Add paginated library JSON and dedicated still thumbs that never stream archive masters.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/utils/library.ts

@@ -615,6 +615,121 @@ export function publicLibrary(event: H3Event, opts?: { light?: boolean }) {
   }
 }
 
+/** Paginated metadata page — no file bytes, no existsSync join of the volume. */
+export function publicLibraryPage(
+  event: H3Event,
+  opts: { limit?: number; cursor?: string; folderId?: string; type?: string } = {}
+) {
+  const limit = Math.min(Math.max(Number(opts.limit) || 50, 1), 60)
+  const cursor = String(opts.cursor || '')
+  const folderId = String(opts.folderId || '')
+  const typeFilter = String(opts.type || 'all')
+  const full = publicLibrary(event, { light: true })
+
+  type Row = {
+    id: string
+    name: string
+    type: 'still' | 'clip' | 'track'
+    createdAt: number
+    thumbUrl: string
+    folderId: string
+    prompt?: string
+    promptPre?: string
+    promptPost?: string
+    width?: number
+    height?: number
+    role?: string
+    hideInput?: boolean
+    filename?: string
+    duration?: number
+    ext?: string
+  }
+
+  const rows: Row[] = []
+  for (const still of full.stills) {
+    if (folderId && folderId !== 'all' && still.folderId !== folderId) continue
+    if (typeFilter === 'videos' || typeFilter === 'music') continue
+    rows.push({
+      id: still.id,
+      name: still.name || still.filename || still.id,
+      type: 'still',
+      createdAt: still.createdAt || 0,
+      thumbUrl: `/api/library/stills/${still.id}/thumb`,
+      folderId: still.folderId,
+      prompt: still.prompt,
+      promptPre: still.promptPre,
+      promptPost: still.promptPost,
+      width: still.width,
+      height: still.height,
+      role: still.role,
+      hideInput: still.hideInput,
+      filename: still.filename
+    })
+  }
+  for (const clip of full.clips) {
+    if (folderId && folderId !== 'all' && clip.folderId !== folderId) continue
+    if (typeFilter === 'images' || typeFilter === 'music') continue
+    rows.push({
+      id: clip.id,
+      name: clip.name || clip.id,
+      type: 'clip',
+      createdAt: clip.createdAt || 0,
+      thumbUrl: `/api/library/clips/${clip.id}/thumb`,
+      folderId: clip.folderId,
+      prompt: clip.prompt,
+      promptPre: clip.promptPre,
+      promptPost: clip.promptPost,
+      width: clip.width,
+      height: clip.height,
+      duration: clip.duration
+    })
+  }
+  for (const track of full.tracks || []) {
+    if (folderId && folderId !== 'all' && track.folderId !== folderId) continue
+    if (typeFilter === 'images' || typeFilter === 'videos') continue
+    rows.push({
+      id: track.id,
+      name: track.name || track.id,
+      type: 'track',
+      createdAt: track.createdAt || 0,
+      thumbUrl: '',
+      folderId: track.folderId,
+      duration: track.duration,
+      ext: track.ext
+    })
+  }
+
+  rows.sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0) || String(b.id).localeCompare(String(a.id)))
+
+  let start = 0
+  if (cursor) {
+    const idx = rows.findIndex(row => `${row.type}:${row.id}` === cursor)
+    start = idx >= 0 ? idx + 1 : 0
+  }
+  const page = rows.slice(start, start + limit)
+  const last = page[page.length - 1]
+  const nextCursor = page.length === limit && last ? `${last.type}:${last.id}` : null
+
+  const stillIds = new Set(page.filter(r => r.type === 'still').map(r => r.id))
+  const clipIds = new Set(page.filter(r => r.type === 'clip').map(r => r.id))
+  const trackIds = new Set(page.filter(r => r.type === 'track').map(r => r.id))
+
+  return {
+    folders: full.folders,
+    items: page,
+    nextCursor,
+    limit,
+    stills: full.stills.filter(s => stillIds.has(s.id)),
+    clips: full.clips.filter(c => clipIds.has(c.id)),
+    tracks: (full.tracks || []).filter(t => trackIds.has(t.id)),
+    drafts: full.drafts,
+    loraAliases: full.loraAliases,
+    loraTriggers: full.loraTriggers,
+    keepPrompts: full.keepPrompts,
+    total: rows.length
+  }
+}
+
 export function assertLibraryOwner(event: H3Event) {
   const owner = libraryOwnerKey(event)
   return { owner, catalog: readCatalog(owner) }
@@ -830,7 +945,7 @@ export async function ensureScaledThumb(source: string, dest: string) {
   if (pending) return pending
   const build = withThumbSlot(async () => {
     const ok = await buildStillThumb(source, dest)
-    return ok ? dest : source
+    return ok ? dest : ''
   }).finally(() => {
     thumbBuilds.delete(key)
   })
@@ -1130,7 +1245,7 @@ function buildStillThumb(source: string, dest: string) {
     const proc = spawn('ffmpeg', [
       '-y',
       '-i', source,
-      '-vf', 'scale=320:-2',
+      '-vf', 'scale=384:-2',
       '-frames:v', '1',
       '-q:v', '5',
       dest
@@ -1164,7 +1279,8 @@ export async function stillThumbPath(owner: string, id: string) {
   if (pending) return pending
   const build = withThumbSlot(async () => {
     const ok = await buildStillThumb(source, dest)
-    return ok ? dest : source
+    // Never return the archive master — callers must not stream originals as thumbs
+    return ok ? dest : ''
   }).finally(() => {
     thumbBuilds.delete(key)
   })