@liebstoeckel/live-server 0.3.5

package/LICENSE

@@ -0,0 +1,373 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.

package/README.md

@@ -0,0 +1,67 @@
+# @liebstoeckel/live-server
+
+> Live presenter and audience sync for liebstoeckel. `Bun.serve` plus Yjs over WebSocket on your LAN.
+
+Part of [liebstoeckel](https://liebstoeckel.app), a code-first presentation framework. You write decks in MDX and TSX and build them into a single self-contained HTML file with no server or runtime dependencies. The same file works offline, and when you host it the deck runs a live session between the presenter and the audience. Built on Bun, React 19, Motion, and Tailwind v4.
+
+> **Status: experimental, pre-1.0.** liebstoeckel is an evolving experiment, not yet production-ready. Before 1.0, breaking changes can land in any release without a major-version bump, so pin an exact version if you depend on it.
+
+It serves a built deck and keeps everyone in step over WebSockets. The presenter drives navigation, the audience follows, and interactive plugins (polls, Q&A, reactions) share state through a Yjs document. Roles are handed out as unguessable URL tokens, so you open the presenter link yourself and hand the audience link to the room. Most people drive it through `liebstoeckel live` in [@liebstoeckel/cli](https://www.npmjs.com/package/@liebstoeckel/cli). Use this package directly when you want to embed the server.
+
+## Install
+
+```sh
+bun add @liebstoeckel/live-server
+bun add yjs   # peer
+```
+
+> Bun-only, built on `Bun.serve`.
+
+## Usage
+
+```ts
+import { startServer } from "@liebstoeckel/live-server";
+
+const server = await startServer({ html: "dist/index.html" });
+
+console.log(server.links.presenter); // open this yourself
+console.log(server.links.viewer);    // share this with the room
+
+// …later
+await server.stop();
+```
+
+`startServer({ html, port?, hostname? = "0.0.0.0", publicHost? })` resolves to a `LiveServer` with `session`, `hub`, `port`, `baseUrl`, `links`, `serverPlugins`, and `stop()`. It serves `GET /?t=<token>` and a `WS /sync?t=<token>` endpoint.
+
+## Exports
+
+| Entry | What |
+|---|---|
+| `@liebstoeckel/live-server` | `startServer`, `lanAddress`, session helpers (`createSession`, `roleForToken`, `buildLinks`), the `Hub` / `Peer` runtime, `injectBootstrap`, deck loaders (`classifyTargetPath`, `loadDeckHtml`), the manifest/discovery and relay-client helpers, and the `ServeOptions` / `LiveServer` / `Session` / `Role` / `Links` types |
+| `@liebstoeckel/live-server/cli` | `runLive` (powers `liebstoeckel live`) |
+
+## Gotchas
+
+- Roles are URL tokens, not logins. Anyone with the presenter link can drive the deck, so treat it like a secret.
+- It runs server-plugin code on the host and binds `0.0.0.0` by default, so only serve decks you trust on a network you trust.
+- To share beyond the LAN, pair it with [@liebstoeckel/present-relay](https://docs.liebstoeckel.app/guides/relay/).
+
+## Architecture
+
+A `Bun.serve` HTTP and WebSocket server in front of a single-session Yjs relay. One deck is one process.
+
+- `server.ts` holds `startServer`. It extracts the embedded plugin manifest, then rehydrates and runs any server plugins on the host (a plugin's default export gets `{ doc, session }` and may return a teardown). It serves `GET /?t=<token>` (the deck HTML with the live bootstrap injected) and upgrades `WS /sync?t=<token>`. Inbound frames are capped at 4 MB, and Bun's auto-ping `idleTimeout` prunes dead sockets.
+- `relay.ts` holds the `Hub`, which owns the authoritative `Y.Doc`. New peers get full state when they join (late-join replay), and each peer's update broadcasts to every other peer, keyed by origin. Periodic no-op keepalive frames feed the client liveness watchdogs and prune dead peers. A failing send drops that peer instead of throwing.
+- `session.ts` mints two unguessable hex tokens per session. `roleForToken` maps a URL token to `presenter` or `viewer`, and denies anything unknown. `buildLinks` formats the shareable URLs.
+- `inject.ts` writes `window.__LIEBSTOECKEL_LIVE__` into `<head>` (the WebSocket URL, role, token, and viewer link), so the engine's live client activates instead of its standalone fallback.
+- `manifest.ts` and `discovery.ts` re-export `@liebstoeckel/plugin-sdk` (manifest extract and embed, plus server-bundle rehydrate), so the build and the live server share one implementation.
+- `relay-client.ts` is the WAN path. `uploadDeck` and `endSession` call a `present-relay` control API, and `runServerPluginsViaRelay` runs the deck's server plugins locally while connecting to the relay as the privileged `runner` peer, so deck code never runs on the relay.
+- `cli.ts` holds `runLive`, which powers `liebstoeckel live`. It classifies the target (a built `.html` or a project directory, building through `@liebstoeckel/engine` when needed), then runs in LAN mode (`startServer`) or relay mode (`relay-client`), printing the local and LAN presenter and audience links.
+
+## Links
+
+- [Live presenting](https://docs.liebstoeckel.app/guides/live/) and the [relay guide](https://docs.liebstoeckel.app/guides/relay/)
+- [Homepage](https://liebstoeckel.app)
+- [Source and issues](https://github.com/liebstoeckel/liebstoeckel-app)
+
+Licensed under [MPL-2.0](https://github.com/liebstoeckel/liebstoeckel-app/blob/main/LICENSE).

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@liebstoeckel/live-server",
+  "version": "0.3.5",
+  "description": "Live presenter and audience sync for liebstoeckel decks over Yjs and WebSocket.",
+  "keywords": [
+    "liebstoeckel",
+    "slides",
+    "presentation-slides",
+    "ai-agents",
+    "ai",
+    "skills",
+    "yjs",
+    "crdt",
+    "websocket",
+    "bun"
+  ],
+  "homepage": "https://liebstoeckel.app",
+  "bugs": "https://github.com/liebstoeckel/liebstoeckel-app/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/liebstoeckel/liebstoeckel-app.git",
+    "directory": "packages/live-server"
+  },
+  "license": "MPL-2.0",
+  "author": "Leon Kaucher <contact@liebstoeckel.app>",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "LICENSE"
+  ],
+  "engines": {
+    "bun": ">=1.3"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./cli": "./src/cli.ts"
+  },
+  "dependencies": {
+    "@liebstoeckel/engine": "^0.3.5",
+    "@liebstoeckel/plugin-sdk": "^0.3.4",
+    "@liebstoeckel/thumbnails": "^0.3.5",
+    "citty": "^0.2.2"
+  },
+  "peerDependencies": {
+    "yjs": "^13.6.31"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,211 @@
+#!/usr/bin/env bun
+import { defineCommand, runMain } from "citty";
+import { mkdtempSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { startServer } from "./server";
+import { buildLinks } from "./session";
+import { uploadDeck, runServerPluginsViaRelay, endSession } from "./relay-client";
+
+export type TargetKind = "html" | "project" | "unknown";
+
+/** Pure: decide how to treat a target path. */
+export function classifyTargetPath(path: string, isDir: boolean): TargetKind {
+  if (/\.html?$/i.test(path)) return "html";
+  if (isDir || /package\.json$/i.test(path)) return "project";
+  return "unknown";
+}
+
+const TRUST_WARNING = `
+⚠  liebstoeckel live server
+   This builds and runs the deck's code, including any plugins it bundles, server-side plugin code executes on THIS machine. Only run decks you trust.
+`;
+
+/** Resolve a target into deck HTML (building the project if needed). */
+export async function loadDeckHtml(arg: string): Promise<string> {
+  const abs = resolve(arg);
+  const isDir = statSync(abs).isDirectory();
+  const kind = classifyTargetPath(abs, isDir);
+  if (kind === "html") return Bun.file(abs).text();
+  if (kind === "project") {
+    const dir = abs.endsWith("package.json") ? dirname(abs) : abs;
+    const { bundleDeck } = await import("@liebstoeckel/engine/build");
+    // Build to a throwaway dir, NOT the deck's own dist/. `liebstoeckel build` owns
+    // dist/<slug>.html (ADR 0068); a stray dist/index.html written here would shadow
+    // it for `push`'s default-file pick and confuse the two artifacts (ticket 0030).
+    const outdir = mkdtempSync(join(tmpdir(), "lst-live-"));
+    const prev = process.cwd();
+    process.chdir(dir);
+    try {
+      await bundleDeck({ entry: "./index.html", outdir, inlinePackage: false });
+    } finally {
+      process.chdir(prev);
+    }
+    return Bun.file(join(outdir, "index.html")).text();
+  }
+  throw new Error(`Cannot present target: ${arg} (expected a .html file or a deck project)`);
+}
+
+interface ThumbSettings {
+  enabled: boolean;
+  width?: number;
+  quality?: number;
+  scale?: number;
+  format?: "webp" | "jpeg" | "png";
+}
+
+/** The thumbnail-related flags shared by `live`, `thumbs`, and `build`. Capture is
+ *  ON by default; `--no-thumbnails` flips `thumbnails` to false. */
+export interface ThumbFlags {
+  thumbnails?: boolean;
+  format?: string;
+  width?: string;
+  quality?: string;
+  scale?: string;
+}
+
+/** Derive thumbnail settings from the parsed flags. Capture is ON unless
+ *  `--no-thumbnails` was passed; an unknown `--format` and non-numeric sizes are
+ *  ignored (mirrors `liebstoeckel thumbs`). Pure, the unit-test anchor. */
+export function thumbSettings(f: ThumbFlags): ThumbSettings {
+  const num = (v: string | undefined): number | undefined => {
+    const n = v == null ? NaN : Number(v);
+    return Number.isFinite(n) ? n : undefined;
+  };
+  return {
+    enabled: f.thumbnails !== false,
+    width: num(f.width),
+    quality: num(f.quality),
+    scale: num(f.scale),
+    format: f.format === "webp" || f.format === "jpeg" || f.format === "png" ? f.format : undefined,
+  };
+}
+
+/** Capture + embed slide thumbnails into the deck HTML so the overview grid is
+ *  instant and uniform. On by default. The gate/capture/embed/never-fatal policy
+ *  lives in the thumbnails package's `withThumbnails`; this just wires it to the CLI
+ *  (dynamic import so `--no-thumbnails` pays no playwright-core cost, and a missing
+ *  module degrades to a hint rather than a crash). */
+export async function addThumbnails(html: string, s: ThumbSettings): Promise<string> {
+  if (!s.enabled) return html;
+  let mod: typeof import("@liebstoeckel/thumbnails");
+  try {
+    mod = await import("@liebstoeckel/thumbnails");
+  } catch {
+    process.stderr.write("⚠  thumbnails skipped: @liebstoeckel/thumbnails not installed (pass --no-thumbnails to silence)\n");
+    return html;
+  }
+  process.stderr.write("▶  capturing slide thumbnails …\n");
+  const { html: out, manifest, skipped } = await mod.withThumbnails(html, {
+    width: s.width,
+    quality: s.quality,
+    scale: s.scale,
+    format: s.format,
+    onSlide: (i, n) => process.stderr.write(`\r   slide ${i + 1}/${n}   `),
+  });
+  if (skipped) {
+    process.stderr.write(`\r⚠  thumbnails skipped: ${skipped}            \n`);
+    return html;
+  }
+  process.stderr.write(`\r✓  embedded ${Object.keys(manifest!.thumbs).length} thumbnails            \n`);
+  return out;
+}
+
+/** LAN mode: serve the deck locally and relay Yjs over /sync. */
+async function localMain(arg: string, thumbs: ThumbSettings, port?: number) {
+  process.stderr.write(TRUST_WARNING + "\n");
+  const html = await addThumbnails(await loadDeckHtml(arg), thumbs);
+  const live = await startServer({ html, port });
+
+  const local = buildLinks(`http://localhost:${live.port}`, live.session);
+  console.log(`\n▶  liebstoeckel live, session ${live.session.id}\n`);
+  console.log(`   on this machine   presenter  ${local.presenter}`);
+  console.log(`                     audience   ${local.viewer}`);
+  console.log(`   on the network    presenter  ${live.links.presenter}`);
+  console.log(`                     audience   ${live.links.viewer}`);
+  if (live.serverPlugins.length) console.log(`\n   server plugins:   ${live.serverPlugins.join(", ")}`);
+
+  const shutdown = () => {
+    live.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}
+
+/** Relay mode: upload the deck to a public relay; run the deck's server plugins
+ *  locally as the relay's privileged peer (deck code never runs on the relay). */
+async function relayMain(arg: string, relayUrl: string, relayToken: string, thumbs: ThumbSettings) {
+  process.stderr.write(TRUST_WARNING + "\n");
+  const html = await addThumbnails(await loadDeckHtml(arg), thumbs);
+  process.stderr.write(`▶  uploading deck to ${relayUrl} …\n`);
+  const info = await uploadDeck(relayUrl, relayToken, html);
+  const runner = await runServerPluginsViaRelay({
+    html,
+    syncUrl: info.urls.sync,
+    runnerToken: info.runnerToken,
+    sessionId: info.id,
+  });
+
+  console.log(`\n▶  liebstoeckel live (relayed), session ${info.id}\n`);
+  console.log(`   public            presenter  ${info.urls.presenter}`);
+  console.log(`                     audience   ${info.urls.viewer}`);
+  if (runner.plugins.length) {
+    console.log(`\n   server plugins (running locally): ${runner.plugins.join(", ")}`);
+  }
+
+  const shutdown = async () => {
+    runner.stop();
+    await endSession(relayUrl, relayToken, info.id);
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown());
+  process.on("SIGTERM", () => void shutdown());
+}
+
+export const liveCommand = defineCommand({
+  meta: {
+    name: "live",
+    description: "present live (LAN by default, or through a public --relay)",
+  },
+  args: {
+    deck: {
+      type: "positional",
+      required: false,
+      description: "deck .html or deck source dir (default: cwd)",
+      valueHint: "deck.html|deck-dir",
+    },
+    dir: { type: "string", description: "deck directory (alternative to the positional)", valueHint: "deck" },
+    relay: { type: "string", description: "public relay URL to present through", valueHint: "url" },
+    "relay-token": { type: "string", description: "relay account token (or LIEBSTOECKEL_RELAY_TOKEN)", valueHint: "tok" },
+    port: { type: "string", description: "LAN listen port", valueHint: "N" },
+    thumbnails: {
+      type: "boolean",
+      default: true,
+      description: "capture slide thumbnails (needs Chromium)",
+      negativeDescription: "skip thumbnail capture",
+    },
+    format: { type: "string", description: "thumbnail image format", valueHint: "webp|jpeg|png" },
+    width: { type: "string", description: "thumbnail width in px", valueHint: "N" },
+    quality: { type: "string", description: "thumbnail image quality", valueHint: "N" },
+    scale: { type: "string", description: "thumbnail device scale factor", valueHint: "N" },
+  },
+  async run({ args }) {
+    // Deck targeting (ADR 0050): a leading positional, else --dir, else cwd.
+    const arg = args.deck ?? args.dir ?? ".";
+    const thumbs = thumbSettings(args);
+    const relayUrl = args.relay;
+    const relayToken = args["relay-token"] ?? process.env.LIEBSTOECKEL_RELAY_TOKEN;
+    if (relayUrl) {
+      if (!relayToken) {
+        console.error("--relay requires --relay-token <token> (or LIEBSTOECKEL_RELAY_TOKEN)");
+        process.exit(1);
+      }
+      await relayMain(arg, relayUrl, relayToken, thumbs);
+    } else {
+      await localMain(arg, thumbs, Number(args.port) || undefined);
+    }
+  },
+});
+
+if (import.meta.main) void runMain(liveCommand);

package/src/discovery.ts

@@ -0,0 +1,2 @@
+// Canonical impl lives in plugin-sdk (shared by bundleDeck + the live server).
+export * from "@liebstoeckel/plugin-sdk/discovery";

package/src/index.ts

@@ -0,0 +1,40 @@
+export { startServer, lanAddress, type ServeOptions, type LiveServer } from "./server";
+export { Hub, type Peer, type Send, type HubOptions, type AudiencePolicy } from "./relay";
+export { audienceScopeFromHtml } from "./scope";
+export {
+  buildAudienceScope,
+  authorizeAudienceUpdate,
+  tokenBucket,
+  type AudienceScope,
+  type PeerRole,
+  type TokenBucket,
+} from "@liebstoeckel/plugin-sdk/authorize";
+export { createSession, roleForToken, buildLinks, type Session, type Role, type Links } from "./session";
+export { injectBootstrap, injectWatermark, type LiveBootstrap } from "./inject";
+export {
+  embedManifest,
+  extractManifest,
+  encodeManifest,
+  parseManifest,
+  encodeServerBundle,
+  rehydrateServerBundle,
+  MANIFEST_ATTR,
+  type PluginManifest,
+  type PluginManifestEntry,
+} from "./manifest";
+export {
+  classifyPlugin,
+  discoverFromDeps,
+  discoverFromPackageJson,
+  fsLookup,
+  PLUGIN_KEYWORD,
+  type DiscoveredPlugin,
+} from "./discovery";
+export { classifyTargetPath, loadDeckHtml } from "./cli";
+export {
+  uploadDeck,
+  endSession,
+  runServerPluginsViaRelay,
+  type RelaySessionInfo,
+  type RunnerHandle,
+} from "./relay-client";

package/src/inject.ts

@@ -0,0 +1,39 @@
+import type { Role } from "./session";
+
+export interface LiveBootstrap {
+  ws: string; // websocket url
+  session: string;
+  role: Role;
+  token: string;
+  participant: string;
+  /** the read-only follow-along link (for the in-deck QR) */
+  viewer?: string;
+}
+
+/** Inject `window.__LIEBSTOECKEL_LIVE__` into <head> so the client knows a server
+ *  is present (absence → standalone fallback). `</` is escaped to keep the inline
+ *  script well-formed. */
+export function injectBootstrap(html: string, boot: LiveBootstrap): string {
+  const json = JSON.stringify(boot).replace(/</g, "\\u003c");
+  const tag = `<script>window.__LIEBSTOECKEL_LIVE__=${json}</script>`;
+  if (html.includes("</head>")) return html.replace("</head>", `${tag}</head>`);
+  if (html.includes("<body")) return html.replace("<body", `${tag}<body`);
+  return tag + html;
+}
+
+const WATERMARK_HREF = "https://liebstoeckel.app";
+
+/** Inject a small, unobtrusive "Published with liebstoeckel" provenance badge for the
+ *  free-tier live audience view (ADR 0061 / ADR 0056). White-labelled (paid) sessions
+ *  omit it. Inserted before the last </body>; self-contained inline styles (the deck
+ *  runs in an opaque sandbox). The corner link opens in a new tab (allow-popups). */
+export function injectWatermark(html: string): string {
+  const badge =
+    `<a href="${WATERMARK_HREF}" target="_blank" rel="noopener noreferrer"` +
+    ` style="position:fixed;right:10px;bottom:10px;z-index:2147483647;` +
+    `font:500 11px/1 system-ui,sans-serif;color:#fff;background:rgba(0,0,0,.55);` +
+    `padding:5px 9px;border-radius:999px;text-decoration:none;letter-spacing:.02em;` +
+    `backdrop-filter:blur(4px);pointer-events:auto">Published with liebstoeckel</a>`;
+  const at = html.lastIndexOf("</body>");
+  return at >= 0 ? html.slice(0, at) + badge + html.slice(at) : html + badge;
+}

package/src/manifest.ts

@@ -0,0 +1,2 @@
+// Canonical impl lives in plugin-sdk (shared by bundleDeck + the live server).
+export * from "@liebstoeckel/plugin-sdk/manifest";

package/src/relay-client.ts

@@ -0,0 +1,104 @@
+import type * as Y from "yjs";
+import { connectLive } from "@liebstoeckel/engine/live";
+import { extractManifest, rehydrateServerBundle } from "./manifest";
+
+export interface RelaySessionInfo {
+  id: string;
+  presenterToken: string;
+  viewerToken: string;
+  runnerToken: string;
+  expiresAt: number;
+  urls: { presenter: string; viewer: string; sync: string };
+}
+
+/** Upload a built deck to a relay and create a public session (tokens + urls).
+ *  Audience write-scope + rate-limiting are enforced by default: a public viewer link
+ *  invites strangers, so the relay must drop any audience update outside the plugins'
+ *  declared `audienceWrites` (the scope is read from the deck's own embedded manifest).
+ *  Pass `{ enforce: false }` only for a deliberately trusted audience. */
+export async function uploadDeck(
+  relayUrl: string,
+  accountToken: string,
+  html: string,
+  opts: { enforce?: boolean } = {},
+): Promise<RelaySessionInfo> {
+  const headers: Record<string, string> = {
+    authorization: `Bearer ${accountToken}`,
+    "content-type": "text/html",
+  };
+  if (opts.enforce !== false) headers["x-live-enforce"] = "1";
+  const res = await fetch(`${relayUrl.replace(/\/$/, "")}/api/sessions`, {
+    method: "POST",
+    headers,
+    body: html,
+  });
+  if (!res.ok) {
+    const msg = await res.text().catch(() => "");
+    throw new Error(`relay upload failed (${res.status} ${res.statusText})${msg ? `: ${msg}` : ""}`);
+  }
+  return (await res.json()) as RelaySessionInfo;
+}
+
+/** Tear down a relay session (best-effort). */
+export async function endSession(relayUrl: string, accountToken: string, id: string): Promise<void> {
+  await fetch(`${relayUrl.replace(/\/$/, "")}/api/sessions/${id}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${accountToken}` },
+  }).catch(() => {});
+}
+
+export interface RunnerHandle {
+  plugins: string[];
+  stop(): void;
+}
+
+type ServerCtx = { doc: Y.Doc; session: { id: string } };
+
+/** Run a deck's *server* plugins locally and apply their effects to the relay's
+ *  shared doc by connecting as the privileged "runner" peer. The relay never runs
+ *  deck code, it only relays the resulting Yjs updates to viewers. No-op (still
+ *  resolves) for decks without any server plugins. */
+export async function runServerPluginsViaRelay(opts: {
+  html: string;
+  /** ws(s)://<relay>/sync/<id> (no token) */
+  syncUrl: string;
+  runnerToken: string;
+  sessionId: string;
+}): Promise<RunnerHandle> {
+  const manifest = extractManifest(opts.html);
+  const serverPlugins = (manifest?.plugins ?? []).filter((p) => p.hasServer && p.server);
+  if (serverPlugins.length === 0) return { plugins: [], stop() {} };
+
+  const sep = opts.syncUrl.includes("?") ? "&" : "?";
+  const conn = connectLive(
+    {
+      ws: `${opts.syncUrl}${sep}t=${encodeURIComponent(opts.runnerToken)}`,
+      session: opts.sessionId,
+      role: "presenter",
+      token: opts.runnerToken,
+    },
+    "runner",
+  );
+
+  const cleanups: Array<() => void> = [];
+  const plugins: string[] = [];
+  for (const p of serverPlugins) {
+    const mod = await rehydrateServerBundle(p.server!, p.name);
+    if (typeof mod.default === "function") {
+      const teardown = (mod.default as (ctx: ServerCtx) => unknown)({
+        doc: conn.doc,
+        session: { id: opts.sessionId },
+      });
+      if (typeof teardown === "function") cleanups.push(teardown as () => void);
+      plugins.push(p.name);
+    }
+  }
+
+  return {
+    plugins,
+    stop() {
+      for (const c of cleanups) c();
+      conn.close();
+    },
+  };
+}

package/src/relay.ts

@@ -0,0 +1,139 @@
+import * as Y from "yjs";
+import {
+  authorizeAudienceUpdate,
+  tokenBucket,
+  type AudienceScope,
+  type PeerRole,
+  type TokenBucket,
+} from "@liebstoeckel/plugin-sdk/authorize";
+
+export type Send = (data: Uint8Array) => void;
+
+export interface Peer {
+  key: symbol;
+  /** feed an update received from this peer into the shared doc */
+  recv(data: Uint8Array): void;
+  /** detach this peer */
+  leave(): void;
+}
+
+export interface AudiencePolicy {
+  /** which doc areas an audience peer may write (ADR 0061). */
+  scope: AudienceScope;
+  /** per-audience-peer write rate limit; omit for no limit. */
+  rate?: { capacity: number; refillPerSec: number };
+}
+
+export interface HubOptions {
+  /** if set, periodically send a benign keepalive frame to every peer so quiet
+   *  sessions still surface a "message" on the client (drives its watchdog) and
+   *  dead peers are pruned. 0/undefined = off. */
+  keepaliveMs?: number;
+  /** if set, `audience`-role peers are write-scope enforced (ADR 0061): updates that
+   *  touch anything outside the scope are dropped, not applied. Absent → no
+   *  enforcement (every peer may write, the local/LAN trusted model, ADR 0012). */
+  audience?: AudiencePolicy;
+}
+
+// A valid Yjs update for an empty doc: applying it is a no-op (no structs), but
+// it's a real frame, so the client's message handler fires and resets its
+// liveness watchdog without mutating any state.
+const KEEPALIVE: Uint8Array = Y.encodeStateAsUpdate(new Y.Doc());
+
+/** A minimal Yjs relay hub for one session: holds the authoritative doc, sends
+ *  full state to newcomers, and broadcasts each update to every *other* peer.
+ *  Server-plugin mutations (origin = undefined) broadcast to all. */
+export class Hub {
+  readonly doc = new Y.Doc();
+  private peers = new Map<symbol, Send>();
+  private keepalive?: ReturnType<typeof setInterval>;
+  private readonly audience?: AudiencePolicy;
+
+  constructor(opts: HubOptions = {}) {
+    this.audience = opts.audience;
+    this.doc.on("update", (update: Uint8Array, origin: unknown) => {
+      for (const [key, send] of this.peers) {
+        if (key !== origin) this.deliver(key, send, update);
+      }
+    });
+    if (opts.keepaliveMs && opts.keepaliveMs > 0) {
+      this.keepalive = setInterval(() => {
+        for (const [key, send] of this.peers) this.deliver(key, send, KEEPALIVE);
+      }, opts.keepaliveMs);
+      // don't keep the process alive just for keepalives
+      (this.keepalive as { unref?: () => void }).unref?.();
+    }
+  }
+
+  /** Send to one peer; a failing send (dead/closing socket) drops that peer
+   *  rather than throwing out of the broadcast loop and starving the others. */
+  private deliver(key: symbol, send: Send, data: Uint8Array): void {
+    try {
+      send(data);
+    } catch {
+      this.peers.delete(key);
+    }
+  }
+
+  get size(): number {
+    return this.peers.size;
+  }
+
+  /** Encode the full doc state as opaque Yjs update bytes, for persisting a session
+   *  snapshot to object storage (ADR 0061). Persisting bytes runs no deck code. */
+  snapshot(): Uint8Array {
+    return Y.encodeStateAsUpdate(this.doc);
+  }
+
+  /** Seed the doc from a prior snapshot (re-seed on relay restart). No-op on garbage. */
+  seed(update: Uint8Array): void {
+    try {
+      Y.applyUpdate(this.doc, update);
+    } catch {
+      /* ignore bad seed */
+    }
+  }
+
+  join(send: Send, role: PeerRole = "presenter"): Peer {
+    const key = Symbol("peer");
+    this.peers.set(key, send);
+    // hand the newcomer the full current state (late-join replay)
+    this.deliver(key, send, Y.encodeStateAsUpdate(this.doc));
+
+    // An audience peer is write-scope enforced when a policy is configured (ADR 0061);
+    // presenter/runner peers are trusted and write the whole doc. With no policy the
+    // Hub is the open, trusted relay (ADR 0012), every peer may write.
+    const enforced = role === "audience" && this.audience !== undefined;
+    const bucket: TokenBucket | undefined =
+      enforced && this.audience!.rate
+        ? tokenBucket(this.audience!.rate.capacity, this.audience!.rate.refillPerSec)
+        : undefined;
+
+    return {
+      key,
+      recv: (data) => {
+        // a malformed/garbage frame must never crash the relay or other peers
+        try {
+          if (enforced) {
+            if (bucket && !bucket.tryConsume(Date.now())) return; // rate-limited → drop
+            if (!authorizeAudienceUpdate(Y.encodeStateAsUpdate(this.doc), data, this.audience!.scope)) {
+              return; // out-of-scope write → drop, never applied/broadcast
+            }
+          }
+          Y.applyUpdate(this.doc, data, key);
+        } catch {
+          /* ignore bad update */
+        }
+      },
+      leave: () => {
+        this.peers.delete(key);
+      },
+    };
+  }
+
+  destroy(): void {
+    if (this.keepalive) clearInterval(this.keepalive);
+    this.peers.clear();
+    this.doc.destroy();
+  }
+}

package/src/scope.ts

@@ -0,0 +1,9 @@
+import { extractManifest } from "./manifest";
+import { buildAudienceScope, type AudienceScope } from "@liebstoeckel/plugin-sdk/authorize";
+
+// Build the audience write-scope for a session straight from the deck's own embedded
+// plugin manifest (ADR 0061), the deck already carries it, so the relay needs no
+// extra input to know which plugin fields an audience may write.
+export function audienceScopeFromHtml(html: string): AudienceScope {
+  return buildAudienceScope(extractManifest(html));
+}

package/src/server.ts

@@ -0,0 +1,129 @@
+import * as os from "node:os";
+import { Hub } from "./relay";
+import { createSession, roleForToken, buildLinks, type Session, type Links } from "./session";
+import { injectBootstrap } from "./inject";
+import { extractManifest, rehydrateServerBundle } from "./manifest";
+
+/** First non-internal IPv4 address (for LAN links / QR). */
+export function lanAddress(): string {
+  for (const list of Object.values(os.networkInterfaces())) {
+    for (const ni of list ?? []) {
+      if (ni.family === "IPv4" && !ni.internal) return ni.address;
+    }
+  }
+  return "127.0.0.1";
+}
+
+export interface ServeOptions {
+  /** built deck HTML (ideally with an embedded plugin manifest) */
+  html: string;
+  port?: number;
+  hostname?: string;
+  /** host used in the printed links / QR (defaults to the LAN address) */
+  publicHost?: string;
+}
+
+export interface LiveServer {
+  session: Session;
+  hub: Hub;
+  port: number;
+  baseUrl: string;
+  links: Links;
+  serverPlugins: string[];
+  stop(): void;
+}
+
+type WSData = { peer: ReturnType<Hub["join"]> | null };
+
+/** cap inbound WS frames (Yjs updates for a poll-class deck are tiny) */
+const MAX_FRAME_BYTES = 4 * 1024 * 1024;
+
+/** Start a live session server for one deck. Rehydrates & runs any server plugins
+ *  from the manifest, serves the deck with the live bootstrap injected, and relays
+ *  Yjs over `/sync`. */
+export async function startServer(opts: ServeOptions): Promise<LiveServer> {
+  const session = createSession();
+  const hub = new Hub({ keepaliveMs: 25_000 });
+  const cleanups: Array<() => void> = [];
+  const serverPlugins: string[] = [];
+
+  const manifest = extractManifest(opts.html);
+  if (manifest) {
+    for (const p of manifest.plugins) {
+      if (!p.hasServer || !p.server) continue;
+      const mod = await rehydrateServerBundle(p.server, p.name);
+      if (typeof mod.default === "function") {
+        // Runs the default instance; a multi-instance server plugin enumerates the rest
+        // from the doc index (readPluginInstances / observePluginIndex). ADR 0033/0034.
+        const teardown = (mod.default as (ctx: { doc: typeof hub.doc; session: { id: string }; instance: string }) => unknown)({
+          doc: hub.doc,
+          session: { id: session.id },
+          instance: "",
+        });
+        if (typeof teardown === "function") cleanups.push(teardown as () => void);
+        serverPlugins.push(p.name);
+      }
+    }
+  }
+
+  const server = Bun.serve<WSData>({
+    port: opts.port ?? 0,
+    hostname: opts.hostname ?? "0.0.0.0",
+    fetch(req, srv) {
+      const url = new URL(req.url);
+      const token = url.searchParams.get("t");
+
+      if (url.pathname === "/sync") {
+        if (!roleForToken(session, token)) return new Response("forbidden", { status: 403 });
+        const data: WSData = { peer: null };
+        return srv.upgrade(req, { data }) ? undefined : new Response("upgrade failed", { status: 400 });
+      }
+
+      if (url.pathname === "/") {
+        const role = roleForToken(session, token);
+        if (!role || !token) return new Response("Invalid or expired link.", { status: 403 });
+        const wsProto = url.protocol === "https:" ? "wss:" : "ws:";
+        const wsUrl = `${wsProto}//${url.host}/sync?t=${token}`;
+        const viewer = `${url.protocol}//${url.host}/?t=${session.viewerToken}`;
+        const body = injectBootstrap(opts.html, { ws: wsUrl, session: session.id, role, token, participant: "", viewer });
+        return new Response(body, { headers: { "content-type": "text/html; charset=utf-8" } });
+      }
+
+      return new Response("not found", { status: 404 });
+    },
+    websocket: {
+      // Bun auto-sends pings (sendPings default) and closes connections idle past
+      // this window, so a dead client is detected and its peer cleaned up.
+      idleTimeout: 120,
+      open(ws) {
+        ws.data.peer = hub.join((d) => ws.send(d));
+      },
+      message(ws, msg) {
+        if (typeof msg === "string") return;
+        const bytes = new Uint8Array(msg as unknown as ArrayBufferLike);
+        if (bytes.byteLength > MAX_FRAME_BYTES) return; // drop oversized frames
+        ws.data.peer?.recv(bytes); // recv is internally guarded
+      },
+      close(ws) {
+        ws.data.peer?.leave();
+      },
+    },
+  });
+
+  const host = opts.publicHost ?? lanAddress();
+  const port = server.port ?? 0;
+  const baseUrl = `http://${host}:${port}`;
+  return {
+    session,
+    hub,
+    port,
+    baseUrl,
+    links: buildLinks(baseUrl, session),
+    serverPlugins,
+    stop() {
+      for (const c of cleanups) c();
+      server.stop(true);
+      hub.destroy();
+    },
+  };
+}

package/src/session.ts

@@ -0,0 +1,40 @@
+export type Role = "presenter" | "viewer";
+
+export interface Session {
+  id: string;
+  presenterToken: string;
+  viewerToken: string;
+}
+
+const hex = (bytes = 16): string => {
+  const a = new Uint8Array(bytes);
+  crypto.getRandomValues(a);
+  return Array.from(a, (b) => b.toString(16).padStart(2, "0")).join("");
+};
+
+/** Create a session with two unguessable tokens. `gen` is injectable for tests. */
+export function createSession(gen: () => string = () => hex()): Session {
+  return { id: gen().slice(0, 8), presenterToken: gen(), viewerToken: gen() };
+}
+
+/** Resolve a role from a URL token. Unknown/missing → null (deny). */
+export function roleForToken(s: Session, token: string | undefined | null): Role | null {
+  if (!token) return null;
+  if (token === s.presenterToken) return "presenter";
+  if (token === s.viewerToken) return "viewer";
+  return null;
+}
+
+export interface Links {
+  presenter: string;
+  viewer: string;
+}
+
+/** Build the shareable links. `base` is e.g. `http://192.168.1.5:4321`. */
+export function buildLinks(base: string, s: Session): Links {
+  const b = base.replace(/\/$/, "");
+  return {
+    presenter: `${b}/?t=${s.presenterToken}`,
+    viewer: `${b}/?t=${s.viewerToken}`,
+  };
+}