@schlessera/brain-ui-server 0.30.1 → 0.32.0

package/src/middleware/origin.ts

@@ -1,32 +1,100 @@
-import type { Context } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 
 /**
- * Same-origin enforcement for requests a browser sends without a preflight.
+ * Compare the browser's Origin with the request's externally visible origin.
  *
- * Every other state-changing route here reads `application/json`, which is not
- * a CORS-simple content type and so forces a preflight the attacker's origin
- * fails — CSRF-safe by accident. A multipart upload has no such protection: it
- * is a simple request, and under `AUTH_MODE=tailscale` the credential is the
- * source IP rather than a cookie, so no SameSite flag stands in the way either.
- * Any page opened on the tailnet could otherwise POST into the brain.
- *
- * The check is free because the routes that use it are only ever called by the
- * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
+ * Without a trusted proxy the server cannot know whether TLS was terminated
+ * upstream, so preserve the historical host+port comparison. Once proxy
+ * headers are trusted, include the scheme sourced from X-Forwarded-Proto.
  */
-export function isSameOriginRequest(c: Context, allowed: string[]): boolean {
-  // Chromium and Firefox send this, and it is not settable by script.
-  const site = c.req.header("sec-fetch-site");
-  if (site) return site === "same-origin" || site === "none";
+function originMatchesRequest(
+  c: Context,
+  origin: string,
+  trustProxy: boolean
+): boolean {
+  const host = c.req.header("host");
+  if (!host) return false;
+
+  const parsedOrigin = new URL(origin);
+  if (!trustProxy) return parsedOrigin.host === host;
+
+  const forwarded = c.req.header("x-forwarded-proto")?.split(",", 1)[0]?.trim();
+  const protocol = forwarded
+    ? `${forwarded.toLowerCase()}:`
+    : new URL(c.req.url).protocol;
+
+  return parsedOrigin.origin === new URL(`${protocol}//${host}`).origin;
+}
 
-  // Older browsers: fall back to Origin, and to the configured allowlist when
-  // the deployment is split across origins.
+/**
+ * Browser request origin policy shared by state-changing HTTP routes and the
+ * WebSocket upgrade.
+ *
+ * Fetch metadata is authoritative when it says same-origin (including the
+ * Vite proxy case where Host is rewritten). Older browsers fall back to an
+ * Origin comparison: host+port without TRUST_PROXY, or the full origin when
+ * proxy headers are trusted. Headerless non-browser clients remain accepted
+ * and are still subject to the route's auth guard. ALLOWED_ORIGINS is an
+ * additional path for explicitly configured split-topology deployments.
+ */
+export function isSameOriginRequest(
+  c: Context,
+  allowedOrigins: readonly string[],
+  trustProxy = false
+): boolean {
+  const site = c.req.header("sec-fetch-site")?.toLowerCase();
   const origin = c.req.header("origin");
-  if (!origin) return true; // A non-browser client; still gated by auth.
-  if (allowed.length > 0) return allowed.includes(origin);
-  try {
-    const host = c.req.header("host");
-    return !!host && new URL(origin).host === host;
-  } catch {
-    return false;
+
+  // An opaque sandboxed origin is present, not equivalent to a headerless
+  // non-browser client. Reject it even if other metadata claims same-origin.
+  if (origin?.toLowerCase() === "null") return false;
+
+  if (site === "same-origin" || site === "none") return true;
+
+  if (origin) {
+    try {
+      if (originMatchesRequest(c, origin, trustProxy)) return true;
+    } catch {
+      // Malformed Origin can still only match an allowlist by exact string.
+    }
   }
+
+  if (!site && !origin) return true;
+
+  return origin !== undefined && allowedOrigins.includes(origin);
+}
+
+/**
+ * Enforce the origin policy on every non-GET API request, with an optional
+ * additional allowlist confined to one route prefix.
+ */
+export function originPolicy(
+  allowedOrigins: readonly string[],
+  trustProxy = false,
+  scopedAllowlist?: { pathPrefix: string; origins: readonly string[] }
+): MiddlewareHandler {
+  return async (c, next) => {
+    const requestAllowedOrigins =
+      scopedAllowlist && c.req.path.startsWith(scopedAllowlist.pathPrefix)
+        ? [...allowedOrigins, ...scopedAllowlist.origins]
+        : allowedOrigins;
+    if (
+      c.req.method !== "GET" &&
+      !isSameOriginRequest(c, requestAllowedOrigins, trustProxy)
+    ) {
+      return c.json({ error: "cross_origin_rejected" }, 403);
+    }
+    await next();
+  };
+}
+
+/** Require the exact JSON media type while allowing standard parameters. */
+export function requireJson(): MiddlewareHandler {
+  return async (c, next) => {
+    const mediaType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+    if (mediaType !== "application/json") {
+      return c.json({ error: "unsupported_media_type" }, 415);
+    }
+    await next();
+  };
 }

package/src/middleware/passkeys.ts

@@ -19,11 +19,18 @@ import {
   type AuthRuntime,
   issueSessionCookie,
   consumeLoginToken,
-  LOGIN_RATE_LIMIT,
-  GLOBAL_LOGIN_RATE_LIMIT,
+  isLoginBlocked,
+  recordLoginFailure,
+  PASSKEY_LOGIN_RATE_LIMIT,
+  acquirePasskeyVerification,
+  releasePasskeyVerification,
+  bumpSessionsEpoch,
 } from "./auth.js";
 import { clientIp } from "./tailscale.js";
 import type { WebAuthnConfig } from "../config/env.js";
+import { readJsonBody } from "./body-limit.js";
+import { requireJson } from "./origin.js";
+import type { ClientSet } from "../ws/clients.js";
 
 /**
  * WebAuthn passkeys as an extension of `password` mode: the password bootstraps
@@ -43,9 +50,12 @@ import type { WebAuthnConfig } from "../config/env.js";
 /** Injected per-app dependencies for every passkey route and helper. */
 export interface PasskeyContext {
   db: Database;
+  /** Live sockets invalidated when a credential is revoked. */
+  clients: ClientSet;
+  /** WebAuthn identity plus ceremony-only origin and RP overrides. */
   webauthn: WebAuthnConfig;
   auth: AuthRuntime;
-  /** ALLOWED_ORIGINS — split-topology origins also valid for ceremonies. */
+  /** ALLOWED_ORIGINS — globally allowed split-topology origins. */
   allowedOrigins: string[];
   /** Where ceremony failures are reported; absent means silence. */
   log?: Logger;
@@ -322,21 +332,17 @@ export function passkeyPublicRoutes(
     return c.json(options);
   });
 
-  app.post("/auth/passkey/login-verify", async (c) => {
+  app.post("/auth/passkey/login-verify", requireJson(), async (c) => {
     if (mode !== "password") return notEnabled(c);
     const ip = clientIp(c, ctx.auth.trustProxy, ctx.auth.trustProxyHops) || "unknown";
-    // Same buckets as password login: one combined online-guess budget.
-    const perIpOk = consumeLoginToken(`ip:${ip}`, LOGIN_RATE_LIMIT);
-    const globalOk = consumeLoginToken("global", GLOBAL_LOGIN_RATE_LIMIT);
-    if (!perIpOk || !globalOk) {
-      return c.json({ error: "Too many attempts. Try again in a minute." }, 429);
-    }
     const rp = resolveRp(c, ctx);
     if (!rp) return c.json({ error: "Origin not allowed" }, 400);
 
     let response: AuthenticationResponseJSON;
     try {
-      response = await c.req.json();
+      const result = await readJsonBody<AuthenticationResponseJSON>(c);
+      if (result instanceof Response) return result;
+      response = result;
     } catch {
       return c.json({ error: "Invalid request body" }, 400);
     }
@@ -352,22 +358,59 @@ export function passkeyPublicRoutes(
       return fail();
     }
 
-    try {
-      const result = await verifyAuthentication({
-        response,
-        expectedChallenge: challenge,
-        expectedOrigin: rp.origin,
-        expectedRPID: rp.rpID,
-        credential: toWebAuthnCredential(row),
+    // Only a credential for this RP carrying a live, single-use challenge can
+    // reach this budget. Random bodies are rejected above without allocating
+    // or incrementing attacker-controlled bucket keys.
+    const failureBucket = `pk:${ip}`;
+    if (isLoginBlocked(failureBucket, PASSKEY_LOGIN_RATE_LIMIT)) {
+      return c.json({ error: "Too many attempts. Try again in a minute." }, 429);
+    }
+
+    if (!acquirePasskeyVerification(ip)) {
+      ctx.failures?.add(1, {
+        reason: "in_flight_limited",
+        ceremony: "authentication",
       });
-      if (!result.verified) return fail();
-      ctx.db
-        .prepare(
-          "UPDATE passkey_credentials SET counter = ?, last_used_at = ? WHERE id = ?"
-        )
-        .run(result.authenticationInfo.newCounter, now(), row.id);
+      ctx.log?.emit({
+        severityText: "WARN",
+        body: "passkey verification capacity reached",
+        attributes: { ip },
+      });
+      return c.json({ error: "Too many login verifications in progress." }, 429);
+    }
+
+    try {
+      try {
+        const result = await verifyAuthentication({
+          response,
+          expectedChallenge: challenge,
+          expectedOrigin: rp.origin,
+          expectedRPID: rp.rpID,
+          credential: toWebAuthnCredential(row),
+        });
+        if (!result.verified) {
+          recordLoginFailure(failureBucket, PASSKEY_LOGIN_RATE_LIMIT);
+          ctx.failures?.add(1, {
+            reason: "verification_failed",
+            ceremony: "authentication",
+          });
+          ctx.log?.emit({
+            severityText: "WARN",
+            body: "passkey authentication failed",
+          });
+          return fail();
+        }
+        ctx.db
+          .prepare(
+            "UPDATE passkey_credentials SET counter = ?, last_used_at = ? WHERE id = ?"
+          )
+          .run(result.authenticationInfo.newCounter, now(), row.id);
+      } finally {
+        releasePasskeyVerification(ip);
+      }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
+      recordLoginFailure(failureBucket, PASSKEY_LOGIN_RATE_LIMIT);
       // The library throws on a counter regression — possible cloned
       // credential. Cloud passkeys legitimately sit at 0, so warn, don't
       // revoke.
@@ -390,7 +433,7 @@ export function passkeyPublicRoutes(
       return fail();
     }
 
-    await issueSessionCookie(c, ctx.auth);
+    await issueSessionCookie(c, ctx.auth, ctx.db);
     return c.json({ ok: true });
   });
 
@@ -436,14 +479,19 @@ export function passkeyManagementRoutes(
     return c.json(options);
   });
 
-  app.post("/auth/passkey/register-verify", async (c) => {
+  app.post("/auth/passkey/register-verify", requireJson(), async (c) => {
     if (mode !== "password") return notEnabled(c);
     const rp = resolveRp(c, ctx);
     if (!rp) return c.json({ error: "Origin not allowed" }, 400);
 
     let body: { response?: RegistrationResponseJSON; label?: unknown };
     try {
-      body = await c.req.json();
+      const result = await readJsonBody<{
+        response?: RegistrationResponseJSON;
+        label?: unknown;
+      }>(c);
+      if (result instanceof Response) return result;
+      body = result;
     } catch {
       return c.json({ error: "Invalid request body" }, 400);
     }
@@ -510,11 +558,13 @@ export function passkeyManagementRoutes(
     return c.json({ credentials: rows.map(toSummary) });
   });
 
-  app.put("/auth/passkey/:id", async (c) => {
+  app.put("/auth/passkey/:id", requireJson(), async (c) => {
     if (mode !== "password") return notEnabled(c);
     let body: { label?: unknown };
     try {
-      body = await c.req.json();
+      const result = await readJsonBody<{ label?: unknown }>(c);
+      if (result instanceof Response) return result;
+      body = result;
     } catch {
       return c.json({ error: "Invalid request body" }, 400);
     }
@@ -531,6 +581,7 @@ export function passkeyManagementRoutes(
       .prepare("DELETE FROM passkey_credentials WHERE id = ?")
       .run(c.req.param("id"));
     if (result.changes === 0) return c.json({ error: "Unknown passkey" }, 404);
+    bumpSessionsEpoch(ctx.db, ctx.clients);
     return c.json({ ok: true });
   });
 

package/src/routes/brain.ts

@@ -9,6 +9,8 @@ import {
 } from "../voice/keyterm-builder.js";
 import { existsSync } from "fs";
 import { join } from "path";
+import { readJsonBody } from "../middleware/body-limit.js";
+import { requireJson } from "../middleware/origin.js";
 
 export interface BrainRoutesDeps {
   brain: BrainClient;
@@ -288,13 +290,15 @@ export function createBrainRoutes(deps: BrainRoutesDeps): Hono {
     });
   })
 
-  .post("/brain/add", async (c) => {
-    const body = await c.req.json<{
+  .post("/brain/add", requireJson(), async (c) => {
+    const result = await readJsonBody<{
       content: string;
       type?: string;
       title?: string;
       tags?: string[];
-    }>();
+    }>(c);
+    if (result instanceof Response) return result;
+    const body = result;
     if (!body.content) {
       return c.json({ error: "Field 'content' is required" }, 400);
     }

package/src/routes/files.ts

@@ -24,7 +24,7 @@ function errorResponse(err: unknown, log?: Logger): { body: { error: string; siz
     return { body: { error: "file_too_large", size: err.size }, status: 413 };
   }
   log?.emit({ severityText: "ERROR", body: "file request failed", attributes: { error: err instanceof Error ? err.message : String(err) } });
-  return { body: { error: err instanceof Error ? err.message : "internal_error" }, status: 500 };
+  return { body: { error: "internal_error" }, status: 500 };
 }
 
 export function createFilesRoutes(deps: { brainRoot: string; log?: Logger }): Hono {
@@ -57,7 +57,7 @@ export function createFilesRoutes(deps: { brainRoot: string; log?: Logger }): Ho
             "Content-Length": String(size),
             "Content-Disposition": "inline",
             "X-Content-Type-Options": "nosniff",
-            "Content-Security-Policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'",
+            "Content-Security-Policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; frame-ancestors 'none'",
             "Cache-Control": "private, max-age=0, must-revalidate",
           },
         });

package/src/routes/models.ts

@@ -18,6 +18,8 @@ import {
 } from "@schlessera/brain-ui-sdk";
 import type { BackendRegistry } from "../agent/backend.js";
 import type { ModelPricingState } from "../pricing/model-pricing.js";
+import { readJsonBody } from "../middleware/body-limit.js";
+import { requireJson } from "../middleware/origin.js";
 import {
   getBillingOverrides,
   getCustomOpenRouterModels,
@@ -97,8 +99,9 @@ export function createModelRoutes(deps: {
     return c.json(pricing.state());
   })
 
-  .put("/models/hidden", async (c) => {
-    const body = (await c.req.json().catch(() => null)) as unknown;
+  .put("/models/hidden", requireJson(), async (c) => {
+    const body = await readJsonBody(c).catch(() => null);
+    if (body instanceof Response) return body;
     const hidden = (body as { hidden?: unknown } | null)?.hidden;
     if (
       !Array.isArray(hidden) ||
@@ -113,8 +116,9 @@ export function createModelRoutes(deps: {
     return c.json(await buildCatalog());
   })
 
-  .put("/models/default", async (c) => {
-    const body = (await c.req.json().catch(() => null)) as unknown;
+  .put("/models/default", requireJson(), async (c) => {
+    const body = await readJsonBody(c).catch(() => null);
+    if (body instanceof Response) return body;
     const defaultId = (body as { defaultId?: unknown } | null)?.defaultId;
     if (defaultId !== null && typeof defaultId !== "string") {
       return c.json({ error: "defaultId must be a profile id or null" }, 400);
@@ -131,8 +135,9 @@ export function createModelRoutes(deps: {
     return c.json(await buildCatalog());
   })
 
-  .put("/models/custom", async (c) => {
-    const body = (await c.req.json().catch(() => null)) as unknown;
+  .put("/models/custom", requireJson(), async (c) => {
+    const body = await readJsonBody(c).catch(() => null);
+    if (body instanceof Response) return body;
     const models = (body as { models?: unknown } | null)?.models;
     if (!Array.isArray(models) || models.some((id) => typeof id !== "string")) {
       return c.json({ error: "models must be an array of OpenRouter model ids" }, 400);
@@ -185,8 +190,9 @@ export function createModelRoutes(deps: {
     return c.json(await buildCatalog());
   })
 
-  .put("/models/thinking", async (c) => {
-    const body = (await c.req.json().catch(() => null)) as unknown;
+  .put("/models/thinking", requireJson(), async (c) => {
+    const body = await readJsonBody(c).catch(() => null);
+    if (body instanceof Response) return body;
     const thinking = (body as { thinking?: unknown } | null)?.thinking;
     if (
       typeof thinking !== "object" ||
@@ -218,8 +224,9 @@ export function createModelRoutes(deps: {
     return c.json(await buildCatalog());
   })
 
-  .put("/models/billing", async (c) => {
-    const body = (await c.req.json().catch(() => null)) as unknown;
+  .put("/models/billing", requireJson(), async (c) => {
+    const body = await readJsonBody(c).catch(() => null);
+    if (body instanceof Response) return body;
     const billing = (body as { billing?: unknown } | null)?.billing;
     if (
       typeof billing !== "object" ||

package/src/routes/pi-auth.ts

@@ -17,6 +17,8 @@
 import { Hono } from "hono";
 import type { AgentConfig } from "../config/env.js";
 import { loadBackendModule, parsePiProfiles } from "../agent/backend.js";
+import { readJsonBody } from "../middleware/body-limit.js";
+import { requireJson } from "../middleware/origin.js";
 
 /** Structural mirror of the pi package's PiLoginFlow (primitives only). */
 export interface PiLoginFlowView {
@@ -104,8 +106,10 @@ export function createPiAuthRoutes(deps: PiAuthRoutesDeps): Hono {
       const auth = await getAuth();
       return c.json({ providers: await auth.status(providers) });
     })
-    .post("/pi-auth/login", async (c) => {
-      const body = (await c.req.json().catch(() => null)) as {
+    .post("/pi-auth/login", requireJson(), async (c) => {
+      const result = await readJsonBody(c).catch(() => null);
+      if (result instanceof Response) return result;
+      const body = result as {
         providerId?: unknown;
       } | null;
       const providerId = typeof body?.providerId === "string" ? body.providerId : "";
@@ -138,8 +142,10 @@ export function createPiAuthRoutes(deps: PiAuthRoutesDeps): Hono {
       auth.cancelFlow(c.req.param("id"));
       return c.json({ ok: true });
     })
-    .post("/pi-auth/logout", async (c) => {
-      const body = (await c.req.json().catch(() => null)) as {
+    .post("/pi-auth/logout", requireJson(), async (c) => {
+      const result = await readJsonBody(c).catch(() => null);
+      if (result instanceof Response) return result;
+      const body = result as {
         providerId?: unknown;
       } | null;
       const providerId = typeof body?.providerId === "string" ? body.providerId : "";

package/src/routes/push.ts

@@ -2,6 +2,8 @@ import { Hono } from "hono";
 import { z } from "zod";
 
 import type { PushSender } from "../activity/push-sender.js";
+import { readJsonBody } from "../middleware/body-limit.js";
+import { requireJson } from "../middleware/origin.js";
 
 /**
  * Push subscription lifecycle. Behind the auth guard by mount position —
@@ -59,9 +61,11 @@ export function createPushRoutes(deps: { sender: PushSender }): Hono {
       }
     })
 
-    .post("/push/subscribe", async (c) => {
+    .post("/push/subscribe", requireJson(), async (c) => {
       try {
-        const body = subscribeSchema.parse(await c.req.json());
+        const result = await readJsonBody(c);
+        if (result instanceof Response) return result;
+        const body = subscribeSchema.parse(result);
         sender.subscribe(body.subscription, body.label);
         return c.json({ ok: true });
       } catch (err) {
@@ -72,9 +76,11 @@ export function createPushRoutes(deps: { sender: PushSender }): Hono {
       }
     })
 
-    .post("/push/unsubscribe", async (c) => {
+    .post("/push/unsubscribe", requireJson(), async (c) => {
       try {
-        const body = unsubscribeSchema.parse(await c.req.json());
+        const result = await readJsonBody(c);
+        if (result instanceof Response) return result;
+        const body = unsubscribeSchema.parse(result);
         return c.json({ removed: sender.unsubscribe(body.endpoint) });
       } catch (err) {
         return c.json(

package/src/routes/render.ts

@@ -3,16 +3,18 @@ import { Hono } from "hono";
 import { z } from "zod";
 import type { RenderRequest } from "@schlessera/brain-ui-sdk/protocol";
 import { buildHtmlDocument } from "@schlessera/brain-render-template";
+import {
+  readJsonBody,
+  RENDER_BODY_LIMIT_BYTES,
+} from "../middleware/body-limit.js";
+import { requireJson } from "../middleware/origin.js";
 
 /**
- * Cap on the content string posted for rendering. The old 512KB bound
- * predated inlined assets: a shared document carries `data:` image URIs and
- * pre-rendered mermaid SVGs, which pass that on their own without the prose
- * being long. This is an HTTP body, not a socket frame, so it is not bounded
- * by the WebSocket budget.
+ * A shared document may carry inlined images and pre-rendered mermaid SVGs.
+ * The route's streaming reader owns its 5 MB request cap before JSON parsing;
+ * the schema validates shape only so it cannot disagree by counting UTF-16
+ * code units instead.
  */
-const MAX_CONTENT_BYTES = 4 * 1024 * 1024;
-
 /**
  * Rendering seam. The deployment owns the actual renderer process (e.g. the
  * network-denied headless Chrome in @schlessera/brain-render-puppeteer) and
@@ -25,14 +27,14 @@ export interface AppRenderer {
 }
 
 const bodySchema = z.object({
-  content: z.string().min(1).max(MAX_CONTENT_BYTES),
+  content: z.string().min(1),
   contentType: z.enum(["markdown", "html"]),
   format: z.enum(["png", "pdf"]),
   title: z.string().max(200).optional(),
 }) satisfies z.ZodType<RenderRequest>;
 
 export function createRenderRoutes(renderer?: AppRenderer, log?: Logger) {
-  return new Hono().post("/render", async (c) => {
+  return new Hono().post("/render", requireJson(), async (c) => {
     if (!renderer) {
       return c.json(
         { error: "render_unavailable", detail: "This deployment has no renderer configured" },
@@ -42,7 +44,9 @@ export function createRenderRoutes(renderer?: AppRenderer, log?: Logger) {
 
     let parsed;
     try {
-      parsed = bodySchema.parse(await c.req.json());
+      const result = await readJsonBody(c, RENDER_BODY_LIMIT_BYTES);
+      if (result instanceof Response) return result;
+      parsed = bodySchema.parse(result);
     } catch (err) {
       return c.json({ error: "invalid_request", detail: err instanceof Error ? err.message : "bad body" }, 400);
     }

package/src/routes/share.ts

@@ -94,12 +94,14 @@ export interface ShareRoutesDeps {
   brainRoot: string;
   /** ALLOWED_ORIGINS — the same-origin check's split-topology allowlist. */
   allowedOrigins: string[];
+  /** Trust X-Forwarded-Proto when resolving the request's expected origin. */
+  trustProxy: boolean;
   /** Where failures are reported; absent means silence. */
   log?: Logger;
 }
 
 export function createShareRoutes(deps: ShareRoutesDeps): Hono {
-  const { brainRoot, allowedOrigins, log } = deps;
+  const { brainRoot, allowedOrigins, trustProxy, log } = deps;
 
   /**
    * In-flight intakes. Each one holds its whole payload in memory while the
@@ -124,49 +126,48 @@ export function createShareRoutes(deps: ShareRoutesDeps): Hono {
   }
 
   return new Hono().post("/share", async (c) => {
-  // See middleware/origin.ts: a multipart POST is a CORS-simple request, so it
-  // reaches this route with no preflight, and in tailscale mode the credential
-  // is the source IP. This route is only ever called by the app itself.
-  if (!isSameOriginRequest(c, allowedOrigins)) {
+  // Keep the same shared policy at the route boundary as defense in depth for
+  // embedders that mount this exported route factory outside createApp().
+  if (!isSameOriginRequest(c, allowedOrigins, trustProxy)) {
     return c.json({ error: "cross_origin_rejected" }, 403);
   }
 
   if (inFlight >= SHARE_MAX_CONCURRENT_INTAKE) {
     return c.json({ error: "busy" }, 503);
   }
+  inFlight += 1;
 
-  const tooLarge = () =>
-    c.json({ error: "share_too_large", limit: SHARE_MAX_TOTAL_BYTES }, 413);
-
-  // Cheap early-out for a client that declares its size honestly; the streamed
-  // count below is what actually enforces the cap.
-  const declaredLength = Number(c.req.header("content-length") ?? "0");
-  if (Number.isFinite(declaredLength) && declaredLength > HARD_BODY_LIMIT) {
-    return tooLarge();
-  }
-
-  const raw = await readCappedBody(c.req.raw, HARD_BODY_LIMIT);
-  if (raw === null) return tooLarge();
-
-  let form: FormData;
   try {
-    const contentType = c.req.header("content-type");
-    form = await new Response(raw, {
-      headers: contentType ? { "content-type": contentType } : {},
-    }).formData();
-  } catch {
-    // A truncated upload or a malformed multipart body. The share is gone
-    // either way; the client re-offers it from its own copy.
-    return c.json({ error: "invalid_form" }, 400);
-  }
+    const tooLarge = () =>
+      c.json({ error: "share_too_large", limit: SHARE_MAX_TOTAL_BYTES }, 413);
+
+    // Cheap early-out for a client that declares its size honestly; the streamed
+    // count below is what actually enforces the cap.
+    const declaredLength = Number(c.req.header("content-length") ?? "0");
+    if (Number.isFinite(declaredLength) && declaredLength > HARD_BODY_LIMIT) {
+      return tooLarge();
+    }
 
-  // Empty parts are what an app sends when it has nothing to attach.
-  const files = form
-    .getAll("files")
-    .filter((value): value is File => value instanceof File && value.size > 0);
+    const raw = await readCappedBody(c.req.raw, HARD_BODY_LIMIT);
+    if (raw === null) return tooLarge();
+
+    let form: FormData;
+    try {
+      const contentType = c.req.header("content-type");
+      form = await new Response(raw, {
+        headers: contentType ? { "content-type": contentType } : {},
+      }).formData();
+    } catch {
+      // A truncated upload or a malformed multipart body. The share is gone
+      // either way; the client re-offers it from its own copy.
+      return c.json({ error: "invalid_form" }, 400);
+    }
+
+    // Empty parts are what an app sends when it has nothing to attach.
+    const files = form
+      .getAll("files")
+      .filter((value): value is File => value instanceof File && value.size > 0);
 
-  inFlight += 1;
-  try {
     const result = await stageShare(
       brainRoot,
       {