@songsid/agend 2.3.3-beta.9 → 2.3.4-beta.1

package/dist/tunnel/named-diagnostics.d.ts

@@ -3,7 +3,8 @@ export declare const NAMED_TUNNEL_FAILURE_MESSAGES: {
     readonly "named-route-missing": "The named hostname did not reach a published application; check this tunnel's hostname, DNS and published application route.";
     readonly "named-hostname-mismatch": "The named hostname answered with a different page; check that its published application points to AgEnD's origin URL.";
     readonly "named-origin-unreachable": "Cloudflare could not reach the local origin; check the published application's origin URL and port.";
-    readonly "named-connection-failed": "The named tunnel could not connect to Cloudflare; check network, DNS and firewall access, then retry.";
+    readonly "named-connection-failed": "The named tunnel could not connect to Cloudflare; check that this machine's network allows outbound connections to Cloudflare, or try protocol http2.";
+    readonly "named-self-unreachable": "The named tunnel is connected to Cloudflare, but this machine could not open its own address; this machine's network may block the hostname or its DNS.";
 };
 export type NamedTunnelFailureKind = keyof typeof NAMED_TUNNEL_FAILURE_MESSAGES;
 export declare function namedTunnelFailureMessage(kind: string): string | undefined;

package/dist/tunnel/named-diagnostics.js

@@ -5,7 +5,10 @@ export const NAMED_TUNNEL_FAILURE_MESSAGES = {
     "named-route-missing": "The named hostname did not reach a published application; check this tunnel's hostname, DNS and published application route.",
     "named-hostname-mismatch": "The named hostname answered with a different page; check that its published application points to AgEnD's origin URL.",
     "named-origin-unreachable": "Cloudflare could not reach the local origin; check the published application's origin URL and port.",
-    "named-connection-failed": "The named tunnel could not connect to Cloudflare; check network, DNS and firewall access, then retry.",
+    "named-connection-failed": "The named tunnel could not connect to Cloudflare; check that this machine's network allows outbound connections to Cloudflare, or try protocol http2.",
+    // The connector registered, but this machine's own HTTPS request to the hostname was reset or timed out: the tunnel
+    // is up; this machine's network does not open its own address (from elsewhere it may work).
+    "named-self-unreachable": "The named tunnel is connected to Cloudflare, but this machine could not open its own address; this machine's network may block the hostname or its DNS.",
 };
 export function namedTunnelFailureMessage(kind) {
     return Object.hasOwn(NAMED_TUNNEL_FAILURE_MESSAGES, kind) ? NAMED_TUNNEL_FAILURE_MESSAGES[kind] : undefined;

package/dist/tunnel/named-diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"named-diagnostics.js","sourceRoot":"","sources":["../../src/tunnel/named-diagnostics.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,mBAAmB,EAAE,wGAAwG;IAC7H,qBAAqB,EAAE,8HAA8H;IACrJ,yBAAyB,EAAE,uHAAuH;IAClJ,0BAA0B,EAAE,qGAAqG;IACjI,yBAAyB,EAAE,uGAAuG;CAC1H,CAAC;AAEX,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAA8B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxI,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvK,2GAA2G;AAC3G,MAAM,UAAU,6BAA6B,CAAC,KAAc,EAAE,KAAa;IACzE,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,QAAQ,GAAa,EAAE,CAAC;IACtF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,4GAA4G;IAC5G,OAAO,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAgF,CAAC;QAC9F,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,qBAAqB,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AACxG,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,KAAa;IACrE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,MAAM,KAAK,GAAG,iBAAiB,CAAC,2BAA2B,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACzH,IAAI,+OAA+O,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC5R,IAAI,+FAA+F,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC9I,IAAI,8HAA8H,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAClL,IAAI,+QAA+Q,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAClU,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"named-diagnostics.js","sourceRoot":"","sources":["../../src/tunnel/named-diagnostics.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,mBAAmB,EAAE,wGAAwG;IAC7H,qBAAqB,EAAE,8HAA8H;IACrJ,yBAAyB,EAAE,uHAAuH;IAClJ,0BAA0B,EAAE,qGAAqG;IACjI,yBAAyB,EAAE,uJAAuJ;IAClL,oHAAoH;IACpH,4FAA4F;IAC5F,wBAAwB,EAAE,yJAAyJ;CAC3K,CAAC;AAEX,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAA8B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxI,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvK,2GAA2G;AAC3G,MAAM,UAAU,6BAA6B,CAAC,KAAc,EAAE,KAAa;IACzE,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,QAAQ,GAAa,EAAE,CAAC;IACtF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,4GAA4G;IAC5G,OAAO,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAgF,CAAC;QAC9F,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,qBAAqB,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AACxG,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,KAAa;IACrE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,MAAM,KAAK,GAAG,iBAAiB,CAAC,2BAA2B,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACzH,IAAI,+OAA+O,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC5R,IAAI,+FAA+F,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC9I,IAAI,8HAA8H,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAClL,IAAI,+QAA+Q,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAClU,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tunnel/named-link-test.d.ts

@@ -0,0 +1,90 @@
+import { type CloudflaredOptions, type CloudflaredProtocol } from "./cloudflared.js";
+import { type ProbeResponse } from "./public-fetch.js";
+import type { TunnelPurposeLane } from "./purpose-lane.js";
+import type { TunnelProvider } from "./types.js";
+export type NamedTestStep = "values" | "origin" | "tunnel" | "dns" | "reach";
+export declare const NAMED_TEST_STEPS: readonly NamedTestStep[];
+/** What each step found; the page words each one (and what to do next) in the person's language. */
+export type NamedTestCode = "ok" | "live" | "timeout" | "cancelled" | "bad-hostname" | "bad-port" | "no-token" | "bad-token" | "dashboard-port" | "port-in-use" | "origin-failed" | "link-open-other" | "tunnel-busy" | "auth" | "network" | "stopped" | "no-binary" | "dns-missing" | "dns-failed" | "wrong-service" | "other-page" | "route-missing" | "self-unreachable" | "reach-failed";
+export interface NamedTestStepResult {
+    step: NamedTestStep;
+    ok: boolean;
+    code: NamedTestCode;
+}
+export interface NamedTestResult {
+    steps: NamedTestStepResult[];
+    hostname: string | null;
+    port: number | null;
+    /** The test connector's stop could not be proven: it may still run (the lane stays held until it is resolved). */
+    cleanup?: "unconfirmed";
+}
+export interface NamedTestInput {
+    hostname: unknown;
+    port: unknown;
+    protocol: unknown;
+    token: string | null | undefined;
+}
+export declare const NAMED_TEST_REGISTER_MS = 20000;
+export declare const NAMED_TEST_REACH_MS = 20000;
+/** The whole test before cleanup, whatever happens. */
+export declare const NAMED_TEST_HARD_MS = 60000;
+/** Cleanup's own allowance after the deadline: the managed stop (TERM, proof, KILL, proof) and closing the stand-in. */
+export declare const NAMED_TEST_CLEANUP_MS = 15000;
+/** The test connector's lane: started through the managed tunnel, given back only on a proven stop. */
+export interface NamedTestLane {
+    start(input: {
+        binary: string;
+        hostname: string;
+        token: string;
+        protocol: CloudflaredProtocol;
+        origin: URL;
+        signal: AbortSignal;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        kind: string;
+    }>;
+    stop(): Promise<{
+        confirmed: boolean;
+    }>;
+    /** Nothing was started: give the lane back. */
+    releaseUnused(): void;
+}
+export interface NamedLinkTestDeps {
+    /** The dashboard's own port: never the tunnel's origin. */
+    healthPort: number;
+    /** The bundled cloudflared's path (may fetch the pinned copy). */
+    ensureBinary(signal: AbortSignal): Promise<string>;
+    /** The open link on exactly these values: its page's readiness marker. Null: none (or other values). */
+    liveMarker(values: {
+        hostname: string;
+        port: number;
+        token: string;
+        protocol: CloudflaredProtocol;
+    }): string | null;
+    /** Holds the one tunnel lane for the test, or says who holds it. */
+    reserve(): NamedTestLane | {
+        busy: "link-open" | "other";
+    };
+    /** The admin who asked is still signed in (checked before anything is started). */
+    current?(): boolean;
+    /** Test seams. */
+    resolve4?: (host: string) => Promise<string[]>;
+    systemLookup?: (host: string) => Promise<unknown>;
+    fetchPage?: (url: string, signal: AbortSignal) => Promise<ProbeResponse>;
+    bindHost?: string;
+    hardMs?: number;
+    cleanupMs?: number;
+    reachMs?: number;
+    retryMs?: number;
+}
+export declare function runNamedLinkTest(input: NamedTestInput, deps: NamedLinkTestDeps, outer?: AbortSignal): Promise<NamedTestResult>;
+/**
+ * The production lane: the one tunnel lane's reservation, the connector started by its managed start (lease, proven
+ * stop) as a CloudflaredProvider that is ready once registered. `provider` is a test seam.
+ */
+export declare function namedTestLane(lane: TunnelPurposeLane, opts?: {
+    registerMs?: number;
+    provider?: (o: CloudflaredOptions) => TunnelProvider;
+}): NamedLinkTestDeps["reserve"];

package/dist/tunnel/named-link-test.js

@@ -0,0 +1,270 @@
+/**
+ * The fixed-address "Test connection" (Settings → Access; the user, 2026-11-01): checks the named-tunnel values as
+ * filled in, step by step, and says for each ✗ what the person can do next.
+ *
+ *   ① values   the hostname, the origin port and the connector token are well-formed
+ *   ② origin   a stand-in answers on 127.0.0.1:<port> for this test (what Cloudflare's route must point to)
+ *   ③ tunnel   a test connector (the bundled cloudflared, the token in its environment) registers with Cloudflare
+ *   ④ dns      the hostname resolves through a public resolver
+ *   ⑤ reach    an HTTPS request to the hostname comes back with this test's nonce (so it reached THIS AgEnD)
+ *
+ * With the admin's link already open on exactly these values (protocol included), nothing is started: ② and ③ are
+ * the open link's own, and ⑤ looks for its page's readiness marker instead (the open link is never stopped, replaced
+ * or shared).
+ *
+ * #2907 review: the connector is started through the one tunnel lane's managed start (the lease a crash leaves
+ * recoverable, a stop proven by the process's fingerprint); the lane is given back only on a confirmed stop — an
+ * unproven one is reported (`cleanup: "unconfirmed"`) and the lane stays held. Every stage races the hard deadline,
+ * and nothing is started once it (or the admin's session) is gone. Only closed step codes leave this module: the
+ * token goes into the connector's environment, never argv, and its output is read for a closed classification only.
+ */
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { lookup, Resolver } from "node:dns/promises";
+import { publicTunnelHostname, normalizePublicTunnelToken } from "../public-tunnel-config.js";
+import { CloudflaredProvider } from "./cloudflared.js";
+import { classifyNamedTunnelProbeError } from "./named-diagnostics.js";
+import { fetchViaPublicResolver, fetchViaSystemResolver, isPublicIPv4, PUBLIC_RESOLVERS } from "./public-fetch.js";
+export const NAMED_TEST_STEPS = ["values", "origin", "tunnel", "dns", "reach"];
+/** Cloudflare's own "no connector / origin unreachable" answers (502 Bad gateway, 503, 530 incl. error 1033). */
+const WRONG_SERVICE_STATUSES = new Set([502, 503, 504, 530]);
+export const NAMED_TEST_REGISTER_MS = 20_000;
+export const NAMED_TEST_REACH_MS = 20_000;
+/** The whole test before cleanup, whatever happens. */
+export const NAMED_TEST_HARD_MS = 60_000;
+/** Cleanup's own allowance after the deadline: the managed stop (TERM, proof, KILL, proof) and closing the stand-in. */
+export const NAMED_TEST_CLEANUP_MS = 15_000;
+const DEADLINE = Symbol("deadline");
+/** A step that threw (not a closed answer): its own closed failure. */
+const UNEXPECTED = { values: "bad-token", origin: "origin-failed", tunnel: "stopped", dns: "dns-failed", reach: "reach-failed" };
+/** `p`, unless the signal fires first (then DEADLINE); `p` itself is left to settle on its own. */
+function within(p, signal) {
+    if (signal.aborted) {
+        p.catch(() => { });
+        return Promise.reject(DEADLINE);
+    }
+    return new Promise((resolve, reject) => {
+        const stop = () => reject(DEADLINE);
+        signal.addEventListener("abort", stop, { once: true });
+        p.then(v => { signal.removeEventListener("abort", stop); resolve(v); }, e => { signal.removeEventListener("abort", stop); reject(e); });
+    });
+}
+const settleWithin = (p, ms) => Promise.race([p, new Promise(r => setTimeout(() => r(DEADLINE), ms).unref?.())]);
+export async function runNamedLinkTest(input, deps, outer) {
+    const steps = [];
+    const pass = (step, code = "ok") => { steps.push({ step, ok: true, code }); };
+    const fail = (step, code) => { steps.push({ step, ok: false, code }); return { steps, hostname, port }; };
+    // ① values — nothing runs on a value that could not be used.
+    const hostname = publicTunnelHostname(typeof input.hostname === "string" ? input.hostname.trim() : input.hostname);
+    const portRaw = typeof input.port === "string" && input.port.trim() !== "" ? Number(input.port) : input.port;
+    const port = Number.isInteger(portRaw) && portRaw >= 1024 && portRaw <= 65535 ? portRaw : null;
+    if (!hostname)
+        return fail("values", "bad-hostname");
+    if (port === null)
+        return fail("values", "bad-port");
+    if (!input.token)
+        return fail("values", "no-token");
+    const token = normalizePublicTunnelToken(input.token);
+    if (!token)
+        return fail("values", "bad-token");
+    pass("values");
+    const protocol = input.protocol === "quic" || input.protocol === "auto" ? input.protocol : "http2";
+    const abort = new AbortController();
+    const hard = setTimeout(() => abort.abort(), deps.hardMs ?? NAMED_TEST_HARD_MS);
+    const onOuter = () => abort.abort();
+    outer?.addEventListener("abort", onOuter, { once: true });
+    const signal = abort.signal;
+    /** Before anything is started: the deadline has not passed and the admin who asked is still signed in. */
+    const gone = () => signal.aborted ? "timeout" : deps.current && !deps.current() ? "cancelled" : null;
+    let server = null, lane = null, started = false;
+    let result;
+    let step = "origin";
+    try {
+        result = await (async () => {
+            // The admin's link is open on exactly these values: test it as it is.
+            const marker = deps.liveMarker({ hostname, port, token, protocol });
+            if (marker) {
+                pass("origin", "live");
+                pass("tunnel", "live");
+                step = "dns";
+                const dns = await within(resolveStep(hostname, deps), signal);
+                if (dns !== "ok")
+                    return fail("dns", dns);
+                pass("dns");
+                step = "reach";
+                const reach = await within(reachStep(`https://${hostname}/signin`, marker, true, deps, signal), signal);
+                return reach === "ok" ? (pass("reach"), { steps, hostname, port }) : fail("reach", reach);
+            }
+            if (port === deps.healthPort)
+                return fail("origin", "dashboard-port");
+            const stop = gone();
+            if (stop)
+                return fail("origin", stop);
+            const held = deps.reserve();
+            if ("busy" in held)
+                return fail("origin", held.busy === "link-open" ? "link-open-other" : "tunnel-busy");
+            lane = held;
+            // ② origin — a stand-in that answers every request with this test's nonce, and nothing else.
+            const nonce = randomBytes(16).toString("hex");
+            const page = `<!doctype html><title>AgEnD</title><p>agend-named-test ${nonce}</p>`;
+            const stand = createServer((req, res) => { res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" }); res.end(req.method === "HEAD" ? undefined : page); });
+            server = stand;
+            const bound = await within(new Promise(resolve => {
+                stand.once("error", (err) => resolve(err?.code === "EADDRINUSE" || err?.code === "EACCES" ? "port-in-use" : "origin-failed"));
+                stand.listen(port, deps.bindHost ?? "127.0.0.1", () => resolve("ok"));
+            }), signal);
+            if (bound !== "ok") {
+                server = null;
+                return fail("origin", bound);
+            }
+            pass("origin");
+            // ③ tunnel — a test connector of the same tunnel, through the lane's managed start.
+            step = "tunnel";
+            let binary;
+            try {
+                binary = await within(deps.ensureBinary(signal), signal);
+            }
+            catch (err) {
+                if (err === DEADLINE)
+                    throw err;
+                return fail("tunnel", "no-binary");
+            }
+            const late = gone();
+            if (late)
+                return fail("tunnel", late);
+            started = true;
+            const connector = await within(lane.start({ binary, hostname, token, protocol, origin: new URL(`http://127.0.0.1:${port}`), signal }), signal);
+            if (!connector.ok)
+                return fail("tunnel", tunnelCode(connector.kind, signal));
+            pass("tunnel");
+            // ④ dns, ⑤ reach — through a public resolver, as a phone elsewhere would.
+            step = "dns";
+            const dns = await within(resolveStep(hostname, deps), signal);
+            if (dns !== "ok")
+                return fail("dns", dns);
+            pass("dns");
+            step = "reach";
+            const reach = await within(reachStep(`https://${hostname}/agend-named-test-${nonce.slice(0, 8)}`, `agend-named-test ${nonce}`, false, deps, signal), signal);
+            return reach === "ok" ? (pass("reach"), { steps, hostname, port }) : fail("reach", reach);
+        })();
+    }
+    catch (err) {
+        // #2907 review (r2): nothing thrown escapes before the cleanup below — the deadline is "timeout" (or "cancelled"),
+        // anything else (a lease write refused, an unexpected error) is the step's closed failure; never a raw error.
+        result = fail(step, err === DEADLINE ? (outer?.aborted ? "cancelled" : "timeout") : UNEXPECTED[step]);
+    }
+    finally {
+        clearTimeout(hard);
+        outer?.removeEventListener("abort", onOuter);
+        // Cleanup, unconditionally and with its own allowance: what was started goes through the lane's managed stop
+        // (which gives the lane back only on a proven stop); the stand-in closes on every outcome.
+        const cleanupMs = deps.cleanupMs ?? NAMED_TEST_CLEANUP_MS;
+        let unconfirmed = false;
+        if (lane) {
+            const held = lane;
+            if (started) {
+                const stopped = await settleWithin(held.stop().catch(() => ({ confirmed: false })), cleanupMs);
+                unconfirmed = stopped === DEADLINE || !stopped.confirmed;
+            }
+            else
+                held.releaseUnused();
+        }
+        if (server) {
+            const stand = server;
+            await settleWithin(new Promise(r => { stand.close(() => r()); stand.closeAllConnections?.(); }), cleanupMs);
+        }
+        if (unconfirmed)
+            result.cleanup = "unconfirmed";
+    }
+    return result;
+}
+/** ③'s closed codes from the managed start's error kinds. */
+function tunnelCode(kind, signal) {
+    switch (kind) {
+        case "named-auth-failed": return "auth";
+        case "named-connection-failed":
+        case "timeout": return "network";
+        case "cancelled": return signal.aborted ? "timeout" : "stopped";
+        case "lease-held": return "tunnel-busy";
+        case "binary-missing":
+        case "binary-not-executable": return "no-binary";
+        default: return "stopped";
+    }
+}
+/** ④: a public resolver's answer (what a phone elsewhere gets); the system's only when the public one cannot answer. */
+async function resolveStep(hostname, deps) {
+    try {
+        const resolve4 = deps.resolve4 ?? ((h) => { const r = new Resolver({ timeout: 3_000, tries: 2 }); r.setServers([...PUBLIC_RESOLVERS]); return r.resolve4(h); });
+        const addresses = await resolve4(hostname);
+        return addresses.some(isPublicIPv4) ? "ok" : "dns-missing";
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOTFOUND" || code === "ENODATA")
+            return "dns-missing";
+    }
+    try {
+        await (deps.systemLookup ?? ((h) => lookup(h)))(hostname);
+        return "ok";
+    }
+    catch (err) {
+        return err?.code === "ENOTFOUND" ? "dns-missing" : "dns-failed";
+    }
+}
+/** ⑤: retried until the budget ends (the edge takes a moment to learn a new connector); the last answer decides. */
+async function reachStep(url, expected, live, deps, signal) {
+    const fetchPage = deps.fetchPage ?? ((u, s) => fetchViaPublicResolver(u, s, { fallback: (v, t) => fetchViaSystemResolver(v, t) }));
+    const deadline = performance.now() + (deps.reachMs ?? NAMED_TEST_REACH_MS);
+    let last = "reach-failed";
+    while (!signal.aborted && performance.now() < deadline) {
+        const attempt = new AbortController();
+        const stop = () => attempt.abort();
+        signal.addEventListener("abort", stop, { once: true });
+        const timer = setTimeout(stop, Math.max(1, Math.min(5_000, deadline - performance.now())));
+        try {
+            const res = await within(fetchPage(url, attempt.signal), attempt.signal);
+            if (res.status === 200 && res.body.includes(expected))
+                return "ok";
+            last = res.status === 200 ? "other-page" : res.status === 404 ? "route-missing" : WRONG_SERVICE_STATUSES.has(res.status) ? "wrong-service" : "reach-failed";
+            // The open link's page may be served by another of the tunnel's connectors; any 200 there is its page.
+            if (live && res.status === 200)
+                return "other-page";
+        }
+        catch (err) {
+            if (err !== DEADLINE) {
+                const kind = classifyNamedTunnelProbeError(err, "");
+                last = kind === "named-route-missing" ? "route-missing" : kind === "named-connection-failed" ? "self-unreachable" : "reach-failed";
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", stop);
+        }
+        await new Promise(r => setTimeout(r, deps.retryMs ?? 1_000));
+    }
+    return last;
+}
+/**
+ * The production lane: the one tunnel lane's reservation, the connector started by its managed start (lease, proven
+ * stop) as a CloudflaredProvider that is ready once registered. `provider` is a test seam.
+ */
+export function namedTestLane(lane, opts = {}) {
+    return () => {
+        const id = `named-test-${randomBytes(6).toString("hex")}`;
+        const reservation = lane.reserve("named-test", id);
+        if (!reservation)
+            return { busy: lane.holder() === "dashboard" ? "link-open" : "other" };
+        return {
+            async start(i) {
+                const provider = (opts.provider ?? (o => new CloudflaredProvider(o)))({ binaryName: i.binary, protocol: i.protocol,
+                    named: { hostname: i.hostname, token: i.token }, registeredOnly: true, deadlineMs: opts.registerMs ?? NAMED_TEST_REGISTER_MS });
+                const result = await reservation.start(provider, { sid: id, origin: i.origin, pagePath: "/", readinessMarker: id,
+                    expiresAt: Date.now() + NAMED_TEST_HARD_MS, signal: i.signal });
+                return result.ok ? { ok: true } : { ok: false, kind: result.errorKind };
+            },
+            async stop() { return { confirmed: (await reservation.stop("named link test done")).confirmed }; },
+            releaseUnused() { reservation.releaseUnused(); },
+        };
+    };
+}
+//# sourceMappingURL=named-link-test.js.map

package/dist/tunnel/named-link-test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-link-test.js","sourceRoot":"","sources":["../../src/tunnel/named-link-test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAqD,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,EAAsB,MAAM,mBAAmB,CAAC;AAKvI,MAAM,CAAC,MAAM,gBAAgB,GAA6B,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AA0BzG,iHAAiH;AACjH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,wHAAwH;AACxH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AA+B5C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AACpC,uEAAuE;AACvE,MAAM,UAAU,GAAyC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AACvK,mGAAmG;AACnG,SAAS,MAAM,CAAI,CAAa,EAAE,MAAmB;IACnD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAC3E,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,YAAY,GAAG,CAAI,CAAa,EAAE,EAAU,EAAgC,EAAE,CAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAkB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAEpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAqB,EAAE,IAAuB,EAAE,KAAmB;IACxG,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,IAAI,GAAkB,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,IAAmB,EAAmB,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzJ,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC7G,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAK,OAAkB,IAAI,IAAI,IAAK,OAAkB,IAAI,KAAK,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;IACjI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,CAAC;IACf,MAAM,QAAQ,GAAwB,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAExH,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACpC,KAAK,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,0GAA0G;IAC1G,MAAM,IAAI,GAAG,GAAyB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3H,IAAI,MAAM,GAAkB,IAAI,EAAE,IAAI,GAAyB,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACrF,IAAI,MAAuB,CAAC;IAC5B,IAAI,IAAI,GAAkB,QAAQ,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,KAAK,IAA8B,EAAE;YACnD,sEAAsE;YACtE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpE,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC/C,IAAI,GAAG,KAAK,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC9D,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,IAAI,GAAG,OAAO,CAAC;gBACf,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,WAAW,QAAQ,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;gBACxG,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;YAAC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YACzG,IAAI,GAAG,IAAI,CAAC;YAEZ,6FAA6F;YAC7F,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,0DAA0D,KAAK,MAAM,CAAC;YACnF,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClM,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE;gBAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,KAAK,YAAY,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;gBACrJ,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YACpE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEf,oFAAoF;YACpF,IAAI,GAAG,QAAQ,CAAC;YAChB,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBAAC,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YACjE,OAAO,GAAG,EAAE,CAAC;gBAAC,IAAI,GAAG,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;gBAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAAC,CAAC;YACpF,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;YAAC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3D,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/I,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEf,0EAA0E;YAC1E,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,CAAC;YACZ,IAAI,GAAG,OAAO,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,WAAW,QAAQ,qBAAqB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,oBAAoB,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7J,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5F,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mHAAmH;QACnH,8GAA8G;QAC9G,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,6GAA6G;QAC7G,2FAA2F;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,qBAAqB,CAAC;QAC1D,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,GAAkB,IAAI,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC/F,WAAW,GAAG,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3D,CAAC;;gBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAW,MAAM,CAAC;YAC7B,MAAM,YAAY,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,WAAW;YAAE,MAAO,CAAC,OAAO,GAAG,aAAa,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6DAA6D;AAC7D,SAAS,UAAU,CAAC,IAAY,EAAE,MAAmB;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB,EAAE,OAAO,MAAM,CAAC;QACxC,KAAK,yBAAyB,CAAC;QAAC,KAAK,SAAS,EAAE,OAAO,SAAS,CAAC;QACjE,KAAK,WAAW,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,KAAK,YAAY,EAAE,OAAO,aAAa,CAAC;QACxC,KAAK,gBAAgB,CAAC;QAAC,KAAK,uBAAuB,EAAE,OAAO,WAAW,CAAC;QACxE,SAAS,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,wHAAwH;AACxH,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAuB;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxK,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC;IACvE,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACvF,OAAO,GAAG,EAAE,CAAC;QAAC,OAAQ,GAA6B,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IAAC,CAAC;AAC7G,CAAC;AAED,oHAAoH;AACpH,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,QAAgB,EAAE,IAAa,EAAE,IAAuB,EAAE,MAAmB;IACjH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAc,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxJ,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC;IAC3E,IAAI,IAAI,GAAkB,cAAc,CAAC;IACzC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnE,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;YAC5J,uGAAuG;YACvG,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,YAAY,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,6BAA6B,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpD,IAAI,GAAG,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC;YACrI,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB,EAAE,IAAI,GAAkF,EAAE;IAC7I,OAAO,GAAG,EAAE;QACV,MAAM,EAAE,GAAG,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACzF,OAAO;YACL,KAAK,CAAC,KAAK,CAAC,CAAC;gBACX,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBAChH,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,sBAAsB,EAAE,CAAC,CAAC;gBAClI,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;oBAC9G,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1E,CAAC;YACD,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAClG,aAAa,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;SACjD,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/tunnel/purpose-lane.d.ts

@@ -14,5 +14,7 @@ export declare class TunnelPurposeLane {
     private readonly manager;
     private owner;
     constructor(manager: Pick<ManagedTunnel, "start" | "stop">);
-    reserve(purpose: "login" | "dashboard", id: string): TunnelReservation | null;
+    /** #2906: who holds the lane now (the fixed address's Test connection says which), or null. */
+    holder(): string | null;
+    reserve(purpose: "login" | "dashboard" | "named-test", id: string): TunnelReservation | null;
 }

package/dist/tunnel/purpose-lane.js

@@ -6,6 +6,8 @@ export class TunnelPurposeLane {
     constructor(manager) {
         this.manager = manager;
     }
+    /** #2906: who holds the lane now (the fixed address's Test connection says which), or null. */
+    holder() { return this.owner?.purpose ?? null; }
     reserve(purpose, id) {
         if (this.owner)
             return this.owner.purpose === purpose && this.owner.id === id ? this.owner.reservation : null;

package/dist/tunnel/purpose-lane.js.map

@@ -1 +1 @@
-{"version":3,"file":"purpose-lane.js","sourceRoot":"","sources":["../../src/tunnel/purpose-lane.ts"],"names":[],"mappings":"AAYA,MAAM,QAAQ,GAAG,GAAqB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAClH,kGAAkG;AAClG,MAAM,OAAO,iBAAiB;IAEC,OAAO;IAD5B,KAAK,GAA2E,IAAI,CAAC;IAC7F,YAA6B,OAA8C;uBAA9C,OAAO;IAA0C,CAAC;IAC/E,OAAO,CAAC,OAA8B,EAAE,EAAU;QAChD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,QAAiD,CAAC;QACtD,IAAI,QAA+C,CAAC;QACpD,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,WAAW,GAAsB;YACrC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC3B,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBACzG,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9B,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;wBAAE,OAAO,GAAG,IAAI,CAAC;oBACpD,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;gBAC3B,4GAA4G;gBAC5G,6CAA6C;gBAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACjD,OAAO,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;oBAC9B,MAAM,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;oBAChE,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YACD,aAAa,EAAE,OAAO;SACvB,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QAC1C,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"purpose-lane.js","sourceRoot":"","sources":["../../src/tunnel/purpose-lane.ts"],"names":[],"mappings":"AAYA,MAAM,QAAQ,GAAG,GAAqB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAClH,kGAAkG;AAClG,MAAM,OAAO,iBAAiB;IAEC,OAAO;IAD5B,KAAK,GAA2E,IAAI,CAAC;IAC7F,YAA6B,OAA8C;uBAA9C,OAAO;IAA0C,CAAC;IAC/E,+FAA+F;IAC/F,MAAM,KAAoB,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,OAA6C,EAAE,EAAU;QAC/D,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,QAAiD,CAAC;QACtD,IAAI,QAA+C,CAAC;QACpD,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,WAAW,GAAsB;YACrC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC3B,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBACzG,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9B,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;wBAAE,OAAO,GAAG,IAAI,CAAC;oBACpD,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;gBAC3B,4GAA4G;gBAC5G,6CAA6C;gBAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACjD,OAAO,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;oBAC9B,MAAM,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;oBAChE,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YACD,aAAa,EAAE,OAAO;SACvB,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QAC1C,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/types.d.ts

@@ -434,6 +434,11 @@ export interface WebConfig {
         enabled?: boolean;
         max_hours?: number;
     };
+    /** #2911: page share links — one agent page, read-only, for a limited time, on the Office share's tunnel (default on; 24 h at most). */
+    page_share?: {
+        enabled?: boolean;
+        max_hours?: number;
+    };
     /** Expose provider API-key verify/apply endpoints (default false until dark-shipped). */
     provider_secrets?: boolean;
     /**
@@ -484,6 +489,11 @@ export interface WebConfig {
      * instead of it; web.preview: false turns previews off everywhere.
      */
     preview_on_public_link?: boolean;
+    /**
+     * #2911 (7): previews may load libraries from cdnjs (/ajax/libs/) and jsDelivr (/npm/) — scripts, styles and fonts
+     * only (connect-src stays 'none'). Default false. Those requests leave this machine.
+     */
+    preview_cdn?: boolean;
     /**
      * #1629: agents' own web themes and effects. `agent_edit` (default true): false refuses every agent appearance write,
      * fleet-wide; what is stored stays, and people can still reset and lock.

package/dist/ui/chat-store.js

@@ -456,6 +456,13 @@ export function createChatStore(deps) {
   const isPasted = (f) => pastedTexts.has(f);
   /** Typing stays local. */
   function setDraft(target, value) { s.drafts[target] = value; }
+  /** #2911: a line added to the composer for the person to edit (after what is typed, on its own line; never twice). */
+  function addToDraft(target, line) {
+    const d = s.drafts[target] || "";
+    if (!target || !line || d.split("\n").includes(line)) return;
+    s.drafts[target] = d ? `${d.replace(/\n+$/, "")}\n${line}` : line;
+    changed(target);
+  }
   /**
    * #2272: reply to a message of this chat — what the bar above the composer shows (its sender and first words); only
    * its row is sent. One at a time per chat: a new one replaces it.
@@ -575,7 +582,7 @@ export function createChatStore(deps) {
     onPrompt, applyPrompts, resolvePrompt, answerPrompt, answerByNonce, holdPrompt, releasePrompt, promptsFor,
     applyReplyButtons, clickReplyButton,
     uploadFile, send, retryOutgoing, deleteOutgoing, putBackOutgoing, threadRows, addFiles, removeFile, attachPastedText, fileBackAsText, isPasted, setDraft,
-    startReply, clearReply, findQuoted,
+    startReply, clearReply, findQuoted, addToDraft,
     cancelReply, isUser, runCommand, dismissCommand, commandFree,
     allHidden: (name) => s.allHidden.has(name),
   };

package/dist/ui/chat-strings.js

@@ -56,6 +56,25 @@ register("chat", {
     pvOpenPanel: "Open in panel", pvInPanel: "Shown in the panel.", pvPanel: "HTML preview", pvSource: "From {0}, {1} — show the message",
     pvPage: "Page", pvCode: "Code", pvReload: "Reload", pvClose: "Close the panel", pvBack: "Back to the chat", pvResize: "Resize the preview panel",
     pvNewer: "A newer version is in the reply from {0}.", pvNewerShow: "Show it", pvPanelIdle: "Click Preview to run it here.",
+    // #2911 (M-2216): the panel's versions and their changes.
+    pvVersions: "Versions", pvVer: "v{0}/{1}", pvVerLong: "Version {0} of {1}", pvVerPrev: "Previous version", pvVerNext: "Next version",
+    pvChanges: "Changes", pvChangesFrom: "Changes from v{0}", pvChangesNone: "No changes from v{0}.",
+    pvPagesCount: "Pages ({0})", pvPagesTitle: "Every page in this conversation", pvPagesUntitled: "Untitled page", pvPagesVersions: "{0} versions",
+    pvWidth: "Width the page is shown at", pvWidthFull: "Full width", pvWidthTablet: "Tablet · 768", pvWidthPhone: "Phone · 390",
+    pvFs: "Full screen", pvFsExit: "Leave full screen (Esc)",
+    pvChangesBig: "These versions are too large or too different to compare here. Download both to compare them.", pvChangesCut: "showing the first {0} lines",
+    // #2911 (M-2217): the preview's feedback actions.
+    pvFbReply: "Reply about this page", pvFbReplyTitle: "Reply to the message this page came in, naming the page — you write what to change",
+    pvFbAboutNamed: "About the page “{0}”: ", pvFbAboutThis: "About this page: ",
+    pvFbErrOne: "error", pvFbErrMany: "errors", pvFbErrTitle: "The page reported errors: put them in the message box, quoted, for you to check and send. Their text is the page's",
+    pvFbErrHeadOne: "The preview reported 1 error (text from the page):", pvFbErrHead: "The preview reported {0} errors (text from the page):",
+    pvFbErrRejection: "Unhandled rejection: ", pvFbErrAt: "line {0}:{1}", pvFbErrMore: "…and {0} more.",
+    // #2911 (7, M-2216): CDN libraries in previews.
+    pvCdnBlocked: "Blocked by the preview: ",
+    pvCdnNote: "This page loads a library from {0}, which previews block unless Settings → Web dashboard → “HTML previews may load libraries from cdnjs / jsDelivr” is on.",
+    pvFbPick: "Point at it", pvFbPickTitle: "Click an element in the page to say what to change about it",
+    pvFbPickCancel: "Cancel pointing", pvFbPickCancelTitle: "Stop pointing — the page takes clicks again",
+    pvFbPickWords: "On `{0}` (“{1}”, text from the page): ", pvFbPickAt: "On `{0}` (from the page): ",
     lbLabel: "Image: {0}", lbLabelNoName: "Image", lbClose: "Close", lbOpenOriginal: "Open original", lbPrev: "Previous image", lbNext: "Next image", lbCount: "{0} / {1}",
     // #2333: zoom in the lightbox.
     lbZoomIn: "Zoom in (+)", lbZoomOut: "Zoom out (−)", lbZoomLevel: "{0}% — click for fit or actual size (0 / 1)", lbFitWidth: "Fit width (W)",
@@ -180,6 +199,23 @@ register("chat", {
     pvOpenPanel: "在面板中開啟", pvInPanel: "已在面板中顯示。", pvPanel: "HTML 預覽", pvSource: "來自 {0}，{1}——顯示該訊息",
     pvPage: "頁面", pvCode: "程式碼", pvReload: "重新載入", pvClose: "關閉面板", pvBack: "回到對話", pvResize: "調整預覽面板寬度",
     pvNewer: "{0} 的回覆裡有較新的版本。", pvNewerShow: "顯示", pvPanelIdle: "按「預覽」在這裡執行。",
+    pvVersions: "版本", pvVer: "v{0}/{1}", pvVerLong: "第 {0} 版，共 {1} 版", pvVerPrev: "上一版", pvVerNext: "下一版",
+    pvChanges: "變更", pvChangesFrom: "與第 {0} 版相比的變更", pvChangesNone: "與第 {0} 版相比沒有變更。",
+    pvPagesCount: "頁面（{0}）", pvPagesTitle: "這段對話中的所有頁面", pvPagesUntitled: "未命名頁面", pvPagesVersions: "{0} 個版本",
+    pvWidth: "頁面顯示寬度", pvWidthFull: "完整寬度", pvWidthTablet: "平板 · 768", pvWidthPhone: "手機 · 390",
+    pvFs: "全螢幕", pvFsExit: "離開全螢幕（Esc）",
+    pvChangesBig: "這兩版太大或差異太多，無法在這裡比較。請下載兩版後再比較。", pvChangesCut: "只顯示前 {0} 行",
+    // #2911 (M-2217): 預覽的回饋動作。
+    pvFbReply: "回覆這個頁面", pvFbReplyTitle: "回覆這個頁面所在的訊息並註明頁面——要改什麼由你來寫",
+    pvFbAboutNamed: "關於頁面「{0}」：", pvFbAboutThis: "關於這個頁面：",
+    pvFbErrOne: "個錯誤", pvFbErrMany: "個錯誤", pvFbErrTitle: "頁面回報了錯誤：以引用的方式放進輸入框，由你確認後送出。錯誤文字來自頁面本身",
+    pvFbErrHeadOne: "預覽回報了 1 個錯誤（文字來自頁面）：", pvFbErrHead: "預覽回報了 {0} 個錯誤（文字來自頁面）：",
+    pvFbErrRejection: "未處理的 rejection：", pvFbErrAt: "第 {0} 行第 {1} 欄", pvFbErrMore: "……還有 {0} 個。",
+    pvCdnBlocked: "被預覽封鎖：",
+    pvCdnNote: "這個頁面要從 {0} 載入函式庫，但預覽會封鎖它，除非開啟 設定 → 網頁儀表板 中的「HTML 預覽可從 cdnjs / jsDelivr 載入函式庫」。",
+    pvFbPick: "指出位置", pvFbPickTitle: "在頁面上點一個元素，說明要怎麼改",
+    pvFbPickCancel: "取消指出", pvFbPickCancelTitle: "停止指出——頁面恢復接收點擊",
+    pvFbPickWords: "在 `{0}`（「{1}」，文字來自頁面）：", pvFbPickAt: "在 `{0}`（來自頁面）：",
     lbLabel: "圖片：{0}", lbLabelNoName: "圖片", lbClose: "關閉", lbOpenOriginal: "開啟原圖", lbPrev: "上一張", lbNext: "下一張", lbCount: "{0} / {1}",
     lbZoomIn: "放大（+）", lbZoomOut: "縮小（−）", lbZoomLevel: "{0}%：點一下切換「符合視窗」與「實際大小」（0 / 1）", lbFitWidth: "符合寬度（W）",
     pvWhyOptin: "還沒允許 HTML 預覽。可從這張卡片的 ⋯ 選單或「設定 → 偏好設定」允許。",