@songsid/agend 2.3.2-beta.5 → 2.3.2-beta.7

package/dist/office-share-service.js

@@ -0,0 +1,172 @@
+/**
+ * #2636 part 3: Office share links, running — the shares (office-share.ts OfficeShares), their gateway, and the quick
+ * tunnel they share. Design: #2636, confirmed with the leader's two additions (2026-10-25):
+ *
+ * - The tunnel starts with the first share and stops when the last one ends (expired, revoked, its owner no longer an
+ *   admin, the feature turned off). trycloudflare.com limits new quick tunnels: a start it refuses (429) fails that one
+ *   share with "try again later" — nothing retries on its own. A share is only handed out once the tunnel is up.
+ * - No step beyond the admin check (decision a94a1bab): whoever may make one gets the link at once.
+ * - Its own manager and lease (OFFICE_SHARE_TUNNEL_DIR): never the fleet's one tunnel lane (/web, /login) nor the
+ *   public link's preview tunnel. A tunnel that goes away unexpectedly ends every share (their address was its host).
+ */
+import { ALL_OFFICES, OfficeShareLimiter, OfficeShares, createOfficeShareGateway, shareMaxMinutes } from "./office-share.js";
+import { OFFICE_SHARE_PAGE, OFFICE_SHARE_PAGE_CSP, officeShareStatic } from "./office-share-page.js";
+import { failureOf } from "./public-link-progress.js";
+import { newTunnelSid } from "./tunnel/manager.js";
+/** Where the share tunnel keeps its own lease (never the fleet's `tunnel.lease`). */
+export const OFFICE_SHARE_TUNNEL_DIR = "office-share-tunnel";
+const QUICK_TUNNEL_HOST = /^[a-z0-9-]+\.trycloudflare\.com$/;
+/** The lease's own end: none — the tunnel ends with its last share, not on a clock. */
+const NO_EXPIRY_WALL = Number.MAX_SAFE_INTEGER;
+/** How often open shares are checked against who may still have them. */
+export const SWEEP_MS = 30_000;
+export class OfficeShareService {
+    deps;
+    shares;
+    gateway = null;
+    origin = null;
+    starting = null;
+    stopping = null;
+    abort = null;
+    unsubscribe;
+    limiter = new OfficeShareLimiter();
+    constructor(deps) {
+        this.deps = deps;
+        this.shares = deps.shares ?? new OfficeShares({ changed: list => this.onChanged(list) });
+    }
+    enabled() { return this.deps.config()?.enabled !== false; }
+    list() { return this.shares.list(); }
+    /**
+     * A new share and its URL, once the tunnel is up. `minutes` 15–max_hours×60 (60 if not given); `office` ALL_OFFICES
+     * or a stored office's id. A tunnel that cannot start ends the share at once and says why.
+     */
+    async create(opts) {
+        if (!this.enabled())
+            return { ok: false, error: "disabled" };
+        const made = this.shares.create({ ...opts, maxMinutes: shareMaxMinutes(this.deps.config()?.max_hours), exists: id => this.deps.officeExists(id) });
+        if (!made.ok)
+            return { ok: false, error: made.error };
+        const up = await this.up();
+        if (!up.ok) {
+            this.shares.revoke(made.share.id);
+            return { ok: false, error: "tunnel", reason: up.reason };
+        }
+        // Ended while the tunnel came up (revoked, or the feature turned off meanwhile): not handed out.
+        if (!this.shares.find(made.token))
+            return { ok: false, error: "tunnel", reason: "closed" };
+        return { ok: true, share: made.share, url: `${up.origin}/o/${made.token}` };
+    }
+    revoke(id) { return this.shares.revoke(id); }
+    /** Shares no longer allowed: the feature off (all), an owner no longer an admin, an office deleted. */
+    sweep() {
+        if (!this.enabled())
+            return this.shares.revoke("all");
+        return this.shares.endWhere(s => !this.deps.ownerCurrent(s.owner) || (s.office !== ALL_OFFICES && !this.deps.officeExists(s.office)));
+    }
+    /** The fleet is stopping: every share ends and the tunnel goes. */
+    async close() {
+        this.shares.revoke("all");
+        await this.down("fleet stopping");
+    }
+    onChanged(list) {
+        const open = new Set(list.map(s => s.id));
+        for (const id of this.known)
+            if (!open.has(id))
+                this.limiter.forget(id);
+        this.known = open;
+        // While any is open, who may still have it is asked again every SWEEP_MS (an admin removed, the feature turned
+        // off, an office deleted end theirs without anyone looking).
+        if (list.length && !this.sweeper) {
+            this.sweeper = setInterval(() => this.sweep(), SWEEP_MS);
+            this.sweeper.unref?.();
+        }
+        if (!list.length && this.sweeper) {
+            clearInterval(this.sweeper);
+            this.sweeper = null;
+        }
+        if (!list.length)
+            void this.down("no shares");
+        try {
+            this.deps.changed?.(list);
+        }
+        catch { /* a listener never keeps a share or the tunnel */ }
+    }
+    known = new Set();
+    sweeper = null;
+    /** The tunnel, up or coming up (one start at a time; never retried here). */
+    up() {
+        if (this.origin)
+            return Promise.resolve({ ok: true, origin: this.origin });
+        return this.starting ??= this.start().finally(() => { this.starting = null; });
+    }
+    async start() {
+        await this.stopping?.catch(() => { });
+        const abort = this.abort = new AbortController();
+        const gateway = (this.deps.createGateway ?? createOfficeShareGateway)({
+            shares: this.shares, source: this.deps.source, limiter: this.limiter, statics: officeShareStatic,
+            page: () => ({ body: OFFICE_SHARE_PAGE, csp: OFFICE_SHARE_PAGE_CSP }),
+        });
+        this.gateway = gateway;
+        const fail = (reason, detail) => {
+            this.deps.log?.(`tunnel ${reason}`, detail);
+            if (this.gateway === gateway) {
+                gateway.close();
+                this.gateway = null;
+            }
+            void this.deps.manager.stop(`start failed: ${reason}`).catch(() => { });
+            return { ok: false, reason };
+        };
+        try {
+            const binary = await this.deps.ensure(abort.signal);
+            if (abort.signal.aborted)
+                return fail("closed");
+            const origin = await gateway.listen();
+            if (abort.signal.aborted)
+                return fail("closed");
+            const result = await this.deps.manager.start(this.deps.provider(binary.path), {
+                sid: newTunnelSid(), origin, pagePath: "/ready", readinessMarker: gateway.readinessMarker, expiresAt: NO_EXPIRY_WALL,
+                signal: abort.signal, onCandidateHost: host => { if (!abort.signal.aborted)
+                    gateway.setHost(host); },
+            });
+            if (!result.ok)
+                return fail(failureOf(result.errorKind), result.message);
+            if (abort.signal.aborted)
+                return fail("closed");
+            const published = new URL(result.handle.pageUrl);
+            if (published.protocol !== "https:" || published.pathname !== "/ready" || !QUICK_TUNNEL_HOST.test(published.host))
+                return fail("bad-address");
+            gateway.setHost(published.host);
+            this.origin = published.origin;
+            // Gone by itself: every share's address was this host — they end, and the next share starts a new tunnel.
+            this.unsubscribe = result.handle.onUnexpectedExit(() => {
+                this.deps.log?.("tunnel exited");
+                this.origin = null;
+                this.shares.revoke("all");
+            });
+            this.deps.log?.("tunnel ready");
+            return { ok: true, origin: published.origin };
+        }
+        catch (err) {
+            return fail(abort.signal.aborted ? "closed" : "unknown", err?.message);
+        }
+    }
+    down(reason) {
+        if (!this.origin && !this.starting && !this.gateway)
+            return this.stopping ?? Promise.resolve();
+        this.origin = null;
+        this.abort?.abort();
+        this.abort = null;
+        this.unsubscribe?.();
+        this.unsubscribe = undefined;
+        this.gateway?.setHost(null);
+        this.gateway?.close();
+        this.gateway = null;
+        const stopping = this.stopping = (async () => {
+            await this.starting?.catch(() => { });
+            return this.deps.manager.stop(reason);
+        })().catch(() => { }).finally(() => { if (this.stopping === stopping)
+            this.stopping = null; });
+        return stopping;
+    }
+}
+//# sourceMappingURL=office-share-service.js.map

package/dist/office-share-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"office-share-service.js","sourceRoot":"","sources":["../src/office-share-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,EAAE,wBAAwB,EAAE,eAAe,EACvE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAE,SAAS,EAA0B,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAsB,MAAM,qBAAqB,CAAC;AAGvE,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAC7D,uFAAuF;AACvF,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAC/C,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AA2B/B,MAAM,OAAO,kBAAkB;IAUA,IAAI;IATxB,MAAM,CAAe;IACtB,OAAO,GAA8B,IAAI,CAAC;IAC1C,MAAM,GAAkB,IAAI,CAAC;IAC7B,QAAQ,GAAuG,IAAI,CAAC;IACpH,QAAQ,GAA4B,IAAI,CAAC;IACzC,KAAK,GAA2B,IAAI,CAAC;IACrC,WAAW,CAA2B;IAC7B,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEpD,YAA6B,IAA4B;oBAA5B,IAAI;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,KAAc,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,KAAoB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpD;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAyE;QACpF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnJ,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAAC,CAAC;QAC5G,iGAAiG;QACjG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,CAAC,EAAU,IAAY,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE7D,uGAAuG;IACvG,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxI,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAEO,SAAS,CAAC,IAAmB;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,+GAA+G;QAC/G,6DAA6D;QAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAC,CAAC;QACvH,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;IACjG,CAAC;IACO,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1B,OAAO,GAA0C,IAAI,CAAC;IAE9D,6EAA6E;IACrE,EAAE;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC;YACpE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB;YAChG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAE,MAAe,EAAE,EAAE;YAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;YACvE,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAC5E,GAAG,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,EAAE,cAAc;gBACpH,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACrG,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9I,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,0GAA0G;YAC1G,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAG,GAAa,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,MAAc;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/F,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/office-share.d.ts

@@ -0,0 +1,228 @@
+import { createServer, type Server } from "node:http";
+import { type OfficeAct } from "./web-office-acts.js";
+import type { Office } from "./web-office-store.js";
+export declare const OFFICE_SHARE_LIMITS: {
+    /** Shares open at once, fleet-wide. */
+    readonly links: 10;
+    /** Lifetime: 1 h unless asked, 15 min to `web.office_share.max_hours` (24 at most). */
+    readonly defaultMinutes: 60;
+    readonly minMinutes: 15;
+    readonly maxHours: 24;
+    /** Per share, a sliding minute: requests, and bytes answered. */
+    readonly requestsPerMinute: 120;
+    readonly bytesPerMinute: number;
+    /** The page's static files (its code, the same for every share), all shares together. */
+    readonly staticRequestsPerMinute: 1200;
+    readonly staticBytesPerMinute: number;
+};
+/** "All offices": every stored office (and whoever is in none); otherwise a stored office's id. */
+export declare const ALL_OFFICES = "all";
+/**
+ * An office's members after the share's cut, when every one it named is out of the share: a team no chart has (a team's
+ * name has no control character), so the page finds nobody — never [], which the page reads as everyone.
+ */
+export declare const NOBODY = "team:\0";
+/** An ended (or unknown) share's page: the same words whichever it is. */
+export declare const ENDED_PAGE: string;
+export interface OfficeShare {
+    /** A short handle for lists and revoking (never the token). */
+    id: string;
+    /** ALL_OFFICES, or a stored office's id. */
+    office: string;
+    /** Agents' own lines (office_set `say`) are shown. */
+    text: boolean;
+    /** Who made it (for the list and General's announcement). */
+    owner: string;
+    /** Wall-clock ms, for display; the expiry itself runs on the monotonic clock. */
+    createdAt: number;
+    expiresAt: number;
+}
+export type OfficeShareCreate = {
+    ok: true;
+    share: OfficeShare;
+    token: string;
+} | {
+    ok: false;
+    error: "too_many" | "duration" | "office";
+};
+export declare const hashShareToken: (token: string) => string;
+/** The longest a share may live, in minutes: `web.office_share.max_hours` (whole hours, 1–24), 24 by default. */
+export declare function shareMaxMinutes(maxHours: unknown): number;
+/**
+ * The open shares. Each ends at its deadline (monotonic; a timer tells `changed` then, and find() refuses it from that
+ * moment whatever the timer did), when revoked, or when its owner is no longer allowed (endWhere). `changed` hears every
+ * change with the list as it is now — the tunnel follows it (none left: stop).
+ */
+export declare class OfficeShares {
+    private readonly deps;
+    private readonly byHash;
+    private readonly now;
+    private readonly wall;
+    constructor(deps?: {
+        /** Monotonic ms (performance.now by default). */
+        now?(): number;
+        /** Wall-clock ms (Date.now by default): only what is shown. */
+        wall?(): number;
+        changed?(shares: OfficeShare[]): void;
+        random?(n: number): Buffer;
+        setTimer?(fn: () => void, ms: number): ReturnType<typeof setTimeout> | null;
+        clearTimer?(t: ReturnType<typeof setTimeout>): void;
+    });
+    /** A new share: `minutes` from 15 to `maxMinutes`; `office` ALL_OFFICES or an id `exists` knows. */
+    create(opts: {
+        office: string;
+        minutes?: number;
+        text?: boolean;
+        owner: string;
+        maxMinutes?: number;
+        exists?(office: string): boolean;
+    }): OfficeShareCreate;
+    /** The open share a token names, or null (unknown, malformed, ended). */
+    find(token: string): OfficeShare | null;
+    /** The open shares, soonest to end first. */
+    list(): OfficeShare[];
+    /** End one share by id, or every one (ALL_OFFICES is not an id: "all" ends all). Returns how many ended. */
+    revoke(id: string): number;
+    /** End every share `test` picks (an owner no longer a fleet admin, an office deleted, the feature turned off). */
+    endWhere(test: (share: OfficeShare) => boolean): number;
+    private drop;
+    private prune;
+    private announce;
+}
+/** Per key (a share's id): requests and bytes in a sliding minute (monotonic, memory only). */
+export declare class OfficeShareLimiter {
+    private readonly now;
+    private readonly limits;
+    private readonly seen;
+    constructor(now?: () => number, limits?: {
+        requests: number;
+        bytes: number;
+    });
+    /** A request arrives: false when the key has had its requests or bytes this minute. */
+    admit(id: string): boolean;
+    /** What the admitted request answered, in bytes. */
+    sent(id: string, bytes: number): void;
+    forget(id: string): void;
+    private window;
+}
+/** Where a share's picture is read from: the fleet's own reads, as they are now. */
+export interface OfficeShareSource {
+    /** The status frame (getUiStatus): its `instances`. */
+    status(): unknown;
+    /** The org chart (orgChart): `general` and `teams`. */
+    org(): {
+        general?: unknown;
+        teams?: unknown;
+    };
+    /** The stored offices (web-office-store.ts list()). */
+    offices(): {
+        rev: number;
+        offices: Office[];
+    };
+    /** The live acts (OfficeActs live()). */
+    acts(): OfficeAct[];
+    /** /ui/traffic's snapshot. */
+    traffic(): {
+        now: string;
+        items: unknown[];
+        delegations?: unknown[];
+    };
+    /** The instances "Needs you" names now (one entry per item). */
+    needs(): string[];
+    /** cross_instance_visibility "hidden" now. */
+    hidden(name: string): boolean;
+    /** The skin packs the host keeps (web-office-skins.ts). */
+    skins?: {
+        list(): {
+            packs: Array<{
+                id: string;
+            }>;
+        } & Record<string, unknown>;
+        get(id: string): unknown;
+        picture(id: string, sha: string): Buffer | null;
+    };
+}
+/**
+ * One share's picture, read once from `src`: who is in it (`scope`), and each read the page makes, cut to them.
+ * `offices`: the shared office, or every stored office; `null` when the shared office is gone (the share then shows
+ * nothing and its owner is told it ended).
+ */
+export declare class OfficeShareView {
+    private readonly share;
+    private readonly src;
+    readonly offices: Office[] | null;
+    readonly scope: ReadonlySet<string>;
+    private readonly people;
+    /** fleet.yaml's teams with someone shown, each with only its shown members. */
+    private readonly teams;
+    constructor(share: Pick<OfficeShare, "office" | "text"> & Partial<Pick<OfficeShare, "expiresAt">>, src: OfficeShareSource);
+    /** The status frame as the page's app store takes it, and the chart's structure (no descriptions, threads or info). */
+    state(): Record<string, unknown>;
+    /**
+     * /ui/offices's answer, the shared office (or all) only, each cut to the share (#2637 review): its members only those
+     * shown (an instance, or a team with someone shown; NOBODY when none is), and a seat kept for someone not shown keeps
+     * its place but not the name. The stored offices are never changed.
+     */
+    officeList(): {
+        rev: number;
+        offices: Office[];
+        readable: boolean;
+    };
+    /** /ui/office-acts's answer: the acts of the people shown, in a shown office, without their line unless shared. */
+    acts(): {
+        acts: OfficeAct[];
+        now: number;
+    };
+    /**
+     * A pack's answer as this share gets it (#2637 review): its manifest's instance names cut to the share — `byInstance`
+     * only for people shown, a furniture item's `activeFor` only them (none left: [], which watches nobody, never the
+     * missing key, which watches everyone). A copy: the kept pack is never changed.
+     */
+    pack(answer: unknown): unknown;
+    /** The packs the shown offices are drawn in (a pack no shown office names is not offered). */
+    skinIds(): Set<string>;
+}
+export interface OfficeShareGateway {
+    readonly server: Server;
+    readonly readinessMarker: string;
+    listen(): Promise<URL>;
+    setHost(host: string | null): void;
+    close(): void;
+}
+/**
+ * The share tunnel's gateway. GET and HEAD only, on this tunnel's own Host; `/ready` for the tunnel's probe; then
+ * `/o/<token>` and its reads, for an open share within its limits:
+ *
+ *   /o/<t>                                  the page (`page`; 404 while there is none)
+ *   /o/<t>/state                            OfficeShareView.state()
+ *   /o/<t>/offices                          OfficeShareView.officeList()
+ *   /o/<t>/office-acts                      OfficeShareView.acts()
+ *   /o/<t>/office-skins                     the packs the shown offices use
+ *   /o/<t>/office-skins/<id>                one of them, its instance names cut to the share (never cached)
+ *   /o/<t>/office-skins/<id>/img/<sha>.png  its picture (immutable)
+ *
+ * and, with no token, the page's static files at the dashboard's own paths (`statics`: `/assets/<name>`, `/ui/js/<name>`;
+ * office-share-page.ts names them), limited together (OFFICE_SHARE_LIMITS.static*).
+ *
+ * Anything else, an unknown or ended token, an office since deleted: an empty 404 (no word on why: a stranger learns
+ * nothing). Over the limit: 429. The share is asked again before each answer is sent. No cookie is read or set and
+ * nothing is logged per request.
+ */
+export declare function createOfficeShareGateway(opts: {
+    shares: Pick<OfficeShares, "find">;
+    source: OfficeShareSource;
+    limiter?: OfficeShareLimiter;
+    /** The page for a share (HTML), or null while there is none. */
+    page?(share: OfficeShare, token: string): {
+        body: string;
+        csp: string;
+    } | null;
+    /** A static file of the page by its path (`/assets/…`, `/ui/js/…`), or null. */
+    statics?(path: string): {
+        body: Buffer;
+        type: string;
+    } | null;
+    staticLimiter?: OfficeShareLimiter;
+    create?: typeof createServer;
+    marker?: string;
+}): OfficeShareGateway;