/common/models/setting.const";
 import { DEFAULT_SETTINGS, type ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/settings";
 import { generateCredentialObject } from "@vrtmrz/livesync-commonlib/compat/replication/httplib";
@@ -67,6 +68,7 @@ export async function generateReport(settings: ObsidianLiveSyncSettings, core: L
         delete pluginConfig[key as keyof ObsidianLiveSyncSettings];
     }
 
+    redactTurnSettingsForReport(pluginConfig);
     pluginConfig.couchDB_DBNAME = REDACTED;
     pluginConfig.couchDB_PASSWORD = REDACTED;
     const scheme = pluginConfig.couchDB_URI.startsWith("http:")

src/common/reportTool.unit.spec.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it, vi } from "vitest";
+import { DEFAULT_SETTINGS } from "@vrtmrz/livesync-commonlib/settings";
+import { REMOTE_P2P } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import type { LiveSyncBaseCore } from "@/LiveSyncBaseCore";
+import { generateReport } from "./reportTool";
+
+vi.mock("./utils", () => ({ requestToCouchDBWithCredentials: vi.fn() }));
+vi.mock("@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions", () => ({
+    compatGlobal: { origin: "test", navigator: { userAgent: "test" } },
+}));
+
+describe("TURN credentials in diagnostic reports", () => {
+    it("redacts provider tokens in all profiles and runtime credentials", async () => {
+        const token = "private+token/with=symbols";
+        const provider = { P2P_managedType: "CF", P2P_managedId: "private-key", P2P_managedToken: token };
+        const settings = {
+            ...DEFAULT_SETTINGS,
+            remoteType: REMOTE_P2P,
+            ...provider,
+            P2P_iceServers: [{ urls: "turn:example.test", username: "issued-user", credential: "issued-password" }],
+            P2P_iceServersExpiresAt: 123456789,
+            remoteConfigurations: {
+                inactive: {
+                    id: "inactive",
+                    name: "Inactive TURN",
+                    isEncrypted: false,
+                    uri: `sls+p2p://room?managedType=CF&managedId=private-key&token=${encodeURIComponent(token)}`,
+                },
+            },
+        };
+        const core = { services: { vault: { isStorageInsensitive: () => false } } } as unknown as LiveSyncBaseCore;
+        const report = await generateReport(settings, core);
+        const text = JSON.stringify(report);
+        expect(text).not.toContain(token);
+        expect(text).not.toContain(encodeURIComponent(token));
+        expect(text).not.toContain("private-key");
+        expect(report.pluginConfig.remoteConfigurations.inactive.uri).toBe("sls+p2p://");
+        expect(settings.P2P_managedToken).toBe(token);
+        expect(text).not.toMatch(/issued-user|issued-password|P2P_iceServers/);
+    });
+});

src/common/turnSettingsPrivacy.ts

@@ -0,0 +1,63 @@
+import {
+    hasManagedP2PTurnConfiguration,
+    type ObsidianLiveSyncSettings,
+} from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { pickP2PSyncSettings } from "@vrtmrz/livesync-commonlib/compat/common/utils";
+import { CLOUDFLARE_TURN_TYPE } from "@/integrations/cloudflare/settings";
+
+/** Include inactive profiles when deciding whether Markdown would disclose provider settings. */
+export function hasManagedTurnSettings(settings: Partial<ObsidianLiveSyncSettings>): boolean {
+    return (
+        hasManagedP2PTurnConfiguration(settings) ||
+        Object.values(settings.remoteConfigurations ?? {}).some(({ uri }) => {
+            if (!uri.startsWith("sls+p2p://")) return false;
+            const queryStart = uri.indexOf("?");
+            return (
+                queryStart >= 0 && new URLSearchParams(uri.slice(queryStart + 1).split("#", 1)[0]).has("managedType")
+            );
+        })
+    );
+}
+
+/** Reports retain a recognised provider label and omit issued credentials. */
+export function redactTurnSettingsForReport(settings: Partial<ObsidianLiveSyncSettings>): void {
+    if (settings.P2P_managedType) {
+        settings.P2P_managedType =
+            settings.P2P_managedType === CLOUDFLARE_TURN_TYPE ? CLOUDFLARE_TURN_TYPE : "redacted";
+    }
+    if (settings.P2P_managedId !== undefined) settings.P2P_managedId = "redacted";
+    if (settings.P2P_managedToken !== undefined) settings.P2P_managedToken = "redacted";
+    delete settings.P2P_iceServers;
+    delete settings.P2P_iceServersExpiresAt;
+}
+
+/** Managed connection profiles are shared through Setup URIs and QR codes. */
+export function omitManagedTurnProfilesFromMarkdown(settings: Partial<ObsidianLiveSyncSettings>): void {
+    delete settings.P2P_iceServers;
+    delete settings.P2P_iceServersExpiresAt;
+    if (!hasManagedTurnSettings(settings)) return;
+    delete settings.P2P_managedType;
+    delete settings.P2P_managedId;
+    delete settings.P2P_managedToken;
+    delete settings.remoteConfigurations;
+    delete settings.activeConfigurationId;
+    delete settings.P2P_ActiveRemoteConfigurationId;
+}
+
+/** Preserve the complete connection when Markdown omits its profile group. */
+export function preserveManagedTurnProfilesOnMarkdownImport(
+    incoming: Partial<ObsidianLiveSyncSettings>,
+    current: ObsidianLiveSyncSettings,
+    merged: ObsidianLiveSyncSettings
+): void {
+    if (
+        !hasManagedTurnSettings(current) ||
+        incoming.remoteConfigurations !== undefined ||
+        incoming.P2P_managedType !== undefined
+    )
+        return;
+    merged.remoteConfigurations = structuredClone(current.remoteConfigurations);
+    merged.activeConfigurationId = current.activeConfigurationId;
+    merged.P2P_ActiveRemoteConfigurationId = current.P2P_ActiveRemoteConfigurationId;
+    Object.assign(merged, pickP2PSyncSettings(current));
+}

src/common/turnSettingsPrivacy.unit.spec.ts

@@ -0,0 +1,139 @@
+import { describe, expect, it } from "vitest";
+import {
+    DEFAULT_SETTINGS,
+    REMOTE_P2P,
+    type ObsidianLiveSyncSettings,
+} from "@vrtmrz/livesync-commonlib/compat/common/types";
+import {
+    SettingService,
+    type SettingServiceDependencies,
+} from "@vrtmrz/livesync-commonlib/compat/services/base/SettingService";
+import { ServiceContext } from "@vrtmrz/livesync-commonlib/compat/services/base/ServiceBase";
+import { ConnectionStringParser } from "@vrtmrz/livesync-commonlib/compat/common/ConnectionString";
+import {
+    hasManagedTurnSettings,
+    omitManagedTurnProfilesFromMarkdown,
+    preserveManagedTurnProfilesOnMarkdownImport,
+    redactTurnSettingsForReport,
+} from "./turnSettingsPrivacy";
+
+class MemorySettingService extends SettingService {
+    readonly items = new Map<string, string>();
+    saved?: ObsidianLiveSyncSettings;
+    protected setItem(key: string, value: string) {
+        this.items.set(key, value);
+    }
+    protected getItem(key: string) {
+        return this.items.get(key) ?? "";
+    }
+    protected deleteItem(key: string) {
+        this.items.delete(key);
+    }
+    protected saveData(settings: ObsidianLiveSyncSettings) {
+        this.saved = structuredClone(settings);
+        return Promise.resolve();
+    }
+    protected loadData() {
+        return Promise.resolve(this.saved);
+    }
+}
+
+function configuredSettings() {
+    return {
+        ...DEFAULT_SETTINGS,
+        P2P_managedType: "CF",
+        P2P_managedId: "private-key-id",
+        P2P_managedToken: "private-token",
+        remoteConfigurations: {
+            managed: {
+                id: "managed",
+                name: "Managed TURN",
+                isEncrypted: false,
+                uri: "sls+p2p://room?managedType=CF&managedId=private-key-id&token=private-token",
+            },
+        },
+        activeConfigurationId: "central",
+        P2P_ActiveRemoteConfigurationId: "managed",
+    };
+}
+
+describe("managed TURN settings privacy", () => {
+    it("preserves the active managed room through Markdown import, save, and reload", async () => {
+        const current = {
+            ...configuredSettings(),
+            remoteType: REMOTE_P2P,
+            activeConfigurationId: "managed",
+            P2P_roomID: "local-room",
+            P2P_relays: "wss://local-relay.example.test",
+            P2P_passphrase: "local-passphrase",
+        };
+        const originalURI = ConnectionStringParser.serialize({ type: "p2p", settings: current });
+        current.remoteConfigurations.managed.uri = originalURI;
+        const service = new MemorySettingService(new ServiceContext(), {
+            APIService: {
+                getSystemVaultName: () => "test-vault",
+                getAppID: () => "test-app",
+                addLog: () => undefined,
+                confirm: { askString: async () => "" },
+            } as unknown as SettingServiceDependencies["APIService"],
+        });
+        service.settings = structuredClone(current);
+        const incoming: Partial<ObsidianLiveSyncSettings> = {
+            P2P_roomID: "imported-room",
+            P2P_relays: "wss://imported-relay.example.test",
+            P2P_passphrase: "imported-passphrase",
+        };
+        const merged = { ...structuredClone(DEFAULT_SETTINGS), ...incoming };
+        preserveManagedTurnProfilesOnMarkdownImport(incoming, current, merged);
+        await service.applyExternalSettings(merged, true);
+        const saved = service.saved!.remoteConfigurations.managed;
+        const uri = saved.isEncrypted ? await service.decryptConfigurationItem(saved.uri, "*") : saved.uri;
+        expect(uri).toBe(originalURI);
+        expect(service.settings.P2P_roomID).toBe("local-room");
+        await service.loadSettings();
+        expect(service.settings.P2P_roomID).toBe("local-room");
+    });
+
+    it("redacts provider fields and issued credentials, including unknown integrations", () => {
+        const settings = configuredSettings();
+        settings.P2P_managedType = "private-token";
+        redactTurnSettingsForReport(settings);
+        expect([settings.P2P_managedType, settings.P2P_managedId, settings.P2P_managedToken]).toEqual([
+            "redacted",
+            "redacted",
+            "redacted",
+        ]);
+    });
+
+    it("omits the whole managed profile group from Markdown, including inactive sources", () => {
+        const settings = configuredSettings();
+        settings.P2P_managedType = "";
+        expect(hasManagedTurnSettings(settings)).toBe(true);
+        omitManagedTurnProfilesFromMarkdown(settings);
+        expect(JSON.stringify(settings)).not.toMatch(/private-token|private-key-id|sls\+p2p/);
+        expect(settings).not.toHaveProperty("remoteConfigurations");
+        expect(settings).not.toHaveProperty("activeConfigurationId");
+        expect(settings).not.toHaveProperty("P2P_ActiveRemoteConfigurationId");
+    });
+
+    it("preserves existing profiles and both selections when Markdown omits the group", () => {
+        const current = configuredSettings();
+        const incoming = { ...DEFAULT_SETTINGS };
+        delete (incoming as Partial<typeof incoming>).remoteConfigurations;
+        delete (incoming as Partial<typeof incoming>).P2P_managedType;
+        const merged = { ...DEFAULT_SETTINGS, ...incoming };
+        preserveManagedTurnProfilesOnMarkdownImport(incoming, current, merged);
+        expect(merged.remoteConfigurations).toEqual(current.remoteConfigurations);
+        expect(merged.remoteConfigurations).not.toBe(current.remoteConfigurations);
+        expect(merged.P2P_managedToken).toEqual(current.P2P_managedToken);
+        expect(merged.activeConfigurationId).toBe("central");
+        expect(merged.P2P_ActiveRemoteConfigurationId).toBe("managed");
+    });
+
+    it("retains the manual-only Markdown contract", () => {
+        const settings = { ...DEFAULT_SETTINGS };
+        const before = structuredClone(settings);
+        omitManagedTurnProfilesFromMarkdown(settings);
+        expect(settings).toEqual(before);
+    });
+});

src/features/P2PSync/TurnConfiguration.svelte

@@ -0,0 +1,69 @@
+<script lang="ts">
+    import type { P2PConnectionInfo } from "@vrtmrz/livesync-commonlib/compat/common/types";
+    import { CLOUDFLARE_TURN_TYPE } from "@/integrations/cloudflare/settings";
+    import { validateManagedTurnSettings } from "@/integrations/turnSettings";
+    import { translateLiveSyncMessage as translate, translateIfAvailable } from "@/common/translation";
+
+    type TurnSettings = Pick<P2PConnectionInfo, "P2P_turnServers" | "P2P_turnUsername" | "P2P_turnCredential" | "P2P_managedType" | "P2P_managedId" | "P2P_managedToken">;
+    let { settings = $bindable() }: { settings: TurnSettings } = $props();
+    const managedType = $derived(settings.P2P_managedType ?? "");
+    const error = $derived(validateManagedTurnSettings(settings));
+
+    function selectProvider(type: string) {
+        settings.P2P_managedType = type || undefined;
+        settings.P2P_managedId = type ? "" : undefined;
+        settings.P2P_managedToken = type ? "" : undefined;
+    }
+</script>
+
+<div class="turn-configuration">
+    <label>
+        <span>{translate("TURN configuration")}</span>
+        <select aria-label={translate("TURN configuration")} name="p2p-turn-source" value={managedType} onchange={(event) => selectProvider(event.currentTarget.value)}>
+            <option value="">{translate("Manual")}</option>
+            <option value={CLOUDFLARE_TURN_TYPE}>{translate("Managed (Cloudflare)")}</option>
+            {#if managedType !== "" && managedType !== CLOUDFLARE_TURN_TYPE}
+                <option value={managedType} disabled>{translate("Unsupported TURN configuration")}</option>
+            {/if}
+        </select>
+    </label>
+    {#if managedType === ""}
+        <label>
+            <span>{translate("TURN Server URLs (comma-separated)")}</span>
+            <textarea name="p2p-turn-servers" rows="3" placeholder="turn:turn.example.com:3478"
+                bind:value={settings.P2P_turnServers} autocapitalize="off" spellcheck="false"></textarea>
+        </label>
+        <label>
+            <span>{translate("TURN Username")}</span>
+            <input type="text" name="p2p-turn-username" placeholder={translate("Enter TURN username")} bind:value={settings.P2P_turnUsername}
+                autocomplete="off" autocapitalize="off" spellcheck="false" />
+        </label>
+        <label>
+            <span>{translate("TURN Credential")}</span>
+            <input type="password" name="p2p-turn-credential" placeholder={translate("Enter TURN credential")} bind:value={settings.P2P_turnCredential}
+                autocomplete="new-password" />
+        </label>
+    {:else if managedType === CLOUDFLARE_TURN_TYPE}
+        <label>
+            <span>{translate("TURN Key ID")}</span>
+            <input type="text" name="p2p-turn-turnKeyId" bind:value={settings.P2P_managedId}
+                autocomplete="off" autocapitalize="off" spellcheck="false" />
+        </label>
+        <label>
+            <span>{translate("TURN Key API Token")}</span>
+            <input type="password" name="p2p-turn-apiToken" bind:value={settings.P2P_managedToken}
+                autocomplete="new-password" autocapitalize="off" spellcheck="false" />
+        </label>
+        <p>{translate("The API token is saved with this profile and included in Setup URI and QR code sharing. Temporary TURN credentials are kept in memory only.")}</p>
+    {/if}
+    {#if error}
+        <p role="status" class="turn-error">{translateIfAvailable(error)}</p>
+    {/if}
+</div>
+
+<style>
+    label { display: grid; gap: 0.25rem; margin: 0.75rem 0; }
+    input, textarea, select { box-sizing: border-box; width: 100%; }
+    p { font-size: var(--font-ui-small, 0.9rem); }
+    .turn-error { color: var(--text-error, #b33); }
+</style>

src/integrations/cloudflare/settings.ts

@@ -0,0 +1,49 @@
+/** The provider identifier persisted in a P2P profile for Cloudflare TURN. */
+export const CLOUDFLARE_TURN_TYPE = "CF" as const;
+
+/** The lifetime requested from Cloudflare for each issued credential set. */
+export const CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS = 86_400 as const;
+
+/** The Cloudflare TURN credential-generation endpoint. */
+export const CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT = "https://rtc.live.cloudflare.com/v1/turn/keys" as const;
+
+/** A Cloudflare TURN configuration. */
+export interface CloudflareTurnConfiguration {
+    readonly turnKeyId: string;
+    readonly apiToken: string;
+}
+
+// TURN Key IDs are inserted into one fixed URL path. Keep the accepted set
+// deliberately narrower than URI escaping so a configuration cannot alter
+// the request path or add a query string.
+const TURN_KEY_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,255}$/;
+
+// RFC 6750's b64token grammar, including optional trailing padding. This
+// also excludes whitespace and control characters from the Authorization
+// header without exposing the token in a validation message.
+const BEARER_TOKEN_PATTERN = /^[A-Za-z0-9._~+/-]+={0,2}$/;
+const MAX_BEARER_TOKEN_LENGTH = 4_096;
+
+/**
+ * Returns a safe validation message for a Cloudflare TURN configuration.
+ * The result never includes the supplied Key ID or API token.
+ */
+export function validateCloudflareTurnConfiguration(value: CloudflareTurnConfiguration): string | undefined {
+    const turnKeyId = value.turnKeyId;
+    if (typeof turnKeyId !== "string" || turnKeyId.length === 0) {
+        return "Enter a TURN Key ID.";
+    }
+    if (!TURN_KEY_ID_PATTERN.test(turnKeyId)) {
+        return "TURN Key ID contains unsupported characters.";
+    }
+
+    const apiToken = value.apiToken;
+    if (typeof apiToken !== "string" || apiToken.length === 0) {
+        return "Enter a TURN Key API Token.";
+    }
+    if (apiToken.length > MAX_BEARER_TOKEN_LENGTH || !BEARER_TOKEN_PATTERN.test(apiToken)) {
+        return "TURN Key API Token must use Bearer token syntax.";
+    }
+
+    return undefined;
+}

src/integrations/cloudflare/turnCredentials.ts

@@ -0,0 +1,363 @@
+import {
+    CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT,
+    CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS,
+    type CloudflareTurnConfiguration,
+    validateCloudflareTurnConfiguration,
+} from "./settings";
+
+/** Fetch-compatible function supplied by the host composition. */
+export type CloudflareTurnFetch = (input: string | Request, init?: RequestInit) => Promise<Response>;
+
+export interface CloudflareTurnDependencies {
+    readonly fetch: CloudflareTurnFetch;
+    readonly now?: () => number;
+    readonly requestDeadlineMs?: number;
+}
+
+export const CLOUDFLARE_TURN_REQUEST_DEADLINE_MS = 15_000 as const;
+export const CLOUDFLARE_TURN_MAX_RESPONSE_BYTES = 32 * 1024;
+export const CLOUDFLARE_TURN_MAX_ICE_SERVER_ENTRIES = 16 as const;
+export const CLOUDFLARE_TURN_MAX_ICE_SERVER_URLS = 32 as const;
+export const CLOUDFLARE_TURN_MIN_REMAINING_LIFETIME_MS = 30_000 as const;
+
+type TurnFailureCode = "configuration" | "authentication" | "unavailable" | "invalid-response";
+
+const FAILURE_MESSAGES: Record<TurnFailureCode, string> = {
+    configuration: "The Cloudflare TURN configuration is invalid.",
+    authentication: "The Cloudflare TURN credential request was not authorised.",
+    unavailable: "The Cloudflare TURN service is unavailable.",
+    "invalid-response": "The Cloudflare TURN service returned an invalid response.",
+};
+
+function credentialFailure(code: TurnFailureCode, retryable: boolean): Error {
+    return Object.assign(new Error(FAILURE_MESSAGES[code]), { code, retryable });
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function abortError(): Error {
+    try {
+        return new DOMException("The operation was aborted.", "AbortError");
+    } catch {
+        const error = new Error("The operation was aborted.");
+        error.name = "AbortError";
+        return error;
+    }
+}
+
+function throwIfAborted(signal: AbortSignal): void {
+    if (signal.aborted) {
+        throw abortError();
+    }
+}
+
+function isControlCharacter(value: string): boolean {
+    return Array.from(value).some((character) => {
+        const code = character.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+}
+
+function isPort(value: string): boolean {
+    if (!/^\d{1,5}$/.test(value)) return false;
+    const port = Number(value);
+    return port >= 1 && port <= 65_535;
+}
+
+function isHost(value: string): boolean {
+    return value.length > 0 && /^[A-Za-z0-9._-]+$/.test(value);
+}
+
+/**
+ * Validates the URL forms accepted by WebRTC's ICE server configuration.
+ * TURN URLs may carry only the standard transport query parameter; userinfo,
+ * paths, fragments, and arbitrary query values are not accepted.
+ */
+export function isSupportedIceServerUrl(value: string): boolean {
+    if (value.length === 0 || value.length > 2_048 || isControlCharacter(value)) return false;
+    const schemeMatch = /^(stun|stuns|turn|turns):(.+)$/i.exec(value);
+    if (!schemeMatch) return false;
+
+    const remainder = schemeMatch[2];
+    const queryIndex = remainder.indexOf("?");
+    const authority = queryIndex >= 0 ? remainder.slice(0, queryIndex) : remainder;
+    const query = queryIndex >= 0 ? remainder.slice(queryIndex + 1) : "";
+    if (authority.length === 0 || authority.includes("/") || authority.includes("#") || authority.includes("@")) {
+        return false;
+    }
+    if (authority.includes("%")) return false;
+
+    if (authority.startsWith("[")) {
+        const closingBracket = authority.indexOf("]");
+        if (closingBracket < 0) return false;
+        const host = authority.slice(1, closingBracket);
+        if (!/^[0-9A-Fa-f:.]+$/.test(host) || !host.includes(":")) return false;
+        const suffix = authority.slice(closingBracket + 1);
+        if (suffix !== "" && (!suffix.startsWith(":") || !isPort(suffix.slice(1)))) return false;
+    } else {
+        const colonIndex = authority.lastIndexOf(":");
+        const host = colonIndex >= 0 ? authority.slice(0, colonIndex) : authority;
+        if (!isHost(host) || (colonIndex >= 0 && !isPort(authority.slice(colonIndex + 1)))) return false;
+        // IPv6 literals must use brackets so a colon cannot be interpreted as
+        // an ambiguous port separator.
+        if (colonIndex >= 0 && host.includes(":")) return false;
+    }
+
+    if (query.length === 0) return true;
+    const queryParts = query.split("&");
+    return queryParts.length === 1 && /^transport=(udp|tcp)$/i.test(queryParts[0]);
+}
+
+function isTurnUrl(value: string): boolean {
+    return /^(turn|turns):/i.test(value);
+}
+
+function isCredential(value: unknown): value is string {
+    return typeof value === "string" && value.length > 0 && value.length <= 4_096 && !isControlCharacter(value);
+}
+
+function normaliseIceServers(value: unknown): readonly RTCIceServer[] {
+    if (!isRecord(value) || !Array.isArray(value.iceServers)) {
+        throw credentialFailure("invalid-response", false);
+    }
+    if (value.iceServers.length === 0 || value.iceServers.length > CLOUDFLARE_TURN_MAX_ICE_SERVER_ENTRIES) {
+        throw credentialFailure("invalid-response", false);
+    }
+
+    const servers: RTCIceServer[] = [];
+    let urlCount = 0;
+    let hasTurnServer = false;
+
+    for (const candidate of value.iceServers) {
+        if (!isRecord(candidate)) throw credentialFailure("invalid-response", false);
+        const rawUrls = candidate.urls;
+        const urls =
+            typeof rawUrls === "string"
+                ? [rawUrls]
+                : Array.isArray(rawUrls) && rawUrls.every((url): url is string => typeof url === "string")
+                  ? [...rawUrls]
+                  : undefined;
+        if (!urls || urls.length === 0) throw credentialFailure("invalid-response", false);
+
+        urlCount += urls.length;
+        if (urlCount > CLOUDFLARE_TURN_MAX_ICE_SERVER_URLS || urls.some((url) => !isSupportedIceServerUrl(url))) {
+            throw credentialFailure("invalid-response", false);
+        }
+
+        const turnEntry = urls.some(isTurnUrl);
+        hasTurnServer ||= turnEntry;
+        const normalised: RTCIceServer = { urls };
+        if (turnEntry) {
+            if (!isCredential(candidate.username) || !isCredential(candidate.credential)) {
+                throw credentialFailure("invalid-response", false);
+            }
+            normalised.username = candidate.username;
+            normalised.credential = candidate.credential;
+        }
+        servers.push(normalised);
+    }
+
+    if (!hasTurnServer) throw credentialFailure("invalid-response", false);
+    return Object.freeze(servers);
+}
+
+class BoundedResponseError extends Error {
+    constructor(readonly kind: "too-large" | "invalid-length" | "read-failed") {
+        super(kind);
+    }
+}
+
+async function readResponseBody(response: Response): Promise<string> {
+    const contentLength = response.headers.get("content-length");
+    if (contentLength !== null) {
+        const declaredLength = Number(contentLength);
+        if (!Number.isFinite(declaredLength) || declaredLength < 0) {
+            throw new BoundedResponseError("invalid-length");
+        }
+        if (declaredLength > CLOUDFLARE_TURN_MAX_RESPONSE_BYTES) {
+            throw new BoundedResponseError("too-large");
+        }
+    }
+
+    if (!response.body) {
+        try {
+            const text = await response.text();
+            if (new TextEncoder().encode(text).byteLength > CLOUDFLARE_TURN_MAX_RESPONSE_BYTES) {
+                throw new BoundedResponseError("too-large");
+            }
+            return text;
+        } catch (error) {
+            if (error instanceof BoundedResponseError) throw error;
+            throw new BoundedResponseError("read-failed");
+        }
+    }
+
+    const reader = response.body.getReader();
+    const chunks: Uint8Array[] = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const result = await reader.read();
+            if (result.done) break;
+            totalBytes += result.value.byteLength;
+            if (totalBytes > CLOUDFLARE_TURN_MAX_RESPONSE_BYTES) {
+                try {
+                    await reader.cancel();
+                } catch {
+                    // The response is already invalid because it exceeded the
+                    // bound; cancellation failure must not change the safe
+                    // classification or expose a host-specific error.
+                }
+                throw new BoundedResponseError("too-large");
+            }
+            chunks.push(result.value);
+        }
+    } catch (error) {
+        if (error instanceof BoundedResponseError) throw error;
+        throw new BoundedResponseError("read-failed");
+    } finally {
+        reader.releaseLock();
+    }
+
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+}
+
+function classifyHttpFailure(status: number): Error {
+    if (status === 401 || status === 403) {
+        return credentialFailure("authentication", false);
+    }
+    if (status === 408 || status === 429 || status >= 500) {
+        return credentialFailure("unavailable", true);
+    }
+    return credentialFailure("unavailable", false);
+}
+
+function parseResponseBody(body: string): readonly RTCIceServer[] {
+    let value: unknown;
+    try {
+        value = JSON.parse(body) as unknown;
+    } catch {
+        throw credentialFailure("invalid-response", false);
+    }
+    return normaliseIceServers(value);
+}
+
+/** Acquire one temporary ICE configuration for a new room connection. */
+export async function acquireCloudflareTurnCredentials(
+    configuration: CloudflareTurnConfiguration,
+    dependencies: CloudflareTurnDependencies,
+    signal: AbortSignal
+): Promise<{ iceServers: readonly RTCIceServer[]; expiresAt: number }> {
+    if (validateCloudflareTurnConfiguration(configuration)) throw credentialFailure("configuration", false);
+    const now = dependencies.now ?? Date.now;
+    const requestDeadlineMs = dependencies.requestDeadlineMs ?? CLOUDFLARE_TURN_REQUEST_DEADLINE_MS;
+    throwIfAborted(signal);
+    const requestStartedAt = now();
+    if (!Number.isFinite(requestStartedAt)) {
+        throw credentialFailure("unavailable", true);
+    }
+
+    const requestController = new AbortController();
+    let cancelledByCaller = false;
+    let rejectCaller: ((reason?: unknown) => void) | undefined;
+    const callerAbort = new Promise<never>((_resolve, reject) => {
+        rejectCaller = reject;
+    });
+    let timedOut = false;
+    const onAbort = () => {
+        cancelledByCaller = true;
+        requestController.abort();
+        rejectCaller?.(abortError());
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) {
+        signal.removeEventListener("abort", onAbort);
+        requestController.abort();
+        throw abortError();
+    }
+    let timeoutId: ReturnType<typeof setTimeout> | undefined;
+    const deadline = new Promise<never>((_resolve, reject) => {
+        timeoutId = globalThis.setTimeout(() => {
+            timedOut = true;
+            requestController.abort();
+            reject(credentialFailure("unavailable", true));
+        }, requestDeadlineMs);
+    });
+
+    const cleanup = () => {
+        if (timeoutId !== undefined) globalThis.clearTimeout(timeoutId);
+        signal.removeEventListener("abort", onAbort);
+    };
+
+    const endpoint = `${CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT}/${configuration.turnKeyId}/credentials/generate-ice-servers`;
+    let response: Response;
+    try {
+        response = await Promise.race([
+            dependencies.fetch(endpoint, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${configuration.apiToken}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({ ttl: CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS }),
+                signal: requestController.signal,
+                redirect: "error",
+                credentials: "omit",
+                cache: "no-store",
+            }),
+            callerAbort,
+            deadline,
+        ]);
+    } catch {
+        cleanup();
+        if (cancelledByCaller || signal.aborted) throw abortError();
+        if (timedOut) throw credentialFailure("unavailable", true);
+        throw credentialFailure("unavailable", true);
+    }
+
+    if (cancelledByCaller || signal.aborted) {
+        cleanup();
+        throw abortError();
+    }
+    if (timedOut || requestController.signal.aborted) {
+        cleanup();
+        throw credentialFailure("unavailable", true);
+    }
+    if (response.status !== 201) {
+        cleanup();
+        throw classifyHttpFailure(response.status);
+    }
+
+    let body: string;
+    try {
+        body = await Promise.race([readResponseBody(response), callerAbort, deadline]);
+    } catch (error) {
+        cleanup();
+        if (cancelledByCaller || signal.aborted) throw abortError();
+        if (timedOut) throw credentialFailure("unavailable", true);
+        if (error instanceof BoundedResponseError && error.kind === "read-failed") {
+            throw credentialFailure("unavailable", true);
+        }
+        throw credentialFailure("invalid-response", false);
+    }
+
+    try {
+        throwIfAborted(signal);
+        const iceServers = parseResponseBody(body);
+        const expiresAt = requestStartedAt + CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS * 1_000;
+        if (!Number.isFinite(expiresAt) || expiresAt <= now() + CLOUDFLARE_TURN_MIN_REMAINING_LIFETIME_MS) {
+            throw credentialFailure("invalid-response", false);
+        }
+        return { iceServers, expiresAt };
+    } finally {
+        cleanup();
+    }
+}

src/integrations/cloudflare/turnCredentials.unit.spec.ts

@@ -0,0 +1,179 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+    CLOUDFLARE_TURN_MAX_RESPONSE_BYTES,
+    CLOUDFLARE_TURN_REQUEST_DEADLINE_MS,
+    acquireCloudflareTurnCredentials,
+} from "./turnCredentials";
+import {
+    CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT,
+    CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS,
+    validateCloudflareTurnConfiguration,
+} from "./settings";
+
+const configuration = {
+    turnKeyId: "key-123",
+    apiToken: "token_abc-123",
+} as const;
+
+function response(body: unknown, status = 201): Response {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+
+function validBody() {
+    return {
+        iceServers: [
+            {
+                urls: ["turn:relay.example.test:3478?transport=udp", "turns:relay.example.test:5349"],
+                username: "turn-user",
+                credential: "turn-password",
+            },
+            { urls: "stun:stun.example.test:3478" },
+        ],
+    };
+}
+
+afterEach(() => {
+    vi.useRealTimers();
+});
+
+describe("Cloudflare TURN credentials", () => {
+    it("requests the fixed endpoint with the bearer token and TTL", async () => {
+        const now = 1_000_000;
+        let requestUrl: string | Request | undefined;
+        let requestInit: RequestInit | undefined;
+        const fetch = vi.fn(async (input: string | Request, init?: RequestInit) => {
+            requestUrl = input;
+            requestInit = init;
+            return response(validBody());
+        });
+        const dependencies = { fetch, now: () => now };
+
+        const result = await acquireCloudflareTurnCredentials(
+            configuration,
+            dependencies,
+            new AbortController().signal
+        );
+
+        expect(requestUrl).toBe(`${CLOUDFLARE_TURN_CREDENTIAL_ENDPOINT}/key-123/credentials/generate-ice-servers`);
+        expect(requestInit).toMatchObject({
+            method: "POST",
+            redirect: "error",
+            credentials: "omit",
+            cache: "no-store",
+            body: JSON.stringify({ ttl: CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS }),
+        });
+        expect(new Headers(requestInit?.headers).get("authorization")).toBe("Bearer token_abc-123");
+        expect(new Headers(requestInit?.headers).get("content-type")).toBe("application/json");
+        expect(requestInit?.signal).toBeInstanceOf(AbortSignal);
+        expect(result.iceServers).toHaveLength(2);
+        expect(result.expiresAt).toBe(now + CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS * 1_000);
+    });
+
+    it("rejects malformed, oversized, and STUN-only responses without exposing secrets", async () => {
+        const cases: Array<{ body: unknown; expectedCode: string }> = [
+            { body: { iceServers: [] }, expectedCode: "invalid-response" },
+            { body: { iceServers: [{ urls: "turn:relay.example.test:3478" }] }, expectedCode: "invalid-response" },
+            { body: { iceServers: [{ urls: "stun:stun.example.test:3478" }] }, expectedCode: "invalid-response" },
+        ];
+        for (const testCase of cases) {
+            const dependencies = {
+                fetch: vi.fn(async () => response(testCase.body)),
+                now: () => 1_000_000,
+            };
+            const error = await acquireCloudflareTurnCredentials(
+                configuration,
+                dependencies,
+                new AbortController().signal
+            ).catch((reason: unknown) => reason);
+            expect(error).toMatchObject({ code: testCase.expectedCode });
+            expect(String(error)).not.toContain(configuration.apiToken);
+            expect(String(error)).not.toContain(configuration.turnKeyId);
+        }
+
+        const oversized = "x".repeat(CLOUDFLARE_TURN_MAX_RESPONSE_BYTES + 1);
+        const dependencies = {
+            fetch: vi.fn(async () => new Response(oversized, { status: 201 })),
+            now: () => 1_000_000,
+        };
+        const error = await acquireCloudflareTurnCredentials(
+            configuration,
+            dependencies,
+            new AbortController().signal
+        ).catch((reason: unknown) => reason);
+        expect(error).toMatchObject({ code: "invalid-response" });
+    });
+
+    it("classifies authentication and transient provider failures", async () => {
+        const authDependencies = {
+            fetch: vi.fn(async () => response({}, 401)),
+        };
+        await expect(
+            acquireCloudflareTurnCredentials(configuration, authDependencies, new AbortController().signal)
+        ).rejects.toMatchObject({
+            code: "authentication",
+            retryable: false,
+        });
+
+        const transientDependencies = {
+            fetch: vi.fn(async () => response({}, 503)),
+        };
+        await expect(
+            acquireCloudflareTurnCredentials(configuration, transientDependencies, new AbortController().signal)
+        ).rejects.toMatchObject({
+            code: "unavailable",
+            retryable: true,
+        });
+    });
+
+    it("propagates caller cancellation and turns a deadline into an unavailable failure", async () => {
+        const controller = new AbortController();
+        const fetch = vi.fn((_input: string | Request, init?: RequestInit) => {
+            return new Promise<Response>((_resolve, reject) => {
+                init?.signal?.addEventListener("abort", () => reject(new DOMException("aborted", "AbortError")), {
+                    once: true,
+                });
+            });
+        });
+        const dependencies = { fetch };
+        const cancelled = acquireCloudflareTurnCredentials(configuration, dependencies, controller.signal);
+        controller.abort();
+        await expect(cancelled).rejects.toMatchObject({ name: "AbortError" });
+
+        vi.useFakeTimers();
+        const timedDependencies = { fetch };
+        const timed = acquireCloudflareTurnCredentials(configuration, timedDependencies, new AbortController().signal);
+        const assertion = expect(timed).rejects.toMatchObject({ code: "unavailable", retryable: true });
+        await vi.advanceTimersByTimeAsync(CLOUDFLARE_TURN_REQUEST_DEADLINE_MS);
+        await assertion;
+    });
+
+    it("rejects an issuance which has no usable remaining lifetime", async () => {
+        let now = 1_000_000;
+        const dependencies = {
+            fetch: vi.fn(async () => {
+                now += CLOUDFLARE_TURN_CREDENTIAL_TTL_SECONDS * 1_000;
+                return response(validBody());
+            }),
+            now: () => now,
+        };
+        await expect(
+            acquireCloudflareTurnCredentials(configuration, dependencies, new AbortController().signal)
+        ).rejects.toMatchObject({
+            code: "invalid-response",
+        });
+    });
+});
+
+describe("Cloudflare TURN input validation", () => {
+    it("rejects unsafe key IDs and malformed bearer credentials", () => {
+        expect(
+            validateCloudflareTurnConfiguration({ turnKeyId: "key/id", apiToken: configuration.apiToken })
+        ).toContain("unsupported characters");
+        expect(validateCloudflareTurnConfiguration({ ...configuration, apiToken: "token with spaces" })).toContain(
+            "Bearer token syntax"
+        );
+    });
+});

src/integrations/turnSettings.ts

@@ -0,0 +1,14 @@
+import type { P2PConnectionInfo } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { CLOUDFLARE_TURN_TYPE, validateCloudflareTurnConfiguration } from "./cloudflare/settings";
+
+/** Validate provider inputs without requesting credentials. */
+export function validateManagedTurnSettings(settings: Partial<P2PConnectionInfo>): string | undefined {
+    if (settings.P2P_managedType === undefined || settings.P2P_managedType === "") return undefined;
+    if (settings.P2P_managedType !== CLOUDFLARE_TURN_TYPE) {
+        return "The selected TURN configuration is not supported.";
+    }
+    return validateCloudflareTurnConfiguration({
+        turnKeyId: settings.P2P_managedId ?? "",
+        apiToken: settings.P2P_managedToken ?? "",
+    });
+}

src/main.ts

@@ -1,3 +1,4 @@
+import { useP2PSettingsPreparation } from "@/serviceFeatures/useP2PSettingsPreparation";
 import { getLanguage, Notice, Plugin, type App, type PluginManifest } from "./deps";
 import { setGetLanguage } from "@vrtmrz/livesync-commonlib/compat/common/coreEnvFunctions";
 setGetLanguage(getLanguage);
@@ -182,7 +183,8 @@ export default class ObsidianLiveSyncPlugin extends Plugin {
                 const replicator = useP2PReplicatorFeature(
                     core,
                     (_compatibilityReplicator, p2p) => createInteractiveP2PReplication(p2p),
-                    createOpenRebuildUI(this.app)
+                    createOpenRebuildUI(this.app),
+                    { prepareP2PSettings: useP2PSettingsPreparation(core.services.API.webCompatFetch.bind(core.services.API)) }
                 );
                 setupManager.registerP2PSetupConnectionProbe(replicator.connectionProbe);
                 useP2PReplicatorCommands(core, replicator);

src/modules/features/ModuleObsidianSettingAsMarkdown.ts

@@ -1,3 +1,8 @@
+import {
+    hasManagedTurnSettings,
+    omitManagedTurnProfilesFromMarkdown,
+    preserveManagedTurnProfilesOnMarkdownImport,
+} from "@/common/turnSettingsPrivacy";
 // import { PouchDB } from "../../lib/src/pouchdb/pouchdb-browser";
 import { isObjectDifferent } from "octagonal-wheels/object";
 import { EVENT_SETTING_SAVED, eventHub } from "@/common/events";
@@ -129,6 +134,7 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
 
         let settingToApply = { ...DEFAULT_SETTINGS } as ObsidianLiveSyncSettings;
         settingToApply = { ...settingToApply, ...newSetting };
+        preserveManagedTurnProfilesOnMarkdownImport(newSetting, this.settings, settingToApply);
         if (!settingToApply?.writeCredentialsForSettingSync) {
             //New setting does not contains credentials.
             settingToApply.couchDB_USER = this.settings.couchDB_USER;
@@ -208,11 +214,18 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
             delete saveData.couchDB_CustomHeaders;
             delete saveData.bucketCustomHeaders;
         }
+        omitManagedTurnProfilesFromMarkdown(saveData);
         return saveData;
     }
 
     async saveSettingToMarkdown(filename: string) {
         const saveData = this.generateSettingForMarkdown();
+        if (hasManagedTurnSettings(this.settings)) {
+            this._log(
+                "Share TURN provider credentials through an encrypted Setup URI. Connection profiles are omitted from Markdown settings.",
+                LOG_LEVEL_INFO
+            );
+        }
         const file = await this.core.storageAccess.isExists(filename);
 
         if (!file) {

src/modules/features/SetupWizard/dialogs/SetupRemoteP2P.svelte

@@ -1,4 +1,6 @@
 <script lang="ts">
+    import TurnConfiguration from "@/features/P2PSync/TurnConfiguration.svelte";
+    import { validateManagedTurnSettings } from "@/integrations/turnSettings";
     // import { delay } from "octagonal-wheels/promises";
     import DialogHeader from "@/modules/services/LiveSyncUI/components/DialogHeader.svelte";
     import Guidance from "@/modules/services/LiveSyncUI/components/Guidance.svelte";
@@ -15,7 +17,7 @@
         P2PMessageSizePresets,
         PREFERRED_BASE,
         RemoteTypes,
-        hasValidP2PTurnServerUrl,
+        hasP2PTurnConfiguration,
         normaliseP2PConnectionPath,
         normaliseP2PMaxWirePayloadBytes,
         type EntryDoc,
@@ -27,7 +29,6 @@
     import { TrysteroReplicator } from "@vrtmrz/livesync-commonlib/compat/replication/trystero/TrysteroReplicator";
     import type { ReplicatorHostEnv } from "@vrtmrz/livesync-commonlib/compat/replication/trystero/types";
     import {
-        copyTo,
         generateP2PRoomId,
         pickP2PSyncSettings,
         type SimpleStore,
@@ -51,7 +52,7 @@
     const context = getDialogContext();
     let error = $state("");
     let connectionPathResetNotice = $state(false);
-    const hasValidTurnServer = $derived(hasValidP2PTurnServerUrl(syncSetting.P2P_turnServers ?? ""));
+    const hasValidTurnServer = $derived(hasP2PTurnConfiguration(syncSetting));
     type Props = GuestDialogProps<SetupRemoteP2PResultType, SetupRemoteP2PInitialData>;
 
     const { setResult, getInitialData }: Props = $props();
@@ -61,7 +62,7 @@
         connectionProbe = initialData?.connectionProbe;
         const initialSettings = initialData?.settings;
         if (initialSettings) {
-            copyTo(initialSettings, syncSetting);
+            syncSetting = pickP2PSyncSettings(initialSettings);
         }
         const initialPeerName = (initialSettings?.P2P_DevicePeerName ?? "").trim();
         if (initialPeerName !== "") {
@@ -100,12 +101,14 @@
     async function checkConnection() {
         try {
             processing = true;
+            const sourceError = validateManagedTurnSettings(syncSetting);
+            if (sourceError) return sourceError;
             const trialRemoteSetting = generateSetting();
             const admission = connectionProbe;
             if (!admission) {
                 throw new Error("The P2P Setup connection probe is not available.");
             }
-            const result = await coordinateP2PSetupConnectionProbe(admission, trialRemoteSetting, async () => {
+            const result = await coordinateP2PSetupConnectionProbe(admission, trialRemoteSetting, async (signallingSettings) => {
                 const map = new Map<string, unknown>();
                 const store = {
                     get: (key: string) => {
@@ -133,7 +136,7 @@
                     const env: ReplicatorHostEnv = {
                         events: context.context.events,
                         translate: context.context.translate,
-                        settings: trialRemoteSetting,
+                        settings: signallingSettings,
                         processReplicatedDocs: async (_docs: PouchDB.Core.ExistingDocument<EntryDoc>[]) => {
                             return;
                         },
@@ -204,6 +207,8 @@
         }
     }
     function commit() {
+        error = validateManagedTurnSettings(syncSetting) ?? "";
+        if (error) return;
         const setting = pickP2PSyncSettings(generateSetting());
         setResult(setting);
     }
@@ -215,7 +220,8 @@
             syncSetting.P2P_relays.trim() !== "" &&
             syncSetting.P2P_roomID.trim() !== "" &&
             syncSetting.P2P_passphrase.trim() !== "" &&
-            (syncSetting.P2P_DevicePeerName ?? "").trim() !== ""
+            (syncSetting.P2P_DevicePeerName ?? "").trim() !== "" &&
+            validateManagedTurnSettings(syncSetting) === undefined
         );
     });
 </script>
@@ -339,24 +345,24 @@
     </InputRow>
     <InfoNote>
         {translateMessage(
-            "TURN relay only is available when at least one valid TURN server URL is configured under Advanced Settings."
+            "TURN relay only requires a TURN server or a configured credential source under Advanced Settings."
         )}
     </InfoNote>
     <InfoNote notice visible={connectionPathResetNotice}>
         {translateMessage(
-            "TURN relay only requires at least one valid TURN server URL. Connection path has been restored to Automatic."
+            "TURN relay only requires TURN configuration. Connection path has been restored to Automatic."
         )}
     </InfoNote>
 </ExtraItems>
 <ExtraItems title={translateMessage("Advanced Settings")}>
     <InfoNote>
         {translateMessage(
-            "TURN server settings are only necessary if you are behind a strict NAT or firewall that prevents direct P2P connections. In most cases, you can leave these fields blank."
+            "Configure TURN when a direct connection cannot be established or when you select TURN relay only."
         )}
     </InfoNote>
-    <InfoNote warning>
+    <InfoNote>
         {translateMessage(
-            "TURN relays the encrypted WebRTC connection only when a direct path cannot be established. A TURN provider cannot read encrypted Vault contents, but it can observe connection metadata and traffic volume. Use a provider you trust."
+            "WebRTC encrypts data between your devices, including when it passes through TURN. The TURN provider cannot read the transferred data. It can see network addresses and traffic volume."
         )}
         <a
             href="https://github.com/vrtmrz/obsidian-livesync/blob/main/docs/p2p.md#signalling-relay-and-turn-server"
@@ -364,34 +370,7 @@
             rel="noopener noreferrer">{translateMessage("Learn more about signalling and TURN")}</a
         >.
     </InfoNote>
-    <InputRow label={translateMessage("TURN Server URLs (comma-separated)")}>
-        <textarea
-            name="p2p-turn-servers"
-            placeholder="turn:turn.example.com:3478,turn:turn.example.com:443"
-            autocapitalize="off"
-            spellcheck="false"
-            bind:value={syncSetting.P2P_turnServers}
-            rows="5"
-        ></textarea>
-    </InputRow>
-    <InputRow label={translateMessage("TURN Username")}>
-        <input
-            type="text"
-            name="p2p-turn-username"
-            placeholder={translateMessage("Enter TURN username")}
-            autocorrect="off"
-            autocapitalize="off"
-            spellcheck="false"
-            bind:value={syncSetting.P2P_turnUsername}
-        />
-    </InputRow>
-    <InputRow label={translateMessage("TURN Credential")}>
-        <Password
-            name="p2p-turn-credential"
-            placeholder={translateMessage("Enter TURN credential")}
-            bind:value={syncSetting.P2P_turnCredential}
-        />
-    </InputRow>
+    <TurnConfiguration bind:settings={syncSetting} />
 </ExtraItems>
 <InfoNote error visible={error !== ""}>
     {error}

src/modules/features/SetupWizard/dialogs/UseSetupURI.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
     import { configURIBase } from "@/common/types";
-    import type { ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/compat/common/types";
     import DialogHeader from "@/modules/services/LiveSyncUI/components/DialogHeader.svelte";
     import Guidance from "@/modules/services/LiveSyncUI/components/Guidance.svelte";
     import Decision from "@/modules/services/LiveSyncUI/components/Decision.svelte";
@@ -10,7 +9,7 @@
     import Password from "@/modules/services/LiveSyncUI/components/Password.svelte";
 
     import { onMount } from "svelte";
-    import { decryptString } from "@vrtmrz/livesync-commonlib/compat/encryption/stringEncryption";
+    import { decodeSettingsFromSetupURI } from "@vrtmrz/livesync-commonlib/compat/API/processSetting";
     import type { GuestDialogProps } from "@/modules/services/LiveSyncUI/svelteDialog";
     import { TYPE_CANCELLED, type UseSetupURIResultType } from "./setupDialogTypes";
     import { $msg as translateMessage } from "@/common/translation";
@@ -30,7 +29,7 @@
         }
     });
 
-    const seemsValid = $derived.by(() => setupURI.startsWith(configURIBase));
+    const seemsValid = $derived(setupURI.startsWith(configURIBase));
     async function processSetupURI() {
         error = "";
         if (!seemsValid) return;
@@ -39,11 +38,8 @@
             return;
         }
         try {
-            const settingPieces = setupURI.substring(configURIBase.length);
-            const encodedConfig = decodeURIComponent(settingPieces);
-            const newConf = (await JSON.parse(
-                await decryptString(encodedConfig, passphrase)
-            )) as ObsidianLiveSyncSettings;
+            const newConf = await decodeSettingsFromSetupURI(setupURI.trim(), passphrase);
+            if (!newConf) throw new Error("Invalid Setup URI settings");
             setResult(newConf);
             // Logger("Settings imported successfully", LOG_LEVEL_NOTICE);
             return;

src/modules/features/SetupWizard/dialogs/p2pSetupConnectionProbe.ts

@@ -3,6 +3,7 @@ import {
     type P2PConnectionProbeAdmission,
     type P2PConnectionProbeSettings,
 } from "@vrtmrz/livesync-commonlib/p2p";
+import { P2PConnectionPaths, type P2PSyncSetting } from "@vrtmrz/livesync-commonlib/compat/common/types";
 
 export type P2PSetupConnectionProbeResult =
     | { readonly ok: true }
@@ -20,12 +21,25 @@ export interface P2PSetupConnectionProbe {
 }
 
 /** Interpret the stable P2P owner's admission without constructing transport eagerly. */
-export async function coordinateP2PSetupConnectionProbe(
+export async function coordinateP2PSetupConnectionProbe<T extends P2PConnectionProbeSettings>(
     admission: P2PConnectionProbeAdmission,
-    trialSettings: P2PConnectionProbeSettings,
-    runOwnedTrial: () => Promise<P2PSetupConnectionProbeResult>
+    trialSettings: T,
+    runOwnedTrial: (settings: T) => Promise<P2PSetupConnectionProbeResult>
 ): Promise<P2PSetupConnectionProbeResult> {
-    const settlement = await admission.run(trialSettings, runOwnedTrial);
+    const settlement = await admission.run(trialSettings, () => {
+        // This trial checks signalling only; TURN allocation belongs to an actual connection.
+        const settings: T & Partial<P2PSyncSetting> = { ...trialSettings };
+        delete settings.P2P_managedType;
+        delete settings.P2P_managedId;
+        delete settings.P2P_managedToken;
+        delete settings.P2P_iceServers;
+        delete settings.P2P_iceServersExpiresAt;
+        settings.P2P_turnServers = "";
+        settings.P2P_turnUsername = "";
+        settings.P2P_turnCredential = "";
+        settings.P2P_connectionPath = P2PConnectionPaths.Automatic;
+        return runOwnedTrial(settings);
+    });
     if (settlement.status === "observed-active") return { ok: true };
     if (settlement.status === "blocked") {
         return {

src/modules/features/SetupWizard/dialogs/p2pSetupConnectionProbe.unit.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import { ACTIVE_P2P_RELAY_BINDING_CONFLICT, type P2PConnectionProbeAdmission } from "@vrtmrz/livesync-commonlib/p2p";
+import { DEFAULT_SETTINGS, P2PConnectionPaths } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import {
     coordinateP2PSetupConnectionProbe,
     probeP2PSetupConnection,
@@ -7,6 +8,40 @@ import {
 } from "./p2pSetupConnectionProbe";
 
 describe("P2P setup connection probe", () => {
+    it("constructs a signalling-only trial when the draft selects managed TURN", async () => {
+        const settings = {
+            ...DEFAULT_SETTINGS,
+            P2P_managedType: "CF",
+            P2P_managedId: "test-key",
+            P2P_managedToken: "test-token",
+            P2P_iceServers: [
+                { urls: "turn:temporary.example.test", username: "issued-user", credential: "issued-password" },
+            ],
+            P2P_iceServersExpiresAt: 123456789,
+            P2P_turnServers: "turn:unused.example.test:3478",
+            P2P_turnUsername: "unused-user",
+            P2P_turnCredential: "unused-password",
+            P2P_connectionPath: P2PConnectionPaths.Relay,
+        };
+        const admission: P2PConnectionProbeAdmission = {
+            run: async (_settings, trial) => ({ status: "trial", result: await trial() }),
+        };
+        const result = await coordinateP2PSetupConnectionProbe(admission, settings, async (trial = settings) => {
+            expect(trial.P2P_managedType).toBeUndefined();
+            expect(trial.P2P_managedToken).toBeUndefined();
+            expect(trial.P2P_iceServers).toBeUndefined();
+            expect(trial.P2P_iceServersExpiresAt).toBeUndefined();
+            expect(trial.P2P_turnServers).toBe("");
+            expect(trial.P2P_turnUsername).toBe("");
+            expect(trial.P2P_turnCredential).toBe("");
+            expect(trial.P2P_connectionPath).toBe(P2PConnectionPaths.Automatic);
+            return { ok: true };
+        });
+        expect(result).toEqual({ ok: true });
+        expect(settings.P2P_managedToken).toBe("test-token");
+        expect(settings.P2P_connectionPath).toBe(P2PConnectionPaths.Relay);
+    });
+
     it("uses a compatible active signalling connection without constructing a trial", async () => {
         const runOwnedTrial = vi.fn(async (): Promise<P2PSetupConnectionProbeResult> => ({ ok: true }));
         const admission: P2PConnectionProbeAdmission = {

src/modules/main/ModuleLiveSyncMain.ts

@@ -45,7 +45,13 @@ export class ModuleLiveSyncMain extends AbstractModule {
         }
         // Ordinary start-up may continue when individual files could not be
         // processed. Explicit Fetch and Rebuild flows retain the strict default.
-        const initialisationResult = await this.services.databaseEvents.initialiseDatabase(false, false, false, true);
+        const { ignoreSuspending = false, continueOnFileFailure = true } = this.core.startupDatabaseOptions;
+        const initialisationResult = await this.services.databaseEvents.initialiseDatabase(
+            false,
+            false,
+            ignoreSuspending,
+            continueOnFileFailure
+        );
         if (initialisationResult === VaultScanResults.FAILED) {
             this._log($msg("Ui.Common.LocalDatabaseInitialisationFailed"), LOG_LEVEL_NOTICE);
             //TODO:stop all sync.

src/modules/main/ModuleLiveSyncMain.unit.spec.ts

@@ -25,6 +25,7 @@ describe("ModuleLiveSyncMain", () => {
         const log = vi.fn();
         const host = {
             core: {
+                startupDatabaseOptions: {},
                 services: {
                     appLifecycle: {
                         onLayoutReady: vi.fn(async () => true),
@@ -58,6 +59,7 @@ describe("ModuleLiveSyncMain", () => {
         };
         const host = {
             core: {
+                startupDatabaseOptions: {},
                 services: { appLifecycle },
             },
             services: {
@@ -77,4 +79,33 @@ describe("ModuleLiveSyncMain", () => {
         expect(result).toBe(true);
         expect(log).toHaveBeenCalledWith("Ui.Common.SomeFilesCouldNotBeSynchronised", LOG_LEVEL_NOTICE);
     });
+
+    it("passes strict startup database options to initialisation", async () => {
+        const initialiseDatabase = vi.fn(async () => false);
+        const host = {
+            core: {
+                startupDatabaseOptions: {
+                    ignoreSuspending: true,
+                    continueOnFileFailure: false,
+                },
+                services: {
+                    appLifecycle: {
+                        onLayoutReady: vi.fn(async () => true),
+                    },
+                },
+            },
+            services: {
+                databaseEvents: { initialiseDatabase },
+            },
+            settings: {
+                suspendFileWatching: false,
+                suspendParseReplicationResult: false,
+            },
+            _log: vi.fn(),
+        };
+
+        await ModuleLiveSyncMain.prototype._onLiveSyncReady.call(host as never);
+
+        expect(initialiseDatabase).toHaveBeenCalledWith(false, false, true, false);
+    });
 });

src/serviceFeatures/setupObsidian/qrCode.ts

@@ -9,7 +9,8 @@ import { fireAndForget } from "@vrtmrz/livesync-commonlib/compat/common/utils";
 import type { SetupFeatureHost } from "./types";
 
 export async function encodeSetupSettingsAsQR(host: SetupFeatureHost) {
-    const settingString = encodeSettingsToQRCodeData(host.services.setting.currentSettings());
+    const settings = host.services.setting.currentSettings();
+    const settingString = encodeSettingsToQRCodeData(settings);
     const result = encodeQR(settingString, OutputFormat.SVG);
     if (result === "") {
         return "";

src/serviceFeatures/setupObsidian/qrCode.unit.spec.ts

@@ -3,6 +3,9 @@ import { EVENT_REQUEST_SHOW_SETUP_QR } from "@vrtmrz/livesync-commonlib/compat/e
 import { createServiceContext } from "@vrtmrz/livesync-commonlib/context";
 import { encodeSetupSettingsAsQR, useSetupQRCodeFeature } from "./qrCode";
 import { encodeQR, encodeSettingsToQRCodeData } from "@vrtmrz/livesync-commonlib/compat/API/processSetting";
+import { copySetupURI } from "./setupUri";
+
+vi.mock("./setupUri", () => ({ copySetupURI: vi.fn() }));
 
 vi.mock("@vrtmrz/livesync-commonlib/compat/API/processSetting", () => {
     return {
@@ -15,6 +18,32 @@ vi.mock("@vrtmrz/livesync-commonlib/compat/API/processSetting", () => {
 });
 
 describe("setupObsidian/qrCode", () => {
+    it("shows managed TURN settings and inactive profiles through the ordinary QR dialogue", async () => {
+        const settings = {
+            remoteConfigurations: {
+                managed: { uri: "sls+p2p://room?managedType=CF&managedId=turn-key&token=private-token" },
+            },
+        };
+        const confirmWithMessage = vi.fn();
+        const translate = vi.fn(() => "qr-message");
+        const host = {
+            services: {
+                API: { addLog: vi.fn() },
+                context: createServiceContext({ translate }),
+                setting: { currentSettings: () => settings },
+                UI: { confirm: { confirmWithMessage } },
+            },
+        } as any;
+        vi.mocked(encodeSettingsToQRCodeData).mockReturnValue("encoded-settings");
+        vi.mocked(encodeQR).mockReturnValue("<svg/>");
+
+        expect(await encodeSetupSettingsAsQR(host)).toBe("<svg/>");
+        expect(encodeSettingsToQRCodeData).toHaveBeenCalledWith(settings);
+        expect(translate).toHaveBeenCalledWith("Setup.QRCode", { qr_image: "<svg/>" });
+        expect(confirmWithMessage).toHaveBeenCalledWith("Settings QR Code", "qr-message", ["OK"], "OK");
+        expect(copySetupURI).not.toHaveBeenCalled();
+    });
+
     afterEach(() => {
         vi.restoreAllMocks();
         vi.clearAllMocks();

src/serviceFeatures/useP2PSettingsPreparation.ts

@@ -0,0 +1,18 @@
+import type { P2PSyncSetting } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { acquireCloudflareTurnCredentials, type CloudflareTurnFetch } from "@/integrations/cloudflare/turnCredentials";
+import { validateManagedTurnSettings } from "@/integrations/turnSettings";
+
+/** Prepare a connection copy using the host's HTTP adapter. */
+export function useP2PSettingsPreparation(fetch: CloudflareTurnFetch) {
+    return async (settings: Readonly<P2PSyncSetting>, signal: AbortSignal): Promise<P2PSyncSetting> => {
+        const error = validateManagedTurnSettings(settings);
+        if (error) throw new Error(error);
+        if (!settings.P2P_managedType) return { ...settings };
+        const { iceServers, expiresAt } = await acquireCloudflareTurnCredentials(
+            { turnKeyId: settings.P2P_managedId ?? "", apiToken: settings.P2P_managedToken ?? "" },
+            { fetch },
+            signal
+        );
+        return { ...settings, P2P_iceServers: iceServers, P2P_iceServersExpiresAt: expiresAt };
+    };
+}

src/serviceFeatures/useP2PSettingsPreparation.unit.spec.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it, vi } from "vitest";
+import { DEFAULT_SETTINGS } from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { useP2PSettingsPreparation } from "./useP2PSettingsPreparation";
+
+const managed = {
+    ...DEFAULT_SETTINGS,
+    P2P_managedType: "CF",
+    P2P_managedId: "key-123",
+    P2P_managedToken: "test-token",
+};
+
+describe("host preparation of P2P settings", () => {
+    it("puts issued ICE credentials on a connection copy without changing saved inputs", async () => {
+        const iceServers = [
+            { urls: ["turn:relay.example.test:3478"], username: "issued-user", credential: "issued-password" },
+        ];
+        const fetch = vi.fn(async () => new Response(JSON.stringify({ iceServers }), { status: 201 }));
+        const before = structuredClone(managed);
+        const settings = await useP2PSettingsPreparation(fetch)(managed, new AbortController().signal);
+        expect(settings.P2P_iceServers).toEqual(iceServers);
+        expect(settings.P2P_iceServersExpiresAt).toBeGreaterThan(Date.now());
+        expect(managed).toEqual(before);
+        expect(settings).not.toBe(managed);
+        expect(fetch).toHaveBeenCalledOnce();
+    });
+
+    it("keeps manual settings and rejects an unsupported provider without HTTP requests", async () => {
+        const fetch = vi.fn();
+        const prepare = useP2PSettingsPreparation(fetch);
+        await expect(prepare(DEFAULT_SETTINGS, new AbortController().signal)).resolves.toEqual(DEFAULT_SETTINGS);
+        await expect(prepare({ ...managed, P2P_managedType: "unknown" }, new AbortController().signal)).rejects.toThrow(
+            "not supported"
+        );
+        await expect(
+            prepare({ ...managed, P2P_managedToken: "invalid token" }, new AbortController().signal)
+        ).rejects.toThrow("Bearer token syntax");
+        expect(fetch).not.toHaveBeenCalled();
+    });
+
+    it("propagates a safe acquisition failure without using the manual TURN fields", async () => {
+        const fetch = vi.fn(async () => new Response(null, { status: 401 }));
+        const prepare = useP2PSettingsPreparation(fetch);
+        await expect(
+            prepare({ ...managed, P2P_turnServers: "turn:manual.example.test" }, new AbortController().signal)
+        ).rejects.toThrow("not authorised");
+        expect(fetch).toHaveBeenCalledOnce();
+    });
+});