@dev.fast/whiteboard 0.0.0-stage → 0.2.0

package/dist/client-DFoh50W3.js

@@ -0,0 +1,950 @@
+import { d as gitAt } from "./src-CmdiBL20.js";
+import { n as isJsonObject, u as parseJsonText } from "./src-X9phtB2j.js";
+import "./src-DnwdaQ2r.js";
+import { B as parseMarkdown, C as resourceReferences, E as sourceReferences, K as sourceAnchors, M as lensSchema, N as lensSelections, O as checkReferences, S as resourceReference, _ as hasCodeReferences, b as pinsSchema, c as traceSchema, h as elements, l as textIncludesQuote, n as migrateStoredDocument, o as normalizedSoftwareElementSchema, p as documentSchema, r as migrateStoredLenses, s as normalizedSoftwareRelationshipSchema, t as liftFileLenses, u as anchorPins, z as markdownNodes } from "./stored-document-migration-DHeMpLMb.js";
+import { t as ReviewInputError } from "./input-error-OLgB_h31.js";
+import { createHash, randomUUID } from "node:crypto";
+import { z } from "zod";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+//#region ../review-share-protocol/src/index.ts
+const SHARE_FORMAT = "review-share/1";
+const MAX_SHARE_MANIFEST_BYTES = 2097152;
+const MAX_SHARE_OBJECT_BYTES = 33554432;
+const MAX_SHARE_OBJECTS = 2048;
+const objectIdSchema = z.string().regex(/^[a-f0-9]{64}$/);
+const shareIdSchema = z.uuid();
+const capabilitySchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+const shareObjectSchema = z.strictObject({
+	id: objectIdSchema,
+	size: z.number().int().min(0).max(MAX_SHARE_OBJECT_BYTES),
+	sha256: objectIdSchema
+}).refine((object) => object.id === object.sha256, "Object ID must match its digest.");
+z.string().min(1).max(4096).refine((file) => !file.startsWith("/") && !file.includes("\\") && !/[\u0000-\u001f\u007f]/.test(file) && file.split("/").every((part) => part !== "" && part !== "." && part !== ".."), "Use a repository-relative file path.");
+/** The published identity is independent of the author's credential transport. */
+function normalizeGitHubRemote(remote) {
+	const url = new URL(remote.trim().replace(/^git@github\.com:/, "https://github.com/"));
+	if (!["https:", "ssh:"].includes(url.protocol) || url.hostname !== "github.com" || url.port || url.search || url.hash || url.protocol === "ssh:" && url.username !== "git") throw new Error("Sharing requires a GitHub repository remote.");
+	const parts = url.pathname.replace(/\.git$/, "").split("/").slice(1);
+	if (parts.length !== 2 || parts.some((part) => !/^[A-Za-z0-9_.-]+$/.test(part) || part === "." || part === "..")) throw new Error("Sharing requires a GitHub repository remote.");
+	return `https://github.com/${parts.join("/")}.git`;
+}
+const gitHubRepositoryUrlSchema = z.string().refine((value) => {
+	try {
+		return normalizeGitHubRemote(value) === value;
+	} catch {
+		return false;
+	}
+}, "Use a canonical GitHub HTTPS repository URL without credentials.");
+const shareManifestSchema = z.strictObject({
+	format: z.literal(SHARE_FORMAT),
+	reviewId: z.string().min(1).max(256),
+	version: z.number().int().nonnegative(),
+	title: z.string().min(1).max(4096),
+	snapshot: objectIdSchema,
+	presentation: objectIdSchema,
+	objects: z.array(shareObjectSchema).min(2).max(MAX_SHARE_OBJECTS),
+	resources: z.array(z.strictObject({
+		id: z.string().min(1).max(256),
+		kind: z.enum([
+			"image",
+			"trace",
+			"map"
+		]),
+		mimeType: z.enum(["image/png", "application/json"]),
+		object: objectIdSchema
+	})).max(MAX_SHARE_OBJECTS),
+	repository: z.strictObject({ cloneUrl: gitHubRepositoryUrlSchema }).optional()
+}).superRefine((manifest, context) => {
+	const ids = new Set(manifest.objects.map((object) => object.id));
+	const fail = (message) => context.addIssue({
+		code: "custom",
+		message
+	});
+	if (ids.size !== manifest.objects.length) fail("Duplicate object ID.");
+	if (manifest.objects.reduce((size, object) => size + object.size, 0) > 134217728) fail("Share exceeds the total byte limit.");
+	for (const id of [
+		manifest.snapshot,
+		manifest.presentation,
+		...manifest.resources.map((resource) => resource.object)
+	]) if (!ids.has(id)) fail("Reference to an undeclared object.");
+	if (new Set(manifest.resources.map((resource) => resource.id)).size !== manifest.resources.length) fail("Duplicate resource ID.");
+	for (const resource of manifest.resources) if (resource.kind === "image" !== (resource.mimeType === "image/png")) fail("Resource MIME type does not match its kind.");
+});
+z.strictObject({
+	requestId: z.uuid(),
+	manifest: z.strictObject({
+		sha256: objectIdSchema,
+		size: z.number().int().positive().max(MAX_SHARE_MANIFEST_BYTES)
+	})
+});
+function parseShareLink(value) {
+	const url = new URL(value);
+	if (url.protocol !== "https:" || url.username || url.password || url.search) throw new Error("Use an HTTPS Review share link.");
+	const match = /^\/s\/([^/]+)$/.exec(url.pathname);
+	return {
+		origin: url.origin,
+		shareId: shareIdSchema.parse(match?.[1]),
+		capability: capabilitySchema.parse(url.hash.slice(1))
+	};
+}
+//#endregion
+//#region src/server/bounded-stream.ts
+var StreamLimitError = class extends Error {
+	constructor() {
+		super("Stream exceeds its byte limit.");
+	}
+};
+async function readBoundedStream(stream, limit) {
+	const reader = stream.getReader();
+	const parts = [];
+	let size = 0;
+	try {
+		for (;;) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > limit) {
+				await reader.cancel().catch(() => {});
+				throw new StreamLimitError();
+			}
+			parts.push(value);
+		}
+		return Buffer.concat(parts, size);
+	} finally {
+		reader.releaseLock();
+	}
+}
+//#endregion
+//#region src/sharing/export.ts
+function digestBytes(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function validateShareSources(snapshot) {
+	if (!snapshot.pins && hasCodeReferences(snapshot)) throw new ReviewInputError("Reviews with code references need source pins before sharing.", 409);
+}
+/** Freeze one stored version before any asynchronous source reads. */
+async function exportShare(input) {
+	const { target, kind: _kind, staleSources: _staleSources, sourceUnavailable: _sourceUnavailable, lastEdit: _lastEdit, ...snapshot } = structuredClone(input.store.read(input.reviewId, input.version));
+	if (target?.kind === "worktree") throw new ReviewInputError("Pin this review to commits before sharing it.");
+	documentSchema.parse(snapshot.document);
+	checkReferences(snapshot.document);
+	const objects = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	const add = (bytes) => {
+		if (bytes.byteLength > 33554432) throw new ReviewInputError("A shared object exceeds the upload limit.");
+		const id = digestBytes(bytes);
+		if (!objects.has(id)) {
+			totalBytes += bytes.byteLength;
+			if (totalBytes > 134217728) throw new ReviewInputError("Review exceeds the sharing limit.");
+			objects.set(id, Uint8Array.from(bytes));
+		}
+		return id;
+	};
+	const json = (value) => add(Buffer.from(JSON.stringify(value)));
+	const resources = [];
+	const maps = {};
+	const sources = [...sourceReferences(snapshot.document), ...lensSelections(snapshot.lenses ?? []).flatMap((selection) => sourceAnchors(selection.source).map((source) => ({
+		...selection,
+		source,
+		peek: false
+	})))];
+	const pins = snapshot.pins;
+	validateShareSources(snapshot);
+	if (Boolean(pins) !== Boolean(input.repository)) throw new ReviewInputError("Shared source pins require a repository.", 409);
+	for (const block of elements(snapshot.document)) {
+		if (block.type !== "markdown") continue;
+		for (const node of markdownNodes(parseMarkdown(block.markdown))) if (node.type === "image") throw new ReviewInputError("Convert Markdown images to managed image blocks before sharing.");
+	}
+	for (const block of resourceReferences(snapshot.document)) {
+		await input.data.validateResource(pins, block);
+		const reference = resourceReference(block);
+		if (!reference || resources.some((resource) => resource.id === reference.id)) continue;
+		const { id } = reference;
+		const resource = input.store.resource(id);
+		resources.push({
+			id,
+			kind: z.enum([
+				"image",
+				"trace",
+				"map"
+			]).parse(resource.kind),
+			mimeType: z.enum(["image/png", "application/json"]).parse(resource.mimeType),
+			object: add(resource.data)
+		});
+		if (block.type === "software_map") {
+			const map = await input.data.map(pins, id);
+			Object.defineProperty(maps, id, {
+				value: map,
+				enumerable: true
+			});
+			for (const element of map.elements) for (const range of element.sourceRanges ?? []) sources.push({
+				id: `${id}:${element.id}`,
+				source: {
+					...range,
+					side: map.side
+				}
+			});
+		}
+	}
+	for (const reference of sources) await input.data.validateSource(anchorPins(reference.source, pins), reference.source, { peek: reference.peek ?? false });
+	const snapshotId = json(snapshot);
+	const presentationId = json({ maps });
+	const manifest = shareManifestSchema.parse({
+		format: SHARE_FORMAT,
+		reviewId: snapshot.reviewId,
+		version: snapshot.version,
+		title: snapshot.title,
+		snapshot: snapshotId,
+		presentation: presentationId,
+		objects: [...objects].map(([id, bytes]) => ({
+			id,
+			sha256: id,
+			size: bytes.byteLength
+		})),
+		resources,
+		repository: input.repository
+	});
+	if (Buffer.byteLength(JSON.stringify(manifest)) > 2097152) throw new ReviewInputError("The share manifest exceeds the upload limit.");
+	return {
+		manifest,
+		objects
+	};
+}
+//#endregion
+//#region src/sharing/repository.ts
+/** Keep credential helpers but prevent the calling shell from redirecting Git's object store. */
+function sharedGit(cwd, args) {
+	const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_") || [
+		"GIT_SSH",
+		"GIT_SSH_COMMAND",
+		"GIT_ASKPASS",
+		"GIT_SSH_VARIANT"
+	].includes(key)));
+	return gitAt(cwd, [
+		"-c",
+		"core.hooksPath=/dev/null",
+		"-c",
+		"core.fsmonitor=false",
+		...args
+	], {
+		env: {
+			...env,
+			GIT_TERMINAL_PROMPT: "0"
+		},
+		timeout: 3e5
+	});
+}
+function fetchError(stderr, publishing) {
+	if (/not our ref|couldn't find remote ref|unadvertised object/i.test(stderr)) return new ReviewInputError(publishing ? "Push the reviewed commits to GitHub before sharing." : "The shared commits are no longer available on GitHub. Ask the sender to restore them, then retry.", 409);
+	return new ReviewInputError("Could not fetch the GitHub repository. Check your connection and Git credentials for this repository, then retry.", 409);
+}
+/** Recipients need complete history; publication only checks that the commits exist. */
+async function fetchPinnedRepository(root, url, pins, publishing = false) {
+	if (![pins.base, pins.head].every((commit) => /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(commit))) throw new ReviewInputError("Sharing requires immutable base and head commits.");
+	await mkdir(root, {
+		recursive: true,
+		mode: 448
+	});
+	await sharedGit(root, ["init", "--quiet"]);
+	if (!publishing) {
+		await sharedGit(root, [
+			"config",
+			"core.hooksPath",
+			"/dev/null"
+		]);
+		await sharedGit(root, [
+			"config",
+			"core.fsmonitor",
+			"false"
+		]);
+		await sharedGit(root, [
+			"remote",
+			"add",
+			"origin",
+			url
+		]);
+	}
+	const refs = publishing ? "refs/heads/review" : "refs/review";
+	try {
+		await sharedGit(root, [
+			"fetch",
+			"--no-tags",
+			"--force",
+			...publishing ? ["--depth=1", "--filter=tree:0"] : [],
+			publishing ? url : "origin",
+			`${pins.base}:${refs}/base`,
+			`${pins.head}:${refs}/head`
+		]);
+	} catch (error) {
+		throw fetchError(error instanceof Error && "stderr" in error ? String(error.stderr) : "", publishing);
+	}
+	if (!publishing) for (const commit of [pins.base, pins.head]) await sharedGit(root, [
+		"cat-file",
+		"-e",
+		`${commit}^{commit}`
+	]);
+}
+async function repositoryReady(root, pins) {
+	try {
+		if ((await sharedGit(root, ["rev-parse", "HEAD"])).stdout.trim() !== pins.head) return false;
+		for (const commit of [pins.base, pins.head]) await sharedGit(root, [
+			"cat-file",
+			"-e",
+			`${commit}^{commit}`
+		]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function readShareRepository(root) {
+	let cloneUrl;
+	try {
+		cloneUrl = normalizeGitHubRemote((await sharedGit(root, [
+			"remote",
+			"get-url",
+			"origin"
+		])).stdout);
+	} catch {
+		throw new ReviewInputError("Sharing requires a GitHub origin remote.");
+	}
+	return { cloneUrl };
+}
+async function verifyShareRepository(root, pins, repository) {
+	const { cloneUrl } = repository ?? await readShareRepository(root);
+	const temporary = await mkdtemp(path.join(tmpdir(), "review-share-check-"));
+	try {
+		await fetchPinnedRepository(temporary, cloneUrl, pins, true);
+	} finally {
+		await rm(temporary, {
+			recursive: true,
+			force: true
+		});
+	}
+	return { cloneUrl };
+}
+//#endregion
+//#region src/sharing/import.ts
+const sharedSnapshotSchema = z.strictObject({
+	reviewId: z.string().min(1),
+	version: z.number().int().nonnegative(),
+	title: z.string().min(1),
+	pins: pinsSchema.extend({
+		base: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/),
+		head: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/)
+	}).optional(),
+	document: documentSchema,
+	lenses: z.array(lensSchema).optional(),
+	createdAt: z.string(),
+	origin: z.strictObject({
+		branch: z.string().optional(),
+		baseRef: z.string().optional(),
+		pullRequestNumber: z.number().int().positive().optional(),
+		pullRequestUrl: z.string().optional(),
+		revision: z.string().optional()
+	}).optional()
+});
+const count = z.number().int().nonnegative();
+const counts = z.strictObject({
+	additions: count,
+	deletions: count
+});
+const mapSchema = z.strictObject({
+	commit: z.string(),
+	side: z.enum(["base", "head"]),
+	elements: z.array(normalizedSoftwareElementSchema),
+	relationships: z.array(normalizedSoftwareRelationshipSchema),
+	countsByElementPath: z.record(z.string(), counts),
+	unmappedByElementPath: z.record(z.string(), counts.extend({ files: z.array(counts.extend({
+		file: z.string(),
+		hunks: z.array(z.strictObject({
+			startLine: count,
+			lines: z.array(z.strictObject({
+				kind: z.enum(["add", "remove"]),
+				oldLine: count.nullable(),
+				newLine: count.nullable(),
+				text: z.string()
+			}))
+		}))
+	})) }))
+});
+const sharePresentationSchema = z.strictObject({ maps: z.record(z.string(), mapSchema) });
+function validateShareBundle(bundle) {
+	const manifest = shareManifestSchema.parse(bundle.manifest);
+	if (Buffer.byteLength(JSON.stringify(manifest)) > 2097152) throw new Error("Share manifest is too large.");
+	if (bundle.objects.size !== manifest.objects.length) throw new Error("Share object count does not match its manifest.");
+	for (const object of manifest.objects) {
+		const bytes = bundle.objects.get(object.id);
+		if (!bytes || bytes.byteLength !== object.size || digestBytes(bytes) !== object.sha256) throw new Error(`Shared object ${object.id} is missing or corrupt.`);
+	}
+	const json = (id) => parseJsonText(Buffer.from(bundle.objects.get(id)).toString());
+	const stored = json(manifest.snapshot);
+	const snapshot = sharedSnapshotSchema.parse(isJsonObject(stored) && "document" in stored ? liftSharedLenses(stored, migrateStoredDocument(stored.document)) : stored);
+	if (snapshot.reviewId !== manifest.reviewId || snapshot.version !== manifest.version || snapshot.title !== manifest.title) throw new Error("Shared snapshot does not match its manifest.");
+	checkReferences(snapshot.document);
+	validateShareSources(snapshot);
+	if (Boolean(snapshot.pins) !== Boolean(manifest.repository)) throw new Error("Shared source pins require a repository.");
+	const presentation = sharePresentationSchema.parse(json(manifest.presentation));
+	if (!snapshot.pins && Object.keys(presentation.maps).length) throw new Error("Shared maps require source pins.");
+	const traces = /* @__PURE__ */ new Map();
+	for (const block of resourceReferences(snapshot.document)) {
+		const reference = resourceReference(block);
+		const resource = manifest.resources.find((item) => item.id === reference?.id);
+		if (!reference || !resource || resource.kind !== reference.kind) throw new Error("Missing or mismatched shared resource.");
+		if (block.type === "trace_quote") {
+			let events = traces.get(resource.object);
+			if (!events) {
+				const trace = traceSchema.parse(json(resource.object));
+				events = new Map(trace.events.map((event) => [event.id, event]));
+				if (events.size !== trace.events.length) throw new Error("Duplicate shared trace event.");
+				traces.set(resource.object, events);
+			}
+			const event = events.get(block.eventId);
+			if (!event || !textIncludesQuote(event.text, block.text)) throw new Error("Shared quote does not match its trace.");
+		}
+		if (block.type === "software_map") {
+			const map = presentation.maps[block.mapVersionId];
+			if (!map || map.commit !== snapshot.pins?.[map.side]) throw new Error("Shared map pins do not match.");
+		}
+	}
+	return {
+		manifest,
+		snapshot,
+		presentation
+	};
+}
+function liftSharedLenses(stored, migrated) {
+	const { document, lenses } = liftFileLenses(migrated);
+	const kept = Array.isArray(stored.lenses) ? migrateStoredLenses(stored.lenses) : [];
+	return {
+		...stored,
+		document,
+		...(kept.length || lenses.length) && { lenses: [...kept, ...lenses] }
+	};
+}
+function sharedReviewId(origin, shareId) {
+	const url = new URL(origin);
+	shareIdSchema.parse(shareId);
+	return `shared-${digestBytes(Buffer.from(JSON.stringify([url.origin, shareId])))}`;
+}
+/** Separate immutable directory tree; authoring mutation handlers cannot write it. */
+var SharedReviewStore = class {
+	root;
+	fetchRepository;
+	loaded = /* @__PURE__ */ new Map();
+	validated = /* @__PURE__ */ new Map();
+	attention = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
+	catalogLoaded = false;
+	downloads = /* @__PURE__ */ new Set();
+	trackImport(job) {
+		this.downloads.add(job);
+		job.finally(() => this.downloads.delete(job));
+	}
+	async close() {
+		await Promise.allSettled([...this.downloads, ...this.jobs.values()]);
+	}
+	local;
+	repositories = /* @__PURE__ */ new Map();
+	jobs = /* @__PURE__ */ new Map();
+	states = /* @__PURE__ */ new Map();
+	constructor(root, fetchRepository = fetchPinnedRepository) {
+		this.root = root;
+		this.fetchRepository = fetchRepository;
+	}
+	connect(store, data) {
+		this.local = {
+			store,
+			data
+		};
+		data.workspaces.attachExternalReviews({
+			has: (id) => this.has(id) || !this.catalogLoaded && id.startsWith("shared-"),
+			subscribe: (listener) => this.subscribe(listener)
+		});
+	}
+	has(id) {
+		return this.loaded.has(id);
+	}
+	status(id) {
+		return this.states.get(id) ?? {
+			stage: "error",
+			error: "Shared review is not available."
+		};
+	}
+	setStatus(id, stage, error) {
+		this.states.set(id, {
+			stage,
+			error
+		});
+		for (const listener of this.listeners) listener();
+	}
+	repositoryRoot(id) {
+		if (!/^shared-[a-f0-9]{64}$/.test(id)) throw new ReviewInputError("Invalid shared review ID.");
+		return path.join(this.root, ".repositories", id);
+	}
+	async prepare(id) {
+		const active = this.jobs.get(id);
+		if (active) return active;
+		const job = this.prepareRepository(id).finally(() => this.jobs.delete(id));
+		this.jobs.set(id, job);
+		return job;
+	}
+	async prepareRepository(id) {
+		const local = this.local;
+		const saved = this.validated.get(id);
+		if (!saved) throw new ReviewInputError("Shared review is not available.", 404);
+		if (!saved.snapshot.pins) {
+			this.setStatus(id, "ready");
+			return;
+		}
+		if (!local) throw new ReviewInputError("Repository service is unavailable.", 409);
+		const root = this.repositoryRoot(id);
+		try {
+			this.setStatus(id, "fetching");
+			if (!await repositoryReady(root, saved.snapshot.pins)) {
+				const prior = this.repositories.get(id);
+				await local.data.workspaces.remove(id);
+				if (prior) await local.data.forgetRepository(prior);
+				await rm(root, {
+					recursive: true,
+					force: true
+				});
+				await this.fetchRepository(root, saved.manifest.repository.cloneUrl, saved.snapshot.pins);
+				await sharedGit(root, [
+					"checkout",
+					"--detach",
+					saved.snapshot.pins.head
+				]);
+			}
+			const repository = await local.data.register(root);
+			this.repositories.set(id, repository.id);
+			await writeFile(path.join(this.root, id, "repository.json"), JSON.stringify({
+				repositoryId: repository.id,
+				ready: false
+			}), { mode: 384 });
+			const pins = {
+				...saved.snapshot.pins,
+				repositoryId: repository.id
+			};
+			this.setStatus(id, "validating");
+			await local.data.validatePins(pins);
+			const references = sourceReferences(saved.snapshot.document).map((item) => item.source);
+			for (const map of Object.values(saved.presentation.maps)) for (const element of map.elements) for (const range of element.sourceRanges ?? []) references.push({
+				...range,
+				side: map.side
+			});
+			await local.data.validateSources(pins, references);
+			await local.data.workspaces.open(id, pins);
+			if (local.data.workspaces.list(id).some((workspace) => !workspace.rootPath)) throw new ReviewInputError("Could not prepare the pinned checkout. Retry opening the share.", 409);
+			await writeFile(path.join(this.root, id, "repository.json"), JSON.stringify({
+				repositoryId: repository.id,
+				ready: true
+			}), { mode: 384 });
+			this.setStatus(id, "ready");
+		} catch (error) {
+			const message = error instanceof ReviewInputError ? error.message : "Could not prepare the shared repository. Check Git credentials and retry.";
+			this.setStatus(id, "error", message);
+			throw new ReviewInputError(message, 409);
+		}
+	}
+	async assertReady(id) {
+		const saved = this.validated.get(id);
+		if (!saved || saved.snapshot.pins && !await repositoryReady(this.repositoryRoot(id), saved.snapshot.pins)) {
+			this.setStatus(id, "error", "The managed checkout is missing. Reopen the share link to fetch it again.");
+			throw new ReviewInputError(this.status(id).error, 409);
+		}
+		this.get(id);
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	async load() {
+		await mkdir(this.root, {
+			recursive: true,
+			mode: 448
+		});
+		for (const id of await readdir(this.root)) {
+			if (!/^shared-[a-f0-9]{64}$/.test(id)) continue;
+			let saved;
+			try {
+				saved = await this.readValidated(id);
+			} catch {
+				await rename(path.join(this.root, id), path.join(this.root, `.invalid-${id}-${Date.now()}`));
+				console.warn("A cached shared review was corrupt. Reopen its share link to download it again.");
+				continue;
+			}
+			const { bundle, validated } = saved;
+			this.loaded.set(id, {
+				manifest: bundle.manifest,
+				attribution: bundle.attribution
+			});
+			this.validated.set(id, validated);
+			let prepared = false;
+			try {
+				const metadata = z.strictObject({
+					repositoryId: z.string(),
+					ready: z.boolean()
+				}).parse(JSON.parse(await readFile(path.join(this.root, id, "repository.json"), "utf8")));
+				if (this.local?.store.repositoryPath(metadata.repositoryId) === path.join(await realpath(this.root), ".repositories", id)) {
+					this.repositories.set(id, metadata.repositoryId);
+					prepared = metadata.ready;
+				}
+			} catch {}
+			if (!validated.snapshot.pins) this.setStatus(id, "ready");
+			else if (prepared && this.local && await repositoryReady(this.repositoryRoot(id), validated.snapshot.pins)) {
+				const repository = await this.local.data.register(this.repositoryRoot(id));
+				this.repositories.set(id, repository.id);
+				this.setStatus(id, "ready");
+			} else this.setStatus(id, "error", "Reopen the share link to fetch its repository.");
+			try {
+				this.attention.set(id, z.strictObject({
+					viewedAt: z.string().nullable(),
+					dismissedAt: z.string().nullable()
+				}).parse(JSON.parse(await readFile(path.join(this.root, id, "attention.json"), "utf8"))));
+			} catch {}
+		}
+		this.catalogLoaded = true;
+		for (const listener of this.listeners) listener();
+	}
+	get(id) {
+		const bundle = this.loaded.get(id);
+		if (!bundle) throw new ReviewInputError("Shared review is not available.", 404);
+		const validated = this.validated.get(id);
+		const repositoryId = this.repositories.get(id);
+		if (this.status(id).stage !== "ready" || validated.snapshot.pins && (!repositoryId || !existsSync(path.join(this.repositoryRoot(id), ".git")))) throw new ReviewInputError(this.status(id).error ?? "Fetch the shared repository before opening this review.", 409);
+		return {
+			...validated,
+			snapshot: {
+				...validated.snapshot,
+				reviewId: id,
+				pins: validated.snapshot.pins ? {
+					...validated.snapshot.pins,
+					repositoryId
+				} : void 0,
+				target: validated.snapshot.pins ? {
+					kind: "commits",
+					...validated.snapshot.pins,
+					repositoryId
+				} : void 0,
+				shared: {
+					...bundle.attribution,
+					cloneUrl: bundle.manifest.repository?.cloneUrl
+				}
+			}
+		};
+	}
+	list(mode = "structural") {
+		const reviews = this.loaded.keys().filter((id) => this.status(id).stage === "ready" && (!this.validated.get(id)?.snapshot.pins || existsSync(path.join(this.repositoryRoot(id), ".git")))).map((id) => {
+			const { document: _document, ...snapshot } = this.get(id).snapshot;
+			return {
+				...snapshot,
+				firstCreatedAt: snapshot.version === 0 ? snapshot.createdAt : void 0,
+				repositoryName: "Shared review",
+				viewedAt: this.attention.get(id)?.viewedAt ?? null,
+				dismissedAt: this.attention.get(id)?.dismissedAt ?? null
+			};
+		}).toArray();
+		return this.local?.store.withDiffStats(reviews, mode) ?? reviews;
+	}
+	async readObject(id, objectId) {
+		const entry = this.get(id).manifest.objects.find((object) => object.id === objectId);
+		if (!entry) throw new ReviewInputError("Shared object is unavailable.", 404);
+		const file = path.join(this.root, id, objectId);
+		if ((await stat(file)).size !== entry.size) throw new Error("Corrupt cached shared object.");
+		const bytes = await readFile(file);
+		if (digestBytes(bytes) !== entry.sha256) throw new Error("Corrupt cached shared object.");
+		return bytes;
+	}
+	async removeLocal(id) {
+		await this.jobs.get(id)?.catch(() => {});
+		if (!this.loaded.has(id)) throw new ReviewInputError("Shared review is not available.", 404);
+		await this.local?.data.workspaces.remove(id);
+		const repositoryId = this.repositories.get(id);
+		if (repositoryId) {
+			await this.local?.data.forgetRepository(repositoryId);
+			this.local?.store.unregisterRepository(repositoryId);
+		}
+		await rm(this.repositoryRoot(id), {
+			recursive: true,
+			force: true
+		});
+		this.repositories.delete(id);
+		this.states.delete(id);
+		await rm(path.join(this.root, id), {
+			recursive: true,
+			force: true
+		});
+		this.loaded.delete(id);
+		this.validated.delete(id);
+		this.attention.delete(id);
+		for (const listener of this.listeners) listener();
+	}
+	async setAttention(id, action) {
+		this.get(id);
+		const state = this.attention.get(id) ?? {
+			viewedAt: null,
+			dismissedAt: null
+		};
+		if (action === "view") state.viewedAt = (/* @__PURE__ */ new Date()).toISOString();
+		else state.dismissedAt = action === "dismiss" ? (/* @__PURE__ */ new Date()).toISOString() : null;
+		await writeFile(path.join(this.root, id, "attention.json"), JSON.stringify(state), { mode: 384 });
+		this.attention.set(id, state);
+		for (const listener of this.listeners) listener();
+	}
+	async import(origin, shareId, bundle) {
+		const validated = validateShareBundle(bundle);
+		const id = sharedReviewId(origin, shareId);
+		await mkdir(this.root, {
+			recursive: true,
+			mode: 448
+		});
+		const staging = await mkdtemp(path.join(this.root, ".import-"));
+		try {
+			await writeFile(path.join(staging, "manifest.json"), JSON.stringify(bundle.manifest), { mode: 384 });
+			if (bundle.attribution) await writeFile(path.join(staging, "attribution.json"), JSON.stringify(bundle.attribution), { mode: 384 });
+			for (const [objectId, bytes] of bundle.objects) await writeFile(path.join(staging, objectId), bytes, { mode: 384 });
+			try {
+				await rename(staging, path.join(this.root, id));
+			} catch (error) {
+				if (!(error instanceof Error && "code" in error && ["ENOTEMPTY", "EEXIST"].includes(String(error.code)))) throw error;
+				const existing = await this.read(id);
+				if (JSON.stringify(existing.manifest) !== JSON.stringify(bundle.manifest)) throw new Error("An immutable share changed its manifest.");
+			}
+		} finally {
+			await rm(staging, {
+				recursive: true,
+				force: true
+			});
+		}
+		this.loaded.set(id, {
+			manifest: bundle.manifest,
+			attribution: bundle.attribution
+		});
+		this.validated.set(id, validated);
+		for (const listener of this.listeners) listener();
+		await this.prepare(id);
+		return id;
+	}
+	async read(id) {
+		return (await this.readValidated(id)).bundle;
+	}
+	async readValidated(id) {
+		if (!/^shared-[a-f0-9]{64}$/.test(id)) throw new Error("Invalid shared review ID.");
+		const dir = path.join(this.root, id);
+		if ((await stat(path.join(dir, "manifest.json"))).size > 2097152) throw new Error("Shared manifest is too large.");
+		const manifest = shareManifestSchema.parse(JSON.parse(await readFile(path.join(dir, "manifest.json"), "utf8")));
+		const objects = /* @__PURE__ */ new Map();
+		for (const object of manifest.objects) {
+			const file = path.join(dir, object.id);
+			if ((await stat(file)).size !== object.size) throw new Error("Corrupt cached shared object.");
+			objects.set(object.id, await readFile(file));
+		}
+		let attribution;
+		try {
+			attribution = z.strictObject({
+				login: z.string(),
+				sharedAt: z.number()
+			}).parse(JSON.parse(await readFile(path.join(dir, "attribution.json"), "utf8")));
+		} catch {}
+		const bundle = {
+			manifest,
+			objects,
+			attribution
+		};
+		return {
+			bundle,
+			validated: validateShareBundle(bundle)
+		};
+	}
+};
+//#endregion
+//#region src/sharing/client.ts
+const uploadSchema = z.strictObject({
+	url: z.url(),
+	headers: z.record(z.string(), z.string()),
+	expiresAt: z.string()
+});
+const createdSchema = z.strictObject({
+	shareId: z.uuid(),
+	upload: uploadSchema
+});
+const registeredSchema = z.object({
+	registered: z.literal(true),
+	uploads: z.record(z.string(), uploadSchema)
+});
+const UPLOAD_CONCURRENCY = 4;
+const MAX_UPLOAD_RESPONSE_BYTES = 8388608;
+const linkSchema = z.strictObject({
+	shareId: z.uuid(),
+	url: z.url()
+});
+const receivedSchema = z.strictObject({
+	manifest: shareManifestSchema,
+	sender: z.strictObject({ login: z.string().min(1).max(256) }),
+	sharedAt: z.number()
+});
+const signedUrlSchema = z.url().refine((value) => {
+	const url = new URL(value);
+	return url.protocol === "https:" && !url.username && !url.password;
+});
+const downloadSchema = z.strictObject({
+	url: z.url(),
+	expiresAt: z.string()
+});
+/** Size is checked while reading, even if Content-Length is absent or false. */
+async function readBoundedBytes(response, limit) {
+	if (!response.ok || !response.body) throw new Error(`Download failed (${response.status}).`);
+	const declared = response.headers.get("content-length");
+	if (declared && Number(declared) > limit) {
+		await response.body.cancel().catch(() => {});
+		throw new Error("Download exceeds its declared limit.");
+	}
+	try {
+		return await readBoundedStream(response.body, limit);
+	} catch (error) {
+		if (error instanceof StreamLimitError) throw new Error("Download exceeds its declared limit.");
+		throw error;
+	}
+}
+/** The share service rejected the account token; the stored login is stale. */
+var ShareAuthError = class extends Error {
+	constructor() {
+		super("The share service rejected the stored login.");
+		this.name = "ShareAuthError";
+	}
+};
+var SharePreflightError = class extends Error {
+	constructor(cause) {
+		super(cause instanceof Error ? cause.message : "Repository verification failed.", { cause });
+		this.name = "SharePreflightError";
+	}
+};
+var ShareRequestError = class extends Error {
+	status;
+	constructor(status) {
+		super(`Share request failed (${status}).`);
+		this.status = status;
+	}
+};
+/** Account tokens go only to the configured API origin, never to object storage. */
+var ShareClient = class {
+	token;
+	send;
+	origin;
+	constructor(origin, token, send = fetch) {
+		this.token = token;
+		this.send = send;
+		const url = new URL(origin);
+		if (url.username || url.password || url.protocol !== "https:" && !(url.protocol === "http:" && url.hostname === "localhost")) throw new Error("Use a secure share service origin.");
+		this.origin = url.origin;
+	}
+	async api(route, method = "GET", body, capability, maxBytes = MAX_SHARE_MANIFEST_BYTES) {
+		const headers = new Headers({ "content-type": "application/json" });
+		if (capability) headers.set("x-review-share-token", capability);
+		else if (this.token) headers.set("authorization", `Bearer ${this.token}`);
+		const init = {
+			method,
+			redirect: "error",
+			signal: AbortSignal.timeout(6e4),
+			headers
+		};
+		if (body !== void 0) init.body = JSON.stringify(body);
+		const response = await this.send(this.origin + route, init);
+		if (!response.ok) {
+			await response.body?.cancel();
+			if (response.status === 401 && !capability) throw new ShareAuthError();
+			throw new ShareRequestError(response.status);
+		}
+		return parseJsonText(Buffer.from(await readBoundedBytes(response, maxBytes)).toString());
+	}
+	async upload(upload, bytes) {
+		if (!signedUrlSchema.safeParse(upload.url).success) throw new Error("Invalid object upload URL.");
+		const response = await this.send(upload.url, {
+			method: "PUT",
+			headers: upload.headers,
+			body: Buffer.from(bytes),
+			redirect: "error",
+			signal: AbortSignal.timeout(12e4)
+		});
+		await response.body?.cancel();
+		if (!response.ok && response.status !== 412) throw new Error(`Object upload failed (${response.status}).`);
+	}
+	async create(bundle, requestId = randomUUID(), beforeUpload) {
+		validateShareBundle(bundle);
+		const manifestBytes = Buffer.from(JSON.stringify(bundle.manifest));
+		const created = createdSchema.parse(await this.api("/api/shares", "POST", {
+			requestId,
+			manifest: {
+				size: manifestBytes.byteLength,
+				sha256: digestBytes(manifestBytes)
+			}
+		}));
+		const route = `/api/shares/${created.shareId}`;
+		await this.upload(created.upload, manifestBytes);
+		const { uploads } = registeredSchema.parse(await this.api(`${route}/manifest`, "POST", {}, void 0, MAX_UPLOAD_RESPONSE_BYTES));
+		try {
+			if (bundle.manifest.objects.some(({ id }) => !uploads[id])) throw new Error("The share service omitted an object upload URL.");
+			await beforeUpload?.();
+		} catch (error) {
+			await this.recoverLink(created.shareId).catch(async (failure) => {
+				if (failure instanceof ShareRequestError && failure.status === 409) await this.revoke(created.shareId);
+			}).catch(() => {});
+			throw new SharePreflightError(error);
+		}
+		for (let offset = 0; offset < bundle.manifest.objects.length; offset += UPLOAD_CONCURRENCY) {
+			const failed = (await Promise.allSettled(bundle.manifest.objects.slice(offset, offset + UPLOAD_CONCURRENCY).map(async (object) => {
+				await this.upload(uploads[object.id], bundle.objects.get(object.id));
+			}))).find((result) => result.status === "rejected");
+			if (failed) throw failed.reason;
+		}
+		for (let batch = 0; batch <= Math.ceil(bundle.manifest.objects.length / 32); batch++) {
+			const result = await this.api(`${route}/complete`, "POST", {});
+			if (linkSchema.safeParse(result).success) return linkSchema.parse(result);
+			z.strictObject({ complete: z.literal(false) }).parse(result);
+		}
+		throw new Error("Share verification did not finish.");
+	}
+	async list(cursor) {
+		const query = cursor ? `?cursor=${z.uuid().parse(cursor)}` : "";
+		return this.api(`/api/shares${query}`);
+	}
+	async recoverLink(shareId) {
+		return linkSchema.parse(await this.api(`/api/shares/${z.uuid().parse(shareId)}/link`));
+	}
+	async revoke(shareId) {
+		return this.api(`/api/shares/${z.uuid().parse(shareId)}`, "DELETE");
+	}
+	async download(shareId, capability) {
+		const route = `/api/shared/${z.uuid().parse(shareId)}`;
+		const received = receivedSchema.parse(await this.api(route, "GET", void 0, capability));
+		const manifest = received.manifest;
+		const objects = /* @__PURE__ */ new Map();
+		const download = async (object) => {
+			const signed = downloadSchema.parse(await this.api(`${route}/objects/${object.id}`, "GET", void 0, capability));
+			if (!signedUrlSchema.safeParse(signed.url).success) throw new Error("Invalid object download URL.");
+			const bytes = await readBoundedBytes(await this.send(signed.url, {
+				redirect: "error",
+				signal: AbortSignal.timeout(12e4)
+			}), object.size);
+			if (bytes.byteLength !== object.size || digestBytes(bytes) !== object.sha256) throw new Error("Downloaded share object failed its integrity check.");
+			objects.set(object.id, bytes);
+		};
+		for (let start = 0; start < manifest.objects.length; start += 4) await Promise.all(manifest.objects.slice(start, start + 4).map(download));
+		return {
+			manifest,
+			objects,
+			attribution: {
+				login: received.sender.login,
+				sharedAt: received.sharedAt
+			}
+		};
+	}
+};
+//#endregion
+export { sharedReviewId as a, verifyShareRepository as c, StreamLimitError as d, readBoundedStream as f, SharedReviewStore as i, exportShare as l, shareIdSchema as m, ShareClient as n, validateShareBundle as o, parseShareLink as p, SharePreflightError as r, readShareRepository as s, ShareAuthError as t, validateShareSources as u };