frontend/apps/web, package @shm/web: Remix 2.17 on Node with Vite, React Query, the shared editor, Sentry, Tailwind. The server entry is app/entry.server.tsx, which loads .env first, then everything else. The catch-all route app/routes/$.tsx renders documents. app/routes/api.$.tsx is the Seed API. The app/routes/hm.api.* files are the site services. Run it with pnpm web against the desktop dev daemon, or pnpm web:standalone with its own daemon.

The server holds one gRPC-web client to DAEMON_HTTP_URL, the daemon's HTTP port. An interceptor adds Authorization: Bearer <token> when the current request carries one, so a signed-in browser can read private content it is allowed to see. Server-rendered loaders and the API both go through this client. The API also forwards the browser's own authorization header into every gRPC call it makes.

A bearer token the daemon rejects fails the request with a 401, even for public content. The page loader shows that as a server error. Clear the cookie if a site refuses to load after a key change.

Server-side rendering caches the responses of Query, QueryBlock, InteractionSummary and ListCitations for 30 seconds, 500 entries at most, in server-universal-client.ts. An entry holds the in-flight promise, so concurrent renders of one page share a single gRPC call. That client is never authenticated, so the cache only ever holds the public view. API responses to browsers carry Cache-Control: private, no-store, and there is no HTTP cache in front of the app. Citation lists and the counts in interaction summaries fetch one page of 500 citations and never more (listAllPages with maxPages in @shm/shared), because enumerating every citation of a heavily cited document held the daemon's read pool and took hyper.media down in August 2026. A document with more than 500 citations shows a truncated count until the daemon can report a count without enumerating.

A site is a daemon plus this app plus a JSON file. config.json in the data directory holds availableRegistrationSecret, and after registration also registeredAccountUid and sourcePeerId. The owner opens https://site/hm/register?secret=… and pastes the link into the desktop app's publish dialog. The desktop app posts to /hm/api/register. The site then connects to the desktop's peer and records the account. When the site and desktop share a daemon, as in local development, matching peer IDs skip the connection and resource push because the content is already local. A service-config.json variant serves several sites from one deployment with custom domains. Until registration, the site shows a "not registered" page. Sites explains the model, and Self-hosting walks through it.

Set SEED_IS_GATEWAY=true and the site becomes a gateway. A gateway serves canonical /hm/<account>/<path> URLs for any account. A normal site serves one registered space. hyper.media runs as a gateway.

Publishing a space to a domain

URLs explains versions, block fragments and view terms.

The loaders in app/loaders.ts resolve the URL to a document or comment, following redirects, then fill a React Query cache that the browser takes over without refetching. Each request gets its own QueryClient (app/queries.server.ts, staleTime: Infinity). The query definitions are shared with the apps in @shm/shared (models/queries.ts): queryResource, queryDirectory, queryAccount, queryQueryBlock, queryDocumentCollaborators and the rest each return a {queryKey, queryFn} that works for both prefetchQuery on the server and useQuery in a component. So the rule is simple: the server prefetches exactly the queries the components will ask for.

Prefetching runs in two waves of parallel Promise.allSettled calls, so one failure never breaks a page: first the document, the site home, both directories, the collaborators of the document and the home, and the breadcrumb documents; then, from the document's content, the payload of every query block, every embedded document and every author account. The cache is dehydrated into the loader data and restored in a HydrationBoundary. Anything missing is fetched by the browser on demand. Interaction summaries (comment and citation counts) are deliberately not prefetched: computing one enumerates every citation of the target, and prefetching thirty per page took hyper.media down on 2026-08-11. The browser fetches them for the cards on screen.

The document body itself is server-rendered as real editor markup by renderDocumentToHTML in @shm/editor/ssr-render. It converts the blocks exactly as the editor does at mount, serializes the ProseMirror document with the schema's own renderHTML through DOMSerializer in a happy-dom window, and renders the React node views (images, embeds, query blocks) with react-dom/server from the same prefetched cache. The result is cached per origin, document version and data fingerprint and injected with dangerouslySetInnerHTML. The page keeps that placeholder until the editor has mounted over it, then DocumentContentHandoff in @shm/ui lifts it two frames later, so the swap does not paint a blank frame. Because the markup is identical, read-only and editable views share one editor instance and switch without a remount.

Browser identities are Ed25519 keys generated with WebCrypto as non-extractable key pairs and stored in IndexedDB. A database migration dropped the older P-256 identities. A browser key does not own a space. It acts for an account held in the vault, through a delegated AGENT capability and a profile alias. This is the flow described in Sign in with Seed. Comments and document edits are built and signed in the browser with the SDK and posted through the PublishBlobs action. For private content the app also calls the daemon's authenticate RPC and keeps the resulting bearer token in an HTTP-only cookie.

The /hm/notifications page signs its requests in the browser with the session key and talks to the notify host that the vault callback named at sign-in, not to NOTIFY_SERVICE_HOST. Notify describes both the signed inbox and the older unsigned email subscribe form.

CLI

SDK

Web API

Agents