Public files were addressed by a 32-character account id, and a public
folder answered with JSON, so a link was unusable to send to anyone.
Accounts that signed up with a BNS name can now be addressed by it
(/p/alice.x/<drive>/<folder>/), a public folder opened in a browser is a
page with its files, small pictures and a player (tools still get JSON),
and every link and redirect on it is relative so navigate.st/s3/ serves
the same pages. Pithos shows the navigate.st/s3 address when a folder is
made public.
A server-sent file list could name paths outside the s3d folder (or the key
file in it), and a failed move back deleted every listed path. Transfers now
accept only s3d data paths, check all of them before writing, never
overwrite, and clean up only what they wrote.
A lost reply could lose or fork the drives: move-up and move-down now ask the
server who holds them before touching the local copy, and once the server is
told to release, the local copy is never removed (the release is retried).
The gateway no longer lets one account route another's access key id, refuses
. and .. in shared-key paths, strips presign parameters before re-signing,
counts upload size on disk, stops s3d before it can be restarted mid-move, and
claims sign-up proofs before checking them. The key file is never replaced
when unreadable, a local edit removes the older encrypted copy, listing pages
no longer repeat, and data hashes stream instead of loading whole files.
The gateway is the only thing standing between a shared key and the rest of
an owner's drive, so its SigV4 check, grant decisions and the BNS/deposit
proofs get tests that need no s3d to run.
