@schlessera/brain-ui-server 0.12.1 → 0.13.0

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAWA,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAoB1E,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAqBD,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB;;;EAyFvD"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAYA,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAoB1E,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAqBD,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB;;;EA6FvD"}

package/dist/app.js

@@ -8,6 +8,7 @@ import { brainRoutes } from "./routes/brain.js";
 import { sessionRoutes } from "./routes/sessions.js";
 import { voiceRoutes } from "./routes/voice.js";
 import { filesRoutes } from "./routes/files.js";
+import { shareRoutes, shareTargetFallbackRoutes } from "./routes/share.js";
 import { createRenderRoutes } from "./routes/render.js";
 import { providerRoutes } from "./routes/providers.js";
 import { modelRoutes } from "./routes/models.js";
@@ -74,6 +75,9 @@ export function createApp(options = {}) {
     // /api/status is intentionally NOT here — it leaks the git SHA, cron errors,
     // and a session oracle, so it lives behind the guard below.
     app.route("/api", healthRoutes);
+    // Not under /api, and not behind the guard: this is where a system share
+    // lands when no service worker was around to intercept it. See the route.
+    app.route("/", shareTargetFallbackRoutes);
     app.route("/api", authRoutes(authMode, { passwordDisabled: passwordLoginDisabled }));
     app.route("/api", passkeyPublicRoutes(authMode));
     // Auth guard for every other /api/* route. The probe below is intentionally
@@ -89,6 +93,7 @@ export function createApp(options = {}) {
     app.route("/api", sessionRoutes);
     app.route("/api", voiceRoutes);
     app.route("/api", filesRoutes);
+    app.route("/api", shareRoutes);
     app.route("/api", createRenderRoutes(options.renderer));
     app.route("/api", providerRoutes);
     app.route("/api", modelRoutes);

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAyBxE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,2EAA2E;AAC3E,6CAA6C;AAC7C,SAAS,iBAAiB,CAAC,CAAU,EAAE,cAAwB;IAC7D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,4EAA4E;IAC5E,2EAA2E;IAC3E,6CAA6C;IAC7C,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,mBAAmB,EAAE,CAAC;IAEtB,IAAI,OAAO,CAAC,MAAM;QAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,eAAe,CAAC;QACd,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IAEH,aAAa;IACb,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvB,6EAA6E;IAC7E,sEAAsE;IACtE,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,IAAI,CAAC;YACH,MAAM,EAAE,cAAc;YACtB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;YAC9C,YAAY,EAAE,CAAC,cAAc,CAAC;YAC9B,WAAW,EAAE,IAAI;SAClB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,6EAA6E;IAC7E,4DAA4D;IAC5D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjD,4EAA4E;IAC5E,wEAAwE;IACxE,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,6EAA6E;IAC7E,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE/B,6EAA6E;IAC7E,2EAA2E;IAC3E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACjD,eAAe;QACf,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAyBxE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,2EAA2E;AAC3E,6CAA6C;AAC7C,SAAS,iBAAiB,CAAC,CAAU,EAAE,cAAwB;IAC7D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,4EAA4E;IAC5E,2EAA2E;IAC3E,6CAA6C;IAC7C,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,mBAAmB,EAAE,CAAC;IAEtB,IAAI,OAAO,CAAC,MAAM;QAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,eAAe,CAAC;QACd,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IAEH,aAAa;IACb,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvB,6EAA6E;IAC7E,sEAAsE;IACtE,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,IAAI,CAAC;YACH,MAAM,EAAE,cAAc;YACtB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;YAC9C,YAAY,EAAE,CAAC,cAAc,CAAC;YAC9B,WAAW,EAAE,IAAI;SAClB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,6EAA6E;IAC7E,4DAA4D;IAC5D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,yEAAyE;IACzE,0EAA0E;IAC1E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjD,4EAA4E;IAC5E,wEAAwE;IACxE,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,6EAA6E;IAC7E,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE/B,6EAA6E;IAC7E,2EAA2E;IAC3E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACjD,eAAe;QACf,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -14,5 +14,6 @@ export { getBackends, getBackendsInfo } from "./agent/backend.js";
 export { resolveAuthMode, type AuthMode } from "./middleware/auth.js";
 export { WsHost, type WsHostOptions, defaultWsHost, configureWsHost, handleClientMessage, resetForTests, resolveTurnTarget, createSessionCatalog, type SessionCatalog, } from "./ws/handler.js";
 export * as brainClient from "./brain/client.js";
+export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
 export { buildKeyterms, writeCache } from "./voice/keyterm-builder.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG9E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAI7D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGtE,OAAO,EACL,MAAM,EACN,KAAK,aAAa,EAClB,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG9E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAI7D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGtE,OAAO,EACL,MAAM,EACN,KAAK,aAAa,EAClB,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAIjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGzE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -20,6 +20,9 @@ export { WsHost, defaultWsHost, configureWsHost, handleClientMessage, resetForTe
 // Brain repo access (spawned CLI wrapper) — useful for embedders that add
 // their own routes on top.
 export * as brainClient from "./brain/client.js";
+// Share staging: a deployment can sweep expired staging dirs at boot; the
+// intake route also sweeps opportunistically on every share.
+export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
 // Voice keyterm cache rebuild (used by deployments after `brain sync`).
 export { buildKeyterms, writeCache } from "./voice/keyterm-builder.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAA2C,MAAM,UAAU,CAAC;AAE9E,+CAA+C;AAC/C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7D,4EAA4E;AAC5E,+BAA+B;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAiB,MAAM,sBAAsB,CAAC;AAEtE,+CAA+C;AAC/C,OAAO,EACL,MAAM,EAEN,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,0EAA0E;AAC1E,2BAA2B;AAC3B,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAEjD,wEAAwE;AACxE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAA2C,MAAM,UAAU,CAAC;AAE9E,+CAA+C;AAC/C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7D,4EAA4E;AAC5E,+BAA+B;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAiB,MAAM,sBAAsB,CAAC;AAEtE,+CAA+C;AAC/C,OAAO,EACL,MAAM,EAEN,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,0EAA0E;AAC1E,2BAA2B;AAC3B,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAEjD,0EAA0E;AAC1E,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,wEAAwE;AACxE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/middleware/origin.d.ts

@@ -0,0 +1,17 @@
+import type { Context } from "hono";
+/**
+ * Same-origin enforcement for requests a browser sends without a preflight.
+ *
+ * Every other state-changing route here reads `application/json`, which is not
+ * a CORS-simple content type and so forces a preflight the attacker's origin
+ * fails — CSRF-safe by accident. A multipart upload has no such protection: it
+ * is a simple request, and under `AUTH_MODE=tailscale` the credential is the
+ * source IP rather than a cookie, so no SameSite flag stands in the way either.
+ * Any page opened on the tailnet could otherwise POST into the brain.
+ *
+ * The check is free because the routes that use it are only ever called by the
+ * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
+ */
+export declare function allowedOriginList(): string[];
+export declare function isSameOriginRequest(c: Context, allowed?: string[]): boolean;
+//# sourceMappingURL=origin.d.ts.map

package/dist/middleware/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAK5C;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,WAAsB,GAAG,OAAO,CAgBtF"}

package/dist/middleware/origin.js

@@ -0,0 +1,40 @@
+/**
+ * Same-origin enforcement for requests a browser sends without a preflight.
+ *
+ * Every other state-changing route here reads `application/json`, which is not
+ * a CORS-simple content type and so forces a preflight the attacker's origin
+ * fails — CSRF-safe by accident. A multipart upload has no such protection: it
+ * is a simple request, and under `AUTH_MODE=tailscale` the credential is the
+ * source IP rather than a cookie, so no SameSite flag stands in the way either.
+ * Any page opened on the tailnet could otherwise POST into the brain.
+ *
+ * The check is free because the routes that use it are only ever called by the
+ * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
+ */
+export function allowedOriginList() {
+    return (process.env.ALLOWED_ORIGINS ?? "")
+        .split(",")
+        .map((origin) => origin.trim())
+        .filter(Boolean);
+}
+export function isSameOriginRequest(c, allowed = allowedOriginList()) {
+    // Chromium and Firefox send this, and it is not settable by script.
+    const site = c.req.header("sec-fetch-site");
+    if (site)
+        return site === "same-origin" || site === "none";
+    // Older browsers: fall back to Origin, and to the configured allowlist when
+    // the deployment is split across origins.
+    const origin = c.req.header("origin");
+    if (!origin)
+        return true; // A non-browser client; still gated by auth.
+    if (allowed.length > 0)
+        return allowed.includes(origin);
+    try {
+        const host = c.req.header("host");
+        return !!host && new URL(origin).host === host;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=origin.js.map

package/dist/middleware/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SACvC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,OAAO,GAAG,iBAAiB,EAAE;IAC3E,oEAAoE;IACpE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,CAAC;IAE3D,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/routes/share.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Answer a share that reached the SERVER — which means no service worker was
+ * there to intercept it.
+ *
+ * That happens: the worker is evicted, storage was cleared, or the app was
+ * installed before the worker activated. Android bakes the share target's
+ * intent filters into the WebAPK at install time, so the share sheet keeps
+ * offering the app regardless, and the POST lands here. Without this route the
+ * user gets a bare 404 inside the app window (the SPA fallback is GET-only).
+ *
+ * The body is deliberately not read: the payload cannot be recovered from here
+ * anyway. Landing in the app is still the best outcome, because loading the app
+ * re-registers the worker and the next share works.
+ *
+ * Registered BEFORE the auth guard, and it must stay there: a share navigation
+ * is cross-site, so the SameSite=Strict session cookie is absent by
+ * construction and an authenticated version of this route could never fire.
+ */
+export declare const shareTargetFallbackRoutes: import("hono/hono-base").HonoBase<import("hono/types").BlankEnv, {
+    "/share-target": {
+        $post: {
+            input: {};
+            output: undefined;
+            outputFormat: "redirect";
+            status: 303;
+        };
+    };
+}, "/", "/share-target">;
+export declare const shareRoutes: import("hono/hono-base").HonoBase<import("hono/types").BlankEnv, {
+    "/share": {
+        $post: {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 403;
+        } | {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 503;
+        } | {
+            input: {};
+            output: {
+                error: string;
+                limit: number;
+            };
+            outputFormat: "json";
+            status: 413;
+        } | {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {};
+            output: {
+                id: string;
+                dir: string;
+                receivedAt: number;
+                title?: string | undefined;
+                text?: string | undefined;
+                url?: string | undefined;
+                files: {
+                    name: string;
+                    path: string;
+                    mediaType: string;
+                    bytes: number;
+                }[];
+                skipped?: string[] | undefined;
+            };
+            outputFormat: "json";
+            status: 201;
+        } | {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 500;
+        };
+    };
+}, "/", "/share">;
+//# sourceMappingURL=share.d.ts.map

package/dist/routes/share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.d.ts","sourceRoot":"","sources":["../../src/routes/share.ts"],"names":[],"mappings":"AA8DA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;wBAErC,CAAC;AA8BF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiEtB,CAAC"}

package/dist/routes/share.js

@@ -0,0 +1,158 @@
+import { Hono } from "hono";
+import { SHARE_MAX_CONCURRENT_INTAKE, SHARE_MAX_TOTAL_BYTES, } from "@schlessera/brain-ui-sdk/protocol";
+import { isSameOriginRequest } from "../middleware/origin.js";
+import { EmptyShareError, ShareTooLargeError, pruneShareStaging, stageShare, } from "../share/staging.js";
+/**
+ * Slack over the total cap for multipart framing (boundaries, part headers, and
+ * the title/text/url fields).
+ */
+const BODY_SLACK_BYTES = 1_000_000;
+const HARD_BODY_LIMIT = SHARE_MAX_TOTAL_BYTES + BODY_SLACK_BYTES;
+/**
+ * Read the body, refusing to buffer more than `limit` bytes.
+ *
+ * `content-length` is only a hint — HTTP/2 and chunked transfer encoding omit
+ * it entirely, and a client is free to lie — so the cap has to be counted off
+ * the stream itself. Calling `formData()` first would hand an unbounded body to
+ * the multipart parser and let an authenticated caller exhaust memory well
+ * inside the advertised limits.
+ *
+ * Returns null when the body exceeds the limit.
+ */
+async function readCappedBody(request, limit) {
+    const stream = request.body;
+    if (!stream)
+        return new Blob([]);
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > limit)
+                return null;
+            // Copy out of the reader's view: the underlying buffer may be reused.
+            chunks.push(value.slice().buffer);
+        }
+    }
+    finally {
+        reader.releaseLock();
+        // Nothing more is wanted from an over-limit body; let the peer find out.
+        if (total > limit)
+            await stream.cancel().catch(() => { });
+    }
+    // Hand the chunks to the parser as they are. Concatenating them into one
+    // buffer first would copy the whole payload a second time, for nothing.
+    return new Blob(chunks);
+}
+/**
+ * Answer a share that reached the SERVER — which means no service worker was
+ * there to intercept it.
+ *
+ * That happens: the worker is evicted, storage was cleared, or the app was
+ * installed before the worker activated. Android bakes the share target's
+ * intent filters into the WebAPK at install time, so the share sheet keeps
+ * offering the app regardless, and the POST lands here. Without this route the
+ * user gets a bare 404 inside the app window (the SPA fallback is GET-only).
+ *
+ * The body is deliberately not read: the payload cannot be recovered from here
+ * anyway. Landing in the app is still the best outcome, because loading the app
+ * re-registers the worker and the next share works.
+ *
+ * Registered BEFORE the auth guard, and it must stay there: a share navigation
+ * is cross-site, so the SameSite=Strict session cookie is absent by
+ * construction and an authenticated version of this route could never fire.
+ */
+export const shareTargetFallbackRoutes = new Hono().post("/share-target", (c) => c.redirect("/?share_error=no_worker", 303));
+/**
+ * In-flight intakes. Each one holds its whole payload in memory while the
+ * multipart parser runs, so without a bound the per-share cap multiplies by
+ * however many clients ask at once — on a box that also runs headless Chrome
+ * for the renderer.
+ */
+let inFlight = 0;
+/** At most one sweep per interval: the intake path should not stat the inbox on every upload. */
+let lastPrune = 0;
+const PRUNE_INTERVAL_MS = 10 * 60 * 1000;
+function maybePrune() {
+    const now = Date.now();
+    if (now - lastPrune < PRUNE_INTERVAL_MS)
+        return;
+    lastPrune = now;
+    // Deliberately not awaited: pruning is housekeeping, and the client is
+    // waiting on the staging result, not on it.
+    void pruneShareStaging().catch((err) => {
+        console.error("[share] prune failed:", err);
+    });
+}
+function firstString(form, name) {
+    const value = form.get(name);
+    return typeof value === "string" && value.trim() ? value : undefined;
+}
+export const shareRoutes = new Hono().post("/share", async (c) => {
+    // See middleware/origin.ts: a multipart POST is a CORS-simple request, so it
+    // reaches this route with no preflight, and in tailscale mode the credential
+    // is the source IP. This route is only ever called by the app itself.
+    if (!isSameOriginRequest(c)) {
+        return c.json({ error: "cross_origin_rejected" }, 403);
+    }
+    if (inFlight >= SHARE_MAX_CONCURRENT_INTAKE) {
+        return c.json({ error: "busy" }, 503);
+    }
+    const tooLarge = () => c.json({ error: "share_too_large", limit: SHARE_MAX_TOTAL_BYTES }, 413);
+    // Cheap early-out for a client that declares its size honestly; the streamed
+    // count below is what actually enforces the cap.
+    const declaredLength = Number(c.req.header("content-length") ?? "0");
+    if (Number.isFinite(declaredLength) && declaredLength > HARD_BODY_LIMIT) {
+        return tooLarge();
+    }
+    const raw = await readCappedBody(c.req.raw, HARD_BODY_LIMIT);
+    if (raw === null)
+        return tooLarge();
+    let form;
+    try {
+        const contentType = c.req.header("content-type");
+        form = await new Response(raw, {
+            headers: contentType ? { "content-type": contentType } : {},
+        }).formData();
+    }
+    catch {
+        // A truncated upload or a malformed multipart body. The share is gone
+        // either way; the client re-offers it from its own copy.
+        return c.json({ error: "invalid_form" }, 400);
+    }
+    // Empty parts are what an app sends when it has nothing to attach.
+    const files = form
+        .getAll("files")
+        .filter((value) => value instanceof File && value.size > 0);
+    inFlight += 1;
+    try {
+        const result = await stageShare({
+            title: firstString(form, "title"),
+            text: firstString(form, "text"),
+            url: firstString(form, "url"),
+            files,
+        });
+        maybePrune();
+        return c.json(result, 201);
+    }
+    catch (err) {
+        if (err instanceof EmptyShareError) {
+            return c.json({ error: "empty_share" }, 400);
+        }
+        if (err instanceof ShareTooLargeError) {
+            return c.json({ error: err.reason, limit: err.limit }, 413);
+        }
+        console.error("[share]", err);
+        return c.json({ error: "share_failed" }, 500);
+    }
+    finally {
+        inFlight -= 1;
+    }
+});
+//# sourceMappingURL=share.js.map

package/dist/routes/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["../../src/routes/share.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B;;;GAGG;AACH,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,eAAe,GAAG,qBAAqB,GAAG,gBAAgB,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,KAAa;IAEb,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,KAAK;gBAAE,OAAO,IAAI,CAAC;YAC/B,sEAAsE;YACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAqB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACrB,yEAAyE;QACzE,IAAI,KAAK,GAAG,KAAK;YAAE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9E,CAAC,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAC3C,CAAC;AAEF;;;;;GAKG;AACH,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB,iGAAiG;AACjG,IAAI,SAAS,GAAG,CAAC,CAAC;AAClB,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,SAAS,GAAG,iBAAiB;QAAE,OAAO;IAChD,SAAS,GAAG,GAAG,CAAC;IAChB,uEAAuE;IACvE,4CAA4C;IAC5C,KAAK,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/D,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,IAAI,2BAA2B,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;IAE1E,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,eAAe,EAAE,CAAC;QACxE,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,QAAQ,EAAE,CAAC;IAEpC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE;YAC7B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;SAC5D,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,yDAAyD;QACzD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,mEAAmE;IACnE,MAAM,KAAK,GAAG,IAAI;SACf,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,CAAC,KAAK,EAAiB,EAAE,CAAC,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAE7E,QAAQ,IAAI,CAAC,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC;YACjC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;YAC7B,KAAK;SACN,CAAC,CAAC;QAEH,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/share/staging.d.ts

@@ -0,0 +1,62 @@
+import { type ShareIntakeResult } from "@schlessera/brain-ui-sdk/protocol";
+/**
+ * Staging for an incoming system share.
+ *
+ * Everything a share carries is attacker-influenced: file names come from
+ * whichever app invoked the share sheet, and the text is whatever page the user
+ * was looking at. So the payload lands in a directory whose name the SERVER
+ * mints, under a dot-directory that is gitignored and hidden from the file
+ * browser, and nothing in it is ever trusted to be a path.
+ *
+ * The consumer is an LLM agent with file and shell tools, which sets the bar
+ * for "sanitized": a name is not safe merely because the filesystem accepts it.
+ * It also has to be safe unquoted in a shell, and free of characters that are
+ * invisible to the human reviewing what the agent is about to do.
+ */
+export declare class EmptyShareError extends Error {
+    constructor();
+}
+export type ShareLimitReason = "too_many_files" | "file_too_large" | "share_too_large" | "text_too_large" | "inbox_full";
+export declare class ShareTooLargeError extends Error {
+    /** Machine-readable reason, returned to the client verbatim. */
+    reason: ShareLimitReason;
+    limit: number;
+    constructor(
+    /** Machine-readable reason, returned to the client verbatim. */
+    reason: ShareLimitReason, limit: number);
+}
+export interface ShareInput {
+    title?: string | undefined;
+    text?: string | undefined;
+    url?: string | undefined;
+    files: File[];
+}
+/** Absolute staging root. Read per call, so a test can move BRAIN_PATH. */
+export declare function shareStagingRoot(): string;
+/**
+ * Reduce whatever the sharing app called a file to a plain name that cannot
+ * escape its directory, hide itself, or do anything in a shell.
+ *
+ * Path separators are dropped rather than replaced: a name is a name, and the
+ * only directory a staged file may land in is the one this module just made.
+ */
+export declare function sanitizeFileName(raw: string, mediaType: string): string;
+/**
+ * Write one share to its own staging directory and return the manifest.
+ *
+ * Staged into `.<id>.partial` and renamed into place only once `meta.json` is
+ * written. The rename is atomic within a filesystem, so the agent can never
+ * observe a share that is missing files or a manifest — not even if the process
+ * is killed mid-write, which `try/catch` cleanup cannot cover.
+ */
+export declare function stageShare(input: ShareInput): Promise<ShareIntakeResult>;
+/**
+ * Remove staged shares older than the TTL, and partial directories orphaned by
+ * a crash mid-write.
+ *
+ * Called opportunistically on each intake (debounced) and exported so a
+ * deployment can sweep at boot too — scheduling belongs to the container
+ * crontab, and this sweep is cheap and bounded.
+ */
+export declare function pruneShareStaging(now?: number): Promise<number>;
+//# sourceMappingURL=staging.d.ts.map

package/dist/share/staging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging.d.ts","sourceRoot":"","sources":["../../src/share/staging.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,iBAAiB,EAEvB,MAAM,mCAAmC,CAAC;AAG3C;;;;;;;;;;;;;GAaG;AAEH,qBAAa,eAAgB,SAAQ,KAAK;;CAKzC;AAED,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,gBAAgB,GAChB,YAAY,CAAC;AAEjB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,gEAAgE;IACzD,MAAM,EAAE,gBAAgB;IACxB,KAAK,EAAE,MAAM;;IAFpB,gEAAgE;IACzD,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,MAAM;CAKvB;AAgED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AA+BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAyBvE;AAyED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgH9E;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzE"}