@vincentt-xr/cli 0.1.4 → 0.2.0

package/dist/preview/runner.js

@@ -1,50 +1,63 @@
-// The whole preview stack behind one call. Stands up, in order: the app dev serve
-// (on an internal port), the harness relay (WS event sink + localhost /query), a
-// front proxy unifying them on one origin (`/__harness` → relay, else → app), and
-// a cloudflared tunnel to that origin so a phone gets ONE https URL that serves
-// both the app (secure context → live camera) and the diagnostics socket.
+// The whole preview stack behind one call. Stands up, in order: the app dev
+// serve (on an internal port), the harness relay (WS event sink + localhost
+// /query), a front proxy unifying them on one origin (`/__harness` → relay,
+// else → app), and the EDGE TUNNEL CLIENT dialing wss://…/tunnel — so a phone
+// gets ONE https URL that serves both the app (secure context → live camera)
+// and the diagnostics socket.
+//
+// The tunnel is the platform's own edge (D-Self-hosted-edge). The Cloudflare
+// named-tunnel implementation this replaced put a third party in the middle of
+// the creator's console output, which a feature whose central promise is "we
+// relay and retain nothing" cannot do and remain honest.
 //
 // Returns the public URL plus a `stop()` that reaps everything. A failure at any
 // step tears down what was already started, so the caller never leaks a child
-// process or a live backend tunnel. Used by both the CLI (`npm run preview`) and
-// the MCP verbs (preview_start / preview_stop).
+// process or a live session.
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
+import { TunnelClient, resolveForwardTarget, } from "@vincentt-xr/harness/tunnel";
 import { startRelay } from "../relay/server.js";
-import { ensureCloudflared } from "./cloudflared.js";
-import { startSessionTunnel } from "./tunnel.js";
 import { proxyWeb, proxyWs } from "./proxy.js";
 import { getFreePort, isPortListening, waitForApp } from "./net.js";
+import { endPreviewSession, heartbeatPreviewSession, mintPreviewSession, workingTreeKey, PreviewEndedError, } from "./api.js";
+import { ProjectUnreachableError } from "../lib/backend.js";
 export async function startPreview(opts) {
-    const { projectCwd, harnessPath = "/__harness", devCommand = ["npm", "run", "dev"], appStdio = "ignore", registerTimeoutMs = 90_000, appReadyTimeoutMs = 8_000, onLog = () => undefined, } = opts;
-    // Resolve ports. The app port defaults to 5173; the relay + front ports are
-    // harness-internal, so auto-pick free ones (the relay port is returned for the
-    // MCP diag_* tools to point at) instead of colliding on fixed defaults.
+    const { projectCwd, config, projectId, harnessPath = "/__harness", devCommand = ["npm", "run", "dev"], appStdio = "ignore", appReadyTimeoutMs = 8_000, onLog = () => undefined, fetchImpl = fetch, } = opts;
     const appPort = opts.appPort ?? 5173;
     const relayPort = opts.relayPort ?? (await getFreePort());
     const frontPort = opts.frontPort ?? (await getFreePort());
-    // If a dev server is already up on appPort, reuse it — don't spawn a second one
-    // that would fail to bind and leave the tunnel serving a broken origin.
     const reuseApp = await isPortListening(appPort);
-    // Track every resource so any failure below can unwind exactly what started.
     let app;
     let relay;
     let front;
-    let session;
     let tunnel;
+    let heartbeat;
+    let minted;
+    let stopped = false;
     const stop = async () => {
-        tunnel?.kill();
+        if (stopped)
+            return;
+        stopped = true;
+        if (heartbeat !== undefined)
+            clearInterval(heartbeat);
+        tunnel?.close();
         app?.kill();
         front?.close();
         if (relay)
             await relay.close();
-        if (session)
-            await session.reap();
+        // Ending the session is what makes the LINK stop working, so it is not
+        // best-effort in intent even though it is in effect: the 12-hour ceiling
+        // and the edge's 60-second fail-closed deadline both reap a session whose
+        // DELETE never landed.
+        if (minted)
+            await endPreviewSession(config, minted.sessionId, fetchImpl);
     };
     try {
-        // Resolve cloudflared up front so a fresh host provisions it before we mint a
-        // tunnel we couldn't otherwise run.
-        const cloudflaredBin = await ensureCloudflared({ onLog });
+        // The MINT comes first. Everything below it costs the creator a dev-server
+        // start and a port; if the mint is going to fail — rate limit, revoked
+        // membership, no binding — it should fail before any of that happens.
+        const key = await workingTreeKey(projectCwd);
+        minted = await mintPreviewSession(config, projectId, key, fetchImpl);
         if (reuseApp) {
             onLog(`reusing the dev server already on :${appPort}`);
         }
@@ -62,22 +75,82 @@ export async function startPreview(opts) {
             path: harnessPath,
             projectDir: projectCwd,
             onLog: (m) => onLog(`[relay] ${m}`),
+            onEvents: opts.onEvents,
+            onCapReached: opts.onCapReached,
+        });
+        front = createServer((req, res) => {
+            const toRelay = req.url?.startsWith(harnessPath) === true;
+            // Recovery is signalled by normal output resuming, so the re-arm has to
+            // happen on a SUCCESSFUL response rather than on a timer. A relay request
+            // is not the creator's app and must not clear an app failure.
+            if (!toRelay) {
+                res.on("finish", () => {
+                    if (res.statusCode < 500)
+                        opts.onOriginRecovered?.();
+                });
+            }
+            proxyWeb(req, res, toRelay ? relayPort : appPort, () => opts.onOriginError?.("", "origin_unreachable"));
         });
-        front = createServer((req, res) => proxyWeb(req, res, req.url?.startsWith(harnessPath) ? relayPort : appPort));
         front.on("upgrade", (req, socket, head) => proxyWs(req, socket, head, req.url?.startsWith(harnessPath) ? relayPort : appPort));
         await new Promise((resolve) => front.listen(frontPort, resolve));
-        session = await startSessionTunnel(projectCwd, frontPort);
-        tunnel = spawn(cloudflaredBin, ["tunnel", "run", "--token", session.runToken], {
-            stdio: ["ignore", "pipe", "pipe"],
+        // ONE configured target, captured HERE from the creator's own config and
+        // never from a request (2.15.4 rule 1). The loopback assertion runs at
+        // start and is re-checked at every connect.
+        const target = await resolveForwardTarget("127.0.0.1", frontPort);
+        tunnel = new TunnelClient({
+            edgeUrl: minted.edgeUrl,
+            grant: minted.grant,
+            // The reconnect dial carries the session id as its own header, because
+            // that path carries NO GRANT and the grant's signed `sid` claim is what
+            // used to name the row (D-The-reconnect-path-carries-no-grant).
+            sessionId: minted.sessionId,
+            target,
+            onViewer: opts.onViewer,
+            onViewerGone: opts.onViewerGone,
+            onControl: (kind) => {
+                const reason = controlToReason(kind);
+                if (reason === null) {
+                    opts.onExpiring?.();
+                    return;
+                }
+                opts.onEnded?.(reason);
+            },
+            onOriginError: opts.onOriginError,
+            onStateChange: opts.onTunnelState,
+            onTunnelError: (code) => opts.onLog?.(`tunnel dial failed: ${code}`),
+            // A REFUSED reconnect is an ending, not noise to retry through. Each
+            // status is a different creator action, so they are not collapsed.
+            onReconnectRefused: (status) => {
+                const reason = refusalToReason(status);
+                if (reason !== null)
+                    opts.onEnded?.(reason);
+            },
         });
-        await waitForRegister(tunnel, registerTimeoutMs, (line) => onLog(`[cloudflared] ${line}`));
-        // Don't hand back a live URL that serves a blank page: wait for the app to
-        // actually respond. Non-fatal — a slow build still returns, flagged not-ready.
+        tunnel.start();
+        // The heartbeat is keepalive AND re-authorization: every beat re-runs
+        // RequireMembership on the API side, so a project transferred out from
+        // under a live preview, or a member removed from the org, ends it on the
+        // next beat rather than at the 12-hour ceiling.
+        heartbeat = setInterval(() => {
+            void runHeartbeat(config, minted.sessionId, fetchImpl, opts.onEnded);
+        }, minted.heartbeatSec * 1000);
+        // Node must not be held alive by the heartbeat alone — the tunnel and the
+        // relay are what keep the process up, and a stray interval would outlive a
+        // teardown that failed to clear it.
+        heartbeat.unref?.();
         const appReady = reuseApp ? true : await waitForApp(appPort, appReadyTimeoutMs);
         if (!appReady) {
             onLog(`app on :${appPort} isn't responding yet — the URL may be blank until it builds`);
         }
-        return { url: session.url, relayPort, appPort, tunnelPid: tunnel.pid, appReady, stop };
+        return {
+            url: minted.url,
+            sessionId: minted.sessionId,
+            expiresAt: minted.expiresAt,
+            relayPort,
+            appPort,
+            appReady,
+            stop,
+        };
     }
     catch (err) {
         await stop();
@@ -85,42 +158,120 @@ export async function startPreview(opts) {
     }
 }
 /**
- * Resolve once cloudflared reports a live edge connection, reject if it exits
- * first or never registers. On failure the rejection carries cloudflared's own
- * recent output — otherwise "did not register" hides the real cause (an invalid
- * run token, or a network that blocks the QUIC edge, the two common culprits).
- * `onLine` streams each log line out live. Exported for unit testing.
+ * Two of the three CONTROL kinds are endings. `expiring` is NOT: it is the
+ * hard-max warning, and it arrives on the same channel. Mapping it to an ending
+ * would take away a link that has half an hour left, at exactly the moment the
+ * creator is being warned to plan around it — so it returns null and the caller
+ * renders the warning instead.
  */
-export function waitForRegister(tunnel, timeoutMs, onLine) {
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const recent = [];
-        const finish = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            fn();
-        };
-        const tail = () => {
-            const lines = recent.slice(-15).join("\n").trim();
-            return lines ? `\ncloudflared output:\n${lines}` : "";
-        };
-        const scan = (buf) => {
-            const text = String(buf);
-            for (const line of text.split(/\r?\n/)) {
-                if (!line.trim())
-                    continue;
-                recent.push(line);
-                onLine?.(line);
-            }
-            if (/Registered tunnel connection|Connection [^ ]+ registered/.test(text)) {
-                finish(resolve);
-            }
-        };
-        tunnel.stdout?.on("data", scan);
-        tunnel.stderr?.on("data", scan);
-        tunnel.on("exit", (code) => finish(() => reject(new Error(`cloudflared exited before registering (code ${code}).${tail()}`))));
-        const timer = setTimeout(() => finish(() => reject(new Error(`cloudflared did not register within ${timeoutMs}ms.${tail()}`))), timeoutMs);
-    });
+export function controlToReason(kind) {
+    if (kind === "superseded")
+        return "superseded";
+    if (kind === "revoke")
+        return "authz_revoked";
+    return null;
+}
+/**
+ * A refused RECONNECT dial → the ending screen it means.
+ *
+ * The edge answers a reattach with three distinguishable statuses and they are
+ * deliberately not collapsed (`ingress.go:299-310`): the consume is what
+ * separates them, and collapsing would cost the CLI its ability to say "another
+ * tunnel holds this preview" versus "your preview ended" — different creator
+ * actions, and the debugging creator is the common case.
+ *
+ * A 409 is the grace cap being spent, which is the one ending that explains the
+ * bound. A 401 (the token was refused) and a 410 (the session is gone) both mean
+ * the link is not coming back, and `grace_exhausted` is that screen.
+ *
+ * Anything else — 502, 503, a transient edge fault — returns null and keeps the
+ * backoff. Ending a preview over a momentarily unavailable edge would take away
+ * a link that is about to work again.
+ */
+export function refusalToReason(status) {
+    if (status === 409)
+        return "grace_cap";
+    if (status === 401 || status === 410)
+        return "grace_exhausted";
+    return null;
+}
+/**
+ * One heartbeat. A 410 is the session ending on the server's terms; a 404/403
+ * is authorization lost. They are DELIBERATELY NOT MERGED, because the remedies
+ * differ: one is "find out who you are", the other is "try again".
+ *
+ * A transport failure is neither — the API being briefly unreachable must not
+ * end a healthy preview, because the edge already fails closed on its own
+ * 60-second deadline and will drain if the outage is real.
+ *
+ * THE 410 IS NOT REPORTED AS `hard_max`. It previously was, unconditionally, and
+ * that is a FALSE STATEMENT about the product's own behaviour for every terminal
+ * cause that is not the ceiling: a session flipped `abandoned` at minute 30, or
+ * superseded, or stopped elsewhere, all answer 410, and the hard-max screen is a
+ * `✓` telling the creator the preview did exactly what it promised over 12 hours.
+ *
+ * The API's 410 body carries ONE opaque code (`preview_session_ended`) for every
+ * terminal reason — verified against the running stack: an `abandoned` row and an
+ * `expired` row return byte-identical bodies — so the CLI CANNOT tell them apart
+ * and must not guess. `session_ended` is the honest, cause-free rendering until
+ * the wire carries the discriminator. See the note on PreviewEndedError.
+ */
+export async function runHeartbeat(config, sessionId, fetchImpl, onEnded) {
+    try {
+        await heartbeatPreviewSession(config, sessionId, fetchImpl);
+    }
+    catch (err) {
+        if (err instanceof ProjectUnreachableError) {
+            onEnded?.("authz_revoked");
+            return;
+        }
+        if (err instanceof PreviewEndedError) {
+            onEnded?.(endReasonToPreviewEnd(err.endReason));
+            return;
+        }
+        // A network blip. See above.
+    }
+}
+/**
+ * The API's `endReason` → the CLI's ending screen.
+ *
+ * `hard_max` is returned ONLY for an explicit `expired`. An UNLABELLED 410 —
+ * which is every 410 the API sends today — maps to `grace_exhausted`, the one
+ * ending whose copy states only what is actually known: the preview has ended
+ * and the link no longer works. It asserts no cause.
+ *
+ * That default is the conservative choice and it is deliberate. `hard_max` is a
+ * `✓` claiming the preview ran its full 12 hours; rendering it for a session the
+ * platform reaped at minute 30 tells the creator something untrue about their own
+ * session. `grace_exhausted` is a `✗` that says the link is gone and gives the
+ * next command, which is true of EVERY terminal cause. Under-claiming a cause
+ * costs the creator one sentence of diagnosis; over-claiming one states a fact
+ * only the product can see, and states it wrong.
+ *
+ * EVERY endReason the domain defines must have a case here. The `default` is for
+ * a reason a NEWER api invented, not for one this client forgot: a fall-through
+ * renders "your network dropped" for a cause that may be nothing of the kind.
+ * That is not hypothetical — `stopped` and `disconnected` fell through for a
+ * build, so a creator who stopped their own preview from another terminal was
+ * told their connection failed. The set is enumerated from the domain by
+ * QA-F3-C9(f), which fails when a new member is added rather than mapping it
+ * silently to a wrong screen.
+ */
+export function endReasonToPreviewEnd(reason) {
+    switch (reason) {
+        case "abandoned":
+            return "abandoned";
+        case "expired":
+            return "hard_max";
+        case "superseded":
+            return "superseded";
+        case "revoked":
+            return "authz_revoked";
+        case "stopped":
+            return "stopped_elsewhere";
+        case "disconnected":
+            return "disconnected";
+        default:
+            return "grace_exhausted";
+    }
 }

package/dist/preview/stream.d.ts

@@ -0,0 +1,52 @@
+import type { DiagEvent, LogEvent, NetworkEvent, TraceEvent } from "@vincentt-xr/harness/events";
+import type { UAClass } from "@vincentt-xr/harness/tunnel";
+/** One line per viewer per 5s on the terminal. The agent's pull is unthrottled. */
+export declare const PERF_THROTTLE_MS = 5000;
+export declare function uaLabel(c: UAClass): string;
+export declare function uaShort(c: UAClass): string;
+/**
+ * Color carries meaning, never identity: a stream where four labels are four
+ * colors is a stream where nothing stands out, and it degrades to unreadable in
+ * a piped log — which is where an agent reads it. Output must be fully readable
+ * with color stripped, so every colorizer here is a pure wrapper the caller can
+ * disable wholesale.
+ */
+export interface Palette {
+    red(s: string): string;
+    yellow(s: string): string;
+    dim(s: string): string;
+}
+export declare function palette(color: boolean): Palette;
+export declare function formatBytes(n: number): string;
+export declare function formatDuration(ms: number): string;
+/**
+ * The record draws `200   1.2 MB   1.9s`. The event type carries no byte count,
+ * so the caller supplies one when it has it and the column stays blank rather
+ * than showing a zero that would read as an empty response.
+ */
+export declare function renderNetworkWithSize(label: string, e: NetworkEvent, bytes: number | undefined, p: Palette): string;
+/**
+ * displayPath keeps the path and drops the origin. The origin is the preview's
+ * own capability URL on every same-origin request, and printing it on every line
+ * would put the capability in the creator's scrollback dozens of times a minute
+ * — the same reason 2.18 sets Referrer-Policy: no-referrer.
+ */
+export declare function displayPath(url: string): string;
+export declare function renderLog(label: string, e: LogEvent, p: Palette): string;
+export declare function renderTrace(label: string, e: TraceEvent): string;
+/** The dispatcher. Returns null for an event kind the terminal does not print. */
+export declare function renderEvent(label: string, e: DiagEvent, p: Palette): string | null;
+/**
+ * A 60 Hz sampler printed raw would bury logs and network under the one signal a
+ * creator is least often looking for. This is a per-VIEWER gate, not a global
+ * one: four phones each get their own line every 5s, because suppressing the
+ * fourth phone's perf because the first phone just reported would hide the exact
+ * comparison the creator opened four phones to make.
+ */
+export declare class PerfThrottle {
+    private readonly windowMs;
+    private readonly last;
+    constructor(windowMs?: number);
+    allow(label: string, now: number): boolean;
+    forget(label: string): void;
+}

package/dist/preview/stream.js

@@ -0,0 +1,171 @@
+// The live stream's rendering (Flow L15). Pure string functions, no I/O — the
+// terminal is written by the runner, so every line's shape is unit-testable.
+//
+// The design target is not "read four devices", it is "notice the one that is
+// wrong". Every rule below serves that:
+//   1. the label is column one, always, fixed width — the eye scans one column
+//      to separate devices, and the shape does NOT change when a second phone
+//      arrives;
+//   2. status, size and duration right-align in fixed columns, so a slow asset
+//      is found by SHAPE rather than by reading;
+//   3. color carries exactly three things and nothing else;
+//   4. perf is throttled to one line per viewer per 5s.
+/** One line per viewer per 5s on the terminal. The agent's pull is unthrottled. */
+export const PERF_THROTTLE_MS = 5_000;
+/** The colored duration threshold (rule 3). */
+const SLOW_MS = 3_000;
+/** Column one. `[viewer-1]  ` — wide enough for `viewer-9999`. */
+const LABEL_COL = 14;
+const STATUS_COL = 5;
+const SIZE_COL = 9;
+const DURATION_COL = 8;
+/** The path column, before the right-aligned trio. */
+const PATH_COL = 40;
+/**
+ * The closed enum's six values map to exactly six strings and there is NO
+ * SEVENTH. `unknown` renders as the empty string and the caller OMITS the
+ * descriptor entirely — a device we cannot classify gets no descriptor rather
+ * than the word "unknown", which would read as a fault.
+ */
+const UA_LABELS = {
+    ios_safari: "iPhone · Safari",
+    android_chrome: "Android · Chrome",
+    desktop_chrome: "Desktop · Chrome",
+    desktop_safari: "Desktop · Safari",
+    desktop_firefox: "Desktop · Firefox",
+    unknown: "",
+};
+/** The short form used in the roster, where the browser is redundant. */
+const UA_SHORT = {
+    ios_safari: "iPhone",
+    android_chrome: "Android",
+    desktop_chrome: "Desktop",
+    desktop_safari: "Desktop",
+    desktop_firefox: "Desktop",
+    unknown: "",
+};
+export function uaLabel(c) {
+    return UA_LABELS[c] ?? "";
+}
+export function uaShort(c) {
+    return UA_SHORT[c] ?? "";
+}
+const ANSI = {
+    red: (s) => `${s}`,
+    yellow: (s) => `${s}`,
+    dim: (s) => `${s}`,
+};
+const PLAIN = { red: (s) => s, yellow: (s) => s, dim: (s) => s };
+export function palette(color) {
+    return color ? ANSI : PLAIN;
+}
+// ---- formatting primitives --------------------------------------------------
+export function formatBytes(n) {
+    if (!Number.isFinite(n) || n < 0)
+        return "";
+    if (n < 1024)
+        return `${n} B`;
+    if (n < 1024 * 1024)
+        return `${(n / 1024).toFixed(0)} KB`;
+    return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+export function formatDuration(ms) {
+    if (!Number.isFinite(ms) || ms < 0)
+        return "";
+    return ms < 1000 ? `${Math.round(ms)}ms` : `${(ms / 1000).toFixed(1)}s`;
+}
+function padEnd(s, n) {
+    return s.length >= n ? s : s + " ".repeat(n - s.length);
+}
+function padStart(s, n) {
+    return s.length >= n ? s : " ".repeat(n - s.length) + s;
+}
+/**
+ * The label is column one, ALWAYS — including when `--viewer` has filtered the
+ * stream to one device. Dropping it there would produce a transcript that is
+ * ambiguous the moment it is pasted into an agent's context, and pasting is the
+ * whole point.
+ */
+function labelCol(label) {
+    return padEnd(`[${label}]`, LABEL_COL);
+}
+// ---- the three line kinds ---------------------------------------------------
+/**
+ * The record draws `200   1.2 MB   1.9s`. The event type carries no byte count,
+ * so the caller supplies one when it has it and the column stays blank rather
+ * than showing a zero that would read as an empty response.
+ */
+export function renderNetworkWithSize(label, e, bytes, p) {
+    const status = e.status === 0 ? "ERR" : String(e.status);
+    const statusCol = e.status === 0 || e.status >= 400
+        ? p.red(padStart(status, STATUS_COL))
+        : padStart(status, STATUS_COL);
+    const duration = formatDuration(e.durationMs);
+    const durationCol = e.durationMs >= SLOW_MS
+        ? p.red(padStart(duration, DURATION_COL))
+        : padStart(duration, DURATION_COL);
+    return (labelCol(label) +
+        padEnd(`${e.method} ${displayPath(e.url)}`, PATH_COL) +
+        statusCol +
+        padStart(bytes === undefined ? "" : formatBytes(bytes), SIZE_COL) +
+        durationCol);
+}
+/**
+ * displayPath keeps the path and drops the origin. The origin is the preview's
+ * own capability URL on every same-origin request, and printing it on every line
+ * would put the capability in the creator's scrollback dozens of times a minute
+ * — the same reason 2.18 sets Referrer-Policy: no-referrer.
+ */
+export function displayPath(url) {
+    try {
+        const u = new URL(url);
+        return u.pathname + u.search;
+    }
+    catch {
+        return url;
+    }
+}
+export function renderLog(label, e, p) {
+    const level = padEnd(e.level, STATUS_COL);
+    const colored = e.level === "error" ? p.red(level) : e.level === "warn" ? p.yellow(level) : level;
+    return `${labelCol(label)}${colored} ${e.message}`;
+}
+export function renderTrace(label, e) {
+    const fps = e.fps.toFixed(0);
+    return `${labelCol(label)}${padEnd("perf", STATUS_COL)} ${fps} fps · ${e.longTaskCount} long tasks · ${e.longestTaskMs}ms peak`;
+}
+/** The dispatcher. Returns null for an event kind the terminal does not print. */
+export function renderEvent(label, e, p) {
+    if (e.kind === "network")
+        return renderNetworkWithSize(label, e, undefined, p);
+    if (e.kind === "log")
+        return renderLog(label, e, p);
+    if (e.kind === "trace")
+        return renderTrace(label, e);
+    return null;
+}
+// ---- perf throttling --------------------------------------------------------
+/**
+ * A 60 Hz sampler printed raw would bury logs and network under the one signal a
+ * creator is least often looking for. This is a per-VIEWER gate, not a global
+ * one: four phones each get their own line every 5s, because suppressing the
+ * fourth phone's perf because the first phone just reported would hide the exact
+ * comparison the creator opened four phones to make.
+ */
+export class PerfThrottle {
+    windowMs;
+    last = new Map();
+    constructor(windowMs = PERF_THROTTLE_MS) {
+        this.windowMs = windowMs;
+    }
+    allow(label, now) {
+        const prev = this.last.get(label);
+        if (prev !== undefined && now - prev < this.windowMs)
+            return false;
+        this.last.set(label, now);
+        return true;
+    }
+    forget(label) {
+        this.last.delete(label);
+    }
+}