bavitutor 0.3.1 → 0.3.2

package/README.md

@@ -83,12 +83,38 @@ vpx /path/to/bavitutor --no-open        # vpx takes the same specs and flags
 | `--host <host>`    | `127.0.0.1`        | interface to listen on (this machine only) |
 | `--data-dir <dir>` | `~/.bavitutor`     | database, plus settings in `<dir>/.env`    |
 | `--no-open`        |                    | don't open the browser                     |
+| `--tailscale`      |                    | also share it on your tailnet (see below)  |
 
 On start the CLI checks for a Claude login or `ANTHROPIC_API_KEY`, looks for
 Chrome (`BAVI_CHROME`, then the standard Windows, macOS and Linux locations)
 and warns if either is missing, and stops with a clear message if the port is
 taken.
 
+### Open it on your other devices
+
+```sh
+npx bavitutor --tailscale
+```
+
+With `--tailscale`, BaviTutor also shares itself on your
+[Tailscale](https://tailscale.com) tailnet, so your phone or another computer
+can open it:
+
+```text
+BaviTutor is running at http://localhost:4100  (Ctrl+C to stop)
+     on your tailnet at https://laptop.tail1234.ts.net:4100
+```
+
+It runs `tailscale serve` over HTTPS on the same port number, so anything you
+already serve on 443 stays as it is. Only devices on your tailnet can reach it
+(it is not Funnel), and the share stops when BaviTutor stops. Anyone on your
+tailnet can use it, on your Claude login.
+
+It needs Tailscale installed and logged in, with MagicDNS and HTTPS
+Certificates turned on (admin console, DNS page). If something is missing,
+BaviTutor says what to fix and still runs on this computer. If BaviTutor is
+already running, `--tailscale` shares that one until you press Ctrl+C.
+
 ### Configuration (environment, `apps/server/.env` in dev, `<data-dir>/.env` for the CLI)
 
 | Variable               | Default             | Meaning                                                    |

package/dist/bavitutor.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { Duplex, PassThrough, Readable } from "node:stream";
 import * as Http from "node:http";
 import { createServer } from "node:http";
@@ -652,6 +652,71 @@ function isBoolean(input) {
 	return typeof input === "boolean";
 }
 /**
+* Checks whether a value is a `symbol`.
+*
+* **When to use**
+*
+* Use when you need a `Predicate` guard to narrow an `unknown` value to a
+* symbol.
+*
+* **Details**
+*
+* Uses `typeof input === "symbol"`.
+*
+* **Example** (Guarding symbols)
+*
+* ```ts import.meta.vitest
+* import { Predicate } from "effect"
+*
+* const data: unknown = Symbol.for("id")
+*
+* if (Predicate.isSymbol(data)) {
+*   data.description // => "id"
+* }
+* ```
+*
+* @see {@link isPropertyKey}
+* @category guards
+* @since 2.0.0
+*/
+function isSymbol(input) {
+	return typeof input === "symbol";
+}
+/**
+* Checks whether a value is a valid `PropertyKey` (string, number, or symbol).
+*
+* **When to use**
+*
+* Use when you need a `Predicate` guard for unknown property keys before
+* indexing.
+*
+* **Details**
+*
+* Uses `isString`, `isNumber`, and `isSymbol`.
+*
+* **Example** (Guarding property keys)
+*
+* ```ts import.meta.vitest
+* import { Predicate } from "effect"
+*
+* const key: unknown = "name"
+* const obj: Record<PropertyKey, unknown> = { name: "Ada" }
+*
+* if (Predicate.isPropertyKey(key) && key in obj) {
+*   obj[key] // => "Ada"
+* }
+* ```
+*
+* @see {@link isString}
+* @see {@link isNumber}
+* @see {@link isSymbol}
+* @category guards
+* @since 4.0.0
+*/
+function isPropertyKey(u) {
+	return isString(u) || isNumber(u) || isSymbol(u);
+}
+/**
 * Checks whether a value is a `function`.
 *
 * **When to use**
@@ -23018,7 +23083,7 @@ const provideService = /*#__PURE__*/ dual(3, (self, key, service) => fromChannel
 * @category destructors
 * @since 2.0.0
 */
-const run$4 = /*#__PURE__*/ dual(2, (self, sink) => scopedWith((scope) => toPullScoped(self.channel, scope).pipe(flatMap$1((upstream) => sink.transform(upstream, scope)), map$3(([a]) => a))));
+const run$5 = /*#__PURE__*/ dual(2, (self, sink) => scopedWith((scope) => toPullScoped(self.channel, scope).pipe(flatMap$1((upstream) => sink.transform(upstream, scope)), map$3(([a]) => a))));
 /**
 * Runs the stream and collects all elements into an array.
 *
@@ -26761,6 +26826,35 @@ function withConstructorDefault$1(ast, defaultValue) {
 function decodeTo$1(from, to, transformation) {
 	return appendTransformation(from, transformation, to);
 }
+function parseParameter(ast) {
+	const literals = [];
+	const parameters = [];
+	function go(ast) {
+		switch (ast._tag) {
+			case "Literal":
+				if (isPropertyKey(ast.literal) && !literals.includes(ast.literal)) literals.push(ast.literal);
+				return;
+			case "UniqueSymbol":
+				if (!literals.includes(ast.symbol)) literals.push(ast.symbol);
+				return;
+			case "Never": return;
+			case "Union":
+				for (let i = 0; i < ast.types.length; i++) go(ast.types[i]);
+				return;
+			default: parameters.push(ast);
+		}
+	}
+	go(ast);
+	return {
+		literals,
+		parameters
+	};
+}
+/** @internal */
+function record(key, value) {
+	const { literals, parameters: indexSignatures } = parseParameter(key);
+	return new Objects(literals.map((literal) => new PropertySignature(literal, value)), indexSignatures.map((parameter) => new IndexSignature(parameter, value)));
+}
 /**
 * Returns `true` if the AST node represents an optional property.
 *
@@ -27850,7 +27944,7 @@ const layer$20 = /*#__PURE__*/ effect(ChildProcessSpawner, /* @__PURE__ */ gen(f
 						evaluate: () => nodeStream,
 						onError: (error) => toPlatformError(`fromWritable(fd${fd})`, toError(error), command)
 					});
-					if (config.stream) yield* forkScoped(run$4(config.stream, sink));
+					if (config.stream) yield* forkScoped(run$5(config.stream, sink));
 					inputSinks.set(fd, sink);
 					break;
 				}
@@ -27884,7 +27978,7 @@ const layer$20 = /*#__PURE__*/ effect(ChildProcessSpawner, /* @__PURE__ */ gen(f
 			endOnDone: config.endOnDone,
 			encoding: config.encoding
 		});
-		if (isStream(config.stream)) return as(forkScoped(run$4(config.stream, sink)), sink);
+		if (isStream(config.stream)) return as(forkScoped(run$5(config.stream, sink)), sink);
 		return succeed$3(sink);
 	});
 	const setupChildOutputStreams = (command, childProcess, stdoutConfig, stderrConfig) => {
@@ -29387,7 +29481,7 @@ function make$37(schema) {
 }
 function makeIs(ast) {
 	{
-		const parser = asExit(run$3(ast));
+		const parser = asExit(run$4(ast));
 		return (input) => {
 			const exit = parser(input, defaultParseOptions);
 			if (isSuccess(exit)) return true;
@@ -29429,7 +29523,7 @@ function _is(ast) {
 * @since 4.0.0
 */
 function decodeUnknownEffect$1(schema, options) {
-	const parser = run$3(schema.ast);
+	const parser = run$4(schema.ast);
 	return options === void 0 ? parser : (input, overrideOptions) => parser(input, mergeParseOptions(options, overrideOptions));
 }
 /** @internal */
@@ -29458,7 +29552,7 @@ function decodeUnknownOption$1(schema, options) {
 * @since 4.0.0
 */
 function encodeUnknownEffect$1(schema, options) {
-	const parser = run$3(flip(schema.ast));
+	const parser = run$4(flip(schema.ast));
 	return options === void 0 ? parser : (input, overrideOptions) => parser(input, mergeParseOptions(options, overrideOptions));
 }
 const mergeParseOptions = (options, overrideOptions) => overrideOptions ? {
@@ -29470,7 +29564,7 @@ const getValue = (value) => {
 	return succeed$3(value);
 };
 /** @internal */
-function run$3(ast) {
+function run$4(ast) {
 	return runWithCompiler(normalCompiler, ast);
 }
 function parserResult(result, input) {
@@ -32189,6 +32283,50 @@ function Struct(fields) {
 	return makeStruct(struct(fields, void 0), fields);
 }
 /**
+* Defines a record schema whose dynamic properties are selected by a key schema
+* and decoded with a value schema.
+*
+* **Details**
+*
+* For dynamic keys, the key schema selects matching own properties and the
+* value schema decodes or encodes only those selected properties. Checks on
+* string, number, symbol, and template literal key schemas narrow which
+* properties are selected.
+*
+* For transformed key schemas, property selection is based on encoded property
+* names before the selected key is decoded.
+*
+* **Gotchas**
+*
+* When decoded or encoded key transformations produce the same property key,
+* sequential parsing applies selected own properties in selection order, so
+* the later selected property overwrites the earlier value. Dynamic key
+* selection always examines own properties. Finite literal keys are declared
+* fields and may therefore be inherited. Output key order is not guaranteed.
+*
+* **Example** (Defining a string-keyed record of numbers)
+*
+* ```ts import.meta.vitest
+* import { Schema } from "effect"
+*
+* const schema = Schema.Record(Schema.String, Schema.Number)
+*
+* // { readonly [x: string]: number }
+* type R = typeof schema.Type
+*
+* Schema.decodeUnknownSync(schema)({ a: 1, b: 2 }) // => { a: 1, b: 2 }
+* ```
+*
+* @category constructors
+* @since 3.10.0
+*/
+function Record(key, value) {
+	return make$35(record(key.ast, value.ast), {
+		key,
+		value
+	});
+}
+/**
 * @category constructors
 * @since 4.0.0
 */
@@ -36997,7 +37135,7 @@ var PartBase$1 = class extends Class$1 {
 		this[TypeId$16] = TypeId$16;
 	}
 };
-const defaultWriteFile = (path, file) => flatMap$1(FileSystem, (fs) => mapError$2(run$4(file.content, fs.sink(path)), toMultipartError));
+const defaultWriteFile = (path, file) => flatMap$1(FileSystem, (fs) => mapError$2(run$5(file.content, fs.sink(path)), toMultipartError));
 /**
 * Persists a stream of multipart parts into a record.
 *
@@ -38233,7 +38371,7 @@ const constInterruptedFiber$1 = /*#__PURE__*/ function() {
 * @category combinators
 * @since 2.0.0
 */
-const run$2 = function() {
+const run$3 = function() {
 	const self = arguments[0];
 	if (!isEffect(arguments[1])) {
 		const options = arguments[1];
@@ -39315,7 +39453,7 @@ const constInterruptedFiber = /*#__PURE__*/ function() {
 * @category combinators
 * @since 2.0.0
 */
-const run$1 = function() {
+const run$2 = function() {
 	const self = arguments[0];
 	if (isEffect(arguments[2])) return runImpl(self, arguments[1], arguments[2], arguments[3]);
 	const key = arguments[1];
@@ -47460,7 +47598,7 @@ const fromLiteral = (literal) => codeByLiteral[literal];
 //#endregion
 //#region package.json
 var name = "bavitutor";
-var version$1 = "0.3.1";
+var version$1 = "0.3.2";
 /**
 * Default Server-Sent Events encoder.
 *
@@ -55384,14 +55522,14 @@ const sqliteCauseWithErrno = (cause) => {
 * @category running
 * @since 4.0.0
 */
-const run = /*#__PURE__*/ make$13({});
+const run$1 = /*#__PURE__*/ make$13({});
 /**
 * Creates a layer that runs the configured SQLite migrations during layer construction and provides no services.
 *
 * @category layers
 * @since 4.0.0
 */
-const layer = (options) => effectDiscard(run(options));
+const layer = (options) => effectDiscard(run$1(options));
 const MigratorLive = layer({ loader: fromRecord({
 	"0001_initial": gen(function* () {
 		const sql = yield* SqlClient;
@@ -56848,7 +56986,7 @@ var Flashcards = class Flashcards extends Service()("bavitutor/Flashcards") {
 				return next;
 			}).pipe(andThen(succeed$6(entry.deferred, rows)));
 			const release = forEach$1(mine, (entry) => settle(entry, []), { discard: true });
-			if (mine.length > 0) yield* run$2(writers, forEach$1(chunksOf(mine, 3), (chunk) => writeRows(goalId, chunk.map((entry) => entry.idea)).pipe(flatMap$1((rows) => forEach$1(chunk, (entry) => settle(entry, rows.get(entry.idea.id) ?? []), { discard: true }))), {
+			if (mine.length > 0) yield* run$3(writers, forEach$1(chunksOf(mine, 3), (chunk) => writeRows(goalId, chunk.map((entry) => entry.idea)).pipe(flatMap$1((rows) => forEach$1(chunk, (entry) => settle(entry, rows.get(entry.idea.id) ?? []), { discard: true }))), {
 				concurrency: WRITE_CONCURRENCY$1,
 				discard: true
 			}).pipe(ensuring(release)));
@@ -62124,7 +62262,7 @@ var Research = class Research extends Service()("bavitutor/Research") {
 			});
 			yield* goals.setStatus(goalId, "Failed");
 		})));
-		const start = (goalId) => run$1(fibers, goalId, run(goalId)).pipe(asVoid);
+		const start = (goalId) => run$2(fibers, goalId, run(goalId)).pipe(asVoid);
 		const cancel = (goalId) => remove$1(fibers, goalId);
 		return Research.of({
 			start,
@@ -62657,7 +62795,7 @@ var IdeaSeeding = class IdeaSeeding extends Service()("bavitutor/IdeaSeeding") {
 			let queued = 0;
 			for (const conceptId of conceptIds) if ((yield* goals.ideas(goalId, conceptId)).length > 0) yield* seedConcept(goalId, conceptId, how);
 			else if (isResearched) {
-				yield* run$1(writing, `${goalId}/${conceptId}`, writeThenSeed(goalId, conceptId, how), { onlyIfMissing: true });
+				yield* run$2(writing, `${goalId}/${conceptId}`, writeThenSeed(goalId, conceptId, how), { onlyIfMissing: true });
 				queued++;
 			}
 			if (queued > 0) yield* logInfo(`Writing key ideas for ${queued} skipped lesson(s) in the background`);
@@ -62948,7 +63086,7 @@ var QuestionBank = class QuestionBank extends Service()("bavitutor/QuestionBank"
 				missing: maybeDetail.value.graph.concepts.filter((concept) => !existing.has(concept.id))
 			});
 		});
-		const prepareDiagnostics = (goalId) => run$1(preparing, goalId, gen(function* () {
+		const prepareDiagnostics = (goalId) => run$2(preparing, goalId, gen(function* () {
 			const maybeWork = yield* missingConcepts(goalId);
 			if (isNone(maybeWork)) return;
 			const { subject, missing } = maybeWork.value;
@@ -63396,7 +63534,7 @@ var RenderError = class extends TaggedError()("RenderError", { message: String$2
 const WIDTH = 960;
 const HEIGHT = 600;
 const FRAME_ID = "render";
-const START_TIMEOUT_MS = 6e3;
+const START_TIMEOUT_MS$1 = 6e3;
 const CHECK_TIMEOUT_MS = 8e3;
 const STEP_TIMEOUT_MS = 6e3;
 const CALL_TIMEOUT = seconds(15);
@@ -63528,7 +63666,7 @@ var Renderer = class Renderer extends Service()("bavitutor/viz/Renderer") {
 				from: 0,
 				kind: "Start",
 				index: 0
-			}, START_TIMEOUT_MS);
+			}, START_TIMEOUT_MS$1);
 			const startEvents = yield* readEvents(page);
 			const isReady = startEvents.some((maybeEvent) => exists(maybeEvent, (event) => event.type === "bv:ready"));
 			if (!hasStarted || !isReady) {
@@ -63536,7 +63674,7 @@ var Renderer = class Renderer extends Service()("bavitutor/viz/Renderer") {
 				return yield* finish({
 					count: 0,
 					captions: [],
-					errors: isReadonlyArrayNonEmpty(startErrors) ? dedupeIssues(startErrors) : [errorIssue(`The scene did not start within ${START_TIMEOUT_MS / 1e3} s (an endless loop at load time?).`, "load")],
+					errors: isReadonlyArrayNonEmpty(startErrors) ? dedupeIssues(startErrors) : [errorIssue(`The scene did not start within ${START_TIMEOUT_MS$1 / 1e3} s (an endless loop at load time?).`, "load")],
 					warnings: [],
 					shots: []
 				});
@@ -63830,7 +63968,7 @@ var Visuals = class Visuals extends Service()("bavitutor/Visuals") {
 			_tag: "Failed",
 			note: `Unexpected error: ${pretty(cause).slice(0, 400)}`
 		})), withSpan("Visuals.generate"));
-		const start = (goalId, visualId) => run$1(running, key(goalId, visualId), generate(goalId, visualId), { onlyIfMissing: true }).pipe(asVoid);
+		const start = (goalId, visualId) => run$2(running, key(goalId, visualId), generate(goalId, visualId), { onlyIfMissing: true }).pipe(asVoid);
 		const enqueue = (goalId, visualId, brief, context) => gen(function* () {
 			const now = yield* currentTimeMillis;
 			const text = brief.trim();
@@ -64243,7 +64381,7 @@ var Lessons = class Lessons extends Service()("bavitutor/Lessons") {
             VALUES (${goalId}, ${conceptId}, 'Generating', ${now})
             ON CONFLICT (goal_id, concept_id) DO UPDATE SET status = 'Generating', error = NULL, started_at = excluded.started_at
           `.pipe(orDie$2);
-			yield* run$1(generating, `${goalId}/${conceptId}`, generate(goalId, conceptId), { onlyIfMissing: true });
+			yield* run$2(generating, `${goalId}/${conceptId}`, generate(goalId, conceptId), { onlyIfMissing: true });
 			return now;
 		});
 		const storedArm = (goalId, conceptId) => sql`
@@ -64983,7 +65121,7 @@ var Reviews = class Reviews extends Service()("bavitutor/Reviews") {
 			return new Map(entries);
 		});
 		const leechMap = leeches.active.pipe(map$3((all) => new Map(all.map((leech) => [conceptKey$1(leech.goalId, leech.conceptId), leech]))));
-		const prepareItems = (goalId, conceptId) => run$1(preparing, `${goalId}/${conceptId}`, gen(function* () {
+		const prepareItems = (goalId, conceptId) => run$2(preparing, `${goalId}/${conceptId}`, gen(function* () {
 			if (((yield* sql`
               SELECT COUNT(*) AS n FROM questions
               WHERE goal_id = ${goalId} AND concept_id = ${conceptId} AND purpose = 'Review'
@@ -66515,6 +66653,147 @@ const makeServer = (options = {}) => {
 	})).pipe(provide(ResumeInterrupted), provide(ResumeSkippedIdeas), provide(ServicesLive), provide(ConfigLive(options)));
 };
 //#endregion
+//#region apps/server/src/tailscale.ts
+/**
+* `bavitutor --tailscale`: shares the server with the learner's other devices
+* through `tailscale serve`, over HTTPS on the same port number, so whatever
+* the machine already serves on 443 stays as it is. `serve` runs in the
+* foreground, and Tailscale drops the share when that process ends, so the
+* share lasts exactly as long as BaviTutor does.
+*/
+const problem = (reason, ...fix) => ({
+	_tag: "Problem",
+	reason,
+	fix
+});
+const decodeStatus = decodeUnknownOption(fromJsonString(Struct({
+	BackendState: String$2,
+	Self: optional(NullOr(Struct({ DNSName: String$2 }))),
+	CertDomains: optional(NullOr(ArraySchema(String$2)))
+})));
+const ServeConfig = Struct({
+	TCP: optional(Record(String$2, Unknown)),
+	Web: optional(Record(String$2, Struct({ Handlers: optional(Record(String$2, Struct({ Proxy: optional(String$2) }))) })))
+});
+const decodeServeStatus = decodeUnknownOption(fromJsonString(Struct({
+	...ServeConfig.fields,
+	Foreground: optional(Record(String$2, ServeConfig))
+})));
+const TRY_AGAIN = "then try again.";
+/** Reads `tailscale status --json`: this device's name, or what's in the way. */
+const readStatus = (json) => decodeStatus(json).pipe(match$5({
+	onNone: () => problem("Tailscale isn't running", `Start the Tailscale app, ${TRY_AGAIN}`),
+	onSome: (status) => {
+		if (status.BackendState === "Stopped") return problem("Tailscale is off", `Turn it on in the Tailscale app or with \`tailscale up\`, ${TRY_AGAIN}`);
+		if (status.BackendState === "NeedsLogin") return problem("Tailscale isn't logged in", `Log in with the Tailscale app or \`tailscale up\`, ${TRY_AGAIN}`);
+		if (status.BackendState === "NeedsMachineAuth") return problem("This computer waits for approval on your tailnet", `Approve it at https://login.tailscale.com/admin/machines, ${TRY_AGAIN}`);
+		const dnsName = status.Self?.DNSName.replace(/\.$/, "") ?? "";
+		if (status.BackendState !== "Running" || dnsName === "") return problem("Tailscale isn't connected yet", `Wait a moment, ${TRY_AGAIN}`);
+		if ((status.CertDomains ?? []).length === 0) return problem("Your tailnet doesn't have HTTPS on", "Turn on MagicDNS and HTTPS Certificates at", `https://login.tailscale.com/admin/dns, ${TRY_AGAIN}`);
+		return { dnsName };
+	}
+}));
+/**
+* Reads `tailscale serve status --json` for one port: `Ours` when that tailnet
+* port already proxies to the same local port (BaviTutor shared it before),
+* `Taken` when it serves something else.
+*/
+const servedPort = (json, port) => decodeServeStatus(json).pipe(match$5({
+	onNone: () => "Free",
+	onSome: (status) => {
+		const configs = [status, ...Object.values(status.Foreground ?? {})];
+		if (configs.some((config) => Object.entries(config.Web ?? {}).some(([hostPort, web]) => {
+			const proxy = web.Handlers?.["/"]?.Proxy;
+			return hostPort.endsWith(`:${port}`) && proxy !== void 0 && URL.canParse(proxy) && new URL(proxy).port === String(port);
+		}))) return "Ours";
+		return configs.some((config) => config.TCP?.[String(port)] !== void 0) ? "Taken" : "Free";
+	}
+}));
+/** Where the server listens, as the address `tailscale serve` proxies to. */
+const serveTarget = (host, port) => {
+	const address = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
+	return `http://${address.includes(":") ? `[${address}]` : address}:${port}`;
+};
+const tailnetUrl = (dnsName, port) => port === 443 ? `https://${dnsName}` : `https://${dnsName}:${port}`;
+/** `tailscale` from the PATH, then where the installers put it. */
+const cliCandidates = () => ["tailscale", ...(process.platform === "win32" ? [join(process.env["PROGRAMFILES"] ?? "C:/Program Files", "Tailscale", "tailscale.exe")] : process.platform === "darwin" ? [
+	"/Applications/Tailscale.app/Contents/MacOS/Tailscale",
+	"/opt/homebrew/bin/tailscale",
+	"/usr/local/bin/tailscale"
+] : []).filter((path) => existsSync(path))];
+/** Runs the tailscale CLI and resolves with its stdout, or undefined if `cli` doesn't exist. */
+const run = (cli, args) => new Promise((done) => {
+	execFile(cli, args, {
+		timeout: 5e3,
+		windowsHide: true
+	}, (error, stdout) => done(error?.code === "ENOENT" ? void 0 : stdout));
+});
+/** Finds Tailscale and checks it can share over HTTPS. */
+const checkTailscale = async () => {
+	for (const cli of cliCandidates()) {
+		const status = await run(cli, ["status", "--json"]);
+		if (status !== void 0) {
+			const read = readStatus(status);
+			return "dnsName" in read ? {
+				_tag: "Tailnet",
+				cli,
+				dnsName: read.dnsName
+			} : read;
+		}
+	}
+	return problem("Tailscale not found", `Get it at https://tailscale.com/download and log in, ${TRY_AGAIN}`);
+};
+const START_TIMEOUT_MS = 1e4;
+/**
+* Shares the server listening on `host:port` at the same port on the tailnet.
+* Kill the returned process to stop sharing.
+*/
+const shareOnTailnet = async (tailnet, port, host) => {
+	const url = tailnetUrl(tailnet.dnsName, port);
+	const served = servedPort(await run(tailnet.cli, [
+		"serve",
+		"status",
+		"--json"
+	]) ?? "", port);
+	if (served === "Ours") return {
+		_tag: "Shared",
+		url,
+		process: void 0
+	};
+	if (served === "Taken") return problem(`Port ${port} on your tailnet is in use`, "See what uses it with `tailscale serve status`, or pick another port:", `bavitutor --tailscale --port ${port === 65535 ? port - 1 : port + 1}`);
+	const args = [
+		"serve",
+		`--https=${port}`,
+		serveTarget(host, port)
+	];
+	return new Promise((done) => {
+		const child = spawn(tailnet.cli, args, { windowsHide: true });
+		const output = [];
+		const timer = setTimeout(() => {
+			child.kill();
+			done(problem(`Tailscale didn't share port ${port} within ${START_TIMEOUT_MS / 1e3} seconds`, `Run \`tailscale ${args.join(" ")}\` to see why.`));
+		}, START_TIMEOUT_MS);
+		child.stdout.on("data", (chunk) => {
+			output.push(String(chunk));
+			if (output.join("").includes(`https://${tailnet.dnsName}`)) {
+				clearTimeout(timer);
+				done({
+					_tag: "Shared",
+					url,
+					process: child
+				});
+			}
+		});
+		child.stderr.on("data", (chunk) => output.push(String(chunk)));
+		const fail = (detail) => {
+			clearTimeout(timer);
+			done(problem(`Tailscale couldn't share port ${port}`, `It said: ${detail}`));
+		};
+		child.once("error", (error) => fail(error.message));
+		child.once("exit", () => fail(output.join("").trim().split(/\r?\n/).findLast((line) => line.trim() !== "") ?? "nothing"));
+	});
+};
+//#endregion
 //#region apps/server/src/cli.ts
 /**
 * Production entry, shipped as the `bavitutor` bin: checks the machine, then
@@ -66531,6 +66810,7 @@ Options:
   --port <port>     port to listen on (default: $PORT, then ${DEFAULT_PORT})
   --host <host>     interface to listen on (default: ${DEFAULT_HOST}, this machine only)
   --data-dir <dir>  database and settings (default: ~/.bavitutor)
+  --tailscale       also share it on your tailnet over HTTPS (same port)
   --no-open         don't open the browser
   --no-update       don't switch to a newer version from npm
   -v, --version     print the version
@@ -66551,6 +66831,10 @@ const parseOptions = () => {
 				port: { type: "string" },
 				host: { type: "string" },
 				"data-dir": { type: "string" },
+				tailscale: {
+					type: "boolean",
+					default: false
+				},
 				open: {
 					type: "boolean",
 					default: true
@@ -66808,6 +67092,19 @@ const openBrowser = (url) => {
 		say(`Open ${url} in your browser.`);
 	}
 };
+const warnNotShared = (problem) => warn([`${problem.reason}, so only this computer can open BaviTutor.`, ...problem.fix]);
+/** For `--tailscale`: the tailnet to share on, or undefined after a warning. */
+const checkTailnet = async () => {
+	const result = await checkTailscale();
+	if (result._tag === "Problem") {
+		warnNotShared(result);
+		return;
+	}
+	say(`  tailnet  ${result.dnsName}`);
+	return result;
+};
+/** Prints the tailnet URL under the local one, lined up on "at". */
+const sayTailnetUrl = (lead, url, note = "") => say(`${"on your tailnet".padStart(lead.length)} at ${url}${note}`);
 const main = async () => {
 	const options = parseOptions();
 	if (options.help) {
@@ -66871,10 +67168,25 @@ const main = async () => {
 		]);
 		else say(`  visuals  ${chrome}`);
 	}
+	const tailnet = options.tailscale ? await checkTailnet() : void 0;
 	const choice = await choosePort(requestedPort, isExplicitPort, host);
 	if (choice.isRunning) {
+		const lead = "BaviTutor is already running";
 		say();
-		say(`BaviTutor is already running at ${urlFor(choice.port)}`);
+		say(`${lead} at ${urlFor(choice.port)}`);
+		const shared = tailnet === void 0 ? void 0 : await shareOnTailnet(tailnet, choice.port, host);
+		if (shared?._tag === "Shared") {
+			const sharing = shared.process;
+			sayTailnetUrl(lead, shared.url, sharing === void 0 ? "" : "  (Ctrl+C to stop sharing)");
+			if (sharing !== void 0) {
+				const stopSharing = () => sharing.kill();
+				process.once("SIGINT", stopSharing);
+				process.once("SIGTERM", stopSharing);
+			}
+		} else if (shared !== void 0) {
+			say();
+			warnNotShared(shared);
+		}
 		say();
 		if (options.open) openBrowser(urlFor(choice.port));
 		sayIfOutdated(latest);
@@ -66885,8 +67197,19 @@ const main = async () => {
 	const url = urlFor(port);
 	effectDiscard(gen(function* () {
 		yield* HttpServer;
+		const lead = "BaviTutor is running";
 		say();
-		say(`BaviTutor is running at ${url}  (Ctrl+C to stop)`);
+		say(`${lead} at ${url}  (Ctrl+C to stop)`);
+		if (tailnet !== void 0) {
+			const shared = yield* acquireRelease(promise(() => shareOnTailnet(tailnet, port, host)), (result) => sync(() => {
+				if (result._tag === "Shared") result.process?.kill();
+			}));
+			if (shared._tag === "Shared") sayTailnetUrl(lead, shared.url);
+			else {
+				say();
+				warnNotShared(shared);
+			}
+		}
 		say();
 		if (options.open) openBrowser(url);
 		sayIfOutdated(latest);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bavitutor",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Describe what you want to learn; BaviTutor researches it, maps it and teaches it.",
   "keywords": [
     "claude",