dscord 0.4.0-alpha.2 → 0.4.0-alpha.4

package/central/directory.mjs

@@ -0,0 +1,224 @@
+import { randomInt } from 'node:crypto';
+import { failure } from './store.mjs';
+
+export const SERVER_WELL_KNOWN = '/.well-known/dscord/server';
+/** A server whose public page has not been read for this long drops out of search until it is read again. */
+export const LISTING_STALE_MS = 3 * 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 10_000;
+const MAX_BODY_BYTES = 64 * 1024;
+const MAX_RESULTS = 50;
+/** How a server can be found: by keyword search, only by its exact number, or not at all. */
+export const DISCOVERY = ['public', 'number', 'hidden'];
+/** How people join: anyone with a central account, or only with an invitation from the server. */
+export const JOIN = ['open', 'invite'];
+/** Where a listing stands with this central's administrators. Only listed servers are searchable. */
+export const LISTING_STATUS = ['pending', 'listed', 'rejected', 'banned'];
+/** Whether a newly submitted server waits for an administrator ('review') or is listed at once ('open'). */
+export const LISTING_MODES = ['review', 'open'];
+// Server numbers are eight digits, handed out at random so they say nothing about when a server was listed.
+const NUMBER_MIN = 10_000_000;
+const NUMBER_SPAN = 90_000_000;
+
+const iso = value => value === null || value === undefined ? null : new Date(value).toISOString();
+
+function text(value, max, field) {
+  if (value === undefined || value === null) return '';
+  if (typeof value !== 'string' || value.length > max || /[\u0000-\u0008\u000b-\u001f\u007f]/.test(value)) throw failure(502, 'SERVER_PAGE_INVALID', `${field} is not valid`);
+  return value.trim();
+}
+
+function count(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+
+/** The public page a chat server serves at /.well-known/dscord/server, reduced to what the index keeps. */
+export function readServerPage(value, origin) {
+  if (!value || typeof value !== 'object' || value.schemaVersion !== 1) throw failure(502, 'SERVER_PAGE_INVALID', 'Unknown server page version');
+  if (value.origin !== origin) throw failure(502, 'SERVER_PAGE_INVALID', 'The page names a different origin');
+  const tags = Array.isArray(value.tags) ? value.tags : [];
+  if (tags.length > 10) throw failure(502, 'SERVER_PAGE_INVALID', 'At most 10 tags');
+  return {
+    central: typeof value.central === 'string' ? value.central : '',
+    discovery: DISCOVERY.includes(value.discovery) ? value.discovery : 'hidden',
+    page: {
+      name: text(value.name, 80, 'name') || new URL(origin).hostname,
+      description: text(value.description, 500, 'description'),
+      tags: [...new Set(tags.map(tag => text(tag, 32, 'tag').toLowerCase()).filter(Boolean))],
+      members: { people: count(value.members?.people), bots: count(value.members?.bots) },
+      join: JOIN.includes(value.join) ? value.join : 'invite',
+    },
+  };
+}
+
+async function readJson(response) {
+  const reader = response.body?.getReader();
+  if (!reader) return response.json();
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > MAX_BODY_BYTES) { await reader.cancel(); throw failure(502, 'SERVER_PAGE_INVALID', 'The server page is too large'); }
+    chunks.push(value);
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+
+/**
+ * The server index. A chat server submits its origin; the index reads the server's public page from that origin and
+ * keeps reading it. A page served at the origin and naming this central is the server's consent to be listed, so
+ * submitting needs no account. This central's administrators decide what is listed: new servers wait for review
+ * unless the central lists them at once.
+ */
+export class ServerDirectory {
+  constructor({ db, issuer, now = Date.now, fetch = globalThis.fetch, fetchVia = {} }) {
+    Object.assign(this, { db, issuer, now, fetch, fetchVia });
+    db.exec(`CREATE TABLE IF NOT EXISTS servers (origin TEXT PRIMARY KEY, number INTEGER NOT NULL UNIQUE,
+        status TEXT NOT NULL CHECK(status IN ('pending','listed','rejected','banned')), note TEXT NOT NULL DEFAULT '',
+        discovery TEXT NOT NULL, page_json TEXT NOT NULL, submitted_at INTEGER NOT NULL, reviewed_at INTEGER,
+        fetched_at INTEGER, last_error TEXT, checked_at INTEGER NOT NULL);`);
+  }
+
+  async read(origin) {
+    const base = this.fetchVia[origin] || origin;
+    let response;
+    try {
+      response = await this.fetch(`${base}${SERVER_WELL_KNOWN}`, { headers: { Accept: 'application/json' }, redirect: 'error',
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    } catch { throw failure(502, 'SERVER_UNREACHABLE', 'Could not reach the server page'); }
+    if (response.status === 404) throw failure(409, 'SERVER_PAGE_MISSING', 'The server does not publish a directory page');
+    if (!response.ok) throw failure(502, 'SERVER_UNREACHABLE', `The server page answered ${response.status}`);
+    let body;
+    try { body = await readJson(response); } catch (error) { throw error.code ? error : failure(502, 'SERVER_PAGE_INVALID', 'The server page is not JSON'); }
+    const page = readServerPage(body, origin);
+    if (page.central !== this.issuer) throw failure(409, 'CENTRAL_MISMATCH', 'The server trusts a different central');
+    return page;
+  }
+
+  /**
+   * Reads the page and keeps the server. A new server is pending under review and listed at once otherwise;
+   * a rejected server that submits again goes back to pending. A banned origin stays out.
+   */
+  async submit(origin, { review = true } = {}) {
+    const existing = this.server(origin);
+    if (existing?.status === 'banned') throw failure(403, 'SERVER_BANNED', 'This central does not list the server');
+    const read = await this.read(origin);
+    const at = this.now();
+    const page = JSON.stringify(read.page);
+    if (existing) {
+      const status = existing.status === 'rejected' ? 'pending' : existing.status;
+      this.db.prepare(`UPDATE servers SET status=?, discovery=?, page_json=?, submitted_at=CASE WHEN ?<>status THEN ? ELSE submitted_at END,
+          fetched_at=?, last_error=NULL, checked_at=? WHERE origin=?`).run(status, read.discovery, page, status, at, at, at, origin);
+    } else {
+      // A server keeps its number for as long as it stays in the index.
+      for (;;) {
+        const number = NUMBER_MIN + randomInt(NUMBER_SPAN);
+        try {
+          this.db.prepare(`INSERT INTO servers(origin,number,status,discovery,page_json,submitted_at,reviewed_at,fetched_at,checked_at)
+              VALUES (?,?,?,?,?,?,?,?,?)`).run(origin, number, review ? 'pending' : 'listed', read.discovery, page, at, review ? null : at, at, at);
+          break;
+        } catch (error) { if (!String(error.message).includes('UNIQUE')) throw error; }
+      }
+    }
+    return this.submittedView(this.server(origin));
+  }
+
+  server(origin) { return this.db.prepare('SELECT * FROM servers WHERE origin=?').get(origin); }
+
+  existing(origin) {
+    const row = this.server(origin);
+    if (!row) throw failure(404, 'SERVER_NOT_FOUND');
+    return row;
+  }
+
+  /** Reads the page again. A page that cannot be read keeps the last listing, which drops out of search once stale. */
+  async refresh(origin) {
+    const row = this.server(origin);
+    if (!row) return undefined;
+    const at = this.now();
+    try {
+      const read = await this.read(origin);
+      this.db.prepare('UPDATE servers SET discovery=?, page_json=?, fetched_at=?, last_error=NULL, checked_at=? WHERE origin=?')
+        .run(read.discovery, JSON.stringify(read.page), at, at, origin);
+    } catch (error) {
+      if (!error.code) throw error;
+      this.db.prepare('UPDATE servers SET last_error=?, checked_at=? WHERE origin=?').run(error.code, at, origin);
+    }
+    return this.server(origin);
+  }
+
+  async refreshAll() {
+    for (const { origin } of this.db.prepare("SELECT origin FROM servers WHERE status IN ('pending','listed') ORDER BY checked_at").all()) {
+      await this.refresh(origin);
+    }
+  }
+
+  /** An administrator's decision: list, reject or ban a server, with an optional note the server's operators can read. */
+  decide(origin, status, note = '') {
+    if (!['listed', 'rejected', 'banned'].includes(status)) throw failure(400, 'LISTING_STATUS_INVALID');
+    if (typeof note !== 'string' || note.length > 500) throw failure(400, 'NOTE_INVALID');
+    this.existing(origin);
+    this.db.prepare('UPDATE servers SET status=?, note=?, reviewed_at=? WHERE origin=?').run(status, note.trim(), this.now(), origin);
+    return this.adminView(this.server(origin));
+  }
+
+  /** Drops a server from the index, number and all; a removed server may submit again and gets a new number. */
+  remove(origin) {
+    if (!this.db.prepare('DELETE FROM servers WHERE origin=?').run(origin).changes) throw failure(404, 'SERVER_NOT_FOUND');
+  }
+
+  /** What a submitting server learns: its number and where its listing stands. */
+  submittedView(row) {
+    return { origin: row.origin, number: row.number, status: row.status, note: row.note, discovery: row.discovery };
+  }
+
+  adminView(row) {
+    return { ...this.submittedView(row), ...JSON.parse(row.page_json), submittedAt: iso(row.submitted_at), reviewedAt: iso(row.reviewed_at),
+      fetchedAt: iso(row.fetched_at), checkedAt: iso(row.checked_at), lastError: row.last_error };
+  }
+
+  /** Every server in the index for its administrators, newest submissions first, optionally of one status. */
+  list({ status = '' } = {}) {
+    if (status && !LISTING_STATUS.includes(status)) throw failure(400, 'LISTING_STATUS_INVALID');
+    const rows = status ? this.db.prepare('SELECT * FROM servers WHERE status=? ORDER BY submitted_at DESC').all(status)
+      : this.db.prepare('SELECT * FROM servers ORDER BY submitted_at DESC').all();
+    return rows.map(row => this.adminView(row));
+  }
+
+  counts() {
+    return Object.fromEntries(LISTING_STATUS.map(status => [status,
+      this.db.prepare('SELECT COUNT(*) AS n FROM servers WHERE status=?').get(status).n]));
+  }
+
+  /**
+   * Listed servers read within the last three days. A query of digits finds the server with that number, unless it is hidden;
+   * otherwise only public servers are searched, and every word must appear in the name, description or tags.
+   */
+  search({ q = '', tag = '', limit = 20 } = {}) {
+    const query = String(q).trim();
+    const fresh = this.now() - LISTING_STALE_MS;
+    if (/^\d{8}$/.test(query)) {
+      const row = this.db.prepare("SELECT * FROM servers WHERE number=? AND status='listed' AND discovery IN ('public','number') AND fetched_at>=?")
+        .get(Number(query), fresh);
+      if (row) return [this.publicView(row, JSON.parse(row.page_json))];
+    }
+    const words = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const wanted = String(tag).trim().toLowerCase();
+    const size = Math.min(Math.max(Number.parseInt(limit, 10) || 20, 1), MAX_RESULTS);
+    return this.db.prepare("SELECT * FROM servers WHERE status='listed' AND discovery='public' AND fetched_at>=?").all(fresh)
+      .map(row => ({ row, page: JSON.parse(row.page_json) }))
+      .filter(({ page }) => {
+        if (wanted && !page.tags.includes(wanted)) return false;
+        const haystack = [page.name, page.description, ...page.tags].join('\n').toLowerCase();
+        return words.every(word => haystack.includes(word));
+      })
+      .sort((a, b) => b.page.members.people - a.page.members.people || a.page.name.localeCompare(b.page.name))
+      .slice(0, size)
+      .map(({ row, page }) => this.publicView(row, page));
+  }
+
+  publicView(row, page) {
+    return { origin: row.origin, number: row.number, ...page, updatedAt: iso(row.fetched_at) };
+  }
+}

package/central/rules.mjs

@@ -0,0 +1,51 @@
+// The central server owns the account format. Chat servers and clients read the
+// published rule; they never define their own.
+
+// A username becomes the Matrix localpart on every chat server, so a central rule
+// can only narrow the characters Matrix allows in a localpart.
+export const MATRIX_LOCALPART = /^[a-z0-9._=\-/]+$/;
+const MAX_LOCALPART = 64;
+
+export const DEFAULT_USERNAME_RULE = Object.freeze({
+  pattern: '^[a-z][a-z0-9._-]*$',
+  minLength: 3,
+  maxLength: 32,
+  reserved: Object.freeze(['admin', 'root', 'system', 'dscord', 'central']),
+});
+
+function fail(message) {
+  throw new Error(`usernameRule: ${message}`);
+}
+
+/** The rule from central configuration, checked once at start. */
+export function usernameRule(input = {}) {
+  const rule = { ...DEFAULT_USERNAME_RULE, ...input };
+  if (typeof rule.pattern !== 'string' || !rule.pattern.startsWith('^') || !rule.pattern.endsWith('$')) fail('pattern must be anchored with ^ and $');
+  let expression;
+  try { expression = new RegExp(rule.pattern, 'u'); }
+  catch (error) { fail(`pattern does not compile: ${error.message}`); }
+  if (!Number.isSafeInteger(rule.minLength) || rule.minLength < 1) fail('minLength must be a positive integer');
+  if (!Number.isSafeInteger(rule.maxLength) || rule.maxLength < rule.minLength || rule.maxLength > MAX_LOCALPART) {
+    fail(`maxLength must be between minLength and ${MAX_LOCALPART}`);
+  }
+  if (!Array.isArray(rule.reserved) || rule.reserved.some(name => typeof name !== 'string')) fail('reserved must be a list of names');
+  const reserved = [...new Set(rule.reserved.map(name => name.toLowerCase()))].sort();
+  return Object.freeze({
+    pattern: rule.pattern, minLength: rule.minLength, maxLength: rule.maxLength, reserved: Object.freeze(reserved),
+    /** The stored (lowercase) username, or a reason it is refused. */
+    check(value) {
+      if (typeof value !== 'string') return { error: 'USERNAME_REQUIRED' };
+      const name = value.trim().toLowerCase();
+      if (name.length < rule.minLength || name.length > rule.maxLength) return { error: 'USERNAME_LENGTH' };
+      if (!MATRIX_LOCALPART.test(name) || !expression.test(name)) return { error: 'USERNAME_CHARACTERS' };
+      if (reserved.includes(name)) return { error: 'USERNAME_RESERVED' };
+      return { username: name };
+    },
+  });
+}
+
+/** What chat servers and clients see. */
+export function publicRule(rule) {
+  return { pattern: rule.pattern, minLength: rule.minLength, maxLength: rule.maxLength, reserved: [...rule.reserved],
+    charset: MATRIX_LOCALPART.source, caseInsensitive: true, immutable: true };
+}

package/central/service.mjs

@@ -0,0 +1,365 @@
+import { Avatars } from './avatars.mjs';
+import http from 'node:http';
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { localPath, packageRoot } from '../src/paths.mjs';
+import { readJsonBody } from '../src/http-json.mjs';
+import { Router } from '../src/core/router.mjs';
+import { usernameRule, publicRule } from './rules.mjs';
+import { CentralStore, failure } from './store.mjs';
+import { LISTING_MODES, ServerDirectory } from './directory.mjs';
+import { IDENTITY_TOKEN_TTL_SECONDS, loadSigningKey, publicJwks, signIdentityToken } from './tokens.mjs';
+
+const jsonHeaders = { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' };
+const loopback = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+function origin(value, name) {
+  let url;
+  try { url = new URL(String(value)); } catch { throw new Error(`${name} must be an absolute URL`); }
+  if (url.origin !== String(value).replace(/\/$/, '')) throw new Error(`${name} must be a bare origin without a path`);
+  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback.has(url.hostname))) throw new Error(`${name} must use HTTPS`);
+  return url.origin;
+}
+
+/** A chat server is named by its origin; anything else is refused before a token is issued. */
+function audienceOf(value) {
+  try { return origin(typeof value === 'string' ? value : '', 'audience'); }
+  catch { throw failure(400, 'AUDIENCE_INVALID', 'Name the chat server by its HTTPS origin'); }
+}
+
+function serverOrigin(value) {
+  try { return origin(typeof value === 'string' ? value : '', 'origin'); }
+  catch { throw failure(400, 'SERVER_ORIGIN_INVALID', 'Name the chat server by its HTTPS origin'); }
+}
+
+export function centralOptions(config = {}) {
+  const issuer = origin(config.issuer, 'issuer');
+  const domain = config.domain ?? new URL(issuer).hostname;
+  if (typeof domain !== 'string' || !/^[a-z0-9.-]+$/.test(domain)) throw new Error('domain must be a lowercase host name');
+  if (config.registration !== undefined && !['open', 'closed'].includes(config.registration)) throw new Error('registration must be open or closed');
+  if (config.listing !== undefined && !LISTING_MODES.includes(config.listing)) throw new Error('listing must be review or open');
+  const admins = (config.admins ?? []).map(name => String(name).trim().toLowerCase()).filter(Boolean);
+  const clientOrigins = (config.clientOrigins ?? []).map(value => origin(value, 'clientOrigins'));
+  const serverFetchUrls = Object.fromEntries(Object.entries(config.serverFetchUrls ?? {})
+    .map(([key, value]) => [origin(key, 'serverFetchUrls'), new URL(String(value)).href.replace(/\/$/, '')]));
+  return { issuer, domain, registration: config.registration ?? 'open', listing: config.listing ?? 'review', admins,
+    rule: usernameRule(config.usernameRule), clientOrigins, serverFetchUrls };
+}
+
+/**
+ * The saved configuration. On first start a deployment may seed it from the environment
+ * (DSCORD_CENTRAL_ISSUER, DSCORD_CENTRAL_REGISTRATION, DSCORD_CENTRAL_LISTING, DSCORD_CENTRAL_ADMINS, DSCORD_CENTRAL_CLIENT_ORIGINS,
+ * DSCORD_CENTRAL_SERVER_FETCH_URLS); after that the file is the configuration. Registration and listing are only the starting
+ * values: administrators change them in the panel, and the saved choice wins from then on.
+ */
+export async function loadConfig(dataRoot, env = process.env) {
+  const filename = env.DSCORD_CENTRAL_CONFIG_PATH || path.join(dataRoot, 'central-config.json');
+  try { return JSON.parse(await readFile(filename, 'utf8')); }
+  catch (error) { if (error.code !== 'ENOENT' || !env.DSCORD_CENTRAL_ISSUER) throw error; }
+  const list = value => (value || '').split(',').map(item => item.trim()).filter(Boolean);
+  const config = { issuer: env.DSCORD_CENTRAL_ISSUER, registration: env.DSCORD_CENTRAL_REGISTRATION || 'open',
+    listing: env.DSCORD_CENTRAL_LISTING || 'review', admins: list(env.DSCORD_CENTRAL_ADMINS), clientOrigins: list(env.DSCORD_CENTRAL_CLIENT_ORIGINS) };
+  // origin=fetch-url pairs, for chat servers whose public origin is not reachable from where central runs.
+  const fetchUrls = list(env.DSCORD_CENTRAL_SERVER_FETCH_URLS).map(pair => pair.split('=').map(part => part.trim()));
+  if (fetchUrls.length) config.serverFetchUrls = Object.fromEntries(fetchUrls);
+  centralOptions(config);
+  await writeFile(filename, JSON.stringify(config, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+  return config;
+}
+
+const REFRESH_INTERVAL_MS = 60 * 60 * 1000;
+
+const staticTypes = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8',
+  '.svg': 'image/svg+xml', '.txt': 'text/plain; charset=utf-8', '.woff2': 'font/woff2' };
+
+export async function createCentral({ dataRoot = localPath('central'), config, now = Date.now, fetch = globalThis.fetch,
+  refreshIntervalMs = REFRESH_INTERVAL_MS, adminWebRoot = process.env.DSCORD_CENTRAL_ADMIN_WEB_DIR || path.join(packageRoot, 'dist/central-admin') } = {}) {
+  await mkdir(dataRoot, { recursive: true, mode: 0o700 });
+  config ||= await loadConfig(dataRoot);
+  const options = centralOptions(config);
+  const key = await loadSigningKey(path.join(dataRoot, 'signing-key.json'));
+  const filename = path.join(dataRoot, 'central.sqlite');
+  const store = new CentralStore({ filename, rule: options.rule, domain: options.domain, now });
+  await chmod(filename, 0o600);
+  const avatars = new Avatars({ store, dataRoot, issuer: options.issuer, config: config.avatars });
+  const directory = new ServerDirectory({ db: store.db, issuer: options.issuer, now, fetch, fetchVia: options.serverFetchUrls });
+  const jwks = publicJwks(key);
+  const settings = () => ({ registration: store.setting('registration', options.registration), listing: store.setting('listing', options.listing) });
+  const discovery = {
+    issuer: options.issuer, domain: options.domain, registration: settings().registration,
+    usernameRule: publicRule(options.rule), globalIdFormat: `{username}@${options.domain}`,
+    jwksUri: `${options.issuer}/.well-known/jwks.json`, identityTokenTtlSeconds: IDENTITY_TOKEN_TTL_SECONDS,
+    deviceVerificationUri: `${options.issuer}/device`, serverIndexUri: `${options.issuer}/api/servers`,
+  };
+
+  const router = new Router();
+  const signedIn = request => {
+    const authorization = request.headers.authorization || '';
+    return store.authenticate(authorization.startsWith('Bearer ') ? authorization.slice(7) : '');
+  };
+  const person = request => {
+    const signed = signedIn(request);
+    if (signed.account.kind !== 'human') throw failure(403, 'HUMAN_REQUIRED');
+    return signed;
+  };
+
+  const administrator = request => {
+    const signed = person(request);
+    if (!options.admins.includes(signed.account.username)) throw failure(403, 'ADMIN_REQUIRED', 'This account does not administer this central');
+    return signed;
+  };
+
+  discovery.avatars = { maxUploadBytes: avatars.options.maxUploadBytes, sizes: avatars.options.sizes };
+  router.get('/.well-known/dscord/central', ({ send }) => send(200, discovery));
+  router.get('/.well-known/jwks.json', ({ send }) => send(200, jwks));
+
+  router.post('/api/register', async ({ body, send }) => {
+    if (settings().registration !== 'open') throw failure(403, 'REGISTRATION_CLOSED');
+    const input = await body();
+    const account = await store.createHuman(input);
+    send(201, { token: store.openSession(account, 'login', 'password'), account: store.view(account) });
+  });
+  router.post('/api/login', async ({ body, send }) => {
+    const input = await body();
+    const { token, account } = await store.login(input.username, input.password);
+    send(200, { token, account: store.view(account) });
+  });
+  router.post('/api/logout', ({ request, send }) => { store.closeSession(signedIn(request).session); send(200, { loggedOut: true }); });
+  router.get('/api/me', ({ request, send }) => send(200, { account: store.view(signedIn(request).account) }));
+  // People and Bots edit their own profile the same way; a Bot's owner can also rename it from the Bot's settings.
+  router.on('PATCH', '/api/me', async ({ request, body, send }) => {
+    const { account } = signedIn(request);
+    const input = await body();
+    send(200, { account: store.view(input.displayName === undefined ? account : store.rename(account, input.displayName)) });
+  });
+  router.delete('/api/me', ({ request, send }) => { store.closeAccount(person(request).account); send(200, { closed: true }); });
+
+  // Avatars are public identity images; edits require the account itself (a person or a Bot) or the Bot's owner.
+  router.get('/api/profiles', ({ url, response, send }) => {
+    response.setHeader('Access-Control-Allow-Origin', '*');
+    const ids = (url.searchParams.get('ids') || '').split(',').filter(Boolean);
+    if (ids.length > 100 || ids.some(id => id.length > 256)) throw failure(400, 'PROFILE_BATCH_LIMIT');
+    send(200, { profiles: [...new Set(ids)].flatMap(id => {
+      const account = store.account(id) || (id.endsWith(`@${options.domain}`) ? store.db.prepare('SELECT * FROM accounts WHERE username=?').get(id.slice(0, -(options.domain.length + 1))) : undefined);
+      return account?.status === 'active' ? [avatars.profile(account)] : [];
+    }) });
+  });
+  router.get(/^\/avatars\/([a-f0-9]{64})\/(\d+)\.webp$/, ({ response }, id, size) => avatars.serve(response, id, size));
+  for (const route of ['/api/me/avatar', /^\/api\/bots\/([^/]+)\/avatar$/]) {
+    const target = (request, id) => id ? store.ownedBot(person(request).account, id) : signedIn(request).account;
+    router.get(route, ({ request, send }, id) => send(200, { profile: avatars.profile(target(request, id)), maxUploadBytes: avatars.options.maxUploadBytes }));
+    router.on('PUT', route, async ({ request, url, send }, id) => {
+      const account = target(request, id);
+      const version = avatars.expected(account, url.searchParams.get('version'));
+      const asset = await avatars.upload(request, url.searchParams);
+      target(request, id); // Recheck authorization after decoding and writing.
+      send(200, { profile: avatars.commit(account, version, asset) });
+    });
+    router.delete(route, ({ request, url, send }, id) => {
+      const account = target(request, id);
+      send(200, { profile: avatars.commit(account, avatars.expected(account, url.searchParams.get('version')), null) });
+    });
+  }
+
+  // A person's own DSH signs in with a connection key made on a chat server's page; the key carries one of these codes.
+  router.post('/api/connect-codes', ({ request, send }) => send(201, store.startConnect(person(request).account)));
+  router.post('/api/connect-codes/redeem', async ({ body, send }) => {
+    const input = await body();
+    const label = typeof input.label === 'string' && input.label.trim() ? input.label.trim().slice(0, 80) : 'DSH';
+    const { token, account } = store.redeemConnect(input.code, label);
+    send(200, { token, account: store.view(account) });
+  });
+
+  // The one way to sign in to a chat server, for people and Bots alike.
+  router.post('/api/identity-tokens', async ({ request, body, send }) => {
+    const { account } = signedIn(request);
+    const input = await body();
+    const audience = audienceOf(input.audience);
+    store.grant(account, audience, { allowNew: input.allowNew === true });
+    const view = store.view(account);
+    const issuedAt = Math.floor(now() / 1000);
+    const claims = { iss: options.issuer, sub: account.id, aud: audience, iat: issuedAt, exp: issuedAt + IDENTITY_TOKEN_TTL_SECONDS,
+      jti: randomUUID(), username: view.username, gid: view.globalId, kind: view.kind, name: view.displayName,
+      ...(view.owner ? { owner: view.owner } : {}) };
+    send(200, { token: signIdentityToken(key, claims), expiresIn: IDENTITY_TOKEN_TTL_SECONDS, audience });
+  });
+  router.get('/api/grants', ({ request, send }) => send(200, { grants: store.grantsOf(signedIn(request).account) }));
+  router.delete(/^\/api\/grants\/([^/]+)$/, ({ request, send }, audience) => {
+    store.revokeGrant(signedIn(request).account, audienceOf(audience));
+    send(200, { revoked: true });
+  });
+
+  // A Bot is set up here, from any chat server's page, and the device that runs it follows.
+  router.post('/api/bots', async ({ request, body, send }) => {
+    const { account } = person(request);
+    send(201, { bot: store.managedBot(store.createBot(account, await body(), { serverOrigin })) });
+  });
+  router.get('/api/bots', ({ request, send }) => send(200, { bots: store.botsOf(person(request).account).map(bot => store.managedBot(bot)) }));
+  router.on('PATCH', /^\/api\/bots\/([^/]+)$/, async ({ request, body, send }, botId) => {
+    const { account } = person(request);
+    send(200, { bot: store.managedBot(store.updateBot(account, store.ownedBot(account, botId), await body(), { serverOrigin })) });
+  });
+  router.delete(/^\/api\/bots\/([^/]+)$/, ({ request, send }, botId) => {
+    store.closeAccount(store.ownedBot(person(request).account, botId));
+    send(200, { closed: true });
+  });
+  router.get(/^\/api\/bots\/([^/]+)\/grants$/, ({ request, send }, botId) =>
+    send(200, { grants: store.grantsOf(store.ownedBot(person(request).account, botId)) }));
+  router.delete(/^\/api\/bots\/([^/]+)\/grants\/([^/]+)$/, ({ request, send }, botId, audience) => {
+    store.revokeGrant(store.ownedBot(person(request).account, botId), audienceOf(audience));
+    send(200, { revoked: true });
+  });
+  router.get(/^\/api\/bots\/([^/]+)\/nodes$/, ({ request, send }, botId) =>
+    send(200, { nodes: store.nodesOf(store.ownedBot(person(request).account, botId)) }));
+  router.delete(/^\/api\/bots\/([^/]+)\/nodes\/([^/]+)$/, ({ request, send }, botId, nodeId) => {
+    store.revokeNode(store.ownedBot(person(request).account, botId), nodeId);
+    send(200, { revoked: true });
+  });
+
+  // The person's DSH devices. Each reports every few seconds and is told which Bots to run and how.
+  router.get('/api/devices', ({ request, send }) => send(200, { devices: store.devicesOf(person(request).account) }));
+  router.post(/^\/api\/devices\/([^/]+)\/sync$/, async ({ request, body, send }, deviceId) => {
+    const { account, session } = person(request);
+    send(200, store.syncDevice(account, session, deviceId, await body()));
+  });
+  router.delete(/^\/api\/devices\/([^/]+)$/, ({ request, send }, deviceId) => {
+    store.removeDevice(person(request).account, deviceId);
+    send(200, { removed: true });
+  });
+
+  // A Bot has no password: its owner approves a node by the code the node shows.
+  router.post('/api/device', async ({ body, send }) => {
+    const input = await body();
+    const label = typeof input.label === 'string' && input.label.trim() ? input.label.trim().slice(0, 80) : 'DSH node';
+    send(200, { ...store.startDevice(label), verificationUri: discovery.deviceVerificationUri, interval: 5 });
+  });
+  router.post('/api/device/approve', async ({ request, body, send }) => {
+    const { account } = person(request);
+    const input = await body();
+    const { bot, label } = store.approveDevice(account, input.userCode, input.botId);
+    send(200, { bot: store.view(bot), label });
+  });
+  router.post('/api/device/token', async ({ body, send }) => {
+    const { token, account } = store.redeemDevice((await body()).deviceCode);
+    send(200, { token, account: store.view(account) });
+  });
+
+  // The server index. Anyone may search it, and any chat server may submit itself; this central's administrators decide what is listed.
+  router.get('/api/servers', ({ url, response, send }) => {
+    response.setHeader('Access-Control-Allow-Origin', '*');
+    send(200, { servers: directory.search(Object.fromEntries(url.searchParams)) });
+  });
+  router.post('/api/servers', async ({ body, send }) =>
+    send(200, { server: await directory.submit(serverOrigin((await body()).origin), { review: settings().listing === 'review' }) }));
+
+  // The administrators named in the configuration run this central from its panel at /admin.
+  router.get('/api/admin/overview', ({ request, send }) => {
+    const { account } = administrator(request);
+    send(200, { account: store.view(account), issuer: options.issuer, settings: settings(), servers: directory.counts(), accounts: store.accountCounts() });
+  });
+  router.post('/api/admin/settings', async ({ request, body, send }) => {
+    administrator(request);
+    const input = await body();
+    if (input.registration !== undefined) {
+      if (!['open', 'closed'].includes(input.registration)) throw failure(400, 'REGISTRATION_INVALID');
+      store.saveSetting('registration', input.registration);
+    }
+    if (input.listing !== undefined) {
+      if (!LISTING_MODES.includes(input.listing)) throw failure(400, 'LISTING_INVALID');
+      store.saveSetting('listing', input.listing);
+    }
+    discovery.registration = settings().registration;
+    send(200, { settings: settings() });
+  });
+  router.get('/api/admin/servers', ({ request, url, send }) => {
+    administrator(request);
+    send(200, { servers: directory.list({ status: url.searchParams.get('status') || '' }) });
+  });
+  router.post(/^\/api\/admin\/servers\/([^/]+)\/decision$/, async ({ request, body, send }, value) => {
+    administrator(request);
+    const input = await body();
+    send(200, { server: directory.decide(serverOrigin(value), input.status, input.note ?? '') });
+  });
+  router.post(/^\/api\/admin\/servers\/([^/]+)\/refresh$/, async ({ request, send }, value) => {
+    administrator(request);
+    const server = serverOrigin(value);
+    directory.existing(server);
+    send(200, { server: directory.adminView(await directory.refresh(server)) });
+  });
+  router.delete(/^\/api\/admin\/servers\/([^/]+)$/, ({ request, send }, value) => {
+    administrator(request);
+    directory.remove(serverOrigin(value));
+    send(200, { removed: true });
+  });
+  router.get('/api/admin/accounts', ({ request, url, send }) => {
+    administrator(request);
+    send(200, { accounts: store.accounts(Object.fromEntries(url.searchParams)) });
+  });
+  router.post(/^\/api\/admin\/accounts\/([^/]+)\/(disable|enable)$/, ({ request, send }, id, action) => {
+    const { account } = administrator(request);
+    if (id === account.id) throw failure(409, 'ADMIN_SELF', 'An administrator cannot disable their own account');
+    send(200, { account: store.view(store.setDisabled(id, action === 'disable')) });
+  });
+
+  // The panel itself: a static single-page app.
+  router.get(/^\/admin(\/.*)?$/, async ({ response }, rest = '/') => {
+    const relative = path.normalize(rest === '/' || !path.extname(rest) ? '/index.html' : rest);
+    let bytes;
+    try { bytes = await readFile(path.join(adminWebRoot, relative)); }
+    catch (error) { if (error.code === 'ENOENT' || error.code === 'EISDIR') throw failure(404, 'NOT_FOUND', 'Not found'); throw error; }
+    response.writeHead(200, { 'Content-Type': staticTypes[path.extname(relative)] || 'application/octet-stream',
+      'Cache-Control': relative === '/index.html' ? 'no-store' : 'public, max-age=31536000, immutable', 'X-Content-Type-Options': 'nosniff',
+      'X-Frame-Options': 'DENY', 'Referrer-Policy': 'no-referrer' });
+    response.end(bytes);
+  });
+
+  function cors(request, response) {
+    const from = request.headers.origin;
+    if (!from || !options.clientOrigins.includes(from)) return;
+    response.setHeader('Access-Control-Allow-Origin', from);
+    response.setHeader('Vary', 'Origin');
+    response.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+    response.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE');
+  }
+
+  async function dispatch(request, response) {
+    const url = new URL(request.url, 'http://localhost');
+    const send = (status, value) => { response.writeHead(status, jsonHeaders); response.end(JSON.stringify(value)); };
+    cors(request, response);
+    if (request.method === 'OPTIONS') { response.writeHead(204, { 'Cache-Control': 'no-store' }); response.end(); return; }
+    const route = router.match(request.method, url.pathname);
+    if (!route) return send(404, { error: 'Not found', code: 'NOT_FOUND' });
+    return route.handler({ request, response, url, send, body: () => readJsonBody(request) }, ...route.params);
+  }
+
+  const server = http.createServer((request, response) => {
+    dispatch(request, response).catch(error => {
+      if (response.headersSent || response.destroyed) { response.destroy(); return; }
+      const status = error.status || 500;
+      response.writeHead(status, jsonHeaders);
+      response.end(JSON.stringify({ error: status === 500 ? 'Internal error' : error.message, code: error.code || 'REQUEST_FAILED' }));
+      if (status === 500) console.error(error);
+    });
+  });
+  let refreshing = Promise.resolve();
+  const timer = refreshIntervalMs > 0 ? setInterval(() => {
+    refreshing = refreshing.then(() => directory.refreshAll()).catch(error => console.error(error));
+  }, refreshIntervalMs) : undefined;
+  timer?.unref();
+  return { server, store, avatars, directory, discovery, jwks, settings, close: async () => {
+    clearInterval(timer);
+    await new Promise(resolve => server.close(resolve));
+    await refreshing;
+    store.close();
+  } };
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || '').href) {
+  const central = await createCentral({ dataRoot: process.env.DSCORD_CENTRAL_DATA_DIR || localPath('central') });
+  const port = Number(process.env.DSCORD_CENTRAL_PORT || 18200);
+  const host = process.env.DSCORD_CENTRAL_HOST || '127.0.0.1';
+  central.server.listen(port, host, () => console.log(`DSCord Central ready at http://${host}:${port} (issuer ${central.discovery.issuer})`));
+  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, async () => { await central.close(); process.exit(0); });
+}