@schlessera/brain-ui-server 0.12.1 → 0.13.1

package/dist/ws/turns.js

@@ -1,3 +1,28 @@
+/**
+ * Bytes one queued entry keeps alive in this process until its turn runs.
+ *
+ * Attachments dominate and are still base64 here — the host never decodes a
+ * follow-up's images, it hands the same strings to the backend when the turn
+ * starts — so their wire length IS the retained size. (A JS string may cost
+ * two bytes per character internally; this deliberately measures the payload,
+ * not the engine's representation, so the number matches what the sender put
+ * on the wire.) The client snapshot is a handful of short fields and is not
+ * worth walking.
+ */
+export function queuedFollowUpBytes(entry) {
+    let bytes = Buffer.byteLength(entry.text, "utf-8");
+    for (const attachment of entry.attachments) {
+        bytes += attachment.data.length;
+    }
+    return bytes;
+}
+/** Total bytes currently parked in a session's follow-up queue. */
+export function queuedBytes(turn) {
+    let bytes = 0;
+    for (const entry of turn.queue)
+        bytes += queuedFollowUpBytes(entry);
+    return bytes;
+}
 /**
  * Mutable turn state for one ws host: the running session slots and every
  * pending interactive round-trip. This used to be six module-level globals

package/dist/ws/turns.js.map

@@ -1 +1 @@
-{"version":3,"file":"turns.js","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AA8DA;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACjC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,gBAAgB,GAAG,CAAC,CAAC;IAEZ,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,eAAe,GAAG,CAAC,CAAC;IACpB,WAAW,GAAG,CAAC,CAAC;IAExB,qBAAqB;QACnB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;IACpE,CAAC;IAED,iBAAiB;QACf,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IAED,iDAAiD;IACjD,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,oDAAoD;IACpD,SAAS,CAAC,MAAc;QACtB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,IAAiB,EAAE,MAAc;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,IAAiB,EAAE,MAAc;QACnD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,GAAmB,EACnB,EAAU,EACV,IAAiB;QAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CACX,mCAAmC,EAAE,uCAAuC,CAC7E,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"turns.js","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAqB;IACvD,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAiDD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACjC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,gBAAgB,GAAG,CAAC,CAAC;IAEZ,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,eAAe,GAAG,CAAC,CAAC;IACpB,WAAW,GAAG,CAAC,CAAC;IAExB,qBAAqB;QACnB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;IACpE,CAAC;IAED,iBAAiB;QACf,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IAED,iDAAiD;IACjD,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,oDAAoD;IACpD,SAAS,CAAC,MAAc;QACtB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,IAAiB,EAAE,MAAc;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,IAAiB,EAAE,MAAc;QACnD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,GAAmB,EACnB,EAAU,EACV,IAAiB;QAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CACX,mCAAmC,EAAE,uCAAuC,CAC7E,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schlessera/brain-ui-server",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "brain-kit chat-UI server: Hono app factory, WebSocket turn coordinator, auth (password/passkeys/tailscale/proxy), session catalog, and brain/files/voice routes",
   "license": "MIT",
   "keywords": [
@@ -45,9 +45,9 @@
     "prepublishOnly": "bun ../../scripts/check-dist.ts"
   },
   "dependencies": {
-    "@schlessera/brain-backend-claude": "0.12.1",
-    "@schlessera/brain-render-template": "0.12.1",
-    "@schlessera/brain-ui-sdk": "0.12.1",
+    "@schlessera/brain-backend-claude": "0.13.1",
+    "@schlessera/brain-render-template": "0.13.1",
+    "@schlessera/brain-ui-sdk": "0.13.1",
     "@simplewebauthn/server": "^13.3.2",
     "hono": "^4",
     "ignore": "^7.0.5",

package/src/app.ts

@@ -9,6 +9,7 @@ import { brainRoutes } from "./routes/brain.js";
 import { sessionRoutes } from "./routes/sessions.js";
 import { voiceRoutes } from "./routes/voice.js";
 import { filesRoutes } from "./routes/files.js";
+import { shareRoutes, shareTargetFallbackRoutes } from "./routes/share.js";
 import { createRenderRoutes, type AppRenderer } from "./routes/render.js";
 import { providerRoutes } from "./routes/providers.js";
 import { modelRoutes } from "./routes/models.js";
@@ -114,6 +115,9 @@ export function createApp(options: CreateAppOptions = {}) {
   // /api/status is intentionally NOT here — it leaks the git SHA, cron errors,
   // and a session oracle, so it lives behind the guard below.
   app.route("/api", healthRoutes);
+  // Not under /api, and not behind the guard: this is where a system share
+  // lands when no service worker was around to intercept it. See the route.
+  app.route("/", shareTargetFallbackRoutes);
   app.route("/api", authRoutes(authMode, { passwordDisabled: passwordLoginDisabled }));
   app.route("/api", passkeyPublicRoutes(authMode));
 
@@ -130,6 +134,7 @@ export function createApp(options: CreateAppOptions = {}) {
   app.route("/api", sessionRoutes);
   app.route("/api", voiceRoutes);
   app.route("/api", filesRoutes);
+  app.route("/api", shareRoutes);
   app.route("/api", createRenderRoutes(options.renderer));
   app.route("/api", providerRoutes);
   app.route("/api", modelRoutes);

package/src/index.ts

@@ -35,5 +35,9 @@ export {
 // their own routes on top.
 export * as brainClient from "./brain/client.js";
 
+// Share staging: a deployment can sweep expired staging dirs at boot; the
+// intake route also sweeps opportunistically on every share.
+export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
+
 // Voice keyterm cache rebuild (used by deployments after `brain sync`).
 export { buildKeyterms, writeCache } from "./voice/keyterm-builder.js";

package/src/middleware/origin.ts

@@ -0,0 +1,39 @@
+import type { Context } from "hono";
+
+/**
+ * Same-origin enforcement for requests a browser sends without a preflight.
+ *
+ * Every other state-changing route here reads `application/json`, which is not
+ * a CORS-simple content type and so forces a preflight the attacker's origin
+ * fails — CSRF-safe by accident. A multipart upload has no such protection: it
+ * is a simple request, and under `AUTH_MODE=tailscale` the credential is the
+ * source IP rather than a cookie, so no SameSite flag stands in the way either.
+ * Any page opened on the tailnet could otherwise POST into the brain.
+ *
+ * The check is free because the routes that use it are only ever called by the
+ * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
+ */
+export function allowedOriginList(): string[] {
+  return (process.env.ALLOWED_ORIGINS ?? "")
+    .split(",")
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+}
+
+export function isSameOriginRequest(c: Context, allowed = allowedOriginList()): boolean {
+  // Chromium and Firefox send this, and it is not settable by script.
+  const site = c.req.header("sec-fetch-site");
+  if (site) return site === "same-origin" || site === "none";
+
+  // Older browsers: fall back to Origin, and to the configured allowlist when
+  // the deployment is split across origins.
+  const origin = c.req.header("origin");
+  if (!origin) return true; // A non-browser client; still gated by auth.
+  if (allowed.length > 0) return allowed.includes(origin);
+  try {
+    const host = c.req.header("host");
+    return !!host && new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}

package/src/routes/share.ts

@@ -0,0 +1,178 @@
+import { Hono } from "hono";
+import {
+  SHARE_MAX_CONCURRENT_INTAKE,
+  SHARE_MAX_TOTAL_BYTES,
+} from "@schlessera/brain-ui-sdk/protocol";
+import { isSameOriginRequest } from "../middleware/origin.js";
+import {
+  EmptyShareError,
+  ShareTooLargeError,
+  pruneShareStaging,
+  stageShare,
+} from "../share/staging.js";
+
+/**
+ * Slack over the total cap for multipart framing (boundaries, part headers, and
+ * the title/text/url fields).
+ */
+const BODY_SLACK_BYTES = 1_000_000;
+const HARD_BODY_LIMIT = SHARE_MAX_TOTAL_BYTES + BODY_SLACK_BYTES;
+
+/**
+ * Read the body, refusing to buffer more than `limit` bytes.
+ *
+ * `content-length` is only a hint — HTTP/2 and chunked transfer encoding omit
+ * it entirely, and a client is free to lie — so the cap has to be counted off
+ * the stream itself. Calling `formData()` first would hand an unbounded body to
+ * the multipart parser and let an authenticated caller exhaust memory well
+ * inside the advertised limits.
+ *
+ * Returns null when the body exceeds the limit.
+ */
+async function readCappedBody(
+  request: Request,
+  limit: number
+): Promise<Blob | null> {
+  const stream = request.body;
+  if (!stream) return new Blob([]);
+
+  const reader = stream.getReader();
+  const chunks: BlobPart[] = [];
+  let total = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > limit) return null;
+      // Copy out of the reader's view: the underlying buffer may be reused.
+      chunks.push(value.slice().buffer as ArrayBuffer);
+    }
+  } finally {
+    reader.releaseLock();
+    // Nothing more is wanted from an over-limit body; let the peer find out.
+    if (total > limit) await stream.cancel().catch(() => {});
+  }
+
+  // Hand the chunks to the parser as they are. Concatenating them into one
+  // buffer first would copy the whole payload a second time, for nothing.
+  return new Blob(chunks);
+}
+
+/**
+ * Answer a share that reached the SERVER — which means no service worker was
+ * there to intercept it.
+ *
+ * That happens: the worker is evicted, storage was cleared, or the app was
+ * installed before the worker activated. Android bakes the share target's
+ * intent filters into the WebAPK at install time, so the share sheet keeps
+ * offering the app regardless, and the POST lands here. Without this route the
+ * user gets a bare 404 inside the app window (the SPA fallback is GET-only).
+ *
+ * The body is deliberately not read: the payload cannot be recovered from here
+ * anyway. Landing in the app is still the best outcome, because loading the app
+ * re-registers the worker and the next share works.
+ *
+ * Registered BEFORE the auth guard, and it must stay there: a share navigation
+ * is cross-site, so the SameSite=Strict session cookie is absent by
+ * construction and an authenticated version of this route could never fire.
+ */
+export const shareTargetFallbackRoutes = new Hono().post("/share-target", (c) =>
+  c.redirect("/?share_error=no_worker", 303)
+);
+
+/**
+ * In-flight intakes. Each one holds its whole payload in memory while the
+ * multipart parser runs, so without a bound the per-share cap multiplies by
+ * however many clients ask at once — on a box that also runs headless Chrome
+ * for the renderer.
+ */
+let inFlight = 0;
+
+/** At most one sweep per interval: the intake path should not stat the inbox on every upload. */
+let lastPrune = 0;
+const PRUNE_INTERVAL_MS = 10 * 60 * 1000;
+
+function maybePrune(): void {
+  const now = Date.now();
+  if (now - lastPrune < PRUNE_INTERVAL_MS) return;
+  lastPrune = now;
+  // Deliberately not awaited: pruning is housekeeping, and the client is
+  // waiting on the staging result, not on it.
+  void pruneShareStaging().catch((err) => {
+    console.error("[share] prune failed:", err);
+  });
+}
+
+function firstString(form: FormData, name: string): string | undefined {
+  const value = form.get(name);
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+
+export const shareRoutes = new Hono().post("/share", async (c) => {
+  // See middleware/origin.ts: a multipart POST is a CORS-simple request, so it
+  // reaches this route with no preflight, and in tailscale mode the credential
+  // is the source IP. This route is only ever called by the app itself.
+  if (!isSameOriginRequest(c)) {
+    return c.json({ error: "cross_origin_rejected" }, 403);
+  }
+
+  if (inFlight >= SHARE_MAX_CONCURRENT_INTAKE) {
+    return c.json({ error: "busy" }, 503);
+  }
+
+  const tooLarge = () =>
+    c.json({ error: "share_too_large", limit: SHARE_MAX_TOTAL_BYTES }, 413);
+
+  // Cheap early-out for a client that declares its size honestly; the streamed
+  // count below is what actually enforces the cap.
+  const declaredLength = Number(c.req.header("content-length") ?? "0");
+  if (Number.isFinite(declaredLength) && declaredLength > HARD_BODY_LIMIT) {
+    return tooLarge();
+  }
+
+  const raw = await readCappedBody(c.req.raw, HARD_BODY_LIMIT);
+  if (raw === null) return tooLarge();
+
+  let form: FormData;
+  try {
+    const contentType = c.req.header("content-type");
+    form = await new Response(raw, {
+      headers: contentType ? { "content-type": contentType } : {},
+    }).formData();
+  } catch {
+    // A truncated upload or a malformed multipart body. The share is gone
+    // either way; the client re-offers it from its own copy.
+    return c.json({ error: "invalid_form" }, 400);
+  }
+
+  // Empty parts are what an app sends when it has nothing to attach.
+  const files = form
+    .getAll("files")
+    .filter((value): value is File => value instanceof File && value.size > 0);
+
+  inFlight += 1;
+  try {
+    const result = await stageShare({
+      title: firstString(form, "title"),
+      text: firstString(form, "text"),
+      url: firstString(form, "url"),
+      files,
+    });
+
+    maybePrune();
+    return c.json(result, 201);
+  } catch (err) {
+    if (err instanceof EmptyShareError) {
+      return c.json({ error: "empty_share" }, 400);
+    }
+    if (err instanceof ShareTooLargeError) {
+      return c.json({ error: err.reason, limit: err.limit }, 413);
+    }
+    console.error("[share]", err);
+    return c.json({ error: "share_failed" }, 500);
+  } finally {
+    inFlight -= 1;
+  }
+});