@aigne/afs-did-space 1.12.0-beta.5

package/dist/share-resolve.mjs

@@ -0,0 +1,177 @@
+import { deriveSourcePath, isShareReservedPath, parseShareDeclaration } from "./share-declaration.mjs";
+
+//#region src/share-resolve.ts
+/**
+* Phase 0.4 — ShareResolver: storage-agnostic share reconcile orchestrator.
+*
+* Holds the reconcile BUSINESS LOGIC (YAML parse + schema validation, reserved
+* / forbidden / traversal path checks, sourcePath derivation, nested-share
+* detection, kind auto-detection, slug determination + conflict check) and
+* delegates ALL `shares` table access to an injected {@link ShareStore}. This
+* mirrors the repo's `DIDSpaceResolver + KeyValueStore` precedent — one
+* orchestrator, swappable backend (D1 / libsql), no adapter.
+*
+* Identity is owner-scoped: `(ownerDid, declPath)` is the composite key, so two
+* owners that share one D1 / one daemon-global `_shares.db` never clobber each
+* other (CRITICAL #1 fix). `slug` stays globally unique.
+*
+* Offline full rebuild (`reconcileAll`) is intentionally NOT here — see
+* `D1ShareReconciler` in d1-share-store.ts (D1-only, needs an ObjectStore).
+*/
+/** 21-character random ID using Web Crypto (base-36, no external deps). */
+function generateId() {
+	return Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(36).padStart(2, "0")).join("").slice(0, 21);
+}
+/** Paths under these prefixes are forbidden from having shares. */
+const FORBIDDEN_PREFIXES = ["config/", "vault/"];
+function isForbiddenPath(path) {
+	const p = path.startsWith("/") ? path.slice(1) : path;
+	return FORBIDDEN_PREFIXES.some((prefix) => p.startsWith(prefix));
+}
+function hasPathTraversal(path) {
+	return path.split("/").includes("..");
+}
+/** Returns true if the declPath is a sidecar (not root, not in-tree /.share). */
+function isSidecarPath(declPath) {
+	const p = declPath.startsWith("/") ? declPath.slice(1) : declPath;
+	return p !== ".share" && !p.endsWith("/.share");
+}
+var ShareResolver = class {
+	constructor(store, treeIndex) {
+		this.store = store;
+		this.treeIndex = treeIndex;
+	}
+	resolveBySlug(slug) {
+		return this.store.resolveBySlug(slug);
+	}
+	listByOwner(ownerDid) {
+		return this.store.listByOwner(ownerDid);
+	}
+	listByInstance(ownerDid, instanceDid) {
+		return this.store.listByInstance(ownerDid, instanceDid);
+	}
+	readShare(ownerDid, slug) {
+		return this.store.readByOwnerAndSlug(ownerDid, slug);
+	}
+	findByOwnerAndDeclPath(ownerDid, declPath) {
+		return this.store.findByOwnerAndDeclPath(ownerDid, declPath);
+	}
+	async reconcileFromDecl(params) {
+		const { declPath, declContent, declCid, ownerDid, dryRun = false } = params;
+		const parsed = parseShareDeclaration(declContent);
+		if (!parsed.ok) return parsed;
+		if (isShareReservedPath(declPath)) return {
+			ok: false,
+			code: "share-path-reserved",
+			message: `Path is reserved and cannot have a share declaration: ${declPath}`
+		};
+		if (isForbiddenPath(declPath)) return {
+			ok: false,
+			code: "share-path-forbidden",
+			message: `Path prefix is forbidden for share declarations: ${declPath}`
+		};
+		if (hasPathTraversal(declPath)) return {
+			ok: false,
+			code: "share-path-forbidden",
+			message: `Path traversal detected in declaration path: ${declPath}`
+		};
+		const sourcePath = deriveSourcePath(declPath);
+		const isSidecar = isSidecarPath(declPath);
+		if (sourcePath !== "") {
+			const nested = await this.store.findNestedConflict(ownerDid, declPath, sourcePath);
+			if (nested) return {
+				ok: false,
+				code: "share-nested",
+				message: `Share declaration conflicts with ${nested}`
+			};
+		}
+		if (isSidecar && this.treeIndex && sourcePath) {
+			if (!await this.treeIndex.get(sourcePath, { includeContent: false })) return {
+				ok: false,
+				code: "share-sidecar-target-missing",
+				message: `Sidecar target file not found: ${sourcePath}`
+			};
+		}
+		let resolvedKind;
+		if (parsed.data.kind) {
+			resolvedKind = parsed.data.kind;
+			if (resolvedKind === "web" && this.treeIndex) {
+				const webPrefix = sourcePath ? `${sourcePath}/.web/` : ".web/";
+				const { entries } = await this.treeIndex.list(webPrefix, { limit: 1 });
+				if (entries.length === 0) return {
+					ok: false,
+					code: "share-web-no-decl",
+					message: `kind:web requires a .web/ directory at ${webPrefix}`
+				};
+			}
+		} else if (isSidecar) resolvedKind = "raw";
+		else if (this.treeIndex) {
+			const webPrefix = sourcePath ? `${sourcePath}/.web/` : ".web/";
+			const { entries } = await this.treeIndex.list(webPrefix, { limit: 1 });
+			resolvedKind = entries.length > 0 ? "web" : "raw";
+		} else resolvedKind = "raw";
+		const existing = await this.store.findByOwnerAndDeclPath(ownerDid, declPath);
+		let slug;
+		if (parsed.data.slug) slug = parsed.data.slug;
+		else if (existing) slug = existing.slug;
+		else slug = generateId();
+		if (!existing || existing.slug !== slug) {
+			const conflicting = await this.store.findSlugConflict(slug, ownerDid, declPath);
+			if (conflicting) return {
+				ok: false,
+				code: "share-slug-conflict",
+				message: `Slug "${slug}" is already claimed by ${conflicting}`
+			};
+		}
+		const now = Date.now();
+		const id = existing?.id ?? generateId();
+		const status = parsed.data.status ?? "active";
+		if (dryRun) return {
+			ok: true,
+			entry: {
+				id,
+				ownerDid,
+				sourcePath,
+				declPath,
+				slug,
+				kind: resolvedKind,
+				status,
+				declCid,
+				config: parsed.data,
+				createdAt: existing?.createdAt ?? now,
+				updatedAt: now
+			}
+		};
+		const row = {
+			id,
+			owner_did: ownerDid,
+			source_path: sourcePath,
+			decl_path: declPath,
+			slug,
+			kind: resolvedKind,
+			status,
+			decl_cid: declCid,
+			config_json: JSON.stringify(parsed.data),
+			created_at: existing?.createdAt ?? now,
+			updated_at: now
+		};
+		await this.store.upsert(row);
+		const final = await this.store.findByOwnerAndDeclPath(ownerDid, declPath);
+		if (!final) return {
+			ok: false,
+			code: "share-internal-error",
+			message: "Failed to read back the upserted share row"
+		};
+		return {
+			ok: true,
+			entry: final
+		};
+	}
+	reconcileDelete(ownerDid, declPath) {
+		return this.store.deleteByOwnerAndDeclPath(ownerDid, declPath);
+	}
+};
+
+//#endregion
+export { ShareResolver };
+//# sourceMappingURL=share-resolve.mjs.map

package/dist/share-resolve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-resolve.mjs","names":[],"sources":["../src/share-resolve.ts"],"sourcesContent":["/**\n * Phase 0.4 — ShareResolver: storage-agnostic share reconcile orchestrator.\n *\n * Holds the reconcile BUSINESS LOGIC (YAML parse + schema validation, reserved\n * / forbidden / traversal path checks, sourcePath derivation, nested-share\n * detection, kind auto-detection, slug determination + conflict check) and\n * delegates ALL `shares` table access to an injected {@link ShareStore}. This\n * mirrors the repo's `DIDSpaceResolver + KeyValueStore` precedent — one\n * orchestrator, swappable backend (D1 / libsql), no adapter.\n *\n * Identity is owner-scoped: `(ownerDid, declPath)` is the composite key, so two\n * owners that share one D1 / one daemon-global `_shares.db` never clobber each\n * other (CRITICAL #1 fix). `slug` stays globally unique.\n *\n * Offline full rebuild (`reconcileAll`) is intentionally NOT here — see\n * `D1ShareReconciler` in d1-share-store.ts (D1-only, needs an ObjectStore).\n */\n\nimport {\n  deriveSourcePath,\n  isShareReservedPath,\n  parseShareDeclaration,\n} from \"./share-declaration.js\";\nimport type { ShareEntry, ShareRow, ShareStore } from \"./share-store.js\";\nimport type { TreeIndex } from \"./tree-index.js\";\n\nexport type { ShareEntry } from \"./share-store.js\";\n\n// ─── Helpers ──────────────────────────────────────────────────────────────────\n\n/** 21-character random ID using Web Crypto (base-36, no external deps). */\nfunction generateId(): string {\n  return Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) =>\n    b.toString(36).padStart(2, \"0\"),\n  )\n    .join(\"\")\n    .slice(0, 21);\n}\n\n/** Paths under these prefixes are forbidden from having shares. */\nconst FORBIDDEN_PREFIXES = [\"config/\", \"vault/\"];\n\nfunction isForbiddenPath(path: string): boolean {\n  const p = path.startsWith(\"/\") ? path.slice(1) : path;\n  return FORBIDDEN_PREFIXES.some((prefix) => p.startsWith(prefix));\n}\n\nfunction hasPathTraversal(path: string): boolean {\n  return path.split(\"/\").includes(\"..\");\n}\n\n/** Returns true if the declPath is a sidecar (not root, not in-tree /.share). */\nfunction isSidecarPath(declPath: string): boolean {\n  const p = declPath.startsWith(\"/\") ? declPath.slice(1) : declPath;\n  return p !== \".share\" && !p.endsWith(\"/.share\");\n}\n\ntype ReconcileOk = { ok: true; entry: ShareEntry };\ntype ReconcileFail = { ok: false; code: string; message: string; detail?: unknown };\ntype ReconcileResult = ReconcileOk | ReconcileFail;\n\n// ─── ShareResolver ────────────────────────────────────────────────────────────\n\nexport class ShareResolver {\n  constructor(\n    private store: ShareStore,\n    // treeIndex: optional — used only by reconcileFromDecl for .web/ + sidecar\n    // checks. Production write path MUST pass a treeIndex. Omitting is only\n    // valid for tests that don't exercise those checks. Widened from\n    // D1TreeIndex to the TreeIndex interface (only .get()/.list() are used) so\n    // the libsql SQLiteTreeIndex works unchanged.\n    private treeIndex?: TreeIndex,\n  ) {}\n\n  // ① Public serving hot path ─────────────────────────────────────────────────\n\n  resolveBySlug(slug: string): Promise<ShareEntry | null> {\n    return this.store.resolveBySlug(slug);\n  }\n\n  // ② Virtual path handlers ───────────────────────────────────────────────────\n\n  listByOwner(ownerDid: string): Promise<ShareEntry[]> {\n    return this.store.listByOwner(ownerDid);\n  }\n\n  listByInstance(ownerDid: string, instanceDid: string): Promise<ShareEntry[]> {\n    return this.store.listByInstance(ownerDid, instanceDid);\n  }\n\n  readShare(ownerDid: string, slug: string): Promise<ShareEntry | null> {\n    return this.store.readByOwnerAndSlug(ownerDid, slug);\n  }\n\n  findByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<ShareEntry | null> {\n    return this.store.findByOwnerAndDeclPath(ownerDid, declPath);\n  }\n\n  // ③ Internal upsert ─────────────────────────────────────────────────────────\n\n  async reconcileFromDecl(params: {\n    declPath: string;\n    declContent: Uint8Array;\n    declCid: string;\n    ownerDid: string;\n    dryRun?: boolean;\n  }): Promise<ReconcileResult> {\n    const { declPath, declContent, declCid, ownerDid, dryRun = false } = params;\n\n    // Step 1: YAML parse + schema validation\n    const parsed = parseShareDeclaration(declContent);\n    if (!parsed.ok) return parsed;\n\n    // Step 2: reserved path check (.shares/, instances/{iid}/.shares/)\n    if (isShareReservedPath(declPath)) {\n      return {\n        ok: false,\n        code: \"share-path-reserved\",\n        message: `Path is reserved and cannot have a share declaration: ${declPath}`,\n      };\n    }\n\n    // Step 3: blacklist prefix check (config/, vault/, ...)\n    if (isForbiddenPath(declPath)) {\n      return {\n        ok: false,\n        code: \"share-path-forbidden\",\n        message: `Path prefix is forbidden for share declarations: ${declPath}`,\n      };\n    }\n\n    // Step 4: path traversal check\n    if (hasPathTraversal(declPath)) {\n      return {\n        ok: false,\n        code: \"share-path-forbidden\",\n        message: `Path traversal detected in declaration path: ${declPath}`,\n      };\n    }\n\n    const sourcePath = deriveSourcePath(declPath);\n    const isSidecar = isSidecarPath(declPath);\n\n    // Step 5: nested share detection (skip for root share — sourcePath === \"\")\n    if (sourcePath !== \"\") {\n      const nested = await this.store.findNestedConflict(ownerDid, declPath, sourcePath);\n      if (nested) {\n        return {\n          ok: false,\n          code: \"share-nested\",\n          message: `Share declaration conflicts with ${nested}`,\n        };\n      }\n    }\n\n    // Step 6: sidecar target existence check\n    if (isSidecar && this.treeIndex && sourcePath) {\n      const target = await this.treeIndex.get(sourcePath, { includeContent: false });\n      if (!target) {\n        return {\n          ok: false,\n          code: \"share-sidecar-target-missing\",\n          message: `Sidecar target file not found: ${sourcePath}`,\n        };\n      }\n    }\n\n    // Step 6b / 7: kind detection + validation\n    let resolvedKind: \"raw\" | \"web\";\n\n    if (parsed.data.kind) {\n      resolvedKind = parsed.data.kind;\n      // Validate explicit kind:web — .web/ directory must exist\n      if (resolvedKind === \"web\" && this.treeIndex) {\n        const webPrefix = sourcePath ? `${sourcePath}/.web/` : \".web/\";\n        const { entries } = await this.treeIndex.list(webPrefix, { limit: 1 });\n        if (entries.length === 0) {\n          return {\n            ok: false,\n            code: \"share-web-no-decl\",\n            message: `kind:web requires a .web/ directory at ${webPrefix}`,\n          };\n        }\n      }\n    } else if (isSidecar) {\n      // Sidecar always defaults to raw\n      resolvedKind = \"raw\";\n    } else if (this.treeIndex) {\n      // in-tree: auto-detect from .web/ presence\n      const webPrefix = sourcePath ? `${sourcePath}/.web/` : \".web/\";\n      const { entries } = await this.treeIndex.list(webPrefix, { limit: 1 });\n      resolvedKind = entries.length > 0 ? \"web\" : \"raw\";\n    } else {\n      resolvedKind = \"raw\";\n    }\n\n    // Step 8: slug determination\n    const existing = await this.store.findByOwnerAndDeclPath(ownerDid, declPath);\n    let slug: string;\n\n    if (parsed.data.slug) {\n      slug = parsed.data.slug;\n    } else if (existing) {\n      slug = existing.slug; // preserve existing slug\n    } else {\n      slug = generateId(); // first write — generate\n    }\n\n    // Slug conflict check (only when the slug differs from the existing row).\n    // Excludes the row by IDENTITY (ownerDid, declPath) — never decl_path alone\n    // — so a sibling owner's same-decl_path row isn't wrongly excluded.\n    if (!existing || existing.slug !== slug) {\n      const conflicting = await this.store.findSlugConflict(slug, ownerDid, declPath);\n      if (conflicting) {\n        return {\n          ok: false,\n          code: \"share-slug-conflict\",\n          message: `Slug \"${slug}\" is already claimed by ${conflicting}`,\n        };\n      }\n    }\n\n    // Build the entry we would write\n    const now = Date.now();\n    const id = existing?.id ?? generateId();\n    const status = parsed.data.status ?? \"active\";\n\n    if (dryRun) {\n      // Return what would be written without touching the store\n      const entry: ShareEntry = {\n        id,\n        ownerDid,\n        sourcePath,\n        declPath,\n        slug,\n        kind: resolvedKind,\n        status,\n        declCid,\n        config: parsed.data,\n        createdAt: existing?.createdAt ?? now,\n        updatedAt: now,\n      };\n      return { ok: true, entry };\n    }\n\n    // Step 9: UPSERT — ON CONFLICT(owner_did, decl_path) keyed in the store so\n    // it never clobbers a sibling owner's row that owns a conflicting slug.\n    const row: ShareRow = {\n      id,\n      owner_did: ownerDid,\n      source_path: sourcePath,\n      decl_path: declPath,\n      slug,\n      kind: resolvedKind,\n      status,\n      decl_cid: declCid,\n      config_json: JSON.stringify(parsed.data),\n      created_at: existing?.createdAt ?? now,\n      updated_at: now,\n    };\n    await this.store.upsert(row);\n\n    // Read back the final row\n    const final = await this.store.findByOwnerAndDeclPath(ownerDid, declPath);\n    if (!final) {\n      return {\n        ok: false,\n        code: \"share-internal-error\",\n        message: \"Failed to read back the upserted share row\",\n      };\n    }\n\n    return { ok: true, entry: final };\n  }\n\n  reconcileDelete(ownerDid: string, declPath: string): Promise<void> {\n    return this.store.deleteByOwnerAndDeclPath(ownerDid, declPath);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,aAAqB;AAC5B,QAAO,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC,GAAG,MAC7D,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAChC,CACE,KAAK,GAAG,CACR,MAAM,GAAG,GAAG;;;AAIjB,MAAM,qBAAqB,CAAC,WAAW,SAAS;AAEhD,SAAS,gBAAgB,MAAuB;CAC9C,MAAM,IAAI,KAAK,WAAW,IAAI,GAAG,KAAK,MAAM,EAAE,GAAG;AACjD,QAAO,mBAAmB,MAAM,WAAW,EAAE,WAAW,OAAO,CAAC;;AAGlE,SAAS,iBAAiB,MAAuB;AAC/C,QAAO,KAAK,MAAM,IAAI,CAAC,SAAS,KAAK;;;AAIvC,SAAS,cAAc,UAA2B;CAChD,MAAM,IAAI,SAAS,WAAW,IAAI,GAAG,SAAS,MAAM,EAAE,GAAG;AACzD,QAAO,MAAM,YAAY,CAAC,EAAE,SAAS,UAAU;;AASjD,IAAa,gBAAb,MAA2B;CACzB,YACE,AAAQ,OAMR,AAAQ,WACR;EAPQ;EAMA;;CAKV,cAAc,MAA0C;AACtD,SAAO,KAAK,MAAM,cAAc,KAAK;;CAKvC,YAAY,UAAyC;AACnD,SAAO,KAAK,MAAM,YAAY,SAAS;;CAGzC,eAAe,UAAkB,aAA4C;AAC3E,SAAO,KAAK,MAAM,eAAe,UAAU,YAAY;;CAGzD,UAAU,UAAkB,MAA0C;AACpE,SAAO,KAAK,MAAM,mBAAmB,UAAU,KAAK;;CAGtD,uBAAuB,UAAkB,UAA8C;AACrF,SAAO,KAAK,MAAM,uBAAuB,UAAU,SAAS;;CAK9D,MAAM,kBAAkB,QAMK;EAC3B,MAAM,EAAE,UAAU,aAAa,SAAS,UAAU,SAAS,UAAU;EAGrE,MAAM,SAAS,sBAAsB,YAAY;AACjD,MAAI,CAAC,OAAO,GAAI,QAAO;AAGvB,MAAI,oBAAoB,SAAS,CAC/B,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS,yDAAyD;GACnE;AAIH,MAAI,gBAAgB,SAAS,CAC3B,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS,oDAAoD;GAC9D;AAIH,MAAI,iBAAiB,SAAS,CAC5B,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS,gDAAgD;GAC1D;EAGH,MAAM,aAAa,iBAAiB,SAAS;EAC7C,MAAM,YAAY,cAAc,SAAS;AAGzC,MAAI,eAAe,IAAI;GACrB,MAAM,SAAS,MAAM,KAAK,MAAM,mBAAmB,UAAU,UAAU,WAAW;AAClF,OAAI,OACF,QAAO;IACL,IAAI;IACJ,MAAM;IACN,SAAS,oCAAoC;IAC9C;;AAKL,MAAI,aAAa,KAAK,aAAa,YAEjC;OAAI,CADW,MAAM,KAAK,UAAU,IAAI,YAAY,EAAE,gBAAgB,OAAO,CAAC,CAE5E,QAAO;IACL,IAAI;IACJ,MAAM;IACN,SAAS,kCAAkC;IAC5C;;EAKL,IAAI;AAEJ,MAAI,OAAO,KAAK,MAAM;AACpB,kBAAe,OAAO,KAAK;AAE3B,OAAI,iBAAiB,SAAS,KAAK,WAAW;IAC5C,MAAM,YAAY,aAAa,GAAG,WAAW,UAAU;IACvD,MAAM,EAAE,YAAY,MAAM,KAAK,UAAU,KAAK,WAAW,EAAE,OAAO,GAAG,CAAC;AACtE,QAAI,QAAQ,WAAW,EACrB,QAAO;KACL,IAAI;KACJ,MAAM;KACN,SAAS,0CAA0C;KACpD;;aAGI,UAET,gBAAe;WACN,KAAK,WAAW;GAEzB,MAAM,YAAY,aAAa,GAAG,WAAW,UAAU;GACvD,MAAM,EAAE,YAAY,MAAM,KAAK,UAAU,KAAK,WAAW,EAAE,OAAO,GAAG,CAAC;AACtE,kBAAe,QAAQ,SAAS,IAAI,QAAQ;QAE5C,gBAAe;EAIjB,MAAM,WAAW,MAAM,KAAK,MAAM,uBAAuB,UAAU,SAAS;EAC5E,IAAI;AAEJ,MAAI,OAAO,KAAK,KACd,QAAO,OAAO,KAAK;WACV,SACT,QAAO,SAAS;MAEhB,QAAO,YAAY;AAMrB,MAAI,CAAC,YAAY,SAAS,SAAS,MAAM;GACvC,MAAM,cAAc,MAAM,KAAK,MAAM,iBAAiB,MAAM,UAAU,SAAS;AAC/E,OAAI,YACF,QAAO;IACL,IAAI;IACJ,MAAM;IACN,SAAS,SAAS,KAAK,0BAA0B;IAClD;;EAKL,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,KAAK,UAAU,MAAM,YAAY;EACvC,MAAM,SAAS,OAAO,KAAK,UAAU;AAErC,MAAI,OAeF,QAAO;GAAE,IAAI;GAAM,OAbO;IACxB;IACA;IACA;IACA;IACA;IACA,MAAM;IACN;IACA;IACA,QAAQ,OAAO;IACf,WAAW,UAAU,aAAa;IAClC,WAAW;IACZ;GACyB;EAK5B,MAAM,MAAgB;GACpB;GACA,WAAW;GACX,aAAa;GACb,WAAW;GACX;GACA,MAAM;GACN;GACA,UAAU;GACV,aAAa,KAAK,UAAU,OAAO,KAAK;GACxC,YAAY,UAAU,aAAa;GACnC,YAAY;GACb;AACD,QAAM,KAAK,MAAM,OAAO,IAAI;EAG5B,MAAM,QAAQ,MAAM,KAAK,MAAM,uBAAuB,UAAU,SAAS;AACzE,MAAI,CAAC,MACH,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS;GACV;AAGH,SAAO;GAAE,IAAI;GAAM,OAAO;GAAO;;CAGnC,gBAAgB,UAAkB,UAAiC;AACjE,SAAO,KAAK,MAAM,yBAAyB,UAAU,SAAS"}

package/dist/share-serve.cjs

@@ -0,0 +1,145 @@
+const require_rolldown_runtime = require('./_virtual/rolldown_runtime.cjs');
+require('./mime-utils.cjs');
+const require_share_declaration = require('./share-declaration.cjs');
+let _aigne_afs = require("@aigne/afs");
+let ufo = require("ufo");
+let _aigne_afs_provider_utils = require("@aigne/afs-provider-utils");
+
+//#region src/share-serve.ts
+/**
+* Phase 4.1 — serveShare: runtime-agnostic public serving of `kind:"raw"` shares.
+*
+* `GET /s/{slug}/{subPath}` content serving as a pure-AFS function. Both runtimes
+* register a reserved `/s/` route and call this with a runtime-specific
+* `buildScopedAFS` (CF: D1TreeIndex + R2; Node: the owner DIDSpace's
+* SQLiteTreeIndex + FsObjectStore). Everything else — slug lookup, revoked/web
+* handling, `.share` blocking, the sidecar vs directory/root split, the
+* index.html / SPA fallback lookup order, mime/etag/cache headers — lives here
+* so the two runtimes never fork it (design §serving 逻辑单一来源).
+*
+* Decoupled from any runtime binding.
+*
+* Security (sealed here, not per-runtime):
+*   - revoked === nonexistent → 404 (no existence leak).
+*   - `.share` / `*.share` declaration files are never served (404).
+*   - reads are scoped by the caller's `buildScopedAFS` to the share subtree
+*     (PrefixedTreeIndex with a trailing slash) — no escape to sibling paths.
+*   - Content-Type is ALWAYS detectMimeType(path), never trusted storage
+*     metadata (MIME-sniff defense).
+*/
+/** True for fingerprinted immutable assets: `[.-][0-9a-f]{8,}.(js|css|woff2?|ttf|eot)`. */
+function isImmutableAsset(path) {
+	return /[.-][0-9a-f]{8,}\.(js|css|woff2?|ttf|eot)$/.test(path);
+}
+/** Sidecar = declPath ends with ".share" but is neither bare ".share" nor a "/.share". */
+function isSidecarShare(declPath) {
+	const p = declPath.startsWith("/") ? declPath.slice(1) : declPath;
+	return p !== ".share" && p.endsWith(".share") && !p.endsWith("/.share");
+}
+async function serveShare(opts) {
+	const { lookup, buildScopedAFS, slug, subPath: rawSubPath, request } = opts;
+	if (!slug) return new Response("Not Found", { status: 404 });
+	const share = await lookup.resolveBySlug(slug);
+	if (!share || share.status !== "active") return new Response("Not Found", { status: 404 });
+	if (share.kind === "web") return new Response("Share not yet rendered", {
+		status: 503,
+		headers: {
+			"X-Share-State": "rendering-pending",
+			"Retry-After": "30"
+		}
+	});
+	const subPath = (0, ufo.cleanDoubleSlashes)(`/${(0, ufo.withoutLeadingSlash)(rawSubPath)}`);
+	if (require_share_declaration.isShareDeclarationPath(subPath)) return new Response("Not Found", { status: 404 });
+	if (isSidecarShare(share.declPath)) return serveRaw(await buildScopedAFS({
+		ownerDid: share.ownerDid,
+		prefix: null
+	}), `/${share.sourcePath}`, request);
+	const prefix = share.sourcePath ? `${share.sourcePath}/` : null;
+	return serveRaw(await buildScopedAFS({
+		ownerDid: share.ownerDid,
+		prefix
+	}), subPath, request);
+}
+/**
+* Serve a file from a readonly AFS. Lookup order:
+*   1. subPath directly
+*   2. subPath/index.html
+*   3. SPA fallback: /index.html at root
+*   4. 404
+*/
+async function serveRaw(afs, subPath, request) {
+	const readEntry = async (path) => {
+		try {
+			const entry = (await afs.read(path)).data;
+			if (!entry) return null;
+			if (entry.meta?.kind === "did-space:directory" || entry.meta?.kind === "did-space:root") return null;
+			return entry;
+		} catch (err) {
+			if (err instanceof _aigne_afs.AFSNotFoundError) return null;
+			throw err;
+		}
+	};
+	try {
+		const entry = subPath === "/" ? null : await readEntry(subPath);
+		if (entry) return buildShareResponse(entry, subPath, request);
+		const indexPath = subPath === "/" ? "/index.html" : (0, ufo.cleanDoubleSlashes)(`${subPath}/index.html`);
+		const indexEntry = await readEntry(indexPath);
+		if (indexEntry) return buildShareResponse(indexEntry, indexPath, request);
+		if (subPath !== "/" && indexPath !== "/index.html") {
+			const spaEntry = await readEntry("/index.html");
+			if (spaEntry) return buildShareResponse(spaEntry, "/index.html", request);
+		}
+		return new Response("Not Found", { status: 404 });
+	} catch {
+		return new Response("Internal Server Error", { status: 500 });
+	}
+}
+/**
+* Build the 200/304 Response for a read file entry.
+*   - ETag = WEAK validator `W/"<cid>"`; If-None-Match match → 304.
+*   - Cache-Control: immutable for fingerprinted assets, else max-age=300.
+*   - Content-Type ALWAYS from detectMimeType(path); X-Content-Type-Options:nosniff.
+*
+* WHY WEAK: a CDN (Cloudflare) may compress a compressible 200 body (html/js/css)
+* and STRIPS a strong validator in the process — the strong ETag never reaches
+* the browser, so it never revalidates and the 304 path is dead. A weak ETag
+* survives compression (it only asserts semantic, not byte, equivalence), which
+* is exactly right for content-addressed serving: the CID identifies the content
+* regardless of transfer encoding. (Verified on staging: strong ETag was stripped
+* from text/html but kept on image/png; weak survives both.)
+*/
+function buildShareResponse(entry, targetPath, request) {
+	const cid = entry.meta?.cid;
+	const etag = cid ? `W/"${cid}"` : void 0;
+	const cacheControl = isImmutableAsset(targetPath) ? "public, max-age=31536000, immutable" : "public, max-age=300";
+	if (etag) {
+		const ifNoneMatch = request.headers.get("If-None-Match");
+		const bareTag = (t) => t.replace(/^W\//, "");
+		if (ifNoneMatch && bareTag(ifNoneMatch) === bareTag(etag)) return new Response(null, {
+			status: 304,
+			headers: {
+				ETag: etag,
+				"Cache-Control": cacheControl
+			}
+		});
+	}
+	const content = entry.content;
+	const mimeType = (0, _aigne_afs_provider_utils.detectMimeType)(targetPath) || "application/octet-stream";
+	const headers = new Headers();
+	headers.set("Content-Type", mimeType);
+	headers.set("Cache-Control", cacheControl);
+	headers.set("X-Content-Type-Options", "nosniff");
+	if (etag) headers.set("ETag", etag);
+	if (content instanceof ArrayBuffer || content instanceof Uint8Array) return new Response(content, {
+		status: 200,
+		headers
+	});
+	if (typeof content === "string") return new Response(content, {
+		status: 200,
+		headers
+	});
+	return new Response("Not Found", { status: 404 });
+}
+
+//#endregion
+exports.serveShare = serveShare;

package/dist/share-serve.d.cts

@@ -0,0 +1,30 @@
+import { ShareEntry } from "./share-store.cjs";
+import { AFS } from "@aigne/afs";
+
+//#region src/share-serve.d.ts
+/** Minimal slug → share lookup — satisfied by ShareResolver AND any ShareStore. */
+interface ShareLookup {
+  resolveBySlug(slug: string): Promise<ShareEntry | null>;
+}
+/**
+ * Runtime-injected: build a READONLY AFS for `ownerDid`, scoped under `prefix`
+ * (with trailing slash) or — when `prefix` is null — over the owner's whole
+ * tree. The three-state separator contract (design H3) is handled by serveShare
+ * deciding the prefix; the runtime only wires the storage primitives.
+ */
+type BuildScopedAFS = (args: {
+  ownerDid: string;
+  prefix: string | null;
+}) => Promise<AFS> | AFS;
+interface ServeShareOptions {
+  lookup: ShareLookup;
+  buildScopedAFS: BuildScopedAFS;
+  slug: string;
+  /** Raw subpath after `/s/{slug}` (may be "" or "/..."). */
+  subPath: string;
+  request: Request;
+}
+declare function serveShare(opts: ServeShareOptions): Promise<Response>;
+//#endregion
+export { BuildScopedAFS, ServeShareOptions, ShareLookup, serveShare };
+//# sourceMappingURL=share-serve.d.cts.map

package/dist/share-serve.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-serve.d.cts","names":[],"sources":["../src/share-serve.ts"],"mappings":";;;;;UA6BiB,WAAA;EACf,aAAA,CAAc,IAAA,WAAe,OAAA,CAAQ,UAAA;AAAA;;;;AAcvC;;;KALY,cAAA,IAAkB,IAAA;EAC5B,QAAA;EACA,MAAA;AAAA,MACI,OAAA,CAAQ,GAAA,IAAO,GAAA;AAAA,UAEJ,iBAAA;EACf,MAAA,EAAQ,WAAA;EACR,cAAA,EAAgB,cAAA;EAChB,IAAA;EADgB;EAGhB,OAAA;EACA,OAAA,EAAS,OAAA;AAAA;AAAA,iBAcW,UAAA,CAAW,IAAA,EAAM,iBAAA,GAAoB,OAAA,CAAQ,QAAA"}

package/dist/share-serve.d.mts

@@ -0,0 +1,30 @@
+import { ShareEntry } from "./share-store.mjs";
+import { AFS } from "@aigne/afs";
+
+//#region src/share-serve.d.ts
+/** Minimal slug → share lookup — satisfied by ShareResolver AND any ShareStore. */
+interface ShareLookup {
+  resolveBySlug(slug: string): Promise<ShareEntry | null>;
+}
+/**
+ * Runtime-injected: build a READONLY AFS for `ownerDid`, scoped under `prefix`
+ * (with trailing slash) or — when `prefix` is null — over the owner's whole
+ * tree. The three-state separator contract (design H3) is handled by serveShare
+ * deciding the prefix; the runtime only wires the storage primitives.
+ */
+type BuildScopedAFS = (args: {
+  ownerDid: string;
+  prefix: string | null;
+}) => Promise<AFS> | AFS;
+interface ServeShareOptions {
+  lookup: ShareLookup;
+  buildScopedAFS: BuildScopedAFS;
+  slug: string;
+  /** Raw subpath after `/s/{slug}` (may be "" or "/..."). */
+  subPath: string;
+  request: Request;
+}
+declare function serveShare(opts: ServeShareOptions): Promise<Response>;
+//#endregion
+export { BuildScopedAFS, ServeShareOptions, ShareLookup, serveShare };
+//# sourceMappingURL=share-serve.d.mts.map

package/dist/share-serve.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-serve.d.mts","names":[],"sources":["../src/share-serve.ts"],"mappings":";;;;;UA6BiB,WAAA;EACf,aAAA,CAAc,IAAA,WAAe,OAAA,CAAQ,UAAA;AAAA;;;;AAcvC;;;KALY,cAAA,IAAkB,IAAA;EAC5B,QAAA;EACA,MAAA;AAAA,MACI,OAAA,CAAQ,GAAA,IAAO,GAAA;AAAA,UAEJ,iBAAA;EACf,MAAA,EAAQ,WAAA;EACR,cAAA,EAAgB,cAAA;EAChB,IAAA;EADgB;EAGhB,OAAA;EACA,OAAA,EAAS,OAAA;AAAA;AAAA,iBAcW,UAAA,CAAW,IAAA,EAAM,iBAAA,GAAoB,OAAA,CAAQ,QAAA"}

package/dist/share-serve.mjs

@@ -0,0 +1,144 @@
+import { detectMimeType } from "./mime-utils.mjs";
+import { isShareDeclarationPath } from "./share-declaration.mjs";
+import { AFSNotFoundError } from "@aigne/afs";
+import { cleanDoubleSlashes, withoutLeadingSlash } from "ufo";
+
+//#region src/share-serve.ts
+/**
+* Phase 4.1 — serveShare: runtime-agnostic public serving of `kind:"raw"` shares.
+*
+* `GET /s/{slug}/{subPath}` content serving as a pure-AFS function. Both runtimes
+* register a reserved `/s/` route and call this with a runtime-specific
+* `buildScopedAFS` (CF: D1TreeIndex + R2; Node: the owner DIDSpace's
+* SQLiteTreeIndex + FsObjectStore). Everything else — slug lookup, revoked/web
+* handling, `.share` blocking, the sidecar vs directory/root split, the
+* index.html / SPA fallback lookup order, mime/etag/cache headers — lives here
+* so the two runtimes never fork it (design §serving 逻辑单一来源).
+*
+* Decoupled from any runtime binding.
+*
+* Security (sealed here, not per-runtime):
+*   - revoked === nonexistent → 404 (no existence leak).
+*   - `.share` / `*.share` declaration files are never served (404).
+*   - reads are scoped by the caller's `buildScopedAFS` to the share subtree
+*     (PrefixedTreeIndex with a trailing slash) — no escape to sibling paths.
+*   - Content-Type is ALWAYS detectMimeType(path), never trusted storage
+*     metadata (MIME-sniff defense).
+*/
+/** True for fingerprinted immutable assets: `[.-][0-9a-f]{8,}.(js|css|woff2?|ttf|eot)`. */
+function isImmutableAsset(path) {
+	return /[.-][0-9a-f]{8,}\.(js|css|woff2?|ttf|eot)$/.test(path);
+}
+/** Sidecar = declPath ends with ".share" but is neither bare ".share" nor a "/.share". */
+function isSidecarShare(declPath) {
+	const p = declPath.startsWith("/") ? declPath.slice(1) : declPath;
+	return p !== ".share" && p.endsWith(".share") && !p.endsWith("/.share");
+}
+async function serveShare(opts) {
+	const { lookup, buildScopedAFS, slug, subPath: rawSubPath, request } = opts;
+	if (!slug) return new Response("Not Found", { status: 404 });
+	const share = await lookup.resolveBySlug(slug);
+	if (!share || share.status !== "active") return new Response("Not Found", { status: 404 });
+	if (share.kind === "web") return new Response("Share not yet rendered", {
+		status: 503,
+		headers: {
+			"X-Share-State": "rendering-pending",
+			"Retry-After": "30"
+		}
+	});
+	const subPath = cleanDoubleSlashes(`/${withoutLeadingSlash(rawSubPath)}`);
+	if (isShareDeclarationPath(subPath)) return new Response("Not Found", { status: 404 });
+	if (isSidecarShare(share.declPath)) return serveRaw(await buildScopedAFS({
+		ownerDid: share.ownerDid,
+		prefix: null
+	}), `/${share.sourcePath}`, request);
+	const prefix = share.sourcePath ? `${share.sourcePath}/` : null;
+	return serveRaw(await buildScopedAFS({
+		ownerDid: share.ownerDid,
+		prefix
+	}), subPath, request);
+}
+/**
+* Serve a file from a readonly AFS. Lookup order:
+*   1. subPath directly
+*   2. subPath/index.html
+*   3. SPA fallback: /index.html at root
+*   4. 404
+*/
+async function serveRaw(afs, subPath, request) {
+	const readEntry = async (path) => {
+		try {
+			const entry = (await afs.read(path)).data;
+			if (!entry) return null;
+			if (entry.meta?.kind === "did-space:directory" || entry.meta?.kind === "did-space:root") return null;
+			return entry;
+		} catch (err) {
+			if (err instanceof AFSNotFoundError) return null;
+			throw err;
+		}
+	};
+	try {
+		const entry = subPath === "/" ? null : await readEntry(subPath);
+		if (entry) return buildShareResponse(entry, subPath, request);
+		const indexPath = subPath === "/" ? "/index.html" : cleanDoubleSlashes(`${subPath}/index.html`);
+		const indexEntry = await readEntry(indexPath);
+		if (indexEntry) return buildShareResponse(indexEntry, indexPath, request);
+		if (subPath !== "/" && indexPath !== "/index.html") {
+			const spaEntry = await readEntry("/index.html");
+			if (spaEntry) return buildShareResponse(spaEntry, "/index.html", request);
+		}
+		return new Response("Not Found", { status: 404 });
+	} catch {
+		return new Response("Internal Server Error", { status: 500 });
+	}
+}
+/**
+* Build the 200/304 Response for a read file entry.
+*   - ETag = WEAK validator `W/"<cid>"`; If-None-Match match → 304.
+*   - Cache-Control: immutable for fingerprinted assets, else max-age=300.
+*   - Content-Type ALWAYS from detectMimeType(path); X-Content-Type-Options:nosniff.
+*
+* WHY WEAK: a CDN (Cloudflare) may compress a compressible 200 body (html/js/css)
+* and STRIPS a strong validator in the process — the strong ETag never reaches
+* the browser, so it never revalidates and the 304 path is dead. A weak ETag
+* survives compression (it only asserts semantic, not byte, equivalence), which
+* is exactly right for content-addressed serving: the CID identifies the content
+* regardless of transfer encoding. (Verified on staging: strong ETag was stripped
+* from text/html but kept on image/png; weak survives both.)
+*/
+function buildShareResponse(entry, targetPath, request) {
+	const cid = entry.meta?.cid;
+	const etag = cid ? `W/"${cid}"` : void 0;
+	const cacheControl = isImmutableAsset(targetPath) ? "public, max-age=31536000, immutable" : "public, max-age=300";
+	if (etag) {
+		const ifNoneMatch = request.headers.get("If-None-Match");
+		const bareTag = (t) => t.replace(/^W\//, "");
+		if (ifNoneMatch && bareTag(ifNoneMatch) === bareTag(etag)) return new Response(null, {
+			status: 304,
+			headers: {
+				ETag: etag,
+				"Cache-Control": cacheControl
+			}
+		});
+	}
+	const content = entry.content;
+	const mimeType = detectMimeType(targetPath) || "application/octet-stream";
+	const headers = new Headers();
+	headers.set("Content-Type", mimeType);
+	headers.set("Cache-Control", cacheControl);
+	headers.set("X-Content-Type-Options", "nosniff");
+	if (etag) headers.set("ETag", etag);
+	if (content instanceof ArrayBuffer || content instanceof Uint8Array) return new Response(content, {
+		status: 200,
+		headers
+	});
+	if (typeof content === "string") return new Response(content, {
+		status: 200,
+		headers
+	});
+	return new Response("Not Found", { status: 404 });
+}
+
+//#endregion
+export { serveShare };
+//# sourceMappingURL=share-serve.mjs.map

package/dist/share-serve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-serve.mjs","names":[],"sources":["../src/share-serve.ts"],"sourcesContent":["/**\n * Phase 4.1 — serveShare: runtime-agnostic public serving of `kind:\"raw\"` shares.\n *\n * `GET /s/{slug}/{subPath}` content serving as a pure-AFS function. Both runtimes\n * register a reserved `/s/` route and call this with a runtime-specific\n * `buildScopedAFS` (CF: D1TreeIndex + R2; Node: the owner DIDSpace's\n * SQLiteTreeIndex + FsObjectStore). Everything else — slug lookup, revoked/web\n * handling, `.share` blocking, the sidecar vs directory/root split, the\n * index.html / SPA fallback lookup order, mime/etag/cache headers — lives here\n * so the two runtimes never fork it (design §serving 逻辑单一来源).\n *\n * Decoupled from any runtime binding.\n *\n * Security (sealed here, not per-runtime):\n *   - revoked === nonexistent → 404 (no existence leak).\n *   - `.share` / `*.share` declaration files are never served (404).\n *   - reads are scoped by the caller's `buildScopedAFS` to the share subtree\n *     (PrefixedTreeIndex with a trailing slash) — no escape to sibling paths.\n *   - Content-Type is ALWAYS detectMimeType(path), never trusted storage\n *     metadata (MIME-sniff defense).\n */\n\nimport { type AFS, type AFSEntry, AFSNotFoundError } from \"@aigne/afs\";\nimport { cleanDoubleSlashes, withoutLeadingSlash } from \"ufo\";\nimport { detectMimeType } from \"./mime-utils.js\";\nimport { isShareDeclarationPath } from \"./share-declaration.js\";\nimport type { ShareEntry } from \"./share-store.js\";\n\n/** Minimal slug → share lookup — satisfied by ShareResolver AND any ShareStore. */\nexport interface ShareLookup {\n  resolveBySlug(slug: string): Promise<ShareEntry | null>;\n}\n\n/**\n * Runtime-injected: build a READONLY AFS for `ownerDid`, scoped under `prefix`\n * (with trailing slash) or — when `prefix` is null — over the owner's whole\n * tree. The three-state separator contract (design H3) is handled by serveShare\n * deciding the prefix; the runtime only wires the storage primitives.\n */\nexport type BuildScopedAFS = (args: {\n  ownerDid: string;\n  prefix: string | null;\n}) => Promise<AFS> | AFS;\n\nexport interface ServeShareOptions {\n  lookup: ShareLookup;\n  buildScopedAFS: BuildScopedAFS;\n  slug: string;\n  /** Raw subpath after `/s/{slug}` (may be \"\" or \"/...\"). */\n  subPath: string;\n  request: Request;\n}\n\n/** True for fingerprinted immutable assets: `[.-][0-9a-f]{8,}.(js|css|woff2?|ttf|eot)`. */\nfunction isImmutableAsset(path: string): boolean {\n  return /[.-][0-9a-f]{8,}\\.(js|css|woff2?|ttf|eot)$/.test(path);\n}\n\n/** Sidecar = declPath ends with \".share\" but is neither bare \".share\" nor a \"/.share\". */\nfunction isSidecarShare(declPath: string): boolean {\n  const p = declPath.startsWith(\"/\") ? declPath.slice(1) : declPath;\n  return p !== \".share\" && p.endsWith(\".share\") && !p.endsWith(\"/.share\");\n}\n\nexport async function serveShare(opts: ServeShareOptions): Promise<Response> {\n  const { lookup, buildScopedAFS, slug, subPath: rawSubPath, request } = opts;\n\n  if (!slug) return new Response(\"Not Found\", { status: 404 });\n\n  const share = await lookup.resolveBySlug(slug);\n  // Revoked === nonexistent — no existence leakage.\n  if (!share || share.status !== \"active\") {\n    return new Response(\"Not Found\", { status: 404 });\n  }\n\n  if (share.kind === \"web\") {\n    // kind:web rendering pipeline is a separate project — stub for now.\n    return new Response(\"Share not yet rendered\", {\n      status: 503,\n      headers: { \"X-Share-State\": \"rendering-pending\", \"Retry-After\": \"30\" },\n    });\n  }\n\n  const subPath = cleanDoubleSlashes(`/${withoutLeadingSlash(rawSubPath)}`);\n\n  // Block \"/.share\", \"dir/.share\", and \"file.pdf.share\" from ever being served.\n  if (isShareDeclarationPath(subPath)) {\n    return new Response(\"Not Found\", { status: 404 });\n  }\n\n  // Three-state (design H3):\n  //   sidecar       → whole-owner tree (prefix null), serve sourcePath, ignore subPath\n  //   directory      → PrefixedTreeIndex(base, `${sourcePath}/`), serve subPath\n  //   root (src=\"\")  → whole-owner tree (prefix null), serve subPath\n  if (isSidecarShare(share.declPath)) {\n    const afs = await buildScopedAFS({ ownerDid: share.ownerDid, prefix: null });\n    return serveRaw(afs, `/${share.sourcePath}`, request);\n  }\n\n  const prefix = share.sourcePath ? `${share.sourcePath}/` : null;\n  const afs = await buildScopedAFS({ ownerDid: share.ownerDid, prefix });\n  return serveRaw(afs, subPath, request);\n}\n\n/**\n * Serve a file from a readonly AFS. Lookup order:\n *   1. subPath directly\n *   2. subPath/index.html\n *   3. SPA fallback: /index.html at root\n *   4. 404\n */\nasync function serveRaw(afs: AFS, subPath: string, request: Request): Promise<Response> {\n  const readEntry = async (path: string): Promise<AFSEntry | null> => {\n    try {\n      const result = await afs.read(path);\n      const entry = result.data;\n      if (!entry) return null;\n      // Directories return descriptive string content — not a file to serve.\n      if (entry.meta?.kind === \"did-space:directory\" || entry.meta?.kind === \"did-space:root\") {\n        return null;\n      }\n      return entry;\n    } catch (err) {\n      if (err instanceof AFSNotFoundError) return null;\n      throw err;\n    }\n  };\n\n  try {\n    // `subPath === \"/\"` is always the share's directory ROOT — a read there can\n    // only ever return the root/directory descriptor (never a servable file),\n    // so skip that round-trip (a wasted D1 COUNT in the did-space provider) and\n    // go straight to index.html.\n    const entry = subPath === \"/\" ? null : await readEntry(subPath);\n    if (entry) return buildShareResponse(entry, subPath, request);\n\n    const indexPath = subPath === \"/\" ? \"/index.html\" : cleanDoubleSlashes(`${subPath}/index.html`);\n    const indexEntry = await readEntry(indexPath);\n    if (indexEntry) return buildShareResponse(indexEntry, indexPath, request);\n\n    if (subPath !== \"/\" && indexPath !== \"/index.html\") {\n      const spaEntry = await readEntry(\"/index.html\");\n      if (spaEntry) return buildShareResponse(spaEntry, \"/index.html\", request);\n    }\n\n    return new Response(\"Not Found\", { status: 404 });\n  } catch {\n    return new Response(\"Internal Server Error\", { status: 500 });\n  }\n}\n\n/**\n * Build the 200/304 Response for a read file entry.\n *   - ETag = WEAK validator `W/\"<cid>\"`; If-None-Match match → 304.\n *   - Cache-Control: immutable for fingerprinted assets, else max-age=300.\n *   - Content-Type ALWAYS from detectMimeType(path); X-Content-Type-Options:nosniff.\n *\n * WHY WEAK: a CDN (Cloudflare) may compress a compressible 200 body (html/js/css)\n * and STRIPS a strong validator in the process — the strong ETag never reaches\n * the browser, so it never revalidates and the 304 path is dead. A weak ETag\n * survives compression (it only asserts semantic, not byte, equivalence), which\n * is exactly right for content-addressed serving: the CID identifies the content\n * regardless of transfer encoding. (Verified on staging: strong ETag was stripped\n * from text/html but kept on image/png; weak survives both.)\n */\nfunction buildShareResponse(entry: AFSEntry, targetPath: string, request: Request): Response {\n  const cid = entry.meta?.cid as string | undefined;\n  const etag = cid ? `W/\"${cid}\"` : undefined;\n  const cacheControl = isImmutableAsset(targetPath)\n    ? \"public, max-age=31536000, immutable\"\n    : \"public, max-age=300\";\n\n  if (etag) {\n    // RFC 7232 §3.2: If-None-Match uses the WEAK comparison function, so match\n    // on the opaque-tag value regardless of the `W/` prefix on either side (a\n    // client that cached a strong form, or echoes the weak form, both hit).\n    const ifNoneMatch = request.headers.get(\"If-None-Match\");\n    const bareTag = (t: string) => t.replace(/^W\\//, \"\");\n    if (ifNoneMatch && bareTag(ifNoneMatch) === bareTag(etag)) {\n      return new Response(null, {\n        status: 304,\n        headers: { ETag: etag, \"Cache-Control\": cacheControl },\n      });\n    }\n  }\n\n  const content = entry.content;\n  // detectMimeType(path) wins over stored metadata (MIME-sniff defense).\n  const mimeType = detectMimeType(targetPath) || \"application/octet-stream\";\n\n  const headers = new Headers();\n  headers.set(\"Content-Type\", mimeType);\n  headers.set(\"Cache-Control\", cacheControl);\n  headers.set(\"X-Content-Type-Options\", \"nosniff\");\n  if (etag) headers.set(\"ETag\", etag);\n\n  if (content instanceof ArrayBuffer || content instanceof Uint8Array) {\n    // Uint8Array<ArrayBufferLike> isn't structurally BodyInit under every lib\n    // target; the runtime accepts it (it's a valid body) so cast at the seam.\n    return new Response(content as unknown as BodyInit, { status: 200, headers });\n  }\n  if (typeof content === \"string\") {\n    return new Response(content, { status: 200, headers });\n  }\n  return new Response(\"Not Found\", { status: 404 });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,SAAS,iBAAiB,MAAuB;AAC/C,QAAO,6CAA6C,KAAK,KAAK;;;AAIhE,SAAS,eAAe,UAA2B;CACjD,MAAM,IAAI,SAAS,WAAW,IAAI,GAAG,SAAS,MAAM,EAAE,GAAG;AACzD,QAAO,MAAM,YAAY,EAAE,SAAS,SAAS,IAAI,CAAC,EAAE,SAAS,UAAU;;AAGzE,eAAsB,WAAW,MAA4C;CAC3E,MAAM,EAAE,QAAQ,gBAAgB,MAAM,SAAS,YAAY,YAAY;AAEvE,KAAI,CAAC,KAAM,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;CAE5D,MAAM,QAAQ,MAAM,OAAO,cAAc,KAAK;AAE9C,KAAI,CAAC,SAAS,MAAM,WAAW,SAC7B,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AAGnD,KAAI,MAAM,SAAS,MAEjB,QAAO,IAAI,SAAS,0BAA0B;EAC5C,QAAQ;EACR,SAAS;GAAE,iBAAiB;GAAqB,eAAe;GAAM;EACvE,CAAC;CAGJ,MAAM,UAAU,mBAAmB,IAAI,oBAAoB,WAAW,GAAG;AAGzE,KAAI,uBAAuB,QAAQ,CACjC,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AAOnD,KAAI,eAAe,MAAM,SAAS,CAEhC,QAAO,SADK,MAAM,eAAe;EAAE,UAAU,MAAM;EAAU,QAAQ;EAAM,CAAC,EACvD,IAAI,MAAM,cAAc,QAAQ;CAGvD,MAAM,SAAS,MAAM,aAAa,GAAG,MAAM,WAAW,KAAK;AAE3D,QAAO,SADK,MAAM,eAAe;EAAE,UAAU,MAAM;EAAU;EAAQ,CAAC,EACjD,SAAS,QAAQ;;;;;;;;;AAUxC,eAAe,SAAS,KAAU,SAAiB,SAAqC;CACtF,MAAM,YAAY,OAAO,SAA2C;AAClE,MAAI;GAEF,MAAM,SADS,MAAM,IAAI,KAAK,KAAK,EACd;AACrB,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,MAAM,SAAS,yBAAyB,MAAM,MAAM,SAAS,iBACrE,QAAO;AAET,UAAO;WACA,KAAK;AACZ,OAAI,eAAe,iBAAkB,QAAO;AAC5C,SAAM;;;AAIV,KAAI;EAKF,MAAM,QAAQ,YAAY,MAAM,OAAO,MAAM,UAAU,QAAQ;AAC/D,MAAI,MAAO,QAAO,mBAAmB,OAAO,SAAS,QAAQ;EAE7D,MAAM,YAAY,YAAY,MAAM,gBAAgB,mBAAmB,GAAG,QAAQ,aAAa;EAC/F,MAAM,aAAa,MAAM,UAAU,UAAU;AAC7C,MAAI,WAAY,QAAO,mBAAmB,YAAY,WAAW,QAAQ;AAEzE,MAAI,YAAY,OAAO,cAAc,eAAe;GAClD,MAAM,WAAW,MAAM,UAAU,cAAc;AAC/C,OAAI,SAAU,QAAO,mBAAmB,UAAU,eAAe,QAAQ;;AAG3E,SAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;SAC3C;AACN,SAAO,IAAI,SAAS,yBAAyB,EAAE,QAAQ,KAAK,CAAC;;;;;;;;;;;;;;;;;AAkBjE,SAAS,mBAAmB,OAAiB,YAAoB,SAA4B;CAC3F,MAAM,MAAM,MAAM,MAAM;CACxB,MAAM,OAAO,MAAM,MAAM,IAAI,KAAK;CAClC,MAAM,eAAe,iBAAiB,WAAW,GAC7C,wCACA;AAEJ,KAAI,MAAM;EAIR,MAAM,cAAc,QAAQ,QAAQ,IAAI,gBAAgB;EACxD,MAAM,WAAW,MAAc,EAAE,QAAQ,QAAQ,GAAG;AACpD,MAAI,eAAe,QAAQ,YAAY,KAAK,QAAQ,KAAK,CACvD,QAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IAAE,MAAM;IAAM,iBAAiB;IAAc;GACvD,CAAC;;CAIN,MAAM,UAAU,MAAM;CAEtB,MAAM,WAAW,eAAe,WAAW,IAAI;CAE/C,MAAM,UAAU,IAAI,SAAS;AAC7B,SAAQ,IAAI,gBAAgB,SAAS;AACrC,SAAQ,IAAI,iBAAiB,aAAa;AAC1C,SAAQ,IAAI,0BAA0B,UAAU;AAChD,KAAI,KAAM,SAAQ,IAAI,QAAQ,KAAK;AAEnC,KAAI,mBAAmB,eAAe,mBAAmB,WAGvD,QAAO,IAAI,SAAS,SAAgC;EAAE,QAAQ;EAAK;EAAS,CAAC;AAE/E,KAAI,OAAO,YAAY,SACrB,QAAO,IAAI,SAAS,SAAS;EAAE,QAAQ;EAAK;EAAS,CAAC;AAExD,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC"}

package/dist/share-store.cjs

@@ -0,0 +1,25 @@
+
+//#region src/share-store.ts
+/** Map a raw storage row to a public ShareEntry (malformed config_json → {}). */
+function rowToEntry(row) {
+	let config = {};
+	try {
+		config = JSON.parse(row.config_json);
+	} catch {}
+	return {
+		id: row.id,
+		ownerDid: row.owner_did,
+		sourcePath: row.source_path,
+		declPath: row.decl_path,
+		slug: row.slug,
+		kind: row.kind,
+		status: row.status,
+		declCid: row.decl_cid ?? void 0,
+		config,
+		createdAt: row.created_at,
+		updatedAt: row.updated_at
+	};
+}
+
+//#endregion
+exports.rowToEntry = rowToEntry;