Chat stays usable when the file service is off or down. Files up to 256 MB are hosted like chat; downloads try the host first and fall back to file-service tickets.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> [CI]
- all authorization rules (owner/creator, per-channel read/write grants, who may
remove whom, delete rules, structure management) live in ChannelPolicy; a test
fails if they are reimplemented elsewhere
- ChannelInfo carries what the caller may do (can_*), member and invitation lists
say who can be removed; clients display it and never derive it
- the host no longer stores or calls the file service: it only signs short-lived
tickets from space permissions (create/put/get/delete/domain), and keeps an opaque
fileDomain reference on the channel
- a whole file is registered in one request (last frame header + per-frame length and
digest) instead of one request per 1 MiB frame; the signed manifest still has to
match every digest
- drop file quota/threshold, receipts, reconcile and delete-queue code from the host
- contract generator emits constants for enums, error codes, token roles, permissions
and share states
- structure mutations returned the full structure to any member who could call them (moving an item after sending a message exposed channels the member has no access to)
- moving items now requires write access to the destination channel; new folders require an existing channel
- account avatars are only readable by the owner or accounts sharing a space
justmeandClaude Sonnet 5.5