@celsoft/platform 0.5.0 → 0.7.0

package/dist/runtime/index.js

@@ -3,8 +3,8 @@ import { Pool } from "pg";
 import { AUTH_PATH, createAuth } from "./auth.js";
 import { createEmail } from "./email.js";
 import { createFiles } from "./files.js";
-import { isCrossSiteForm, needsSession, PLATFORM_API, rateLimited } from "./guard.js";
-import { issueRecoveryCode, recoverOwner } from "./owner.js";
+import { isCrossSiteForm, needsSession, rateLimited } from "./guard.js";
+import { CLIENT_PATH, clientScript, createLive, joinRoom, LIVE_PATH, liveRoom } from "./live.js";
 import { isScreen, renderScreen } from "./screens.js";
 const defaultPool = (connectionString) => new Pool({ connectionString, max: 5 });
 const json = (body, status = 200) => Response.json(body, { status });
@@ -12,54 +12,17 @@ const json = (body, status = 200) => Response.json(body, { status });
 // platform's own bindings are added to it. Pass the app's tables as `schema` for a typed `app.db`.
 // A handler may throw a Response, as `requireUser` does, and it is sent as the answer.
 export function defineApp(handler, options = {}) {
-    const openPool = options.pool ?? defaultPool;
+    const onMessage = options.live?.onMessage;
     return {
         async fetch(request, env, ctx) {
             const url = new URL(request.url);
-            let pool;
-            let db;
-            let email;
-            let files;
-            let auth;
-            let session;
-            const app = {
-                env,
-                get db() {
-                    if (!env.DB)
-                        throw new Error("this app has no database; add `database` to platform.jsonc");
-                    return (db ??= drizzle((pool ??= openPool(env.DB.connectionString)), { schema: options.schema ?? {} }));
-                },
-                get email() {
-                    return (email ??= createEmail(env));
-                },
-                get files() {
-                    return (files ??= createFiles(env));
-                },
-                get auth() {
-                    if (!env.BETTER_AUTH_SECRET)
-                        throw new Error("this app has no auth; set `auth: true` in platform.jsonc");
-                    return (auth ??= createAuth({
-                        db: app.db,
-                        secret: env.BETTER_AUTH_SECRET,
-                        baseURL: env.APP_URL ?? url.origin,
-                        email: app.email,
-                        requireVerification: env.EMAIL_MODE === "send",
-                    }));
-                },
-                session() {
-                    return (session ??= env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : Promise.resolve(null));
-                },
-                async requireUser() {
-                    const current = await app.session();
-                    if (!current)
-                        throw json({ error: "sign in first" }, 401);
-                    return current.user;
-                },
-                waitUntil: (promise) => ctx.waitUntil(promise),
-            };
+            const { app, close } = createContext(request, env, ctx, options);
             try {
                 if (isCrossSiteForm(request, url))
                     return json({ error: "cross-site form submissions are refused" }, 403);
+                const live = await liveRoute(request, url, env, app, options);
+                if (live)
+                    return live;
                 if (env.BETTER_AUTH_SECRET) {
                     const platform = await platformRoute(request, url, env, app, options);
                     if (platform)
@@ -73,14 +36,93 @@ export function defineApp(handler, options = {}) {
                 throw thrown;
             }
             finally {
-                if (pool)
-                    ctx.waitUntil(pool.end());
+                close();
             }
         },
+        // The Durable Object class behind live rooms, exported by the deploy's generated entry module.
+        // A browser's message reaches the app's onMessage with the same `app` a request gets.
+        LiveRoom: liveRoom((rawEnv) => {
+            if (!onMessage)
+                return undefined;
+            const env = rawEnv;
+            return async (room, message, from) => {
+                const pending = [];
+                const { app, close } = createContext(new Request(env.APP_URL ?? "https://app.invalid/"), env, { waitUntil: (p) => void pending.push(p) }, options);
+                try {
+                    await onMessage(room, message, from, app);
+                    await Promise.allSettled(pending);
+                }
+                finally {
+                    close();
+                }
+            };
+        }),
+    };
+}
+function createContext(request, env, ctx, options) {
+    const openPool = options.pool ?? defaultPool;
+    let pool;
+    let db;
+    let email;
+    let files;
+    let auth;
+    let live;
+    let session;
+    const app = {
+        env,
+        get db() {
+            if (!env.DB)
+                throw new Error("this app has no database; add `database` to platform.jsonc");
+            return (db ??= drizzle((pool ??= openPool(env.DB.connectionString)), { schema: options.schema ?? {} }));
+        },
+        get email() {
+            return (email ??= createEmail(env));
+        },
+        get files() {
+            return (files ??= createFiles(env));
+        },
+        get auth() {
+            if (!env.BETTER_AUTH_SECRET)
+                throw new Error("this app has no auth; set `auth: true` in platform.jsonc");
+            return (auth ??= createAuth({
+                db: app.db,
+                secret: env.BETTER_AUTH_SECRET,
+                baseURL: env.APP_URL ?? new URL(request.url).origin,
+                email: app.email,
+                requireVerification: env.EMAIL_MODE === "send",
+            }));
+        },
+        get live() {
+            return (live ??= createLive(env.LIVE, env.LIVE_ROOMS === "on"));
+        },
+        session() {
+            return (session ??= env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : Promise.resolve(null));
+        },
+        async requireUser() {
+            const current = await app.session();
+            if (!current)
+                throw json({ error: "sign in first" }, 401);
+            return current.user;
+        },
+        waitUntil: (promise) => ctx.waitUntil(promise),
     };
+    return { app, close: () => void (pool && ctx.waitUntil(pool.end())) };
+}
+// Live rooms answer for themselves: the browser client, and joining a room once the app agrees.
+async function liveRoute(request, url, env, app, options) {
+    if (!url.pathname.startsWith(LIVE_PATH) || env.LIVE_ROOMS !== "on" || !env.LIVE)
+        return undefined;
+    if (url.pathname === CLIENT_PATH)
+        return clientScript();
+    return joinRoom(request, url, env.LIVE, async (room) => {
+        const user = (await app.session())?.user ?? null;
+        const canJoin = (await options.live?.canJoin?.(room, user, app)) ?? false;
+        const canSend = canJoin && ((await options.live?.canSend?.(room, user, app)) ?? false);
+        return { user: user && { id: user.id, name: user.name }, canJoin, canSend };
+    });
 }
-// What the platform answers itself for an app with auth: screens, auth routes, owner recovery,
-// and the sign-in check in front of every private /api route.
+// What the platform answers itself for an app with auth: screens, auth routes, and the sign-in
+// check in front of every private /api route.
 async function platformRoute(request, url, env, app, options) {
     const path = url.pathname;
     if (request.method === "GET" && isScreen(path))
@@ -91,19 +133,6 @@ async function platformRoute(request, url, env, app, options) {
         return json({ error: "not found" }, 404);
     if (path.startsWith(`${AUTH_PATH}/`))
         return app.auth.handler(request);
-    const db = app.db;
-    if (path === `${PLATFORM_API}recovery-code` && request.method === "POST") {
-        const user = await app.requireUser();
-        return json({ code: await issueRecoveryCode(db, user.id) });
-    }
-    if (path === `${PLATFORM_API}recover` && request.method === "POST") {
-        const body = (await request.json().catch(() => ({})));
-        const { email, code, password } = body;
-        if (typeof email !== "string" || typeof code !== "string" || typeof password !== "string" || password.length < 8) {
-            return json({ error: "email, code and a password of at least 8 characters are required" }, 400);
-        }
-        return json({ ok: await recoverOwner(db, app.auth, { email, code, password }) });
-    }
     if (needsSession(path))
         await app.requireUser();
     return undefined;

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAyCtD,MAAM,WAAW,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9E,0FAA0F;AAC1F,mGAAmG;AACnG,uFAAuF;AACvF,MAAM,UAAU,SAAS,CACvB,OAAoD,EACpD,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAE7C,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAA+B,EAAE,GAAqB;YAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAsB,CAAC;YAC3B,IAAI,EAAsC,CAAC;YAC3C,IAAI,KAAwB,CAAC;YAC7B,IAAI,KAAwB,CAAC;YAC7B,IAAI,IAAsB,CAAC;YAC3B,IAAI,OAA4C,CAAC;YAEjD,MAAM,GAAG,GAAmD;gBAC1D,GAAG;gBACH,IAAI,EAAE;oBACJ,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;oBAC3F,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAK,EAAa,EAAE,CAAC,CAAC,CAAC;gBACtH,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,KAAK;oBACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,IAAI;oBACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;wBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;oBACzG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;wBAC1B,EAAE,EAAE,GAAG,CAAC,EAA6C;wBACrD,MAAM,EAAE,GAAG,CAAC,kBAAkB;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM;wBAClC,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;qBAC/C,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,OAAO;oBACL,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9H,CAAC;gBACD,KAAK,CAAC,WAAW;oBACf,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,OAAO;wBAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;gBACtB,CAAC;gBACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;aAC/C,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1G,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC9C,MAAM,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI;oBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,8DAA8D;AAC9D,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAA2B;IAE3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrI,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,gBAAgB,CAAC,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAA6C,CAAC;IAC7D,IAAI,IAAI,KAAK,GAAG,YAAY,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,YAAY,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QACjF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjH,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kEAAkE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAiC,MAAM,WAAW,CAAC;AAEhI,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAuDtD,MAAM,WAAW,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9E,0FAA0F;AAC1F,mGAAmG;AACnG,uFAAuF;AACvF,MAAM,UAAU,SAAS,CACvB,OAAoD,EACpD,OAAO,GAAmD,EAAE;IAG5D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;IAE1C,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAqB;YAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1G,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;gBACtB,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC9C,MAAM,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,+FAA+F;QAC/F,sFAAsF;QACtF,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;YAC5B,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACjC,MAAM,GAAG,GAAG,MAAa,CAAC;YAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAuB,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnJ,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC1C,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpC,CAAC;wBAAS,CAAC;oBACT,KAAK,EAAE,CAAC;gBACV,CAAC;YACH,CAAC,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAgB,EAChB,GAAQ,EACR,GAAqB,EACrB,OAAgC;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,IAAI,IAAsB,CAAC;IAC3B,IAAI,EAAsC,CAAC;IAC3C,IAAI,KAAwB,CAAC;IAC7B,IAAI,KAAwB,CAAC;IAC7B,IAAI,IAAsB,CAAC;IAC3B,IAAI,IAAsB,CAAC;IAC3B,IAAI,OAA4C,CAAC;IAEjD,MAAM,GAAG,GAA4B;QACnC,GAAG;QACH,IAAI,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC3F,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAK,EAAa,EAAE,CAAC,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,KAAK;YACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK;YACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,IAAI;YACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAA6C;gBACrD,MAAM,EAAE,GAAG,CAAC,kBAAkB;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;gBACnD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;aAC/C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,IAAI;YACN,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;YACL,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9H,CAAC;QACD,KAAK,CAAC,WAAW;YACf,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;KAC/C,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAAgC;IAEhC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAClG,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,YAAY,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,8CAA8C;AAC9C,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAAgC;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrI,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,gBAAgB,CAAC,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/live-client.d.ts

@@ -0,0 +1,19 @@
+export interface LivePeer {
+    id: string;
+    name: string;
+}
+export interface LiveHandlers {
+    onMessage?(data: unknown, meta: {
+        from: LivePeer | null;
+        seq: number;
+    }): void;
+    onPresence?(people: LivePeer[], anonymous: number): void;
+    onStatus?(status: "open" | "closed" | "refused"): void;
+    onError?(error: string): void;
+    onReload?(): void;
+}
+export interface LiveConnection {
+    send(data: unknown): boolean;
+    close(): void;
+}
+export declare function live(room: string, handlers?: LiveHandlers): LiveConnection;

package/dist/runtime/live-client.js

@@ -0,0 +1,74 @@
+// The browser side of live rooms. It has no imports and closes over nothing, so the runtime
+// can also serve it as a script with `live.toString()`, for pages that have no bundler.
+export function live(room, handlers = {}) {
+    let socket;
+    let last;
+    let stopped = false;
+    let attempts = 0;
+    const open = () => {
+        const url = new URL(`/api/live/${encodeURIComponent(room)}`, location.href);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        if (last !== undefined)
+            url.searchParams.set("since", String(last));
+        const current = new WebSocket(url);
+        socket = current;
+        current.onopen = () => {
+            attempts = 0;
+            handlers.onStatus?.("open");
+        };
+        current.onmessage = (event) => {
+            const frame = JSON.parse(String(event.data));
+            if (frame.type === "hello") {
+                if (last === undefined)
+                    last = frame.seq;
+            }
+            else if (frame.type === "message") {
+                last = frame.seq;
+                handlers.onMessage?.(frame.data, { from: frame.from, seq: frame.seq });
+            }
+            else if (frame.type === "ack") {
+                last = Math.max(last ?? 0, frame.seq);
+            }
+            else if (frame.type === "presence") {
+                handlers.onPresence?.(frame.people, frame.anonymous);
+            }
+            else if (frame.type === "reload") {
+                last = undefined;
+                if (handlers.onReload)
+                    handlers.onReload();
+                else
+                    location.reload();
+            }
+            else if (frame.type === "error") {
+                handlers.onError?.(frame.error);
+            }
+        };
+        current.onclose = (event) => {
+            if (socket !== current)
+                return;
+            // 4403 and 4404 mean the app refused this room; trying again would only be refused again.
+            if (event.code === 4403 || event.code === 4404) {
+                stopped = true;
+                handlers.onStatus?.("refused");
+                return;
+            }
+            handlers.onStatus?.("closed");
+            if (!stopped)
+                setTimeout(open, Math.min(15000, 500 * 2 ** attempts++));
+        };
+    };
+    open();
+    return {
+        send(data) {
+            if (socket?.readyState !== 1)
+                return false;
+            socket.send(JSON.stringify({ data }));
+            return true;
+        },
+        close() {
+            stopped = true;
+            socket?.close();
+        },
+    };
+}
+//# sourceMappingURL=live-client.js.map

package/dist/runtime/live-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-client.js","sourceRoot":"","sources":["../../src/runtime/live-client.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,wFAAwF;AAuBxF,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,QAAQ,GAAiB,EAAE;IAC5D,IAAI,MAA6B,CAAC;IAClC,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5E,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,OAAO,CAAC;QACjB,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE;YACpB,QAAQ,GAAG,CAAC,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,IAAI,IAAI,KAAK,SAAS;oBAAE,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC;YAC3C,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC;gBACjB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAChC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACrC,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,IAAI,GAAG,SAAS,CAAC;gBACjB,IAAI,QAAQ,CAAC,QAAQ;oBAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;;oBACtC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO;YAC/B,0FAA0F;YAC1F,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC/C,OAAO,GAAG,IAAI,CAAC;gBACf,QAAQ,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,OAAO;gBAAE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,EAAE,CAAC;IACP,OAAO;QACL,IAAI,CAAC,IAAI;YACP,IAAI,MAAM,EAAE,UAAU,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK;YACH,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime/live.d.ts

@@ -0,0 +1,29 @@
+import type { LivePeer } from "./live-client.js";
+export declare const LIVE_PATH = "/api/live/";
+export declare const CLIENT_PATH = "/api/live/client.js";
+export declare const MAX_MESSAGE: number;
+export declare const KEPT_MESSAGES = 500;
+export interface LiveNamespace {
+    idFromName(name: string): unknown;
+    get(id: unknown): {
+        fetch(request: Request): Promise<Response>;
+    };
+}
+export interface Live {
+    publish(room: string, message: unknown): Promise<void>;
+}
+export declare const clientScript: () => Response;
+export declare function createLive(namespace: LiveNamespace | undefined, enabled: boolean): Live;
+export interface JoinDecision {
+    user: LivePeer | null;
+    canJoin: boolean;
+    canSend: boolean;
+}
+export declare function joinRoom(request: Request, url: URL, namespace: LiveNamespace, decide: (room: string) => Promise<JoinDecision>): Promise<Response>;
+export type OnMessage = (room: string, message: unknown, from: LivePeer | null) => Promise<void>;
+export interface LiveRoomClass {
+    new (state: unknown, env: unknown): {
+        fetch(request: Request): Promise<Response>;
+    };
+}
+export declare function liveRoom(onMessage: (env: unknown) => OnMessage | undefined): LiveRoomClass;

package/dist/runtime/live.js

@@ -0,0 +1,158 @@
+import { live as client } from "./live-client.js";
+// Live rooms: one Durable Object per room name, holding the open sockets, a numbered window of
+// recent messages for catching up, and who is connected. Rooms carry messages only; what they
+// mean and whether anything is saved is the app's business.
+export const LIVE_PATH = "/api/live/";
+export const CLIENT_PATH = `${LIVE_PATH}client.js`;
+export const MAX_MESSAGE = 64 * 1024;
+export const KEPT_MESSAGES = 500;
+const ROOM_NAME = /^[A-Za-z0-9:_.-]{1,200}$/;
+export const clientScript = () => new Response(`export ${client.toString()}\n`, { headers: { "content-type": "text/javascript; charset=utf-8", "cache-control": "public, max-age=300" } });
+const roomStub = (namespace, room) => namespace.get(namespace.idFromName(room));
+export function createLive(namespace, enabled) {
+    return {
+        async publish(room, message) {
+            if (!enabled || !namespace)
+                throw new Error("this app has no live rooms; set `live: true` in platform.jsonc");
+            if (!ROOM_NAME.test(room))
+                throw new Error(`invalid room name ${room}`);
+            const body = JSON.stringify(message);
+            if (body.length > MAX_MESSAGE)
+                throw new Error(`live messages are limited to ${MAX_MESSAGE} bytes`);
+            const response = await roomStub(namespace, room).fetch(new Request("https://room/publish", { method: "POST", headers: { "x-room": room }, body }));
+            if (!response.ok)
+                throw new Error(`publishing to ${room} failed: ${response.status}`);
+        },
+    };
+}
+// A refusal is sent as a closed socket with a reason, so the browser client knows to stop retrying.
+function refuse(code, reason) {
+    const pair = new WebSocketPair();
+    const socket = pair[1];
+    socket.accept();
+    socket.close(code, reason);
+    return new Response(null, { status: 101, webSocket: pair[0] });
+}
+// The Worker decides who joins and who may send; the room trusts what it is told, since only
+// the Worker can reach it.
+export async function joinRoom(request, url, namespace, decide) {
+    if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+        return new Response("expected a WebSocket", { status: 426 });
+    const room = decodeURIComponent(url.pathname.slice(LIVE_PATH.length));
+    if (!ROOM_NAME.test(room))
+        return refuse(4404, "no such room");
+    const { user, canJoin, canSend } = await decide(room);
+    if (!canJoin)
+        return refuse(4403, "not allowed to join");
+    const headers = new Headers(request.headers);
+    headers.set("x-room", room);
+    headers.set("x-attachment", JSON.stringify({ room, user, canSend }));
+    const since = url.searchParams.get("since");
+    return roomStub(namespace, room).fetch(new Request(`https://room/join${since ? `?since=${encodeURIComponent(since)}` : ""}`, { headers }));
+}
+export function liveRoom(onMessage) {
+    return class LiveRoom {
+        env;
+        state;
+        constructor(state, env) {
+            this.env = env;
+            this.state = state;
+            this.state.storage.sql.exec("create table if not exists messages (seq integer primary key autoincrement, body text not null, sender text not null)");
+        }
+        async fetch(request) {
+            const url = new URL(request.url);
+            if (url.pathname === "/publish") {
+                this.deliver(await request.text(), null);
+                return new Response(null, { status: 204 });
+            }
+            const attachment = JSON.parse(request.headers.get("x-attachment") ?? "null");
+            const pair = new WebSocketPair();
+            const socket = pair[1];
+            this.state.acceptWebSocket(socket);
+            socket.serializeAttachment(attachment);
+            socket.send(JSON.stringify({ type: "hello", seq: this.latest() }));
+            const since = url.searchParams.get("since");
+            if (since !== null)
+                this.catchUp(socket, Number(since));
+            this.presence();
+            return new Response(null, { status: 101, webSocket: pair[0] });
+        }
+        async webSocketMessage(socket, raw) {
+            const attachment = socket.deserializeAttachment();
+            if (!attachment.canSend)
+                return socket.send(JSON.stringify({ type: "error", error: "not allowed to send to this room" }));
+            if (typeof raw !== "string" || raw.length > MAX_MESSAGE)
+                return socket.send(JSON.stringify({ type: "error", error: `messages are text up to ${MAX_MESSAGE} bytes` }));
+            let data;
+            try {
+                data = JSON.parse(raw).data;
+            }
+            catch {
+                return socket.send(JSON.stringify({ type: "error", error: "messages are JSON" }));
+            }
+            const seq = this.deliver(JSON.stringify(data ?? null), attachment.user, socket);
+            socket.send(JSON.stringify({ type: "ack", seq }));
+            const hook = onMessage(this.env);
+            if (hook)
+                this.state.waitUntil(hook(attachment.room, data, attachment.user));
+        }
+        webSocketClose(socket, code, reason) {
+            try {
+                socket.close(code, reason);
+            }
+            catch {
+                // already closed
+            }
+            this.presence(socket);
+        }
+        webSocketError(socket) {
+            this.presence(socket);
+        }
+        latest() {
+            return Number(this.state.storage.sql.exec("select coalesce(max(seq), 0) as seq from messages").toArray()[0].seq);
+        }
+        // A browser gone longer than the kept window can only be told to reload.
+        catchUp(socket, since) {
+            const oldest = Number(this.state.storage.sql.exec("select coalesce(min(seq), 0) as seq from messages").toArray()[0].seq);
+            if (since + 1 < oldest)
+                return socket.send(JSON.stringify({ type: "reload" }));
+            for (const row of this.state.storage.sql.exec("select seq, body, sender from messages where seq > ? order by seq", since).toArray()) {
+                socket.send(`{"type":"message","seq":${row.seq},"from":${row.sender},"data":${row.body}}`);
+            }
+        }
+        deliver(body, from, except) {
+            const sender = JSON.stringify(from);
+            const seq = Number(this.state.storage.sql.exec("insert into messages (body, sender) values (?, ?) returning seq", body, sender).toArray()[0].seq);
+            this.state.storage.sql.exec("delete from messages where seq <= ?", seq - KEPT_MESSAGES);
+            const frame = `{"type":"message","seq":${seq},"from":${sender},"data":${body}}`;
+            for (const socket of this.state.getWebSockets())
+                if (socket !== except)
+                    trySend(socket, frame);
+            return seq;
+        }
+        presence(leaving) {
+            const sockets = this.state.getWebSockets().filter((s) => s !== leaving);
+            const people = new Map();
+            let anonymous = 0;
+            for (const socket of sockets) {
+                const { user } = socket.deserializeAttachment();
+                if (user)
+                    people.set(user.id, user);
+                else
+                    anonymous++;
+            }
+            const frame = JSON.stringify({ type: "presence", people: [...people.values()], anonymous });
+            for (const socket of sockets)
+                trySend(socket, frame);
+        }
+    };
+}
+function trySend(socket, frame) {
+    try {
+        socket.send(frame);
+    }
+    catch {
+        // the socket closed between listing and sending; its close handler updates presence
+    }
+}
+//# sourceMappingURL=live.js.map

package/dist/runtime/live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../../src/runtime/live.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGlD,+FAA+F;AAC/F,8FAA8F;AAC9F,4DAA4D;AAE5D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,SAAS,WAAW,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAkC7C,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAC/B,IAAI,QAAQ,CAAC,UAAU,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,eAAe,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;AAE3J,MAAM,QAAQ,GAAG,CAAC,SAAwB,EAAE,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAEvG,MAAM,UAAU,UAAU,CAAC,SAAoC,EAAE,OAAgB;IAC/E,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAC9G,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,QAAQ,CAAC,CAAC;YACpG,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnJ,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAS,MAAM,CAAC,IAAiB,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAoC,CAAC;IAC1D,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAkB,CAAC,CAAC;AACjF,CAAC;AAQD,6FAA6F;AAC7F,2BAA2B;AAC3B,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,GAAQ,EAAE,SAAwB,EAAE,MAA+C;IAClI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW;QAAE,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChI,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAuB,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,oBAAoB,KAAK,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7I,CAAC;AAUD,MAAM,UAAU,QAAQ,CAAC,SAAkD;IACzE,OAAO,MAAM,QAAQ;QAKR,GAAG;QAJL,KAAK,CAAY;QAE1B,YACE,KAAc,EACL,GAAY;uBAAZ,GAAG;YAEZ,IAAI,CAAC,KAAK,GAAG,KAAkB,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uHAAuH,CAAC,CAAC;QACvJ,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,OAAgB;YAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;gBACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAe,CAAC;YAC3F,MAAM,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,IAAI;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAkB,CAAC,CAAC;QACjF,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAkB,EAAE,GAAyB;YAClE,MAAM,UAAU,GAAG,MAAM,CAAC,qBAAqB,EAAgB,CAAC;YAChE,IAAI,CAAC,UAAU,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAC;YAC1H,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,2BAA2B,WAAW,QAAQ,EAAE,CAAC,CAAC,CAAC;YACtK,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,cAAc,CAAC,MAAkB,EAAE,IAAY,EAAE,MAAc;YAC7D,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAED,cAAc,CAAC,MAAkB;YAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAED,MAAM;YACJ,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;QACpH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,MAAkB,EAAE,KAAa;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;YAC1H,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC/E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpI,MAAM,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,GAAG,WAAW,GAAG,CAAC,MAAM,WAAW,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAY,EAAE,IAAqB,EAAE,MAAmB;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;YACnJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,GAAG,GAAG,aAAa,CAAC,CAAC;YACxF,MAAM,KAAK,GAAG,2BAA2B,GAAG,WAAW,MAAM,WAAW,IAAI,GAAG,CAAC;YAChF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE;gBAAE,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC/F,OAAO,GAAG,CAAC;QACb,CAAC;QAED,QAAQ,CAAC,OAAoB;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,qBAAqB,EAAgB,CAAC;gBAC9D,IAAI,IAAI;oBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;oBAC/B,SAAS,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5F,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAkB,EAAE,KAAa;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC"}

package/dist/runtime/screens.d.ts

@@ -1,4 +1,4 @@
-export declare const SCREEN_PATHS: readonly ["/login", "/signup", "/forgot", "/reset", "/recover"];
+export declare const SCREEN_PATHS: readonly ["/login", "/signup", "/forgot", "/reset"];
 export type ScreenPath = (typeof SCREEN_PATHS)[number];
 export declare function isScreen(pathname: string): pathname is ScreenPath;
 export declare function renderScreen(path: ScreenPath, appName: string, stylesheet: string | undefined): Response;

package/dist/runtime/screens.js

@@ -1,7 +1,8 @@
 // Sign-in, sign-up and password screens every app with auth gets. Class names are part of the
 // public interface: an app restyles them with its own stylesheet, loaded after this one.
-export const SCREEN_PATHS = ["/login", "/signup", "/forgot", "/reset", "/recover"];
-const email = { name: "email", label: "Email", type: "email", autocomplete: "email" };
+export const SCREEN_PATHS = ["/login", "/signup", "/forgot", "/reset"];
+// Password managers pair a saved password with the field marked "username", even when it holds an email.
+const email = { name: "email", label: "Email", type: "email", autocomplete: "username" };
 const password = (autocomplete, label = "Password") => ({ name: "password", label, type: "password", autocomplete });
 const SCREENS = {
     "/login": {
@@ -29,13 +30,6 @@ const SCREENS = {
         button: "Change password",
         links: [["/login", "Back to sign in"]],
     },
-    "/recover": {
-        title: "Recover the owner account",
-        intro: "Use the recovery code you saved when you first signed in. It works once.",
-        fields: [email, { name: "code", label: "Recovery code", type: "text", autocomplete: "one-time-code" }, password("new-password", "New password")],
-        button: "Reset owner password",
-        links: [["/login", "Back to sign in"]],
-    },
 };
 export function isScreen(pathname) {
     return SCREEN_PATHS.includes(pathname);
@@ -44,7 +38,7 @@ export function renderScreen(path, appName, stylesheet) {
     const screen = SCREENS[path];
     const fields = screen.fields
         .map((f) => `<label class="platform-field"><span class="platform-label">${f.label}</span>` +
-        `<input class="platform-input" name="${f.name}" type="${f.type}" autocomplete="${f.autocomplete}" required${f.type === "password" ? ' minlength="8"' : ""}></label>`)
+        `<input class="platform-input" id="${f.name}" name="${f.name}" type="${f.type}" autocomplete="${f.autocomplete}" required${f.type === "password" ? ' minlength="8"' : ""}></label>`)
         .join("");
     const links = screen.links.map(([href, text]) => `<a href="${href}" data-carry>${text}</a>`).join("");
     const html = `<!doctype html>
@@ -56,7 +50,7 @@ export function renderScreen(path, appName, stylesheet) {
 <p class="platform-app">${escape(appName)}</p>
 <h1 class="platform-title">${screen.title}</h1>
 ${screen.intro ? `<p class="platform-intro">${screen.intro}</p>` : ""}
-<form class="platform-form" novalidate>${fields}
+<form class="platform-form" method="post" action="${path}" novalidate>${path === "/reset" ? '<input id="email" name="email" type="email" autocomplete="username" hidden>' : ""}${fields}
 <p class="platform-error" role="alert" hidden></p>
 <button class="platform-button" type="submit">${screen.button}</button></form>
 <div class="platform-message" role="status" hidden></div>
@@ -73,6 +67,7 @@ const STYLE = `
 :root{--platform-bg:#f4f6f8;--platform-card:#fff;--platform-fg:#1b2430;--platform-muted:#5d6a78;--platform-line:#d5dce3;--platform-accent:#2554c7;--platform-on-accent:#fff;--platform-error:#b42318;color-scheme:light dark}
 @media (prefers-color-scheme:dark){:root{--platform-bg:#11161c;--platform-card:#19212a;--platform-fg:#e6ebf0;--platform-muted:#9aa7b4;--platform-line:#2c3742;--platform-accent:#7aa2ff;--platform-on-accent:#0b1220;--platform-error:#ff8a80}}
 *{box-sizing:border-box}
+[hidden]{display:none!important}
 body.platform-screen{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px 16px;background:var(--platform-bg);color:var(--platform-fg);font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
 .platform-card{width:100%;max-width:380px;background:var(--platform-card);border:1px solid var(--platform-line);border-radius:12px;padding:28px 24px;display:flex;flex-direction:column;gap:16px}
 .platform-app{margin:0;font-size:13px;letter-spacing:.06em;text-transform:uppercase;color:var(--platform-muted)}
@@ -117,12 +112,7 @@ function say(...parts) {
 async function finish() {
   const invitation = params.get("invitation");
   if (invitation) await post("/api/auth/organization/accept-invitation", { invitationId: invitation }).catch(() => {});
-  const { code } = await post("/api/platform/recovery-code", {}).catch(() => ({}));
-  if (!code) return location.assign(next);
-  const box = Object.assign(document.createElement("p"), { className: "platform-code", textContent: code });
-  const go = Object.assign(document.createElement("button"), { className: "platform-button", type: "button", textContent: "I saved it, continue" });
-  go.onclick = () => location.assign(next);
-  say("You're the owner of this app. Save this recovery code somewhere safe: it resets your password if you ever lose access to your email, and it is shown only once.", box, go);
+  location.assign(next);
 }
 
 const actions = {
@@ -132,13 +122,8 @@ const actions = {
     if (data.token) return finish();
     say("Check your email for a link to confirm your address. It signs you in.");
   },
-  forgot: async v => { await post("/api/auth/request-password-reset", { email: v.email, redirectTo: "/reset" }); say("If that address has an account, a reset link is on its way."); },
+  forgot: async v => { await post("/api/auth/request-password-reset", { email: v.email, redirectTo: "/reset?email=" + encodeURIComponent(v.email) }); say("If that address has an account, a reset link is on its way."); },
   reset: async v => { await post("/api/auth/reset-password", { newPassword: v.password, token: params.get("token") }); say("Your password is changed. Sign in with it now."); },
-  recover: async v => {
-    const { ok } = await post("/api/platform/recover", { email: v.email, code: v.code, password: v.password });
-    if (!ok) throw new Error("That email and recovery code don't match.");
-    say("The owner password is changed and every session is signed out. Sign in with the new password; you'll get a new recovery code.");
-  },
 };
 
 form.addEventListener("submit", async e => {
@@ -152,6 +137,8 @@ form.addEventListener("submit", async e => {
   finally { button.disabled = false; }
 });
 
+// The reset link carries the email, so a password manager knows which saved login to update.
+if (page === "reset") document.getElementById("email").value = params.get("email") || "";
 if (page === "reset" && (params.get("error") || !params.get("token"))) say("That reset link has expired or was already used. Ask for a new one from the sign-in page.");
 if (page === "login") fetch("/api/auth/get-session", { credentials: "same-origin" }).then(r => r.json()).then(s => s && s.session && finish()).catch(() => {});
 `;