@xopcai/xopc 0.0.222 → 0.0.224

package/dist/src/share/share-config.js

@@ -19,6 +19,15 @@ const ShareThumbnailPatchSchema = z.object({
 	failureCooldownMs: z.number().int().min(0).max(36e5).optional(),
 	internalGatewayUrl: z.string().min(1).optional()
 });
+const ShareNotePatchSchema = z.object({
+	enabled: z.boolean().optional(),
+	maxMarkdownBytes: z.number().int().min(1024).max(10485760).optional(),
+	maxAttachmentCount: z.number().int().min(0).max(500).optional(),
+	maxAttachmentSize: z.number().int().min(1024).max(1073741824).optional(),
+	maxTotalSize: z.number().int().min(1024).max(2147483648).optional(),
+	assetTicketTtlMs: z.number().int().min(6e4).max(36e5).optional(),
+	revokeOnSourceDelete: z.boolean().optional()
+});
 const ShareConfigPatchSchema = z.object({
 	enabled: z.boolean().optional(),
 	defaultTtlMs: z.number().int().min(6e4).max(6048e5).optional(),
@@ -27,7 +36,8 @@ const ShareConfigPatchSchema = z.object({
 	maxFileSize: z.number().int().min(1048576).max(10737418240).optional(),
 	inlinePreviewMimes: z.array(z.string().min(1)).optional(),
 	directory: ShareDirectoryPatchSchema.optional(),
-	thumbnail: ShareThumbnailPatchSchema.optional()
+	thumbnail: ShareThumbnailPatchSchema.optional(),
+	note: ShareNotePatchSchema.optional()
 });
 function resolveDirectoryConfig(raw) {
 	const base = SHARE_CONFIG_DEFAULTS.directory;
@@ -57,6 +67,20 @@ function resolveThumbnailConfig(raw) {
 		internalGatewayUrl: patch.internalGatewayUrl ?? base.internalGatewayUrl
 	};
 }
+function resolveNoteConfig(raw) {
+	const base = SHARE_CONFIG_DEFAULTS.note;
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { ...base };
+	const patch = raw;
+	return {
+		enabled: patch.enabled ?? base.enabled,
+		maxMarkdownBytes: patch.maxMarkdownBytes ?? base.maxMarkdownBytes,
+		maxAttachmentCount: patch.maxAttachmentCount ?? base.maxAttachmentCount,
+		maxAttachmentSize: patch.maxAttachmentSize ?? base.maxAttachmentSize,
+		maxTotalSize: patch.maxTotalSize ?? base.maxTotalSize,
+		assetTicketTtlMs: patch.assetTicketTtlMs ?? base.assetTicketTtlMs,
+		revokeOnSourceDelete: patch.revokeOnSourceDelete ?? base.revokeOnSourceDelete
+	};
+}
 function resolveShareConfig(raw) {
 	const patch = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
 	return {
@@ -67,7 +91,8 @@ function resolveShareConfig(raw) {
 		maxFileSize: patch.maxFileSize ?? SHARE_CONFIG_DEFAULTS.maxFileSize,
 		inlinePreviewMimes: Array.isArray(patch.inlinePreviewMimes) ? patch.inlinePreviewMimes.filter((x) => typeof x === "string" && x.trim().length > 0) : [...SHARE_CONFIG_DEFAULTS.inlinePreviewMimes],
 		directory: resolveDirectoryConfig(patch.directory),
-		thumbnail: resolveThumbnailConfig(patch.thumbnail)
+		thumbnail: resolveThumbnailConfig(patch.thumbnail),
+		note: resolveNoteConfig(patch.note)
 	};
 }
 function mergeShareConfigPatch(config, patch) {
@@ -99,7 +124,11 @@ function mergeShareConfigPatch(config, patch) {
 		thumbnail: parsed.data.thumbnail ? {
 			...current.thumbnail,
 			...parsed.data.thumbnail
-		} : current.thumbnail
+		} : current.thumbnail,
+		note: parsed.data.note ? {
+			...current.note,
+			...parsed.data.note
+		} : current.note
 	};
 	if (next.defaultTtlMs > next.maxTtlMs) return {
 		ok: false,

package/dist/src/share/share-landing.d.ts

@@ -1,5 +1,5 @@
 import type { DirectoryListing } from './share-store.js';
-import type { ShareRecord } from './share-types.js';
+import type { NoteShareRecord, ShareRecord } from './share-types.js';
 export interface ShareLandingOgOptions {
     /** Absolute https/http URL of this landing page (for og:url). Omit if non-public. */
     absoluteShareUrl?: string | null;
@@ -10,6 +10,10 @@ export interface ShareLandingOgOptions {
     /** Description override (default: type + size). */
     description?: string;
 }
+/** Lightweight public shell for Note shares. Crawlers get metadata; browsers continue to the SPA preview. */
+export declare function renderNoteShareLandingPage(record: NoteShareRecord, previewUrl: string, options?: {
+    og?: ShareLandingOgOptions;
+}): string;
 /** Render the file download confirmation landing page (does not consume downloadCount). */
 export declare function renderShareLandingPage(record: ShareRecord, downloadPath: string, options?: {
     /** Path to open the file inline (?inline=1) for browser-native rendering. */

package/dist/src/share/share-landing.js

@@ -35,6 +35,33 @@ body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;b
 .empty{text-align:center;color:#94a3b8;padding:2rem}
 `;
 }
+/** Lightweight public shell for Note shares. Crawlers get metadata; browsers continue to the SPA preview. */
+function renderNoteShareLandingPage(record, previewUrl, options) {
+	const title = escapeHtml(record.fileName);
+	const description = escapeHtml(record.description ?? "A Note shared via xopc");
+	const target = escapeHtml(previewUrl);
+	return `<!DOCTYPE html>
+<html lang="zh">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<meta name="robots" content="noindex,nofollow">
+${renderOgTags({
+		title,
+		description,
+		url: options?.og?.absoluteShareUrl ?? null,
+		image: options?.og?.absoluteThumbnailUrl ?? null
+	})}
+<title>${title} — xopc Share</title>
+<meta http-equiv="refresh" content="0;url=${target}">
+</head>
+<body>
+<p><a href="${target}">Open shared Note</a></p>
+<script>location.replace(${JSON.stringify(previewUrl)})<\/script>
+</body>
+</html>`;
+}
 /** Render the file download confirmation landing page (does not consume downloadCount). */
 function renderShareLandingPage(record, downloadPath, options) {
 	const fileName = escapeHtml(record.fileName);
@@ -212,4 +239,4 @@ function renderShareExpiredPage(reason) {
 </html>`;
 }
 //#endregion
-export { renderFolderLandingPage, renderShareExpiredPage, renderShareLandingPage };
+export { renderFolderLandingPage, renderNoteShareLandingPage, renderShareExpiredPage, renderShareLandingPage };

package/dist/src/share/share-store.d.ts

@@ -1,4 +1,4 @@
-import type { ShareRecord, ShareConfig, CreateShareParams } from './share-types.js';
+import type { ShareRecord, ShareConfig, CreateShareParams, WorkspaceShareRecord, NoteShareRecord, DirectoryShareRecord } from './share-types.js';
 export interface DirectoryListingEntry {
     name: string;
     /** Workspace/share-relative POSIX path. */
@@ -32,10 +32,31 @@ export declare class ShareStore {
     create(params: CreateShareParams & {
         workspaceRoot: string;
         gatewayTokenHash: string;
-    }): Promise<ShareRecord>;
+    }): Promise<WorkspaceShareRecord>;
     private createFileShare;
     private createDirectoryShare;
     private buildRecord;
+    createNoteShare(input: {
+        id: string;
+        sourceNoteId: string;
+        sourceVersion: number;
+        artifactRelativePath: string;
+        artifactSize: number;
+        attachmentCount: number;
+        snapshotRevision?: number;
+        fileName: string;
+        ttlMs?: number;
+        maxViews?: number | null;
+        description?: string;
+        gatewayTokenHash: string;
+    }): NoteShareRecord;
+    updateNoteSnapshot(id: string, patch: {
+        sourceVersion: number;
+        artifactSize: number;
+        attachmentCount: number;
+        fileName: string;
+    }): NoteShareRecord | null;
+    getNoteShares(noteId: string): NoteShareRecord[];
     private persistAndAudit;
     getById(id: string): ShareRecord | null;
     getByToken(token: string): ShareRecord | null;
@@ -46,8 +67,15 @@ export declare class ShareStore {
     };
     /** Increment download counter (used by directory & file downloads). Debounced persist. */
     incrementDownloadCount(id: string): void;
+    /** Atomically validate and consume one access in the single-threaded store. */
+    consumeAccess(id: string): {
+        valid: true;
+    } | {
+        valid: false;
+        reason: string;
+    };
     /** Check if the file still exists and inode matches. */
-    validateFileIntegrity(record: ShareRecord): Promise<{
+    validateFileIntegrity(record: WorkspaceShareRecord): Promise<{
         valid: boolean;
         reason?: string;
     }>;
@@ -55,7 +83,7 @@ export declare class ShareStore {
      * Resolve a child path inside a directory share. Returns the absolute path
      * if it stays within both the share root and the workspace.
      */
-    resolveDirectoryChild(record: ShareRecord, relativePath: string): Promise<{
+    resolveDirectoryChild(record: DirectoryShareRecord, relativePath: string): Promise<{
         ok: true;
         absolutePath: string;
     } | {
@@ -63,7 +91,7 @@ export declare class ShareStore {
         reason: string;
     }>;
     /** List a single directory level (cached, share-root-relative). */
-    listDirectory(record: ShareRecord, relativePath: string): Promise<DirectoryListing>;
+    listDirectory(record: DirectoryShareRecord, relativePath: string): Promise<DirectoryListing>;
     /** Update thumbnail status. Persists immediately so generator restart is safe. */
     setThumbnailStatus(id: string, status: 'pending' | 'ready' | 'failed'): void;
     /** Drop the listing cache for a share (used on revoke/update). */
@@ -84,6 +112,7 @@ export declare class ShareStore {
     private cleanupExpired;
     shutdown(): void;
     private resolveAndValidatePath;
+    private cleanupNoteArtifact;
 }
 export declare function resolveMimeType(fileName: string): string;
 /** HTTP Content-Type with charset for text-like bodies (browser inline preview). */

package/dist/src/share/share-store.js

@@ -8,7 +8,7 @@ import { logShareAudit } from "./share-audit.js";
 import { join, relative, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { randomBytes, randomUUID } from "node:crypto";
-import { lstat, readdir, realpath, stat } from "node:fs/promises";
+import { lstat, readdir, realpath, rm, stat } from "node:fs/promises";
 //#region src/share/share-store.ts
 init_paths();
 init_logger();
@@ -166,14 +166,13 @@ var ShareStore = class {
 		const id = randomUUID();
 		const token = randomBytes(32).toString("base64url");
 		const now = /* @__PURE__ */ new Date();
-		const record = {
+		const common = {
 			id,
 			token,
 			absolutePath: input.absolutePath,
 			workspaceRelativePath: input.workspaceRelativePath,
 			workspaceRoot: input.workspaceRoot,
 			inode: input.inode,
-			kind: input.kind,
 			fileName: input.fileName,
 			fileSize: input.fileSize,
 			mimeType: input.mimeType,
@@ -183,13 +182,78 @@ var ShareStore = class {
 			downloadCount: 0,
 			revoked: false,
 			createdByTokenHash: input.gatewayTokenHash,
-			description: input.description,
+			description: input.description
+		};
+		const record = input.kind === "directory" ? {
+			...common,
+			kind: "directory",
 			directory: input.directory
+		} : {
+			...common,
+			kind: "file"
 		};
 		this.shares.set(id, record);
 		this.tokenIndex.set(token, id);
 		return record;
 	}
+	createNoteShare(input) {
+		if (!this.config.enabled || !this.config.note.enabled) throw new Error("Note sharing is disabled");
+		if (this.getActiveShares().length >= this.config.maxActiveShares) throw new Error(`Maximum active shares reached (${this.config.maxActiveShares})`);
+		const ttlMs = input.ttlMs ?? this.config.defaultTtlMs;
+		if (ttlMs < 6e4 || ttlMs > this.config.maxTtlMs) throw new Error(`TTL must be between 60s and ${this.config.maxTtlMs / 1e3}s`);
+		if (input.maxViews !== void 0 && input.maxViews !== null && (input.maxViews < 1 || input.maxViews > 1e3)) throw new Error("maxViews must be between 1 and 1000");
+		const now = /* @__PURE__ */ new Date();
+		const record = {
+			id: input.id,
+			token: randomBytes(32).toString("base64url"),
+			kind: "note",
+			fileName: input.fileName,
+			fileSize: input.artifactSize,
+			mimeType: "application/x-xopc-note",
+			workspaceRelativePath: "",
+			sourceNoteId: input.sourceNoteId,
+			sourceVersion: input.sourceVersion,
+			artifactRelativePath: input.artifactRelativePath,
+			attachmentCount: input.attachmentCount,
+			snapshotRevision: input.snapshotRevision ?? 1,
+			assetTicketSecret: randomBytes(32).toString("base64url"),
+			createdAt: now.toISOString(),
+			expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+			maxViews: input.maxViews ?? null,
+			downloadCount: 0,
+			revoked: false,
+			createdByTokenHash: input.gatewayTokenHash,
+			description: input.description
+		};
+		this.shares.set(record.id, record);
+		this.tokenIndex.set(record.token, record.id);
+		this.persistAndAudit(record, "share.create", `Note share created: ${record.fileName}`, {
+			noteId: record.sourceNoteId,
+			sourceVersion: record.sourceVersion,
+			attachmentCount: record.attachmentCount,
+			ttlMs
+		});
+		return record;
+	}
+	updateNoteSnapshot(id, patch) {
+		const record = this.shares.get(id);
+		if (!record || record.kind !== "note") return null;
+		record.sourceVersion = patch.sourceVersion;
+		record.fileSize = patch.artifactSize;
+		record.attachmentCount = patch.attachmentCount;
+		record.fileName = patch.fileName;
+		record.snapshotRevision += 1;
+		this.persistSync();
+		logShareAudit("share.update", {
+			shareId: id,
+			noteId: record.sourceNoteId,
+			snapshotRevision: record.snapshotRevision
+		}, `Note share snapshot updated: ${record.fileName}`);
+		return record;
+	}
+	getNoteShares(noteId) {
+		return this.getAllShares().filter((record) => record.kind === "note" && record.sourceNoteId === noteId);
+	}
 	persistAndAudit(record, event, message, extra) {
 		this.persistSync();
 		logShareAudit(event, {
@@ -229,6 +293,22 @@ var ShareStore = class {
 		record.downloadCount++;
 		this.scheduleDebouncedPersist();
 	}
+	/** Atomically validate and consume one access in the single-threaded store. */
+	consumeAccess(id) {
+		const record = this.shares.get(id);
+		if (!record) return {
+			valid: false,
+			reason: "not_found"
+		};
+		const validation = this.validateAccess(record);
+		if (!validation.valid) return {
+			valid: false,
+			reason: validation.reason ?? "access_denied"
+		};
+		record.downloadCount++;
+		this.scheduleDebouncedPersist();
+		return { valid: true };
+	}
 	/** Check if the file still exists and inode matches. */
 	async validateFileIntegrity(record) {
 		try {
@@ -302,7 +382,6 @@ var ShareStore = class {
 	}
 	/** List a single directory level (cached, share-root-relative). */
 	async listDirectory(record, relativePath) {
-		if (record.kind !== "directory") throw new Error("Not a directory share");
 		const trimmed = (relativePath ?? "").replace(/^\/+/, "");
 		const cacheKey = `${record.id}::${trimmed}`;
 		const cacheTtl = this.config.directory.listingCacheMs;
@@ -376,6 +455,7 @@ var ShareStore = class {
 		const record = this.shares.get(id);
 		if (!record) return false;
 		record.revoked = true;
+		this.cleanupNoteArtifact(record);
 		this.invalidateListingCache(id);
 		this.persistSync();
 		logShareAudit("share.revoke", {
@@ -391,6 +471,7 @@ var ShareStore = class {
 			const record = this.shares.get(id);
 			if (record && !record.revoked) {
 				record.revoked = true;
+				this.cleanupNoteArtifact(record);
 				this.invalidateListingCache(id);
 				count++;
 				logShareAudit("share.revoke", {
@@ -408,6 +489,7 @@ var ShareStore = class {
 		let count = 0;
 		for (const record of this.shares.values()) if (!record.revoked && now >= new Date(record.expiresAt).getTime()) {
 			record.revoked = true;
+			this.cleanupNoteArtifact(record);
 			this.invalidateListingCache(record.id);
 			count++;
 		}
@@ -440,7 +522,7 @@ var ShareStore = class {
 		try {
 			const raw = readFileSync(path, "utf8");
 			const data = JSON.parse(raw);
-			if (data.version !== 1 || !Array.isArray(data.shares)) return;
+			if (data.version !== 1 && data.version !== 2 || !Array.isArray(data.shares)) return;
 			const now = Date.now();
 			let cleaned = 0;
 			for (const record of data.shares) {
@@ -474,7 +556,7 @@ var ShareStore = class {
 			}
 		}
 		writeFileSync(path, `${JSON.stringify({
-			version: 1,
+			version: 2,
 			shares: records
 		}, null, 2)}\n`, "utf8");
 	}
@@ -499,19 +581,23 @@ var ShareStore = class {
 	cleanupExpired() {
 		const now = Date.now();
 		let removed = 0;
-		for (const [id, record] of this.shares) if (now - new Date(record.expiresAt).getTime() > EXPIRED_RETENTION_MS) {
-			this.shares.delete(id);
-			this.tokenIndex.delete(record.token);
-			this.invalidateListingCache(id);
-			if (this.onCleanup) try {
-				this.onCleanup(record);
-			} catch (err) {
-				log.warn({
-					err,
-					shareId: id
-				}, "Share cleanup hook threw");
+		for (const [id, record] of this.shares) {
+			const expiredMs = now - new Date(record.expiresAt).getTime();
+			if (expiredMs >= 0) this.cleanupNoteArtifact(record);
+			if (expiredMs > EXPIRED_RETENTION_MS) {
+				this.shares.delete(id);
+				this.tokenIndex.delete(record.token);
+				this.invalidateListingCache(id);
+				if (this.onCleanup) try {
+					this.onCleanup(record);
+				} catch (err) {
+					log.warn({
+						err,
+						shareId: id
+					}, "Share cleanup hook threw");
+				}
+				removed++;
 			}
-			removed++;
 		}
 		if (removed > 0) {
 			this.persistSync();
@@ -543,6 +629,26 @@ var ShareStore = class {
 		if (relToRoot.startsWith("..") || relToRoot.split(/[/\\]/).includes("..")) throw new Error("Path is outside workspace");
 		return abs;
 	}
+	cleanupNoteArtifact(record) {
+		if (record.kind !== "note") return;
+		const expected = join("share-artifacts", record.id);
+		if (record.artifactRelativePath !== expected) {
+			log.warn({
+				shareId: record.id,
+				artifactRelativePath: record.artifactRelativePath
+			}, "Skipped unsafe Note share artifact cleanup path");
+			return;
+		}
+		rm(join(resolveStateDir(), expected), {
+			recursive: true,
+			force: true
+		}).catch((err) => {
+			log.warn({
+				err,
+				shareId: record.id
+			}, "Failed to clean Note share artifact");
+		});
+	}
 };
 async function scanDirectory(root, opts) {
 	let entryCount = 0;

package/dist/src/share/share-thumbnail.js

@@ -92,8 +92,10 @@ async function runThumbnail(task, ctx) {
 	if (!target) return;
 	try {
 		let bytes;
-		if (task.scope === "file") bytes = await renderForFile(target, ctx);
-		else bytes = await renderForSite(target, ctx);
+		if (task.scope === "file") {
+			if (!("kind" in target) || target.kind === "note") return;
+			bytes = await renderForFile(target, ctx);
+		} else bytes = await renderForSite(target, ctx);
 		if (bytes.length > ctx.config.maxBytes) bytes = bytes.subarray(0, ctx.config.maxBytes);
 		await writeFile(getThumbnailPath(task.token), bytes);
 		if (task.scope === "file") getShareStore().setThumbnailStatus(task.recordId, "ready");

package/dist/src/share/share-types.d.ts

@@ -1,4 +1,5 @@
-export type ShareKind = 'file' | 'directory';
+export type WorkspaceShareKind = 'file' | 'directory';
+export type ShareKind = WorkspaceShareKind | 'note';
 export interface ShareDirectoryMeta {
     /** 'browse' shows a file tree; 'zip-only' hides structure and only offers ZIP. */
     mode: 'browse' | 'zip-only';
@@ -9,22 +10,14 @@ export interface ShareDirectoryMeta {
     /** Maximum traversal depth (defense against recursive symlinks). */
     maxDepth: number;
 }
-export interface ShareRecord {
+interface ShareRecordBase {
     /** Unique identifier (UUIDv4) for management. */
     id: string;
     /** Cryptographically secure URL token (base64url, 32 bytes). */
     token: string;
-    /** Resolved absolute path at creation time. */
-    absolutePath: string;
-    /** Workspace-relative POSIX path (for display). */
-    workspaceRelativePath: string;
-    /** Workspace root at creation time (for download-time re-validation). */
-    workspaceRoot: string;
-    /** File or directory inode at creation time (TOCTOU protection). */
-    inode: number;
-    /** Discriminator for downstream branching ('file' | 'directory'). */
+    /** Discriminator for downstream branching. */
     kind: ShareKind;
-    /** Original file/folder name (basename). */
+    /** Public display name. Retained as fileName for API compatibility. */
     fileName: string;
     /**
      * For files: file size in bytes (snapshot at creation).
@@ -56,6 +49,40 @@ export interface ShareRecord {
     /** ISO timestamp of the last failed attempt (used for cooldown). */
     thumbnailFailedAt?: string;
 }
+interface WorkspaceShareRecordBase extends ShareRecordBase {
+    kind: WorkspaceShareKind;
+    /** Resolved absolute path at creation time. */
+    absolutePath: string;
+    /** Workspace-relative POSIX path (for display). */
+    workspaceRelativePath: string;
+    /** Workspace root at creation time (for download-time re-validation). */
+    workspaceRoot: string;
+    /** File or directory inode at creation time (TOCTOU protection). */
+    inode: number;
+}
+export interface FileShareRecord extends WorkspaceShareRecordBase {
+    kind: 'file';
+    directory?: undefined;
+}
+export interface DirectoryShareRecord extends WorkspaceShareRecordBase {
+    kind: 'directory';
+    directory: ShareDirectoryMeta;
+}
+export interface NoteShareRecord extends ShareRecordBase {
+    kind: 'note';
+    /** Notes are state-owned objects, not workspace paths. */
+    workspaceRelativePath: '';
+    sourceNoteId: string;
+    sourceVersion: number;
+    artifactRelativePath: string;
+    attachmentCount: number;
+    snapshotRevision: number;
+    /** Private HMAC key for short-lived public asset tickets. */
+    assetTicketSecret: string;
+    directory?: undefined;
+}
+export type WorkspaceShareRecord = FileShareRecord | DirectoryShareRecord;
+export type ShareRecord = WorkspaceShareRecord | NoteShareRecord;
 export interface CreateShareParams {
     /** Workspace-relative file path. */
     path: string;
@@ -70,7 +97,7 @@ export interface CreateShareParams {
     /** Agent id to resolve workspace root. */
     agentId?: string;
     /** Force directory share semantics (overrides auto-detection). */
-    kind?: ShareKind;
+    kind?: WorkspaceShareKind;
     /** Directory: browse vs zip-only. Defaults to 'browse'. */
     directoryMode?: 'browse' | 'zip-only';
     /** Directory: cap on entry count at scan time. */
@@ -83,7 +110,7 @@ export interface CreateShareParams {
     maxDepth?: number;
 }
 export interface ShareStoreData {
-    version: 1;
+    version: 1 | 2;
     shares: ShareRecord[];
 }
 export type ShareReachability = 'public' | 'lan' | 'local-only';
@@ -115,6 +142,15 @@ export interface ShareThumbnailConfig {
     /** Optional override for the loopback URL used by the headless renderer. */
     internalGatewayUrl?: string;
 }
+export interface ShareNoteConfig {
+    enabled: boolean;
+    maxMarkdownBytes: number;
+    maxAttachmentCount: number;
+    maxAttachmentSize: number;
+    maxTotalSize: number;
+    assetTicketTtlMs: number;
+    revokeOnSourceDelete: boolean;
+}
 export interface ShareConfig {
     enabled: boolean;
     defaultTtlMs: number;
@@ -124,6 +160,8 @@ export interface ShareConfig {
     inlinePreviewMimes: string[];
     directory: ShareDirectoryConfig;
     thumbnail: ShareThumbnailConfig;
+    note: ShareNoteConfig;
 }
 /** Default share configuration values. */
 export declare const SHARE_CONFIG_DEFAULTS: ShareConfig;
+export {};

package/dist/src/share/share-types.js

@@ -34,6 +34,15 @@ const SHARE_CONFIG_DEFAULTS = {
 		viewportHeight: 630,
 		generationTimeoutMs: 8e3,
 		failureCooldownMs: 5 * 6e4
+	},
+	note: {
+		enabled: true,
+		maxMarkdownBytes: 2 * 1024 * 1024,
+		maxAttachmentCount: 50,
+		maxAttachmentSize: 100 * 1024 * 1024,
+		maxTotalSize: 250 * 1024 * 1024,
+		assetTicketTtlMs: 10 * 6e4,
+		revokeOnSourceDelete: true
 	}
 };
 //#endregion

package/dist/src/share/share-zip.d.ts

@@ -1,5 +1,5 @@
 import { Readable } from 'node:stream';
-import type { ShareRecord } from './share-types.js';
+import type { DirectoryShareRecord } from './share-types.js';
 export interface ZipPlanFile {
     /** Path within the archive (POSIX, no leading /, may contain subdirs). */
     zipPath: string;
@@ -32,4 +32,4 @@ export interface PlanDirectoryOpts {
     /** Walk depth cap. */
     maxDepth: number;
 }
-export declare function planDirectoryFiles(record: ShareRecord, opts: PlanDirectoryOpts): Promise<ZipPlanFile[]>;
+export declare function planDirectoryFiles(record: DirectoryShareRecord, opts: PlanDirectoryOpts): Promise<ZipPlanFile[]>;

package/dist/src/tui/backends/embedded-backend.js

@@ -23,9 +23,9 @@ import { parseModelRef } from "../../agent/models/selection.js";
 import { buildReviewContext, resolveGitRoot } from "../../review/review-git.js";
 import { MessageBus, MessageBusShutdownError } from "../../infra/bus/queue.js";
 import "../../infra/bus/index.js";
-import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import "../../config/index.js";
+import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { buildWorkflowChildTools } from "../../agent/workflow/workflow-child-tools.js";
 import { WorkflowRunService } from "../../workflows/service/workflow-run-service.js";
 import { WorkflowSessionBridge } from "../../workflows/service/workflow-session-bridge.js";

package/dist/src/tunnel/env.d.ts

@@ -1,12 +1,16 @@
 import type { Config } from '../config/schema.js';
-export declare const TUNNEL_MASKED_SECRET_SENTINELS: readonly ["***", "••••••••••••"];
-export type TunnelRegistrationSecretSource = 'env' | 'config' | 'dev_default' | 'missing';
+export type TunnelRegistrationSecretSource = 'config' | 'dev_default' | 'missing';
 export type TunnelRegistrationSecretMeta = {
     configured: boolean;
     source: TunnelRegistrationSecretSource;
 };
-/** True when the broker is the public frp.xopc.ai service (not local dev). */
-export declare function isProductionTunnelBroker(brokerUrl: string): boolean;
+export declare const TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE = "TUNNEL_REGISTRATION_SECRET_REQUIRED";
+export declare class TunnelRegistrationSecretError extends Error {
+    readonly code = "TUNNEL_REGISTRATION_SECRET_REQUIRED";
+    constructor(brokerUrl?: string);
+}
+/** True only for brokers that are safe to use with the built-in development secret. */
+export declare function isLocalDevelopmentTunnelBroker(brokerUrl: string): boolean;
 export declare function maskTunnelSecretForWeb(secret: string): string;
 export declare function isMaskedTunnelSecretPatchValue(value: string): boolean;
 /**
@@ -15,9 +19,11 @@ export declare function isMaskedTunnelSecretPatchValue(value: string): boolean;
 /** Plaintext registration secret from config file only (never env). */
 export declare function readTunnelRegistrationSecretFromConfigOnly(config: Config | undefined): string | null;
 export declare function getTunnelRegistrationSecretMeta(config: Config | undefined, env?: NodeJS.ProcessEnv, brokerUrl?: string): TunnelRegistrationSecretMeta;
+export declare function resolveOptionalTunnelRegistrationSecret(brokerUrl?: string, configSecret?: string): string | undefined;
+export declare function tunnelRegistrationSecretRequiredMessage(brokerUrl?: string): string;
 /**
  * Registration secret for Tunnel Broker register API.
- * Priority: env `XOPC_TUNNEL_REGISTRATION_SECRET` → `tunnel.registrationSecret` in config → dev default (non-production brokers only).
+ * Resolve `tunnel.registrationSecret` from config, with a development default for local brokers.
  */
-export declare function resolveTunnelRegistrationSecret(env?: NodeJS.ProcessEnv, brokerUrl?: string, configSecret?: string): string;
+export declare function resolveTunnelRegistrationSecret(brokerUrl?: string, configSecret?: string): string;
 export declare function resolveTunnelBrokerUrl(configBrokerUrl: string | undefined, env?: NodeJS.ProcessEnv): string;