'; echo ''.$safeTitle.''; echo '

'.$safeTitle.'

'.$body.'

'; exit; } function colabgpt_direct_json(array $payload,int $status=200): never { http_response_code($status); header('Content-Type: application/json; charset=utf-8'); header('Cache-Control: no-store'); header('X-Content-Type-Options: nosniff'); header('Referrer-Policy: no-referrer'); echo json_encode($payload,JSON_UNESCAPED_SLASHES|JSON_THROW_ON_ERROR); exit; } $token=isset($_GET['t'])&&is_string($_GET['t'])?$_GET['t']:''; if($token==='') colabgpt_direct_html('Invalid link','

This link is missing its secure token.

',400); try{ $service=colabgpt_direct_file_transfer_service(); $method=strtoupper((string)($_SERVER['REQUEST_METHOD']??'GET')); // Download tokens remain direct GET-only. try{ $claims=$service->decodePublicToken($token,'download'); if($method!=='GET') colabgpt_direct_html('Method not allowed','

This download link only supports GET.

',405); $service->downloadFile($claims); }catch(RuntimeException $downloadError){ if(!in_array($downloadError->getMessage(),['DIRECT_TRANSFER_TOKEN_INVALID','DIRECT_TRANSFER_TOKEN_EXPIRED'],true)){ throw $downloadError; } } $claims=$service->decodePublicToken($token,'upload'); if($method==='GET'){ $safeToken=json_encode($token,JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_HEX_QUOT|JSON_THROW_ON_ERROR); $body=<<Select one or more files. Browser fallback uploads use 20 MB raw binary chunks, assembled and verified on the server.

No Base64 or GPT-mediated file chunks are used.

The secure upload link expires automatically. Keep this page open until all selected files finish.

HTML; colabgpt_direct_html('Upload project files',$body); } if($method!=='POST'){ colabgpt_direct_json(['ok'=>false,'error'=>'METHOD_NOT_ALLOWED'],405); } $op=isset($_GET['op'])&&is_string($_GET['op'])?$_GET['op']:''; if($op==='init'){ $raw=file_get_contents('php://input'); if(!is_string($raw)) throw new RuntimeException('DIRECT_UPLOAD_REQUEST_INVALID'); try{$input=json_decode($raw,true,16,JSON_THROW_ON_ERROR);} catch(Throwable){throw new InvalidArgumentException('DIRECT_UPLOAD_REQUEST_INVALID');} if(!is_array($input)) throw new InvalidArgumentException('DIRECT_UPLOAD_REQUEST_INVALID'); $name=$input['fileName']??null; $size=$input['fileSize']??null; $total=$input['totalChunks']??null; if(!is_string($name)||!is_int($size)||!is_int($total)) throw new InvalidArgumentException('DIRECT_UPLOAD_REQUEST_INVALID'); $result=$service->beginChunkedUpload($claims,$name,$size,$total); colabgpt_direct_json(['ok'=>true]+$result); } if($op==='chunk'){ $uploadId=isset($_GET['uploadId'])&&is_string($_GET['uploadId'])?$_GET['uploadId']:''; $chunkRaw=$_GET['chunkIndex']??null; if($uploadId==='' || !(is_string($chunkRaw)||is_int($chunkRaw)) || !preg_match('/^\d+$/',(string)$chunkRaw)){ throw new InvalidArgumentException('DIRECT_UPLOAD_CHUNK_REQUEST_INVALID'); } $result=$service->storeChunkStream($claims,$uploadId,(int)$chunkRaw); colabgpt_direct_json(['ok'=>true]+$result); } if($op==='complete'){ $raw=file_get_contents('php://input'); if(!is_string($raw)) throw new RuntimeException('DIRECT_UPLOAD_REQUEST_INVALID'); try{$input=json_decode($raw,true,16,JSON_THROW_ON_ERROR);} catch(Throwable){throw new InvalidArgumentException('DIRECT_UPLOAD_REQUEST_INVALID');} if(!is_array($input)||!isset($input['uploadId'])||!is_string($input['uploadId'])){ throw new InvalidArgumentException('DIRECT_UPLOAD_REQUEST_INVALID'); } $result=$service->completeChunkedUpload($claims,$input['uploadId']); colabgpt_direct_json(['ok'=>true]+$result); } colabgpt_direct_json(['ok'=>false,'error'=>'DIRECT_UPLOAD_OPERATION_INVALID'],400); }catch(RuntimeException|InvalidArgumentException $e){ $code=$e->getMessage(); $safe=in_array($code,[ 'DIRECT_TRANSFER_TOKEN_EXPIRED','DIRECT_UPLOAD_SIZE_INVALID','DIRECT_UPLOAD_CHUNK_COUNT_INVALID', 'DIRECT_UPLOAD_CHUNK_INDEX_INVALID','DIRECT_UPLOAD_CHUNK_SIZE_INVALID','DIRECT_UPLOAD_CHUNK_MISSING', 'DIRECT_UPLOAD_NOT_FOUND','DIRECT_UPLOAD_CHUNK_CONFLICT','PROJECT_MEMBERSHIP_REQUIRED' ],true)?$code:'DIRECT_FILE_TRANSFER_FAILED'; if(strtoupper((string)($_SERVER['REQUEST_METHOD']??'GET'))==='POST'){ colabgpt_direct_json(['ok'=>false,'error'=>$safe],400); } $msg=$code==='DIRECT_TRANSFER_TOKEN_EXPIRED' ? 'This secure link has expired. Ask CollabGPT for a fresh link.' : 'The file transfer could not be completed safely.'; colabgpt_direct_html('Transfer stopped','

'.htmlspecialchars($msg,ENT_QUOTES|ENT_SUBSTITUTE,'UTF-8').'

',400); }