@xopcai/xopc 0.0.222 → 0.0.224

package/dist/src/gateway/hono/routes/workflows.js

@@ -7,10 +7,10 @@ import { messagesToClientHistory } from "../../../session/client-history.js";
 import "../../../workflows/domain/index.js";
 import { resolveWorkflowRunArtifactsDir } from "../../../workflows/store/paths.js";
 import { WorkflowDraftService } from "../../../workflows/draft/workflow-draft-service.js";
-import "../../../workflows/draft/index.js";
-import { ProjectWorkflowPresetRepository } from "../../../workflows/project-presets/project-workflow-preset-repository.js";
 import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../../workflows/authoring/workflow-draft-store.js";
 import "../../../workflows/authoring/index.js";
+import "../../../workflows/draft/index.js";
+import { ProjectWorkflowPresetRepository } from "../../../workflows/project-presets/project-workflow-preset-repository.js";
 import { basename, join } from "node:path";
 import { readFile, stat } from "node:fs/promises";
 //#region src/gateway/hono/routes/workflows.ts

package/dist/src/gateway/run-loop.js

@@ -67,6 +67,9 @@ async function runGatewayLoop(opts) {
 				forceCloseRequested = true;
 				console.warn(`[GatewayRunLoop] Received ${signal} again; force closing connections`);
 				server?.forceCloseConnections();
+			} else if (signal === "SIGINT" || signal === "SIGTERM") {
+				console.warn(`[GatewayRunLoop] Received ${signal} again; force exiting`);
+				exitProcess(0);
 			}
 			return;
 		}

package/dist/src/gateway/server.d.ts

@@ -14,6 +14,8 @@ export interface GatewayServerConfig {
 export declare class GatewayServer {
     private server?;
     private extraServers;
+    private readonly serverSockets;
+    private stopPromise;
     private config;
     private service;
     constructor(config: GatewayServerConfig);
@@ -23,6 +25,7 @@ export declare class GatewayServer {
         restartExpectedMs?: number | null;
     }): Promise<void>;
     stop(): Promise<void>;
+    private stopInternal;
     forceCloseConnections(): void;
     get isRunning(): boolean;
     get serviceInstance(): GatewayService;

package/dist/src/gateway/server.js

@@ -10,6 +10,8 @@ ensureXopcCliOnPath();
 var GatewayServer = class {
 	server;
 	extraServers = [];
+	serverSockets = /* @__PURE__ */ new Map();
+	stopPromise = null;
 	config;
 	service;
 	constructor(config) {
@@ -57,7 +59,14 @@ var GatewayServer = class {
 		});
 		const primaryHost = listenHosts[0] ?? bindHost;
 		const attachUpgrade = (server) => {
-			server.on("upgrade", (req, socket, head) => {
+			const inner = server;
+			const sockets = /* @__PURE__ */ new Set();
+			this.serverSockets.set(server, sockets);
+			inner.on("connection", (socket) => {
+				sockets.add(socket);
+				socket.once("close", () => sockets.delete(socket));
+			});
+			inner.on("upgrade", (req, socket, head) => {
 				try {
 					if (this.service.realtime.handleUpgrade(req, socket, head)) return;
 					if (handleSiteShareUpgrade(this.service, req, socket, head)) return;
@@ -98,11 +107,20 @@ var GatewayServer = class {
 		await this.stop();
 	}
 	async stop() {
+		if (this.stopPromise) return this.stopPromise;
+		this.stopPromise = this.stopInternal();
+		return this.stopPromise;
+	}
+	async stopInternal() {
 		console.log("[GatewayServer] Stopping gateway server...");
+		const forceCloseServer = (server) => {
+			server.closeAllConnections?.();
+			for (const socket of this.serverSockets.get(server) ?? []) socket.destroy();
+		};
 		const closeServer = async (server) => {
 			if (!server) return;
 			const forceClose = setTimeout(() => {
-				server.closeAllConnections?.();
+				forceCloseServer(server);
 			}, 2e3);
 			await new Promise((resolve) => {
 				server.close(() => {
@@ -111,16 +129,23 @@ var GatewayServer = class {
 				});
 			});
 		};
-		await closeServer(this.server);
+		const primaryServer = this.server;
+		const extraServers = this.extraServers;
+		const closePromises = [closeServer(primaryServer), ...extraServers.map(closeServer)];
+		const activeServers = [primaryServer, ...extraServers].filter((server) => server !== void 0);
+		await this.service.stop();
+		for (const server of activeServers) forceCloseServer(server);
+		await Promise.all(closePromises);
+		for (const server of activeServers) this.serverSockets.delete(server);
 		this.server = void 0;
-		for (const extra of this.extraServers) await closeServer(extra);
 		this.extraServers = [];
-		await this.service.stop();
 		console.log("[GatewayServer] Gateway server stopped");
 	}
 	forceCloseConnections() {
 		const close = (server) => {
+			if (!server) return;
 			server?.closeAllConnections?.();
+			for (const socket of this.serverSockets.get(server) ?? []) socket.destroy();
 		};
 		close(this.server);
 		for (const extra of this.extraServers) close(extra);

package/dist/src/gateway/service.js

@@ -45,25 +45,25 @@ import { MessageBus, MessageBusShutdownError } from "../infra/bus/queue.js";
 import "../infra/bus/index.js";
 import { AgentService } from "../agent/service.js";
 import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
+import "../config/index.js";
 import { setPairingBroadcastSink } from "../channels/pairing/pairing-events.js";
 import { registerClarifyBridge } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
-import "../config/index.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
 import { DiscussionLiveWorker } from "../discussions/live-worker.js";
 import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
 import { DiscussionSealer } from "../discussions/sealer.js";
 import "../discussions/index.js";
+import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
+import "../endpoint-tools/index.js";
 import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
 import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
 import "../knowledge/index.js";
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
 import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
-import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
-import "../endpoint-tools/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { prepareAutomationAgentSession } from "./automation-agent-session.js";
 import { reconcileDreamingAutomations } from "./dreaming-automation-reconciler.js";

package/dist/src/notes/service.d.ts

@@ -6,11 +6,14 @@ export declare class NotesService {
     private readonly store;
     private lastSnapshotAt;
     private quickCapturesInFlight;
+    private noteCapturesInFlight;
+    private noteAttachmentsInFlight;
     constructor(store?: NotesStore);
     initialize(): Promise<void>;
     quickCapture(markdown: string, source: CaptureSource, idempotencyKey?: string): Promise<Note>;
     private createQuickCapture;
-    createNote(params: CreateNoteParams): Promise<Note>;
+    createNote(params: CreateNoteParams, idempotencyKey?: string): Promise<Note>;
+    private createNoteWithId;
     getNote(id: string): Promise<Note | null>;
     updateNote(id: string, patch: Partial<Note>, trigger?: SnapshotTrigger): Promise<Note | null>;
     private reconcileAttachments;
@@ -49,7 +52,8 @@ export declare class NotesService {
         mimeType: string;
         duration?: number;
         retainWithoutReference?: boolean;
-    }): Promise<NoteAttachment | null>;
+    }, idempotencyKey?: string): Promise<NoteAttachment | null>;
+    private addAttachmentWithId;
     removeAttachment(noteId: string, attachmentId: string): Promise<boolean>;
     getAttachmentPath(noteId: string, attachmentId: string): Promise<{
         filePath: string;

package/dist/src/notes/service.js

@@ -19,6 +19,12 @@ const SNAPSHOT_THROTTLE_MS = 6e4;
 function quickCaptureId(idempotencyKey) {
 	return `capture_${createHash("sha256").update(`xopc:quick-capture:${idempotencyKey}`).digest("hex").slice(0, 32)}`;
 }
+function noteCaptureId(idempotencyKey) {
+	return `note_capture_${createHash("sha256").update(`xopc:note-capture:${idempotencyKey}`).digest("hex").slice(0, 32)}`;
+}
+function noteAttachmentId(noteId, idempotencyKey) {
+	return `attachment_${createHash("sha256").update(`xopc:note-attachment:${noteId}:${idempotencyKey}`).digest("hex").slice(0, 32)}`;
+}
 function inferKind(markdown, hasAttachments, attachments) {
 	if (hasAttachments && attachments?.length && attachments.every((item) => item.type === "audio")) return "voice";
 	if (hasAttachments) return "media";
@@ -146,6 +152,8 @@ async function buildAiCatalysisReport(note, config) {
 var NotesService = class {
 	lastSnapshotAt = /* @__PURE__ */ new Map();
 	quickCapturesInFlight = /* @__PURE__ */ new Map();
+	noteCapturesInFlight = /* @__PURE__ */ new Map();
+	noteAttachmentsInFlight = /* @__PURE__ */ new Map();
 	constructor(store = new NotesStore()) {
 		this.store = store;
 	}
@@ -204,8 +212,20 @@ var NotesService = class {
 		}, "Quick capture");
 		return note;
 	}
-	async createNote(params) {
-		const id = randomUUID();
+	async createNote(params, idempotencyKey) {
+		const id = idempotencyKey ? noteCaptureId(idempotencyKey) : randomUUID();
+		if (idempotencyKey) {
+			const existing = await this.store.getNote(id);
+			if (existing) return existing;
+			const inFlight = this.noteCapturesInFlight.get(id);
+			if (inFlight) return inFlight;
+			const capture = this.createNoteWithId(id, params).finally(() => this.noteCapturesInFlight.delete(id));
+			this.noteCapturesInFlight.set(id, capture);
+			return capture;
+		}
+		return this.createNoteWithId(id, params);
+	}
+	async createNoteWithId(id, params) {
 		const now = Date.now();
 		const markdown = params.markdown ?? "";
 		const note = {
@@ -463,12 +483,24 @@ var NotesService = class {
 	async listNotes(query = {}) {
 		return this.store.listNotes(query);
 	}
-	async addAttachment(noteId, file) {
+	async addAttachment(noteId, file, idempotencyKey) {
+		if (!idempotencyKey) return this.addAttachmentWithId(noteId, file, randomUUID());
+		const attachmentId = noteAttachmentId(noteId, idempotencyKey);
+		const existing = (await this.store.getNote(noteId))?.attachments?.find((attachment) => attachment.id === attachmentId);
+		if (existing) return existing;
+		const inFlightKey = `${noteId}:${attachmentId}`;
+		const inFlight = this.noteAttachmentsInFlight.get(inFlightKey);
+		if (inFlight) return inFlight;
+		const capture = this.addAttachmentWithId(noteId, file, attachmentId).finally(() => this.noteAttachmentsInFlight.delete(inFlightKey));
+		this.noteAttachmentsInFlight.set(inFlightKey, capture);
+		return capture;
+	}
+	async addAttachmentWithId(noteId, file, attachmentId) {
 		const note = await this.store.getNote(noteId);
 		if (!note) return null;
 		const { relativePath, size } = await this.store.saveAttachment(noteId, file.name, file.buffer);
 		const attachment = {
-			id: randomUUID(),
+			id: attachmentId,
 			type: file.mimeType.startsWith("image/") ? "image" : file.mimeType.startsWith("audio/") ? "audio" : file.mimeType.startsWith("video/") ? "video" : "file",
 			mimeType: file.mimeType,
 			fileName: file.name,

package/dist/src/providers/index.js

@@ -1,6 +1,6 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { getOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
+import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
 import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
@@ -141,7 +141,7 @@ function getAllProviders() {
 	for (const p of getProviders()) providers.add(p);
 	for (const m of registry.getAll()) providers.add(m.provider);
 	for (const plugin of getProviderRegistry().listAll()) providers.add(plugin.id);
-	for (const provider of getOAuthProviderIds()) providers.add(provider);
+	for (const provider of getModelOAuthProviderIds()) providers.add(provider);
 	return Array.from(providers);
 }
 async function getApiKey(provider, credentialOptions) {

package/dist/src/share/note-share-service.d.ts

@@ -0,0 +1,67 @@
+import type { Note, NoteAttachment } from '../notes/types.js';
+import type { NoteShareRecord } from './share-types.js';
+import type { ShareStore } from './share-store.js';
+export interface NoteShareManifestAttachment {
+    id: string;
+    type: NoteAttachment['type'];
+    mimeType: string;
+    fileName: string;
+    size: number;
+    artifactFileName: string;
+    checksum: string;
+    duration?: number;
+}
+export interface NoteShareManifest {
+    schemaVersion: 1;
+    shareId: string;
+    source: {
+        noteId: string;
+        noteVersion: number;
+    };
+    title: string;
+    markdown: string;
+    snapshotAt: string;
+    attachments: NoteShareManifestAttachment[];
+}
+export interface NoteShareSource {
+    getNote(id: string): Promise<Note | null>;
+    getAttachmentPath(noteId: string, attachmentId: string): Promise<{
+        filePath: string;
+        mimeType: string;
+        fileName: string;
+    } | null>;
+}
+export interface CreateNoteShareInput {
+    expectedNoteVersion?: number;
+    attachmentIds?: string[];
+    ttlMs?: number;
+    maxViews?: number | null;
+    description?: string;
+    gatewayTokenHash: string;
+}
+export declare class NoteShareVersionConflictError extends Error {
+    readonly currentVersion: number;
+    constructor(currentVersion: number);
+}
+export declare class NoteShareService {
+    private readonly store;
+    private readonly notes;
+    constructor(store: ShareStore, notes: NoteShareSource);
+    create(noteId: string, input: CreateNoteShareInput): Promise<NoteShareRecord>;
+    refresh(noteId: string, shareId: string, input: Pick<CreateNoteShareInput, 'expectedNoteVersion' | 'attachmentIds'>): Promise<NoteShareRecord>;
+    list(noteId: string): NoteShareRecord[];
+    revokeForNote(noteId: string): Promise<number>;
+    removeArtifact(shareId: string): Promise<void>;
+    readManifest(record: NoteShareRecord): Promise<NoteShareManifest>;
+    issueAssetTicket(record: NoteShareRecord): string;
+    verifyAssetTicket(record: NoteShareRecord, ticket: string): boolean;
+    resolveAsset(record: NoteShareRecord, attachmentId: string): Promise<{
+        path: string;
+        attachment: NoteShareManifestAttachment;
+    } | null>;
+    publicMarkdown(record: NoteShareRecord, manifest: NoteShareManifest, ticket: string): string;
+    private requireNote;
+    private buildArtifact;
+    private artifactRelativePath;
+    private artifactDir;
+}

package/dist/src/share/note-share-service.js

@@ -0,0 +1,283 @@
+import { resolveStateDir } from "../config/paths-state.js";
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
+import { init_paths } from "../config/paths.js";
+import { collectReferencedAttachmentIds } from "../notes/note-attachment-sync.js";
+import { dirname, join } from "node:path";
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { copyFile, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+//#region src/share/note-share-service.ts
+init_paths();
+init_logger();
+const log = createLogger("NoteShareService");
+const MANIFEST_SCHEMA_VERSION = 1;
+var NoteShareVersionConflictError = class extends Error {
+	constructor(currentVersion) {
+		super("Note changed after the share preview was reviewed");
+		this.currentVersion = currentVersion;
+		this.name = "NoteShareVersionConflictError";
+	}
+};
+var NoteShareService = class {
+	constructor(store, notes) {
+		this.store = store;
+		this.notes = notes;
+	}
+	async create(noteId, input) {
+		const note = await this.requireNote(noteId, input.expectedNoteVersion);
+		const id = randomUUID();
+		const staged = await this.buildArtifact(id, note, input.attachmentIds);
+		try {
+			return this.store.createNoteShare({
+				id,
+				sourceNoteId: note.id,
+				sourceVersion: note.updatedAt,
+				artifactRelativePath: this.artifactRelativePath(id),
+				artifactSize: staged.totalSize,
+				attachmentCount: staged.manifest.attachments.length,
+				fileName: staged.manifest.title,
+				ttlMs: input.ttlMs,
+				maxViews: input.maxViews,
+				description: input.description,
+				gatewayTokenHash: input.gatewayTokenHash
+			});
+		} catch (error) {
+			await this.removeArtifact(id);
+			throw error;
+		}
+	}
+	async refresh(noteId, shareId, input) {
+		const record = this.store.getById(shareId);
+		if (!record || record.kind !== "note" || record.sourceNoteId !== noteId) throw new Error("Note share not found");
+		const note = await this.requireNote(noteId, input.expectedNoteVersion);
+		const finalDir = this.artifactDir(shareId);
+		const stagedDir = `${finalDir}.refresh-${randomUUID()}`;
+		const backupDir = `${finalDir}.backup-${randomUUID()}`;
+		const staged = await this.buildArtifact(shareId, note, input.attachmentIds, stagedDir);
+		let movedOld = false;
+		try {
+			await rename(finalDir, backupDir);
+			movedOld = true;
+			await rename(stagedDir, finalDir);
+			const updated = this.store.updateNoteSnapshot(shareId, {
+				sourceVersion: note.updatedAt,
+				artifactSize: staged.totalSize,
+				attachmentCount: staged.manifest.attachments.length,
+				fileName: staged.manifest.title
+			});
+			if (!updated) throw new Error("Note share not found");
+			await rm(backupDir, {
+				recursive: true,
+				force: true
+			});
+			return updated;
+		} catch (error) {
+			await rm(stagedDir, {
+				recursive: true,
+				force: true
+			});
+			if (movedOld) {
+				await rm(finalDir, {
+					recursive: true,
+					force: true
+				});
+				await rename(backupDir, finalDir).catch(() => void 0);
+			}
+			throw error;
+		}
+	}
+	list(noteId) {
+		return this.store.getNoteShares(noteId);
+	}
+	async revokeForNote(noteId) {
+		const active = this.store.getNoteShares(noteId).filter((record) => !record.revoked);
+		const count = this.store.revokeMany(active.map((record) => record.id));
+		await Promise.all(active.map((record) => this.removeArtifact(record.id)));
+		return count;
+	}
+	async removeArtifact(shareId) {
+		await rm(this.artifactDir(shareId), {
+			recursive: true,
+			force: true
+		}).catch((err) => {
+			log.warn({
+				err,
+				shareId
+			}, "Failed to remove Note share artifact");
+		});
+	}
+	async readManifest(record) {
+		const raw = await readFile(join(resolveStateDir(), record.artifactRelativePath, "manifest.json"), "utf8");
+		const manifest = JSON.parse(raw);
+		if (manifest.schemaVersion !== MANIFEST_SCHEMA_VERSION || manifest.shareId !== record.id) throw new Error("Invalid Note share artifact");
+		return manifest;
+	}
+	issueAssetTicket(record) {
+		const expiresAt = Date.now() + this.store.getConfig().note.assetTicketTtlMs;
+		const payload = Buffer.from(JSON.stringify({
+			shareId: record.id,
+			revision: record.snapshotRevision,
+			expiresAt
+		})).toString("base64url");
+		return `${payload}.${createHmac("sha256", record.assetTicketSecret).update(payload).digest("base64url")}`;
+	}
+	verifyAssetTicket(record, ticket) {
+		const [payload, signature] = ticket.split(".");
+		if (!payload || !signature) return false;
+		const expected = createHmac("sha256", record.assetTicketSecret).update(payload).digest();
+		let actual;
+		try {
+			actual = Buffer.from(signature, "base64url");
+		} catch {
+			return false;
+		}
+		if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return false;
+		try {
+			const value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+			return value.shareId === record.id && value.revision === record.snapshotRevision && typeof value.expiresAt === "number" && Date.now() < value.expiresAt;
+		} catch {
+			return false;
+		}
+	}
+	async resolveAsset(record, attachmentId) {
+		const attachment = (await this.readManifest(record)).attachments.find((item) => item.id === attachmentId);
+		if (!attachment || attachment.artifactFileName !== attachment.id) return null;
+		return {
+			path: join(resolveStateDir(), record.artifactRelativePath, "assets", attachment.artifactFileName),
+			attachment
+		};
+	}
+	publicMarkdown(record, manifest, ticket) {
+		return manifest.markdown.replace(/xopc-attachment:\/\/notes\/([^/]+)\/([^\s)]+)/gi, (_match, noteId, attachmentId) => {
+			let decodedNoteId = noteId;
+			let decodedAttachmentId = attachmentId;
+			try {
+				decodedNoteId = decodeURIComponent(noteId);
+				decodedAttachmentId = decodeURIComponent(attachmentId);
+			} catch {
+				return "#invalid-attachment";
+			}
+			if (decodedNoteId !== record.sourceNoteId || !manifest.attachments.some((item) => item.id === decodedAttachmentId)) return "#attachment-not-shared";
+			return `/s/${encodeURIComponent(record.token)}/assets/${encodeURIComponent(decodedAttachmentId)}?ticket=${encodeURIComponent(ticket)}`;
+		});
+	}
+	async requireNote(noteId, expectedVersion) {
+		const note = await this.notes.getNote(noteId);
+		if (!note) throw new Error("Note not found");
+		if (expectedVersion !== void 0 && note.updatedAt !== expectedVersion) throw new NoteShareVersionConflictError(note.updatedAt);
+		return note;
+	}
+	async buildArtifact(shareId, note, requestedAttachmentIds, targetDir = this.artifactDir(shareId)) {
+		const cfg = this.store.getConfig().note;
+		if (!cfg.enabled) throw new Error("Note sharing is disabled");
+		const referenced = collectReferencedAttachmentIds(note);
+		const known = new Map((note.attachments ?? []).map((attachment) => [attachment.id, attachment]));
+		for (const id of referenced) if (!known.has(id)) throw new Error(`Referenced attachment is missing: ${id}`);
+		const selected = requestedAttachmentIds === void 0 ? [...referenced] : Array.from(new Set(requestedAttachmentIds));
+		for (const id of selected) if (!referenced.has(id)) throw new Error(`Attachment is not referenced by this Note: ${id}`);
+		const projectedMarkdown = projectPublicMarkdown(note, new Set(selected));
+		const markdownBytes = Buffer.byteLength(projectedMarkdown, "utf8");
+		if (markdownBytes > cfg.maxMarkdownBytes) throw new Error("Note Markdown exceeds sharing limit");
+		if (selected.length > cfg.maxAttachmentCount) throw new Error("Note has too many attachments to share");
+		const tempDir = targetDir === this.artifactDir(shareId) ? `${targetDir}.tmp-${randomUUID()}` : targetDir;
+		const assetsDir = join(tempDir, "assets");
+		await rm(tempDir, {
+			recursive: true,
+			force: true
+		});
+		await mkdir(assetsDir, {
+			recursive: true,
+			mode: 448
+		});
+		let totalSize = markdownBytes;
+		const attachments = [];
+		try {
+			for (const id of selected) {
+				const source = known.get(id);
+				if (source.size > cfg.maxAttachmentSize) throw new Error(`Attachment exceeds sharing limit: ${source.fileName}`);
+				totalSize += source.size;
+				if (totalSize > cfg.maxTotalSize) throw new Error("Note share exceeds total size limit");
+				const resolved = await this.notes.getAttachmentPath(note.id, id);
+				if (!resolved) throw new Error(`Attachment is missing: ${source.fileName}`);
+				const fileStat = await stat(resolved.filePath);
+				if (!fileStat.isFile() || fileStat.size !== source.size) throw new Error(`Attachment changed or is missing: ${source.fileName}`);
+				const bytes = await readFile(resolved.filePath);
+				const checksum = createHash("sha256").update(bytes).digest("hex");
+				await copyFile(resolved.filePath, join(assetsDir, id));
+				attachments.push({
+					id,
+					type: source.type,
+					mimeType: source.mimeType,
+					fileName: source.fileName,
+					size: source.size,
+					artifactFileName: id,
+					checksum,
+					duration: source.duration
+				});
+			}
+			const title = note.title?.trim() || "Untitled Note";
+			const manifest = {
+				schemaVersion: MANIFEST_SCHEMA_VERSION,
+				shareId,
+				source: {
+					noteId: note.id,
+					noteVersion: note.updatedAt
+				},
+				title,
+				markdown: projectedMarkdown,
+				snapshotAt: (/* @__PURE__ */ new Date()).toISOString(),
+				attachments
+			};
+			await writeFile(join(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, { mode: 384 });
+			if (tempDir !== targetDir) {
+				await mkdir(dirname(targetDir), {
+					recursive: true,
+					mode: 448
+				});
+				await rename(tempDir, targetDir);
+			}
+			return {
+				manifest,
+				totalSize
+			};
+		} catch (error) {
+			await rm(tempDir, {
+				recursive: true,
+				force: true
+			});
+			throw error;
+		}
+	}
+	artifactRelativePath(shareId) {
+		return join("share-artifacts", shareId);
+	}
+	artifactDir(shareId) {
+		return join(resolveStateDir(), this.artifactRelativePath(shareId));
+	}
+};
+function projectPublicMarkdown(note, selected) {
+	const canonicalTarget = "xopc-attachment://notes/([^/\\s)]+)/([^\\s)]+)";
+	const assertOwned = new RegExp(canonicalTarget, "gi");
+	note.markdown.replace(assertOwned, (_match, rawNoteId) => {
+		let noteId;
+		try {
+			noteId = decodeURIComponent(rawNoteId);
+		} catch {
+			throw new Error("Invalid Note attachment reference");
+		}
+		if (noteId !== note.id) throw new Error("Cross-Note attachment references cannot be shared");
+		return _match;
+	});
+	const projectTarget = (rawNoteId, rawAttachmentId) => {
+		try {
+			return decodeURIComponent(rawNoteId) === note.id && selected.has(decodeURIComponent(rawAttachmentId));
+		} catch {
+			return false;
+		}
+	};
+	let markdown = note.markdown.replace(new RegExp(`!\\[([^\\]]*)\\]\\(${canonicalTarget}\\)`, "gi"), (_match, alt, rawNoteId, rawAttachmentId) => projectTarget(rawNoteId, rawAttachmentId) ? _match : `_[Attachment not shared${alt ? `: ${alt}` : ""}]_`);
+	markdown = markdown.replace(new RegExp(`\\[([^\\]]+)\\]\\(${canonicalTarget}\\)`, "gi"), (_match, label, rawNoteId, rawAttachmentId) => projectTarget(rawNoteId, rawAttachmentId) ? _match : label);
+	return markdown;
+}
+//#endregion
+export { NoteShareService, NoteShareVersionConflictError };