@xopcai/xopc 0.0.84 → 0.0.85

package/dist/src/share/share-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"share-store.js","names":[],"sources":["../../../src/share/share-store.ts"],"sourcesContent":["import { randomBytes, randomUUID } from 'node:crypto';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { stat, lstat, realpath } from 'node:fs/promises';\n\nimport { resolveStateDir } from '../config/paths.js';\nimport { isPathUnderWorkspace } from '../gateway/workspace-editor-path.js';\nimport { createLogger } from '../utils/logger.js';\nimport { logShareAudit } from './share-audit.js';\nimport type { ShareRecord, ShareStoreData, ShareConfig, CreateShareParams } from './share-types.js';\nimport { SHARE_CONFIG_DEFAULTS } from './share-types.js';\n\nconst log = createLogger('ShareStore');\n\nconst SHARES_FILE = 'shares.json';\nconst CLEANUP_INTERVAL_MS = 10 * 60_000;\nconst EXPIRED_RETENTION_MS = 24 * 60 * 60_000;\nconst MAX_STORED_RECORDS = 500;\nconst TRUNCATE_TO = 200;\nconst VIEW_COUNT_DEBOUNCE_MS = 2_000;\n\nfunction resolveSharesPath(): string {\n  return join(resolveStateDir(), SHARES_FILE);\n}\n\nexport class ShareStore {\n  private shares = new Map<string, ShareRecord>();\n  private tokenIndex = new Map<string, string>();\n  private viewCountDirty = false;\n  private viewCountTimer: ReturnType<typeof setTimeout> | null = null;\n  private cleanupTimer: ReturnType<typeof setInterval> | null = null;\n  private config: ShareConfig;\n\n  constructor(config?: Partial<ShareConfig>) {\n    this.config = { ...SHARE_CONFIG_DEFAULTS, ...config };\n    this.load();\n    this.startCleanupTimer();\n  }\n\n  updateConfig(config: Partial<ShareConfig>): void {\n    this.config = { ...this.config, ...config };\n  }\n\n  getConfig(): ShareConfig {\n    return { ...this.config };\n  }\n\n  // ── CRUD ────────────────────────────────────────────────────────────────────\n\n  async create(params: CreateShareParams & {\n    workspaceRoot: string;\n    gatewayTokenHash: string;\n  }): Promise<ShareRecord> {\n    if (!this.config.enabled) {\n      throw new Error('File sharing is disabled');\n    }\n\n    const activeCount = this.getActiveShares().length;\n    if (activeCount >= this.config.maxActiveShares) {\n      throw new Error(`Maximum active shares reached (${this.config.maxActiveShares})`);\n    }\n\n    const { path: relPath, workspaceRoot, gatewayTokenHash } = params;\n    const ttlMs = params.ttlMs ?? this.config.defaultTtlMs;\n\n    if (ttlMs < 60_000 || ttlMs > this.config.maxTtlMs) {\n      throw new Error(`TTL must be between 60s and ${this.config.maxTtlMs / 1000}s`);\n    }\n    if (params.maxViews !== undefined && params.maxViews !== null) {\n      if (params.maxViews < 1 || params.maxViews > 1000) {\n        throw new Error('maxViews must be between 1 and 1000');\n      }\n    }\n\n    const absolutePath = await this.resolveAndValidatePath(relPath, workspaceRoot);\n    const fileStat = await stat(absolutePath);\n\n    if (!fileStat.isFile()) {\n      throw new Error('Path is not a regular file');\n    }\n    if (fileStat.size > this.config.maxFileSize) {\n      const maxMb = (this.config.maxFileSize / 1_048_576).toFixed(0);\n      throw new Error(`File size exceeds maximum (${maxMb} MB)`);\n    }\n\n    const linkStat = await lstat(absolutePath);\n    if (linkStat.isSymbolicLink()) {\n      const realPath = await realpath(absolutePath);\n      if (!isPathUnderWorkspace(workspaceRoot, realPath)) {\n        throw new Error('Symlink target is outside workspace');\n      }\n    }\n\n    const id = randomUUID();\n    const token = randomBytes(32).toString('base64url');\n    const fileName = relPath.split('/').pop() ?? relPath;\n    const mimeType = resolveMimeType(fileName);\n    const now = new Date();\n\n    const record: ShareRecord = {\n      id,\n      token,\n      absolutePath,\n      workspaceRelativePath: relPath,\n      workspaceRoot,\n      inode: fileStat.ino,\n      isDirectory: false,\n      fileName,\n      fileSize: fileStat.size,\n      mimeType,\n      createdAt: now.toISOString(),\n      expiresAt: new Date(now.getTime() + ttlMs).toISOString(),\n      maxViews: params.maxViews ?? null,\n      viewCount: 0,\n      revoked: false,\n      createdByTokenHash: gatewayTokenHash,\n      description: params.description,\n    };\n\n    this.shares.set(id, record);\n    this.tokenIndex.set(token, id);\n    this.persistSync();\n\n    logShareAudit(\n      'share.create',\n      { shareId: id, tokenPrefix: token.slice(0, 8), fileName, fileSize: fileStat.size, ttlMs },\n      `Share created: ${fileName}`,\n    );\n\n    return record;\n  }\n\n  getById(id: string): ShareRecord | null {\n    return this.shares.get(id) ?? null;\n  }\n\n  getByToken(token: string): ShareRecord | null {\n    const id = this.tokenIndex.get(token);\n    if (!id) return null;\n    return this.shares.get(id) ?? null;\n  }\n\n  /** Validate a share is still accessible for download. Returns null reason if valid. */\n  validateAccess(record: ShareRecord): { valid: boolean; reason?: string } {\n    if (record.revoked) return { valid: false, reason: 'revoked' };\n    if (Date.now() >= new Date(record.expiresAt).getTime()) return { valid: false, reason: 'expired' };\n    if (record.maxViews !== null && record.viewCount >= record.maxViews) {\n      return { valid: false, reason: 'max_views' };\n    }\n    return { valid: true };\n  }\n\n  /** Increment view count (debounced persist). */\n  incrementViewCount(id: string): void {\n    const record = this.shares.get(id);\n    if (!record) return;\n    record.viewCount++;\n    this.scheduleDebouncedPersist();\n  }\n\n  /** Check if the file still exists and inode matches. */\n  async validateFileIntegrity(record: ShareRecord): Promise<{ valid: boolean; reason?: string }> {\n    try {\n      const realPath = await realpath(record.absolutePath);\n      if (!isPathUnderWorkspace(record.workspaceRoot, realPath)) {\n        return { valid: false, reason: 'file_deleted' };\n      }\n      const fileStat = await stat(record.absolutePath);\n      if (fileStat.ino !== record.inode) {\n        logShareAudit(\n          'share.path_changed',\n          { shareId: record.id, tokenPrefix: record.token.slice(0, 8), oldInode: record.inode, newInode: fileStat.ino },\n          `Share file replaced (inode changed): ${record.fileName}`,\n        );\n        return { valid: false, reason: 'file_deleted' };\n      }\n      return { valid: true };\n    } catch {\n      return { valid: false, reason: 'file_deleted' };\n    }\n  }\n\n  revoke(id: string): boolean {\n    const record = this.shares.get(id);\n    if (!record) return false;\n    record.revoked = true;\n    this.persistSync();\n    logShareAudit(\n      'share.revoke',\n      { shareId: id, tokenPrefix: record.token.slice(0, 8), fileName: record.fileName },\n      `Share revoked: ${record.fileName}`,\n    );\n    return true;\n  }\n\n  revokeMany(ids: string[]): number {\n    let count = 0;\n    for (const id of ids) {\n      const record = this.shares.get(id);\n      if (record && !record.revoked) {\n        record.revoked = true;\n        count++;\n        logShareAudit(\n          'share.revoke',\n          { shareId: id, tokenPrefix: record.token.slice(0, 8), fileName: record.fileName },\n          `Share revoked (batch): ${record.fileName}`,\n        );\n      }\n    }\n    if (count > 0) this.persistSync();\n    return count;\n  }\n\n  revokeExpired(): number {\n    const now = Date.now();\n    let count = 0;\n    for (const record of this.shares.values()) {\n      if (!record.revoked && now >= new Date(record.expiresAt).getTime()) {\n        record.revoked = true;\n        count++;\n      }\n    }\n    if (count > 0) this.persistSync();\n    return count;\n  }\n\n  update(id: string, patch: { extendTtlMs?: number; maxViews?: number | null }): ShareRecord | null {\n    const record = this.shares.get(id);\n    if (!record) return null;\n\n    if (patch.extendTtlMs !== undefined) {\n      const newExpiry = new Date(Date.now() + patch.extendTtlMs);\n      record.expiresAt = newExpiry.toISOString();\n    }\n    if (patch.maxViews !== undefined) {\n      record.maxViews = patch.maxViews;\n    }\n\n    this.persistSync();\n    logShareAudit(\n      'share.update',\n      { shareId: id, tokenPrefix: record.token.slice(0, 8), patch },\n      `Share updated: ${record.fileName}`,\n    );\n    return record;\n  }\n\n  getActiveShares(): ShareRecord[] {\n    const now = Date.now();\n    return [...this.shares.values()].filter(\n      (r) => !r.revoked && now < new Date(r.expiresAt).getTime(),\n    );\n  }\n\n  getAllShares(): ShareRecord[] {\n    return [...this.shares.values()].sort(\n      (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime(),\n    );\n  }\n\n  // ── Persistence ─────────────────────────────────────────────────────────────\n\n  private load(): void {\n    const path = resolveSharesPath();\n    if (!existsSync(path)) return;\n    try {\n      const raw = readFileSync(path, 'utf8');\n      const data = JSON.parse(raw) as ShareStoreData;\n      if (data.version !== 1 || !Array.isArray(data.shares)) return;\n\n      const now = Date.now();\n      let cleaned = 0;\n      for (const record of data.shares) {\n        const expiredMs = now - new Date(record.expiresAt).getTime();\n        if (expiredMs > EXPIRED_RETENTION_MS) {\n          cleaned++;\n          continue;\n        }\n        this.shares.set(record.id, record);\n        this.tokenIndex.set(record.token, record.id);\n      }\n      if (cleaned > 0) {\n        log.info({ cleaned }, `Cleaned ${cleaned} expired share records on load`);\n        this.persistSync();\n      }\n    } catch (err) {\n      log.warn({ err }, 'Failed to load shares.json');\n    }\n  }\n\n  private persistSync(): void {\n    const path = resolveSharesPath();\n    mkdirSync(resolveStateDir(), { recursive: true });\n\n    let records = [...this.shares.values()];\n    if (records.length > MAX_STORED_RECORDS) {\n      records.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());\n      const active = records.filter((r) => !r.revoked && Date.now() < new Date(r.expiresAt).getTime());\n      records = active.slice(0, TRUNCATE_TO);\n\n      this.shares.clear();\n      this.tokenIndex.clear();\n      for (const r of records) {\n        this.shares.set(r.id, r);\n        this.tokenIndex.set(r.token, r.id);\n      }\n    }\n\n    const data: ShareStoreData = { version: 1, shares: records };\n    writeFileSync(path, `${JSON.stringify(data, null, 2)}\\n`, 'utf8');\n  }\n\n  private scheduleDebouncedPersist(): void {\n    this.viewCountDirty = true;\n    if (this.viewCountTimer) return;\n    this.viewCountTimer = setTimeout(() => {\n      this.viewCountTimer = null;\n      if (this.viewCountDirty) {\n        this.viewCountDirty = false;\n        this.persistSync();\n      }\n    }, VIEW_COUNT_DEBOUNCE_MS);\n    this.viewCountTimer.unref?.();\n  }\n\n  // ── Cleanup ─────────────────────────────────────────────────────────────────\n\n  private startCleanupTimer(): void {\n    this.cleanupTimer = setInterval(() => {\n      this.cleanupExpired();\n    }, CLEANUP_INTERVAL_MS);\n    this.cleanupTimer.unref?.();\n  }\n\n  private cleanupExpired(): void {\n    const now = Date.now();\n    let removed = 0;\n    for (const [id, record] of this.shares) {\n      const expiredMs = now - new Date(record.expiresAt).getTime();\n      if (expiredMs > EXPIRED_RETENTION_MS) {\n        this.shares.delete(id);\n        this.tokenIndex.delete(record.token);\n        removed++;\n      }\n    }\n    if (removed > 0) {\n      this.persistSync();\n      log.debug({ removed }, `Cleaned ${removed} expired shares`);\n    }\n  }\n\n  shutdown(): void {\n    if (this.cleanupTimer) {\n      clearInterval(this.cleanupTimer);\n      this.cleanupTimer = null;\n    }\n    if (this.viewCountTimer) {\n      clearTimeout(this.viewCountTimer);\n      this.viewCountTimer = null;\n    }\n    if (this.viewCountDirty) {\n      this.viewCountDirty = false;\n      this.persistSync();\n    }\n  }\n\n  // ── Helpers ─────────────────────────────────────────────────────────────────\n\n  private async resolveAndValidatePath(relPath: string, workspaceRoot: string): Promise<string> {\n    const trimmed = relPath.trim().replace(/\\\\/g, '/').replace(/^\\/+/, '');\n    if (!trimmed) throw new Error('Empty path');\n    if (trimmed.includes('..')) throw new Error('Path traversal not allowed');\n    if (trimmed.includes('\\0')) throw new Error('Invalid path');\n\n    const { resolve } = await import('node:path');\n    const { relative } = await import('node:path');\n\n    const abs = resolve(workspaceRoot, trimmed);\n    const root = resolve(workspaceRoot);\n    const relToRoot = relative(root, abs);\n    if (relToRoot.startsWith('..') || relToRoot.split(/[/\\\\]/).includes('..')) {\n      throw new Error('Path is outside workspace');\n    }\n    return abs;\n  }\n}\n\n// ── MIME resolution ─────────────────────────────────────────────────────────\n\nconst MIME_BY_EXT: Record<string, string> = {\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  gif: 'image/gif',\n  webp: 'image/webp',\n  svg: 'image/svg+xml',\n  bmp: 'image/bmp',\n  pdf: 'application/pdf',\n  txt: 'text/plain',\n  md: 'text/markdown',\n  json: 'application/json',\n  html: 'text/html',\n  css: 'text/css',\n  js: 'text/javascript',\n  ts: 'text/typescript',\n  xml: 'application/xml',\n  csv: 'text/csv',\n  zip: 'application/zip',\n  gz: 'application/gzip',\n  tar: 'application/x-tar',\n  mp3: 'audio/mpeg',\n  wav: 'audio/wav',\n  ogg: 'audio/ogg',\n  mp4: 'video/mp4',\n  webm: 'video/webm',\n  mov: 'video/quicktime',\n  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',\n  xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',\n  pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',\n};\n\nfunction resolveMimeType(fileName: string): string {\n  const ext = fileName.split('.').pop()?.toLowerCase() ?? '';\n  return MIME_BY_EXT[ext] || 'application/octet-stream';\n}\n\n// ── Singleton ─────────────────────────────────────────────────────────────────\n\nlet singleton: ShareStore | null = null;\n\nexport function getShareStore(config?: Partial<ShareConfig>): ShareStore {\n  if (!singleton) singleton = new ShareStore(config);\n  return singleton;\n}\n\nexport function resetShareStoreForTests(): void {\n  singleton?.shutdown();\n  singleton = null;\n}\n"],"mappings":";;;;;;;;;;;;YAKqD;aAEH;AAKlD,MAAM,MAAM,aAAa,aAAa;AAEtC,MAAM,cAAc;AACpB,MAAM,sBAAsB,KAAK;AACjC,MAAM,uBAAuB,OAAU;AACvC,MAAM,qBAAqB;AAC3B,MAAM,cAAc;AACpB,MAAM,yBAAyB;AAE/B,SAAS,oBAA4B;AACnC,QAAO,KAAK,iBAAiB,EAAE,YAAY;;AAG7C,IAAa,aAAb,MAAwB;CACtB,yBAAiB,IAAI,KAA0B;CAC/C,6BAAqB,IAAI,KAAqB;CAC9C,iBAAyB;CACzB,iBAA+D;CAC/D,eAA8D;CAC9D;CAEA,YAAY,QAA+B;AACzC,OAAK,SAAS;GAAE,GAAG;GAAuB,GAAG;GAAQ;AACrD,OAAK,MAAM;AACX,OAAK,mBAAmB;;CAG1B,aAAa,QAAoC;AAC/C,OAAK,SAAS;GAAE,GAAG,KAAK;GAAQ,GAAG;GAAQ;;CAG7C,YAAyB;AACvB,SAAO,EAAE,GAAG,KAAK,QAAQ;;CAK3B,MAAM,OAAO,QAGY;AACvB,MAAI,CAAC,KAAK,OAAO,QACf,OAAM,IAAI,MAAM,2BAA2B;AAI7C,MADoB,KAAK,iBAAiB,CAAC,UACxB,KAAK,OAAO,gBAC7B,OAAM,IAAI,MAAM,kCAAkC,KAAK,OAAO,gBAAgB,GAAG;EAGnF,MAAM,EAAE,MAAM,SAAS,eAAe,qBAAqB;EAC3D,MAAM,QAAQ,OAAO,SAAS,KAAK,OAAO;AAE1C,MAAI,QAAQ,OAAU,QAAQ,KAAK,OAAO,SACxC,OAAM,IAAI,MAAM,+BAA+B,KAAK,OAAO,WAAW,IAAK,GAAG;AAEhF,MAAI,OAAO,aAAa,KAAA,KAAa,OAAO,aAAa;OACnD,OAAO,WAAW,KAAK,OAAO,WAAW,IAC3C,OAAM,IAAI,MAAM,sCAAsC;;EAI1D,MAAM,eAAe,MAAM,KAAK,uBAAuB,SAAS,cAAc;EAC9E,MAAM,WAAW,MAAM,KAAK,aAAa;AAEzC,MAAI,CAAC,SAAS,QAAQ,CACpB,OAAM,IAAI,MAAM,6BAA6B;AAE/C,MAAI,SAAS,OAAO,KAAK,OAAO,aAAa;GAC3C,MAAM,SAAS,KAAK,OAAO,cAAc,SAAW,QAAQ,EAAE;AAC9D,SAAM,IAAI,MAAM,8BAA8B,MAAM,MAAM;;AAI5D,OAAI,MADmB,MAAM,aAAa,EAC7B,gBAAgB;OAEvB,CAAC,qBAAqB,eAAe,MADlB,SAAS,aAAa,CACK,CAChD,OAAM,IAAI,MAAM,sCAAsC;;EAI1D,MAAM,KAAK,YAAY;EACvB,MAAM,QAAQ,YAAY,GAAG,CAAC,SAAS,YAAY;EACnD,MAAM,WAAW,QAAQ,MAAM,IAAI,CAAC,KAAK,IAAI;EAC7C,MAAM,WAAW,gBAAgB,SAAS;EAC1C,MAAM,sBAAM,IAAI,MAAM;EAEtB,MAAM,SAAsB;GAC1B;GACA;GACA;GACA,uBAAuB;GACvB;GACA,OAAO,SAAS;GAChB,aAAa;GACb;GACA,UAAU,SAAS;GACnB;GACA,WAAW,IAAI,aAAa;GAC5B,WAAW,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,CAAC,aAAa;GACxD,UAAU,OAAO,YAAY;GAC7B,WAAW;GACX,SAAS;GACT,oBAAoB;GACpB,aAAa,OAAO;GACrB;AAED,OAAK,OAAO,IAAI,IAAI,OAAO;AAC3B,OAAK,WAAW,IAAI,OAAO,GAAG;AAC9B,OAAK,aAAa;AAElB,gBACE,gBACA;GAAE,SAAS;GAAI,aAAa,MAAM,MAAM,GAAG,EAAE;GAAE;GAAU,UAAU,SAAS;GAAM;GAAO,EACzF,kBAAkB,WACnB;AAED,SAAO;;CAGT,QAAQ,IAAgC;AACtC,SAAO,KAAK,OAAO,IAAI,GAAG,IAAI;;CAGhC,WAAW,OAAmC;EAC5C,MAAM,KAAK,KAAK,WAAW,IAAI,MAAM;AACrC,MAAI,CAAC,GAAI,QAAO;AAChB,SAAO,KAAK,OAAO,IAAI,GAAG,IAAI;;;CAIhC,eAAe,QAA0D;AACvE,MAAI,OAAO,QAAS,QAAO;GAAE,OAAO;GAAO,QAAQ;GAAW;AAC9D,MAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,CAAE,QAAO;GAAE,OAAO;GAAO,QAAQ;GAAW;AAClG,MAAI,OAAO,aAAa,QAAQ,OAAO,aAAa,OAAO,SACzD,QAAO;GAAE,OAAO;GAAO,QAAQ;GAAa;AAE9C,SAAO,EAAE,OAAO,MAAM;;;CAIxB,mBAAmB,IAAkB;EACnC,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ;AACb,SAAO;AACP,OAAK,0BAA0B;;;CAIjC,MAAM,sBAAsB,QAAmE;AAC7F,MAAI;GACF,MAAM,WAAW,MAAM,SAAS,OAAO,aAAa;AACpD,OAAI,CAAC,qBAAqB,OAAO,eAAe,SAAS,CACvD,QAAO;IAAE,OAAO;IAAO,QAAQ;IAAgB;GAEjD,MAAM,WAAW,MAAM,KAAK,OAAO,aAAa;AAChD,OAAI,SAAS,QAAQ,OAAO,OAAO;AACjC,kBACE,sBACA;KAAE,SAAS,OAAO;KAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;KAAE,UAAU,OAAO;KAAO,UAAU,SAAS;KAAK,EAC7G,wCAAwC,OAAO,WAChD;AACD,WAAO;KAAE,OAAO;KAAO,QAAQ;KAAgB;;AAEjD,UAAO,EAAE,OAAO,MAAM;UAChB;AACN,UAAO;IAAE,OAAO;IAAO,QAAQ;IAAgB;;;CAInD,OAAO,IAAqB;EAC1B,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,UAAU;AACjB,OAAK,aAAa;AAClB,gBACE,gBACA;GAAE,SAAS;GAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;GAAE,UAAU,OAAO;GAAU,EACjF,kBAAkB,OAAO,WAC1B;AACD,SAAO;;CAGT,WAAW,KAAuB;EAChC,IAAI,QAAQ;AACZ,OAAK,MAAM,MAAM,KAAK;GACpB,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,OAAI,UAAU,CAAC,OAAO,SAAS;AAC7B,WAAO,UAAU;AACjB;AACA,kBACE,gBACA;KAAE,SAAS;KAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;KAAE,UAAU,OAAO;KAAU,EACjF,0BAA0B,OAAO,WAClC;;;AAGL,MAAI,QAAQ,EAAG,MAAK,aAAa;AACjC,SAAO;;CAGT,gBAAwB;EACtB,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,QAAQ;AACZ,OAAK,MAAM,UAAU,KAAK,OAAO,QAAQ,CACvC,KAAI,CAAC,OAAO,WAAW,OAAO,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,EAAE;AAClE,UAAO,UAAU;AACjB;;AAGJ,MAAI,QAAQ,EAAG,MAAK,aAAa;AACjC,SAAO;;CAGT,OAAO,IAAY,OAA+E;EAChG,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI,MAAM,gBAAgB,KAAA,EAExB,QAAO,YAAY,IADG,KAAK,KAAK,KAAK,GAAG,MAAM,YAClB,CAAC,aAAa;AAE5C,MAAI,MAAM,aAAa,KAAA,EACrB,QAAO,WAAW,MAAM;AAG1B,OAAK,aAAa;AAClB,gBACE,gBACA;GAAE,SAAS;GAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;GAAE;GAAO,EAC7D,kBAAkB,OAAO,WAC1B;AACD,SAAO;;CAGT,kBAAiC;EAC/B,MAAM,MAAM,KAAK,KAAK;AACtB,SAAO,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC,CAAC,QAC9B,MAAM,CAAC,EAAE,WAAW,MAAM,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAC3D;;CAGH,eAA8B;AAC5B,SAAO,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC,CAAC,MAC9B,GAAG,MAAM,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAC5E;;CAKH,OAAqB;EACnB,MAAM,OAAO,mBAAmB;AAChC,MAAI,CAAC,WAAW,KAAK,CAAE;AACvB,MAAI;GACF,MAAM,MAAM,aAAa,MAAM,OAAO;GACtC,MAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,OAAI,KAAK,YAAY,KAAK,CAAC,MAAM,QAAQ,KAAK,OAAO,CAAE;GAEvD,MAAM,MAAM,KAAK,KAAK;GACtB,IAAI,UAAU;AACd,QAAK,MAAM,UAAU,KAAK,QAAQ;AAEhC,QADkB,MAAM,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,GAC5C,sBAAsB;AACpC;AACA;;AAEF,SAAK,OAAO,IAAI,OAAO,IAAI,OAAO;AAClC,SAAK,WAAW,IAAI,OAAO,OAAO,OAAO,GAAG;;AAE9C,OAAI,UAAU,GAAG;AACf,QAAI,KAAK,EAAE,SAAS,EAAE,WAAW,QAAQ,gCAAgC;AACzE,SAAK,aAAa;;WAEb,KAAK;AACZ,OAAI,KAAK,EAAE,KAAK,EAAE,6BAA6B;;;CAInD,cAA4B;EAC1B,MAAM,OAAO,mBAAmB;AAChC,YAAU,iBAAiB,EAAE,EAAE,WAAW,MAAM,CAAC;EAEjD,IAAI,UAAU,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC;AACvC,MAAI,QAAQ,SAAS,oBAAoB;AACvC,WAAQ,MAAM,GAAG,MAAM,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC;AAEzF,aADe,QAAQ,QAAQ,MAAM,CAAC,EAAE,WAAW,KAAK,KAAK,GAAG,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAC/E,CAAC,MAAM,GAAG,YAAY;AAEtC,QAAK,OAAO,OAAO;AACnB,QAAK,WAAW,OAAO;AACvB,QAAK,MAAM,KAAK,SAAS;AACvB,SAAK,OAAO,IAAI,EAAE,IAAI,EAAE;AACxB,SAAK,WAAW,IAAI,EAAE,OAAO,EAAE,GAAG;;;AAKtC,gBAAc,MAAM,GAAG,KAAK,UAAU;GADP,SAAS;GAAG,QAAQ;GACT,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO;;CAGnE,2BAAyC;AACvC,OAAK,iBAAiB;AACtB,MAAI,KAAK,eAAgB;AACzB,OAAK,iBAAiB,iBAAiB;AACrC,QAAK,iBAAiB;AACtB,OAAI,KAAK,gBAAgB;AACvB,SAAK,iBAAiB;AACtB,SAAK,aAAa;;KAEnB,uBAAuB;AAC1B,OAAK,eAAe,SAAS;;CAK/B,oBAAkC;AAChC,OAAK,eAAe,kBAAkB;AACpC,QAAK,gBAAgB;KACpB,oBAAoB;AACvB,OAAK,aAAa,SAAS;;CAG7B,iBAA+B;EAC7B,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,UAAU;AACd,OAAK,MAAM,CAAC,IAAI,WAAW,KAAK,OAE9B,KADkB,MAAM,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,GAC5C,sBAAsB;AACpC,QAAK,OAAO,OAAO,GAAG;AACtB,QAAK,WAAW,OAAO,OAAO,MAAM;AACpC;;AAGJ,MAAI,UAAU,GAAG;AACf,QAAK,aAAa;AAClB,OAAI,MAAM,EAAE,SAAS,EAAE,WAAW,QAAQ,iBAAiB;;;CAI/D,WAAiB;AACf,MAAI,KAAK,cAAc;AACrB,iBAAc,KAAK,aAAa;AAChC,QAAK,eAAe;;AAEtB,MAAI,KAAK,gBAAgB;AACvB,gBAAa,KAAK,eAAe;AACjC,QAAK,iBAAiB;;AAExB,MAAI,KAAK,gBAAgB;AACvB,QAAK,iBAAiB;AACtB,QAAK,aAAa;;;CAMtB,MAAc,uBAAuB,SAAiB,eAAwC;EAC5F,MAAM,UAAU,QAAQ,MAAM,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,QAAQ,GAAG;AACtE,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,aAAa;AAC3C,MAAI,QAAQ,SAAS,KAAK,CAAE,OAAM,IAAI,MAAM,6BAA6B;AACzE,MAAI,QAAQ,SAAS,KAAK,CAAE,OAAM,IAAI,MAAM,eAAe;EAE3D,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,MAAM,EAAE,aAAa,MAAM,OAAO;EAElC,MAAM,MAAM,QAAQ,eAAe,QAAQ;EAE3C,MAAM,YAAY,SADL,QAAQ,cACU,EAAE,IAAI;AACrC,MAAI,UAAU,WAAW,KAAK,IAAI,UAAU,MAAM,QAAQ,CAAC,SAAS,KAAK,CACvE,OAAM,IAAI,MAAM,4BAA4B;AAE9C,SAAO;;;AAMX,MAAM,cAAsC;CAC1C,KAAK;CACL,KAAK;CACL,MAAM;CACN,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,IAAI;CACJ,MAAM;CACN,MAAM;CACN,KAAK;CACL,IAAI;CACJ,IAAI;CACJ,KAAK;CACL,KAAK;CACL,KAAK;CACL,IAAI;CACJ,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAM;CACN,KAAK;CACL,MAAM;CACN,MAAM;CACN,MAAM;CACP;AAED,SAAS,gBAAgB,UAA0B;AAEjD,QAAO,YADK,SAAS,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OAC7B;;AAK7B,IAAI,YAA+B;AAEnC,SAAgB,cAAc,QAA2C;AACvE,KAAI,CAAC,UAAW,aAAY,IAAI,WAAW,OAAO;AAClD,QAAO;;AAGT,SAAgB,0BAAgC;AAC9C,YAAW,UAAU;AACrB,aAAY"}
+{"version":3,"file":"share-store.js","names":["resolvePath","relPathPosix"],"sources":["../../../src/share/share-store.ts"],"sourcesContent":["import { randomBytes, randomUUID } from 'node:crypto';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join, relative as relPathPosix, resolve as resolvePath } from 'node:path';\nimport { stat, lstat, realpath, readdir } from 'node:fs/promises';\n\nimport { resolveStateDir } from '../config/paths.js';\nimport { isPathUnderWorkspace } from '../gateway/workspace-editor-path.js';\nimport { createLogger } from '../utils/logger.js';\nimport { logShareAudit } from './share-audit.js';\nimport type {\n  ShareRecord,\n  ShareStoreData,\n  ShareConfig,\n  CreateShareParams,\n  ShareKind,\n} from './share-types.js';\nimport { SHARE_CONFIG_DEFAULTS } from './share-types.js';\n\nconst log = createLogger('ShareStore');\n\nconst SHARES_FILE = 'shares.json';\nconst CLEANUP_INTERVAL_MS = 10 * 60_000;\nconst EXPIRED_RETENTION_MS = 24 * 60 * 60_000;\nconst MAX_STORED_RECORDS = 500;\nconst TRUNCATE_TO = 200;\nconst COUNTER_DEBOUNCE_MS = 2_000;\n\nfunction resolveSharesPath(): string {\n  return join(resolveStateDir(), SHARES_FILE);\n}\n\nexport interface DirectoryListingEntry {\n  name: string;\n  /** Workspace/share-relative POSIX path. */\n  path: string;\n  isDirectory: boolean;\n  size: number;\n  mtime: string;\n  mimeType: string;\n}\n\nexport interface DirectoryListing {\n  /** Share-relative path of the listed dir ('' for root). */\n  path: string;\n  entries: DirectoryListingEntry[];\n  truncated: boolean;\n}\n\ninterface DirectoryScanSummary {\n  entryCount: number;\n  totalSize: number;\n}\n\nexport class ShareStore {\n  private shares = new Map<string, ShareRecord>();\n  private tokenIndex = new Map<string, string>();\n  private dirty = false;\n  private debounceTimer: ReturnType<typeof setTimeout> | null = null;\n  private cleanupTimer: ReturnType<typeof setInterval> | null = null;\n  private config: ShareConfig;\n  private listingCache = new Map<string, { listing: DirectoryListing; expiresAt: number }>();\n  /** Optional cleanup hook invoked when a share record is dropped (e.g. delete thumbnail). */\n  private onCleanup: ((record: ShareRecord) => void) | null = null;\n\n  constructor(config?: Partial<ShareConfig>) {\n    this.config = { ...SHARE_CONFIG_DEFAULTS, ...config };\n    this.load();\n    this.startCleanupTimer();\n  }\n\n  updateConfig(config: Partial<ShareConfig>): void {\n    this.config = { ...this.config, ...config };\n  }\n\n  /** Register a cleanup hook (idempotent — last wins). */\n  setCleanupHook(hook: (record: ShareRecord) => void): void {\n    this.onCleanup = hook;\n  }\n\n  getConfig(): ShareConfig {\n    return { ...this.config };\n  }\n\n  // ── CRUD ────────────────────────────────────────────────────────────────────\n\n  async create(\n    params: CreateShareParams & {\n      workspaceRoot: string;\n      gatewayTokenHash: string;\n    },\n  ): Promise<ShareRecord> {\n    if (!this.config.enabled) {\n      throw new Error('File sharing is disabled');\n    }\n\n    const activeCount = this.getActiveShares().length;\n    if (activeCount >= this.config.maxActiveShares) {\n      throw new Error(`Maximum active shares reached (${this.config.maxActiveShares})`);\n    }\n\n    const { path: relPath, workspaceRoot, gatewayTokenHash } = params;\n    const ttlMs = params.ttlMs ?? this.config.defaultTtlMs;\n\n    if (ttlMs < 60_000 || ttlMs > this.config.maxTtlMs) {\n      throw new Error(`TTL must be between 60s and ${this.config.maxTtlMs / 1000}s`);\n    }\n    if (params.maxViews !== undefined && params.maxViews !== null) {\n      if (params.maxViews < 1 || params.maxViews > 1000) {\n        throw new Error('maxViews must be between 1 and 1000');\n      }\n    }\n\n    const absolutePath = await this.resolveAndValidatePath(relPath, workspaceRoot);\n    const fileStat = await stat(absolutePath);\n\n    const detectedKind: ShareKind = fileStat.isDirectory() ? 'directory' : 'file';\n    const requestedKind = params.kind ?? detectedKind;\n    if (requestedKind !== detectedKind) {\n      throw new Error(\n        `Requested share kind '${requestedKind}' does not match filesystem (got '${detectedKind}')`,\n      );\n    }\n\n    if (requestedKind === 'file') {\n      return this.createFileShare({\n        params,\n        absolutePath,\n        fileStat,\n        relPath,\n        workspaceRoot,\n        ttlMs,\n        gatewayTokenHash,\n      });\n    }\n\n    return this.createDirectoryShare({\n      params,\n      absolutePath,\n      fileStat,\n      relPath,\n      workspaceRoot,\n      ttlMs,\n      gatewayTokenHash,\n    });\n  }\n\n  private async createFileShare(args: {\n    params: CreateShareParams;\n    absolutePath: string;\n    fileStat: import('node:fs').Stats;\n    relPath: string;\n    workspaceRoot: string;\n    ttlMs: number;\n    gatewayTokenHash: string;\n  }): Promise<ShareRecord> {\n    const { params, absolutePath, fileStat, relPath, workspaceRoot, ttlMs, gatewayTokenHash } = args;\n\n    if (!fileStat.isFile()) {\n      throw new Error('Path is not a regular file');\n    }\n    if (fileStat.size > this.config.maxFileSize) {\n      const maxMb = (this.config.maxFileSize / 1_048_576).toFixed(0);\n      throw new Error(`File size exceeds maximum (${maxMb} MB)`);\n    }\n\n    const linkStat = await lstat(absolutePath);\n    if (linkStat.isSymbolicLink()) {\n      const real = await realpath(absolutePath);\n      if (!isPathUnderWorkspace(workspaceRoot, real)) {\n        throw new Error('Symlink target is outside workspace');\n      }\n    }\n\n    const fileName = relPath.split('/').pop() || relPath;\n    const mimeType = resolveMimeType(fileName);\n    const record = this.buildRecord({\n      kind: 'file',\n      absolutePath,\n      workspaceRoot,\n      workspaceRelativePath: relPath,\n      inode: fileStat.ino,\n      fileName,\n      fileSize: fileStat.size,\n      mimeType,\n      ttlMs,\n      maxViews: params.maxViews,\n      description: params.description,\n      gatewayTokenHash,\n    });\n\n    this.persistAndAudit(record, 'share.create', `Share created: ${record.fileName}`, {\n      fileName: record.fileName,\n      fileSize: record.fileSize,\n      ttlMs,\n    });\n\n    return record;\n  }\n\n  private async createDirectoryShare(args: {\n    params: CreateShareParams;\n    absolutePath: string;\n    fileStat: import('node:fs').Stats;\n    relPath: string;\n    workspaceRoot: string;\n    ttlMs: number;\n    gatewayTokenHash: string;\n  }): Promise<ShareRecord> {\n    const { params, absolutePath, fileStat, relPath, workspaceRoot, ttlMs, gatewayTokenHash } = args;\n    const dirCfg = this.config.directory;\n    if (!dirCfg.enabled) {\n      throw new Error('Directory sharing is disabled');\n    }\n\n    const followSymlinks = params.followSymlinks ?? false;\n    const maxDepth = params.maxDepth ?? dirCfg.maxDepth;\n    const maxFileCount = Math.min(params.maxFileCount ?? dirCfg.maxFileCount, dirCfg.maxFileCount);\n    const maxFolderSize = Math.min(\n      params.maxFolderSize ?? dirCfg.maxFolderSize,\n      dirCfg.maxFolderSize,\n    );\n\n    const summary = await scanDirectory(absolutePath, {\n      workspaceRoot,\n      followSymlinks,\n      maxDepth,\n      maxFileCount,\n      maxFolderSize,\n    });\n\n    const fileName = relPath.split('/').pop() || relPath || 'shared';\n    const record = this.buildRecord({\n      kind: 'directory',\n      absolutePath,\n      workspaceRoot,\n      workspaceRelativePath: relPath,\n      inode: fileStat.ino,\n      fileName,\n      fileSize: summary.totalSize,\n      mimeType: 'application/x-directory',\n      ttlMs,\n      maxViews: params.maxViews,\n      description: params.description,\n      gatewayTokenHash,\n      directory: {\n        mode: params.directoryMode ?? 'browse',\n        entryCount: summary.entryCount,\n        followSymlinks,\n        maxDepth,\n      },\n    });\n\n    this.persistAndAudit(record, 'share.create', `Folder share created: ${record.fileName}`, {\n      fileName: record.fileName,\n      entryCount: summary.entryCount,\n      totalSize: summary.totalSize,\n      ttlMs,\n      mode: record.directory?.mode,\n    });\n\n    return record;\n  }\n\n  private buildRecord(input: {\n    kind: ShareKind;\n    absolutePath: string;\n    workspaceRoot: string;\n    workspaceRelativePath: string;\n    inode: number;\n    fileName: string;\n    fileSize: number;\n    mimeType: string;\n    ttlMs: number;\n    maxViews?: number | null;\n    description?: string;\n    gatewayTokenHash: string;\n    directory?: ShareRecord['directory'];\n  }): ShareRecord {\n    const id = randomUUID();\n    const token = randomBytes(32).toString('base64url');\n    const now = new Date();\n    const record: ShareRecord = {\n      id,\n      token,\n      absolutePath: input.absolutePath,\n      workspaceRelativePath: input.workspaceRelativePath,\n      workspaceRoot: input.workspaceRoot,\n      inode: input.inode,\n      kind: input.kind,\n      fileName: input.fileName,\n      fileSize: input.fileSize,\n      mimeType: input.mimeType,\n      createdAt: now.toISOString(),\n      expiresAt: new Date(now.getTime() + input.ttlMs).toISOString(),\n      maxViews: input.maxViews ?? null,\n      downloadCount: 0,\n      revoked: false,\n      createdByTokenHash: input.gatewayTokenHash,\n      description: input.description,\n      directory: input.directory,\n    };\n\n    this.shares.set(id, record);\n    this.tokenIndex.set(token, id);\n    return record;\n  }\n\n  private persistAndAudit(\n    record: ShareRecord,\n    event: Parameters<typeof logShareAudit>[0],\n    message: string,\n    extra: Record<string, unknown>,\n  ): void {\n    this.persistSync();\n    logShareAudit(event, { shareId: record.id, tokenPrefix: record.token.slice(0, 8), ...extra }, message);\n  }\n\n  getById(id: string): ShareRecord | null {\n    return this.shares.get(id) ?? null;\n  }\n\n  getByToken(token: string): ShareRecord | null {\n    const id = this.tokenIndex.get(token);\n    if (!id) return null;\n    return this.shares.get(id) ?? null;\n  }\n\n  /** Validate a share is still accessible for download. Returns null reason if valid. */\n  validateAccess(record: ShareRecord): { valid: boolean; reason?: string } {\n    if (record.revoked) return { valid: false, reason: 'revoked' };\n    if (Date.now() >= new Date(record.expiresAt).getTime()) return { valid: false, reason: 'expired' };\n    if (record.maxViews !== null && record.downloadCount >= record.maxViews) {\n      return { valid: false, reason: 'max_views' };\n    }\n    return { valid: true };\n  }\n\n  /** Increment download counter (used by directory & file downloads). Debounced persist. */\n  incrementDownloadCount(id: string): void {\n    const record = this.shares.get(id);\n    if (!record) return;\n    record.downloadCount++;\n    this.scheduleDebouncedPersist();\n  }\n\n  /** Check if the file still exists and inode matches. */\n  async validateFileIntegrity(record: ShareRecord): Promise<{ valid: boolean; reason?: string }> {\n    try {\n      const realPath = await realpath(record.absolutePath);\n      if (!isPathUnderWorkspace(record.workspaceRoot, realPath)) {\n        return { valid: false, reason: 'file_deleted' };\n      }\n      const fileStat = await stat(record.absolutePath);\n      if (fileStat.ino !== record.inode) {\n        logShareAudit(\n          'share.path_changed',\n          {\n            shareId: record.id,\n            tokenPrefix: record.token.slice(0, 8),\n            oldInode: record.inode,\n            newInode: fileStat.ino,\n          },\n          `Share path replaced (inode changed): ${record.fileName}`,\n        );\n        return { valid: false, reason: 'file_deleted' };\n      }\n      return { valid: true };\n    } catch {\n      return { valid: false, reason: 'file_deleted' };\n    }\n  }\n\n  /**\n   * Resolve a child path inside a directory share. Returns the absolute path\n   * if it stays within both the share root and the workspace.\n   */\n  async resolveDirectoryChild(\n    record: ShareRecord,\n    relativePath: string,\n  ): Promise<{ ok: true; absolutePath: string } | { ok: false; reason: string }> {\n    if (record.kind !== 'directory') {\n      return { ok: false, reason: 'not_directory' };\n    }\n    const trimmed = (relativePath ?? '').replace(/^\\/+/, '').replace(/\\\\/g, '/');\n    if (trimmed.includes('..') || trimmed.includes('\\0')) {\n      return { ok: false, reason: 'path_traversal' };\n    }\n    const abs = resolvePath(record.absolutePath, trimmed);\n    const relToShare = relPathPosix(record.absolutePath, abs);\n    if (relToShare.startsWith('..') || relToShare.split(/[/\\\\]/).includes('..')) {\n      return { ok: false, reason: 'path_outside_share' };\n    }\n    try {\n      const real = await realpath(abs);\n      if (!isPathUnderWorkspace(record.workspaceRoot, real)) {\n        return { ok: false, reason: 'path_outside_workspace' };\n      }\n      const relToShareReal = relPathPosix(record.absolutePath, real);\n      if (relToShareReal.startsWith('..') || relToShareReal.split(/[/\\\\]/).includes('..')) {\n        return { ok: false, reason: 'path_outside_share' };\n      }\n      return { ok: true, absolutePath: real };\n    } catch {\n      return { ok: false, reason: 'not_found' };\n    }\n  }\n\n  /** List a single directory level (cached, share-root-relative). */\n  async listDirectory(record: ShareRecord, relativePath: string): Promise<DirectoryListing> {\n    if (record.kind !== 'directory') throw new Error('Not a directory share');\n    const trimmed = (relativePath ?? '').replace(/^\\/+/, '');\n    const cacheKey = `${record.id}::${trimmed}`;\n    const cacheTtl = this.config.directory.listingCacheMs;\n    const now = Date.now();\n    const cached = this.listingCache.get(cacheKey);\n    if (cached && cached.expiresAt > now) return cached.listing;\n\n    const resolved = await this.resolveDirectoryChild(record, trimmed);\n    if (resolved.ok !== true) throw new Error(resolved.reason);\n\n    const absDir = resolved.absolutePath;\n    const stats = await stat(absDir);\n    if (!stats.isDirectory()) throw new Error('not_directory');\n\n    const followSymlinks = record.directory?.followSymlinks ?? false;\n    const dirents = await readdir(absDir, { withFileTypes: true });\n    const entries: DirectoryListingEntry[] = [];\n    let truncated = false;\n    const limit = 2_000;\n\n    for (const dirent of dirents) {\n      if (entries.length >= limit) {\n        truncated = true;\n        break;\n      }\n      const childAbs = resolvePath(absDir, dirent.name);\n      try {\n        const childLstat = await lstat(childAbs);\n        if (childLstat.isSymbolicLink()) {\n          if (!followSymlinks) continue;\n          const real = await realpath(childAbs);\n          if (!isPathUnderWorkspace(record.workspaceRoot, real)) continue;\n          const relToShare = relPathPosix(record.absolutePath, real);\n          if (relToShare.startsWith('..')) continue;\n        }\n        const childStat = childLstat.isSymbolicLink() ? await stat(childAbs) : childLstat;\n        const childRel = trimmed ? `${trimmed}/${dirent.name}` : dirent.name;\n        entries.push({\n          name: dirent.name,\n          path: childRel,\n          isDirectory: childStat.isDirectory(),\n          size: childStat.isFile() ? childStat.size : 0,\n          mtime: childStat.mtime.toISOString(),\n          mimeType: childStat.isDirectory() ? 'application/x-directory' : resolveMimeType(dirent.name),\n        });\n      } catch {\n        /* skip unreadable entries */\n      }\n    }\n\n    entries.sort((a, b) => {\n      if (a.isDirectory !== b.isDirectory) return a.isDirectory ? -1 : 1;\n      return a.name.localeCompare(b.name);\n    });\n\n    const listing: DirectoryListing = { path: trimmed, entries, truncated };\n    if (cacheTtl > 0) {\n      this.listingCache.set(cacheKey, { listing, expiresAt: now + cacheTtl });\n    }\n    return listing;\n  }\n\n  /** Update thumbnail status. Persists immediately so generator restart is safe. */\n  setThumbnailStatus(id: string, status: 'pending' | 'ready' | 'failed'): void {\n    const record = this.shares.get(id);\n    if (!record) return;\n    record.thumbnailStatus = status;\n    if (status === 'ready') record.thumbnailGeneratedAt = new Date().toISOString();\n    if (status === 'failed') record.thumbnailFailedAt = new Date().toISOString();\n    this.persistSync();\n  }\n\n  /** Drop the listing cache for a share (used on revoke/update). */\n  invalidateListingCache(shareId: string): void {\n    for (const key of this.listingCache.keys()) {\n      if (key.startsWith(`${shareId}::`)) this.listingCache.delete(key);\n    }\n  }\n\n  revoke(id: string): boolean {\n    const record = this.shares.get(id);\n    if (!record) return false;\n    record.revoked = true;\n    this.invalidateListingCache(id);\n    this.persistSync();\n    logShareAudit(\n      'share.revoke',\n      { shareId: id, tokenPrefix: record.token.slice(0, 8), fileName: record.fileName },\n      `Share revoked: ${record.fileName}`,\n    );\n    return true;\n  }\n\n  revokeMany(ids: string[]): number {\n    let count = 0;\n    for (const id of ids) {\n      const record = this.shares.get(id);\n      if (record && !record.revoked) {\n        record.revoked = true;\n        this.invalidateListingCache(id);\n        count++;\n        logShareAudit(\n          'share.revoke',\n          { shareId: id, tokenPrefix: record.token.slice(0, 8), fileName: record.fileName },\n          `Share revoked (batch): ${record.fileName}`,\n        );\n      }\n    }\n    if (count > 0) this.persistSync();\n    return count;\n  }\n\n  revokeExpired(): number {\n    const now = Date.now();\n    let count = 0;\n    for (const record of this.shares.values()) {\n      if (!record.revoked && now >= new Date(record.expiresAt).getTime()) {\n        record.revoked = true;\n        this.invalidateListingCache(record.id);\n        count++;\n      }\n    }\n    if (count > 0) this.persistSync();\n    return count;\n  }\n\n  update(id: string, patch: { extendTtlMs?: number; maxViews?: number | null }): ShareRecord | null {\n    const record = this.shares.get(id);\n    if (!record) return null;\n\n    if (patch.extendTtlMs !== undefined) {\n      const newExpiry = new Date(Date.now() + patch.extendTtlMs);\n      record.expiresAt = newExpiry.toISOString();\n    }\n    if (patch.maxViews !== undefined) {\n      record.maxViews = patch.maxViews;\n    }\n\n    this.persistSync();\n    logShareAudit(\n      'share.update',\n      { shareId: id, tokenPrefix: record.token.slice(0, 8), patch },\n      `Share updated: ${record.fileName}`,\n    );\n    return record;\n  }\n\n  getActiveShares(): ShareRecord[] {\n    const now = Date.now();\n    return [...this.shares.values()].filter(\n      (r) => !r.revoked && now < new Date(r.expiresAt).getTime(),\n    );\n  }\n\n  getAllShares(): ShareRecord[] {\n    return [...this.shares.values()].sort(\n      (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime(),\n    );\n  }\n\n  // ── Persistence ─────────────────────────────────────────────────────────────\n\n  private load(): void {\n    const path = resolveSharesPath();\n    if (!existsSync(path)) return;\n    try {\n      const raw = readFileSync(path, 'utf8');\n      const data = JSON.parse(raw) as ShareStoreData;\n      if (data.version !== 1 || !Array.isArray(data.shares)) return;\n\n      const now = Date.now();\n      let cleaned = 0;\n      for (const record of data.shares) {\n        const expiredMs = now - new Date(record.expiresAt).getTime();\n        if (expiredMs > EXPIRED_RETENTION_MS) {\n          cleaned++;\n          continue;\n        }\n        this.shares.set(record.id, record);\n        this.tokenIndex.set(record.token, record.id);\n      }\n      if (cleaned > 0) {\n        log.info({ cleaned }, `Cleaned ${cleaned} expired share records on load`);\n        this.persistSync();\n      }\n    } catch (err) {\n      log.warn({ err }, 'Failed to load shares.json');\n    }\n  }\n\n  private persistSync(): void {\n    const path = resolveSharesPath();\n    mkdirSync(resolveStateDir(), { recursive: true });\n\n    let records = [...this.shares.values()];\n    if (records.length > MAX_STORED_RECORDS) {\n      records.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());\n      const active = records.filter((r) => !r.revoked && Date.now() < new Date(r.expiresAt).getTime());\n      records = active.slice(0, TRUNCATE_TO);\n\n      this.shares.clear();\n      this.tokenIndex.clear();\n      for (const r of records) {\n        this.shares.set(r.id, r);\n        this.tokenIndex.set(r.token, r.id);\n      }\n    }\n\n    const data: ShareStoreData = { version: 1, shares: records };\n    writeFileSync(path, `${JSON.stringify(data, null, 2)}\\n`, 'utf8');\n  }\n\n  private scheduleDebouncedPersist(): void {\n    this.dirty = true;\n    if (this.debounceTimer) return;\n    this.debounceTimer = setTimeout(() => {\n      this.debounceTimer = null;\n      if (this.dirty) {\n        this.dirty = false;\n        this.persistSync();\n      }\n    }, COUNTER_DEBOUNCE_MS);\n    this.debounceTimer.unref?.();\n  }\n\n  // ── Cleanup ─────────────────────────────────────────────────────────────────\n\n  private startCleanupTimer(): void {\n    this.cleanupTimer = setInterval(() => {\n      this.cleanupExpired();\n    }, CLEANUP_INTERVAL_MS);\n    this.cleanupTimer.unref?.();\n  }\n\n  private cleanupExpired(): void {\n    const now = Date.now();\n    let removed = 0;\n    for (const [id, record] of this.shares) {\n      const expiredMs = now - new Date(record.expiresAt).getTime();\n      if (expiredMs > EXPIRED_RETENTION_MS) {\n        this.shares.delete(id);\n        this.tokenIndex.delete(record.token);\n        this.invalidateListingCache(id);\n        if (this.onCleanup) {\n          try {\n            this.onCleanup(record);\n          } catch (err) {\n            log.warn({ err, shareId: id }, 'Share cleanup hook threw');\n          }\n        }\n        removed++;\n      }\n    }\n    if (removed > 0) {\n      this.persistSync();\n      log.debug({ removed }, `Cleaned ${removed} expired shares`);\n    }\n  }\n\n  shutdown(): void {\n    if (this.cleanupTimer) {\n      clearInterval(this.cleanupTimer);\n      this.cleanupTimer = null;\n    }\n    if (this.debounceTimer) {\n      clearTimeout(this.debounceTimer);\n      this.debounceTimer = null;\n    }\n    if (this.dirty) {\n      this.dirty = false;\n      this.persistSync();\n    }\n    this.listingCache.clear();\n  }\n\n  // ── Helpers ─────────────────────────────────────────────────────────────────\n\n  private async resolveAndValidatePath(relPath: string, workspaceRoot: string): Promise<string> {\n    const trimmed = relPath.trim().replace(/\\\\/g, '/').replace(/^\\/+/, '');\n    if (!trimmed) throw new Error('Empty path');\n    if (trimmed.includes('..')) throw new Error('Path traversal not allowed');\n    if (trimmed.includes('\\0')) throw new Error('Invalid path');\n\n    const abs = resolvePath(workspaceRoot, trimmed);\n    const root = resolvePath(workspaceRoot);\n    const relToRoot = relPathPosix(root, abs);\n    if (relToRoot.startsWith('..') || relToRoot.split(/[/\\\\]/).includes('..')) {\n      throw new Error('Path is outside workspace');\n    }\n    return abs;\n  }\n}\n\n// ── Directory scan helpers ────────────────────────────────────────────────────\n\nasync function scanDirectory(\n  root: string,\n  opts: {\n    workspaceRoot: string;\n    followSymlinks: boolean;\n    maxDepth: number;\n    maxFileCount: number;\n    maxFolderSize: number;\n  },\n): Promise<DirectoryScanSummary> {\n  let entryCount = 0;\n  let totalSize = 0;\n\n  async function walk(dir: string, depth: number): Promise<void> {\n    if (depth > opts.maxDepth) return;\n    const dirents = await readdir(dir, { withFileTypes: true });\n    for (const dirent of dirents) {\n      if (entryCount >= opts.maxFileCount) {\n        throw new Error(`Folder exceeds maxFileCount (${opts.maxFileCount})`);\n      }\n      const childAbs = resolvePath(dir, dirent.name);\n      const childLstat = await lstat(childAbs);\n      let effectiveStat = childLstat;\n      if (childLstat.isSymbolicLink()) {\n        if (!opts.followSymlinks) continue;\n        const real = await realpath(childAbs);\n        if (!isPathUnderWorkspace(opts.workspaceRoot, real)) {\n          throw new Error('Symlink target escapes workspace');\n        }\n        effectiveStat = await stat(childAbs);\n      }\n      if (effectiveStat.isFile()) {\n        entryCount++;\n        totalSize += effectiveStat.size;\n        if (totalSize > opts.maxFolderSize) {\n          const maxMb = (opts.maxFolderSize / 1_048_576).toFixed(0);\n          throw new Error(`Folder exceeds maxFolderSize (${maxMb} MB)`);\n        }\n      } else if (effectiveStat.isDirectory()) {\n        entryCount++;\n        await walk(childAbs, depth + 1);\n      }\n    }\n  }\n\n  await walk(root, 0);\n  return { entryCount, totalSize };\n}\n\n// ── MIME resolution ─────────────────────────────────────────────────────────\n\nconst MIME_BY_EXT: Record<string, string> = {\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  gif: 'image/gif',\n  webp: 'image/webp',\n  svg: 'image/svg+xml',\n  bmp: 'image/bmp',\n  pdf: 'application/pdf',\n  txt: 'text/plain',\n  md: 'text/markdown',\n  json: 'application/json',\n  html: 'text/html',\n  css: 'text/css',\n  js: 'text/javascript',\n  mjs: 'text/javascript',\n  ts: 'text/typescript',\n  xml: 'application/xml',\n  csv: 'text/csv',\n  zip: 'application/zip',\n  gz: 'application/gzip',\n  tar: 'application/x-tar',\n  mp3: 'audio/mpeg',\n  wav: 'audio/wav',\n  ogg: 'audio/ogg',\n  mp4: 'video/mp4',\n  webm: 'video/webm',\n  mov: 'video/quicktime',\n  wasm: 'application/wasm',\n  woff: 'font/woff',\n  woff2: 'font/woff2',\n  ttf: 'font/ttf',\n  otf: 'font/otf',\n  ico: 'image/x-icon',\n  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',\n  xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',\n  pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',\n};\n\nexport function resolveMimeType(fileName: string): string {\n  const ext = fileName.split('.').pop()?.toLowerCase() ?? '';\n  return MIME_BY_EXT[ext] || 'application/octet-stream';\n}\n\n/** HTTP Content-Type with charset for text-like bodies (browser inline preview). */\nexport function shareResponseContentType(mime: string): string {\n  if (/;\\s*charset=/i.test(mime)) return mime;\n  if (\n    mime.startsWith('text/') ||\n    mime === 'application/json' ||\n    mime === 'application/javascript' ||\n    mime === 'application/xml' ||\n    mime === 'image/svg+xml'\n  ) {\n    return `${mime}; charset=utf-8`;\n  }\n  return mime;\n}\n\n// ── Singleton ─────────────────────────────────────────────────────────────────\n\nlet singleton: ShareStore | null = null;\n\nexport function getShareStore(config?: Partial<ShareConfig>): ShareStore {\n  if (!singleton) singleton = new ShareStore(config);\n  return singleton;\n}\n\nexport function resetShareStoreForTests(): void {\n  singleton?.shutdown();\n  singleton = null;\n}\n"],"mappings":";;;;;;;;;;;;YAKqD;aAEH;AAWlD,MAAM,MAAM,aAAa,aAAa;AAEtC,MAAM,cAAc;AACpB,MAAM,sBAAsB,KAAK;AACjC,MAAM,uBAAuB,OAAU;AACvC,MAAM,qBAAqB;AAC3B,MAAM,cAAc;AACpB,MAAM,sBAAsB;AAE5B,SAAS,oBAA4B;AACnC,QAAO,KAAK,iBAAiB,EAAE,YAAY;;AAyB7C,IAAa,aAAb,MAAwB;CACtB,yBAAiB,IAAI,KAA0B;CAC/C,6BAAqB,IAAI,KAAqB;CAC9C,QAAgB;CAChB,gBAA8D;CAC9D,eAA8D;CAC9D;CACA,+BAAuB,IAAI,KAA+D;;CAE1F,YAA4D;CAE5D,YAAY,QAA+B;AACzC,OAAK,SAAS;GAAE,GAAG;GAAuB,GAAG;GAAQ;AACrD,OAAK,MAAM;AACX,OAAK,mBAAmB;;CAG1B,aAAa,QAAoC;AAC/C,OAAK,SAAS;GAAE,GAAG,KAAK;GAAQ,GAAG;GAAQ;;;CAI7C,eAAe,MAA2C;AACxD,OAAK,YAAY;;CAGnB,YAAyB;AACvB,SAAO,EAAE,GAAG,KAAK,QAAQ;;CAK3B,MAAM,OACJ,QAIsB;AACtB,MAAI,CAAC,KAAK,OAAO,QACf,OAAM,IAAI,MAAM,2BAA2B;AAI7C,MADoB,KAAK,iBAAiB,CAAC,UACxB,KAAK,OAAO,gBAC7B,OAAM,IAAI,MAAM,kCAAkC,KAAK,OAAO,gBAAgB,GAAG;EAGnF,MAAM,EAAE,MAAM,SAAS,eAAe,qBAAqB;EAC3D,MAAM,QAAQ,OAAO,SAAS,KAAK,OAAO;AAE1C,MAAI,QAAQ,OAAU,QAAQ,KAAK,OAAO,SACxC,OAAM,IAAI,MAAM,+BAA+B,KAAK,OAAO,WAAW,IAAK,GAAG;AAEhF,MAAI,OAAO,aAAa,KAAA,KAAa,OAAO,aAAa;OACnD,OAAO,WAAW,KAAK,OAAO,WAAW,IAC3C,OAAM,IAAI,MAAM,sCAAsC;;EAI1D,MAAM,eAAe,MAAM,KAAK,uBAAuB,SAAS,cAAc;EAC9E,MAAM,WAAW,MAAM,KAAK,aAAa;EAEzC,MAAM,eAA0B,SAAS,aAAa,GAAG,cAAc;EACvE,MAAM,gBAAgB,OAAO,QAAQ;AACrC,MAAI,kBAAkB,aACpB,OAAM,IAAI,MACR,yBAAyB,cAAc,oCAAoC,aAAa,IACzF;AAGH,MAAI,kBAAkB,OACpB,QAAO,KAAK,gBAAgB;GAC1B;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;AAGJ,SAAO,KAAK,qBAAqB;GAC/B;GACA;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;;CAGJ,MAAc,gBAAgB,MAQL;EACvB,MAAM,EAAE,QAAQ,cAAc,UAAU,SAAS,eAAe,OAAO,qBAAqB;AAE5F,MAAI,CAAC,SAAS,QAAQ,CACpB,OAAM,IAAI,MAAM,6BAA6B;AAE/C,MAAI,SAAS,OAAO,KAAK,OAAO,aAAa;GAC3C,MAAM,SAAS,KAAK,OAAO,cAAc,SAAW,QAAQ,EAAE;AAC9D,SAAM,IAAI,MAAM,8BAA8B,MAAM,MAAM;;AAI5D,OAAI,MADmB,MAAM,aAAa,EAC7B,gBAAgB;OAEvB,CAAC,qBAAqB,eAAe,MADtB,SAAS,aAAa,CACK,CAC5C,OAAM,IAAI,MAAM,sCAAsC;;EAI1D,MAAM,WAAW,QAAQ,MAAM,IAAI,CAAC,KAAK,IAAI;EAC7C,MAAM,WAAW,gBAAgB,SAAS;EAC1C,MAAM,SAAS,KAAK,YAAY;GAC9B,MAAM;GACN;GACA;GACA,uBAAuB;GACvB,OAAO,SAAS;GAChB;GACA,UAAU,SAAS;GACnB;GACA;GACA,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB;GACD,CAAC;AAEF,OAAK,gBAAgB,QAAQ,gBAAgB,kBAAkB,OAAO,YAAY;GAChF,UAAU,OAAO;GACjB,UAAU,OAAO;GACjB;GACD,CAAC;AAEF,SAAO;;CAGT,MAAc,qBAAqB,MAQV;EACvB,MAAM,EAAE,QAAQ,cAAc,UAAU,SAAS,eAAe,OAAO,qBAAqB;EAC5F,MAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,CAAC,OAAO,QACV,OAAM,IAAI,MAAM,gCAAgC;EAGlD,MAAM,iBAAiB,OAAO,kBAAkB;EAChD,MAAM,WAAW,OAAO,YAAY,OAAO;EAO3C,MAAM,UAAU,MAAM,cAAc,cAAc;GAChD;GACA;GACA;GACA,cAVmB,KAAK,IAAI,OAAO,gBAAgB,OAAO,cAAc,OAAO,aAUnE;GACZ,eAVoB,KAAK,IACzB,OAAO,iBAAiB,OAAO,eAC/B,OAAO,cAQM;GACd,CAAC;EAEF,MAAM,WAAW,QAAQ,MAAM,IAAI,CAAC,KAAK,IAAI,WAAW;EACxD,MAAM,SAAS,KAAK,YAAY;GAC9B,MAAM;GACN;GACA;GACA,uBAAuB;GACvB,OAAO,SAAS;GAChB;GACA,UAAU,QAAQ;GAClB,UAAU;GACV;GACA,UAAU,OAAO;GACjB,aAAa,OAAO;GACpB;GACA,WAAW;IACT,MAAM,OAAO,iBAAiB;IAC9B,YAAY,QAAQ;IACpB;IACA;IACD;GACF,CAAC;AAEF,OAAK,gBAAgB,QAAQ,gBAAgB,yBAAyB,OAAO,YAAY;GACvF,UAAU,OAAO;GACjB,YAAY,QAAQ;GACpB,WAAW,QAAQ;GACnB;GACA,MAAM,OAAO,WAAW;GACzB,CAAC;AAEF,SAAO;;CAGT,YAAoB,OAcJ;EACd,MAAM,KAAK,YAAY;EACvB,MAAM,QAAQ,YAAY,GAAG,CAAC,SAAS,YAAY;EACnD,MAAM,sBAAM,IAAI,MAAM;EACtB,MAAM,SAAsB;GAC1B;GACA;GACA,cAAc,MAAM;GACpB,uBAAuB,MAAM;GAC7B,eAAe,MAAM;GACrB,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,UAAU,MAAM;GAChB,UAAU,MAAM;GAChB,UAAU,MAAM;GAChB,WAAW,IAAI,aAAa;GAC5B,WAAW,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,MAAM,CAAC,aAAa;GAC9D,UAAU,MAAM,YAAY;GAC5B,eAAe;GACf,SAAS;GACT,oBAAoB,MAAM;GAC1B,aAAa,MAAM;GACnB,WAAW,MAAM;GAClB;AAED,OAAK,OAAO,IAAI,IAAI,OAAO;AAC3B,OAAK,WAAW,IAAI,OAAO,GAAG;AAC9B,SAAO;;CAGT,gBACE,QACA,OACA,SACA,OACM;AACN,OAAK,aAAa;AAClB,gBAAc,OAAO;GAAE,SAAS,OAAO;GAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;GAAE,GAAG;GAAO,EAAE,QAAQ;;CAGxG,QAAQ,IAAgC;AACtC,SAAO,KAAK,OAAO,IAAI,GAAG,IAAI;;CAGhC,WAAW,OAAmC;EAC5C,MAAM,KAAK,KAAK,WAAW,IAAI,MAAM;AACrC,MAAI,CAAC,GAAI,QAAO;AAChB,SAAO,KAAK,OAAO,IAAI,GAAG,IAAI;;;CAIhC,eAAe,QAA0D;AACvE,MAAI,OAAO,QAAS,QAAO;GAAE,OAAO;GAAO,QAAQ;GAAW;AAC9D,MAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,CAAE,QAAO;GAAE,OAAO;GAAO,QAAQ;GAAW;AAClG,MAAI,OAAO,aAAa,QAAQ,OAAO,iBAAiB,OAAO,SAC7D,QAAO;GAAE,OAAO;GAAO,QAAQ;GAAa;AAE9C,SAAO,EAAE,OAAO,MAAM;;;CAIxB,uBAAuB,IAAkB;EACvC,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ;AACb,SAAO;AACP,OAAK,0BAA0B;;;CAIjC,MAAM,sBAAsB,QAAmE;AAC7F,MAAI;GACF,MAAM,WAAW,MAAM,SAAS,OAAO,aAAa;AACpD,OAAI,CAAC,qBAAqB,OAAO,eAAe,SAAS,CACvD,QAAO;IAAE,OAAO;IAAO,QAAQ;IAAgB;GAEjD,MAAM,WAAW,MAAM,KAAK,OAAO,aAAa;AAChD,OAAI,SAAS,QAAQ,OAAO,OAAO;AACjC,kBACE,sBACA;KACE,SAAS,OAAO;KAChB,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;KACrC,UAAU,OAAO;KACjB,UAAU,SAAS;KACpB,EACD,wCAAwC,OAAO,WAChD;AACD,WAAO;KAAE,OAAO;KAAO,QAAQ;KAAgB;;AAEjD,UAAO,EAAE,OAAO,MAAM;UAChB;AACN,UAAO;IAAE,OAAO;IAAO,QAAQ;IAAgB;;;;;;;CAQnD,MAAM,sBACJ,QACA,cAC6E;AAC7E,MAAI,OAAO,SAAS,YAClB,QAAO;GAAE,IAAI;GAAO,QAAQ;GAAiB;EAE/C,MAAM,WAAW,gBAAgB,IAAI,QAAQ,QAAQ,GAAG,CAAC,QAAQ,OAAO,IAAI;AAC5E,MAAI,QAAQ,SAAS,KAAK,IAAI,QAAQ,SAAS,KAAK,CAClD,QAAO;GAAE,IAAI;GAAO,QAAQ;GAAkB;EAEhD,MAAM,MAAMA,QAAY,OAAO,cAAc,QAAQ;EACrD,MAAM,aAAaC,SAAa,OAAO,cAAc,IAAI;AACzD,MAAI,WAAW,WAAW,KAAK,IAAI,WAAW,MAAM,QAAQ,CAAC,SAAS,KAAK,CACzE,QAAO;GAAE,IAAI;GAAO,QAAQ;GAAsB;AAEpD,MAAI;GACF,MAAM,OAAO,MAAM,SAAS,IAAI;AAChC,OAAI,CAAC,qBAAqB,OAAO,eAAe,KAAK,CACnD,QAAO;IAAE,IAAI;IAAO,QAAQ;IAA0B;GAExD,MAAM,iBAAiBA,SAAa,OAAO,cAAc,KAAK;AAC9D,OAAI,eAAe,WAAW,KAAK,IAAI,eAAe,MAAM,QAAQ,CAAC,SAAS,KAAK,CACjF,QAAO;IAAE,IAAI;IAAO,QAAQ;IAAsB;AAEpD,UAAO;IAAE,IAAI;IAAM,cAAc;IAAM;UACjC;AACN,UAAO;IAAE,IAAI;IAAO,QAAQ;IAAa;;;;CAK7C,MAAM,cAAc,QAAqB,cAAiD;AACxF,MAAI,OAAO,SAAS,YAAa,OAAM,IAAI,MAAM,wBAAwB;EACzE,MAAM,WAAW,gBAAgB,IAAI,QAAQ,QAAQ,GAAG;EACxD,MAAM,WAAW,GAAG,OAAO,GAAG,IAAI;EAClC,MAAM,WAAW,KAAK,OAAO,UAAU;EACvC,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,SAAS,KAAK,aAAa,IAAI,SAAS;AAC9C,MAAI,UAAU,OAAO,YAAY,IAAK,QAAO,OAAO;EAEpD,MAAM,WAAW,MAAM,KAAK,sBAAsB,QAAQ,QAAQ;AAClE,MAAI,SAAS,OAAO,KAAM,OAAM,IAAI,MAAM,SAAS,OAAO;EAE1D,MAAM,SAAS,SAAS;AAExB,MAAI,EAAC,MADe,KAAK,OAAO,EACrB,aAAa,CAAE,OAAM,IAAI,MAAM,gBAAgB;EAE1D,MAAM,iBAAiB,OAAO,WAAW,kBAAkB;EAC3D,MAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,eAAe,MAAM,CAAC;EAC9D,MAAM,UAAmC,EAAE;EAC3C,IAAI,YAAY;EAChB,MAAM,QAAQ;AAEd,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,QAAQ,UAAU,OAAO;AAC3B,gBAAY;AACZ;;GAEF,MAAM,WAAWD,QAAY,QAAQ,OAAO,KAAK;AACjD,OAAI;IACF,MAAM,aAAa,MAAM,MAAM,SAAS;AACxC,QAAI,WAAW,gBAAgB,EAAE;AAC/B,SAAI,CAAC,eAAgB;KACrB,MAAM,OAAO,MAAM,SAAS,SAAS;AACrC,SAAI,CAAC,qBAAqB,OAAO,eAAe,KAAK,CAAE;AAEvD,SADmBC,SAAa,OAAO,cAAc,KACvC,CAAC,WAAW,KAAK,CAAE;;IAEnC,MAAM,YAAY,WAAW,gBAAgB,GAAG,MAAM,KAAK,SAAS,GAAG;IACvE,MAAM,WAAW,UAAU,GAAG,QAAQ,GAAG,OAAO,SAAS,OAAO;AAChE,YAAQ,KAAK;KACX,MAAM,OAAO;KACb,MAAM;KACN,aAAa,UAAU,aAAa;KACpC,MAAM,UAAU,QAAQ,GAAG,UAAU,OAAO;KAC5C,OAAO,UAAU,MAAM,aAAa;KACpC,UAAU,UAAU,aAAa,GAAG,4BAA4B,gBAAgB,OAAO,KAAK;KAC7F,CAAC;WACI;;AAKV,UAAQ,MAAM,GAAG,MAAM;AACrB,OAAI,EAAE,gBAAgB,EAAE,YAAa,QAAO,EAAE,cAAc,KAAK;AACjE,UAAO,EAAE,KAAK,cAAc,EAAE,KAAK;IACnC;EAEF,MAAM,UAA4B;GAAE,MAAM;GAAS;GAAS;GAAW;AACvE,MAAI,WAAW,EACb,MAAK,aAAa,IAAI,UAAU;GAAE;GAAS,WAAW,MAAM;GAAU,CAAC;AAEzE,SAAO;;;CAIT,mBAAmB,IAAY,QAA8C;EAC3E,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ;AACb,SAAO,kBAAkB;AACzB,MAAI,WAAW,QAAS,QAAO,wCAAuB,IAAI,MAAM,EAAC,aAAa;AAC9E,MAAI,WAAW,SAAU,QAAO,qCAAoB,IAAI,MAAM,EAAC,aAAa;AAC5E,OAAK,aAAa;;;CAIpB,uBAAuB,SAAuB;AAC5C,OAAK,MAAM,OAAO,KAAK,aAAa,MAAM,CACxC,KAAI,IAAI,WAAW,GAAG,QAAQ,IAAI,CAAE,MAAK,aAAa,OAAO,IAAI;;CAIrE,OAAO,IAAqB;EAC1B,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,UAAU;AACjB,OAAK,uBAAuB,GAAG;AAC/B,OAAK,aAAa;AAClB,gBACE,gBACA;GAAE,SAAS;GAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;GAAE,UAAU,OAAO;GAAU,EACjF,kBAAkB,OAAO,WAC1B;AACD,SAAO;;CAGT,WAAW,KAAuB;EAChC,IAAI,QAAQ;AACZ,OAAK,MAAM,MAAM,KAAK;GACpB,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,OAAI,UAAU,CAAC,OAAO,SAAS;AAC7B,WAAO,UAAU;AACjB,SAAK,uBAAuB,GAAG;AAC/B;AACA,kBACE,gBACA;KAAE,SAAS;KAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;KAAE,UAAU,OAAO;KAAU,EACjF,0BAA0B,OAAO,WAClC;;;AAGL,MAAI,QAAQ,EAAG,MAAK,aAAa;AACjC,SAAO;;CAGT,gBAAwB;EACtB,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,QAAQ;AACZ,OAAK,MAAM,UAAU,KAAK,OAAO,QAAQ,CACvC,KAAI,CAAC,OAAO,WAAW,OAAO,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,EAAE;AAClE,UAAO,UAAU;AACjB,QAAK,uBAAuB,OAAO,GAAG;AACtC;;AAGJ,MAAI,QAAQ,EAAG,MAAK,aAAa;AACjC,SAAO;;CAGT,OAAO,IAAY,OAA+E;EAChG,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG;AAClC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI,MAAM,gBAAgB,KAAA,EAExB,QAAO,YAAY,IADG,KAAK,KAAK,KAAK,GAAG,MAAM,YAClB,CAAC,aAAa;AAE5C,MAAI,MAAM,aAAa,KAAA,EACrB,QAAO,WAAW,MAAM;AAG1B,OAAK,aAAa;AAClB,gBACE,gBACA;GAAE,SAAS;GAAI,aAAa,OAAO,MAAM,MAAM,GAAG,EAAE;GAAE;GAAO,EAC7D,kBAAkB,OAAO,WAC1B;AACD,SAAO;;CAGT,kBAAiC;EAC/B,MAAM,MAAM,KAAK,KAAK;AACtB,SAAO,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC,CAAC,QAC9B,MAAM,CAAC,EAAE,WAAW,MAAM,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAC3D;;CAGH,eAA8B;AAC5B,SAAO,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC,CAAC,MAC9B,GAAG,MAAM,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAC5E;;CAKH,OAAqB;EACnB,MAAM,OAAO,mBAAmB;AAChC,MAAI,CAAC,WAAW,KAAK,CAAE;AACvB,MAAI;GACF,MAAM,MAAM,aAAa,MAAM,OAAO;GACtC,MAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,OAAI,KAAK,YAAY,KAAK,CAAC,MAAM,QAAQ,KAAK,OAAO,CAAE;GAEvD,MAAM,MAAM,KAAK,KAAK;GACtB,IAAI,UAAU;AACd,QAAK,MAAM,UAAU,KAAK,QAAQ;AAEhC,QADkB,MAAM,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,GAC5C,sBAAsB;AACpC;AACA;;AAEF,SAAK,OAAO,IAAI,OAAO,IAAI,OAAO;AAClC,SAAK,WAAW,IAAI,OAAO,OAAO,OAAO,GAAG;;AAE9C,OAAI,UAAU,GAAG;AACf,QAAI,KAAK,EAAE,SAAS,EAAE,WAAW,QAAQ,gCAAgC;AACzE,SAAK,aAAa;;WAEb,KAAK;AACZ,OAAI,KAAK,EAAE,KAAK,EAAE,6BAA6B;;;CAInD,cAA4B;EAC1B,MAAM,OAAO,mBAAmB;AAChC,YAAU,iBAAiB,EAAE,EAAE,WAAW,MAAM,CAAC;EAEjD,IAAI,UAAU,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC;AACvC,MAAI,QAAQ,SAAS,oBAAoB;AACvC,WAAQ,MAAM,GAAG,MAAM,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC;AAEzF,aADe,QAAQ,QAAQ,MAAM,CAAC,EAAE,WAAW,KAAK,KAAK,GAAG,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAC/E,CAAC,MAAM,GAAG,YAAY;AAEtC,QAAK,OAAO,OAAO;AACnB,QAAK,WAAW,OAAO;AACvB,QAAK,MAAM,KAAK,SAAS;AACvB,SAAK,OAAO,IAAI,EAAE,IAAI,EAAE;AACxB,SAAK,WAAW,IAAI,EAAE,OAAO,EAAE,GAAG;;;AAKtC,gBAAc,MAAM,GAAG,KAAK,UAAU;GADP,SAAS;GAAG,QAAQ;GACT,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO;;CAGnE,2BAAyC;AACvC,OAAK,QAAQ;AACb,MAAI,KAAK,cAAe;AACxB,OAAK,gBAAgB,iBAAiB;AACpC,QAAK,gBAAgB;AACrB,OAAI,KAAK,OAAO;AACd,SAAK,QAAQ;AACb,SAAK,aAAa;;KAEnB,oBAAoB;AACvB,OAAK,cAAc,SAAS;;CAK9B,oBAAkC;AAChC,OAAK,eAAe,kBAAkB;AACpC,QAAK,gBAAgB;KACpB,oBAAoB;AACvB,OAAK,aAAa,SAAS;;CAG7B,iBAA+B;EAC7B,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,UAAU;AACd,OAAK,MAAM,CAAC,IAAI,WAAW,KAAK,OAE9B,KADkB,MAAM,IAAI,KAAK,OAAO,UAAU,CAAC,SAAS,GAC5C,sBAAsB;AACpC,QAAK,OAAO,OAAO,GAAG;AACtB,QAAK,WAAW,OAAO,OAAO,MAAM;AACpC,QAAK,uBAAuB,GAAG;AAC/B,OAAI,KAAK,UACP,KAAI;AACF,SAAK,UAAU,OAAO;YACf,KAAK;AACZ,QAAI,KAAK;KAAE;KAAK,SAAS;KAAI,EAAE,2BAA2B;;AAG9D;;AAGJ,MAAI,UAAU,GAAG;AACf,QAAK,aAAa;AAClB,OAAI,MAAM,EAAE,SAAS,EAAE,WAAW,QAAQ,iBAAiB;;;CAI/D,WAAiB;AACf,MAAI,KAAK,cAAc;AACrB,iBAAc,KAAK,aAAa;AAChC,QAAK,eAAe;;AAEtB,MAAI,KAAK,eAAe;AACtB,gBAAa,KAAK,cAAc;AAChC,QAAK,gBAAgB;;AAEvB,MAAI,KAAK,OAAO;AACd,QAAK,QAAQ;AACb,QAAK,aAAa;;AAEpB,OAAK,aAAa,OAAO;;CAK3B,MAAc,uBAAuB,SAAiB,eAAwC;EAC5F,MAAM,UAAU,QAAQ,MAAM,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,QAAQ,GAAG;AACtE,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,aAAa;AAC3C,MAAI,QAAQ,SAAS,KAAK,CAAE,OAAM,IAAI,MAAM,6BAA6B;AACzE,MAAI,QAAQ,SAAS,KAAK,CAAE,OAAM,IAAI,MAAM,eAAe;EAE3D,MAAM,MAAMD,QAAY,eAAe,QAAQ;EAE/C,MAAM,YAAYC,SADLD,QAAY,cACU,EAAE,IAAI;AACzC,MAAI,UAAU,WAAW,KAAK,IAAI,UAAU,MAAM,QAAQ,CAAC,SAAS,KAAK,CACvE,OAAM,IAAI,MAAM,4BAA4B;AAE9C,SAAO;;;AAMX,eAAe,cACb,MACA,MAO+B;CAC/B,IAAI,aAAa;CACjB,IAAI,YAAY;CAEhB,eAAe,KAAK,KAAa,OAA8B;AAC7D,MAAI,QAAQ,KAAK,SAAU;EAC3B,MAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,MAAM,CAAC;AAC3D,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,cAAc,KAAK,aACrB,OAAM,IAAI,MAAM,gCAAgC,KAAK,aAAa,GAAG;GAEvE,MAAM,WAAWA,QAAY,KAAK,OAAO,KAAK;GAC9C,MAAM,aAAa,MAAM,MAAM,SAAS;GACxC,IAAI,gBAAgB;AACpB,OAAI,WAAW,gBAAgB,EAAE;AAC/B,QAAI,CAAC,KAAK,eAAgB;IAC1B,MAAM,OAAO,MAAM,SAAS,SAAS;AACrC,QAAI,CAAC,qBAAqB,KAAK,eAAe,KAAK,CACjD,OAAM,IAAI,MAAM,mCAAmC;AAErD,oBAAgB,MAAM,KAAK,SAAS;;AAEtC,OAAI,cAAc,QAAQ,EAAE;AAC1B;AACA,iBAAa,cAAc;AAC3B,QAAI,YAAY,KAAK,eAAe;KAClC,MAAM,SAAS,KAAK,gBAAgB,SAAW,QAAQ,EAAE;AACzD,WAAM,IAAI,MAAM,iCAAiC,MAAM,MAAM;;cAEtD,cAAc,aAAa,EAAE;AACtC;AACA,UAAM,KAAK,UAAU,QAAQ,EAAE;;;;AAKrC,OAAM,KAAK,MAAM,EAAE;AACnB,QAAO;EAAE;EAAY;EAAW;;AAKlC,MAAM,cAAsC;CAC1C,KAAK;CACL,KAAK;CACL,MAAM;CACN,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,IAAI;CACJ,MAAM;CACN,MAAM;CACN,KAAK;CACL,IAAI;CACJ,KAAK;CACL,IAAI;CACJ,KAAK;CACL,KAAK;CACL,KAAK;CACL,IAAI;CACJ,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAM;CACN,KAAK;CACL,MAAM;CACN,MAAM;CACN,OAAO;CACP,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAM;CACN,MAAM;CACN,MAAM;CACP;AAED,SAAgB,gBAAgB,UAA0B;AAExD,QAAO,YADK,SAAS,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OAC7B;;;AAI7B,SAAgB,yBAAyB,MAAsB;AAC7D,KAAI,gBAAgB,KAAK,KAAK,CAAE,QAAO;AACvC,KACE,KAAK,WAAW,QAAQ,IACxB,SAAS,sBACT,SAAS,4BACT,SAAS,qBACT,SAAS,gBAET,QAAO,GAAG,KAAK;AAEjB,QAAO;;AAKT,IAAI,YAA+B;AAEnC,SAAgB,cAAc,QAA2C;AACvE,KAAI,CAAC,UAAW,aAAY,IAAI,WAAW,OAAO;AAClD,QAAO;;AAGT,SAAgB,0BAAgC;AAC9C,YAAW,UAAU;AACrB,aAAY"}

package/dist/src/share/share-thumbnail.d.ts

@@ -0,0 +1,35 @@
+import type { ShareThumbnailConfig } from './share-types.js';
+type ThumbnailScope = 'file' | 'site';
+interface ThumbnailTaskInput {
+    scope: ThumbnailScope;
+    token: string;
+    /** Stored record id (used to update status). */
+    recordId: string;
+}
+interface ThumbnailRenderContext {
+    config: ShareThumbnailConfig;
+    /** Loopback gateway base URL (e.g. http://127.0.0.1:18790) used by the renderer. */
+    internalBaseUrl: string;
+}
+export declare function getThumbnailPath(token: string): string;
+export declare function thumbnailExists(token: string): Promise<boolean>;
+export declare function readThumbnail(token: string): Promise<Buffer | null>;
+/** Delete the cached thumbnail (called from share-store cleanup hook). */
+export declare function deleteThumbnail(token: string): Promise<void>;
+/**
+ * Schedule generation. Returns the current effective status without waiting.
+ * If a recent failure is within cooldown, returns 'failed' and skips work.
+ */
+export declare function scheduleThumbnail(task: ThumbnailTaskInput, ctx: ThumbnailRenderContext): 'pending' | 'ready' | 'failed' | 'disabled';
+export declare function shutdownThumbnailBrowser(): Promise<void>;
+type PlaceholderKind = 'file' | 'folder' | 'html' | 'image' | 'video' | 'audio' | 'pdf' | 'archive' | 'text' | 'doc' | 'sheet' | 'slides';
+/** Generate a static placeholder card as an SVG-then-jpeg surrogate. Since we
+ * have no native SVG-to-raster encoder available without extra deps, we emit a
+ * tiny inline-SVG that browsers render directly. Callers store .jpg but the
+ * route content-type is set to the actual returned mime. */
+export declare function placeholderSvg(fileName: string, kind: PlaceholderKind): Buffer;
+/** Determine if the cached file is a real jpeg or a placeholder SVG by sniffing. */
+export declare function thumbnailContentType(bytes: Buffer): string;
+/** Helper for tests + cleanup. */
+export declare function resetThumbnailStateForTests(): void;
+export {};

package/dist/src/share/share-thumbnail.js

@@ -0,0 +1,277 @@
+import { resolveStateDir } from "../config/paths-state.js";
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
+import { init_paths } from "../config/paths.js";
+import { getShareStore } from "./share-store.js";
+import { getSiteShareStore } from "./site-share-store.js";
+import { loadPlaywrightCoreModule } from "../browser/providers/playwright-doctor.js";
+import { join } from "node:path";
+import { mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
+//#region src/share/share-thumbnail.ts
+/**
+* Thumbnail generator for shares.
+*
+* Responsibilities:
+*  - Render a 1200x630 jpeg preview for shareable artefacts.
+*  - HTML / sites: launch its own Playwright browser (does NOT share the user
+*    BrowserManager — the user-facing browser is for the agent and we mustn't
+*    pollute its context).
+*  - Images: pass through with size cap; downscale only if oversized.
+*  - Anything else: emit an SVG placeholder card with the file name + icon.
+*  - On-disk cache keyed by token, in `<stateDir>/share-thumbnails/`.
+*  - Process-wide concurrency cap; failure cooldown.
+*/
+init_paths();
+init_logger();
+const log = createLogger("share-thumbnail");
+const THUMBNAIL_DIR = "share-thumbnails";
+let queue = [];
+let inflight = 0;
+const lastFailureAt = /* @__PURE__ */ new Map();
+let browserPromise = null;
+function getThumbnailPath(token) {
+	return join(resolveStateDir(), THUMBNAIL_DIR, `${safeToken(token)}.jpg`);
+}
+async function thumbnailExists(token) {
+	try {
+		const st = await stat(getThumbnailPath(token));
+		return st.isFile() && st.size > 0;
+	} catch {
+		return false;
+	}
+}
+async function readThumbnail(token) {
+	try {
+		return await readFile(getThumbnailPath(token));
+	} catch {
+		return null;
+	}
+}
+/** Delete the cached thumbnail (called from share-store cleanup hook). */
+async function deleteThumbnail(token) {
+	try {
+		await unlink(getThumbnailPath(token));
+	} catch {}
+}
+/**
+* Schedule generation. Returns the current effective status without waiting.
+* If a recent failure is within cooldown, returns 'failed' and skips work.
+*/
+function scheduleThumbnail(task, ctx) {
+	if (!ctx.config.enabled) return "disabled";
+	const failedAt = lastFailureAt.get(task.token);
+	if (failedAt && Date.now() - failedAt < ctx.config.failureCooldownMs) return "failed";
+	queue.push({
+		task,
+		ctx
+	});
+	if (queue.length > 100) queue = queue.slice(-100);
+	pumpQueue();
+	return "pending";
+}
+function pumpQueue() {
+	while (queue.length > 0 && inflight < currentConcurrency()) {
+		const next = queue.shift();
+		if (!next) break;
+		inflight++;
+		runThumbnail(next.task, next.ctx).catch((err) => log.warn({
+			err,
+			token: next.task.token
+		}, "Thumbnail task threw")).finally(() => {
+			inflight--;
+			pumpQueue();
+		});
+	}
+}
+function currentConcurrency() {
+	return Math.max(1, queue[0]?.ctx.config.concurrency ?? 2);
+}
+async function runThumbnail(task, ctx) {
+	await mkdir(join(resolveStateDir(), THUMBNAIL_DIR), { recursive: true });
+	const target = task.scope === "file" ? getShareStore().getById(task.recordId) : getSiteShareStore().getById(task.recordId);
+	if (!target) return;
+	try {
+		let bytes;
+		if (task.scope === "file") bytes = await renderForFile(target, ctx);
+		else bytes = await renderForSite(target, ctx);
+		if (bytes.length > ctx.config.maxBytes) bytes = bytes.subarray(0, ctx.config.maxBytes);
+		await writeFile(getThumbnailPath(task.token), bytes);
+		if (task.scope === "file") getShareStore().setThumbnailStatus(task.recordId, "ready");
+		else getSiteShareStore().setThumbnailStatus(task.recordId, "ready");
+		lastFailureAt.delete(task.token);
+		log.debug({
+			token: task.token.slice(0, 8),
+			scope: task.scope,
+			bytes: bytes.length
+		}, "Thumbnail generated");
+	} catch (err) {
+		lastFailureAt.set(task.token, Date.now());
+		if (task.scope === "file") getShareStore().setThumbnailStatus(task.recordId, "failed");
+		else getSiteShareStore().setThumbnailStatus(task.recordId, "failed");
+		log.warn({
+			err,
+			token: task.token.slice(0, 8),
+			scope: task.scope
+		}, "Thumbnail generation failed");
+	}
+}
+async function renderForFile(record, ctx) {
+	if (record.kind === "directory") return placeholderPng(record.fileName, "folder");
+	const mime = record.mimeType;
+	if (mime === "text/html") return await renderUrlScreenshot(`${ctx.internalBaseUrl.replace(/\/+$/, "")}/s/${record.token}?inline=1`, ctx);
+	if (mime.startsWith("image/")) return await readImageWithSizeCap(record.absolutePath, ctx.config.maxBytes);
+	return placeholderPng(record.fileName, classifyByMime(mime));
+}
+async function renderForSite(record, ctx) {
+	return await renderUrlScreenshot(`${ctx.internalBaseUrl.replace(/\/+$/, "")}/site/${record.token}/`, ctx);
+}
+async function renderUrlScreenshot(url, ctx) {
+	const browser = await getOrLaunchBrowser();
+	if (!browser) throw new Error("playwright-core / chromium unavailable");
+	const context = await browser.newContext({
+		viewport: {
+			width: ctx.config.viewportWidth,
+			height: ctx.config.viewportHeight
+		},
+		deviceScaleFactor: 1,
+		javaScriptEnabled: true,
+		bypassCSP: true,
+		ignoreHTTPSErrors: true,
+		userAgent: "xopc-thumbnail/1.0 (compatible; share preview)"
+	});
+	await context.route("**/*", (route) => {
+		const reqUrl = route.request().url();
+		if (reqUrl.startsWith("data:") || reqUrl.startsWith("blob:") || reqUrl.startsWith(ctx.internalBaseUrl) || reqUrl.startsWith("http://127.0.0.1") || reqUrl.startsWith("http://localhost") || reqUrl.startsWith("http://[::1]")) {
+			route.continue();
+			return;
+		}
+		route.abort();
+	});
+	try {
+		const page = await context.newPage();
+		await page.goto(url, {
+			waitUntil: "load",
+			timeout: ctx.config.generationTimeoutMs
+		});
+		try {
+			await page.waitForLoadState("networkidle", { timeout: Math.min(ctx.config.generationTimeoutMs, 3e3) });
+		} catch {}
+		const bytes = await page.screenshot({
+			type: "jpeg",
+			quality: 80,
+			fullPage: false,
+			clip: {
+				x: 0,
+				y: 0,
+				width: ctx.config.viewportWidth,
+				height: ctx.config.viewportHeight
+			}
+		});
+		return Buffer.from(bytes);
+	} finally {
+		await context.close().catch(() => {});
+	}
+}
+async function getOrLaunchBrowser() {
+	if (!browserPromise) browserPromise = (async () => {
+		try {
+			const pw = await loadPlaywrightCoreModule();
+			const chromium = pw.chromium ?? pw.default?.chromium;
+			if (!chromium?.launch) return null;
+			return await chromium.launch({
+				headless: true,
+				args: ["--no-sandbox"]
+			});
+		} catch (err) {
+			log.warn({ err }, "Playwright launch failed for thumbnail renderer");
+			return null;
+		}
+	})();
+	return browserPromise;
+}
+async function shutdownThumbnailBrowser() {
+	if (!browserPromise) return;
+	try {
+		const b = await browserPromise;
+		if (b) await b.close();
+	} catch {}
+	browserPromise = null;
+	queue = [];
+	inflight = 0;
+	lastFailureAt.clear();
+}
+async function readImageWithSizeCap(absolutePath, cap) {
+	const buf = await readFile(absolutePath);
+	if (buf.length <= cap) return buf;
+	throw new Error(`image exceeds thumbnail size cap (${buf.length} > ${cap})`);
+}
+function classifyByMime(mime) {
+	if (mime.startsWith("image/")) return "image";
+	if (mime.startsWith("video/")) return "video";
+	if (mime.startsWith("audio/")) return "audio";
+	if (mime === "application/pdf") return "pdf";
+	if (mime === "application/zip" || mime === "application/gzip" || mime === "application/x-tar") return "archive";
+	if (mime === "text/html") return "html";
+	if (mime.startsWith("text/")) return "text";
+	if (mime.includes("spreadsheet")) return "sheet";
+	if (mime.includes("presentation")) return "slides";
+	if (mime.includes("wordprocessing")) return "doc";
+	return "file";
+}
+const ICONS = {
+	file: "📄",
+	folder: "📁",
+	html: "🌐",
+	image: "🖼",
+	video: "🎬",
+	audio: "🎵",
+	pdf: "📕",
+	archive: "🗜",
+	text: "📝",
+	doc: "📘",
+	sheet: "📊",
+	slides: "📽"
+};
+function safeToken(token) {
+	return token.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
+}
+/** Generate a static placeholder card as an SVG-then-jpeg surrogate. Since we
+* have no native SVG-to-raster encoder available without extra deps, we emit a
+* tiny inline-SVG that browsers render directly. Callers store .jpg but the
+* route content-type is set to the actual returned mime. */
+function placeholderSvg(fileName, kind) {
+	const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630">
+<defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1">
+<stop offset="0%" stop-color="#0f172a"/><stop offset="100%" stop-color="#1e293b"/></linearGradient></defs>
+<rect width="1200" height="630" fill="url(#g)"/>
+<text x="600" y="300" font-size="200" text-anchor="middle" dominant-baseline="central" font-family="apple color emoji,segoe ui emoji,noto color emoji,sans-serif">${ICONS[kind] ?? ICONS.file}</text>
+<text x="600" y="460" font-size="40" fill="#e2e8f0" text-anchor="middle" font-family="-apple-system,Segoe UI,Roboto,sans-serif" font-weight="600">${escapeXml(fileName.length > 36 ? `${fileName.slice(0, 33)}...` : fileName)}</text>
+<text x="600" y="520" font-size="24" fill="#94a3b8" text-anchor="middle" font-family="-apple-system,Segoe UI,Roboto,sans-serif">Shared via xopc</text>
+</svg>`;
+	return Buffer.from(svg, "utf8");
+}
+function placeholderPng(fileName, kind) {
+	return placeholderSvg(fileName, kind);
+}
+function escapeXml(text) {
+	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+/** Determine if the cached file is a real jpeg or a placeholder SVG by sniffing. */
+function thumbnailContentType(bytes) {
+	if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
+	if (bytes.length >= 8 && bytes[0] === 137 && bytes[1] === 80) return "image/png";
+	if (bytes.length >= 4 && bytes[0] === 71 && bytes[1] === 73) return "image/gif";
+	if (bytes.length >= 12 && bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP") return "image/webp";
+	return "image/svg+xml";
+}
+/** Helper for tests + cleanup. */
+function resetThumbnailStateForTests() {
+	queue = [];
+	inflight = 0;
+	lastFailureAt.clear();
+	browserPromise = null;
+}
+//#endregion
+export { deleteThumbnail, getThumbnailPath, placeholderSvg, readThumbnail, resetThumbnailStateForTests, scheduleThumbnail, shutdownThumbnailBrowser, thumbnailContentType, thumbnailExists };
+
+//# sourceMappingURL=share-thumbnail.js.map

package/dist/src/share/share-thumbnail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-thumbnail.js","names":[],"sources":["../../../src/share/share-thumbnail.ts"],"sourcesContent":["/**\n * Thumbnail generator for shares.\n *\n * Responsibilities:\n *  - Render a 1200x630 jpeg preview for shareable artefacts.\n *  - HTML / sites: launch its own Playwright browser (does NOT share the user\n *    BrowserManager — the user-facing browser is for the agent and we mustn't\n *    pollute its context).\n *  - Images: pass through with size cap; downscale only if oversized.\n *  - Anything else: emit an SVG placeholder card with the file name + icon.\n *  - On-disk cache keyed by token, in `<stateDir>/share-thumbnails/`.\n *  - Process-wide concurrency cap; failure cooldown.\n */\nimport { mkdir, readFile, stat, unlink, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nimport { resolveStateDir } from '../config/paths.js';\nimport { createLogger } from '../utils/logger.js';\nimport { loadPlaywrightCoreModule } from '../browser/providers/playwright-doctor.js';\nimport { getShareStore } from './share-store.js';\nimport { getSiteShareStore } from './site-share-store.js';\nimport type { ShareRecord, ShareThumbnailConfig } from './share-types.js';\nimport type { SiteShareRecord } from './site-share-types.js';\n\nconst log = createLogger('share-thumbnail');\n\nconst THUMBNAIL_DIR = 'share-thumbnails';\n\ntype ThumbnailScope = 'file' | 'site';\n\ninterface ThumbnailTaskInput {\n  scope: ThumbnailScope;\n  token: string;\n  /** Stored record id (used to update status). */\n  recordId: string;\n}\n\ninterface ThumbnailRenderContext {\n  config: ShareThumbnailConfig;\n  /** Loopback gateway base URL (e.g. http://127.0.0.1:18790) used by the renderer. */\n  internalBaseUrl: string;\n}\n\nlet queue: Array<{ task: ThumbnailTaskInput; ctx: ThumbnailRenderContext }> = [];\nlet inflight = 0;\nconst lastFailureAt = new Map<string, number>();\nlet browserPromise: Promise<import('playwright-core').Browser | null> | null = null;\n\nexport function getThumbnailPath(token: string): string {\n  return join(resolveStateDir(), THUMBNAIL_DIR, `${safeToken(token)}.jpg`);\n}\n\nexport async function thumbnailExists(token: string): Promise<boolean> {\n  try {\n    const st = await stat(getThumbnailPath(token));\n    return st.isFile() && st.size > 0;\n  } catch {\n    return false;\n  }\n}\n\nexport async function readThumbnail(token: string): Promise<Buffer | null> {\n  try {\n    return await readFile(getThumbnailPath(token));\n  } catch {\n    return null;\n  }\n}\n\n/** Delete the cached thumbnail (called from share-store cleanup hook). */\nexport async function deleteThumbnail(token: string): Promise<void> {\n  try {\n    await unlink(getThumbnailPath(token));\n  } catch {\n    /* missing file is fine */\n  }\n}\n\n/**\n * Schedule generation. Returns the current effective status without waiting.\n * If a recent failure is within cooldown, returns 'failed' and skips work.\n */\nexport function scheduleThumbnail(\n  task: ThumbnailTaskInput,\n  ctx: ThumbnailRenderContext,\n): 'pending' | 'ready' | 'failed' | 'disabled' {\n  if (!ctx.config.enabled) return 'disabled';\n  const failedAt = lastFailureAt.get(task.token);\n  if (failedAt && Date.now() - failedAt < ctx.config.failureCooldownMs) {\n    return 'failed';\n  }\n  queue.push({ task, ctx });\n  // Cap queue depth so a misbehaving client cannot pin memory.\n  if (queue.length > 100) queue = queue.slice(-100);\n  pumpQueue();\n  return 'pending';\n}\n\nfunction pumpQueue(): void {\n  while (queue.length > 0 && inflight < currentConcurrency()) {\n    const next = queue.shift();\n    if (!next) break;\n    inflight++;\n    void runThumbnail(next.task, next.ctx)\n      .catch((err) => log.warn({ err, token: next.task.token }, 'Thumbnail task threw'))\n      .finally(() => {\n        inflight--;\n        pumpQueue();\n      });\n  }\n}\n\nfunction currentConcurrency(): number {\n  return Math.max(1, queue[0]?.ctx.config.concurrency ?? 2);\n}\n\nasync function runThumbnail(\n  task: ThumbnailTaskInput,\n  ctx: ThumbnailRenderContext,\n): Promise<void> {\n  await mkdir(join(resolveStateDir(), THUMBNAIL_DIR), { recursive: true });\n  const target = task.scope === 'file' ? getShareStore().getById(task.recordId) : getSiteShareStore().getById(task.recordId);\n  if (!target) return;\n  try {\n    let bytes: Buffer;\n    if (task.scope === 'file') {\n      bytes = await renderForFile(target as ShareRecord, ctx);\n    } else {\n      bytes = await renderForSite(target as SiteShareRecord, ctx);\n    }\n    if (bytes.length > ctx.config.maxBytes) {\n      // Re-encode lossily by re-running through a smaller viewport if possible\n      bytes = bytes.subarray(0, ctx.config.maxBytes);\n    }\n    await writeFile(getThumbnailPath(task.token), bytes);\n    if (task.scope === 'file') getShareStore().setThumbnailStatus(task.recordId, 'ready');\n    else getSiteShareStore().setThumbnailStatus(task.recordId, 'ready');\n    lastFailureAt.delete(task.token);\n    log.debug({ token: task.token.slice(0, 8), scope: task.scope, bytes: bytes.length }, 'Thumbnail generated');\n  } catch (err) {\n    lastFailureAt.set(task.token, Date.now());\n    if (task.scope === 'file') getShareStore().setThumbnailStatus(task.recordId, 'failed');\n    else getSiteShareStore().setThumbnailStatus(task.recordId, 'failed');\n    log.warn({ err, token: task.token.slice(0, 8), scope: task.scope }, 'Thumbnail generation failed');\n  }\n}\n\nasync function renderForFile(record: ShareRecord, ctx: ThumbnailRenderContext): Promise<Buffer> {\n  if (record.kind === 'directory') {\n    return placeholderPng(record.fileName, 'folder');\n  }\n  const mime = record.mimeType;\n  if (mime === 'text/html') {\n    const url = `${ctx.internalBaseUrl.replace(/\\/+$/, '')}/s/${record.token}?inline=1`;\n    return await renderUrlScreenshot(url, ctx);\n  }\n  if (mime.startsWith('image/')) {\n    return await readImageWithSizeCap(record.absolutePath, ctx.config.maxBytes);\n  }\n  return placeholderPng(record.fileName, classifyByMime(mime));\n}\n\nasync function renderForSite(record: SiteShareRecord, ctx: ThumbnailRenderContext): Promise<Buffer> {\n  const url = `${ctx.internalBaseUrl.replace(/\\/+$/, '')}/site/${record.token}/`;\n  return await renderUrlScreenshot(url, ctx);\n}\n\nasync function renderUrlScreenshot(url: string, ctx: ThumbnailRenderContext): Promise<Buffer> {\n  const browser = await getOrLaunchBrowser();\n  if (!browser) {\n    throw new Error('playwright-core / chromium unavailable');\n  }\n  const context = await browser.newContext({\n    viewport: { width: ctx.config.viewportWidth, height: ctx.config.viewportHeight },\n    deviceScaleFactor: 1,\n    javaScriptEnabled: true,\n    bypassCSP: true,\n    ignoreHTTPSErrors: true,\n    userAgent: 'xopc-thumbnail/1.0 (compatible; share preview)',\n  });\n  // Block non-loopback network so a malicious share cannot use us to scan/contact external hosts.\n  await context.route('**/*', (route) => {\n    const reqUrl = route.request().url();\n    if (\n      reqUrl.startsWith('data:') ||\n      reqUrl.startsWith('blob:') ||\n      reqUrl.startsWith(ctx.internalBaseUrl) ||\n      reqUrl.startsWith('http://127.0.0.1') ||\n      reqUrl.startsWith('http://localhost') ||\n      reqUrl.startsWith('http://[::1]')\n    ) {\n      void route.continue();\n      return;\n    }\n    void route.abort();\n  });\n  try {\n    const page = await context.newPage();\n    await page.goto(url, { waitUntil: 'load', timeout: ctx.config.generationTimeoutMs });\n    // Best-effort wait for network idle, capped by generationTimeoutMs.\n    try {\n      await page.waitForLoadState('networkidle', { timeout: Math.min(ctx.config.generationTimeoutMs, 3_000) });\n    } catch {\n      /* networkidle may never settle for animation pages — ignore */\n    }\n    const bytes = await page.screenshot({\n      type: 'jpeg',\n      quality: 80,\n      fullPage: false,\n      clip: { x: 0, y: 0, width: ctx.config.viewportWidth, height: ctx.config.viewportHeight },\n    });\n    return Buffer.from(bytes);\n  } finally {\n    await context.close().catch(() => {});\n  }\n}\n\nasync function getOrLaunchBrowser(): Promise<import('playwright-core').Browser | null> {\n  if (!browserPromise) {\n    browserPromise = (async () => {\n      try {\n        const pw = await loadPlaywrightCoreModule();\n        const chromium = pw.chromium\n          ?? (pw as { default?: { chromium?: (typeof pw)['chromium'] } }).default?.chromium;\n        if (!chromium?.launch) return null;\n        return await chromium.launch({ headless: true, args: ['--no-sandbox'] });\n      } catch (err) {\n        log.warn({ err }, 'Playwright launch failed for thumbnail renderer');\n        return null;\n      }\n    })();\n  }\n  return browserPromise;\n}\n\nexport async function shutdownThumbnailBrowser(): Promise<void> {\n  if (!browserPromise) return;\n  try {\n    const b = await browserPromise;\n    if (b) await b.close();\n  } catch {\n    /* ignore */\n  }\n  browserPromise = null;\n  queue = [];\n  inflight = 0;\n  lastFailureAt.clear();\n}\n\nasync function readImageWithSizeCap(absolutePath: string, cap: number): Promise<Buffer> {\n  const buf = await readFile(absolutePath);\n  if (buf.length <= cap) return buf;\n  // We don't ship a real raster encoder here; for tiny budgets the recipient\n  // sees a placeholder rather than a truncated/broken jpeg.\n  throw new Error(`image exceeds thumbnail size cap (${buf.length} > ${cap})`);\n}\n\nfunction classifyByMime(mime: string): PlaceholderKind {\n  if (mime.startsWith('image/')) return 'image';\n  if (mime.startsWith('video/')) return 'video';\n  if (mime.startsWith('audio/')) return 'audio';\n  if (mime === 'application/pdf') return 'pdf';\n  if (mime === 'application/zip' || mime === 'application/gzip' || mime === 'application/x-tar') return 'archive';\n  if (mime === 'text/html') return 'html';\n  if (mime.startsWith('text/')) return 'text';\n  if (mime.includes('spreadsheet')) return 'sheet';\n  if (mime.includes('presentation')) return 'slides';\n  if (mime.includes('wordprocessing')) return 'doc';\n  return 'file';\n}\n\ntype PlaceholderKind =\n  | 'file' | 'folder' | 'html' | 'image' | 'video' | 'audio'\n  | 'pdf' | 'archive' | 'text' | 'doc' | 'sheet' | 'slides';\n\nconst ICONS: Record<PlaceholderKind, string> = {\n  file: '📄', folder: '📁', html: '🌐', image: '🖼', video: '🎬', audio: '🎵',\n  pdf: '📕', archive: '🗜', text: '📝', doc: '📘', sheet: '📊', slides: '📽',\n};\n\nfunction safeToken(token: string): string {\n  return token.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64);\n}\n\n/** Generate a static placeholder card as an SVG-then-jpeg surrogate. Since we\n * have no native SVG-to-raster encoder available without extra deps, we emit a\n * tiny inline-SVG that browsers render directly. Callers store .jpg but the\n * route content-type is set to the actual returned mime. */\nexport function placeholderSvg(fileName: string, kind: PlaceholderKind): Buffer {\n  const icon = ICONS[kind] ?? ICONS.file;\n  const safe = escapeXml(fileName.length > 36 ? `${fileName.slice(0, 33)}...` : fileName);\n  const svg = `<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"1200\" height=\"630\" viewBox=\"0 0 1200 630\">\n<defs><linearGradient id=\"g\" x1=\"0\" y1=\"0\" x2=\"1\" y2=\"1\">\n<stop offset=\"0%\" stop-color=\"#0f172a\"/><stop offset=\"100%\" stop-color=\"#1e293b\"/></linearGradient></defs>\n<rect width=\"1200\" height=\"630\" fill=\"url(#g)\"/>\n<text x=\"600\" y=\"300\" font-size=\"200\" text-anchor=\"middle\" dominant-baseline=\"central\" font-family=\"apple color emoji,segoe ui emoji,noto color emoji,sans-serif\">${icon}</text>\n<text x=\"600\" y=\"460\" font-size=\"40\" fill=\"#e2e8f0\" text-anchor=\"middle\" font-family=\"-apple-system,Segoe UI,Roboto,sans-serif\" font-weight=\"600\">${safe}</text>\n<text x=\"600\" y=\"520\" font-size=\"24\" fill=\"#94a3b8\" text-anchor=\"middle\" font-family=\"-apple-system,Segoe UI,Roboto,sans-serif\">Shared via xopc</text>\n</svg>`;\n  return Buffer.from(svg, 'utf8');\n}\n\nfunction placeholderPng(fileName: string, kind: PlaceholderKind): Buffer {\n  // Returned as SVG bytes — caller's content-type must be `image/svg+xml`.\n  return placeholderSvg(fileName, kind);\n}\n\nfunction escapeXml(text: string): string {\n  return text\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&apos;');\n}\n\n/** Determine if the cached file is a real jpeg or a placeholder SVG by sniffing. */\nexport function thumbnailContentType(bytes: Buffer): string {\n  if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) return 'image/jpeg';\n  if (bytes.length >= 8 && bytes[0] === 0x89 && bytes[1] === 0x50) return 'image/png';\n  if (bytes.length >= 4 && bytes[0] === 0x47 && bytes[1] === 0x49) return 'image/gif';\n  if (bytes.length >= 12 && bytes.subarray(0, 4).toString('ascii') === 'RIFF' && bytes.subarray(8, 12).toString('ascii') === 'WEBP') return 'image/webp';\n  return 'image/svg+xml';\n}\n\n/** Helper for tests + cleanup. */\nexport function resetThumbnailStateForTests(): void {\n  queue = [];\n  inflight = 0;\n  lastFailureAt.clear();\n  browserPromise = null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAgBqD;aACH;AAOlD,MAAM,MAAM,aAAa,kBAAkB;AAE3C,MAAM,gBAAgB;AAiBtB,IAAI,QAA0E,EAAE;AAChF,IAAI,WAAW;AACf,MAAM,gCAAgB,IAAI,KAAqB;AAC/C,IAAI,iBAA2E;AAE/E,SAAgB,iBAAiB,OAAuB;AACtD,QAAO,KAAK,iBAAiB,EAAE,eAAe,GAAG,UAAU,MAAM,CAAC,MAAM;;AAG1E,eAAsB,gBAAgB,OAAiC;AACrE,KAAI;EACF,MAAM,KAAK,MAAM,KAAK,iBAAiB,MAAM,CAAC;AAC9C,SAAO,GAAG,QAAQ,IAAI,GAAG,OAAO;SAC1B;AACN,SAAO;;;AAIX,eAAsB,cAAc,OAAuC;AACzE,KAAI;AACF,SAAO,MAAM,SAAS,iBAAiB,MAAM,CAAC;SACxC;AACN,SAAO;;;;AAKX,eAAsB,gBAAgB,OAA8B;AAClE,KAAI;AACF,QAAM,OAAO,iBAAiB,MAAM,CAAC;SAC/B;;;;;;AASV,SAAgB,kBACd,MACA,KAC6C;AAC7C,KAAI,CAAC,IAAI,OAAO,QAAS,QAAO;CAChC,MAAM,WAAW,cAAc,IAAI,KAAK,MAAM;AAC9C,KAAI,YAAY,KAAK,KAAK,GAAG,WAAW,IAAI,OAAO,kBACjD,QAAO;AAET,OAAM,KAAK;EAAE;EAAM;EAAK,CAAC;AAEzB,KAAI,MAAM,SAAS,IAAK,SAAQ,MAAM,MAAM,KAAK;AACjD,YAAW;AACX,QAAO;;AAGT,SAAS,YAAkB;AACzB,QAAO,MAAM,SAAS,KAAK,WAAW,oBAAoB,EAAE;EAC1D,MAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,KAAM;AACX;AACK,eAAa,KAAK,MAAM,KAAK,IAAI,CACnC,OAAO,QAAQ,IAAI,KAAK;GAAE;GAAK,OAAO,KAAK,KAAK;GAAO,EAAE,uBAAuB,CAAC,CACjF,cAAc;AACb;AACA,cAAW;IACX;;;AAIR,SAAS,qBAA6B;AACpC,QAAO,KAAK,IAAI,GAAG,MAAM,IAAI,IAAI,OAAO,eAAe,EAAE;;AAG3D,eAAe,aACb,MACA,KACe;AACf,OAAM,MAAM,KAAK,iBAAiB,EAAE,cAAc,EAAE,EAAE,WAAW,MAAM,CAAC;CACxE,MAAM,SAAS,KAAK,UAAU,SAAS,eAAe,CAAC,QAAQ,KAAK,SAAS,GAAG,mBAAmB,CAAC,QAAQ,KAAK,SAAS;AAC1H,KAAI,CAAC,OAAQ;AACb,KAAI;EACF,IAAI;AACJ,MAAI,KAAK,UAAU,OACjB,SAAQ,MAAM,cAAc,QAAuB,IAAI;MAEvD,SAAQ,MAAM,cAAc,QAA2B,IAAI;AAE7D,MAAI,MAAM,SAAS,IAAI,OAAO,SAE5B,SAAQ,MAAM,SAAS,GAAG,IAAI,OAAO,SAAS;AAEhD,QAAM,UAAU,iBAAiB,KAAK,MAAM,EAAE,MAAM;AACpD,MAAI,KAAK,UAAU,OAAQ,gBAAe,CAAC,mBAAmB,KAAK,UAAU,QAAQ;MAChF,oBAAmB,CAAC,mBAAmB,KAAK,UAAU,QAAQ;AACnE,gBAAc,OAAO,KAAK,MAAM;AAChC,MAAI,MAAM;GAAE,OAAO,KAAK,MAAM,MAAM,GAAG,EAAE;GAAE,OAAO,KAAK;GAAO,OAAO,MAAM;GAAQ,EAAE,sBAAsB;UACpG,KAAK;AACZ,gBAAc,IAAI,KAAK,OAAO,KAAK,KAAK,CAAC;AACzC,MAAI,KAAK,UAAU,OAAQ,gBAAe,CAAC,mBAAmB,KAAK,UAAU,SAAS;MACjF,oBAAmB,CAAC,mBAAmB,KAAK,UAAU,SAAS;AACpE,MAAI,KAAK;GAAE;GAAK,OAAO,KAAK,MAAM,MAAM,GAAG,EAAE;GAAE,OAAO,KAAK;GAAO,EAAE,8BAA8B;;;AAItG,eAAe,cAAc,QAAqB,KAA8C;AAC9F,KAAI,OAAO,SAAS,YAClB,QAAO,eAAe,OAAO,UAAU,SAAS;CAElD,MAAM,OAAO,OAAO;AACpB,KAAI,SAAS,YAEX,QAAO,MAAM,oBAAoB,GADlB,IAAI,gBAAgB,QAAQ,QAAQ,GAAG,CAAC,KAAK,OAAO,MAAM,YACnC,IAAI;AAE5C,KAAI,KAAK,WAAW,SAAS,CAC3B,QAAO,MAAM,qBAAqB,OAAO,cAAc,IAAI,OAAO,SAAS;AAE7E,QAAO,eAAe,OAAO,UAAU,eAAe,KAAK,CAAC;;AAG9D,eAAe,cAAc,QAAyB,KAA8C;AAElG,QAAO,MAAM,oBAAoB,GADlB,IAAI,gBAAgB,QAAQ,QAAQ,GAAG,CAAC,QAAQ,OAAO,MAAM,IACtC,IAAI;;AAG5C,eAAe,oBAAoB,KAAa,KAA8C;CAC5F,MAAM,UAAU,MAAM,oBAAoB;AAC1C,KAAI,CAAC,QACH,OAAM,IAAI,MAAM,yCAAyC;CAE3D,MAAM,UAAU,MAAM,QAAQ,WAAW;EACvC,UAAU;GAAE,OAAO,IAAI,OAAO;GAAe,QAAQ,IAAI,OAAO;GAAgB;EAChF,mBAAmB;EACnB,mBAAmB;EACnB,WAAW;EACX,mBAAmB;EACnB,WAAW;EACZ,CAAC;AAEF,OAAM,QAAQ,MAAM,SAAS,UAAU;EACrC,MAAM,SAAS,MAAM,SAAS,CAAC,KAAK;AACpC,MACE,OAAO,WAAW,QAAQ,IAC1B,OAAO,WAAW,QAAQ,IAC1B,OAAO,WAAW,IAAI,gBAAgB,IACtC,OAAO,WAAW,mBAAmB,IACrC,OAAO,WAAW,mBAAmB,IACrC,OAAO,WAAW,eAAe,EACjC;AACK,SAAM,UAAU;AACrB;;AAEG,QAAM,OAAO;GAClB;AACF,KAAI;EACF,MAAM,OAAO,MAAM,QAAQ,SAAS;AACpC,QAAM,KAAK,KAAK,KAAK;GAAE,WAAW;GAAQ,SAAS,IAAI,OAAO;GAAqB,CAAC;AAEpF,MAAI;AACF,SAAM,KAAK,iBAAiB,eAAe,EAAE,SAAS,KAAK,IAAI,IAAI,OAAO,qBAAqB,IAAM,EAAE,CAAC;UAClG;EAGR,MAAM,QAAQ,MAAM,KAAK,WAAW;GAClC,MAAM;GACN,SAAS;GACT,UAAU;GACV,MAAM;IAAE,GAAG;IAAG,GAAG;IAAG,OAAO,IAAI,OAAO;IAAe,QAAQ,IAAI,OAAO;IAAgB;GACzF,CAAC;AACF,SAAO,OAAO,KAAK,MAAM;WACjB;AACR,QAAM,QAAQ,OAAO,CAAC,YAAY,GAAG;;;AAIzC,eAAe,qBAAwE;AACrF,KAAI,CAAC,eACH,mBAAkB,YAAY;AAC5B,MAAI;GACF,MAAM,KAAK,MAAM,0BAA0B;GAC3C,MAAM,WAAW,GAAG,YACd,GAA4D,SAAS;AAC3E,OAAI,CAAC,UAAU,OAAQ,QAAO;AAC9B,UAAO,MAAM,SAAS,OAAO;IAAE,UAAU;IAAM,MAAM,CAAC,eAAe;IAAE,CAAC;WACjE,KAAK;AACZ,OAAI,KAAK,EAAE,KAAK,EAAE,kDAAkD;AACpE,UAAO;;KAEP;AAEN,QAAO;;AAGT,eAAsB,2BAA0C;AAC9D,KAAI,CAAC,eAAgB;AACrB,KAAI;EACF,MAAM,IAAI,MAAM;AAChB,MAAI,EAAG,OAAM,EAAE,OAAO;SAChB;AAGR,kBAAiB;AACjB,SAAQ,EAAE;AACV,YAAW;AACX,eAAc,OAAO;;AAGvB,eAAe,qBAAqB,cAAsB,KAA8B;CACtF,MAAM,MAAM,MAAM,SAAS,aAAa;AACxC,KAAI,IAAI,UAAU,IAAK,QAAO;AAG9B,OAAM,IAAI,MAAM,qCAAqC,IAAI,OAAO,KAAK,IAAI,GAAG;;AAG9E,SAAS,eAAe,MAA+B;AACrD,KAAI,KAAK,WAAW,SAAS,CAAE,QAAO;AACtC,KAAI,KAAK,WAAW,SAAS,CAAE,QAAO;AACtC,KAAI,KAAK,WAAW,SAAS,CAAE,QAAO;AACtC,KAAI,SAAS,kBAAmB,QAAO;AACvC,KAAI,SAAS,qBAAqB,SAAS,sBAAsB,SAAS,oBAAqB,QAAO;AACtG,KAAI,SAAS,YAAa,QAAO;AACjC,KAAI,KAAK,WAAW,QAAQ,CAAE,QAAO;AACrC,KAAI,KAAK,SAAS,cAAc,CAAE,QAAO;AACzC,KAAI,KAAK,SAAS,eAAe,CAAE,QAAO;AAC1C,KAAI,KAAK,SAAS,iBAAiB,CAAE,QAAO;AAC5C,QAAO;;AAOT,MAAM,QAAyC;CAC7C,MAAM;CAAM,QAAQ;CAAM,MAAM;CAAM,OAAO;CAAM,OAAO;CAAM,OAAO;CACvE,KAAK;CAAM,SAAS;CAAM,MAAM;CAAM,KAAK;CAAM,OAAO;CAAM,QAAQ;CACvE;AAED,SAAS,UAAU,OAAuB;AACxC,QAAO,MAAM,QAAQ,mBAAmB,IAAI,CAAC,MAAM,GAAG,GAAG;;;;;;AAO3D,SAAgB,eAAe,UAAkB,MAA+B;CAG9E,MAAM,MAAM;;;;oKAFC,MAAM,SAAS,MAAM,KAMqI;oJAL1J,UAAU,SAAS,SAAS,KAAK,GAAG,SAAS,MAAM,GAAG,GAAG,CAAC,OAAO,SAMwE,CAAC;;;AAGvJ,QAAO,OAAO,KAAK,KAAK,OAAO;;AAGjC,SAAS,eAAe,UAAkB,MAA+B;AAEvE,QAAO,eAAe,UAAU,KAAK;;AAGvC,SAAS,UAAU,MAAsB;AACvC,QAAO,KACJ,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,SAAS,CACvB,QAAQ,MAAM,SAAS;;;AAI5B,SAAgB,qBAAqB,OAAuB;AAC1D,KAAI,MAAM,UAAU,KAAK,MAAM,OAAO,OAAQ,MAAM,OAAO,OAAQ,MAAM,OAAO,IAAM,QAAO;AAC7F,KAAI,MAAM,UAAU,KAAK,MAAM,OAAO,OAAQ,MAAM,OAAO,GAAM,QAAO;AACxE,KAAI,MAAM,UAAU,KAAK,MAAM,OAAO,MAAQ,MAAM,OAAO,GAAM,QAAO;AACxE,KAAI,MAAM,UAAU,MAAM,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,QAAQ,KAAK,UAAU,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,QAAQ,KAAK,OAAQ,QAAO;AAC1I,QAAO;;;AAIT,SAAgB,8BAAoC;AAClD,SAAQ,EAAE;AACV,YAAW;AACX,eAAc,OAAO;AACrB,kBAAiB"}

package/dist/src/share/share-types.d.ts

@@ -1,3 +1,14 @@
+export type ShareKind = 'file' | 'directory';
+export interface ShareDirectoryMeta {
+    /** 'browse' shows a file tree; 'zip-only' hides structure and only offers ZIP. */
+    mode: 'browse' | 'zip-only';
+    /** Snapshot entry count at creation time (display + sanity guard). */
+    entryCount: number;
+    /** Whether the symlink filter at scan time was permissive. */
+    followSymlinks: boolean;
+    /** Maximum traversal depth (defense against recursive symlinks). */
+    maxDepth: number;
+}
 export interface ShareRecord {
     /** Unique identifier (UUIDv4) for management. */
     id: string;
@@ -9,37 +20,48 @@ export interface ShareRecord {
     workspaceRelativePath: string;
     /** Workspace root at creation time (for download-time re-validation). */
     workspaceRoot: string;
-    /** File inode at creation time (TOCTOU protection). */
+    /** File or directory inode at creation time (TOCTOU protection). */
     inode: number;
-    /** Whether this share targets a directory. */
-    isDirectory: boolean;
-    /** Original file name (basename). */
+    /** Discriminator for downstream branching ('file' | 'directory'). */
+    kind: ShareKind;
+    /** Original file/folder name (basename). */
     fileName: string;
-    /** File size in bytes (snapshot at creation). */
+    /**
+     * For files: file size in bytes (snapshot at creation).
+     * For directories: sum of file sizes at scan time (display only).
+     */
     fileSize: number;
-    /** MIME type. */
+    /** MIME type (directories: 'application/x-directory'). */
     mimeType: string;
     /** ISO creation timestamp. */
     createdAt: string;
     /** ISO expiration timestamp. */
     expiresAt: string;
-    /** Maximum allowed views (null = unlimited). */
+    /** Maximum allowed downloads (null = unlimited). Counts file/zip/preview events. */
     maxViews: number | null;
-    /** Current view count. */
-    viewCount: number;
+    /** Download counter (file-bytes / zip-bytes / preview events). Landing-page renders never count. */
+    downloadCount: number;
     /** Whether manually revoked. */
     revoked: boolean;
     /** Gateway token SHA-256 hash prefix (12 chars) of the creator. */
     createdByTokenHash: string;
     /** Optional human-readable description. */
     description?: string;
+    /** Directory-only extra fields. */
+    directory?: ShareDirectoryMeta;
+    /** Thumbnail generation status (lazy + scheduled). */
+    thumbnailStatus?: 'pending' | 'ready' | 'failed';
+    /** ISO timestamp of the last successful thumbnail render. */
+    thumbnailGeneratedAt?: string;
+    /** ISO timestamp of the last failed attempt (used for cooldown). */
+    thumbnailFailedAt?: string;
 }
 export interface CreateShareParams {
     /** Workspace-relative file path. */
     path: string;
     /** Time-to-live in milliseconds (default: 24h). */
     ttlMs?: number;
-    /** Maximum view count (null = unlimited). */
+    /** Maximum view/download count (null = unlimited). */
     maxViews?: number | null;
     /** Optional description shown on the landing page. */
     description?: string;
@@ -47,6 +69,18 @@ export interface CreateShareParams {
     sessionKey?: string;
     /** Agent id to resolve workspace root. */
     agentId?: string;
+    /** Force directory share semantics (overrides auto-detection). */
+    kind?: ShareKind;
+    /** Directory: browse vs zip-only. Defaults to 'browse'. */
+    directoryMode?: 'browse' | 'zip-only';
+    /** Directory: cap on entry count at scan time. */
+    maxFileCount?: number;
+    /** Directory: cap on total folder size in bytes. */
+    maxFolderSize?: number;
+    /** Directory: whether to follow symlinks (subject to workspace boundary). */
+    followSymlinks?: boolean;
+    /** Directory: walk depth cap (default 20). */
+    maxDepth?: number;
 }
 export interface ShareStoreData {
     version: 1;
@@ -59,6 +93,28 @@ export interface ResolvedShareUrl {
     reachability: ShareReachability;
     reachabilityHint: string | null;
 }
+export interface ShareDirectoryConfig {
+    enabled: boolean;
+    maxFolderSize: number;
+    maxFileCount: number;
+    maxDepth: number;
+    listingCacheMs: number;
+    zipConcurrency: number;
+}
+export interface ShareThumbnailConfig {
+    enabled: boolean;
+    concurrency: number;
+    /** Hard cap on emitted jpeg bytes. */
+    maxBytes: number;
+    viewportWidth: number;
+    viewportHeight: number;
+    /** Per-render timeout (Playwright navigation + screenshot). */
+    generationTimeoutMs: number;
+    /** Cooldown before a failed token is retried. */
+    failureCooldownMs: number;
+    /** Optional override for the loopback URL used by the headless renderer. */
+    internalGatewayUrl?: string;
+}
 export interface ShareConfig {
     enabled: boolean;
     defaultTtlMs: number;
@@ -66,6 +122,8 @@ export interface ShareConfig {
     maxActiveShares: number;
     maxFileSize: number;
     inlinePreviewMimes: string[];
+    directory: ShareDirectoryConfig;
+    thumbnail: ShareThumbnailConfig;
 }
 /** Default share configuration values. */
 export declare const SHARE_CONFIG_DEFAULTS: ShareConfig;