@songsid/agend 2.3.1 → 2.3.2-beta.10

package/dist/notice-delivery.js

@@ -0,0 +1,35 @@
+/** Sign-in notices post in the topic unless turned off; a legacy "dm" or `notice_delivery.login` route reads as on. */
+export function loginNoticeMode(web) {
+    return web?.notify_login !== false;
+}
+/** Daily tips always post in the General topic; an old "dm" reads as on. */
+export function tipNoticeMode(config) {
+    return config.defaults.tips !== false;
+}
+/** Disk keeps only the boolean field; setting it clears the stale `notice_delivery` route #2591 stored beside it. */
+export function setNoticeMode(config, kind, mode) {
+    const web = config.web = { ...config.web };
+    const delivery = { ...web.notice_delivery };
+    delete delivery[kind];
+    if (Object.keys(delivery).length)
+        web.notice_delivery = delivery;
+    else
+        delete web.notice_delivery;
+    if (kind === "login")
+        web.notify_login = mode !== false;
+    else
+        config.defaults.tips = mode !== false;
+}
+/** Accept the short-lived #2581 string form and #2591's routes, but write back only booleans. */
+export function normalizeNoticeDelivery(config) {
+    if (config.web?.notify_login === "dm" || config.web?.notice_delivery?.login)
+        setNoticeMode(config, "login", config.web.notify_login !== false);
+    if (config.defaults.tips === "dm" || config.web?.notice_delivery?.tips)
+        setNoticeMode(config, "tips", config.defaults.tips !== false);
+    // Even an empty `notice_delivery: {}` is dropped, or the startup migration would rewrite the file on every start.
+    if (config.web && Object.hasOwn(config.web, "notice_delivery")) {
+        config.web = { ...config.web };
+        delete config.web.notice_delivery;
+    }
+}
+//# sourceMappingURL=notice-delivery.js.map

package/dist/notice-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notice-delivery.js","sourceRoot":"","sources":["../src/notice-delivery.ts"],"names":[],"mappings":"AAKA,uHAAuH;AACvH,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,OAAO,GAAG,EAAE,YAAY,KAAK,KAAK,CAAC;AACrC,CAAC;AACD,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,MAAoB;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC;AACxC,CAAC;AACD,qHAAqH;AACrH,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,IAAsB,EAAE,IAAgB;IAC1F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,eAAe,GAAG,QAAQ,CAAC;;QAAM,OAAO,GAAG,CAAC,eAAe,CAAC;IAClG,IAAI,IAAI,KAAK,OAAO;QAAE,GAAG,CAAC,YAAY,GAAG,IAAI,KAAK,KAAK,CAAC;;QAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC;AACtG,CAAC;AACD,iGAAiG;AACjG,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,IAAI,MAAM,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK;QAAE,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC;IAC/I,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI;QAAE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IACtI,kHAAkH;IAClH,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;IAAC,CAAC;AACxI,CAAC"}

package/dist/office-share-page.d.ts

@@ -0,0 +1,16 @@
+/** `/assets/<name>` → src/ui/shared/<name>: the share page's closure there, its stylesheets, the font they name and the
+ * Cozy style's picture (#2631). */
+export declare const SHARE_ASSETS: Readonly<Record<string, string>>;
+/** An asset kept below src/ui/shared/ rather than in it, by name. */
+export declare const SHARE_ASSET_FILES: Readonly<Record<string, string>>;
+/** `/ui/js/<name>` → src/ui/<name>: the share page's own module and the Office's. */
+export declare const SHARE_MODULES: readonly string[];
+/** A static file the share page loads, by its path on the share origin, or null (not one of them). */
+export declare function officeShareStatic(path: string): {
+    body: Buffer;
+    type: string;
+} | null;
+/** The page's policy: its own scripts, styles, pictures and reads; nothing inline, nothing framed, no form. */
+export declare const OFFICE_SHARE_PAGE_CSP: string;
+/** The page itself: the same for every share (the module reads the token from the address). */
+export declare const OFFICE_SHARE_PAGE = "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, viewport-fit=cover\">\n<meta name=\"referrer\" content=\"no-referrer\">\n<meta name=\"robots\" content=\"noindex, nofollow\">\n<title>AgEnD Office</title>\n<link rel=\"stylesheet\" href=\"/assets/tokens.css\">\n<link rel=\"stylesheet\" href=\"/assets/app.css\">\n<script type=\"module\" src=\"/ui/js/office-share-page.js\"></script>\n</head>\n<body>\n<div id=\"app\" class=\"app-root\" data-share=\"1\"></div>\n<noscript><p class=\"noscript\">This live Office view needs JavaScript.</p></noscript>\n</body>\n</html>\n";

package/dist/office-share-page.js

@@ -0,0 +1,85 @@
+/**
+ * #2636: an Office share link's page and the static files it loads, as the share gateway serves them (office-share.ts).
+ *
+ * The page (`/o/<token>`) is a fixed document — no data in it, no inline script — that loads the share page's module
+ * (src/ui/office-share-page.js), which reads the share's own addresses. Its modules and stylesheets are served at the
+ * dashboard's own paths (`/assets/<name>`, `/ui/js/<name>`) so the Office's imports work unchanged, without a token:
+ * they are the app's static code (published with AgEnD), never data — and only the files named here, the page
+ * module's import closure (a test checks the list against the imports), not the directory.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const UI_DIR = join(dirname(fileURLToPath(import.meta.url)), "ui");
+const JS = "text/javascript; charset=utf-8";
+/** `/assets/<name>` → src/ui/shared/<name>: the share page's closure there, its stylesheets, the font they name and the
+ * Cozy style's picture (#2631). */
+export const SHARE_ASSETS = {
+    ...Object.fromEntries([
+        "app-ctx.js", "app-html.js", "app-i18n.js", "app-nav.js", "app-prefs.js", "app-route.js", "app-store.js", "app-themes.js", "header-tools.js",
+        "htm.module.js", "identity-color.js", "instance-nav.js", "owner-css.js", "preact-hooks.module.js", "preact.module.js", "read-stream.js",
+        "side-panel.js", "text-undo.js", "ui-confirm.js", "ui-dialog.js", "ui-icons.js", "ui-states.js", "ui-toast.js", "usage-dialog.js",
+        "view-roster-store.js", "view-strings.js",
+    ].map(name => [name, JS])),
+    "tokens.css": "text/css; charset=utf-8", "app.css": "text/css; charset=utf-8", "inter.woff2": "font/woff2", "office-cozy.png": "image/png",
+};
+/** An asset kept below src/ui/shared/ rather than in it, by name. */
+export const SHARE_ASSET_FILES = { "inter.woff2": join("fonts", "inter.woff2"), "office-cozy.png": join("office", "cozy.png") };
+/** `/ui/js/<name>` → src/ui/<name>: the share page's own module and the Office's. */
+export const SHARE_MODULES = [
+    "office-share-page.js", "fleet-office.js", "fleet-office-model.js", "fleet-office-skin.js", "fleet-office-zones.js", "fleet-office-store.js",
+    "fleet-office-editor.js", "fleet-office-layout.js", "fleet-office-pack.js", "fleet-office-overview.js", "fleet-office-view.js",
+    "fleet-org.js", "fleet-canvas-layout.js", "fleet-canvas-view.js", "fleet-traffic.js", "office-share-dialog.js",
+];
+const cache = new Map();
+const read = (file) => {
+    const hit = cache.get(file);
+    if (hit)
+        return hit;
+    try {
+        const b = readFileSync(file);
+        cache.set(file, b);
+        return b;
+    }
+    catch {
+        return null;
+    }
+};
+/** A static file the share page loads, by its path on the share origin, or null (not one of them). */
+export function officeShareStatic(path) {
+    const asset = /^\/assets\/([A-Za-z0-9_.-]+)$/.exec(path);
+    if (asset && Object.prototype.hasOwnProperty.call(SHARE_ASSETS, asset[1])) {
+        const name = asset[1];
+        const body = read(join(UI_DIR, "shared", SHARE_ASSET_FILES[name] ?? name));
+        return body ? { body, type: SHARE_ASSETS[name] } : null;
+    }
+    const mod = /^\/ui\/js\/([a-z0-9_-]+\.js)$/.exec(path);
+    if (mod && SHARE_MODULES.includes(mod[1])) {
+        const body = read(join(UI_DIR, mod[1]));
+        return body ? { body, type: JS } : null;
+    }
+    return null;
+}
+/** The page's policy: its own scripts, styles, pictures and reads; nothing inline, nothing framed, no form. */
+export const OFFICE_SHARE_PAGE_CSP = "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self'; "
+    + "connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+/** The page itself: the same for every share (the module reads the token from the address). */
+export const OFFICE_SHARE_PAGE = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+<meta name="referrer" content="no-referrer">
+<meta name="robots" content="noindex, nofollow">
+<title>AgEnD Office</title>
+<link rel="stylesheet" href="/assets/tokens.css">
+<link rel="stylesheet" href="/assets/app.css">
+<script type="module" src="/ui/js/office-share-page.js"></script>
+</head>
+<body>
+<div id="app" class="app-root" data-share="1"></div>
+<noscript><p class="noscript">This live Office view needs JavaScript.</p></noscript>
+</body>
+</html>
+`;
+//# sourceMappingURL=office-share-page.js.map

package/dist/office-share-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"office-share-page.js","sourceRoot":"","sources":["../src/office-share-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,MAAM,EAAE,GAAG,gCAAgC,CAAC;AAE5C;mCACmC;AACnC,MAAM,CAAC,MAAM,YAAY,GAAqC;IAC5D,GAAG,MAAM,CAAC,WAAW,CAAC;QACpB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB;QAC5I,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,gBAAgB;QACvI,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB;QACjI,sBAAsB,EAAE,iBAAiB;KAC1C,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1B,YAAY,EAAE,yBAAyB,EAAE,SAAS,EAAE,yBAAyB,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW;CAC3I,CAAC;AACF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAqC,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;AAClK,qFAAqF;AACrF,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,sBAAsB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,uBAAuB;IAC5I,wBAAwB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,sBAAsB;IAC9H,cAAc,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,wBAAwB;CAC/G,CAAC;AAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AACxC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAiB,EAAE;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC5F,CAAC,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,qBAAqB,GAAG,wGAAwG;MACzI,iFAAiF,CAAC;AAEtF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;CAiBhC,CAAC"}

package/dist/office-share-service.d.ts

@@ -0,0 +1,91 @@
+/**
+ * #2636 part 3: Office share links, running — the shares (office-share.ts OfficeShares), their gateway, and the quick
+ * tunnel they share. Design: #2636, confirmed with the leader's two additions (2026-10-25):
+ *
+ * - The tunnel starts with the first share and stops when the last one ends (expired, revoked, its owner no longer an
+ *   admin, the feature turned off). trycloudflare.com limits new quick tunnels: a start it refuses (429) fails that one
+ *   share with "try again later" — nothing retries on its own. A share is only handed out once the tunnel is up.
+ * - No step beyond the admin check (decision a94a1bab): whoever may make one gets the link at once.
+ * - Its own manager and lease (OFFICE_SHARE_TUNNEL_DIR): never the fleet's one tunnel lane (/web, /login) nor the
+ *   public link's preview tunnel. A tunnel that goes away unexpectedly ends every share (their address was its host).
+ */
+import { OfficeShares, createOfficeShareGateway, type OfficeShare, type OfficeShareSource } from "./office-share.js";
+import { type PublicLinkFailure } from "./public-link-progress.js";
+import { type ManagedTunnel } from "./tunnel/manager.js";
+import type { TunnelProvider } from "./tunnel/types.js";
+/** Where the share tunnel keeps its own lease (never the fleet's `tunnel.lease`). */
+export declare const OFFICE_SHARE_TUNNEL_DIR = "office-share-tunnel";
+/** How often open shares are checked against who may still have them. */
+export declare const SWEEP_MS = 30000;
+export type OfficeShareRefusal = "disabled" | "office" | "duration" | "too_many" | "tunnel";
+export type OfficeShareMade = {
+    ok: true;
+    share: OfficeShare;
+    url: string;
+} | {
+    ok: false;
+    error: OfficeShareRefusal;
+    reason?: PublicLinkFailure | "exited";
+};
+export interface OfficeShareServiceDeps {
+    source: OfficeShareSource;
+    manager: Pick<ManagedTunnel, "start" | "stop">;
+    /** cloudflared, installed (pinned) if need be. */
+    ensure(signal: AbortSignal): Promise<{
+        path: string;
+    }>;
+    provider(binary: string): TunnelProvider;
+    /** `web.office_share` as it is now. */
+    config(): {
+        enabled?: boolean;
+        max_hours?: number;
+    } | undefined;
+    /** A stored office by id. */
+    officeExists(id: string): boolean;
+    /** Whether a share's owner may still have it (a fleet admin of this fleet). */
+    ownerCurrent(owner: string): boolean;
+    /** Every change to the open shares (Settings' card, General's notices are the caller's). */
+    changed?(shares: OfficeShare[]): void;
+    /** `detail`: fit for daemon.log — never a token or a URL. */
+    log?(event: string, detail?: string): void;
+    createGateway?: typeof createOfficeShareGateway;
+    shares?: OfficeShares;
+}
+export declare class OfficeShareService {
+    private readonly deps;
+    readonly shares: OfficeShares;
+    private gateway;
+    private origin;
+    private starting;
+    private stopping;
+    private abort;
+    private unsubscribe;
+    private readonly limiter;
+    /** #2662: the shares' pack pictures, each share's own minute — kept here so an ended share's key goes with it. */
+    private readonly pictureLimiter;
+    constructor(deps: OfficeShareServiceDeps);
+    enabled(): boolean;
+    list(): OfficeShare[];
+    /**
+     * A new share and its URL, once the tunnel is up. `minutes` 15–max_hours×60 (60 if not given); `office` ALL_OFFICES
+     * or a stored office's id. A tunnel that cannot start ends the share at once and says why.
+     */
+    create(opts: {
+        office: string;
+        minutes?: number;
+        text?: boolean;
+        owner: string;
+    }): Promise<OfficeShareMade>;
+    revoke(id: string): number;
+    /** Shares no longer allowed: the feature off (all), an owner no longer an admin, an office deleted. */
+    sweep(): number;
+    /** The fleet is stopping: every share ends and the tunnel goes. */
+    close(): Promise<void>;
+    private onChanged;
+    private known;
+    private sweeper;
+    /** The tunnel, up or coming up (one start at a time; never retried here). */
+    private up;
+    private start;
+    private down;
+}

package/dist/office-share-service.js

@@ -0,0 +1,176 @@
+/**
+ * #2636 part 3: Office share links, running — the shares (office-share.ts OfficeShares), their gateway, and the quick
+ * tunnel they share. Design: #2636, confirmed with the leader's two additions (2026-10-25):
+ *
+ * - The tunnel starts with the first share and stops when the last one ends (expired, revoked, its owner no longer an
+ *   admin, the feature turned off). trycloudflare.com limits new quick tunnels: a start it refuses (429) fails that one
+ *   share with "try again later" — nothing retries on its own. A share is only handed out once the tunnel is up.
+ * - No step beyond the admin check (decision a94a1bab): whoever may make one gets the link at once.
+ * - Its own manager and lease (OFFICE_SHARE_TUNNEL_DIR): never the fleet's one tunnel lane (/web, /login) nor the
+ *   public link's preview tunnel. A tunnel that goes away unexpectedly ends every share (their address was its host).
+ */
+import { ALL_OFFICES, OfficeShareLimiter, OfficeShares, createOfficeShareGateway, shareMaxMinutes } from "./office-share.js";
+import { OFFICE_SHARE_PAGE, OFFICE_SHARE_PAGE_CSP, officeShareStatic } from "./office-share-page.js";
+import { failureOf } from "./public-link-progress.js";
+import { newTunnelSid } from "./tunnel/manager.js";
+/** Where the share tunnel keeps its own lease (never the fleet's `tunnel.lease`). */
+export const OFFICE_SHARE_TUNNEL_DIR = "office-share-tunnel";
+const QUICK_TUNNEL_HOST = /^[a-z0-9-]+\.trycloudflare\.com$/;
+/** The lease's own end: none — the tunnel ends with its last share, not on a clock. */
+const NO_EXPIRY_WALL = Number.MAX_SAFE_INTEGER;
+/** How often open shares are checked against who may still have them. */
+export const SWEEP_MS = 30_000;
+export class OfficeShareService {
+    deps;
+    shares;
+    gateway = null;
+    origin = null;
+    starting = null;
+    stopping = null;
+    abort = null;
+    unsubscribe;
+    limiter = new OfficeShareLimiter();
+    /** #2662: the shares' pack pictures, each share's own minute — kept here so an ended share's key goes with it. */
+    pictureLimiter = new OfficeShareLimiter();
+    constructor(deps) {
+        this.deps = deps;
+        this.shares = deps.shares ?? new OfficeShares({ changed: list => this.onChanged(list) });
+    }
+    enabled() { return this.deps.config()?.enabled !== false; }
+    list() { return this.shares.list(); }
+    /**
+     * A new share and its URL, once the tunnel is up. `minutes` 15–max_hours×60 (60 if not given); `office` ALL_OFFICES
+     * or a stored office's id. A tunnel that cannot start ends the share at once and says why.
+     */
+    async create(opts) {
+        if (!this.enabled())
+            return { ok: false, error: "disabled" };
+        const made = this.shares.create({ ...opts, maxMinutes: shareMaxMinutes(this.deps.config()?.max_hours), exists: id => this.deps.officeExists(id) });
+        if (!made.ok)
+            return { ok: false, error: made.error };
+        const up = await this.up();
+        if (!up.ok) {
+            this.shares.revoke(made.share.id);
+            return { ok: false, error: "tunnel", reason: up.reason };
+        }
+        // Ended while the tunnel came up (revoked, or the feature turned off meanwhile): not handed out.
+        if (!this.shares.find(made.token))
+            return { ok: false, error: "tunnel", reason: "closed" };
+        return { ok: true, share: made.share, url: `${up.origin}/o/${made.token}` };
+    }
+    revoke(id) { return this.shares.revoke(id); }
+    /** Shares no longer allowed: the feature off (all), an owner no longer an admin, an office deleted. */
+    sweep() {
+        if (!this.enabled())
+            return this.shares.revoke("all");
+        return this.shares.endWhere(s => !this.deps.ownerCurrent(s.owner) || (s.office !== ALL_OFFICES && !this.deps.officeExists(s.office)));
+    }
+    /** The fleet is stopping: every share ends and the tunnel goes. */
+    async close() {
+        this.shares.revoke("all");
+        await this.down("fleet stopping");
+    }
+    onChanged(list) {
+        const open = new Set(list.map(s => s.id));
+        for (const id of this.known)
+            if (!open.has(id)) {
+                this.limiter.forget(id);
+                this.pictureLimiter.forget(id);
+            }
+        this.known = open;
+        // While any is open, who may still have it is asked again every SWEEP_MS (an admin removed, the feature turned
+        // off, an office deleted end theirs without anyone looking).
+        if (list.length && !this.sweeper) {
+            this.sweeper = setInterval(() => this.sweep(), SWEEP_MS);
+            this.sweeper.unref?.();
+        }
+        if (!list.length && this.sweeper) {
+            clearInterval(this.sweeper);
+            this.sweeper = null;
+        }
+        if (!list.length)
+            void this.down("no shares");
+        try {
+            this.deps.changed?.(list);
+        }
+        catch { /* a listener never keeps a share or the tunnel */ }
+    }
+    known = new Set();
+    sweeper = null;
+    /** The tunnel, up or coming up (one start at a time; never retried here). */
+    up() {
+        if (this.origin)
+            return Promise.resolve({ ok: true, origin: this.origin });
+        return this.starting ??= this.start().finally(() => { this.starting = null; });
+    }
+    async start() {
+        await this.stopping?.catch(() => { });
+        const abort = this.abort = new AbortController();
+        const gateway = (this.deps.createGateway ?? createOfficeShareGateway)({
+            shares: this.shares, source: this.deps.source, limiter: this.limiter, pictureLimiter: this.pictureLimiter, statics: officeShareStatic,
+            page: () => ({ body: OFFICE_SHARE_PAGE, csp: OFFICE_SHARE_PAGE_CSP }),
+        });
+        this.gateway = gateway;
+        const fail = (reason, detail) => {
+            this.deps.log?.(`tunnel ${reason}`, detail);
+            if (this.gateway === gateway) {
+                gateway.close();
+                this.gateway = null;
+            }
+            void this.deps.manager.stop(`start failed: ${reason}`).catch(() => { });
+            return { ok: false, reason };
+        };
+        try {
+            const binary = await this.deps.ensure(abort.signal);
+            if (abort.signal.aborted)
+                return fail("closed");
+            const origin = await gateway.listen();
+            if (abort.signal.aborted)
+                return fail("closed");
+            const result = await this.deps.manager.start(this.deps.provider(binary.path), {
+                sid: newTunnelSid(), origin, pagePath: "/ready", readinessMarker: gateway.readinessMarker, expiresAt: NO_EXPIRY_WALL,
+                signal: abort.signal, onCandidateHost: host => { if (!abort.signal.aborted)
+                    gateway.setHost(host); },
+            });
+            if (!result.ok)
+                return fail(failureOf(result.errorKind), result.message);
+            if (abort.signal.aborted)
+                return fail("closed");
+            const published = new URL(result.handle.pageUrl);
+            if (published.protocol !== "https:" || published.pathname !== "/ready" || !QUICK_TUNNEL_HOST.test(published.host))
+                return fail("bad-address");
+            gateway.setHost(published.host);
+            this.origin = published.origin;
+            // Gone by itself: every share's address was this host — they end, and the next share starts a new tunnel.
+            this.unsubscribe = result.handle.onUnexpectedExit(() => {
+                this.deps.log?.("tunnel exited");
+                this.origin = null;
+                this.shares.revoke("all");
+            });
+            this.deps.log?.("tunnel ready");
+            return { ok: true, origin: published.origin };
+        }
+        catch (err) {
+            return fail(abort.signal.aborted ? "closed" : "unknown", err?.message);
+        }
+    }
+    down(reason) {
+        if (!this.origin && !this.starting && !this.gateway)
+            return this.stopping ?? Promise.resolve();
+        this.origin = null;
+        this.abort?.abort();
+        this.abort = null;
+        this.unsubscribe?.();
+        this.unsubscribe = undefined;
+        this.gateway?.setHost(null);
+        this.gateway?.close();
+        this.gateway = null;
+        const stopping = this.stopping = (async () => {
+            await this.starting?.catch(() => { });
+            return this.deps.manager.stop(reason);
+        })().catch(() => { }).finally(() => { if (this.stopping === stopping)
+            this.stopping = null; });
+        return stopping;
+    }
+}
+//# sourceMappingURL=office-share-service.js.map

package/dist/office-share-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"office-share-service.js","sourceRoot":"","sources":["../src/office-share-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,EAAE,wBAAwB,EAAE,eAAe,EACvE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAE,SAAS,EAA0B,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAsB,MAAM,qBAAqB,CAAC;AAGvE,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAC7D,uFAAuF;AACvF,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAC/C,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AA2B/B,MAAM,OAAO,kBAAkB;IAYA,IAAI;IAXxB,MAAM,CAAe;IACtB,OAAO,GAA8B,IAAI,CAAC;IAC1C,MAAM,GAAkB,IAAI,CAAC;IAC7B,QAAQ,GAAuG,IAAI,CAAC;IACpH,QAAQ,GAA4B,IAAI,CAAC;IACzC,KAAK,GAA2B,IAAI,CAAC;IACrC,WAAW,CAA2B;IAC7B,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACpD,kHAAkH;IACjG,cAAc,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAE3D,YAA6B,IAA4B;oBAA5B,IAAI;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,KAAc,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,KAAoB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpD;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAyE;QACpF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnJ,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAAC,CAAC;QAC5G,iGAAiG;QACjG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,CAAC,EAAU,IAAY,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE7D,uGAAuG;IACvG,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxI,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAEO,SAAS,CAAC,IAAmB;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QAC5G,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,+GAA+G;QAC/G,6DAA6D;QAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAC,CAAC;QACvH,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;IACjG,CAAC;IACO,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1B,OAAO,GAA0C,IAAI,CAAC;IAE9D,6EAA6E;IACrE,EAAE;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC;YACpE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,iBAAiB;YACrI,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAE,MAAe,EAAE,EAAE;YAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;YACvE,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAC5E,GAAG,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,EAAE,cAAc;gBACpH,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACrG,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9I,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,0GAA0G;YAC1G,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAG,GAAa,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,MAAc;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/F,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}