Energon is agent-native publishing for documents, prototypes, and working files, with direct human uploads and browser views built in. Agents publish, read, reference, and revise ordinary files across sessions and tools. Stable links serve current work, not revision history; source history, collaborative editing, and durable project knowledge stay in their purpose-built tools.

Use this glossary when moving between Energon’s user, operator, and contributor guides. Precise terms matter because “owner,” “share password,” and “token expiry” name different controls; treating them as synonyms can expose content or block the wrong writer. The definitions cover the stable product model. A live instance’s /v1/help response remains authoritative for configured names, limits, defaults, and lifetimes.

Glossary

Relationship map

Published content

Site
A named collection of public files under one stable handle-and-slug URL. The site exists in the D1 catalog even before it has paths.

Site file
One relative path inside a site. D1 stores its catalog metadata and R2 stores its bytes; a mutation is complete only when both agree.

Loose file
One standalone published object identified by a generated id. Its readable filename may change during PUT, but the id remains its identity.

Hub
The human-facing interface on the hub origin. In production, Cloudflare Access protects its setup, token, and account pages.

Hub origin (PUBLIC_ORIGIN)
The Worker hostname that serves the human hub and the /v1 API. Cloudflare Access authenticates human hub requests; API tokens authenticate /v1 requests.

Content origin (CONTENT_ORIGIN)
The distinct production hostname that serves published site and loose-file bytes. It does not serve hub account routes and must remain outside Cloudflare Access.

Public content URL (url)
The returned human-facing address on the content origin. It is open by default and may have a share-password gate.

Authenticated API URL (api_url)
The returned raw-byte address under /v1 on the hub origin. It requires a valid API token and does not apply the public share-password gate.

The two URL shapes look like this, but clients should keep the returned fields instead of constructing them:

CONTENT_ORIGIN/{handle}/s/{slug}/
CONTENT_ORIGIN/{handle}/f/{id}/{filename}
PUBLIC_ORIGIN/v1/files/{id}

Identity and access

Instance operator
The individual or organization that controls an instance’s Cloudflare account, deployment, D1 and R2 resources, identity policy, hostnames, and rendered agent skill.

Instance identity
The runtime tuple that tells an agent which host it is using: origin, plugin and marketplace coordinates, repository, token environment variable, and token prefix.

API token
A human-minted credential that lets an agent use /v1 as the owning account. Clients send it with Authorization: Bearer; the full secret is shown once, while Energon stores a hash and masked hint. An expired token cannot be renewed.

Token prefix
The instance-specific marker at the start of an API token. Minting, authentication, masked display, and agent documentation must agree on it.

Share password
An optional gate on one public content URL. It is not a named-user ACL and does not restrict reads by valid API tokens.

Write policy (write_policy)
The per-object mutation rule. owner permits only the creating account to PUT, PATCH, or DELETE; instance permits any valid API token on the host. Neither value restricts reads.

Handle
The public namespace derived from a human identity and snapshotted on content. Use returned URLs rather than guessing it from an email address.

Lifecycle and coordination

Content TTL
The lifetime of a site or loose file. Creation or a PATCH with ttl sets expiry; PUT changes bytes without extending it. Expired reads return 410 Gone even before cleanup finishes.

Token expiry
The independent lifetime chosen when a human mints an API token. Expiry returns terminal 401 token_expired; it does not delete content.

Write claim
A temporary leased D1 marker granting one loose-file mutation exclusive permission to coordinate its R2 and catalog change. An abandoned claim becomes reclaimable after it is stale.

Purge claim
A temporary D1 marker granting expiry cleanup exclusive permission to remove one expired object from R2 and the catalog without racing revival or replacement.

Schema bootstrap
Runtime creation of absent tables plus supported additive upgrades. It helps older instances start but does not replace migration history.

Legacy schema upgrade
The additive bootstrap path from a supported older database shape without rebuilding its persisted identity relationships.

Index phase
The final bootstrap stage, after all required tables and columns exist.

For the controls in context, read Security model and Sharing, access, and expiry. Architecture places claims and schema bootstrap in the system, while HTTP API is the route and field reference.