@xopcai/xopc 0.0.229 → 0.0.231

package/dist/src/gateway/service.js

@@ -21,13 +21,13 @@ import { init_providers, providers_exports } from "../providers/index.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
 import { disposeAllSessionMcpRuntimes } from "../agent/mcp/bundle-mcp-runtime.js";
+import { ProjectService } from "../projects/project-service.js";
+import { resolveProjectAgentId } from "../projects/project-agent.js";
+import "../projects/index.js";
 import { resolveEffectiveGatewayPort } from "./host.js";
 import { AutomationService } from "../automations/service/automation-service.js";
 import { onAutomationProductEvent, publishAutomationProductEvent } from "../automations/product-events.js";
 import "../automations/index.js";
-import { ProjectService } from "../projects/project-service.js";
-import { resolveProjectAgentId } from "../projects/project-agent.js";
-import "../projects/index.js";
 import { TaskApplicationService } from "../tasks/task-application-service.js";
 import { ProactiveScenarioService } from "../proactive/scenarios/service.js";
 import { TaskOutboxDispatcher } from "../tasks/task-outbox-dispatcher.js";
@@ -50,12 +50,6 @@ import { registerClarifyBridge } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
-import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
-import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
-import "../knowledge/index.js";
-import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
-import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
-import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
 import { DiscussionLiveWorker } from "../discussions/live-worker.js";
@@ -64,6 +58,12 @@ import { DiscussionSealer } from "../discussions/sealer.js";
 import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
+import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
+import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
+import "../knowledge/index.js";
+import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
+import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
+import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { prepareAutomationAgentSession } from "./automation-agent-session.js";
 import { reconcileDreamingAutomations } from "./dreaming-automation-reconciler.js";

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/share/hosted-session-share.d.ts

@@ -0,0 +1,104 @@
+import { CredentialResolver } from '../auth/credentials.js';
+import { type SessionShareMessage, type SessionShareToolActivity } from './session-share-projector.js';
+import { type SessionShareSource } from './session-share-service.js';
+export interface HostedSessionShareManifest {
+    schemaVersion: 1;
+    title: string;
+    snapshotAt: string;
+    description?: string;
+    messages: SessionShareMessage[];
+    toolActivities: SessionShareToolActivity[];
+    attachments: Array<{
+        id: string;
+        messageId: string;
+        fileName: string;
+        mimeType: string;
+        size: number;
+        sha256: string;
+    }>;
+}
+export interface HostedSessionShareSnapshot {
+    sessionId: string;
+    cutoffSeq: number;
+    manifest: HostedSessionShareManifest;
+    assets: Array<{
+        id: string;
+        path: string;
+        size: number;
+    }>;
+}
+export interface BuildHostedSessionShareInput {
+    expectedSessionId: string;
+    expectedCutoffSeq: number;
+    expectedMetadataUpdatedAt: string;
+    description?: string;
+    includeToolActivities?: boolean;
+    attachmentIds?: string[];
+}
+export declare class HostedSessionShareBuilder {
+    private readonly source;
+    constructor(source: SessionShareSource);
+    build(sessionKey: string, input: BuildHostedSessionShareInput): Promise<HostedSessionShareSnapshot>;
+    private loadExpectedSource;
+}
+export interface HostedShareResult {
+    id: string;
+    shareUrl: string;
+    expiresAt: string;
+    maxViews: number | null;
+    viewCount: number;
+    snapshotRevision: number;
+}
+type OwnerShare = {
+    id: string;
+    title: string;
+    description: string | null;
+    status: 'staging' | 'active' | 'revoked';
+    revision: number | null;
+    expiresAt: string;
+    maxViews: number | null;
+    viewCount: number;
+    createdAt: string;
+    updatedAt: string;
+};
+export declare class HostedSessionSharePublisher {
+    private readonly credentials;
+    private readonly fetchImpl;
+    private readonly baseUrl;
+    constructor(baseUrl?: string, credentials?: CredentialResolver, fetchImpl?: typeof fetch);
+    create(snapshot: HostedSessionShareSnapshot, lifecycle: {
+        ttlMs: number;
+        maxViews: number | null;
+    }): Promise<HostedShareResult>;
+    refresh(shareId: string, expectedRevision: number, publicUrl: string, snapshot: HostedSessionShareSnapshot): Promise<HostedShareResult>;
+    list(): Promise<OwnerShare[]>;
+    revoke(shareId: string): Promise<void>;
+    private uploadAssets;
+    private request;
+}
+export declare class HostedShareAuthorizationError extends Error {
+    constructor();
+}
+export interface HostedShareBinding extends HostedShareResult {
+    sessionId: string;
+    cutoffSeq: number;
+    title: string;
+    description: string | null;
+    messageCount: number;
+    attachmentCount: number;
+    includeToolActivities: boolean;
+    attachmentIds: string[];
+    createdAt: string;
+    updatedAt: string;
+    revoked: boolean;
+}
+export declare class HostedShareBindingStore {
+    private readonly path;
+    private pending;
+    list(sessionId: string): Promise<HostedShareBinding[]>;
+    upsert(binding: HostedShareBinding): Promise<void>;
+    reconcile(remote: OwnerShare[]): Promise<void>;
+    private mutate;
+    private read;
+}
+export {};

package/dist/src/share/hosted-session-share.js

@@ -0,0 +1,276 @@
+import { resolveStateDir } from "../config/paths-state.js";
+import { init_paths } from "../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { resolveMediaReference } from "../media/media-reference.js";
+import { projectSessionShare } from "./session-share-projector.js";
+import { SessionShareSnapshotConflictError } from "./session-share-service.js";
+import { basename, dirname, join } from "node:path";
+import { createReadStream } from "node:fs";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { mkdir, readFile, stat } from "node:fs/promises";
+//#region src/share/hosted-session-share.ts
+init_credentials();
+init_paths();
+init_write_file_atomic();
+const DEFAULT_SHARE_URL = "https://share.xopc.ai";
+const MAX_MESSAGES = 1e4;
+const MAX_ATTACHMENTS = 20;
+const MAX_ATTACHMENT_BYTES = 32 * 1024 * 1024;
+const MAX_TOTAL_ATTACHMENT_BYTES = 100 * 1024 * 1024;
+const ALLOWED_MIME_TYPES = new Set([
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp",
+	"audio/mpeg",
+	"audio/mp4",
+	"audio/wav",
+	"audio/ogg",
+	"audio/webm",
+	"video/mp4",
+	"video/webm",
+	"video/quicktime",
+	"application/pdf",
+	"text/plain",
+	"text/markdown"
+]);
+var HostedSessionShareBuilder = class {
+	constructor(source) {
+		this.source = source;
+	}
+	async build(sessionKey, input) {
+		const source = await this.loadExpectedSource(sessionKey, input);
+		const projection = projectSessionShare(source.snapshot.entries);
+		if (projection.messages.length === 0) throw new Error("Session has no shareable messages");
+		if (projection.messages.length > MAX_MESSAGES) throw new Error(`Session has more than ${MAX_MESSAGES} shareable messages`);
+		const selected = [...new Set(input.attachmentIds ?? [])];
+		if (selected.length > MAX_ATTACHMENTS) throw new Error(`Select at most ${MAX_ATTACHMENTS} attachments`);
+		const candidates = new Map(projection.attachmentCandidates.map((candidate) => [candidate.id, candidate]));
+		const attachments = [];
+		const assets = [];
+		let totalSize = 0;
+		for (const id of selected) {
+			const candidate = candidates.get(id);
+			const uri = projection.attachmentUris.get(id);
+			if (!candidate || !uri) throw new Error(`Attachment is not part of this session snapshot: ${id}`);
+			const mimeType = normalizeMimeType(candidate.mimeType);
+			if (!ALLOWED_MIME_TYPES.has(mimeType)) throw new Error(`Attachment type is not supported for hosted sharing: ${candidate.fileName}`);
+			const resolved = await resolveMediaReference(uri);
+			const sourceStat = await stat(resolved.path);
+			if (!sourceStat.isFile()) throw new Error(`Attachment is not a file: ${candidate.fileName}`);
+			if (sourceStat.size > MAX_ATTACHMENT_BYTES) throw new Error(`Attachment is too large: ${candidate.fileName}`);
+			totalSize += sourceStat.size;
+			if (totalSize > MAX_TOTAL_ATTACHMENT_BYTES) throw new Error("Selected attachments are too large");
+			attachments.push({
+				id,
+				messageId: candidate.messageId,
+				fileName: publicFileName(candidate.fileName),
+				mimeType,
+				size: sourceStat.size,
+				sha256: await checksumFile(resolved.path)
+			});
+			assets.push({
+				id,
+				path: resolved.path,
+				size: sourceStat.size
+			});
+		}
+		const selectedIds = new Set(selected);
+		return {
+			sessionId: source.snapshot.sessionId,
+			cutoffSeq: source.snapshot.lastSeq,
+			manifest: {
+				schemaVersion: 1,
+				title: (source.metadata.name?.trim() || "Shared conversation").slice(0, 200),
+				snapshotAt: (/* @__PURE__ */ new Date()).toISOString(),
+				...input.description?.trim() ? { description: input.description.trim().slice(0, 1e3) } : {},
+				messages: projection.messages.map((message) => ({
+					...message,
+					attachmentIds: message.attachmentIds.filter((id) => selectedIds.has(id))
+				})),
+				toolActivities: input.includeToolActivities ? projection.toolActivities : [],
+				attachments
+			},
+			assets
+		};
+	}
+	async loadExpectedSource(sessionKey, expected) {
+		const [metadata, snapshot] = await Promise.all([this.source.getMetadata(sessionKey), this.source.getSnapshot(sessionKey)]);
+		if (!metadata || !snapshot || !metadata.sessionId || metadata.sessionId !== snapshot.sessionId) throw new Error("Session not found");
+		if (snapshot.sessionId !== expected.expectedSessionId || snapshot.lastSeq !== expected.expectedCutoffSeq || metadata.updatedAt !== expected.expectedMetadataUpdatedAt) throw new SessionShareSnapshotConflictError();
+		return {
+			metadata,
+			snapshot
+		};
+	}
+};
+var HostedSessionSharePublisher = class {
+	baseUrl;
+	constructor(baseUrl = process.env.XOPC_SHARE_URL ?? DEFAULT_SHARE_URL, credentials = new CredentialResolver(), fetchImpl = fetch) {
+		this.credentials = credentials;
+		this.fetchImpl = fetchImpl;
+		this.baseUrl = baseUrl.replace(/\/+$/, "");
+	}
+	async create(snapshot, lifecycle) {
+		const publicToken = randomBytes(32).toString("base64url");
+		const draft = await this.request("/api/v1/session-shares", {
+			method: "POST",
+			headers: { "Idempotency-Key": `xopc-${randomUUID()}` },
+			body: JSON.stringify({
+				publicToken,
+				manifest: snapshot.manifest,
+				...lifecycle
+			})
+		});
+		await this.uploadAssets(draft, snapshot.assets);
+		const finalized = await this.request(`/api/v1/session-shares/${encodeURIComponent(draft.shareId)}/uploads/${encodeURIComponent(draft.uploadId)}/finalize`, { method: "POST" });
+		if (!draft.publicUrl) throw new Error("Hosted Share did not return a public URL");
+		return toResult(finalized.item, draft.publicUrl);
+	}
+	async refresh(shareId, expectedRevision, publicUrl, snapshot) {
+		const draft = await this.request(`/api/v1/session-shares/${encodeURIComponent(shareId)}/revisions`, {
+			method: "POST",
+			headers: { "Idempotency-Key": `xopc-${randomUUID()}` },
+			body: JSON.stringify({
+				expectedRevision,
+				manifest: snapshot.manifest
+			})
+		});
+		await this.uploadAssets(draft, snapshot.assets);
+		return toResult((await this.request(`/api/v1/session-shares/${encodeURIComponent(shareId)}/uploads/${encodeURIComponent(draft.uploadId)}/finalize`, { method: "POST" })).item, publicUrl);
+	}
+	async list() {
+		return (await this.request("/api/v1/session-shares")).items;
+	}
+	async revoke(shareId) {
+		await this.request(`/api/v1/session-shares/${encodeURIComponent(shareId)}`, { method: "DELETE" });
+	}
+	async uploadAssets(draft, assets) {
+		const uploads = new Map(draft.assetUploads.map((upload) => [upload.assetId, upload.uploadUrl]));
+		for (const asset of assets) {
+			const uploadUrl = uploads.get(asset.id);
+			if (!uploadUrl) throw new Error(`Hosted Share did not accept attachment: ${asset.id}`);
+			const bytes = await readFile(asset.path);
+			if (bytes.byteLength !== asset.size) throw new Error(`Attachment changed during upload: ${asset.id}`);
+			await this.request(uploadUrl, {
+				method: "PUT",
+				headers: {
+					"Content-Length": String(bytes.byteLength),
+					"Content-Type": "application/octet-stream"
+				},
+				body: bytes
+			});
+		}
+	}
+	async request(path, init = {}) {
+		const token = await this.credentials.loadOAuthToken("xopc-share");
+		if (!token) throw new HostedShareAuthorizationError();
+		const url = new URL(path, `${this.baseUrl}/`);
+		if (url.origin !== new URL(this.baseUrl).origin) throw new Error("Hosted Share returned an invalid upload URL");
+		const response = await this.fetchImpl(url, {
+			...init,
+			headers: {
+				Accept: "application/json",
+				...init.body && !init.headers?.["Content-Type"] ? { "Content-Type": "application/json" } : {},
+				...init.headers,
+				Authorization: `Bearer ${token.access}`
+			},
+			signal: init.signal ?? AbortSignal.timeout(12e4)
+		});
+		const body = await response.json().catch(() => ({}));
+		if (response.status === 401) throw new HostedShareAuthorizationError();
+		if (!response.ok) throw new Error(body.error?.message || `Hosted Share request failed (${response.status})`);
+		return body;
+	}
+};
+var HostedShareAuthorizationError = class extends Error {
+	constructor() {
+		super("Connect XOPC Hosted Share before publishing");
+		this.name = "HostedShareAuthorizationError";
+	}
+};
+var HostedShareBindingStore = class {
+	path = join(resolveStateDir(), "hosted-share-bindings.json");
+	pending = Promise.resolve();
+	async list(sessionId) {
+		return (await this.read()).items.filter((item) => item.sessionId === sessionId).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+	}
+	async upsert(binding) {
+		await this.mutate((file) => {
+			const index = file.items.findIndex((item) => item.id === binding.id);
+			if (index === -1) file.items.push(binding);
+			else file.items[index] = binding;
+		});
+	}
+	async reconcile(remote) {
+		const byId = new Map(remote.map((item) => [item.id, item]));
+		await this.mutate((file) => {
+			file.items = file.items.map((binding) => {
+				const item = byId.get(binding.id);
+				return item ? {
+					...binding,
+					expiresAt: item.expiresAt,
+					maxViews: item.maxViews,
+					viewCount: item.viewCount,
+					snapshotRevision: item.revision ?? binding.snapshotRevision,
+					title: item.title,
+					description: item.description,
+					updatedAt: item.updatedAt,
+					revoked: item.status === "revoked"
+				} : binding;
+			});
+		});
+	}
+	async mutate(update) {
+		const operation = this.pending.then(async () => {
+			const file = await this.read();
+			update(file);
+			await mkdir(dirname(this.path), { recursive: true });
+			await writeTextAtomic(this.path, `${JSON.stringify(file, null, 2)}\n`);
+		});
+		this.pending = operation.catch(() => void 0);
+		await operation;
+	}
+	async read() {
+		try {
+			const parsed = JSON.parse(await readFile(this.path, "utf8"));
+			return parsed.version === 1 && Array.isArray(parsed.items) ? {
+				version: 1,
+				items: parsed.items
+			} : {
+				version: 1,
+				items: []
+			};
+		} catch {
+			return {
+				version: 1,
+				items: []
+			};
+		}
+	}
+};
+function toResult(item, shareUrl) {
+	if (!item.revision) throw new Error("Hosted Share revision was not activated");
+	return {
+		id: item.id,
+		shareUrl,
+		expiresAt: item.expiresAt,
+		maxViews: item.maxViews,
+		viewCount: item.viewCount,
+		snapshotRevision: item.revision
+	};
+}
+function normalizeMimeType(value) {
+	return value.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+function publicFileName(value) {
+	return basename(value.replaceAll("\\", "/")).replace(/[\u0000-\u001f\u007f]/g, "_").trim().slice(0, 200) || "attachment";
+}
+async function checksumFile(path) {
+	const hash = createHash("sha256");
+	for await (const chunk of createReadStream(path)) hash.update(chunk);
+	return hash.digest("hex");
+}
+//#endregion
+export { HostedSessionShareBuilder, HostedSessionSharePublisher, HostedShareAuthorizationError, HostedShareBindingStore };

package/dist/src/share/note-share-service.js

@@ -3,8 +3,9 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths } from "../config/paths.js";
 import { collectReferencedAttachmentIds } from "../notes/note-attachment-sync.js";
+import { issueShareAssetTicket, verifyShareAssetTicket } from "./share-asset-ticket.js";
 import { dirname, join } from "node:path";
-import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { copyFile, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 //#region src/share/note-share-service.ts
 init_paths();
@@ -113,31 +114,10 @@ var NoteShareService = class {
 		return manifest;
 	}
 	issueAssetTicket(record) {
-		const expiresAt = Date.now() + this.store.getConfig().note.assetTicketTtlMs;
-		const payload = Buffer.from(JSON.stringify({
-			shareId: record.id,
-			revision: record.snapshotRevision,
-			expiresAt
-		})).toString("base64url");
-		return `${payload}.${createHmac("sha256", record.assetTicketSecret).update(payload).digest("base64url")}`;
+		return issueShareAssetTicket(record, this.store.getConfig().note.assetTicketTtlMs);
 	}
 	verifyAssetTicket(record, ticket) {
-		const [payload, signature] = ticket.split(".");
-		if (!payload || !signature) return false;
-		const expected = createHmac("sha256", record.assetTicketSecret).update(payload).digest();
-		let actual;
-		try {
-			actual = Buffer.from(signature, "base64url");
-		} catch {
-			return false;
-		}
-		if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return false;
-		try {
-			const value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-			return value.shareId === record.id && value.revision === record.snapshotRevision && typeof value.expiresAt === "number" && Date.now() < value.expiresAt;
-		} catch {
-			return false;
-		}
+		return verifyShareAssetTicket(record, ticket);
 	}
 	async resolveAsset(record, attachmentId) {
 		const attachment = (await this.readManifest(record)).attachments.find((item) => item.id === attachmentId);

package/dist/src/share/session-share-projector.d.ts

@@ -0,0 +1,31 @@
+import type { TranscriptSourceEntry } from '../storage/sqlite/index.js';
+export interface SessionShareMessage {
+    id: string;
+    role: 'user' | 'assistant';
+    markdown: string;
+    createdAt: string;
+    attachmentIds: string[];
+}
+export interface SessionShareToolActivity {
+    id: string;
+    messageId?: string;
+    toolName: string;
+    status: 'completed' | 'failed';
+    createdAt: string;
+}
+export interface SessionShareAttachmentCandidate {
+    id: string;
+    messageId: string;
+    fileName: string;
+    mimeType: string;
+    size: number;
+}
+export interface SessionShareProjection {
+    messages: SessionShareMessage[];
+    toolActivities: SessionShareToolActivity[];
+    attachmentCandidates: SessionShareAttachmentCandidate[];
+    /** Internal lookup used only while copying explicitly selected media. */
+    attachmentUris: Map<string, string>;
+}
+/** Closed public projection. Tool arguments/results and raw media references never leave this boundary. */
+export declare function projectSessionShare(entries: TranscriptSourceEntry[]): SessionShareProjection;

package/dist/src/share/session-share-projector.js

@@ -0,0 +1,79 @@
+import { transcriptRowsToClientHistory } from "../session/client-history.js";
+import { createHash } from "node:crypto";
+//#region src/share/session-share-projector.ts
+/** Closed public projection. Tool arguments/results and raw media references never leave this boundary. */
+function projectSessionShare(entries) {
+	const history = transcriptRowsToClientHistory(entries.map((entry) => entry.row));
+	const messages = [];
+	const toolActivities = [];
+	const attachmentCandidates = [];
+	const attachmentUris = /* @__PURE__ */ new Map();
+	for (const item of history) {
+		const rowNumber = parseRowNumber(item.id);
+		const source = rowNumber === null ? void 0 : entries[rowNumber - 1];
+		const createdAt = new Date(source?.createdAt ?? item.timestamp ?? Date.now()).toISOString();
+		if (item.kind === "bash") {
+			if (item.bash?.exitCode === void 0) continue;
+			toolActivities.push({
+				id: `activity-${toolActivities.length + 1}`,
+				toolName: "shell",
+				status: item.bash?.exitCode === 0 ? "completed" : "failed",
+				createdAt
+			});
+			continue;
+		}
+		if (item.kind !== "message" || item.role !== "user" && item.role !== "assistant") continue;
+		const messageId = `message-${messages.length + 1}`;
+		const messageAttachmentIds = [];
+		for (const media of item.media ?? []) {
+			const uri = typeof media.uri === "string" ? media.uri.trim() : "";
+			if (!uri) continue;
+			const id = attachmentId(messageId, uri);
+			messageAttachmentIds.push(id);
+			if (attachmentUris.has(id)) continue;
+			attachmentUris.set(id, uri);
+			attachmentCandidates.push({
+				id,
+				messageId,
+				fileName: media.name?.trim() || "attachment",
+				mimeType: media.mimeType?.trim() || "application/octet-stream",
+				size: Number.isFinite(media.size) && media.size >= 0 ? media.size : 0
+			});
+		}
+		const hasMessage = Boolean(item.content.trim()) || messageAttachmentIds.length > 0;
+		if (hasMessage) messages.push({
+			id: messageId,
+			role: item.role,
+			markdown: item.content,
+			createdAt,
+			attachmentIds: messageAttachmentIds
+		});
+		if (item.role === "assistant") for (const tool of item.toolCalls ?? []) {
+			if (tool.result === void 0 && tool.isError === void 0) continue;
+			toolActivities.push({
+				id: `activity-${toolActivities.length + 1}`,
+				...hasMessage ? { messageId } : {},
+				toolName: tool.name.trim().slice(0, 100) || "tool",
+				status: tool.isError ? "failed" : "completed",
+				createdAt
+			});
+		}
+	}
+	return {
+		messages,
+		toolActivities,
+		attachmentCandidates,
+		attachmentUris
+	};
+}
+function attachmentId(messageId, uri) {
+	return `attachment-${createHash("sha256").update(messageId).update("\0").update(uri).digest("hex").slice(0, 24)}`;
+}
+function parseRowNumber(id) {
+	const match = /^row-(\d+)$/.exec(id ?? "");
+	if (!match) return null;
+	const value = Number(match[1]);
+	return Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+//#endregion
+export { projectSessionShare };

package/dist/src/share/session-share-service.d.ts

@@ -0,0 +1,89 @@
+import type { SessionMetadata } from '../session/types.js';
+import type { CompactionSourceSnapshot } from '../storage/sqlite/index.js';
+import { type SessionShareAttachmentCandidate, type SessionShareMessage, type SessionShareToolActivity } from './session-share-projector.js';
+import type { ShareStore } from './share-store.js';
+import type { SessionShareRecord } from './share-types.js';
+export interface SessionShareManifestAttachment {
+    id: string;
+    messageId: string;
+    mimeType: string;
+    fileName: string;
+    size: number;
+    artifactFileName: string;
+    checksum: string;
+}
+export interface SessionShareManifest {
+    schemaVersion: 1;
+    shareId: string;
+    source: {
+        sessionId: string;
+        cutoffSeq: number;
+    };
+    title: string;
+    snapshotAt: string;
+    messages: SessionShareMessage[];
+    toolActivities: SessionShareToolActivity[];
+    attachments: SessionShareManifestAttachment[];
+}
+export interface SessionShareSource {
+    getMetadata(sessionKey: string): Promise<SessionMetadata | null>;
+    getSnapshot(sessionKey: string): Promise<CompactionSourceSnapshot | null>;
+}
+export interface SessionSharePreview {
+    sessionId: string;
+    cutoffSeq: number;
+    metadataUpdatedAt: string;
+    title: string;
+    snapshotAt: string;
+    messageCount: number;
+    messages: SessionShareMessage[];
+    toolActivities: SessionShareToolActivity[];
+    attachmentCandidates: SessionShareAttachmentCandidate[];
+}
+export interface CreateSessionShareInput {
+    expectedSessionId: string;
+    expectedCutoffSeq: number;
+    expectedMetadataUpdatedAt: string;
+    includeToolActivities?: boolean;
+    attachmentIds?: string[];
+    ttlMs?: number;
+    maxViews?: number | null;
+    description?: string;
+    gatewayTokenHash: string;
+}
+export interface RefreshSessionShareInput {
+    expectedSessionId: string;
+    expectedCutoffSeq: number;
+    expectedMetadataUpdatedAt: string;
+    includeToolActivities?: boolean;
+    attachmentIds?: string[];
+}
+export declare class SessionShareSnapshotConflictError extends Error {
+    constructor();
+}
+export declare class SessionShareService {
+    private readonly store;
+    private readonly source;
+    constructor(store: ShareStore, source: SessionShareSource);
+    preview(sessionKey: string): Promise<SessionSharePreview>;
+    create(sessionKey: string, input: CreateSessionShareInput): Promise<SessionShareRecord>;
+    refresh(sessionKey: string, shareId: string, input: RefreshSessionShareInput): Promise<SessionShareRecord>;
+    list(sessionId: string): SessionShareRecord[];
+    readManifest(record: SessionShareRecord): Promise<SessionShareManifest>;
+    issueAssetTicket(record: SessionShareRecord): string;
+    verifyAssetTicket(record: SessionShareRecord, ticket: string): boolean;
+    resolveAsset(record: SessionShareRecord, attachmentId: string): Promise<{
+        path: string;
+        attachment: SessionShareManifestAttachment;
+    } | null>;
+    removeArtifact(shareId: string): Promise<void>;
+    private loadExpectedSource;
+    private loadSource;
+    private buildManifestBase;
+    private createArtifact;
+    private writeArtifact;
+    private artifactRelativePath;
+    private artifactDir;
+    private validateMessages;
+    private validateManifestRelations;
+}