feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling

src/backend/hosts/delete-credential.ts

@@ -0,0 +1,56 @@
+import {
+  createCurrentCredentialRepository,
+  createCurrentHostRepository,
+  createCurrentHostResolutionRepository,
+} from "../database/repositories/factory.js";
+
+/**
+ * Deletes a credential the user owns: hosts using it fall back to password
+ * auth with no secret, and shares are re-snapshotted. Shared by the delete
+ * route and sync. Null when it does not exist or is not the user's.
+ */
+export async function deleteOwnedCredential(
+  userId: string,
+  credentialId: number,
+): Promise<{ name: string | null } | null> {
+  const credential =
+    await createCurrentCredentialRepository().findDecryptedByIdForUser(
+      userId,
+      credentialId,
+    );
+  if (!credential) return null;
+
+  const hostsUsingCredential =
+    await createCurrentHostResolutionRepository().listHostsUsingCredentialForUser(
+      userId,
+      credentialId,
+    );
+
+  if (hostsUsingCredential.length > 0) {
+    await createCurrentHostRepository().updateManyForUser(
+      userId,
+      hostsUsingCredential.map((host) => host.id),
+      {
+        credentialId: null,
+        password: null,
+        key: null,
+        keyPassword: null,
+        authType: "password",
+      },
+    );
+  }
+
+  const { SharedHostSecretsManager } =
+    await import("../utils/shared-host-secrets-manager.js");
+  const sharedSecretsManager = SharedHostSecretsManager.getInstance();
+  await sharedSecretsManager.deleteForCredential(credentialId);
+
+  await createCurrentCredentialRepository().deleteForUser(userId, credentialId);
+
+  // Shares stay in place; re-snapshot so recipients fall back to whatever
+  // auth the host still has (or lose the stale credential copy).
+  for (const host of hostsUsingCredential) {
+    await sharedSecretsManager.resyncHost(host.id);
+  }
+  return { name: (credential.name as string | null) ?? null };
+}

src/backend/hosts/delete-host.ts

@@ -4,7 +4,6 @@ import {
   createCurrentRbacAccessRepository,
   createCurrentRecentActivityRepository,
   createCurrentSshCredentialUsageRepository,
-  createCurrentSyncTombstoneRepository,
 } from "../database/repositories/factory.js";
 import { pluginEvents, TOPICS } from "../plugins/events.js";
 import { sshLogger } from "../utils/logger.js";
@@ -38,14 +37,6 @@ export async function deleteOwnedHost(
   await createCurrentRbacAccessRepository().deleteHostAccessForHost(hostId);
   await createCurrentHostRepository().deleteForUser(userId, hostId);
 
-  if (host.syncId) {
-    await createCurrentSyncTombstoneRepository().record(
-      userId,
-      "hosts",
-      host.syncId,
-    );
-  }
-
   const name = host.name ?? host.ip;
   emitInternalEvent("host_deleted", userId, hostId, { name });