agent-canvas 0.1.26 → 0.1.28

package/daemon/src/share.test.ts

@@ -0,0 +1,221 @@
+/**
+ * Unit tests for the share packager. Uses a temp directory to back a real
+ * SessionManager so we exercise the actual disk persistence path. The
+ * worker push itself is mocked via fetch override.
+ */
+
+import { describe, expect, test, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { SessionManager } from "./session";
+import { buildSharePayload, pushShareToWorker, shareRevision, loadShareConfig } from "./share";
+
+let testDir: string;
+let originalSessionsDir: string | undefined;
+
+beforeEach(() => {
+  testDir = mkdtempSync(join(tmpdir(), "canvas-share-test-"));
+  // Override SESSIONS_DIR via env (paths.ts reads at module load — for
+  // these tests we instead seed a SessionManager and inject revisions
+  // through its public API rather than touching its private dirs).
+  originalSessionsDir = process.env.CANVAS_TEST_SESSIONS_DIR;
+});
+
+afterEach(() => {
+  try { rmSync(testDir, { recursive: true, force: true }); } catch {}
+  if (originalSessionsDir !== undefined) {
+    process.env.CANVAS_TEST_SESSIONS_DIR = originalSessionsDir;
+  } else {
+    delete process.env.CANVAS_TEST_SESSIONS_DIR;
+  }
+});
+
+describe("loadShareConfig", () => {
+  test("returns null without endpoint", () => {
+    const before = process.env.CANVAS_SHARE_ENDPOINT;
+    delete process.env.CANVAS_SHARE_ENDPOINT;
+    expect(loadShareConfig("0.0.0")).toBeNull();
+    if (before) process.env.CANVAS_SHARE_ENDPOINT = before;
+  });
+
+  test("strips trailing slashes", () => {
+    process.env.CANVAS_SHARE_ENDPOINT = "https://example.com/";
+    const cfg = loadShareConfig("0.0.0");
+    expect(cfg?.endpoint).toBe("https://example.com");
+    delete process.env.CANVAS_SHARE_ENDPOINT;
+  });
+
+  test("includes auth token when set", () => {
+    process.env.CANVAS_SHARE_ENDPOINT = "https://example.com";
+    process.env.CANVAS_SHARE_AUTH_TOKEN = "secret";
+    const cfg = loadShareConfig("0.0.0");
+    expect(cfg?.authToken).toBe("secret");
+    delete process.env.CANVAS_SHARE_ENDPOINT;
+    delete process.env.CANVAS_SHARE_AUTH_TOKEN;
+  });
+});
+
+describe("buildSharePayload", () => {
+  test("packages compiled JS + JSX source", () => {
+    const sm = new SessionManager(testDir);
+    const sid = `test-${Date.now()}`;
+    const files = new Map([["plan.jsx", "<Section>hi</Section>"]]);
+    sm.upsert(sid, files, "/tmp", "Test label");
+    sm.saveCompiled(sid, "plan.jsx", "/* compiled */ export default ()=>null");
+
+    const payload = buildSharePayload(sm, sid, 1, "0.1.27");
+    expect(payload.version).toBe(1);
+    expect(payload.origin.sessionId).toBe(sid);
+    expect(payload.origin.revision).toBe(1);
+    expect(payload.origin.label).toBe("Test label");
+    expect(payload.canvasFiles).toHaveLength(1);
+    expect(payload.canvasFiles[0].filename).toBe("plan.jsx");
+    expect(payload.canvasFiles[0].compiledJs).toContain("/* compiled */");
+    expect(payload.canvasFiles[0].sourceJsx).toContain("<Section>hi</Section>");
+    expect(payload.runtime.componentsVersion).toBe("0.1.27");
+
+    sm.remove(sid);
+  });
+
+  test("throws when revision missing", () => {
+    const sm = new SessionManager(testDir);
+    const sid = `test-${Date.now()}`;
+    sm.upsert(sid, new Map([["plan.jsx", "x"]]), "/tmp");
+    sm.saveCompiled(sid, "plan.jsx", "x");
+    expect(() => buildSharePayload(sm, sid, 99, "0.0.0")).toThrow();
+    sm.remove(sid);
+  });
+
+  test("throws when no compiled JS", () => {
+    const sm = new SessionManager(testDir);
+    const sid = `test-${Date.now()}`;
+    sm.upsert(sid, new Map([["plan.jsx", "x"]]), "/tmp");
+    // Intentionally skip saveCompiled
+    expect(() => buildSharePayload(sm, sid, 1, "0.0.0")).toThrow();
+    sm.remove(sid);
+  });
+});
+
+describe("pushShareToWorker", () => {
+  const originalFetch = globalThis.fetch;
+  afterEach(() => { globalThis.fetch = originalFetch; });
+
+  test("posts JSON and unwraps the response", async () => {
+    let captured: { url: string; init: RequestInit } | null = null;
+    (globalThis as any).fetch = async (url: any, init: any) => {
+      captured = { url: String(url), init };
+      return new Response(JSON.stringify({
+        shareId: "deadbeef",
+        url: "https://example.com/s/deadbeef",
+        ownerToken: "ot",
+        expiresAt: "2026-12-31T00:00:00Z",
+      }), { status: 200, headers: { "Content-Type": "application/json" } });
+    };
+
+    const result = await pushShareToWorker(
+      {
+        version: 1,
+        origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
+        canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
+        runtime: { componentsVersion: "1.0.0" },
+      },
+      { endpoint: "https://example.com", componentsVersion: "1.0.0" },
+    );
+
+    expect(result.shareId).toBe("deadbeef");
+    expect(result.url).toBe("https://example.com/s/deadbeef");
+    expect(result.ownerToken).toBe("ot");
+    expect(captured!.url).toBe("https://example.com/shares");
+    expect(captured!.init.method).toBe("POST");
+  });
+
+  test("includes Authorization header when authToken set", async () => {
+    let captured: any = null;
+    (globalThis as any).fetch = async (_url: any, init: any) => {
+      captured = init;
+      return new Response(JSON.stringify({ shareId: "x", url: "x" }), { status: 200 });
+    };
+
+    await pushShareToWorker(
+      {
+        version: 1,
+        origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
+        canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
+        runtime: { componentsVersion: "1.0.0" },
+      },
+      { endpoint: "https://example.com", componentsVersion: "1.0.0", authToken: "topsecret" },
+    );
+
+    expect(captured.headers["Authorization"]).toBe("Bearer topsecret");
+  });
+
+  test("throws on non-2xx", async () => {
+    (globalThis as any).fetch = async () => new Response("nope", { status: 500 });
+    await expect(
+      pushShareToWorker(
+        {
+          version: 1,
+          origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
+          canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
+          runtime: { componentsVersion: "1.0.0" },
+        },
+        { endpoint: "https://example.com", componentsVersion: "1.0.0" },
+      ),
+    ).rejects.toThrow(/500/);
+  });
+
+  test("throws on malformed response", async () => {
+    (globalThis as any).fetch = async () => new Response(JSON.stringify({ shareId: "x" }), { status: 200 });
+    await expect(
+      pushShareToWorker(
+        {
+          version: 1,
+          origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
+          canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
+          runtime: { componentsVersion: "1.0.0" },
+        },
+        { endpoint: "https://example.com", componentsVersion: "1.0.0" },
+      ),
+    ).rejects.toThrow(/invalid response/);
+  });
+});
+
+describe("shareRevision", () => {
+  const originalFetch = globalThis.fetch;
+  afterEach(() => { globalThis.fetch = originalFetch; });
+
+  test("records share entry on the session", async () => {
+    (globalThis as any).fetch = async () =>
+      new Response(JSON.stringify({
+        shareId: "abc123def456",
+        url: "https://example.com/s/abc123def456",
+        ownerToken: "owner",
+        expiresAt: "2026-12-31T00:00:00Z",
+      }), { status: 200 });
+
+    const sm = new SessionManager(testDir);
+    const sid = `test-${Date.now()}`;
+    sm.upsert(sid, new Map([["plan.jsx", "x"]]), "/tmp");
+    sm.saveCompiled(sid, "plan.jsx", "x");
+
+    const entry = await shareRevision(sm, sid, 1, {
+      endpoint: "https://example.com",
+      componentsVersion: "1.0.0",
+    });
+
+    expect(entry.shareId).toBe("abc123def456");
+    expect(entry.revision).toBe(1);
+    expect(entry.ownerToken).toBe("owner");
+    expect(entry.expiresAt).toBe("2026-12-31T00:00:00Z");
+
+    const shares = sm.getShares(sid);
+    expect(shares).toHaveLength(1);
+    expect(shares[0].shareId).toBe("abc123def456");
+
+    sm.remove(sid);
+  });
+});
+
+void mkdirSync;
+void writeFileSync;

package/daemon/src/share.ts

@@ -0,0 +1,187 @@
+import type { SessionManager, ShareEntry } from "./session";
+
+/**
+ * Canvas sharing: packages a specific revision into a self-contained
+ * snapshot and POSTs it to the configured cloud endpoint (CF Worker).
+ *
+ * The cloud endpoint stores the snapshot and returns a public capability
+ * URL that the author can send to reviewers. Runtime bundles
+ * (react/preact-compat, runtime.js, components.js) are NOT bundled into the
+ * payload — the worker serves matching runtime from its own deploy, keyed
+ * off `runtime.componentsVersion` in the payload. This keeps shares small
+ * while still guaranteeing version compatibility.
+ */
+
+export interface SharePayload {
+  version: 1;
+  origin: {
+    sessionId: string;
+    revision: number;
+    label?: string;
+    createdAt: string;
+  };
+  canvasFiles: Array<{
+    filename: string;
+    compiledJs: string;
+    sourceJsx?: string;
+  }>;
+  runtime: {
+    componentsVersion: string;
+  };
+}
+
+export interface ShareResponse {
+  shareId: string;
+  url: string;
+  ownerToken?: string;
+  expiresAt?: string;
+}
+
+export interface ShareConfig {
+  /** Base URL of the share worker, e.g. `https://canvas-share.example.workers.dev` */
+  endpoint: string;
+  /** Version of the @agent-canvas runtime bundles — worker uses this to pick matching runtime */
+  componentsVersion: string;
+  /** Optional bearer token. If the worker has SHARE_AUTH_TOKEN set, this
+   *  must match. Loaded from CANVAS_SHARE_AUTH_TOKEN env var on the daemon. */
+  authToken?: string;
+}
+
+export function loadShareConfig(version: string): ShareConfig | null {
+  const endpoint = process.env.CANVAS_SHARE_ENDPOINT ?? "https://canvas.contember.com";
+  if (!endpoint) return null;
+  return {
+    endpoint: endpoint.replace(/\/+$/, ""),
+    componentsVersion: version,
+    ...(process.env.CANVAS_SHARE_AUTH_TOKEN ? { authToken: process.env.CANVAS_SHARE_AUTH_TOKEN } : {}),
+  };
+}
+
+/**
+ * Build a SharePayload for the given session/revision. Reads the already
+ * compiled JS from the session's revision directory. Also includes the
+ * original JSX source for "view source" functionality on the shared canvas.
+ */
+export function buildSharePayload(
+  sessionManager: SessionManager,
+  sessionId: string,
+  revision: number,
+  componentsVersion: string,
+): SharePayload {
+  const session = sessionManager.get(sessionId);
+  if (!session) throw new Error(`Session ${sessionId} not found`);
+
+  const revInfo = session.revisions.find((r) => r.revision === revision);
+  if (!revInfo) throw new Error(`Revision ${revision} not found in session ${sessionId}`);
+
+  const canvasFiles: SharePayload["canvasFiles"] = [];
+  for (const cf of revInfo.canvasFiles) {
+    const compiledJs = sessionManager.getCompiled(sessionId, cf.filename, revision);
+    if (!compiledJs) {
+      throw new Error(`No compiled JS for ${cf.filename} at revision ${revision}`);
+    }
+    const sourceJsx = sessionManager.readRevisionJsx(sessionId, revision, cf.filename) ?? undefined;
+    canvasFiles.push({
+      filename: cf.filename,
+      compiledJs,
+      ...(sourceJsx ? { sourceJsx } : {}),
+    });
+  }
+
+  return {
+    version: 1,
+    origin: {
+      sessionId,
+      revision,
+      ...(revInfo.label ? { label: revInfo.label } : {}),
+      createdAt: revInfo.createdAt,
+    },
+    canvasFiles,
+    runtime: { componentsVersion },
+  };
+}
+
+/**
+ * POST the payload to the CF Worker. Returns the `shareId` + public URL
+ * assigned by the worker. Throws on any HTTP error — the caller is expected
+ * to surface the failure to the client (dialog) so the user can retry or
+ * fix their config.
+ */
+export async function pushShareToWorker(
+  payload: SharePayload,
+  config: ShareConfig,
+): Promise<ShareResponse> {
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  if (config.authToken) headers["Authorization"] = `Bearer ${config.authToken}`;
+
+  const res = await fetch(`${config.endpoint}/shares`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(payload),
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Share endpoint returned ${res.status}: ${text || res.statusText}`);
+  }
+  const data = (await res.json()) as { shareId?: string; url?: string; ownerToken?: string; expiresAt?: string };
+  if (!data.shareId || !data.url) {
+    throw new Error(`Share endpoint returned invalid response: ${JSON.stringify(data)}`);
+  }
+  return {
+    shareId: data.shareId,
+    url: data.url,
+    ...(data.ownerToken ? { ownerToken: data.ownerToken } : {}),
+    ...(data.expiresAt ? { expiresAt: data.expiresAt } : {}),
+  };
+}
+
+/**
+ * High-level: build payload, push to worker, record the share on the
+ * session. Returns the ShareEntry that was recorded.
+ */
+export async function shareRevision(
+  sessionManager: SessionManager,
+  sessionId: string,
+  revision: number,
+  config: ShareConfig,
+): Promise<ShareEntry> {
+  const payload = buildSharePayload(sessionManager, sessionId, revision, config.componentsVersion);
+  const response = await pushShareToWorker(payload, config);
+  const entry: ShareEntry = {
+    shareId: response.shareId,
+    url: response.url,
+    revision,
+    createdAt: new Date().toISOString(),
+    ...(response.ownerToken ? { ownerToken: response.ownerToken } : {}),
+    ...(response.expiresAt ? { expiresAt: response.expiresAt } : {}),
+  };
+  sessionManager.addShare(sessionId, entry);
+  return entry;
+}
+
+/**
+ * Revoke a share by calling the worker's owner-only delete endpoint. Removes
+ * it from the local session metadata on success.
+ */
+export async function revokeShare(
+  sessionManager: SessionManager,
+  sessionId: string,
+  shareId: string,
+  config: ShareConfig,
+): Promise<void> {
+  const session = sessionManager.get(sessionId);
+  const entry = session?.shares?.find((s) => s.shareId === shareId);
+  if (!entry) throw new Error(`Share ${shareId} not found`);
+  if (!entry.ownerToken) throw new Error("No owner token recorded for this share");
+
+  const res = await fetch(`${config.endpoint}/shares/${shareId}/revoke`, {
+    method: "POST",
+    headers: { "Authorization": `Bearer ${entry.ownerToken}` },
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Revoke failed: ${res.status} ${text}`);
+  }
+  sessionManager.removeShare(sessionId, shareId);
+}
+

package/daemon/src/websocket.ts

@@ -1,5 +1,5 @@
 import type { ServerWebSocket } from "bun";
-import type { SessionManager } from "./session";
+import type { SessionManager, RemoteFeedbackEntry } from "./session";
 
 export type WSData = { type: "browser" | "wait"; sessionId: string };
 
@@ -36,6 +36,19 @@ export function createWebSocketManager(sessionManager: SessionManager) {
     }
   }
 
+  function broadcastRemoteFeedback(sessionId: string, revision: number, entries: RemoteFeedbackEntry[]) {
+    const sockets = browserSockets.get(sessionId);
+    if (!sockets || sockets.size === 0) return;
+    const payload = JSON.stringify({
+      type: "remote-feedback",
+      revision,
+      entries,
+    });
+    for (const ws of sockets) {
+      ws.send(payload);
+    }
+  }
+
   function broadcastWatcherStatus(sessionId: string) {
     const sockets = browserSockets.get(sessionId);
     if (!sockets) return;
@@ -140,5 +153,5 @@ export function createWebSocketManager(sessionManager: SessionManager) {
     },
   };
 
-  return { handlers, broadcastPlanUpdate, broadcastRevisionUpdate, broadcastWatcherStatus };
+  return { handlers, broadcastPlanUpdate, broadcastRevisionUpdate, broadcastWatcherStatus, broadcastRemoteFeedback };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-canvas",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Interactive visual canvas for Claude Code — rich annotatable documents in the browser",
   "bin": {
     "agent-canvas": "bin/agent-canvas.js"
@@ -8,6 +8,7 @@
   "scripts": {
     "build": "bun daemon/build.ts",
     "typecheck": "tsc --noEmit && tsc --noEmit -p daemon/tsconfig.json",
+    "test": "bun test",
     "prepublishOnly": "bun daemon/build.ts"
   },
   "dependencies": {
@@ -28,6 +29,9 @@
     "type": "git",
     "url": "https://github.com/contember/agent-canvas"
   },
+  "workspaces": [
+    "workers/*"
+  ],
   "license": "MIT",
   "keywords": [
     "claude-code",

package/workers/canvas-share/README.md

@@ -0,0 +1,159 @@
+# canvas-share
+
+Cloudflare Worker that hosts shared agent-canvas snapshots.
+
+## Architecture
+
+- **R2 (`BLOBS`)** stores share payloads, compiled canvas JS, JSX source, and reviewer-uploaded annotation images.
+- **KV (`FEEDBACK`)** stores individual feedback entries (sortable keys for `since` queries) and rate limit counters (TTL 120s).
+- **Static assets (`ASSETS`)** serve runtime bundles (`runtime.js`, `components.js`, `preact-compat.js`, `client.js`, `client.css`) — these are mirrored from `daemon/dist/` automatically by `bun run build`.
+
+Validation is enforced with [Zod](https://zod.dev). Limits are centralized in [`src/types.ts`](src/types.ts).
+
+## Infrastructure as code
+
+The Cloudflare config is defined programmatically in [`oblaka.ts`](oblaka.ts)
+using [`oblaka-iac`](https://github.com/contember/oblaka). The committed
+[`oblaka.ts`](oblaka.ts) is the source of truth; `wrangler.jsonc` is
+auto-generated and **gitignored** — never edit it by hand.
+
+| Command | Generates | Used for |
+|---|---|---|
+| `bun run oblaka` | `wrangler.jsonc` (env `local`) | local dev via Miniflare |
+| `bun run oblaka:stage` | `wrangler.jsonc` (env `stage`) | staging deploy |
+| `bun run oblaka:prod` | `wrangler.jsonc` (env `prod`) | production deploy |
+
+`oblaka-iac` auto-prefixes R2 bucket and KV namespace names with the env
+(e.g. `canvas-share-blobs` becomes `stage-canvas-share-blobs`) so the same
+config produces isolated stage and prod resources.
+
+## Local development
+
+```bash
+cd workers/canvas-share
+bun install
+
+# Build daemon bundles AND auto-copy them into ./public/assets
+cd ../..
+bun run build
+
+# Start the worker locally via Miniflare (no Cloudflare account needed).
+# `bun run dev` runs `oblaka` first to regenerate wrangler.jsonc, then
+# starts wrangler dev --local.
+cd workers/canvas-share
+bun run dev
+
+# Point the daemon at it
+cd ../..
+CANVAS_SHARE_ENDPOINT=http://127.0.0.1:8787 bun bin/agent-canvas.ts daemon restart
+```
+
+Then click **Share** on any revision in the canvas UI.
+
+## Testing
+
+```bash
+cd workers/canvas-share
+bun test            # unit tests for validation, util
+bun run typecheck   # typecheck src/
+```
+
+## Continuous deployment
+
+The repo ships GitHub Actions workflows that deploy the worker automatically:
+
+| Workflow | Trigger | Env |
+|---|---|---|
+| `deploy-worker-stage.yml` | Push to `main` touching `workers/canvas-share/**`, `daemon/client/**`, or `daemon/build.ts` | `stage` |
+| `deploy-worker-prod.yml` | Version tag push (`v*`) | `prod` |
+
+Both call the reusable `deploy-worker.yml` which:
+
+1. Installs deps + builds the daemon runtime bundles (auto-mirrored into `public/assets/`)
+2. Runs `bunx oblaka oblaka.ts --env <env> --remote` to create or update the R2 bucket and KV namespace on Cloudflare
+3. Sets `SHARE_AUTH_TOKEN` via `wrangler secret bulk` (skipped if no token is configured for the env)
+4. Runs `bunx wrangler deploy`
+
+### Required GitHub secrets
+
+| Secret | Purpose |
+|---|---|
+| `CLOUDFLARE_API_TOKEN` | Token with Workers + R2 + KV permissions on the target account |
+| `CLOUDFLARE_ACCOUNT_ID` | Account id the worker deploys to |
+| `SHARE_AUTH_TOKEN_STAGE` | Bearer token daemons must use to POST to stage (optional) |
+| `SHARE_AUTH_TOKEN_PROD` | Bearer token daemons must use to POST to prod (optional) |
+
+Both stage and prod use the same Cloudflare account; oblaka auto-prefixes resource names so stage and prod get separate `stage-canvas-share-blobs` and `prod-canvas-share-blobs` buckets (same for KV).
+
+Use GitHub Environments (`Settings → Environments → stage / prod`) to gate prod deploys behind a manual approval if you want belt-and-suspenders safety.
+
+## Manual production deploy
+
+If you'd rather deploy by hand instead of via CI:
+
+1. (Recommended) Generate a shared bearer token to gate share creation:
+   ```bash
+   openssl rand -hex 32 | bunx wrangler secret put SHARE_AUTH_TOKEN --env prod
+   ```
+   Without this, anyone on the internet can pump shares into your R2 bucket.
+   Set the same value as `CANVAS_SHARE_AUTH_TOKEN` on the daemon side.
+
+2. (Optional) Override default 30-day share expiration:
+   ```bash
+   echo "604800" | bunx wrangler secret put SHARE_TTL_SECONDS --env prod  # 7 days
+   ```
+
+3. Build daemon bundles + deploy. The deploy script regenerates
+   `wrangler.jsonc` for the target env, then runs `wrangler deploy`.
+   The R2 bucket and KV namespace are created automatically by oblaka
+   on first deploy:
+   ```bash
+   cd ../..
+   bun run build
+   cd workers/canvas-share
+   bun run deploy:prod   # or deploy:stage
+   ```
+
+4. Configure the daemon:
+   ```bash
+   export CANVAS_SHARE_ENDPOINT=https://canvas-share.<subdomain>.workers.dev
+   export CANVAS_SHARE_AUTH_TOKEN=<the token you generated>
+   bunx agent-canvas daemon restart
+   ```
+
+The Share button in the canvas UI lights up once the daemon sees `CANVAS_SHARE_ENDPOINT`.
+
+## Endpoints
+
+| Method | Path                               | Purpose                                         | Auth                |
+|--------|------------------------------------|-------------------------------------------------|---------------------|
+| GET    | `/health`                          | Health check                                    | none                |
+| POST   | `/shares`                          | Create a new share                              | `SHARE_AUTH_TOKEN`  |
+| POST   | `/shares/:shareId/revoke`          | Revoke / delete a share                         | `ownerToken`        |
+| GET    | `/shares/:shareId/feedback?since=` | List feedback entries (called by daemon poller) | none (capability)   |
+| GET    | `/s/:shareId`                      | HTML shell for reviewers                        | none (capability)   |
+| GET    | `/s/:shareId/meta`                 | Share metadata                                  | none                |
+| GET    | `/s/:shareId/canvas/:filename`     | Serve compiled canvas JS / JSX source           | none                |
+| POST   | `/s/:shareId/feedback`             | Submit feedback (called by reviewer browser)    | none                |
+| POST   | `/s/:shareId/upload`               | Upload annotation image                         | none                |
+| GET    | `/s/:shareId/uploads/:filename`    | Serve uploaded image                            | none                |
+
+## Rate limits
+
+Per-IP, per-minute, sliding window (KV-backed). Tweak in [`src/types.ts`](src/types.ts).
+
+| Bucket          | Limit |
+|-----------------|-------|
+| Share creation  | 5/min |
+| Feedback POST   | 20/min/share |
+| Upload          | 30/min/share |
+
+## Security model
+
+- **Capability URLs** — anyone with `/s/:shareId` (24-char hex, ~96 bits entropy) has full view+comment access. Brute-forcing is impractical.
+- **Owner token** — returned to the daemon at create time, required to revoke. Stored in the daemon's session metadata so the canvas author can revoke from the Share dialog.
+- **Optional shared bearer token** (`SHARE_AUTH_TOKEN`) — gates share creation so only authorized daemons can push to the worker.
+- **No reviewer auth** — reviewers self-report a name (stored locally in their browser), there is no signup. Suitable for "send to a colleague" flows, **not** public publishing.
+- **Per-share TTL** — defaults to 30 days. Expired shares 404 and are eventually purged by KV's TTL.
+- **Size limits** — share payload max 2 MB, feedback body max 256 KB, image upload max 5 MB.
+- **Validation** — all incoming bodies are validated by Zod schemas before any storage write.

package/workers/canvas-share/oblaka.ts

@@ -0,0 +1,56 @@
+import { define, KVNamespace, R2Bucket, Worker } from 'oblaka-iac'
+
+/**
+ * Per-environment overrides. `local` is what `bunx oblaka oblaka.ts` uses
+ * when generating wrangler.jsonc for `wrangler dev --local`. `stage` and
+ * `prod` are picked when running `bunx oblaka oblaka.ts --env stage|prod`
+ * for actual Cloudflare deploys.
+ *
+ * Secrets (SHARE_AUTH_TOKEN, SHARE_TTL_SECONDS overrides, etc.) are NOT
+ * declared here — set them with `wrangler secret put` after deploy.
+ */
+const vars = {
+	local: {
+		// Empty share auth in local dev so smoke tests don't need a token.
+	},
+	stage: {},
+	prod: {},
+}
+
+export default define(({ env }) => {
+	if (!(env in vars)) {
+		throw new Error(`Unknown environment ${env}`)
+	}
+
+	const blobs = new R2Bucket({
+		name: 'canvas-share-blobs',
+	})
+
+	const feedback = new KVNamespace({
+		name: 'canvas-share-feedback',
+	})
+
+	return new Worker({
+		dir: '.',
+		name: 'canvas-share',
+		main: './src/index.ts',
+		compatibility_flags: ['nodejs_compat'],
+		compatibility_date: '2025-01-01',
+		observability: { enabled: true },
+		// Runtime bundles (preact-compat, runtime, components, client.js + css)
+		// are mirrored here from daemon/dist/ by `bun run build` in the repo
+		// root. The worker serves them via the ASSETS binding.
+		assets: {
+			directory: './public',
+			binding: 'ASSETS',
+		},
+		bindings: {
+			BLOBS: blobs,
+			FEEDBACK: feedback,
+		},
+		vars: {
+			ENVIRONMENT: env,
+			...vars[env as keyof typeof vars],
+		},
+	})
+})