[TeoVader]

What changes

Before: the API cache wrote file, folder, version and comment responses to disk with Frame.io's signed media_links inside. Folder previews and project covers also stored bare signed thumbnail links. Frame.io asks clients not to: "Do not store or cache these URLs. Always request a fresh set of media_links each time" (developer.frame.io/platform/v4/docs/guides/media-links.md and the FAQ).

After: signed media links live in memory only. What a user sees stays the same:

• browsing, thumbnails, covers and previews look and behave as before while the app runs;
• offline after an app restart, folder mosaics, project covers, asset cards, the viewer's placeholder and the versions list still show the images seen before. They now come from the image cache by a stable key, not from a stored link;
• offline copies are local files and are unaffected;
• the expired-link refresh from Refresh cached folder previews and project covers once their links expire #24/Refresh guest comment authors whose avatar link expired #25 still works: a preview or cover read back without links is fetched again when online, just like an expired one.

How

• Disk copy without links (DiskScrub, used by JsonCache.put):
  • each link in a media_links object loses its url, download_url and inline_url, and records which of them it had in stripped;
  • every signed_url field is dropped;
  • memory keeps the full value, so a session is unchanged.
• Stable image keys (ImageRef(key, url)):
  • the key is frameio:<asset id>:<rendition> (for stacks, the head version's id), separate from the temporary link;
  • Asset.thumbnail and Asset.thumbnailCandidates return ImageRefs, and FolderPreview.thumbnails is a list of them;
  • RemoteImage(ImageRef) / RemoteImageChain(List<ImageRef>) with no link make a cache-only Coil request (networkCachePolicy(DISABLED), on an .invalid host, so there is never a network call). When a link arrives, the request restarts.
• Knowing what exists without the link: MediaLink.hasStream / hasDownload read stripped. So a copy read from disk still counts as pictured, still offers Download, and doesn't show "downloads disabled". The actions themselves already fetch the file fresh.
• Viewer:
  • when the refresh fails (offline) and the cached copy has no links, it keeps polling for the file instead of calling the media withheld (Show a clear card when Frame.io withholds a file's media #35), and plays once links come;
  • the EXIF and zip readers are keyed on the link, so they restart when it arrives.
• Old cache entries: JsonCache.scrubLegacyFiles() runs once in the background at start-up (a marker file next to the cache folder records it). It rewrites each entry through the scrub, keeping its age, and deletes old previews whose thumbnails were bare links.
• Image cache keys change for thumbnails (path → asset + rendition), so each thumbnail downloads once more after the update. Images seen only before the update, and not since, don't show offline until they have been seen online once.

Not changed:

• avatar_url (people's avatars, refreshed by Refresh cached folder previews and project covers once their links expire #24/Refresh guest comment authors whose avatar link expired #25), Account.image and Project.image are other signed links that still reach the disk. They are not media_links; a follow-up can give them the same treatment.
• The viewer's full-resolution image and playback still need fresh links.

Checks

• gradlew.bat :app:testDebugUnitTest :app:verifyRoborazziDebug :app:lintDebug on the workstation: 240 tests, only the 2 known Windows-only screenshot differences (notifications, tabletNotifications); lint "No issues found". New tests:
  • DiskScrubTest (6): what is stripped and what stays (scrub-sheet metadata, empty links), idempotence, a scrubbed asset still knowing its thumbnail key and download, ImageRef scrubbing, the cache keeping links in memory but not on disk, the one-time legacy migration;
  • ProjectCoverTest (+4): no signed link on disk, covers after a restart (online: fresh links under the same keys; offline: keys only), a file after a restart offline (thumbnail key, download still known);
  • ModelsTest: the stable keys.
• Existing screenshots unchanged (project_covers passes with ImageRefs)
• Tried on a phone: not done. Worth checking before release: browse online, force-stop, airplane mode, reopen, and check covers and thumbnails show; then the viewer offline and back online.

🤖 Generated with Claude Code