@pipeup/share 0.0.0-stage → 0.5.0

package/dist/cli.js

@@ -0,0 +1,1196 @@
+#!/usr/bin/env node
+
+// share/src/cli.ts
+import { readFile, writeFile } from "node:fs/promises";
+
+// kit/src/encoding.ts
+var utf8 = (text2) => new TextEncoder().encode(text2);
+var text = (bytes) => new TextDecoder().decode(bytes);
+function toB64u(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromB64u(s) {
+  const std = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(std + "=".repeat((4 - std.length % 4) % 4));
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+function toB64(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(s);
+}
+function fromB64(s) {
+  return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+}
+var randomBytes = (n) => crypto.getRandomValues(new Uint8Array(n));
+async function sha256(data) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+}
+
+// kit/src/derive.ts
+var salt = (docId) => utf8(`pipeup/v1/doc:${docId}`);
+async function hkdf(ikm, docId, info, bits) {
+  const base = await crypto.subtle.importKey("raw", ikm, "HKDF", false, ["deriveBits"]);
+  return crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: salt(docId), info: utf8(info) },
+    base,
+    bits
+  );
+}
+function ladder(docId, room) {
+  return {
+    docId,
+    key: async (p2) => crypto.subtle.importKey("raw", await hkdf(room, docId, `pipeup/v1/${p2}/key`, 256), "AES-GCM", false, [
+      "encrypt",
+      "decrypt"
+    ]),
+    addr: async (p2) => toB64u(new Uint8Array(await hkdf(room, docId, `pipeup/v1/${p2}/address`, 128))),
+    aad: (p2) => `pipeup/v1/${p2}:${docId}`
+  };
+}
+
+// kit/src/envelope.ts
+var MAX_INFLATED = 1e6;
+var MAX_OPS = 1e3;
+async function pipe(data, t2, cap = Infinity) {
+  const reader = new Blob([data]).stream().pipeThrough(t2).getReader();
+  const chunks2 = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.length;
+    if (total > cap) {
+      void reader.cancel();
+      throw new Error("too large");
+    }
+    chunks2.push(value);
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const c of chunks2) {
+    out.set(c, at);
+    at += c.length;
+  }
+  return out;
+}
+var seal = (l, p2, ops) => sealJson(l, p2, { pipeup: 1, doc: l.docId, sealed: false, ops });
+async function sealJson(l, p2, value) {
+  const plain = utf8(JSON.stringify(value));
+  const iv = randomBytes(12);
+  const body = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: utf8(l.aad(p2)) },
+    await l.key(p2),
+    await pipe(plain, new CompressionStream("deflate-raw"))
+  );
+  const out = new Uint8Array(13 + body.byteLength);
+  out[0] = 1;
+  out.set(iv, 1);
+  out.set(new Uint8Array(body), 13);
+  return out;
+}
+async function openJson(l, p2, bytes) {
+  try {
+    if (bytes.length < 13 + 16 || bytes[0] !== 1) return null;
+    const plain = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: bytes.slice(1, 13), additionalData: utf8(l.aad(p2)) },
+      await l.key(p2),
+      bytes.slice(13)
+    );
+    return JSON.parse(
+      text(await pipe(new Uint8Array(plain), new DecompressionStream("deflate-raw"), MAX_INFLATED))
+    );
+  } catch {
+    return null;
+  }
+}
+function asBatch(l, value) {
+  const file = value;
+  if (file?.pipeup !== 1 || file.doc !== l.docId || !Array.isArray(file.ops) || file.ops.length > MAX_OPS)
+    return null;
+  let newer = 0;
+  for (const op of file.ops) {
+    const v = op?.body?.v;
+    if (typeof v === "number" && v !== 1) newer++;
+  }
+  return { ops: file.ops, newer };
+}
+async function open(l, p2, bytes) {
+  return asBatch(l, await openJson(l, p2, bytes));
+}
+var toText = (bytes) => `pu1.${toB64u(bytes)}`;
+var fromText = (s) => {
+  if (!/^pu1\.[A-Za-z0-9_-]+$/.test(s)) return null;
+  try {
+    return fromB64u(s.slice(4));
+  } catch {
+    return null;
+  }
+};
+
+// kit/src/transport.ts
+var RetryAfter = class extends Error {
+  /** `limit`: the service's standing rule (one post per this long), so later sends keep at least this gap. */
+  constructor(seconds, limit = false) {
+    super(`try again in ${seconds} s`);
+    this.seconds = seconds;
+    this.limit = limit;
+    this.name = "RetryAfter";
+  }
+};
+
+// kit/src/schnorr.ts
+var P = 2n ** 256n - 2n ** 32n - 977n;
+
+// ../pipeup/dist/pipeup.core.js
+function f(t2) {
+  let e = "";
+  for (let r of t2) e += String.fromCharCode(r);
+  return btoa(e).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function g(t2) {
+  let e = atob(t2.replace(/-/g, "+").replace(/_/g, "/")), r = new Uint8Array(e.length);
+  for (let n = 0; n < e.length; n++) r[n] = e.charCodeAt(n);
+  return r;
+}
+function J(t2 = 16) {
+  return f(crypto.getRandomValues(new Uint8Array(t2)));
+}
+function m(t2) {
+  return new TextEncoder().encode(t2);
+}
+function x(t2) {
+  if (t2 === null || typeof t2 != "object") return JSON.stringify(t2);
+  if (Array.isArray(t2)) return "[" + t2.map(x).join(",") + "]";
+  let e = t2;
+  return "{" + Object.keys(e).filter((r) => e[r] !== void 0).sort().map((r) => JSON.stringify(r) + ":" + x(e[r])).join(",") + "}";
+}
+var Te = /^[A-Za-z0-9_-]{43}$/;
+var Ie = 512;
+var w = /* @__PURE__ */ new Map();
+async function R() {
+  let t2 = await crypto.subtle.generateKey({ name: "Ed25519" }, false, ["sign", "verify"]), e = new Uint8Array(await crypto.subtle.exportKey("raw", t2.publicKey));
+  return { publicKey: f(e), privateKey: t2.privateKey };
+}
+async function S(t2, e) {
+  let r = await crypto.subtle.sign({ name: "Ed25519" }, t2.privateKey, e);
+  return f(new Uint8Array(r));
+}
+async function Q(t2, e, r) {
+  if (!Te.test(t2)) return false;
+  try {
+    if (f(g(t2)) !== t2) return false;
+    let n = w.get(t2);
+    if (!n) {
+      w.size >= Ie && w.delete(w.keys().next().value), n = crypto.subtle.importKey("raw", g(t2), { name: "Ed25519" }, true, ["verify"]), w.set(t2, n);
+      let o = n;
+      o.catch(() => {
+        w.get(t2) === o && w.delete(t2);
+      });
+    }
+    return await crypto.subtle.verify({ name: "Ed25519" }, await n, g(r), e);
+  } catch {
+    return false;
+  }
+}
+var k = 1e4;
+var Ce = 2 ** 18;
+var D = 2 ** 40;
+var L = 2 ** 47;
+var p = { doc: 64, path: 2e3, snapshot: 500, anchorId: 200, quote: 1e4, context: 64, viewEntries: 16, viewKey: 64, viewValue: 200 };
+var Me = /^[0-9a-f]{8}$/;
+var F = /^[A-Za-z0-9_-]{43}$/;
+var $e = /^[A-Za-z0-9_-]{43}$/;
+var Ne = /* @__PURE__ */ new Set(["create", "reply", "edit", "delete", "resolve", "reopen"]);
+async function Y(t2, e) {
+  if (t2.author !== e.publicKey) throw new Error("pipeup: an op must be signed by its author");
+  return { body: t2, sig: await S(e, m(x(t2))) };
+}
+var h = (t2, e) => typeof t2 == "string" && t2.length <= e;
+var O = (t2) => !!t2 && typeof t2 == "object";
+var V = (t2) => typeof t2 == "number" && Number.isFinite(t2) && t2 >= 0 && t2 <= 1;
+function B(t2) {
+  if (!O(t2)) return false;
+  let { id: e, path: r, fingerprint: n, snapshot: o, quote: i, point: s, view: a } = t2;
+  if (!h(r, p.path) || !h(o, p.snapshot) || typeof n != "string" || !Me.test(n) || e !== void 0 && (!h(e, p.anchorId) || e === "") || i !== void 0 && (!O(i) || !h(i.exact, p.quote) || i.exact === "" || !h(i.prefix, p.context) || !h(i.suffix, p.context)) || s !== void 0 && (!O(s) || !V(s.x) || !V(s.y))) return false;
+  if (a !== void 0) {
+    if (!O(a) || Array.isArray(a)) return false;
+    let d = Object.entries(a);
+    if (d.length > p.viewEntries || !d.every(([c, l]) => c.length <= p.viewKey && h(l, p.viewValue))) return false;
+  }
+  return true;
+}
+function W(t2) {
+  if (!O(t2)) return false;
+  let { body: e, sig: r } = t2;
+  if (typeof r != "string" || !O(e) || JSON.stringify({ body: e, sig: r }).length > Ce) return false;
+  let n = e;
+  return !(n.v !== 1 || typeof n.id != "string" || !F.test(n.id) || !Ne.has(n.kind) || !h(n.doc, p.doc) || n.doc === "" || typeof n.thread != "string" || !F.test(n.thread) || typeof n.author != "string" || !$e.test(n.author) || typeof n.name != "string" || n.name.length > 80 || n.name !== n.name.trim() || typeof n.clock != "number" || !Number.isSafeInteger(n.clock) || n.clock < 1 || n.clock > D || typeof n.at != "number" || !Number.isSafeInteger(n.at) || n.at < 0 || n.at > L || n.text !== void 0 && (!h(n.text, k) || n.text !== n.text.trim()) || n.target !== void 0 && (typeof n.target != "string" || !F.test(n.target)) || (n.kind === "create" || n.kind === "reply" || n.kind === "edit") && !n.text || (n.kind === "reply" || n.kind === "edit" || n.kind === "delete") && !n.target || n.kind === "create" && (n.id !== n.thread || !B(n.anchor)));
+}
+function ee(t2) {
+  return Q(t2.body.author, m(x(t2.body)), t2.sig);
+}
+function te(t2, e) {
+  return t2.body.clock !== e.body.clock ? t2.body.clock - e.body.clock : t2.body.at !== e.body.at ? t2.body.at - e.body.at : t2.body.author !== e.body.author ? t2.body.author < e.body.author ? -1 : 1 : t2.body.id !== e.body.id ? t2.body.id < e.body.id ? -1 : 1 : 0;
+}
+function re(t2) {
+  let e = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map();
+  for (let { body: o } of [...t2].sort(te)) {
+    if (o.name && n.set(o.author, o.name), o.kind === "create") {
+      if (e.has(o.id) || !o.anchor || o.text === void 0) continue;
+      let a = ne(o.id, o.author, o.name, o.text, o.at);
+      e.set(o.id, { id: o.id, anchor: o.anchor, root: a, resolved: false }), r.set(o.id, { comment: a, thread: o.id });
+      continue;
+    }
+    let i = e.get(o.thread);
+    if (!i) continue;
+    if (o.kind === "resolve" || o.kind === "reopen") {
+      i.resolved = o.kind === "resolve";
+      continue;
+    }
+    let s = o.target ? r.get(o.target) : void 0;
+    if (!(!s || s.thread !== o.thread)) {
+      if (o.kind === "reply") {
+        if (r.has(o.id) || o.text === void 0) continue;
+        let a = ne(o.id, o.author, o.name, o.text, o.at);
+        i.root.replies.push(a), r.set(o.id, { comment: a, thread: o.thread });
+        continue;
+      }
+      o.author !== s.comment.author || s.comment.deleted || (o.kind === "edit" && o.text !== void 0 && (s.comment.text = o.text, s.comment.edited = true), o.kind === "delete" && (s.comment.text = "", s.comment.deleted = true));
+    }
+  }
+  for (let { comment: o } of r.values()) o.name || (o.unnamed = true, o.name = n.get(o.author) ?? "");
+  return [...e.values()];
+}
+function ne(t2, e, r, n, o) {
+  return { id: t2, author: e, name: r, text: n, at: o, edited: false, deleted: false, replies: [] };
+}
+async function _(t2) {
+  let e = { ...t2, id: void 0, thread: t2.kind === "create" ? void 0 : t2.thread }, r = await crypto.subtle.digest("SHA-256", m(x(e)));
+  return f(new Uint8Array(r));
+}
+var T = class {
+  constructor(e) {
+    this.doc = e;
+  }
+  ops = /* @__PURE__ */ new Map();
+  clock = 0;
+  createAt = /* @__PURE__ */ new Map();
+  threadAt = /* @__PURE__ */ new Map();
+  get size() {
+    return this.ops.size;
+  }
+  all() {
+    return [...this.ops.values()];
+  }
+  threads() {
+    return re(this.ops.values());
+  }
+  async add(e) {
+    let r = [];
+    for (let n of e) {
+      if (!W(n) || n.body.doc !== this.doc || this.ops.has(n.body.id) || n.body.id !== await _(n.body) || !await ee(n)) continue;
+      let o = { body: n.body, sig: n.sig };
+      this.ops.set(o.body.id, o), this.clock = Math.max(this.clock, o.body.clock), o.body.kind === "create" && this.createAt.set(o.body.author, Math.max(this.createAt.get(o.body.author) ?? 0, o.body.at)), this.threadAt.set(o.body.thread, Math.max(this.threadAt.get(o.body.thread) ?? 0, o.body.at)), r.push(o);
+    }
+    return r;
+  }
+  async append(e, r, n) {
+    let o = { v: 1, ...n, id: "", thread: n.kind === "create" ? "" : n.thread, doc: this.doc, author: e.publicKey, name: r, clock: Math.min(this.clock + 1, D), at: Math.min(Math.max(Date.now(), n.kind === "create" ? (this.createAt.get(e.publicKey) ?? 0) + 1 : (this.threadAt.get(n.thread) ?? 0) + 1), L) };
+    o.id = await _(o);
+    let i = this.ops.get(o.id);
+    if (i) return i;
+    o.kind === "create" && (o.thread = o.id);
+    let [s] = await this.add([await Y(o, e)]);
+    if (!s) throw new Error("pipeup: could not record this change");
+    return s;
+  }
+};
+var Re = /^([A-Za-z0-9_-]{16}):([A-Za-z0-9_-]{43})$/;
+function Fe() {
+  return `${J(12)}:${f(crypto.getRandomValues(new Uint8Array(32)))}`;
+}
+async function De(t2) {
+  let e = Re.exec(t2.trim()), r = e?.[1], n = e?.[2];
+  if (!r || !n) throw new Error('pipeup: data-pipeup-doc must look like "<id>:<key>", as made by newDocumentAttribute()');
+  let o = await crypto.subtle.importKey("raw", g(n), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+  return { id: r, key: o };
+}
+async function oe(t2, e, r) {
+  let n = crypto.getRandomValues(new Uint8Array(12)), o = await crypto.subtle.encrypt({ name: "AES-GCM", iv: n, additionalData: m(r) }, t2, m(e));
+  return { iv: f(n), data: f(new Uint8Array(o)) };
+}
+async function ie(t2, e, r) {
+  try {
+    let n = await crypto.subtle.decrypt({ name: "AES-GCM", iv: g(e.iv), additionalData: m(r) }, t2, g(e.data));
+    return new TextDecoder().decode(n);
+  } catch {
+    throw new Error("pipeup: this feedback could not be opened with this document");
+  }
+}
+var Le = 5e6;
+var se = (t2) => `pipeup-file:${t2}`;
+async function ae(t2, e, r) {
+  let n = r ? { pipeup: 1, doc: t2, sealed: true, ...await oe(r, JSON.stringify(e), se(t2)) } : { pipeup: 1, doc: t2, sealed: false, ops: e };
+  return JSON.stringify(n, null, 2);
+}
+async function de(t2, e, r) {
+  if (t2.length > Le) throw new Error("pipeup: this feedback file is too large");
+  let n;
+  try {
+    n = JSON.parse(t2);
+  } catch {
+    throw new Error("pipeup: this is not an Pipeup feedback file");
+  }
+  if (!n || typeof n != "object" || n.pipeup !== 1 || typeof n.doc != "string") throw new Error("pipeup: this is not an Pipeup feedback file");
+  if (n.doc !== e) throw new Error("pipeup: this feedback is for a different document");
+  if (!n.sealed) return Array.isArray(n.ops) ? n.ops : [];
+  if (!r) throw new Error("pipeup: this feedback is sealed, and this page has no document key");
+  if (typeof n.iv != "string" || typeof n.data != "string") throw new Error("pipeup: this is not an Pipeup feedback file");
+  let o;
+  try {
+    o = await ie(r, { iv: n.iv, data: n.data }, se(e));
+  } catch {
+    throw new Error("pipeup: this feedback could not be opened with this document's key");
+  }
+  let i;
+  try {
+    i = JSON.parse(o);
+  } catch {
+    throw new Error("pipeup: this is not an Pipeup feedback file");
+  }
+  return Array.isArray(i) ? i : [];
+}
+var Be = 5e3;
+var _e = /^[a-z][a-z0-9-]{1,23}\/[a-z][a-z0-9-]{0,31}$/;
+var ce = 80;
+var E = class extends Error {
+  constructor(r, n, o = 1) {
+    super("pipeup: shown here, but not saved yet");
+    this.id = r;
+    this.cause = n;
+    this.count = o;
+    this.name = "UnsavedChangeError";
+  }
+};
+var K = class t {
+  constructor(e, r) {
+    this.log = e;
+    this.options = r;
+    this.displayName = r.name.trim() ? pe(r.name) : "";
+  }
+  listeners = /* @__PURE__ */ new Set();
+  cache = [];
+  comments = /* @__PURE__ */ new Map();
+  displayName;
+  e = Promise.resolve();
+  unsaved = [];
+  static async open(e) {
+    if (typeof e.doc != "string" || e.doc === "" || e.doc.length > p.doc) throw new Error(`pipeup: the document id must be 1 to ${p.doc} characters`);
+    let r = new T(e.doc), n = await e.store.load(e.doc), o = n.length - (await r.add(n)).length;
+    o && console.warn(`pipeup: ${o} saved change${o === 1 ? "" : "s"} on this page couldn't be read; kept as saved`);
+    let i = new t(r, e);
+    return i.refresh(false), i;
+  }
+  get id() {
+    return this.options.doc;
+  }
+  get me() {
+    return this.options.identity.publicKey;
+  }
+  get name() {
+    return this.displayName;
+  }
+  set name(e) {
+    this.displayName = pe(e), this.refresh(true, [], "");
+  }
+  threads() {
+    return this.cache;
+  }
+  ops() {
+    return this.log.all();
+  }
+  onChange(e) {
+    return this.listeners.add(e), () => this.listeners.delete(e);
+  }
+  comment(e, r) {
+    return this.enqueue(() => this.write({ kind: "create", anchor: e, text: U(r) }));
+  }
+  reply(e, r) {
+    return this.enqueue(() => this.write({ kind: "reply", thread: this.find(e).thread, target: e, text: U(r) }));
+  }
+  edit(e, r) {
+    return this.enqueue(async () => {
+      let { thread: n } = this.mine(e);
+      await this.write({ kind: "edit", thread: n, target: e, text: U(r) });
+    });
+  }
+  remove(e) {
+    return this.enqueue(async () => {
+      let { thread: r } = this.mine(e);
+      await this.write({ kind: "delete", thread: r, target: e });
+    });
+  }
+  resolve(e) {
+    return this.enqueue(async () => {
+      await this.write({ kind: "resolve", thread: this.thread(e) });
+    });
+  }
+  reopen(e) {
+    return this.enqueue(async () => {
+      await this.write({ kind: "reopen", thread: this.thread(e) });
+    });
+  }
+  sign(e, r) {
+    if (!_e.test(e)) throw new Error('pipeup: a signing purpose looks like "<add-on id>/<name>"');
+    return S(this.options.identity, m(`pipeup:${e}
+${r}`));
+  }
+  flush() {
+    return this.enqueue(() => this.persist());
+  }
+  exportFile() {
+    return ae(this.options.doc, this.log.all(), this.options.key);
+  }
+  async importFile(e) {
+    return this.merge(await de(e, this.options.doc, this.options.key), "file");
+  }
+  merge(e, r) {
+    return e.length > Be ? Promise.reject(new RangeError("pipeup: too many changes to merge at once")) : this.enqueue(async () => {
+      let n = await this.log.add([...e]);
+      this.unsaved.push(...n), n.length > 0 && this.refresh(true, n, r);
+      try {
+        await this.persist();
+      } catch (o) {
+        throw n.length > 0 ? new E(n[0].body.id, o, n.length) : o;
+      }
+      return n.length;
+    });
+  }
+  enqueue(e) {
+    let r = this.e.then(e);
+    return this.e = r.catch(() => {
+    }), r;
+  }
+  async write(e) {
+    let r = await this.log.append(this.options.identity, this.displayName, e);
+    this.unsaved.push(r), this.refresh(true, [r], "local");
+    try {
+      await this.persist();
+    } catch (n) {
+      throw new E(r.body.id, n);
+    }
+    return r.body.id;
+  }
+  async persist() {
+    if (this.unsaved.length === 0) return;
+    let e = [...this.unsaved];
+    await this.options.store.append(this.options.doc, e), this.unsaved = this.unsaved.filter((r) => !e.includes(r));
+  }
+  refresh(e, r = [], n = "") {
+    this.cache = this.log.threads(), this.comments.clear();
+    let o = (i, s) => {
+      i.unnamed && i.author === this.me && this.displayName && (i.name = this.displayName), this.comments.set(i.id, { comment: i, thread: s });
+      for (let a of i.replies) o(a, s);
+    };
+    for (let i of this.cache) o(i.root, i.id);
+    if (e) for (let i of this.listeners) try {
+      i(this.cache, r, n);
+    } catch (s) {
+      globalThis.reportError?.(s);
+    }
+  }
+  find(e) {
+    let r = this.comments.get(e);
+    if (!r) throw new Error("pipeup: there is no comment with that id");
+    return r;
+  }
+  mine(e) {
+    let r = this.find(e);
+    if (r.comment.author !== this.me) throw new Error("pipeup: only the writer can change a comment");
+    return r;
+  }
+  thread(e) {
+    if (!this.cache.some((r) => r.id === e)) throw new Error("pipeup: there is no thread with that id");
+    return e;
+  }
+};
+function U(t2) {
+  let e = t2.trim();
+  if (!e) throw new Error("pipeup: a comment needs some words");
+  if (e.length > k) throw new Error(`pipeup: comments are limited to ${k} characters`);
+  return e;
+}
+function pe(t2) {
+  let e = t2.replace(/\s+/g, " ").trim();
+  if (!e || e.length > ce) throw new Error(`pipeup: choose a name of 1 to ${ce} characters`);
+  return e;
+}
+var q = class {
+  docs = /* @__PURE__ */ new Map();
+  profile = null;
+  async load(e) {
+    return [...this.docs.get(e)?.values() ?? []];
+  }
+  async append(e, r) {
+    let n = this.docs.get(e);
+    n || this.docs.set(e, n = /* @__PURE__ */ new Map());
+    for (let o of r) n.set(o.body.id, o);
+  }
+  async loadProfile() {
+    return this.profile;
+  }
+  async saveProfile(e) {
+    this.profile = e;
+  }
+  async saveProfileIfAbsent(e) {
+    return this.profile || (this.profile = e), this.profile;
+  }
+};
+
+// share/src/address.ts
+var NOT_SET = "sharing isn't set up for this page";
+var NOT_AN_ADDRESS = "data-pipeup-share isn't a sharing address";
+var LOCAL = /^(localhost|127\.0\.0\.1|\[::1\])$/;
+var KEY = /^[A-Za-z0-9_-]{43}$/;
+var off = (reason) => ({ kind: "off", reason });
+function parseShare(value, local = false) {
+  const text2 = value?.trim();
+  if (!text2) return off(NOT_SET);
+  let url;
+  try {
+    url = new URL(text2);
+  } catch {
+    return off(NOT_AN_ADDRESS);
+  }
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:" && LOCAL.test(url.hostname)))
+    return off(NOT_AN_ADDRESS);
+  const at = url.origin + url.pathname;
+  const frag = url.hash.slice(1);
+  if (frag.startsWith("pm1.")) {
+    const [key, token, ...rest] = frag.slice(4).split(".");
+    if (!KEY.test(key ?? "") || rest.length || token !== void 0 && !/^[A-Za-z0-9_-]+$/.test(token))
+      return off(NOT_AN_ADDRESS);
+    if (url.search || !/\/m\/[A-Za-z0-9_-]{22,64}$/.test(at)) return off(NOT_AN_ADDRESS);
+    return { kind: "mailbox", mailbox: at, key: fromB64u(key), ...token ? { token } : {} };
+  }
+  const paste = /^\?([A-Za-z0-9_-]{8,64})$/.exec(url.search)?.[1];
+  if (!paste || !KEY.test(frag)) return off(NOT_AN_ADDRESS);
+  return { kind: "privatebin", base: at, paste, key: fromB64u(frag) };
+}
+
+// share/src/backend.ts
+var Problem = class extends Error {
+  constructor(kind) {
+    super(kind);
+    this.kind = kind;
+    this.name = "Problem";
+  }
+};
+var ACCEPT = { Accept: "application/json" };
+var GET = (f2, url, signal) => f2(url, { headers: ACCEPT, credentials: "omit", signal });
+var POST = (body) => ({
+  method: "POST",
+  headers: ACCEPT,
+  credentials: "omit",
+  body: JSON.stringify(body)
+});
+var refusal = (status) => {
+  const kind = { 403: "closed", 404: "gone", 507: "full" }[status];
+  return kind && new Problem(kind);
+};
+async function json(res) {
+  const t2 = await res.text();
+  const v = t2.length < 1e7 && JSON.parse(t2);
+  if (!v || typeof v !== "object") throw new Error("the answer was not usable");
+  return [v, t2.length];
+}
+function chunks(ops, max = 9e5) {
+  const out = [];
+  let size = 0;
+  for (const op of ops) {
+    size += JSON.stringify(op).length;
+    if (!out.length || size > max || out.at(-1).length >= 500) {
+      out.push([]);
+      size = JSON.stringify(op).length;
+    }
+    out.at(-1).push(op);
+  }
+  return out;
+}
+var sleep = (ms, signal) => new Promise((resolve) => {
+  const t2 = setTimeout(resolve, ms);
+  signal?.addEventListener(
+    "abort",
+    () => {
+      clearTimeout(t2);
+      resolve();
+    },
+    { once: true }
+  );
+});
+var retryAfter = (res, fallback = 10) => {
+  const n = Number(res.headers.get("Retry-After"));
+  return n > 0 ? Math.min(n, 3600) : fallback;
+};
+var idsOf = (ops) => ops.map((o) => o?.body?.id).filter((i) => typeof i === "string");
+
+// share/src/mailbox.ts
+var MAX_BODY = 524288;
+var MAX_PAGES = 1e3;
+var batchId = async (ct) => toB64u(await sha256(utf8(ct))).slice(0, 22);
+var Mailbox = class {
+  constructor(a, l, f2, signal) {
+    this.a = a;
+    this.l = l;
+    this.f = f2;
+    this.signal = signal;
+  }
+  ids = /* @__PURE__ */ new Set();
+  expires = null;
+  moved = false;
+  big = false;
+  cursor = "";
+  seen = /* @__PURE__ */ new Set();
+  memo = null;
+  async read() {
+    const out = [];
+    let reset = 0;
+    for (let pages = 0; pages < MAX_PAGES; ) {
+      const url = `${this.a.mailbox}/ops${this.cursor ? `?since=${encodeURIComponent(this.cursor)}` : ""}`;
+      const r = await GET(this.f, url, this.signal);
+      if (r.status === 404) throw new Problem("gone");
+      if (r.status === 409 && reset++ < 2) {
+        this.cursor = "";
+        continue;
+      }
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+      pages++;
+      const [j] = await json(r);
+      for (const b of Array.isArray(j.batches) ? j.batches : []) {
+        if (typeof b?.id !== "string" || typeof b.ct !== "string" || this.seen.has(b.id)) continue;
+        this.seen.add(b.id);
+        const bytes = fromText(b.ct);
+        const o = bytes && await open(this.l, "share", bytes);
+        if (!o) continue;
+        out.push(o);
+        for (const id of idsOf(o.ops)) this.ids.add(id);
+      }
+      if (typeof j.next === "string") this.cursor = j.next;
+      this.expires = typeof j.expires === "string" ? Date.parse(j.expires) || null : null;
+      if (j.more !== true) break;
+    }
+    return out;
+  }
+  /** The POST for these ops. A retry of the same ops reuses its sealed text and id, so the server collapses it. */
+  async req(ops) {
+    const key = ops.map((o) => o.body.id).join();
+    if (this.memo?.key !== key) {
+      const ct2 = toText(await seal(this.l, "share", ops));
+      this.memo = { key, ct: ct2, id: await batchId(ct2) };
+    }
+    const { ct, id } = this.memo;
+    return [`${this.a.mailbox}/ops`, POST({ id, ct, token: this.a.token })];
+  }
+  async post(ops) {
+    for (const part of chunks(ops)) await this.one(part);
+  }
+  async one(part) {
+    const [url, init] = await this.req(part);
+    const split = async () => {
+      const mid = part.length >> 1;
+      await this.one(part.slice(0, mid));
+      await this.one(part.slice(mid));
+    };
+    if (init.body.length > MAX_BODY && part.length > 1) return split();
+    const r = await this.f(url, { ...init, signal: this.signal });
+    const s = r.status;
+    if (s === 200 || s === 201 || s === 400) return;
+    if (s === 413 && part.length > 1) return split();
+    const refused = refusal(s);
+    if (refused) throw refused;
+    if (s === 429) {
+      const [body] = await json(r).catch(() => [{}]);
+      const n = Number(body.retryAfter);
+      throw new RetryAfter(r.headers.get("Retry-After") ? retryAfter(r) : n > 0 ? Math.min(n, 3600) : 10);
+    }
+    throw new Error(`HTTP ${s}`);
+  }
+};
+
+// share/src/privatebin.ts
+var ROLL_BYTES = 256e3;
+var MAX_HOPS = 16;
+var NEXT = /^[A-Za-z0-9_-]{8,64}$/;
+var spec = () => [toB64(randomBytes(16)), toB64(randomBytes(8)), 1e5, 256, 128, "aes", "gcm", "none"];
+var commentBody = (paste, sealed) => ({
+  v: 2,
+  adata: spec(),
+  ct: toB64(sealed),
+  pasteid: paste,
+  parentid: paste
+});
+async function answer(res) {
+  if (res.status === 429) throw new RetryAfter(retryAfter(res));
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const [j] = await json(res);
+  if (j.status === 0) return j;
+  const n = Number(/\d+/.exec(String(j.message ?? ""))?.[0]);
+  throw new RetryAfter(n >= 1 && n <= 3600 ? n : 30, true);
+}
+async function createPaste(f2, base, l, expire = "never", signal) {
+  const ct = toB64(await seal(l, "share", []));
+  const j = await answer(
+    await f2(base, { ...POST({ v: 2, adata: [spec(), "plaintext", 1, 0], ct, meta: { expire } }), signal })
+  );
+  if (typeof j.id !== "string" || typeof j.deletetoken !== "string")
+    throw new Error("the answer had no paste id");
+  return { id: j.id, deleteToken: j.deletetoken };
+}
+async function deletePaste(f2, base, id, token) {
+  return f2(base, POST({ pasteid: id, deletetoken: token }));
+}
+async function readPaste(f2, base, id, signal) {
+  const r = await GET(f2, `${base}?${id}`, signal);
+  if (r.status === 404) return null;
+  if (!r.ok) throw new Error(`HTTP ${r.status}`);
+  const [j, size] = await json(r);
+  if (j.status !== 0) return null;
+  const ttl = j.meta?.time_to_live;
+  return { j, size, ttl: typeof ttl === "number" && ttl > 0 ? ttl * 1e3 : null };
+}
+var PrivateBin = class {
+  constructor(a, l, f2, signal, gen, onGen = () => {
+  }) {
+    this.a = a;
+    this.l = l;
+    this.f = f2;
+    this.signal = signal;
+    this.onGen = onGen;
+    this.head = gen || a.paste;
+    this.trail.push(a.paste);
+  }
+  ids = /* @__PURE__ */ new Set();
+  expires = null;
+  moved = false;
+  big = false;
+  /** The newest generation seen. */
+  head;
+  /** Every generation moved through, oldest first (the command line lists them). */
+  trail = [];
+  /** Comment id -> the `next` it carries (null: none): a comment is opened once. */
+  seen = /* @__PURE__ */ new Map();
+  async scan(comments, out) {
+    let next;
+    for (const c of Array.isArray(comments) ? comments : []) {
+      if (typeof c?.id !== "string" || typeof c.ct !== "string") continue;
+      let n = this.seen.get(c.id);
+      if (n === void 0) {
+        n = null;
+        let bytes = null;
+        try {
+          if (c.ct.length < 14e5) bytes = fromB64(c.ct);
+        } catch {
+        }
+        const v = bytes && await openJson(this.l, "share", bytes);
+        const nx = v?.next;
+        const b = typeof nx === "string" ? null : asBatch(this.l, v);
+        if (typeof nx === "string" && NEXT.test(nx)) n = nx;
+        else if (b) {
+          out.push(b);
+          for (const id of idsOf(b.ops)) this.ids.add(id);
+        }
+        this.seen.set(c.id, n);
+      }
+      next ??= n ?? void 0;
+    }
+    return next;
+  }
+  /** Reads the newest generation, following `next` records up to 16 hops; falls back to the file's own address. */
+  async read() {
+    const out = [];
+    let id = this.head;
+    let fell = false;
+    let got = false;
+    for (let hops = 0; ; ) {
+      const r = await readPaste(this.f, this.a.base, id, this.signal);
+      if (!r) {
+        if (got) break;
+        if (!fell && id !== this.a.paste) {
+          fell = true;
+          id = this.a.paste;
+          continue;
+        }
+        throw new Problem("gone");
+      }
+      got = true;
+      if (id !== this.head) {
+        this.head = id;
+        this.trail.push(id);
+        this.ids.clear();
+        this.moved = true;
+        this.onGen(id);
+      }
+      const comments = r.j.comments;
+      const next = await this.scan(comments, out);
+      this.expires = r.ttl && Date.now() + r.ttl;
+      const first = (Array.isArray(comments) ? comments[0]?.ct?.length : 0) ?? 0;
+      this.big = !next && r.size > ROLL_BYTES && r.size > 2 * first;
+      if (!next || ++hops >= MAX_HOPS) break;
+      id = next;
+    }
+    return out;
+  }
+  ask(paste, sealed) {
+    return [this.a.base, POST(commentBody(paste, sealed))];
+  }
+  async req(ops) {
+    return this.ask(this.head, await seal(this.l, "share", ops));
+  }
+  go(url, init) {
+    return this.f(url, { ...init, signal: this.signal });
+  }
+  async post(ops) {
+    for (const part of chunks(ops)) await answer(await this.go(...await this.req(part)));
+  }
+  /**
+   * Starts a new generation: a new paste holding `ops`, then a sealed `next` in the old one. The earliest `next`
+   * wins; a loser deletes its own paste. Returns what the final read found.
+   */
+  async roll(ops) {
+    const patiently2 = async (run2) => {
+      for (let tries = 0; ; tries++) {
+        try {
+          return await run2();
+        } catch (e) {
+          if (!(e instanceof RetryAfter) || tries > 5 || this.signal?.aborted) throw e;
+          await sleep(e.seconds * 1e3 * (1 + Math.random() * 0.2), this.signal);
+        }
+      }
+    };
+    const old = this.head;
+    const made = await patiently2(() => createPaste(this.f, this.a.base, this.l, "never", this.signal));
+    for (const part of chunks(ops))
+      await patiently2(
+        async () => answer(await this.go(...this.ask(made.id, await seal(this.l, "share", part))))
+      );
+    await patiently2(
+      async () => answer(await this.go(...this.ask(old, await sealJson(this.l, "share", { next: made.id }))))
+    );
+    const got = await this.read();
+    if (this.head !== made.id)
+      await deletePaste(this.f, this.a.base, made.id, made.deleteToken).catch(() => {
+      });
+    return got;
+  }
+};
+
+// share/src/cli-lib.ts
+var HTML_TAG = /<html\b(?:[^>"']|"[^"]*"|'[^']*')*>/i;
+var attr = (name) => new RegExp(`(\\s)${name}(\\s*=\\s*)("[^"]*"|'[^']*'|[^\\s>"']+)`, "i");
+function readAttribute(html, name) {
+  const tag = HTML_TAG.exec(html)?.[0];
+  const m2 = tag && attr(name).exec(tag);
+  if (!m2) return null;
+  return m2[3].replace(/^["']|["']$/g, "").replace(/&quot;/g, '"').replace(/&amp;/g, "&");
+}
+function setAttribute(html, name, value) {
+  const m2 = HTML_TAG.exec(html);
+  if (!m2) throw new Error("the page has no <html> tag to put it on");
+  const tag = m2[0];
+  const escaped = value.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+  const old = attr(name).exec(tag);
+  let next;
+  if (old) {
+    const q2 = old[3][0] === "'" ? "'" : '"';
+    const v = q2 === "'" ? value.replace(/&/g, "&amp;").replace(/'/g, "&#39;") : escaped;
+    next = tag.slice(0, old.index) + `${old[1]}${name}${old[2]}${q2}${v}${q2}` + tag.slice(old.index + old[0].length);
+  } else {
+    const at = tag.length - 1;
+    next = `${tag.slice(0, at)} ${name}="${escaped}"${tag.slice(at)}`;
+  }
+  return html.slice(0, m2.index) + next + html.slice(m2.index + tag.length);
+}
+var DAY = 864e5;
+var dateWords = (ms) => new Date(ms).toLocaleDateString("en-GB", {
+  day: "numeric",
+  month: "long",
+  year: "numeric",
+  timeZone: "UTC"
+});
+function spanWords(ms) {
+  const n = (x2, unit) => `${x2} ${unit}${x2 === 1 ? "" : "s"}`;
+  if (ms < 36e5) return n(Math.max(1, Math.round(ms / 6e4)), "minute");
+  if (ms < 2 * DAY) return n(Math.round(ms / 36e5), "hour");
+  if (ms < 6.5 * DAY) return n(Math.round(ms / DAY), "day");
+  if (ms < 60 * DAY) return n(Math.round(ms / (7 * DAY)), "week");
+  if (ms < 730 * DAY) return n(Math.round(ms / (30 * DAY)), "month");
+  return n(Math.round(ms / (365 * DAY)), "year");
+}
+function keepWords(host, ttlMs, now = Date.now()) {
+  if (ttlMs === null) return `${host} keeps this shared copy until it is deleted.`;
+  return `${host} keeps this shared copy for ${spanWords(ttlMs)}, until ${dateWords(now + ttlMs)}.`;
+}
+var WITH_VALUE = /* @__PURE__ */ new Set(["server", "from", "key"]);
+function parseArgs(argv) {
+  const flags = /* @__PURE__ */ new Map();
+  const rest = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h") flags.set("help", true);
+    else if (a.startsWith("--")) {
+      const [name, inline] = a.slice(2).split(/=(.*)/s, 2);
+      if (WITH_VALUE.has(name)) {
+        const v = inline ?? argv[++i];
+        if (v === void 0 || v.startsWith("--")) throw new UsageError(`--${name} needs a value`);
+        flags.set(name, v);
+      } else if (["mailbox", "new-doc", "help"].includes(name)) flags.set(name, true);
+      else throw new UsageError(`I don't know the option --${name}`);
+    } else rest.push(a);
+  }
+  return { command: rest[0], file: rest[1], flags };
+}
+var UsageError = class extends Error {
+};
+
+// share/src/cli-run.ts
+var HELP = `Share a Pipeup page's comments through an encrypted service.
+
+Usage:
+  share create <page.html> --server <url> [--mailbox] [--from <feedback.json>] [--new-doc]
+  share stop   <page.html> --key <stop key>
+  share update <page.html>
+
+create   Makes a shared copy and writes its address into the page (data-pipeup-share), changing nothing else.
+         --server   a PrivateBin instance (https://paste.example.org/), or with --mailbox your own mailbox server
+         --mailbox  use the HTTP mailbox contract; set PIPEUP_MAILBOX_CREATE_TOKEN in the environment if the
+                    server wants one (it is never read from the command line)
+         --from     post the comments of a feedback file into the shared copy
+         --new-doc  give the page a document identity (data-pipeup-doc) if it has none
+stop     Deletes the shared copy. --key is the stop key that "create" printed.
+update   Points the page at the newest copy, when PrivateBin has moved on to a newer one.
+
+Exit codes: 0 done, 1 the service or the file failed, 2 the command wasn't understood or needs something first.
+`;
+var wait = (io, ms) => io.wait ? io.wait(ms) : sleep(ms);
+async function patiently(io, run2) {
+  for (let tries = 0; ; tries++) {
+    try {
+      return await run2();
+    } catch (e) {
+      if (!(e instanceof RetryAfter) || tries > 8) throw e;
+      await wait(io, e.seconds * 1e3 + 500);
+    }
+  }
+}
+function server(value, mailbox) {
+  if (typeof value !== "string") throw new UsageError("--server needs the address of the service");
+  const a = parseShare(
+    mailbox ? `${value.replace(/\/+$/, "")}/m/${"x".repeat(22)}#pm1.${"x".repeat(43)}` : `${value}?${"x".repeat(16)}#${"x".repeat(43)}`,
+    true
+  );
+  if (a.kind === "off")
+    throw new UsageError("--server must be an https: address (http://localhost is allowed for development)");
+  const u = new URL(value);
+  return mailbox ? value.replace(/\/+$/, "") : u.origin + u.pathname;
+}
+async function feedbackOps(file, docAttr, io) {
+  const { id, key } = await De(docAttr);
+  const doc = await K.open({
+    doc: id,
+    key,
+    store: new q(),
+    identity: await R(),
+    name: ""
+  });
+  try {
+    await doc.importFile(await io.read(file));
+  } catch (e) {
+    throw new Error(
+      `I couldn't read ${file} as this page's feedback: ${e.message.replace(/^pipeup: /, "")}`
+    );
+  }
+  return [...doc.ops()];
+}
+async function create(file, flags, io) {
+  const mailbox = flags.has("mailbox");
+  const base = server(flags.get("server"), mailbox);
+  let html = await io.read(file);
+  let docAttr = readAttribute(html, "data-pipeup-doc");
+  if (!docAttr) {
+    if (!flags.has("new-doc")) {
+      io.err(
+        `${file} has no data-pipeup-doc, so it has no document identity, and sharing needs one.
+Run the same command with --new-doc and I will write a fresh one into the page.
+`
+      );
+      throw new UsageError("the page needs a document identity");
+    }
+    docAttr = Fe();
+    html = setAttribute(html, "data-pipeup-doc", docAttr);
+    io.out("Gave the page a new document identity (data-pipeup-doc).");
+  }
+  const { id } = await De(docAttr).catch(() => {
+    throw new UsageError("data-pipeup-doc in the page isn't a valid document identity");
+  });
+  const from = typeof flags.get("from") === "string" ? flags.get("from") : null;
+  const ops = from ? await feedbackOps(from, docAttr, io) : [];
+  const room = randomBytes(32);
+  const key = toB64u(room);
+  const l = ladder(id, room);
+  const had = readAttribute(html, "data-pipeup-share");
+  let address;
+  let stopKey;
+  let backend;
+  const host = new URL(base).host;
+  if (mailbox) {
+    const create2 = io.env.PIPEUP_MAILBOX_CREATE_TOKEN;
+    const res = await io.fetch(`${base}/m`, {
+      method: "POST",
+      headers: create2 ? { Authorization: `Bearer ${create2}` } : {},
+      body: JSON.stringify({ v: 1 })
+    });
+    const j = await res.json().catch(() => ({}));
+    if (res.status === 401 || res.status === 403)
+      throw new Error(
+        `${host} wouldn't make a mailbox. It wants a create token: set PIPEUP_MAILBOX_CREATE_TOKEN and run again.`
+      );
+    if (res.status !== 201 || typeof j.mailbox !== "string" || typeof j.stop !== "string")
+      throw new Error(`${host} wouldn't make a mailbox (it answered ${res.status}).`);
+    const token = typeof j.token === "string" ? j.token : null;
+    address = `${base}/m/${j.mailbox}#pm1.${key}${token ? `.${token}` : ""}`;
+    stopKey = j.stop;
+    backend = new Mailbox({ mailbox: `${base}/m/${j.mailbox}`, ...token ? { token } : {} }, l, io.fetch);
+    const until = typeof j.expires === "string" ? Date.parse(j.expires) : NaN;
+    const keep = j.keep === "last-write" ? ", and longer each time a comment is added" : "";
+    io.out(
+      Number.isNaN(until) ? `${host} keeps this shared copy until it is deleted.` : `${host} keeps this shared copy until ${dateWords(until)}${keep}.`
+    );
+    const lim = j.limits;
+    if (lim?.mailbox) io.out(`It holds up to ${Math.round(lim.mailbox / 1048576)} MB of comments.`);
+  } else {
+    const made = await patiently(io, () => createPaste(io.fetch, base, l, "never")).catch((e) => {
+      throw new Error(`${host} wouldn't make a shared copy: ${e.message}`);
+    });
+    address = `${base}?${made.id}#${key}`;
+    stopKey = made.deleteToken;
+    backend = new PrivateBin({ base, paste: made.id }, l, io.fetch);
+    const back = await readPaste(io.fetch, base, made.id).catch(() => null);
+    if (!back)
+      throw new Error(
+        `${host} made the shared copy but I couldn't read it back, so I haven't touched the page.`
+      );
+    io.out(keepWords(host, back.ttl));
+  }
+  if (ops.length) {
+    await patiently(io, () => backend.post(ops));
+    io.out(`Put ${ops.length} comment${ops.length === 1 ? "" : "s"} from ${from} into the shared copy.`);
+  }
+  await io.write(file, setAttribute(html, "data-pipeup-share", address));
+  io.out(`Wrote data-pipeup-share into ${file}; nothing else in the page changed.`);
+  if (had)
+    io.out("It replaced the earlier sharing address: people with the old file keep reading the old copy.");
+  io.out("");
+  io.out(`Stop key: ${stopKey}`);
+  io.out("Keep this private; never put it in the page. You need it to stop sharing:");
+  io.out(`  share stop ${file} --key <stop key>`);
+}
+async function addressOf(file, io) {
+  const html = await io.read(file);
+  const a = parseShare(readAttribute(html, "data-pipeup-share"), true);
+  if (a.kind === "off") throw new UsageError(`${file}: ${a.reason}`);
+  const docAttr = readAttribute(html, "data-pipeup-doc");
+  const doc = docAttr ? (await De(docAttr).catch(() => null))?.id : null;
+  if (!doc) throw new UsageError(`${file} has no valid data-pipeup-doc`);
+  return { html, a, l: ladder(doc, a.key) };
+}
+async function stop(file, flags, io) {
+  const key = flags.get("key");
+  if (typeof key !== "string") throw new UsageError("stop needs --key with the stop key that create printed");
+  const { a, l } = await addressOf(file, io);
+  if (a.kind === "mailbox") {
+    const res = await io.fetch(a.mailbox, { method: "DELETE", headers: { Authorization: `Bearer ${key}` } });
+    if (res.status === 403) throw new Error("That isn't this mailbox's stop key, so nothing was deleted.");
+    if (res.status === 404) throw new Error("The shared copy is already gone.");
+    if (res.status !== 204 && res.status !== 200)
+      throw new Error(`The server answered ${res.status}, so I can't say it was deleted.`);
+    io.out("Deleted the shared copy. Everyone keeps the comments they already have.");
+  } else {
+    const b = new PrivateBin(a, l, io.fetch);
+    const later = [];
+    await b.read().catch(() => {
+    });
+    for (const id of b.trail.slice(1))
+      later.push({ id, ttl: (await readPaste(io.fetch, a.base, id).catch(() => null))?.ttl ?? null });
+    const res = await deletePaste(io.fetch, a.base, a.paste, key);
+    const j = await res.json().catch(() => ({}));
+    if (j.status !== 0)
+      throw new Error(
+        "That isn't this shared copy's stop key (or it is already gone), so nothing was deleted."
+      );
+    io.out(
+      "Deleted the shared copy the page's address points to. Everyone keeps the comments they already have."
+    );
+    if (later.length) {
+      io.err(
+        `${later.length} newer cop${later.length === 1 ? "y was" : "ies were"} made when the first one grew. This key can't delete ${later.length === 1 ? "it" : "them"}; ${later.length === 1 ? "it stays" : "they stay"} until the service removes ${later.length === 1 ? "it" : "them"}:`
+      );
+      for (const g2 of later)
+        io.err(
+          `  ${g2.id}: ${g2.ttl === null ? "no expiry set" : `until about ${dateWords(Date.now() + g2.ttl)}`}`
+        );
+    }
+  }
+  io.out(
+    "The page still carries its old address; remove data-pipeup-share if it should say nothing about sharing."
+  );
+}
+async function update(file, io) {
+  const { html, a, l } = await addressOf(file, io);
+  if (a.kind === "mailbox") return io.out("A mailbox has no newer copies, so there is nothing to update.");
+  const b = new PrivateBin(a, l, io.fetch);
+  await b.read().catch((e) => {
+    throw new Error(
+      `I couldn't read the shared copy: ${e.message === "gone" ? "it is gone" : e.message}`
+    );
+  });
+  if (b.head === a.paste) return io.out("The page already points at the newest copy.");
+  const fragment = new URL(readAttribute(html, "data-pipeup-share")).hash;
+  await io.write(file, setAttribute(html, "data-pipeup-share", `${a.base}?${b.head}${fragment}`));
+  io.out(`Pointed ${file} at the newest copy, so new reviewers don't have to walk through the older ones.`);
+}
+async function run(argv, io) {
+  try {
+    const { command, file, flags } = parseArgs(argv);
+    if (flags.has("help") || !command || command === "help") {
+      io.out(HELP);
+      return flags.has("help") || command === "help" ? 0 : 2;
+    }
+    if (!["create", "stop", "update"].includes(command))
+      throw new UsageError(`I don't know the command "${command}"`);
+    if (!file) throw new UsageError(`${command} needs the page, such as: share ${command} page.html`);
+    if (command === "create") await create(file, flags, io);
+    else if (command === "stop") await stop(file, flags, io);
+    else await update(file, io);
+    return 0;
+  } catch (e) {
+    if (e instanceof UsageError) {
+      io.err(`${e.message.replace(/\.$/, "")}. Try: share --help`);
+      return 2;
+    }
+    io.err(e.message);
+    return 1;
+  }
+}
+
+// share/src/cli.ts
+process.exitCode = await run(process.argv.slice(2), {
+  fetch: (i, n) => fetch(i, n),
+  env: process.env,
+  read: (p2) => readFile(p2, "utf8"),
+  write: (p2, t2) => writeFile(p2, t2),
+  out: (t2) => console.log(t2),
+  err: (t2) => console.error(t2)
+});