code wiki / _hdl_build / nx_media_server.nx
`nx_media_server.nx` source

↩ module page · 948 lines · 65396 B
1// nx_media_server.nx -- SOVEREIGN media server (operator 2026-06-13: NO python, Nishi hardware-up).
2// Composes the PROVEN nx_http_server (socket/listen/accept/read/send) -- NO 3rd party. Serves the
3// /media browser + the FULL NAS library paginated (idx_*.wsl) + range-streamed files from the drvfs
4// NAS mounts (/mnt/nas_*). LAN-bound 0.0.0.0 (internal-network; operator-authorized 2026-06-16; PUBLIC-internet deferred to login-for-sites workstream). Fork-per-connection
5// for a concurrent grid. license_tier: ORIGINAL
6import "nx_syscalls.nx"
7import "nx_http_server.nx"
8import "nx_book_search_lib.nx"   // SC20: bks_search ranked library search (BM25)
9import "_pdf_reflow_lib.nx"      // R3b: PDF text layer -> reflowable mobile HTML (else fall back to page-images)
10import "nx_site_auth.nx"         // AUTH: the one S-class gate (nx_sa_validate over X-Nishi-Session, no cookie)
11import "hub/nx_modern_auth_flow.nx" // AUTH: nx_modern_auth_login + nx_auth_context_init + nx_uas_server_keys_load_or_init
12import "nx_base64.nx"            // AUTH: b64_encode the 152B session token
13import "nx_galx_authz.nx"        // /media SFW allowlist: galx_media_path_ok denies the owner-only nas_logging (recordings/NSFW = /gallery only)
14import "nx_media_cover_lib.nx"   // /api/cover: map a book path -> its EMBEDDED cover image on disk (extract-on-miss), shared with nx_media_cover_gate
15import "nx_token_counter.nx"   // tok_estimate + pack_text: /api/llmpack packs a book into a token-budgeted LLM context ("push a book into an LLM natively")
16import "nx_reader_zoomserve.nx" // /api/zoomprep: intelligent-zoom prep (tile pyramid + panel map per comic page; tiles then ride /api/book)
17import "nx_reader_sync.nx"      // R1 SYNC SPINE: /api/pos per-user position (Whispersync-class) + zero-JS auto-position on chapter fetches
18import "nx_reader_library.nx"   // shared/personal areas: rl_slug_guard/rl_may_access (isolation) + rl_list_personal_json + rl_promote_to_shared
19import "nx_manga_add.nx"        // POST /api/manga/add -> fork nx_manga_get into the caller's PRIVATE area
20import "nx_manga_search.nx"     // SOURCE BROWSER: /api/msearch (on-site search) /api/mfeed (chapters) /api/thumb (cover proxy)
21import "nx_manga_shelf_lib.nx"  // LOCAL SHELF: /api/shelf series->volumes catalog over the ALREADY-OWNED library (browse-before-download, local half)
22const MS_MAGIC_2000000: i64 = 2000000
23const MS_MAGIC_8192: i64 = 8192
24const MS_MAGIC_262144: i64 = 262144
25const MS_MAGIC_4096: i64 = 4096
26const MS_MAGIC_120000: i64 = 120000
27const MS_MAGIC_900000: i64 = 900000
28const MS_MAGIC_16777216: i64 = 16777216
29const MS_MAGIC_5000: i64 = 5000
30const MS_MAGIC_65536: i64 = 65536
31const MS_MAGIC_1469598103: i64 = 1469598103
32const MS_MAGIC_72057594037927931: i64 = 72057594037927931
33const MS_MAGIC_4194304: i64 = 4194304
34const MS_MAGIC_1024: i64 = 1024
35const MS_MAGIC_32768: i64 = 32768
36const MS_MAGIC_2097152: i64 = 2097152
37const MS_MAGIC_86400: i64 = 86400
38
39const MS_PORT:    i64 = 8790
40const MS_BROWSER: *u8 = "knowledge/staging/media/browser.html"
41const MS_READER:  *u8 = "knowledge/staging/media/reader.html"
42const MS_CBX:     *u8 = "knowledge/staging/media/cbx.html"
43const MS_ZOOM:    *u8 = "knowledge/staging/media/zoom.html"   // organ-emitted by nx_reader_zoom_emit (guided-view tile zoom)
44const MS_MANGA:   *u8 = "knowledge/staging/media/manga.html"  // organ-emitted by nx_manga_ui_emit (add + personal library UI)
45const MS_SHELF:   *u8 = "knowledge/staging/media/shelf.html"  // organ-emitted by nx_manga_shelf_emit (LOCAL comics/manga series browse)
46const MS_HEALTH:  *u8 = "knowledge/staging/media/health.html"       // organ-emitted by nx_media_health_emit (media-liveness dashboard)
47const MS_HEALTH_JSON: *u8 = "knowledge/staging/media/mediahealth.json"  // written by nx_movie_probe --sweep
48const MS_READER_ROOT: *u8 = "knowledge/staging/media/reader/"
49
50func ms_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
51func ms_puts(s: *u8) -> i64 { sys_write(1, s, ms_slen(s)); return 0 }
52func ms_app(dst: *u8, off: i64, src: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { dst[off+i] = src[i]; i = i + 1 } return off + n }
53func ms_apps(dst: *u8, off: i64, s: *u8) -> i64 { return ms_app(dst, off, s, ms_slen(s)) }
54func ms_dec(dst: *u8, off: i64, v: i64) -> i64 { let t: *u8 = sys_mmap(28); var m: i64=v; var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1}; var i: i64=0; while i<k { dst[off+i]=t[k-1-i]; i=i+1 } return off+k }
55func ms_starts(p: *u8, plen: i64, pre: *u8) -> i64 { let m: i64 = ms_slen(pre); if m > plen { return 0 } var i: i64 = 0; while i < m { if p[i] != pre[i] { return 0 } i = i + 1 } return 1 }
56
57// extract ?key=value from a path/query into out (NUL-terminated); returns value length (0 if absent).
58func ms_qval(p: *u8, plen: i64, key: *u8, out: *u8, outcap: i64) -> i64 {
  let kl: i64 = ms_slen(key)
  var i: i64 = 0
  while i + kl + 1 <= plen {
      var hit: i64 = 1
      var j: i64 = 0
      while j < kl { if p[i+j] != key[j] { hit = 0; j = kl } else { j = j + 1 } }
      if hit == 1 { if p[i+kl] == (61 as u8) {
          var s: i64 = i + kl + 1
          var o: i64 = 0
          while s < plen { if p[s] == (38 as u8) { s = plen } else { if o < outcap - 1 { out[o] = p[s]; o = o + 1 } s = s + 1 } }
          out[o] = 0 as u8
          return o
      } }
      i = i + 1
  }
  out[0] = 0 as u8
  return 0
76}
77
78// URL-decode src[0..slen] into dst (NUL-term); returns dst length.
79func ms_urldec(src: *u8, slen: i64, dst: *u8) -> i64 {
  var i: i64 = 0
  var o: i64 = 0
  while i < slen {
      let c: i64 = src[i] as i64
      if c == 37 { if i + 2 < slen {
          let h1: i64 = src[i+1] as i64
          let h2: i64 = src[i+2] as i64
          var v1: i64 = h1 - 48; if h1 >= 97 { v1 = h1 - 87 } else { if h1 >= 65 { v1 = h1 - 55 } }
          var v2: i64 = h2 - 48; if h2 >= 97 { v2 = h2 - 87 } else { if h2 >= 65 { v2 = h2 - 55 } }
          dst[o] = ((v1 * 16) + v2) as u8; o = o + 1; i = i + 3
      } else { dst[o] = src[i]; o = o + 1; i = i + 1 } }
      else { if c == 43 { dst[o] = 32 as u8 } else { dst[o] = src[i] } o = o + 1; i = i + 1 }
  }
  dst[o] = 0 as u8
  return o
95}
96
97func ms_ctype(path: *u8) -> *u8 {
  let n: i64 = ms_slen(path)
  if n < 4 { return "application/octet-stream" as *u8 }
  let a: i64 = path[n-3] as i64; let b: i64 = path[n-2] as i64; let c: i64 = path[n-1] as i64
  if c == 103 { if b == 110 { return "image/png" as *u8 } if b == 112 { if a == 106 { return "image/jpeg" as *u8 } } if b == 102 { return "image/gif" as *u8 } }
  if c == 112 { if b == 52 { return "video/mp4" as *u8 } }
  if c == 118 { if b == 107 { return "video/x-matroska" as *u8 } if b == 109 { return "video/x-msvideo" as *u8 } }
  if c == 102 { if b == 100 { return "application/pdf" as *u8 } }
  if c == 108 { return "text/html; charset=utf-8" as *u8 }
  return "application/octet-stream" as *u8
107}
108
109// map ?type= to its idx file path
110func ms_idxpath(t: *u8) -> *u8 {
  if t[0] == (97 as u8) { return "knowledge/staging/media/idx_ai.wsl" as *u8 }       // ai
  if t[0] == (118 as u8) { return "knowledge/staging/media/idx_video.wsl" as *u8 }   // video
  if t[0] == (112 as u8) { return "knowledge/staging/media/idx_photo.wsl" as *u8 }   // photo
  if t[0] == (98 as u8) { return "knowledge/staging/media/idx_book.wsl" as *u8 }     // book
  if t[0] == (115 as u8) { return "knowledge/staging/media/idx_stl.wsl" as *u8 }     // stl
  return "knowledge/staging/media/idx_ai.wsl" as *u8
117}
118
119// /api/list?type=&offset=&limit= -> JSON {total, items:[{n,p}]}
120func ms_handle_list(cfd: i64, p: *u8, plen: i64) -> i64 {
  let tb: *u8 = sys_mmap(16); ms_qval(p, plen, "type" as *u8, tb, 16)
  if tb[0] == (0 as u8) { tb[0] = 97 as u8; tb[1] = 0 as u8 }
  let ob: *u8 = sys_mmap(16); ms_qval(p, plen, "offset" as *u8, ob, 16)
  var off: i64 = 0; var oi: i64 = 0; while ob[oi] != (0 as u8) { off = off*10 + (ob[oi]-48); oi = oi + 1 }
  let lim: i64 = 120
  let lenbox: *i64 = sys_mmap(8) as *i64
  let buf: *u8 = sys_read_file(ms_idxpath(tb), lenbox)
  let blen: i64 = lenbox[0]
  let out: *u8 = sys_mmap(MS_MAGIC_2000000)
  var w: i64 = 0
  w = ms_apps(out, w, "{\"items\":[" as *u8)
  var line: i64 = 0
  var i: i64 = 0
  var emitted: i64 = 0
  while i < blen {
      let ls: i64 = i
      var le: i64 = ls
      var stop: i64 = 0
      while stop == 0 { if le >= blen { stop = 1 } else { if buf[le] == (10 as u8) { stop = 1 } else { le = le + 1 } } }
      var ce: i64 = le
      if ce > ls { if buf[ce-1] == (13 as u8) { ce = ce - 1 } }
      if ce > ls {
          if line >= off { if emitted < lim {
              var bn: i64 = ls
              var x: i64 = ls
              while x < ce { if buf[x] == (47 as u8) { bn = x + 1 } x = x + 1 }
              if emitted > 0 { w = ms_apps(out, w, "," as *u8) }
              w = ms_apps(out, w, "{\"n\":\"" as *u8)
              var y: i64 = bn
              while y < ce { let ch: i64 = buf[y] as i64; if ch == 34 { w = ms_apps(out, w, "\\\"" as *u8) } else { out[w] = buf[y]; w = w + 1 } y = y + 1 }
              w = ms_apps(out, w, "\",\"p\":\"" as *u8)
              y = ls
              while y < ce { let ch: i64 = buf[y] as i64; if ch == 34 { w = ms_apps(out, w, "\\\"" as *u8) } else { out[w] = buf[y]; w = w + 1 } y = y + 1 }
              w = ms_apps(out, w, "\"}" as *u8)
              emitted = emitted + 1
          } }
          line = line + 1
      }
      i = le + 1
  }
  w = ms_apps(out, w, "],\"total\":" as *u8)
  w = ms_dec(out, w, line)
  w = ms_apps(out, w, "}" as *u8)
  let hdr: *u8 = sys_mmap(256); var h: i64 = 0
  h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: " as *u8)
  h = ms_dec(hdr, h, w)
  h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h)
  sys_write(cfd, out, w)
  sys_close(cfd)
  return 0
172}
173
174// /file?p=<urlenc nas path> -> stream with Range
175func ms_handle_file(cfd: i64, p: *u8, plen: i64, req: *u8, reqn: i64) -> i64 {
  let enc: *u8 = sys_mmap(MS_MAGIC_8192); let el: i64 = ms_qval(p, plen, "p" as *u8, enc, MS_MAGIC_8192)
  let path: *u8 = sys_mmap(MS_MAGIC_8192); ms_urldec(enc, el, path)
  // allowlist: a NAS path EXCEPT the owner-only recordings/NSFW (/mnt/nas_logging) -- /media is SFW-for-everyone
  if galx_media_path_ok(path, ms_slen(path)) == 0 { let d: *u8 = "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { let d: *u8 = "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  let sz: i64 = sys_lseek(fd, 0, 2)
  sys_lseek(fd, 0, 0)
  // parse Range: bytes=START-
  var start: i64 = 0; var isrange: i64 = 0
  var ri: i64 = 0
  while ri + 6 < reqn { if req[ri]==(82 as u8) { if req[ri+1]==(97 as u8) { if req[ri+2]==(110 as u8) { if req[ri+3]==(103 as u8) { if req[ri+4]==(101 as u8) { if req[ri+5]==(58 as u8) {
      var s: i64 = ri + 6; while s < reqn { if req[s] == (61 as u8) { s = s + 1; isrange = 1; while s < reqn { if req[s] >= 48 { if req[s] <= 57 { start = start*10 + (req[s]-48); s = s + 1 } else { s = reqn } } else { s = reqn } } } else { s = s + 1 } }
      ri = reqn
  } } } } } } ri = ri + 1 }
  let hdr: *u8 = sys_mmap(512); var h: i64 = 0
  let ct: *u8 = ms_ctype(path)
  if isrange == 1 {
      sys_lseek(fd, start, 0)
      let endb: i64 = sz - 1; let length: i64 = sz - start
      h = ms_apps(hdr, h, "HTTP/1.1 206 Partial Content\r\nContent-Type: " as *u8); h = ms_apps(hdr, h, ct)
      h = ms_apps(hdr, h, "\r\nAccept-Ranges: bytes\r\nContent-Range: bytes " as *u8)
      h = ms_dec(hdr, h, start); h = ms_apps(hdr, h, "-" as *u8); h = ms_dec(hdr, h, endb); h = ms_apps(hdr, h, "/" as *u8); h = ms_dec(hdr, h, sz)
      h = ms_apps(hdr, h, "\r\nContent-Length: " as *u8); h = ms_dec(hdr, h, length); h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  } else {
      h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: " as *u8); h = ms_apps(hdr, h, ct)
      h = ms_apps(hdr, h, "\r\nAccept-Ranges: bytes\r\nContent-Length: " as *u8); h = ms_dec(hdr, h, sz); h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  }
  sys_write(cfd, hdr, h)
  let chunk: *u8 = sys_mmap(MS_MAGIC_262144)
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, chunk, MS_MAGIC_262144); if r <= 0 { go = 0 } else { sys_write(cfd, chunk, r) } }
  sys_close(fd); sys_close(cfd)
  return 0
210}
211
212// 1 if hay[0..hl] contains the needle (used to reject ".." path traversal)
213func ms_contains(hay: *u8, hl: i64, needle: *u8) -> i64 {
  let nl: i64 = ms_slen(needle)
  if nl == 0 { return 0 }
  var i: i64 = 0
  while i + nl <= hl {
      var k: i64 = 0; var hit: i64 = 1
      while k < nl { if hay[i+k] != needle[k] { hit = 0; k = nl } else { k = k + 1 } }
      if hit == 1 { return 1 }
      i = i + 1
  }
  return 0
224}
225
226// serve a static text/html file at a fixed repo path (clone of ms_serve_browser, path-parameterized)
227func ms_serve_static(cfd: i64, path: *u8, ctype: *u8) -> i64 {
  let lenbox: *i64 = sys_mmap(8) as *i64
  let body: *u8 = sys_read_file(path, lenbox)
  let blen: i64 = lenbox[0]
  if (body as i64) == 0 { let d: *u8 = "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  let hdr: *u8 = sys_mmap(256); var h: i64 = 0
  h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: " as *u8); h = ms_apps(hdr, h, ctype)
  h = ms_apps(hdr, h, "\r\nCache-Control: no-store\r\nContent-Length: " as *u8)
  h = ms_dec(hdr, h, blen); h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h)
  if blen > 0 { sys_write(cfd, body, blen) }
  sys_close(cfd)
  return 0
240}
241
242// /api/book?p=<urlenc relpath under knowledge/staging/media/reader/> -> serve the reader model/text.
243// ALLOWLIST: caller-supplied p is prefixed with MS_READER_ROOT here, so any path escaping the reader
244// dir requires "..". We reject "../" defensively. .json -> application/json; else text/plain utf-8.
245func ms_handle_book(cfd: i64, p: *u8, plen: i64) -> i64 {
  let enc: *u8 = sys_mmap(MS_MAGIC_4096); let el: i64 = ms_qval(p, plen, "p" as *u8, enc, MS_MAGIC_4096)
  let rel: *u8 = sys_mmap(MS_MAGIC_4096); ms_urldec(enc, el, rel)
  if ms_contains(rel, ms_slen(rel), ".." as *u8) == 1 { let d: *u8 = "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  // build full repo-relative path = MS_READER_ROOT + rel  (already rooted under reader/ so just strip a leading "reader/")
  let full: *u8 = sys_mmap(MS_MAGIC_8192); var fo: i64 = 0
  // rel typically begins "reader/<slug>/..."; map that onto knowledge/staging/media/reader/<slug>/...
  fo = ms_apps(full, fo, "knowledge/staging/media/" as *u8)
  fo = ms_apps(full, fo, rel)
  full[fo] = 0 as u8
  // enforce the allowlist root prefix
  if ms_starts(full, fo, MS_READER_ROOT) == 0 { let d: *u8 = "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  // content type: .json -> application/json; image/* via ms_ctype (jpg/png/gif/webp); else text/plain.
  // RUNG 3: cbx page<NNN>.jpg / .png must return image/* so the browser renders + zooms them natively.
  var ct: *u8 = ms_ctype(full)
  if fo >= 5 { if full[fo-1] == (110 as u8) { if full[fo-2] == (111 as u8) { if full[fo-3] == (115 as u8) { if full[fo-4] == (106 as u8) { ct = "application/json; charset=utf-8" as *u8 } } } } }
  // ms_ctype returns octet-stream for unknown (e.g. .txt chapters) -> fall back to text/plain for the reader.
  if ms_starts(ct, ms_slen(ct), "application/octet-stream" as *u8) == 1 { ct = "text/plain; charset=utf-8" as *u8 }
  let fd: i64 = sys_openat_rd(full)
  if fd < 0 { let d: *u8 = "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  let sz: i64 = sys_lseek(fd, 0, 2)
  sys_lseek(fd, 0, 0)
  let hdr: *u8 = sys_mmap(256); var h: i64 = 0
  h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: " as *u8); h = ms_apps(hdr, h, ct)
  h = ms_apps(hdr, h, "\r\nCache-Control: no-store\r\nContent-Length: " as *u8); h = ms_dec(hdr, h, sz); h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h)
  let chunk: *u8 = sys_mmap(MS_MAGIC_262144)
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, chunk, MS_MAGIC_262144); if r <= 0 { go = 0 } else { sys_write(cfd, chunk, r) } }
  sys_close(fd); sys_close(cfd)
  return 0
276}
277
278// SECURITY: a slug must be a single safe path component -- alnum / _ / - ONLY (no "/" or "." -> no traversal, no dotfiles).
279func ms_slug_safe(s: *u8) -> i64 {
  let n: i64 = ms_slen(s)
  if n <= 0 { return 0 }
  if n > 200 { return 0 }
  var i: i64 = 0
  while i < n {
      let c: i64 = s[i] as i64
      var ok: i64 = 0
      if c >= 48 { if c <= 57 { ok = 1 } }    // 0-9
      if c >= 65 { if c <= 90 { ok = 1 } }    // A-Z
      if c >= 97 { if c <= 122 { ok = 1 } }   // a-z
      if c == 95 { ok = 1 }                   // _
      if c == 45 { ok = 1 }                   // -
      if ok == 0 { return 0 }
      i = i + 1
  }
  return 1
296}
297
298// /api/llmpack?slug=<slug>&budget=<N> -> concat the book's chap<N>.txt, pack into a TOKEN BUDGET (sovereign
299// nx_token_counter, never overflows the window), return an LLM-ready context as a download. The "push a book into
300// an LLM natively" endpoint. Auth-gated (under /api/). Slug strictly validated. Comics (cbx, no chap files) -> 404.
301func ms_handle_llmpack(cfd: i64, p: *u8, plen: i64) -> i64 {
  let sb: *u8 = sys_mmap(256); ms_qval(p, plen, "slug" as *u8, sb, 256)
  if ms_slug_safe(sb) == 0 { let d: *u8 = "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  let bbu: *u8 = sys_mmap(32); ms_qval(p, plen, "budget" as *u8, bbu, 32)
  var budget: i64 = 0; var bi: i64 = 0
  while bbu[bi] != (0 as u8) { let c: i64 = bbu[bi] as i64; if c >= 48 { if c <= 57 { budget = budget*10 + (c-48) } } bi = bi + 1 }
  if budget <= 0 { budget = MS_MAGIC_120000 }
  if budget > MS_MAGIC_900000 { budget = MS_MAGIC_900000 }
  // concat chapters reader/<slug>/chap<N>.txt until the first missing one
  let bigcap: i64 = MS_MAGIC_16777216
  let big: *u8 = sys_mmap(bigcap); var bn: i64 = 0
  var ci: i64 = 0; var go: i64 = 1
  while go == 1 {
      let path: *u8 = sys_mmap(512); var po: i64 = 0
      po = ms_apps(path, po, "knowledge/staging/media/reader/" as *u8)
      po = ms_apps(path, po, sb)
      po = ms_apps(path, po, "/chap" as *u8)
      po = ms_dec(path, po, ci)
      po = ms_apps(path, po, ".txt" as *u8)
      path[po] = 0 as u8
      let szp: *i64 = sys_mmap(16) as *i64
      let cb: *u8 = sys_read_file(path, szp)
      if (cb as i64) == 0 { go = 0 } else {
          let cn: i64 = szp[0]
          if bn + cn + 4 < bigcap {
              var k: i64 = 0
              while k < cn { big[bn] = cb[k]; bn = bn + 1; k = k + 1 }
              big[bn] = 10 as u8; bn = bn + 1; big[bn] = 10 as u8; bn = bn + 1
          } else { go = 0 }
          ci = ci + 1
          if ci > MS_MAGIC_5000 { go = 0 }
      }
  }
  if bn == 0 { let d: *u8 = "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0 }
  let cap: i64 = (budget * 9) / 10
  let bodycap: i64 = budget * 8 + MS_MAGIC_65536
  let body: *u8 = sys_mmap(bodycap)
  let incl: *i64 = sys_mmap(16) as *i64; let omit: *i64 = sys_mmap(16) as *i64
  pack_text(big, bn, cap, body, bodycap, incl, omit)
  let blen: i64 = ms_slen(body)
  let hdr: *u8 = sys_mmap(512); var h: i64 = 0
  h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Disposition: attachment; filename=\"" as *u8)
  h = ms_apps(hdr, h, sb)
  h = ms_apps(hdr, h, "-llm.txt\"\r\nCache-Control: no-store\r\nContent-Length: " as *u8)
  h = ms_dec(hdr, h, blen)
  h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h)
  sys_write(cfd, body, blen)
  sys_close(cfd)
  return 0
351}
352
353func ms_serve_browser(cfd: i64) -> i64 {
  let lenbox: *i64 = sys_mmap(8) as *i64
  let body: *u8 = sys_read_file(MS_BROWSER, lenbox)
  let blen: i64 = lenbox[0]
  let hdr: *u8 = sys_mmap(256); var h: i64 = 0
  h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: " as *u8)
  h = ms_dec(hdr, h, blen); h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h)
  if blen > 0 { sys_write(cfd, body, blen) }
  sys_close(cfd)
  return 0
364}
365
366// /api/remove?p= -> append a SOFT-DELETE PROPOSAL (additive, rule 13: NEVER delete the NAS file)
367func ms_handle_remove(cfd: i64, p: *u8, plen: i64) -> i64 {
  let enc: *u8 = sys_mmap(MS_MAGIC_8192); let el: i64 = ms_qval(p, plen, "p" as *u8, enc, MS_MAGIC_8192)
  let path: *u8 = sys_mmap(MS_MAGIC_8192); ms_urldec(enc, el, path)
  if galx_media_path_ok(path, ms_slen(path)) == 1 {
      let fd: i64 = sys_openat_append("knowledge/staging/media/removals.tsv" as *u8, 420)
      if fd >= 0 { sys_write(fd, path, ms_slen(path)); sys_write(fd, "\tproposed-soft-delete\n" as *u8, ms_slen("\tproposed-soft-delete\n" as *u8)); sys_close(fd) }
  }
  let r: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 8\r\nConnection: close\r\n\r\n{\"ok\":1}"
  sys_write(cfd, r, ms_slen(r)); sys_close(cfd)
  return 0
377}
378
379func ms_hexc(d: i64) -> i64 { if d < 10 { return 48 + d } return 87 + d }
380// deterministic, filesystem-safe slug from a path: "b" + 14 hex of a bounded polynomial hash.
381func ms_pathslug(p: *u8, n: i64, out: *u8) -> i64 {
  var h: i64 = MS_MAGIC_1469598103
  var i: i64 = 0
  while i < n { h = (h * 131 + (p[i] as i64)) % MS_MAGIC_72057594037927931; i = i + 1 }
  if h < 0 { h = 0 - h }
  out[0] = 98 as u8
  let tmp: *u8 = sys_mmap(32)
  var k: i64 = 0; var hh: i64 = h
  while k < 14 { tmp[k] = ms_hexc(hh % 16) as u8; hh = hh / 16; k = k + 1 }
  var j: i64 = 0
  while j < 14 { out[1 + j] = tmp[13 - j]; j = j + 1 }
  out[15] = 0 as u8
  return 15
394}
395// fork+exec an extractor (argv = <path> <slug>), wait, then report 1 if the target json now exists, else 0.
396// Shared by the EPUB/CBX/KINDLE open paths so the kindle chain can try kf8 THEN mobi without duplicating fork glue.
397func ms_run_extractor(extractor: *u8, path: *u8, slug: *u8, target: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      let av: *i64 = sys_mmap(64) as *i64
      av[0] = extractor as i64
      av[1] = path as i64
      av[2] = slug as i64
      av[3] = 0
      sys_execve(extractor, av, 0 as *i64)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(8) as *i64
  sys_wait4(pid, st, 0)
  let tfd: i64 = sys_openat_rd(target)
  if tfd >= 0 { sys_close(tfd); return 1 }
  return 0
413}
414
415// /api/open?p=<urlenc book path> -> EXTRACT-ON-DEMAND then 302 to the right reader.
416// EPUB -> nx_epub_book -> /reader ; KINDLE (mobi/azw/azw3/prc) -> nx_kf8_book||nx_mobi_book -> /reader ;
417// CBZ/CBR/CB7/PDF -> nx_cbx_pages (magic-sniffing: zip / rar4+rar5 STORE / pdf DCTDecode) -> /cbx. Cached
418// by slug. If extraction yields nothing (DRM, compressed-rar/7z honest-unsupported, vector/text PDF)
419// -> 302 /file (raw download, never a dead end).
420func ms_handle_open(cfd: i64, p: *u8, plen: i64) -> i64 {
  let raw: *u8 = sys_mmap(MS_MAGIC_8192); let rl: i64 = ms_qval(p, plen, "p" as *u8, raw, MS_MAGIC_8192)
  let path: *u8 = sys_mmap(MS_MAGIC_8192); let pn: i64 = ms_urldec(raw, rl, path)
  var dot: i64 = 0 - 1; var x: i64 = 0
  while x < pn { if path[x] == (46 as u8) { dot = x } x = x + 1 }
  var kind: i64 = 0                                   // 1=epub 2=cbz 3=pdf 4=kindle(mobi/azw/azw3/prc) 5=html 6=rtf 0=other
  if dot >= 0 {
      let e1: i64 = (path[dot+1] as i64) | 32
      let e2: i64 = (path[dot+2] as i64) | 32
      let e3: i64 = (path[dot+3] as i64) | 32
      if e1 == 101 { if e2 == 112 { if e3 == 117 { kind = 1 } } }   // epu(b)
      if e1 == 99  { if e2 == 98  { if e3 == 122 { kind = 2 } } }   // cb(z)
      if e1 == 99  { if e2 == 98  { if e3 == 114 { kind = 2 } } }   // cb(r) -> same extractor: it sniffs MAGIC (zip-lie / rar4 / rar5 STORE)
      if e1 == 99  { if e2 == 98  { if e3 == 55  { kind = 2 } } }   // cb(7) -> sniffed; 7z logs honest-unsupported -> falls to /file
      if e1 == 112 { if e2 == 100 { if e3 == 102 { kind = 3 } } }   // pdf
      // KINDLE family -> sovereign nx_kf8_book / nx_mobi_book chain (kind 4). .azw and .azw3 share the first
      // three letters (a,z,w) so one rule covers both; the kf8/mobi fallback sorts MOBI6 vs KF8 at extract time.
      if e1 == 109 { if e2 == 111 { if e3 == 98  { kind = 4 } } }   // mob(i)
      if e1 == 97  { if e2 == 122 { if e3 == 119 { kind = 4 } } }   // azw / azw3
      if e1 == 112 { if e2 == 114 { if e3 == 99  { kind = 4 } } }   // prc
      if e1 == 104 { if e2 == 116 { if e3 == 109 { kind = 5 } } }   // htm(l) -> nx_html_book -> reflow text reader
      if e1 == 114 { if e2 == 116 { if e3 == 102 { kind = 6 } } }   // rtf -> nx_rtf_book -> reflow text reader
  }
  let hdr: *u8 = sys_mmap(MS_MAGIC_8192); var h: i64 = 0
  if kind == 0 {
      h = ms_apps(hdr, h, "HTTP/1.1 302 Found\r\nLocation: /file?p=" as *u8)
      var qi2: i64 = 0; while qi2 < rl { hdr[h] = raw[qi2]; h = h + 1; qi2 = qi2 + 1 }
      h = ms_apps(hdr, h, "\r\nContent-Length: 0\r\nConnection: close\r\n\r\n" as *u8)
      sys_write(cfd, hdr, h); sys_close(cfd); return 0
  }
  // R3b: PDF -> sovereign TEXT reflow for mobile. A born-digital PDF with a real text layer is served as
  // reflowable HTML directly; a scanned/image PDF (little/no text) falls through to the page-image path below.
  if kind == 3 {
      if galx_media_path_ok(path, pn) == 1 {
          let plen2: *i64 = sys_mmap(8) as *i64
          let pdfb: *u8 = sys_read_file(path, plen2)
          if (pdfb as i64) != 0 { if plen2[0] > 0 {
              let rhtml: *u8 = sys_mmap(MS_MAGIC_4194304)
              let rtxt: *u8 = sys_mmap(MS_MAGIC_4194304)
              let rdec: *u8 = sys_mmap(MS_MAGIC_4194304)
              let rtc: *i64 = sys_mmap(8) as *i64
              let rwlen: i64 = pr_pdf_to_reflow(pdfb, plen2[0], rhtml, rtxt, rdec, rtc)
              if rtc[0] >= 400 {
                  let rh: *u8 = sys_mmap(256); var rho: i64 = 0
                  rho = ms_apps(rh, rho, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nCache-Control: no-store\r\nContent-Length: " as *u8)
                  rho = ms_dec(rh, rho, rwlen)
                  rho = ms_apps(rh, rho, "\r\nConnection: close\r\n\r\n" as *u8)
                  sys_write(cfd, rh, rho)
                  sys_write(cfd, rhtml, rwlen)
                  sys_close(cfd)
                  return 0
              }
          } }
      }
  }
  var extractor: *u8 = "./_offc/nx_epub_book.elf" as *u8
  var tjson: *u8 = "/book.json" as *u8
  var route: *u8 = "/library/reader?slug=" as *u8   // /library-prefixed: a redirect Location is resolved by the browser against the origin, NOT <base>, so it must carry the prefix explicitly
  // CBX (image) route is ONLY comics/scans: cbz (2) + pdf-fallback (3). EPUB (1) + KINDLE (4) are reflowable
  // text -> the book.json reader route. (Was `kind != 1` which wrongly routed kindle text to the image viewer.)
  // comics/scans now DEFAULT to the intelligent tiled-zoom reader (/zoom = guided view + per-user resume);
  // the flat /cbx viewer stays reachable manually at /library/cbx?slug=<slug>.
  if kind == 2 { extractor = "./_offc/nx_cbx_pages.elf" as *u8; tjson = "/cbx.json" as *u8; route = "/library/zoom?slug=" as *u8 }
  if kind == 3 { extractor = "./_offc/nx_cbx_pages.elf" as *u8; tjson = "/cbx.json" as *u8; route = "/library/zoom?slug=" as *u8 }
  if kind == 5 { extractor = "./_offc/nx_html_book.elf" as *u8 }   // .html/.htm -> reflow text reader (route+tjson default to reader/book.json)
  if kind == 6 { extractor = "./_offc/nx_rtf_book.elf" as *u8 }    // .rtf -> reflow text reader
  let slug: *u8 = sys_mmap(32); ms_pathslug(path, pn, slug)
  let cp: *u8 = sys_mmap(256); var c: i64 = 0
  c = ms_apps(cp, c, "knowledge/staging/media/reader/" as *u8)
  var si: i64 = 0; while slug[si] != (0 as u8) { cp[c] = slug[si]; c = c + 1; si = si + 1 }
  c = ms_apps(cp, c, tjson); cp[c] = 0 as u8
  // IMAGE-BOOK fast path (kind 1/4): a book already PROMOTED to the zoom viewer carries reader/<slug>/
  // cbx.json ("cfix":2). Route straight to zoom -- the text-reader cache dance is for prose. A stale
  // pre-cfix cbx.json is UNLINKED here so it can never fake a promote downstream.
  let czp: *u8 = sys_mmap(256); var cz: i64 = 0
  cz = ms_apps(czp, cz, "knowledge/staging/media/reader/" as *u8)
  var szi: i64 = 0; while slug[szi] != (0 as u8) { czp[cz] = slug[szi]; cz = cz + 1; szi = szi + 1 }
  cz = ms_apps(czp, cz, "/cbx.json" as *u8); czp[cz] = 0 as u8
  var kindtext: i64 = 0
  if kind == 1 { kindtext = 1 }
  if kind == 4 { kindtext = 1 }
  if kindtext == 1 {
      let zfd: i64 = sys_openat_rd(czp)
      if zfd >= 0 {
          let zb: *u8 = sys_mmap(MS_MAGIC_262144); let zn: i64 = sys_read(zfd, zb, MS_MAGIC_262144); sys_close(zfd)
          var zok: i64 = 0
          if zn > 0 { if ms_contains(zb, zn, "\"cfix\":2" as *u8) == 1 { zok = 1 } }
          if zok == 1 {
              let hz: *u8 = sys_mmap(MS_MAGIC_8192); var ho: i64 = 0
              ho = ms_apps(hz, ho, "HTTP/1.1 302 Found\r\nLocation: /library/zoom?slug=" as *u8)
              var qz: i64 = 0; while slug[qz] != (0 as u8) { hz[ho] = slug[qz]; ho = ho + 1; qz = qz + 1 }
              ho = ms_apps(hz, ho, "\r\nContent-Length: 0\r\nConnection: close\r\n\r\n" as *u8)
              sys_write(cfd, hz, ho); sys_close(cfd); return 0
          }
          __syscall(263, 0 - 100, czp, 0, 0, 0, 0)   // stale pre-cfix promote -> remove, re-derive below
      }
  }
  var have: i64 = 0
  let tfd0: i64 = sys_openat_rd(cp)
  if tfd0 >= 0 {
      // CACHE-HEAL: a TEXT book (epub=1 / kindle=4) only counts as cached if its book.json carries the CURRENT
      // reader-fix schema (\"rfix\":1). An older cache (mojibake / "Chapter N" titles / stripped links, extracted
      // before this fix) is treated as a MISS so it re-extracts with the fixed extractor -- self-healing, no remote
      // rm. CBX comics (kind 2/3) carry the SAME self-heal via "cfix":2 (natural page order + per-page magic gate
      // + cbr): an older cbx.json without the current tag re-extracts on next open. (forked-per-request child:
      // the read buffer dies with the child, no leak.)
      if kind == 1 { let vb: *u8 = sys_mmap(MS_MAGIC_262144); let vn: i64 = sys_read(tfd0, vb, MS_MAGIC_262144); if vn > 0 { if ms_contains(vb, vn, "\"rfix\":1" as *u8) == 1 { have = 1 } } }
      else { if kind == 4 { let vb2: *u8 = sys_mmap(MS_MAGIC_262144); let vn2: i64 = sys_read(tfd0, vb2, MS_MAGIC_262144); if vn2 > 0 { if ms_contains(vb2, vn2, "\"rfix\":1" as *u8) == 1 { have = 1 } } }
      else { if kind == 2 { let vb3: *u8 = sys_mmap(MS_MAGIC_262144); let vn3: i64 = sys_read(tfd0, vb3, MS_MAGIC_262144); if vn3 > 0 { if ms_contains(vb3, vn3, "\"cfix\":2" as *u8) == 1 { have = 1 } } }
      else { if kind == 3 { let vb4: *u8 = sys_mmap(MS_MAGIC_262144); let vn4: i64 = sys_read(tfd0, vb4, MS_MAGIC_262144); if vn4 > 0 { if ms_contains(vb4, vn4, "\"cfix\":2" as *u8) == 1 { have = 1 } } }
      else { have = 1 } } } }
      sys_close(tfd0)
  }
  if have == 0 {
      // RE-EXTRACT NEEDED (missing OR stale pre-rfix cache). Remove any stale book.json FIRST so the kindle
      // kf8->mobi chain's existence-check is accurate: nx_kf8_book DECLINES a MOBI6 file WITHOUT writing book.json,
      // and a leftover stale book.json would otherwise fool ms_run_extractor into "kf8 succeeded" -> nx_mobi_book
      // never runs -> the stale (mojibake) MOBI cache is served forever. (Harmless for epub: it overwrites anyway.)
      __syscall(263, 0 - 100, cp, 0, 0, 0, 0)   // unlinkat(AT_FDCWD, cp)
      if kind == 4 {
          // KINDLE: try KF8/AZW3 first (handles dual + pure-KF8 files). nx_kf8_book DECLINES a MOBI6-only file
          // (returns before writing book.json) so the MOBI6 extractor then catches .mobi/.azw. DRM-protected
          // files make BOTH decline (no book.json) -> falls through to /file below. No dead end, no guessing.
          have = ms_run_extractor("./_offc/nx_kf8_book.elf" as *u8, path, slug, cp)
          if have == 0 { have = ms_run_extractor("./_offc/nx_mobi_book.elf" as *u8, path, slug, cp) }
      } else {
          have = ms_run_extractor(extractor, path, slug, cp)
      }
  }
  // IMAGE-BOOK PROMOTE (kind 1/4): text extraction SUCCEEDED, but the "book" may be a COMIC wearing
  // epub/kindle clothes (~190 full-res page images + ~150-byte anchor "chapters" -- the operator's
  // "epub type comic books dont load"). The promote organ inspects the extracted dir; image-dominant
  // -> cbx.json appears -> ZOOM viewer. Real prose exits 2 and stays on the text reader.
  if kindtext == 1 { if have == 1 {
      if ms_run_extractor("./_offc/nx_imgbook_promote.elf" as *u8, path, slug, czp) == 1 { route = "/library/zoom?slug=" as *u8 }
  } }
  // EPUB DECLINE FALLTHROUGH: an epub whose text extraction declined may still be a ZIP of page images
  // (fixed-layout comic). The magic-sniffing cbx extractor eats those; cbx.json -> zoom. Never a dead end.
  if kind == 1 { if have == 0 {
      have = ms_run_extractor("./_offc/nx_cbx_pages.elf" as *u8, path, slug, czp)
      if have == 1 { route = "/library/zoom?slug=" as *u8 }
  } }
  if have == 1 {
      h = ms_apps(hdr, h, "HTTP/1.1 302 Found\r\nLocation: " as *u8)
      h = ms_apps(hdr, h, route)
      var qi: i64 = 0; while slug[qi] != (0 as u8) { hdr[h] = slug[qi]; h = h + 1; qi = qi + 1 }
  } else {
      h = ms_apps(hdr, h, "HTTP/1.1 302 Found\r\nLocation: /file?p=" as *u8)
      var qj: i64 = 0; while qj < rl { hdr[h] = raw[qj]; h = h + 1; qj = qj + 1 }
  }
  h = ms_apps(hdr, h, "\r\nContent-Length: 0\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h)
  sys_close(cfd)
  return 0
574}
575
576// /api/cover?p=<urlenc book path> -> serve the book's EMBEDDED cover image (cached under reader/<slug>/, extracted
577// on-demand for epub/mobi/azw). No cover / unsupported -> 404 (the grid shows a text-title card); ".." -> 403. The
578// resolution + slug logic lives in nx_media_cover_lib (shared with the gate). This route is behind THE WALL, so a
579// cover is only served to an authenticated session -- the grid fetches it via fetch()+X-Nishi-Session (no-cookie).
580// ---- cover THUMBNAILS (S-class: never serve a full-res cover into the grid -- the gallery's gs_thumb pattern) ----
581// REUSE the gallery's proven thumbnailer. Cache-first (a cached thumb serves O(1)); cold -> fork decode->downscale->
582// encode to .new, atomic rename, serve; FALLBACK to full-res if the generator is absent/fails (zero-regression:
583// without nx_galx_thumb the grid behaves EXACTLY as before). Thumb cached alongside the cover as <cover>.t.jpg.
584const MS_THUMB_ELF: *u8 = "/volume1/ai/galx/nx_galx_thumb.elf"
585const MS_THUMB_MAX: *u8 = "384"
586func ms_fexists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
587func ms_thumb_run(src: *u8, outnew: *u8) -> i64 {
  let argv: *i64 = sys_mmap(48) as *i64
  argv[0] = MS_THUMB_ELF as i64; argv[1] = src as i64; argv[2] = outnew as i64; argv[3] = MS_THUMB_MAX as i64; argv[4] = 0
  let envp: *i64 = sys_mmap(8) as *i64; envp[0] = 0
  let pid: i64 = sys_fork()
  if pid == 0 { sys_execve(MS_THUMB_ELF, argv, envp); sys_exit(127) }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return (st[0] >> 8) & 0xff
596}
597func ms_cover_thumb(cfd: i64, full: *u8) -> i64 {
  let tpath: *u8 = sys_mmap(640)
  var o: i64 = ms_apps(tpath, 0, full); o = ms_apps(tpath, o, ".t.jpg" as *u8); tpath[o] = 0 as u8
  if ms_fexists(tpath) == 1 { return mc_serve_image(cfd, tpath) }   // cache hit -> O(1), no re-generation
  let tnew: *u8 = sys_mmap(640)
  var o2: i64 = ms_apps(tnew, 0, tpath); o2 = ms_apps(tnew, o2, ".new" as *u8); tnew[o2] = 0 as u8
  if ms_thumb_run(full, tnew) == 0 { __syscall(82, tnew as i64, tpath as i64, 0, 0, 0, 0) }   // atomic rename .new -> cache
  if ms_fexists(tpath) == 1 { return mc_serve_image(cfd, tpath) }
  return mc_serve_image(cfd, full)   // FALLBACK: generator absent/failed -> full-res (the grid is never broken)
606}
607
608func ms_handle_cover(cfd: i64, p: *u8, plen: i64) -> i64 {
  let enc: *u8 = sys_mmap(MS_MAGIC_8192); let el: i64 = ms_qval(p, plen, "p" as *u8, enc, MS_MAGIC_8192)
  let path: *u8 = sys_mmap(MS_MAGIC_8192); let pn: i64 = ms_urldec(enc, el, path)
  let full: *u8 = sys_mmap(512)
  let r: i64 = mc_cover_resolve(path, pn, full, 512)
  if r == 1 { return ms_cover_thumb(cfd, full) }
  if r < 0 { let d3: *u8 = "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d3, ms_slen(d3)); sys_close(cfd); return 0 }
  let d4: *u8 = "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"; sys_write(cfd, d4, ms_slen(d4)); sys_close(cfd); return 0
616}
617
618// /api/search?q=<urlenc> -> JSON {results:[{n,p,s}],n} ranked BM25 over the book library (SC20)
619func ms_handle_search(cfd: i64, p: *u8, plen: i64) -> i64 {
  let raw: *u8 = sys_mmap(MS_MAGIC_1024); let rl: i64 = ms_qval(p, plen, "q" as *u8, raw, MS_MAGIC_1024)
  let qb: *u8 = sys_mmap(MS_MAGIC_1024); ms_urldec(raw, rl, qb)
  let tb: *u8 = sys_mmap(16); ms_qval(p, plen, "type" as *u8, tb, 16)
  if tb[0] == (0 as u8) { tb[0] = 98 as u8; tb[1] = 0 as u8 }   // default 'b' (book)
  let res_off: *i64 = sys_mmap(256) as *i64
  let res_len: *i64 = sys_mmap(256) as *i64
  let res_score: *i64 = sys_mmap(256) as *i64
  let cnt: *i64 = sys_mmap(8) as *i64
  let bufi: i64 = bks_search(ms_idxpath(tb), qb, res_off, res_len, res_score, 20, cnt)
  let buf: *u8 = bufi as *u8
  let out: *u8 = sys_mmap(MS_MAGIC_2000000)
  var w: i64 = 0
  w = ms_apps(out, w, "{\"results\":[" as *u8)
  var i: i64 = 0
  while i < cnt[0] {
      let ls: i64 = res_off[i]
      let ce: i64 = res_off[i] + res_len[i]
      var bn: i64 = ls
      var x: i64 = ls
      while x < ce { if buf[x] == (47 as u8) { bn = x + 1 } x = x + 1 }
      if i > 0 { w = ms_apps(out, w, "," as *u8) }
      w = ms_apps(out, w, "{\"n\":\"" as *u8)
      var y: i64 = bn
      while y < ce { let ch: i64 = buf[y] as i64; if ch == 34 { w = ms_apps(out, w, "\\\"" as *u8) } else { out[w] = buf[y]; w = w + 1 } y = y + 1 }
      w = ms_apps(out, w, "\",\"p\":\"" as *u8)
      y = ls
      while y < ce { let ch: i64 = buf[y] as i64; if ch == 34 { w = ms_apps(out, w, "\\\"" as *u8) } else { out[w] = buf[y]; w = w + 1 } y = y + 1 }
      w = ms_apps(out, w, "\",\"s\":" as *u8)
      w = ms_dec(out, w, res_score[i])
      w = ms_apps(out, w, "}" as *u8)
      i = i + 1
  }
  w = ms_apps(out, w, "],\"n\":" as *u8)
  w = ms_dec(out, w, cnt[0])
  w = ms_apps(out, w, "}" as *u8)
  let hdr: *u8 = sys_mmap(256); var h: i64 = 0
  h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: " as *u8)
  h = ms_dec(hdr, h, w)
  h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h)
  sys_write(cfd, out, w)
  sys_close(cfd)
  return 0
663}
664
665// ---- AUTH (S-class Modern Auth, no-cookie; mirrors nx_status_daemon) --------------------------------
666func ms_body_off(req: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i + 4 <= n { if req[i]==(13 as u8) { if req[i+1]==(10 as u8) { if req[i+2]==(13 as u8) { if req[i+3]==(10 as u8) { return i + 4 } } } } i = i + 1 }
  return n
670}
671// find "name=" in body; set out_off/out_n to the raw (still %-encoded) value slice. 1/0.
672func ms_form_field(body: *u8, body_n: i64, name: *u8, name_n: i64, out_off: *i64, out_n: *i64) -> i64 {
  var pos: i64 = 0
  while pos < body_n {
      var m: i64 = 1
      if pos + name_n + 1 > body_n { m = 0 }
      if m == 1 { var i: i64 = 0; while i < name_n { if (body[pos+i] as i64) != (name[i] as i64) { m = 0; i = name_n } if i < name_n { i = i + 1 } } }
      if m == 1 { if (body[pos+name_n] as i64) != 61 { m = 0 } }
      var vend: i64 = pos; var scan: i64 = 1
      while scan == 1 { if vend >= body_n { scan = 0 } if scan == 1 { if (body[vend] as i64) == 38 { scan = 0 } } if scan == 1 { vend = vend + 1 } }
      if m == 1 { out_off[0] = pos + name_n + 1; out_n[0] = vend - (pos + name_n + 1); return 1 }
      pos = vend + 1
  }
  return 0
685}
686func ms_emit_401(cfd: i64) -> i64 {
  let d: *u8 = "HTTP/1.1 401 Unauthorized\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: 24\r\n\r\n{\"error\":\"unauthorized\"}" as *u8
  sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0
689}
690// POST /api/login: handle=<h>&passphrase=<p> (form-urlencoded) -> nx_modern_auth_login -> 200 {token} | 401
691func ms_login(ctx: *NxAuthContext, cfd: i64, req: *u8, req_n: i64) -> i64 {
  let body_off: i64 = ms_body_off(req, req_n)
  let body: *u8 = ((req as i64) + body_off) as *u8
  let body_n: i64 = req_n - body_off
  let hoff: *i64 = sys_mmap(8) as *i64; let hnn: *i64 = sys_mmap(8) as *i64
  let poff2: *i64 = sys_mmap(8) as *i64; let pnn: *i64 = sys_mmap(8) as *i64
  let out: *u8 = sys_mmap(MS_MAGIC_4096); var o: i64 = 0; var ok: i64 = 0
  if ms_form_field(body, body_n, "handle" as *u8, 6, hoff, hnn) == 1 {
      if ms_form_field(body, body_n, "passphrase" as *u8, 10, poff2, pnn) == 1 {
          let hbuf: *u8 = sys_mmap(256); let pbuf: *u8 = sys_mmap(512)
          let h_dec: i64 = ms_urldec(((body as i64)+hoff[0]) as *u8, hnn[0], hbuf)
          let p_dec: i64 = ms_urldec(((body as i64)+poff2[0]) as *u8, pnn[0], pbuf)
          if h_dec > 0 { if p_dec > 0 {
              let tok: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES)
              let tok_n: *i64 = sys_mmap(8) as *i64; tok_n[0] = 0
              if nx_modern_auth_login(ctx, hbuf, h_dec, pbuf, p_dec, tok, NX_MAUTH_SESSION_TOKEN_BYTES, tok_n) == NX_MAUTH_OK {
                  let b64: *u8 = sys_mmap(256)
                  let b64_n: i64 = b64_encode(tok, NX_MAUTH_SESSION_TOKEN_BYTES, b64)
                  o = ms_apps(out, o, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8)
                  o = ms_dec(out, o, 12 + b64_n)
                  o = ms_apps(out, o, "\r\n\r\n{\"token\":\"" as *u8)
                  var z: i64 = 0; while z < b64_n { out[o]=b64[z]; o=o+1; z=z+1 }
                  o = ms_apps(out, o, "\"}" as *u8)
                  ok = 1
              }
          } }
      }
  }
  if ok == 0 { o = ms_apps(out, 0, "HTTP/1.1 401 Unauthorized\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: 24\r\n\r\n{\"error\":\"unauthorized\"}" as *u8) }
  sys_write(cfd, out, o); sys_close(cfd)
  return 0
722}
723// the no-cookie SPA shell: login form -> token in sessionStorage -> all calls carry X-Nishi-Session
724func ms_shell(cfd: i64) -> i64 {
  // body FIRST so Content-Length is exact. PROTOCOL FIX (the /library "10s stall"): this was the ONE
  // response in the daemon without Content-Length -- EOF-delimited consumers (the edge buffered relay,
  // and every client behind it) had to wait ~10s for an idle-close to know the body ended. With the
  // exact length, clients complete immediately. Same pattern as every other handler in this file.
  let out: *u8 = sys_mmap(MS_MAGIC_32768); var o: i64 = 0
  o = ms_apps(out, o, "<!DOCTYPE html><!--nrbuild=7 +content-length-exact +session-ttl-24h+no-logout-on-transient+back-history--><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><base href=\"/library/\"><title>Nishi Library</title>" as *u8)
  o = ms_apps(out, o, "<style>body{font:15px system-ui,-apple-system,Segoe UI,sans-serif;margin:0;background:#0b1220;color:#e6edf6}#lg{max-width:330px;margin:12vh auto;padding:0 20px}#lg input{width:100%;padding:10px;margin:.4rem 0;box-sizing:border-box;border:1px solid #28406a;border-radius:7px;background:#0e1a30;color:#e6edf6}button{padding:10px 18px;border:0;border-radius:7px;background:#e8a534;color:#0b2545;font-weight:700}.e{color:#ff8a8a;min-height:1.2em}#hd{background:#0b2545;padding:10px 14px;display:flex;flex-wrap:wrap;gap:8px 12px;align-items:center;position:sticky;top:0;z-index:5}#hd b{font-size:1.05rem;white-space:nowrap}#q{flex:1 1 200px;min-width:0;padding:9px 12px;border-radius:8px;border:1px solid #28406a;background:#0e1a30;color:#e6edf6;font-size:1rem}#gr{display:grid;grid-template-columns:repeat(auto-fill,minmax(118px,1fr));gap:12px;padding:14px}.c{background:#13233f;border-radius:10px;overflow:hidden;cursor:pointer}.c img.cov{width:100%;aspect-ratio:2/3;object-fit:cover;display:none;background:#0e1a30}.c .t{padding:8px 9px;font-size:.74rem;line-height:1.3;word-break:break-word}@media(max-width:480px){#hd b{width:100%}#gr{grid-template-columns:repeat(auto-fill,minmax(102px,1fr));gap:9px;padding:10px}}</style>" as *u8)
  o = ms_apps(out, o, "<div id=lg><h2>&#128218; Nishi Library</h2><input id=h placeholder=handle autocomplete=username autofocus><input id=p type=password placeholder=passphrase autocomplete=current-password><button id=b>Sign in</button><p id=e class=e></p></div><div id=app hidden><div id=hd><b>&#128218; Library</b><input id=q placeholder=\"search…\"><a href=\"manga\" style=\"padding:9px 14px;border-radius:8px;background:#33507f;color:#e6edf6;text-decoration:none;font-weight:700;white-space:nowrap\">&#128218;+ My Manga</a><a href=\"shelf\" style=\"padding:9px 14px;border-radius:8px;background:#33507f;color:#e6edf6;text-decoration:none;font-weight:700;white-space:nowrap\">&#128214; Comics</a><a href=\"health\" style=\"padding:9px 14px;border-radius:8px;background:#294066;color:#e6edf6;text-decoration:none;font-weight:700;white-space:nowrap\">&#9877; Health</a></div><div id=gr></div></div>" as *u8)
  o = ms_apps(out, o, "<script>function T(){return sessionStorage.nx_sess||''}function H(){return {'X-Nishi-Session':T()}}function app(){document.getElementById('lg').hidden=1;document.getElementById('app').hidden=0;list('')}var IO=new IntersectionObserver(function(es){es.forEach(function(e){if(e.isIntersecting){IO.unobserve(e.target);lc(e.target)}})},{rootMargin:'500px'});function lc(d){fetch('api/cover?p='+encodeURIComponent(d.dataset.p),{headers:H()}).then(function(r){if(!r.ok)throw 0;return r.blob()}).then(function(b){var im=d.firstChild;im.src=URL.createObjectURL(b);im.style.display='block'}).catch(function(){})}" as *u8)
  o = ms_apps(out, o, "var OFF=0,TOTAL=-1,BUSY=0,MODE='browse';function card(it){var d=document.createElement('div');d.className='c';d.dataset.p=it.p;var im=document.createElement('img');im.className='cov';im.alt='';var t=document.createElement('div');t.className='t';t.textContent=it.n;d.appendChild(im);d.appendChild(t);d.onclick=function(){openb(it.p)};IO.observe(d);return d}function lerr(q){var g=document.getElementById('gr');g.innerHTML='';var p=document.createElement('p');p.style.cssText='padding:16px;color:#9ab';p.textContent='Couldn\\u2019t reach the library \\u2014 tap to retry.';p.onclick=function(){list(q)};g.appendChild(p)}function list(q){var g=document.getElementById('gr');g.innerHTML='';OFF=0;TOTAL=-1;BUSY=0;if(q){MODE='search';fetch('api/search?type=book&q='+encodeURIComponent(q),{headers:H()}).then(function(r){if(r.status===401||r.status===403){sessionStorage.removeItem('nx_sess');location.reload();return null}if(!r.ok)throw 0;return r.json()}).then(function(j){if(!j)return;(j.results||[]).forEach(function(it){g.appendChild(card(it))})}).catch(function(){lerr(q)})}else{MODE='browse';loadMore()}}" as *u8)
  o = ms_apps(out, o, "function loadMore(){if(BUSY||MODE!=='browse')return;if(TOTAL>=0&&OFF>=TOTAL)return;BUSY=1;fetch('api/list?type=book&offset='+OFF,{headers:H()}).then(function(r){if(r.status===401||r.status===403){sessionStorage.removeItem('nx_sess');location.reload();return null}if(!r.ok)throw 0;return r.json()}).then(function(j){if(!j){BUSY=0;return}TOTAL=j.total||0;var a=j.items||[];var g=document.getElementById('gr');a.forEach(function(it){g.appendChild(card(it))});OFF=OFF+a.length;BUSY=0;if(a.length===0){TOTAL=OFF;return}if(OFF<TOTAL&&window.innerHeight>=document.body.offsetHeight-120)loadMore()}).catch(function(){BUSY=0;if(OFF===0)lerr('')})}window.addEventListener('scroll',function(){if(window.innerHeight+window.scrollY>=document.body.offsetHeight-900)loadMore()},{passive:true});" as *u8)
  o = ms_apps(out, o, "function openb(p){fetch('api/open?p='+encodeURIComponent(p),{cache:'no-store',headers:H()}).then(function(r){var u=r.url||'';if(u.indexOf('/reader')>=0||u.indexOf('/cbx')>=0){location.href=u;return null}if(u.indexOf('/file')>=0){alert('This book can\\u2019t be opened in the reader \\u2014 it may be DRM-protected or an unsupported format.');return null}return r.text()}).then(function(t){if(t){document.open();document.write(t);document.close()}})}" as *u8)
  o = ms_apps(out, o, "document.getElementById('b').onclick=function(){var b='handle='+encodeURIComponent(document.getElementById('h').value)+'&passphrase='+encodeURIComponent(document.getElementById('p').value);fetch('api/login',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:b}).then(function(r){if(!r.ok)throw 0;return r.json()}).then(function(j){sessionStorage.nx_sess=j.token;app()}).catch(function(){document.getElementById('e').textContent='Wrong handle or passphrase.'})};var qi=document.getElementById('q');qi.oninput=function(){list(qi.value.trim())};if(sessionStorage.nx_sess){app()}</script>" as *u8)
  let hdr: *u8 = sys_mmap(256); var h: i64 = 0
  h = ms_apps(hdr, h, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: " as *u8)
  h = ms_dec(hdr, h, o)
  h = ms_apps(hdr, h, "\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, hdr, h); sys_write(cfd, out, o); sys_close(cfd)
  return 0
744}
745
746func ms_emit_403(cfd: i64) -> i64 {
  let d: *u8 = "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nContent-Length: 16\r\nConnection: close\r\n\r\n{\"error\":\"nope\"}"
  sys_write(cfd, d, ms_slen(d)); sys_close(cfd); return 0
749}
750// ISOLATION GUARD: extract the request's book slug and, if it is a PERSONAL slug ("u_.."), require the caller owns
751// it. The slug is carried either as `slug=<slug>` (zoomprep/pos/ann) or inside `p=reader/<slug>/..` (api/book, the
752// %2F-or-/ separator). Shared slugs + requests with no slug -> allowed (return 1). Uses rl_slug_guard.
753func ms_slug_guarded(ukey: *u8, path: *u8, plen: i64) -> i64 {
  let slug: *u8 = sys_mmap(256)
  var have: i64 = 0
  // try slug=<v>
  let sv: i64 = ms_qval(path, plen, "slug" as *u8, slug, 256)
  if sv > 0 { have = 1 } else {
      // try p=reader/<slug>/..  (p is urlencoded; the leading "reader/" may be literal or %2F-escaped)
      let enc: *u8 = sys_mmap(MS_MAGIC_4096); let el: i64 = ms_qval(path, plen, "p" as *u8, enc, MS_MAGIC_4096)
      if el > 0 {
          let dec: *u8 = sys_mmap(MS_MAGIC_4096); ms_urldec(enc, el, dec)
          let dn: i64 = ms_slen(dec)
          if ms_starts(dec, dn, "reader/" as *u8) == 1 {
              var i: i64 = 7; var o: i64 = 0
              while i < dn { if dec[i] == (47 as u8) { i = dn } else { if o < 200 { slug[o] = dec[i]; o = o + 1 } i = i + 1 } }
              slug[o] = 0 as u8
              if o > 0 { have = 1 }
          }
      }
  }
  if have == 0 { return 1 }               // no book slug in this request -> not our concern
  return rl_slug_guard(ukey, slug)        // shared -> 1 ; own personal -> 1 ; other's personal -> 0
774}
775
776func ms_handle(ctx: *NxAuthContext, cfd: i64) -> i64 {
  let req: *u8 = sys_mmap(MS_MAGIC_65536)
  let m: *i64 = sys_mmap(8) as *i64; let po: *i64 = sys_mmap(8) as *i64; let pl: *i64 = sys_mmap(8) as *i64
  let cl: *i64 = sys_mmap(8) as *i64; let bo: *i64 = sys_mmap(8) as *i64; let rn: *i64 = sys_mmap(8) as *i64
  let rc: i64 = nx_http_server_read_request(cfd, req, MS_MAGIC_65536, m, po, pl, cl, bo, rn)
  if rc != 0 { sys_close(cfd); return 0 }
  var path: *u8 = ((req as i64) + po[0]) as *u8
  var plen: i64 = pl[0]
  // /library prefix-awareness: this reader is reverse-proxied at nishifamily.com/library (sd2_proxy_to
  // forwards the path UNCHANGED) and the served HTML carries <base href="/library/">, so the browser always
  // requests /library/*. Strip a leading "/library" here so every route below matches -- and bare :8791
  // access works identically (the <base> makes even direct hits go through /library). 8 = len("/library").
  if ms_starts(path, plen, "/library" as *u8) == 1 { path = ((path as i64) + 8) as *u8; plen = plen - 8; if plen <= 0 { path = "/" as *u8; plen = 1 } }
  // nishifamily.com/media (the family-facing SFW library name) is reverse-proxied here too -- strip /media the
  // same way so every route below matches. 6 = len("/media"). (operator 2026-06-18: /media live for everyone)
  if ms_starts(path, plen, "/media" as *u8) == 1 { path = ((path as i64) + 6) as *u8; plen = plen - 6; if plen <= 0 { path = "/" as *u8; plen = 1 } }
  // login is the only unauthenticated endpoint
  if ms_starts(path, plen, "/api/login" as *u8) == 1 { return ms_login(ctx, cfd, req, rn[0]) }
  // UI SHELLS served ungated -- they hold NO book data; the data they fetch (/api/book, /file) is the gated
  // part and carries the sessionStorage token. So a real navigation to /reader?slug / /cbx?slug works (the
  // shell renders, then its own fetches present the token). No-cookie cardinal intact.
  if ms_starts(path, plen, "/reader" as *u8) == 1 { return ms_serve_static(cfd, MS_READER, "text/html; charset=utf-8" as *u8) }
  if ms_starts(path, plen, "/cbx" as *u8) == 1 { return ms_serve_static(cfd, MS_CBX, "text/html; charset=utf-8" as *u8) }
  if ms_starts(path, plen, "/zoom" as *u8) == 1 { return ms_serve_static(cfd, MS_ZOOM, "text/html; charset=utf-8" as *u8) }
  if ms_starts(path, plen, "/manga" as *u8) == 1 { return ms_serve_static(cfd, MS_MANGA, "text/html; charset=utf-8" as *u8) }
  if ms_starts(path, plen, "/shelf" as *u8) == 1 { return ms_serve_static(cfd, MS_SHELF, "text/html; charset=utf-8" as *u8) }   // LOCAL comics/manga series browse shell (data via /api/shelf, behind the wall)
  if ms_starts(path, plen, "/health" as *u8) == 1 { return ms_serve_static(cfd, MS_HEALTH, "text/html; charset=utf-8" as *u8) }   // media-liveness dashboard shell (data via /api/mediahealth, behind the wall)
  // COVER PROXY: served ungated because <img src> cannot carry the session header; guarded by mss_handle_thumb's
  // host allow-list (only mangadex/nhentai cover CDNs -> public thumbnails, no user data, not an open proxy).
  if ms_starts(path, plen, "/api/thumb" as *u8) == 1 { return mss_handle_thumb(cfd, path, plen) }
  // THE WALL: every DATA route requires a valid no-cookie X-Nishi-Session token. The handle-returning variant
  // (same validation path) also yields the authenticated USER -> ukey keys the per-user sync spine (R1).
  let uhb: *u8 = sys_mmap(96)
  let uhn: *i64 = sys_mmap(8) as *i64
  if nx_sa_validate_handle(ctx, req, rn[0], sys_now_realtime_sec(), uhb, 64, uhn) != NX_MAUTH_OK {
      if ms_starts(path, plen, "/api/" as *u8) == 1 { return ms_emit_401(cfd) }
      if ms_starts(path, plen, "/file" as *u8) == 1 { return ms_emit_401(cfd) }
      return ms_shell(cfd)
  }
  let ukey: *u8 = sys_mmap(64)
  sy_user_key(uhb, uhn[0], ukey)
  // ---- shared/personal library routes (owner-in-slug isolation) ----
  // POST /api/manga/add {url,title} -> download into THIS user's private area
  if ms_starts(path, plen, "/api/manga/add" as *u8) == 1 {
      if req[0] == (80 as u8) {
          var mbl: i64 = cl[0]
          if bo[0] + mbl > rn[0] { mbl = rn[0] - bo[0] }
          return ma_handle_add(cfd, req, bo[0], mbl, ukey)
      }
      return ms_emit_401(cfd)
  }
  // ---- SOURCE BROWSER (behind the wall): search external sources, list chapters, proxy covers ----
  // GET /api/msearch?src=<mangadex|nhentai>&q=<query> -> unified results JSON
  if ms_starts(path, plen, "/api/msearch" as *u8) == 1 { return mss_handle_search(cfd, path, plen) }
  // GET /api/mbrowse?src=&mode=<popular|latest> -> the LANDING FEED (browse without typing)
  if ms_starts(path, plen, "/api/mbrowse" as *u8) == 1 { return mss_handle_browse(cfd, path, plen) }
  // GET /api/mrandom?src= -> one random title
  if ms_starts(path, plen, "/api/mrandom" as *u8) == 1 { return mss_handle_random(cfd, path, plen) }
  // GET /api/mediahealth -> the media-liveness sweep report (written by nx_movie_probe --sweep). Behind the wall.
  if ms_starts(path, plen, "/api/mediahealth" as *u8) == 1 { return ms_serve_static(cfd, MS_HEALTH_JSON, "application/json" as *u8) }
  // GET /api/dlstatus?slug= -> live download progress {done,total,finished} for THIS user's in-flight book
  if ms_starts(path, plen, "/api/dlstatus" as *u8) == 1 { return ma_handle_dlstatus(cfd, path, plen, ukey) }
  // GET /api/mfeed?id=<mangaId> -> chapter list (mangadex series -> chapters)
  if ms_starts(path, plen, "/api/mfeed" as *u8) == 1 { return mss_handle_feed(cfd, path, plen) }
  // POST /api/import {url,title} -> POLITELY import images (honors robots.txt) into THIS user's private area
  if ms_starts(path, plen, "/api/import" as *u8) == 1 {
      if req[0] == (80 as u8) {
          var ibl: i64 = cl[0]
          if bo[0] + ibl > rn[0] { ibl = rn[0] - bo[0] }
          return ma_handle_import(cfd, req, bo[0], ibl, ukey)
      }
      return ms_emit_401(cfd)
  }
  // GET /api/personal -> the caller's OWN private books (isolation by ukey)
  if ms_starts(path, plen, "/api/personal" as *u8) == 1 {
      let pb: *u8 = sys_mmap(MS_MAGIC_65536)
      rl_list_personal_json(ukey, pb, MS_MAGIC_65536)
      return zs_emit(cfd, "200 OK" as *u8, pb)
  }
  // POST /api/promote?slug=<u_..slug> -> move the caller's personal book into the shared family library
  if ms_starts(path, plen, "/api/promote" as *u8) == 1 {
      let sb: *u8 = sys_mmap(256); ms_qval(path, plen, "slug" as *u8, sb, 256)
      let pr: i64 = rl_promote_to_shared(ukey, sb)
      if pr == 1 { return zs_emit(cfd, "200 OK" as *u8, "{\"ok\":1,\"area\":\"shared\"}" as *u8) }
      return zs_emit(cfd, "200 OK" as *u8, "{\"ok\":0}" as *u8)
  }
  // ★ ISOLATION GUARD: any by-slug route that names a PERSONAL slug (u_<ukey>_..) must be the caller's own.
  // Shared slugs + no-slug requests pass through. Fail-closed 403 otherwise -- before open/book/zoomprep/pos/ann.
  if ms_slug_guarded(ukey, path, plen) == 0 { return ms_emit_403(cfd) }
  // GET /api/shelf -> the LOCAL series->volumes catalog (idx scan + data-driven grouping; nx_manga_shelf_lib).
  // Forked child, fresh from disk truth every request -- no cache to go stale.
  if ms_starts(path, plen, "/api/shelf" as *u8) == 1 {
      let shb: *u8 = sys_mmap(MS_MAGIC_2097152)
      msl_shelf_json(shb, MS_MAGIC_2097152)
      return zs_emit(cfd, "200 OK" as *u8, shb)
  }
  if ms_starts(path, plen, "/api/open" as *u8) == 1 { return ms_handle_open(cfd, path, plen) }
  if ms_starts(path, plen, "/api/cover" as *u8) == 1 { return ms_handle_cover(cfd, path, plen) }
  if ms_starts(path, plen, "/api/search" as *u8) == 1 { return ms_handle_search(cfd, path, plen) }
  if ms_starts(path, plen, "/api/list" as *u8) == 1 { return ms_handle_list(cfd, path, plen) }
  if ms_starts(path, plen, "/api/remove" as *u8) == 1 { return ms_handle_remove(cfd, path, plen) }
  if ms_starts(path, plen, "/api/book" as *u8) == 1 { sy_record_auto(path, plen, ukey, sys_now_realtime_sec()); return ms_handle_book(cfd, path, plen) }
  if ms_starts(path, plen, "/api/pos" as *u8) == 1 {
      if req[0] == (80 as u8) {                                   // 'P' = POST -> store; else GET -> read
          var sbl: i64 = cl[0]
          if bo[0] + sbl > rn[0] { sbl = rn[0] - bo[0] }
          return sy_handle_pos_put(cfd, path, plen, req, bo[0], sbl, ukey)
      }
      return sy_handle_pos_get(cfd, path, plen, ukey)
  }
  if ms_starts(path, plen, "/api/ann" as *u8) == 1 {
      if req[0] == (80 as u8) {
          var abl: i64 = cl[0]
          if bo[0] + abl > rn[0] { abl = rn[0] - bo[0] }
          return sy_handle_ann_put(cfd, path, plen, req, bo[0], abl, ukey)
      }
      return sy_handle_ann_get(cfd, path, plen, ukey)
  }
  if ms_starts(path, plen, "/api/zoomprep" as *u8) == 1 { return zs_handle_zoomprep(cfd, path, plen) }
  if ms_starts(path, plen, "/api/llmpack" as *u8) == 1 { return ms_handle_llmpack(cfd, path, plen) }
  if ms_starts(path, plen, "/cbx" as *u8) == 1 { return ms_serve_static(cfd, MS_CBX, "text/html; charset=utf-8" as *u8) }
  if ms_starts(path, plen, "/reader" as *u8) == 1 { return ms_serve_static(cfd, MS_READER, "text/html; charset=utf-8" as *u8) }
  if ms_starts(path, plen, "/file" as *u8) == 1 { return ms_handle_file(cfd, path, plen, req, rn[0]) }
  return ms_shell(cfd)
900}
901
902func main(argc: i64, argv: *i64) -> i64 {
  // S-class auth wall: args [1]=keysfile [2]=storefile [3]=realm. Reuse the "Nishi Wiki" realm + keys so the
  // operator's EXISTING login works. Fail-fast (Rule 20): arm the realm context at startup or refuse to serve.
  if argc < 4 { ms_puts("usage: nx_media_server <keysfile> <storefile> <realm>\n" as *u8); return 1 }
  let keysfile: *u8 = argv[1] as *u8
  let storefile: *u8 = argv[2] as *u8
  let realm: *u8 = argv[3] as *u8
  let realm_n: i64 = ms_slen(realm)
  let oprf_seed: *u8 = sys_mmap(32)
  let akp: *u8 = sys_mmap(32)
  let akb: *u8 = sys_mmap(33)
  let edp: *u8 = sys_mmap(32)
  let edb: *u8 = sys_mmap(32)
  if nx_uas_server_keys_load_or_init(keysfile, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { ms_puts("FATAL: server-key bundle load\n" as *u8); return 2 }
  let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
  // session TTL: 86400s = 24h = NX_MAUTH_HARD_MAX_TTL_S (the auth layer's HARD CAP -- a larger value makes
  // nx_auth_context_init return BAD_INPUT and the server crash-loops). Was 900s=15min, which logged you out
  // mid-read; 24h is the max allowed and the token lives in tab-scoped sessionStorage (cleared on tab close).
  if nx_auth_context_init(ctx, realm, realm_n, realm, realm_n, storefile as i64, oprf_seed, edp, edb, MS_MAGIC_86400, MS_MAGIC_8192, 1, 1, 5, 1) != NX_MAUTH_OK { ms_puts("FATAL: auth context init\n" as *u8); return 3 }
  var port: i64 = MS_PORT
  if argc >= 5 { var pv: i64 = 0; var pi: i64 = 0; let ps: *u8 = argv[4] as *u8; while ps[pi] != (0 as u8) { if ps[pi] >= (48 as u8) { if ps[pi] <= (57 as u8) { pv = pv*10 + ((ps[pi] as i64) - 48) } } pi = pi + 1 } if pv > 0 { port = pv } }
  let addr: *u8 = sys_mmap(16)
  // LAN bind (0.0.0.0); every request now passes THE WALL (nx_sa_validate, no-cookie X-Nishi-Session) before
  // any catalog/book bytes are served. PUBLIC-internet exposure still deferred to front-end routing.
  nx_http_server_addr_any(addr, port)
  let lv: *i64 = sys_mmap(8) as *i64
  let lfd: i64 = nx_http_server_listen(addr, 64, lv)
  if lfd < 0 { ms_puts("media-server listen FAILED\n" as *u8); return 1 }
  ms_puts("nx_media_server SOVEREIGN on http://0.0.0.0:8790 (LAN / internal-network) -- no python\n" as *u8)
  let av: *i64 = sys_mmap(8) as *i64
  let st: *i64 = sys_mmap(8) as *i64
  var go: i64 = 1
  while go == 1 {
      // Reap ALL exited children each pass (not just one) so per-request fork children can't pile up as
      // zombies toward RLIMIT_NPROC and starve fork() -> the parent would then close() every new connection
      // unhandled = /library serving one request then -4 until killed. Mirrors the supervisor's own reaper.
      var rr: i64 = sys_wait4(0 - 1, st, 1)
      while rr > 0 { rr = sys_wait4(0 - 1, st, 1) }
      let cfd: i64 = nx_http_server_accept_one(lfd, av)
      if cfd >= 0 {
          let pid: i64 = sys_fork()
          if pid == 0 { ms_handle(ctx, cfd); sys_exit(0) }
          sys_close(cfd)
      }
  }
  return 0
948}
nx_media_server.nx source

`nx_media_server.nx` source
