@phnx-labs/agents-cli 1.22.53 → 1.22.54

package/dist/lib/share/worker-template.js

@@ -1,7 +1,8 @@
 // The Cloudflare Worker that fronts the R2 share bucket.
 //
 // One tiny Worker does both sides:
-//   - PUT  /<username>/<slug>  — bearer-gated by TWO principals (not a fallback):
+//   - PUT  /<username>/<slug>  — write-gated by authorizeWrite's THREE principals
+//     (not a fallback chain — each is a distinct legitimate identity):
 //       1. Static WRITE_TOKEN (BYO Cloudflare) — checked first when the presented
 //          bearer equals env.WRITE_TOKEN. owner = env.SHARE_NAMESPACE or the
 //          path's first segment.
@@ -12,8 +13,14 @@
 //          so one user cannot write another's prefix (403 namespace mismatch).
 //          A __handles/<handle> claim binds the handle to the first userId that
 //          writes it; a different userId gets 409 handle taken.
+//       3. __share HMAC cookie — the signed-in viewer's identity cookie (same
+//          {userId,email} identityFromCookie verifies for GET). Lets the shared
+//          page's inline visibility control PATCH with credentials:'include' and
+//          no bearer; SameSite=Lax blocks it cross-site, and the same namespace/
+//          owner checks confine it to the holder's own pages. Applies to PUT,
+//          PATCH, and DELETE alike, since all three share authorizeWrite.
 //     A managed deployment sets PHOENIX_ID_BASE; BYO sets WRITE_TOKEN; the
-//     platform endpoint may set both. Fail loud (401) when neither authenticates.
+//     platform endpoint may set both. Fail loud (401) when none authenticates.
 //     Writes the body to R2 via the BUCKET binding, storing visibility
 //     (public|unlisted|me|org), owner, org_domain (org only), an optional
 //     expires-at, plus provenance (agent/session/host/repo/date), a label, and
@@ -22,6 +29,13 @@
 //     domain is 400. Overwriting an existing slug first copies the current
 //     object to <slug>/rev-<ts>-<rand> (revision history) unless
 //     x-share-no-revision is set.
+//   - PATCH /<username>/<slug> — authenticated metadata-only edit. Rewrites the
+//     exact existing body with all HTTP/custom metadata preserved except the
+//     explicitly requested label/arbitrary metadata changes; never revisions.
+//     Conditional put (onlyIf etagMatches) so a concurrent republish 409s
+//     instead of rolling the body back. Phoenix requires customMetadata.owner
+//     === auth.owner (fail closed when the stamp is missing); WRITE_TOKEN is
+//     the admin repair path.
 //   - GET  /<username>/<slug>  — public|unlisted are anonymous; me requires the
 //     Phoenix owner, org requires a same-domain Phoenix identity (Bearer, then
 //     HMAC cookie, then phoenix_ticket). Unauthenticated me/org 302s to
@@ -62,7 +76,7 @@ export const hooks = {
 };
 
 export default {
-  async fetch(request, env) {
+  async fetch(request, env, ctx) {
     const url = new URL(request.url);
     const path = decodeURIComponent(url.pathname.replace(/^\\/+/, ''));
 
@@ -119,21 +133,58 @@ export default {
       // never smuggle through on a publish that carries no agent/session/host/
       // repo/date at all — e.g. a human publishing outside an agent session, or
       // outside a git checkout.
-      const agent = request.headers.get('x-share-agent') || '';
-      const session = request.headers.get('x-share-session') || '';
-      const host = request.headers.get('x-share-host') || '';
-      const repo = request.headers.get('x-share-repo') || '';
-      const date = request.headers.get('x-share-date') || '';
-      const label = request.headers.get('x-share-label') || '';
+      // Full-Unicode headers (PHNX-2786): the CLI always sends the latin1-safe
+      // x-share-<field> (what a pre-Unicode Worker read), and when the fold was
+      // lossy ALSO a percent-encoded x-share-<field>-u companion plus an
+      // x-share-encoding: percent opt-in. Prefer the decoded companion when the
+      // opt-in is present, so a Japanese/emoji title/label/--meta renders in full
+      // instead of (unnamed) or a dropped glyph; a malformed companion falls
+      // back to the folded value rather than failing the publish.
+      const usePercent = (request.headers.get('x-share-encoding') || '') === 'percent';
+      const readText = (name) => {
+        const folded = request.headers.get('x-share-' + name) || '';
+        if (usePercent) {
+          const encoded = request.headers.get('x-share-' + name + '-u');
+          if (encoded) {
+            try {
+              return decodeURIComponent(encoded);
+            } catch (e) {
+              return folded;
+            }
+          }
+        }
+        return folded;
+      };
+      const agent = readText('agent');
+      const session = readText('session');
+      const host = readText('host');
+      const repo = readText('repo');
+      const date = readText('date');
+      const avatar = readText('avatar');
+      const label = readText('label');
       const labelSource = request.headers.get('x-share-label-source') || '';
       let extraMeta = {};
-      const metaHeader = request.headers.get('x-share-meta');
-      if (metaHeader) {
+      // The -u meta companion carries the whole raw object percent-encoded, so a
+      // single decode+parse recovers full-Unicode keys and values; fall back to
+      // the per-value-folded x-share-meta when it is absent or malformed.
+      const metaEncoded = usePercent ? request.headers.get('x-share-meta-u') : null;
+      if (metaEncoded) {
         try {
-          const parsed = JSON.parse(metaHeader);
+          const parsed = JSON.parse(decodeURIComponent(metaEncoded));
           if (parsed && typeof parsed === 'object') extraMeta = parsed;
-        } catch {
-          // malformed --meta header — ignore rather than fail the whole publish
+        } catch (e) {
+          // malformed unicode meta companion — fall through to the folded header
+        }
+      }
+      if (!Object.keys(extraMeta).length) {
+        const metaHeader = request.headers.get('x-share-meta');
+        if (metaHeader) {
+          try {
+            const parsed = JSON.parse(metaHeader);
+            if (parsed && typeof parsed === 'object') extraMeta = parsed;
+          } catch {
+            // malformed --meta header — ignore rather than fail the whole publish
+          }
         }
       }
       const customMetadata = { ...extraMeta };
@@ -156,6 +207,7 @@ export default {
       if (host) customMetadata['host'] = host;
       if (repo) customMetadata['repo'] = repo;
       if (date) customMetadata['date'] = date;
+      if (avatar) customMetadata['avatar'] = avatar;
       if (label) customMetadata['label'] = label;
       if (labelSource) customMetadata['label-source'] = labelSource;
 
@@ -189,6 +241,95 @@ export default {
       return json({ ok: true, url: url.origin + '/' + path, expiresAt: expiresAt || null, unlisted: visibility === 'unlisted', visibility }, 200);
     }
 
+    if (request.method === 'PATCH') {
+      const auth = await authorizeWrite(request, env);
+      if (auth.error) return auth.error;
+      const segments = path.split('/').filter(Boolean);
+      if (segments.length < 2) return json({ error: 'metadata edit requires /<username>/<slug>' }, 400);
+      if (auth.kind === 'phoenix') {
+        const expected = phoenixHandle(auth);
+        if (!expected || segments[0] !== expected) return json({ error: 'namespace mismatch', owner: expected }, 403);
+      }
+      const existing = await env.BUCKET.get(path);
+      if (!existing) return json({ error: 'share not found', key: path }, 404);
+      const owner = existing.customMetadata && existing.customMetadata.owner;
+      // WRITE_TOKEN is the endpoint owner/admin credential (the same authority
+      // the DELETE path grants it). Phoenix must prove ownership — fail closed
+      // when the object has no owner stamp (handles collide after sanitization).
+      if (auth.kind === 'phoenix' && (!owner || owner !== auth.owner)) return json({ error: 'forbidden' }, 403);
+
+      let edit;
+      try { edit = await request.json(); } catch { return json({ error: 'PATCH body must be JSON' }, 400); }
+      if (!edit || typeof edit !== 'object') return json({ error: 'PATCH body must be an object' }, 400);
+      const metadata = { ...(existing.customMetadata || {}) };
+      const previousVisibility = metadata.visibility || 'public';
+      if (Object.prototype.hasOwnProperty.call(edit, 'label')) {
+        if (edit.label !== null && typeof edit.label !== 'string') return json({ error: 'label must be a string or null' }, 400);
+        if (typeof edit.label === 'string' && (edit.label.trim() !== edit.label || !edit.label || edit.label.length > 200)) return json({ error: 'label must be 1-200 trimmed characters' }, 400);
+        if (edit.label === null) { delete metadata.label; delete metadata['label-source']; }
+        else { metadata.label = edit.label; metadata['label-source'] = 'explicit'; }
+      }
+      // Visibility is a first-class edit field (like label), not an arbitrary
+      // --meta entry — 'visibility' is a RESERVED key, so it can only be changed
+      // here, never smuggled through edit.meta. me/org require a Phoenix identity
+      // and org additionally requires a private (non-public-inbox) email domain,
+      // the SAME gate PUT enforces. This is a metadata-only rewrite: the body is
+      // untouched, so no revision is created (identical to a label/meta edit).
+      if (Object.prototype.hasOwnProperty.call(edit, 'visibility')) {
+        const vis = normalizeVisibility(edit.visibility);
+        if (vis.error) return vis.error;
+        const visibility = vis.value;
+        if (visibility === 'me' || visibility === 'org') {
+          const phoenixBase = typeof env.PHOENIX_ID_BASE === 'string' ? env.PHOENIX_ID_BASE.replace(/\\/+$/, '') : '';
+          if (auth.kind !== 'phoenix' || !phoenixBase) return json({ error: 'visibility me/org requires Phoenix identity' }, 400);
+          if (visibility === 'org') {
+            const domain = emailDomain(auth.email);
+            if (!domain) return json({ error: 'org visibility requires a verified email domain' }, 400);
+            if (PUBLIC_INBOX_DOMAINS.indexOf(domain) !== -1) return json({ error: 'org visibility cannot use a public email domain', domain: domain }, 400);
+          }
+        }
+        metadata.visibility = visibility;
+        // org_domain is meaningful only for org — set it there, drop the stale
+        // value on any move away from org so it can never gate a later read.
+        if (visibility === 'org') metadata.org_domain = emailDomain(auth.email);
+        else delete metadata.org_domain;
+      }
+      const mode = edit.metaMode || 'merge';
+      if (mode !== 'merge' && mode !== 'replace') return json({ error: 'metaMode must be merge or replace' }, 400);
+      const incoming = edit.meta || {};
+      if (!incoming || typeof incoming !== 'object' || Array.isArray(incoming)) return json({ error: 'meta must be an object' }, 400);
+      for (const key in incoming) {
+        if (RESERVED_METADATA_KEYS.indexOf(key) !== -1) return json({ error: 'reserved metadata key', key: key }, 400);
+        if (!/^[a-z0-9-]{1,64}$/.test(key) || typeof incoming[key] !== 'string') return json({ error: 'invalid metadata entry', key: key }, 400);
+      }
+      if (mode === 'replace') {
+        for (const key in metadata) if (RESERVED_METADATA_KEYS.indexOf(key) === -1) delete metadata[key];
+      }
+      for (const key in incoming) metadata[key] = incoming[key];
+      const remove = edit.removeMeta || [];
+      if (!Array.isArray(remove)) return json({ error: 'removeMeta must be an array' }, 400);
+      for (const key of remove) {
+        if (typeof key !== 'string' || RESERVED_METADATA_KEYS.indexOf(key) !== -1 || !/^[a-z0-9-]{1,64}$/.test(key)) return json({ error: 'invalid removable metadata key', key: key }, 400);
+        delete metadata[key];
+      }
+      if (new TextEncoder().encode(JSON.stringify(extraMetaOf(metadata))).length > 2048) return json({ error: 'metadata exceeds 2048 bytes' }, 400);
+      // R2 assigns a fresh uploaded timestamp to every put. Preserve the
+      // canonical publication time before this metadata-only rewrite so gallery
+      // ordering and list JSON do not pretend the page was republished today.
+      if (!metadata['published-at']) metadata['published-at'] = new Date(existing.uploaded).toISOString();
+      const httpHeaders = new Headers();
+      if (typeof existing.writeHttpMetadata === 'function') existing.writeHttpMetadata(httpHeaders);
+      const putOpts = { httpMetadata: httpHeaders, customMetadata: metadata };
+      // onlyIf.etagMatches wants the bare hash (R2Object#etag), not the
+      // quoted HTTP header form (R2Object#httpEtag) — passing httpEtag 500s
+      // on a real Workers R2 binding ("Conditional ETag should not be
+      // wrapped in quotes"), a defect only a real R2 backend surfaces.
+      if (existing.etag) putOpts.onlyIf = { etagMatches: existing.etag };
+      const putResult = await env.BUCKET.put(path, existing.body, putOpts);
+      if (putResult === null) return json({ error: 'conflict', key: path }, 409);
+      return json({ ok: true, url: url.origin + '/' + path, label: metadata.label || null, meta: extraMetaOf(metadata), visibility: metadata.visibility || 'public', previousVisibility: previousVisibility }, 200);
+    }
+
     if (request.method === 'GET' || request.method === 'HEAD') {
       // Single-segment path may be a user gallery/listing OR a legacy flat slug.
       // The disambiguator is whether the <seg>/ prefix holds any object: only a
@@ -202,9 +343,12 @@ export default {
         const list = await env.BUCKET.list({ prefix: segments[0] + '/', limit: 1 });
         const isNamespace = list.objects && list.objects.length > 0;
         if (isNamespace) {
-          return url.searchParams.get('format') === 'json'
-            ? renderListing(env.BUCKET, url.origin, segments[0], request.method)
-            : renderGallery(env.BUCKET, url.origin, segments[0], request.method);
+          if (url.searchParams.get('format') === 'json') {
+            const scope = await resolveListingScope(request, env, segments[0]);
+            if (scope.error) return scope.error;
+            return renderListing(env.BUCKET, url.origin, segments[0], request.method, scope.includeHidden);
+          }
+          return renderGallery(env.BUCKET, url.origin, segments[0], request.method);
         }
         // Not a namespace: fall through. A legacy flat-slug object resolves to its
         // real content; anything else 404s (an empty/nonexistent namespace, which
@@ -219,8 +363,15 @@ export default {
       // ?revisions=json must not leak that the page exists.
       if (segments.length === 2 && url.searchParams.get('revisions') === 'json') {
         const canonical = await env.BUCKET.get(path);
-        if (canonical) {
-          const denied = await gateRestrictedGet(request, env, url, canonical);
+        // Only a me/org canonical needs the viewer resolved — and only there does
+        // a phoenix_ticket failure gate the response, exactly as before this route
+        // shared resolveViewer with the page GET. A public/unlisted revision list
+        // never invoked ticket redemption, so a stale ticket must not 401 it.
+        if (canonical && isIdentityGated((canonical.customMetadata && canonical.customMetadata.visibility) || 'public')) {
+          const viewer = await resolveViewer(request, env, url);
+          if (viewer.redirect) return viewer.redirect;
+          if (viewer.error) return viewer.error;
+          const denied = gateVisibility(url, env, canonical, viewer.identity || null);
           if (denied) return denied;
         }
         return renderRevisions(
@@ -239,9 +390,24 @@ export default {
         await env.BUCKET.delete(path);
         return new Response('gone — this link has expired', { status: 410, headers: { 'content-type': 'text/plain' } });
       }
-      const denied = await gateRestrictedGet(request, env, url, obj);
-      if (denied) return denied;
+      // Resolve the viewer ONCE — needed both to gate me/org reads AND to decide
+      // whether THIS viewer OWNS this namespace (the interactive visibility
+      // control below). A successful phoenix_ticket redemption (redirect: set the
+      // identity cookie, strip the ticket) is honored on ANY page. But a ticket
+      // FAILURE (expired/consumed/unreachable) must only gate a page that needs
+      // identity — a public/unlisted page never invoked ticket redemption before
+      // this refactor, so a stale ticket there must serve anonymously, not 401.
       const visibility = (obj.customMetadata && obj.customMetadata.visibility) || 'public';
+      const viewer = await resolveViewer(request, env, url);
+      if (viewer.redirect) return viewer.redirect;
+      if (viewer.error && isIdentityGated(visibility)) return viewer.error;
+      const identity = viewer.identity || null;
+      const denied = gateVisibility(url, env, obj, identity);
+      if (denied) return denied;
+      // The owner of the namespace (their handle === the first path segment) gets
+      // an interactive visibility control; everyone else keeps the static cue.
+      const isOwner = !!identity && handleFromEmail(identity.email) === firstSeg;
+      const ownerDomain = identity ? emailDomain(identity.email) : '';
       const headers = new Headers();
       obj.writeHttpMetadata(headers);
       headers.set('etag', obj.httpEtag);
@@ -254,18 +420,58 @@ export default {
         if (visibility === 'unlisted') headers.set('X-Robots-Tag', 'noindex');
       }
       if (request.method === 'HEAD') return new Response(null, { status: 200, headers });
-      // HTML pages get an attribution bar injected at serve time (who shared it,
-      // what made it, when, and — the point — a visual VISIBILITY cue). All read
-      // from the object's stamped metadata; non-HTML assets (images, JSON, the OG
-      // cover) are served byte-for-byte. The body changes, so the R2 etag no
+      const ctype = headers.get('content-type') || '';
+      // HTML pages ALWAYS get the attribution bar injected at serve time (who
+      // shared it, what made it, when, and — the point — a visual VISIBILITY cue),
+      // all from stamped metadata. This is unconditional: ?raw does NOT strip the
+      // bar from a shared page (the always-on cue from #3122/#3140 is not
+      // defeatable with a query param). The body changes, so the R2 etag no
       // longer matches — drop it rather than serve a lying validator.
-      const isHtmlPage = (headers.get('content-type') || '').indexOf('text/html') !== -1;
-      if (isHtmlPage) {
+      if (ctype.indexOf('text/html') !== -1) {
         const rawHtml = await obj.text();
-        const withBar = injectAttributionBar(rawHtml, obj.customMetadata || {}, firstSeg);
+        // Per-slug view counter (RUSH view stats). Stored as a SEPARATE R2 object
+        // (__views/<path>) so it never rewrites the page object — a rewrite would
+        // reset obj.uploaded and corrupt "last updated". The __-prefix key is GET-
+        // blocked for direct requests and lives outside every <user>/ list prefix,
+        // so it never leaks into the gallery/listing/revisions. Count only a real
+        // visitor's page view: not ?raw (an embed/OG fetch), not the owner's own
+        // view, and never HEAD (which returned above). The write rides
+        // ctx.waitUntil so it never blocks the response; the displayed count folds
+        // in the current view so the visitor sees themselves included.
+        const wantsRaw = url.searchParams.get('raw') != null;
+        const counting = !wantsRaw && !isOwner;
+        const storedViews = await readViews(env, path);
+        const views = storedViews + (counting ? 1 : 0);
+        if (counting && ctx && typeof ctx.waitUntil === 'function') {
+          ctx.waitUntil(writeViews(env, path, views));
+        }
+        const withBar = injectAttributionBar(rawHtml, obj.customMetadata || {}, firstSeg, {
+          isOwner,
+          ownerDomain,
+          views,
+          uploaded: obj.uploaded,
+        });
         headers.delete('etag');
         return new Response(withBar, { status: 200, headers });
       }
+      // Non-HTML asset. ?raw returns the stored bytes untouched — the escape hatch
+      // for <img src>, OG crawlers, iframes, and anyone embedding the asset (the
+      // viewer's own media element points back at ?raw). Otherwise a BROWSER
+      // navigating directly to a viewable asset (image/video/audio/pdf) gets a
+      // lightweight viewer page carrying the same bar; a non-browser fetch (Accept
+      // without text/html) falls through to raw bytes so embedding is never broken.
+      const wantsRaw = url.searchParams.get('raw') != null;
+      const kind = viewableAssetKind(ctype);
+      if (!wantsRaw && kind && acceptsHtml(request)) {
+        const viewerPage = renderAssetViewer(url.pathname, kind, obj.customMetadata || {}, firstSeg, {
+          isOwner,
+          ownerDomain,
+        });
+        const vheaders = new Headers(headers);
+        vheaders.set('content-type', 'text/html; charset=utf-8');
+        vheaders.delete('etag');
+        return new Response(viewerPage, { status: 200, headers: vheaders });
+      }
       return new Response(obj.body, { status: 200, headers });
     }
 
@@ -307,6 +513,10 @@ function isRevisionKey(key) {
   return key.split('/').length > 2;
 }
 
+function publishedAtOf(object) {
+  return (object.customMetadata && object.customMetadata['published-at']) || object.uploaded;
+}
+
 async function renderGallery(bucket, origin, user, method) {
   const objects = [];
   let cursor;
@@ -329,7 +539,7 @@ async function renderGallery(bucket, origin, user, method) {
     const url = origin + '/' + o.key;
     const label = (o.customMetadata && o.customMetadata['label']) || '';
     const agent = (o.customMetadata && o.customMetadata['agent']) || '';
-    return { slug, url, updated: o.uploaded, label, agent };
+    return { slug, url, updated: publishedAtOf(o), label, agent };
   });
 
   if (method === 'HEAD') {
@@ -360,7 +570,7 @@ async function renderGallery(bucket, origin, user, method) {
   return new Response(html, { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'public, max-age=60' } });
 }
 
-async function renderListing(bucket, origin, user, method) {
+async function renderListing(bucket, origin, user, method, includeHidden) {
   const objects = [];
   let cursor;
   do {
@@ -381,11 +591,11 @@ async function renderListing(bucket, origin, user, method) {
   const now = Date.now();
   const items = objects
     .filter(o => {
-      // Mirror the gallery: hide revisions, sibling .png OG covers, expired
-      // pages, and unlisted/me/org pages — the listing is the machine-readable public surface.
+      // Revisions and sibling .png OG covers are always hidden. Hidden-visibility
+      // pages are included ONLY when an authenticated owner requested scope=mine.
       if (isRevisionKey(o.key)) return false;
       if (o.key.endsWith('.png')) return false;
-      if (isHiddenFromGallery(o.customMetadata && o.customMetadata.visibility)) return false;
+      if (isHiddenFromGallery(o.customMetadata && o.customMetadata.visibility) && !includeHidden) return false;
       const expiresAt = o.customMetadata && o.customMetadata['expires-at'];
       return !(expiresAt && now > Date.parse(expiresAt));
     })
@@ -394,9 +604,10 @@ async function renderListing(bucket, origin, user, method) {
       url: origin + '/' + o.key,
       size: typeof o.size === 'number' ? o.size : 0,
       contentType: (o.httpMetadata && o.httpMetadata.contentType) || null,
-      publishedAt: new Date(o.uploaded).toISOString(),
+      publishedAt: new Date(publishedAtOf(o)).toISOString(),
       expiresAt: (o.customMetadata && o.customMetadata['expires-at']) || null,
       label: (o.customMetadata && o.customMetadata['label']) || null,
+      visibility: (o.customMetadata && o.customMetadata.visibility) || 'public',
       agent: (o.customMetadata && o.customMetadata['agent']) || null,
       session: (o.customMetadata && o.customMetadata['session']) || null,
       host: (o.customMetadata && o.customMetadata['host']) || null,
@@ -407,15 +618,39 @@ async function renderListing(bucket, origin, user, method) {
   // Newest first, so the human table and any script reads the freshest share top.
   items.sort((a, b) => (a.publishedAt < b.publishedAt ? 1 : a.publishedAt > b.publishedAt ? -1 : 0));
 
+  const cacheHeaders = includeHidden
+    ? { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'private, no-store', 'X-Robots-Tag': 'noindex' }
+    : { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'public, max-age=30' };
   if (method === 'HEAD') {
-    return new Response(null, { status: 200, headers: { 'content-type': 'application/json; charset=utf-8' } });
+    return new Response(null, { status: 200, headers: cacheHeaders });
   }
   return new Response(JSON.stringify({ user, count: items.length, objects: items }), {
     status: 200,
-    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'public, max-age=30' },
+    headers: cacheHeaders,
   });
 }
 
+// The machine-readable listing is public by default. A request with
+// '?format=json&scope=mine' asks to include the owner's hidden pages
+// (unlisted / me / org). We honor it ONLY after a valid owner bearer whose
+// namespace matches the requested handle, so one user cannot list another's
+// hidden shares. Anonymous or mismatched requests fail loud. A BYO WRITE_TOKEN
+// bearer is the worker's owner, so namespace enforcement is skipped for BYO.
+async function resolveListingScope(request, env, user) {
+  const scope = new URL(request.url).searchParams.get('scope');
+  if (scope !== 'mine') return { includeHidden: false };
+  const auth = await authorizeWrite(request, env);
+  if (auth.error) return { error: auth.error };
+  if (auth.kind === 'byo') {
+    return { includeHidden: true };
+  }
+  const owner = phoenixHandle(auth);
+  if (owner !== user) {
+    return { error: json({ error: 'namespace mismatch' }, 403) };
+  }
+  return { includeHidden: true };
+}
+
 async function renderRevisions(bucket, origin, key, method, identityGated) {
   const objects = [];
   let cursor;
@@ -459,7 +694,7 @@ async function renderRevisions(bucket, origin, key, method, identityGated) {
 // before it ever reaches this Worker; see RESERVED_META_KEYS in publish.ts).
 // One list, reused both to strip a same-named --meta collision on write and
 // to split arbitrary --meta entries back out on read.
-var RESERVED_METADATA_KEYS = ['expires-at', 'visibility', 'owner', 'org_domain', 'agent', 'session', 'host', 'repo', 'date', 'label', 'label-source'];
+var RESERVED_METADATA_KEYS = ['expires-at', 'published-at', 'visibility', 'owner', 'org_domain', 'agent', 'session', 'host', 'repo', 'date', 'avatar', 'label', 'label-source'];
 var PUBLIC_INBOX_DOMAINS = ['gmail.com', 'googlemail.com', 'outlook.com', 'hotmail.com', 'live.com', 'icloud.com', 'me.com'];
 var SHARE_COOKIE = '__Host-phoenix_share';
 var SHARE_COOKIE_MAX_AGE = 604800;
@@ -498,6 +733,76 @@ var VIS_ICON = {
   public: '<svg viewBox="0 0 24 24" width="13" height="13" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="9"/><path d="M3 12h18M12 3a15 15 0 0 1 0 18M12 3a15 15 0 0 0 0 18"/></svg>',
 };
 
+// Eye glyph for the view-count stat; caret for the owner's interactive chip.
+var STAT_EYE_ICON = '<svg viewBox="0 0 24 24" width="13" height="13" fill="none" stroke="currentColor" stroke-width="2"><path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7-10-7-10-7Z"/><circle cx="12" cy="12" r="3"/></svg>';
+var CARET_ICON = '<svg class="ash-caret" viewBox="0 0 24 24" width="11" height="11" fill="none" stroke="currentColor" stroke-width="2.4"><path d="m6 9 6 6 6-6"/></svg>';
+
+// The owner-only browser script that turns the visibility chip into a live
+// control. Self-contained IIFE, namespaced under .agents-share-bar; injected only
+// when the viewer owns the namespace. It reads the current level and each level's
+// icon/color/label straight from the rendered menu DOM (no embedded config), then
+// PATCHes the SAME in-place edit route the CLI uses — method PATCH, JSON body
+// { visibility } — with credentials:'include' so the viewer's __share cookie /
+// Phoenix identity rides. Optimistic: flip the chip + spinner, then a green check
+// on 2xx or revert + the server's error text on failure (an org-on-public-inbox
+// 400 surfaces verbatim). The share page sets no CSP, so inline JS is fine.
+var ASH_OWNER_JS = \`(function(){
+  var root = document.querySelector('.agents-share-bar');
+  if(!root) return;
+  var chip = root.querySelector('[data-ash-chip]');
+  var menu = root.querySelector('[data-ash-menu]');
+  var toast = root.querySelector('[data-ash-toast]');
+  if(!chip || !menu || !toast) return;
+  var labelEl = chip.querySelector('[data-ash-label]');
+  var chipIc = chip.querySelector('[data-ash-chip-ic]');
+  var busy = false;
+  function opts(){ return menu.querySelectorAll('[data-ash-opt]'); }
+  function currentKey(){ var s = menu.querySelector('.ash-opt.ash-sel'); return s ? s.getAttribute('data-ash-opt') : ''; }
+  function labelFor(key){ var a = opts(); for(var i=0;i<a.length;i++){ if(a[i].getAttribute('data-ash-opt')===key){ var b = a[i].querySelector('b'); return b ? b.textContent : key; } } return key; }
+  function open(){ menu.classList.add('ash-open'); menu.setAttribute('aria-hidden','false'); }
+  function close(){ menu.classList.remove('ash-open'); menu.setAttribute('aria-hidden','true'); }
+  chip.addEventListener('click', function(e){ e.stopPropagation(); if(menu.classList.contains('ash-open')) close(); else open(); });
+  menu.addEventListener('click', function(e){ e.stopPropagation(); });
+  document.addEventListener('click', close);
+  document.addEventListener('keydown', function(e){ if(e.key==='Escape') close(); });
+  function draw(key){
+    var sel = null, a = opts();
+    for(var i=0;i<a.length;i++){ var on = a[i].getAttribute('data-ash-opt')===key; a[i].classList.toggle('ash-sel', on); if(on) sel = a[i]; }
+    if(!sel) return;
+    var ic = sel.querySelector('.ash-opt-ic');
+    var color = ic ? ic.style.color : '';
+    if(color){ chip.style.color = color; chip.style.borderColor = color + '66'; }
+    if(chipIc && ic) chipIc.innerHTML = ic.innerHTML;
+    var b = sel.querySelector('b');
+    if(labelEl && b) labelEl.textContent = b.textContent;
+  }
+  function say(inner, cls){ toast.innerHTML = inner; toast.className = 'ash-toast ash-show' + (cls ? ' ' + cls : ''); }
+  function fade(ms){ setTimeout(function(){ toast.className = 'ash-toast'; }, ms); }
+  function pick(key){
+    close();
+    var prev = currentKey();
+    if(busy || !key || key===prev) return;
+    busy = true;
+    draw(key);
+    var name = labelFor(key);
+    say('<span class="ash-spin"></span> Saving…');
+    fetch(location.pathname, { method:'PATCH', credentials:'include', headers:{'content-type':'application/json'}, body: JSON.stringify({ visibility: key }) })
+      .then(function(res){ return res.json().then(function(j){ return { ok: res.ok, status: res.status, body: j }; }, function(){ return { ok: res.ok, status: res.status, body: {} }; }); })
+      .then(function(r){
+        busy = false;
+        if(r.ok){ say('<span class="ash-ok">\\u2713</span> Now ' + name, 'ash-good'); fade(1600); }
+        else {
+          draw(prev);
+          var msg = (r.body && r.body.error) ? String(r.body.error) : ('Could not update (HTTP ' + r.status + ')');
+          say('<span class="ash-err">\\u2715</span> ' + msg.replace(/[<>&]/g, ' '), 'ash-bad');
+          fade(4000);
+        }
+      }, function(){ busy = false; draw(prev); say('<span class="ash-err">\\u2715</span> Network error \\u2014 not saved', 'ash-bad'); fade(4000); });
+  }
+  var a = opts();
+  for(var i=0;i<a.length;i++){ (function(el){ el.addEventListener('click', function(e){ e.stopPropagation(); pick(el.getAttribute('data-ash-opt')); }); })(a[i]); }
+})();\`;
+
 function visibilityChip(visibility, orgDomain) {
   if (visibility === 'me') return { icon: VIS_ICON.me, label: 'Only you', color: '#f59e0b' };
   if (visibility === 'org') return { icon: VIS_ICON.org, label: 'Anyone at ' + escapeHtml(orgDomain || 'your organization'), color: '#5b9dff' };
@@ -505,14 +810,117 @@ function visibilityChip(visibility, orgDomain) {
   return { icon: VIS_ICON.public, label: 'Public', color: '#30a46c' };
 }
 
-function renderAttributionBar(meta, handle) {
+// A deterministic hue (0-359) from the handle, so a given sharer always gets the
+// same initials-circle colour without any stored palette.
+function avatarHue(s) {
+  var h = 0;
+  for (var i = 0; i < s.length; i++) h = (h * 31 + s.charCodeAt(i)) % 360;
+  return h;
+}
+
+// The avatar slot is ALWAYS rendered: a coloured initials circle derived from the
+// handle. When the object carries an avatar URL (a Gravatar the CLI stamps at
+// publish, or any future hosted photo), a real img is layered on top; onerror
+// removes it so the initials underneath show through when the photo 404s. There
+// is no CSP on the share page, so the inline onerror fallback is honoured.
+function renderAvatar(handle, avatarUrl) {
+  var h = (handle || '').trim();
+  var initial = escapeHtml((h.charAt(0) || '?').toUpperCase());
+  var bg = 'hsl(' + avatarHue(h) + ',48%,42%)';
+  var inner = '<span class="ash-av-i">' + initial + '</span>';
+  if (avatarUrl) {
+    inner += '<img class="ash-av-img" src="' + escapeHtml(avatarUrl) + '" alt="" loading="lazy" ' +
+      'referrerpolicy="no-referrer" onerror="this.remove()">';
+  }
+  return '<span class="ash-avatar" style="background:' + bg + ' !important" aria-hidden="true">' + inner + '</span>';
+}
+
+// A compact relative time for the "last updated" stat: "just now", "2h ago",
+// "3d ago", or an ISO date once past ~30 days. Accepts a Date or a parseable
+// string (R2's obj.uploaded is a Date).
+function relativeTime(when) {
+  var then = when instanceof Date ? when.getTime() : Date.parse(when);
+  if (!then || isNaN(then)) return '';
+  var diff = Date.now() - then;
+  if (diff < 0) diff = 0;
+  var minute = 60000, hour = 3600000, day = 86400000;
+  if (diff < minute) return 'just now';
+  if (diff < hour) return Math.floor(diff / minute) + 'm ago';
+  if (diff < day) return Math.floor(diff / hour) + 'h ago';
+  if (diff < 30 * day) return Math.floor(diff / day) + 'd ago';
+  return new Date(then).toISOString().slice(0, 10);
+}
+
+// The four visibility levels the owner can pick, in menu order. Descriptions
+// mirror the approved mockup. org always appears — a public-inbox owner still
+// sees it and lets the server's 400 drive the failure message (never a hidden
+// client-side rule). orgDomain is the owner's own email domain when known.
+function visibilityLevels(orgDomain) {
+  return [
+    { key: 'public', label: 'Public', color: '#30a46c', icon: VIS_ICON.public, desc: 'Anyone with the link · preview card · listed in your gallery' },
+    { key: 'unlisted', label: 'Unlisted', color: '#9aa0a6', icon: VIS_ICON.unlisted, desc: 'Anyone with the link · no card · hidden from your gallery' },
+    { key: 'me', label: 'Only you', color: '#f59e0b', icon: VIS_ICON.me, desc: 'Sign-in required · only your account can open it' },
+    { key: 'org', label: 'Anyone at ' + escapeHtml(orgDomain || 'your org'), color: '#5b9dff', icon: VIS_ICON.org, desc: 'Anyone signed in with a ' + escapeHtml(orgDomain || 'workspace-domain') + ' account' },
+  ];
+}
+
+function renderVisibilityMenu(current, orgDomain) {
+  var rows = visibilityLevels(orgDomain).map(function (l) {
+    return '<button type="button" class="ash-opt' + (l.key === current ? ' ash-sel' : '') + '" data-ash-opt="' + l.key + '" role="menuitemradio" aria-checked="' + (l.key === current ? 'true' : 'false') + '">' +
+      '<span class="ash-opt-ic" style="color:' + l.color + '">' + l.icon + '</span>' +
+      '<span class="ash-opt-t"><b>' + l.label + '</b><span>' + l.desc + '</span></span>' +
+      '<span class="ash-rd"></span></button>';
+  }).join('');
+  return '<div class="ash-menu" data-ash-menu role="menu" aria-hidden="true"><h4>Who can see this</h4>' + rows + '</div>';
+}
+
+function renderOwnerScript() {
+  return '<script>' + ASH_OWNER_JS + '</script>';
+}
+
+// opts: { isOwner, ownerDomain, views, uploaded } — all optional. isOwner turns
+// the visibility chip into a live control (inline dropdown, Variation A) and
+// injects the owner-only CSS/JS; views/uploaded render the right-side stats
+// cluster. With no opts the bar is exactly today's static strip.
+function renderAttributionBar(meta, handle, opts) {
+  var o = opts || {};
   var cm = meta || {};
-  var chip = visibilityChip(cm.visibility || 'public', cm.org_domain);
+  var visibility = cm.visibility || 'public';
+  var chip = visibilityChip(visibility, cm.org_domain);
+  var avatar = renderAvatar(handle, cm.avatar);
   var left = '';
   // The handle is already the public URL namespace, so surfacing it leaks nothing new.
   if (handle) left += 'Shared by <strong>' + escapeHtml(handle) + '</strong>';
   if (cm.agent) left += (left ? '<span class="ash-dot">·</span>' : '') + 'Made with ' + escapeHtml(cm.agent);
-  var right = '<span class="ash-chip" style="color:' + chip.color + ';border-color:' + chip.color + '66">' + chip.icon + '<span>' + chip.label + '</span></span>';
+
+  // Stats cluster (👁 <n> views · updated <rel>) — right side, left of the chip.
+  var stats = '';
+  var statBits = '';
+  if (o.views != null) {
+    statBits += STAT_EYE_ICON + '<b>' + escapeHtml(String(o.views)) + '</b> ' + (Number(o.views) === 1 ? 'view' : 'views');
+  }
+  if (o.uploaded) {
+    var rel = relativeTime(o.uploaded);
+    if (rel) statBits += (statBits ? '<span class="ash-statsep">·</span>' : '') + 'updated <b>' + escapeHtml(rel) + '</b>';
+  }
+  if (statBits) stats = '<span class="ash-stats" title="page stats">' + statBits + '</span>';
+
+  // The visibility chip: an interactive control for the owner, a static cue for
+  // everyone else (unchanged from today).
+  var chipHtml;
+  var menu = '';
+  var script = '';
+  if (o.isOwner) {
+    chipHtml = '<span class="ash-chip ash-chip-own" data-ash-chip tabindex="0" role="button" aria-haspopup="menu" ' +
+      'style="color:' + chip.color + ';border-color:' + chip.color + '66">' +
+      '<span data-ash-chip-ic>' + chip.icon + '</span><span data-ash-label>' + chip.label + '</span>' + CARET_ICON + '</span>';
+    menu = renderVisibilityMenu(visibility, o.ownerDomain);
+    script = renderOwnerScript();
+  } else {
+    chipHtml = '<span class="ash-chip" style="color:' + chip.color + ';border-color:' + chip.color + '66">' + chip.icon + '<span>' + chip.label + '</span></span>';
+  }
+
+  var right = stats + chipHtml;
   if (cm.date) right += '<span class="ash-date">' + escapeHtml(cm.date) + '</span>';
   // The load-bearing background + base colour ride an INLINE style so the host
   // page's own CSS can never wash the bar out (inline beats a page stylesheet);
@@ -530,6 +938,9 @@ function renderAttributionBar(meta, handle) {
     'padding:8px 16px !important;background:#0b0b0c !important;color:#e8e8e8 !important;border-bottom:1px solid #23232a !important;box-shadow:0 1px 3px rgba(0,0,0,.35) !important;' +
     'font:13px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,system-ui,sans-serif !important}' +
     '.agents-share-bar *{box-sizing:border-box;font-family:inherit}' +
+    '.agents-share-bar .ash-avatar{flex:none;position:relative;width:26px;height:26px;border-radius:50% !important;overflow:hidden;display:inline-flex;align-items:center;justify-content:center;color:#fff !important;font-weight:600;font-size:12px;line-height:1;box-shadow:inset 0 0 0 1px rgba(255,255,255,.14)}' +
+    '.agents-share-bar .ash-av-i{color:#fff !important}' +
+    '.agents-share-bar .ash-av-img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover;border-radius:50% !important}' +
     '.agents-share-bar .ash-left{flex:1 1 auto;min-width:0;overflow:hidden;white-space:nowrap;text-overflow:ellipsis;color:#cfd3d9 !important}' +
     '.agents-share-bar strong{color:#fff !important;font-weight:600}' +
     '.agents-share-bar .ash-dot{opacity:.4;margin:0 4px}' +
@@ -537,14 +948,48 @@ function renderAttributionBar(meta, handle) {
     '.agents-share-bar .ash-date{color:#9096a0 !important}' +
     '.agents-share-bar .ash-chip{display:inline-flex;align-items:center;gap:6px;padding:3px 10px;border-radius:999px;border:1px solid;font-weight:600;font-size:12px;white-space:nowrap}' +
     '.agents-share-bar .ash-chip svg{flex:none;vertical-align:middle}' +
+    '.agents-share-bar .ash-stats{display:inline-flex;align-items:center;gap:5px;color:#9aa0a6 !important;font-size:12px;white-space:nowrap}' +
+    '.agents-share-bar .ash-stats b{color:#c9ced6 !important;font-weight:600}' +
+    '.agents-share-bar .ash-stats svg{flex:none;opacity:.85}' +
+    '.agents-share-bar .ash-statsep{opacity:.35;margin:0 3px}' +
+    (o.isOwner ? OWNER_BAR_CSS : '') +
     '</style>' +
+    avatar +
     '<span class="ash-left">' + left + '</span>' +
     '<span class="ash-right">' + right + '</span>' +
-    '</div>';
+    menu +
+    (o.isOwner ? '<div class="ash-toast" data-ash-toast></div>' : '') +
+    '</div>' +
+    script;
 }
 
-function injectAttributionBar(html, meta, handle) {
-  var bar = renderAttributionBar(meta, handle);
+// Owner-only chip/menu/toast styling, added to the bar's <style> only when the
+// viewer owns the namespace. Namespaced under .agents-share-bar with !important
+// so the host page's CSS can't wash it out; z-index rides the bar's own stacking.
+var OWNER_BAR_CSS =
+  '.agents-share-bar .ash-chip-own{cursor:pointer;transition:background .12s}' +
+  '.agents-share-bar .ash-chip-own:hover{background:rgba(255,255,255,.06)}' +
+  '.agents-share-bar .ash-caret{opacity:.6;margin-left:1px;flex:none}' +
+  '.agents-share-bar .ash-menu{position:absolute !important;top:calc(100% + 6px);right:12px;min-width:286px;max-width:calc(100vw - 24px);background:#151517 !important;border:1px solid #2a2a30 !important;border-radius:12px;box-shadow:0 12px 34px rgba(0,0,0,.5);padding:6px;z-index:2147483647;display:none;text-align:left}' +
+  '.agents-share-bar .ash-menu.ash-open{display:block}' +
+  '.agents-share-bar .ash-menu h4{margin:6px 8px 8px;font-size:11px;text-transform:uppercase;letter-spacing:.07em;color:#7c8290 !important;font-weight:700}' +
+  '.agents-share-bar .ash-opt{display:flex;width:100%;text-align:left;align-items:flex-start;gap:10px;padding:8px;border:0;background:none;border-radius:8px;cursor:pointer;color:#e8e8e8 !important;font:inherit;font-size:13px}' +
+  '.agents-share-bar .ash-opt:hover{background:rgba(255,255,255,.05)}' +
+  '.agents-share-bar .ash-opt-ic{flex:none;width:26px;height:26px;border-radius:7px;display:inline-flex;align-items:center;justify-content:center;background:rgba(255,255,255,.06)}' +
+  '.agents-share-bar .ash-opt-t{flex:1;min-width:0}' +
+  '.agents-share-bar .ash-opt-t b{display:block;font-size:13px;font-weight:600;color:#f0f1f3 !important}' +
+  '.agents-share-bar .ash-opt-t span{display:block;font-size:11.5px;color:#9096a0 !important;line-height:1.35;margin-top:1px;white-space:normal}' +
+  '.agents-share-bar .ash-rd{flex:none;width:16px;height:16px;border-radius:50%;border:2px solid #4a4f59;margin-top:3px}' +
+  '.agents-share-bar .ash-opt.ash-sel .ash-rd{border-color:#5b9dff;background:radial-gradient(circle at center,#5b9dff 0 5px,transparent 6px)}' +
+  '.agents-share-bar .ash-toast{position:absolute !important;top:calc(100% + 6px);right:12px;max-width:calc(100vw - 24px);background:#151517 !important;border:1px solid #2a2a30 !important;color:#e8e8e8 !important;font-size:12px;padding:7px 12px;border-radius:9px;display:none;align-items:center;gap:7px;z-index:2147483647}' +
+  '.agents-share-bar .ash-toast.ash-show{display:inline-flex}' +
+  '.agents-share-bar .ash-spin{width:12px;height:12px;border:2px solid rgba(255,255,255,.25);border-top-color:#fff;border-radius:50%;animation:ash-sp .6s linear infinite;display:inline-block;flex:none}' +
+  '@keyframes ash-sp{to{transform:rotate(360deg)}}' +
+  '.agents-share-bar .ash-ok{color:#30a46c;font-weight:700}' +
+  '.agents-share-bar .ash-err{color:#ff6b6b;font-weight:700}';
+
+function injectAttributionBar(html, meta, handle, opts) {
+  var bar = renderAttributionBar(meta, handle, opts);
   var m = /<body[^>]*>/i.exec(html);
   if (m) {
     var at = m.index + m[0].length;
@@ -553,6 +998,47 @@ function injectAttributionBar(html, meta, handle) {
   return bar + html;
 }
 
+function acceptsHtml(request) {
+  return (request.headers.get('accept') || '').indexOf('text/html') !== -1;
+}
+
+// Assets we can embed in a viewer page. Everything else (JSON, .txt, arbitrary
+// downloads) is served raw — there is nothing useful to wrap it in.
+function viewableAssetKind(contentType) {
+  var ct = (contentType || '').toLowerCase();
+  if (ct.indexOf('image/') === 0) return 'image';
+  if (ct.indexOf('video/') === 0) return 'video';
+  if (ct.indexOf('audio/') === 0) return 'audio';
+  if (ct.indexOf('application/pdf') === 0) return 'pdf';
+  return '';
+}
+
+// A minimal dark viewer page: the attribution bar on top, the asset centered
+// below. The media element points back at THIS url with ?raw so it loads the
+// stored bytes (not the viewer recursively) — and that ?raw fetch re-runs the
+// same me/org gate, so a private asset stays private inside its own viewer.
+function renderAssetViewer(pathname, kind, meta, handle, opts) {
+  var rawUrl = escapeHtml(pathname + '?raw=1');
+  var name = '';
+  try { name = decodeURIComponent(pathname.split('/').pop() || 'file'); } catch (e) { name = pathname.split('/').pop() || 'file'; }
+  var bar = renderAttributionBar(meta, handle, opts);
+  var media = '';
+  if (kind === 'image') media = '<img src="' + rawUrl + '" alt="' + escapeHtml(name) + '">';
+  else if (kind === 'video') media = '<video src="' + rawUrl + '" controls playsinline></video>';
+  else if (kind === 'audio') media = '<audio src="' + rawUrl + '" controls></audio>';
+  else if (kind === 'pdf') media = '<iframe src="' + rawUrl + '" title="' + escapeHtml(name) + '"></iframe>';
+  return '<!doctype html><html><head><meta charset="utf-8">' +
+    '<meta name="viewport" content="width=device-width,initial-scale=1">' +
+    '<title>' + escapeHtml(name) + '</title>' +
+    '<style>html,body{margin:0;background:#0f0f11}' +
+    'body{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:16px;box-sizing:border-box}' +
+    '.ashv{max-width:100%;max-height:calc(100vh - 90px);display:flex;align-items:center;justify-content:center}' +
+    '.ashv img,.ashv video{max-width:100%;max-height:calc(100vh - 90px);display:block;border-radius:8px;box-shadow:0 10px 40px rgba(0,0,0,.5)}' +
+    '.ashv audio{width:min(90vw,560px)}' +
+    '.ashv iframe{width:min(94vw,1000px);height:calc(100vh - 90px);border:0;border-radius:8px;background:#fff}' +
+    '</style></head><body>' + bar + '<div class="ashv">' + media + '</div></body></html>';
+}
+
 function json(body, status) {
   return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
 }
@@ -654,19 +1140,47 @@ function isIdentityGated(visibility) {
   return visibility === 'me' || visibility === 'org';
 }
 
-async function gateRestrictedGet(request, env, url, obj) {
+// Gate a me/org read given the ALREADY-RESOLVED viewer identity. Pure/sync: the
+// caller resolves the viewer once (it also needs the identity for the ownership
+// check) and both the page GET and the ?revisions=json path share this gate.
+function gateVisibility(url, env, obj, identity) {
   const visibility = (obj.customMetadata && obj.customMetadata.visibility) || 'public';
   if (!isIdentityGated(visibility)) return null;
-  const viewer = await resolveViewer(request, env, url);
-  if (viewer.redirect) return viewer.redirect;
-  if (viewer.error) return viewer.error;
-  if (!viewer.identity) return bounceToLogin(url, env);
-  if (!viewerMayRead(visibility, obj.customMetadata, viewer.identity)) {
+  if (!identity) return bounceToLogin(url, env);
+  if (!viewerMayRead(visibility, obj.customMetadata, identity)) {
     return new Response('not found', { status: 404, headers: { 'content-type': 'text/plain' } });
   }
   return null;
 }
 
+// Per-slug view counter, stored as a SEPARATE R2 object under __views/<path> so
+// counting a view never rewrites the page object (which would reset its uploaded
+// timestamp and corrupt "last updated"). Best-effort telemetry: a read/write
+// failure must never break page serving, so both degrade to a no-op rather than
+// throwing. R2 has no atomic increment, so two simultaneous views can race and
+// lose a count — acceptable for an approximate visitor count.
+async function readViews(env, path) {
+  try {
+    const obj = await env.BUCKET.get('__views/' + path);
+    if (!obj) return 0;
+    const raw = typeof obj.text === 'function' ? await obj.text() : '';
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) && n >= 0 ? n : 0;
+  } catch {
+    return 0;
+  }
+}
+
+async function writeViews(env, path, count) {
+  try {
+    await env.BUCKET.put('__views/' + path, String(count), {
+      httpMetadata: { contentType: 'text/plain; charset=utf-8' },
+    });
+  } catch {
+    // best-effort: a failed counter write must never surface to the visitor
+  }
+}
+
 function viewerMayRead(visibility, meta, identity) {
   if (visibility === 'me') {
     const owner = meta && meta.owner;
@@ -838,17 +1352,28 @@ async function defaultVerifyPhoenixToken(request, env) {
   return { userId: body.userId, email: typeof body.email === 'string' ? body.email : '' };
 }
 
-// Two legitimate principals: WRITE_TOKEN equality first (admin/BYO), otherwise
-// the bearer is a Phoenix token and we verify it. 401 when neither authenticates.
+// Write principals, in order: WRITE_TOKEN equality (admin/BYO), then a Phoenix
+// bearer, then the signed-in viewer's __share cookie. The cookie is an
+// HMAC-signed {userId,email} proof (identityFromCookie verifies it), which lets
+// the shared page's inline visibility control PATCH with credentials:'include'
+// and no bearer — the browser has the identity cookie, not a token. It cannot be
+// abused cross-site: the cookie is SameSite=Lax, which blocks it from riding a
+// cross-origin non-GET (CSRF), and namespace/owner enforcement on PUT/PATCH/
+// DELETE still confines a cookie holder to their own pages. 401 when none apply.
 async function authorizeWrite(request, env) {
   const presented = (request.headers.get('authorization') || '').replace(/^Bearer\\s+/i, '');
-  if (!presented) return { error: json({ error: 'unauthorized' }, 401) };
-  if (env.WRITE_TOKEN && safeEqual(presented, env.WRITE_TOKEN)) {
-    return { kind: 'byo', owner: env.SHARE_NAMESPACE || 'byo' };
+  if (presented) {
+    if (env.WRITE_TOKEN && safeEqual(presented, env.WRITE_TOKEN)) {
+      return { kind: 'byo', owner: env.SHARE_NAMESPACE || 'byo' };
+    }
+    const claims = await hooks.verifyPhoenixToken(request, env);
+    if (claims && typeof claims.userId === 'string' && claims.userId) {
+      return { kind: 'phoenix', owner: claims.userId, email: typeof claims.email === 'string' ? claims.email : '' };
+    }
   }
-  const claims = await hooks.verifyPhoenixToken(request, env);
-  if (claims && typeof claims.userId === 'string' && claims.userId) {
-    return { kind: 'phoenix', owner: claims.userId, email: typeof claims.email === 'string' ? claims.email : '' };
+  const cookieId = await identityFromCookie(request, env);
+  if (cookieId && cookieId.userId) {
+    return { kind: 'phoenix', owner: cookieId.userId, email: typeof cookieId.email === 'string' ? cookieId.email : '' };
   }
   return { error: json({ error: 'unauthorized' }, 401) };
 }