dsh-claude-design 2.4.0 → 2.5.0

package/skills/claude-design/scripts/server.mjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 // claude-design: local editor server (prebuilt; do not edit).
 
-import fs5 from "node:fs";
-import path4 from "node:path";
+import fs7 from "node:fs";
+import path6 from "node:path";
 
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import fs4 from "node:fs";
+import { createHash as createHash2, randomBytes, randomUUID } from "node:crypto";
+import fs6 from "node:fs";
 import fsp2 from "node:fs/promises";
 import http from "node:http";
-import path3 from "node:path";
+import path5 from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { spawn } from "node:child_process";
@@ -18,6 +18,9 @@ import os from "node:os";
 var COMMENTS_FILE = "comments.json";
 var COMMENTS_VERSION = 1;
 var LIMITS = { text: 1e4, label: 1e3, detail: 4e3, anchor: 2048, section: 200, name: 100 };
+function sameAuthor(a, b) {
+  return a.kind === "user" && b.kind === "user" && (a.principal ?? "") === (b.principal ?? "");
+}
 var CommentsError = class extends Error {
   code;
   status;
@@ -88,7 +91,10 @@ function parseDoc(text) {
   const threads = data.threads.filter(
     (t) => isRecord(t) && typeof t.id === "string" && typeof t.anchor === "string" && typeof t.label === "string" && (t.status === "open" || t.status === "resolved") && Array.isArray(t.messages) && t.messages.every((m) => isRecord(m) && typeof m.text === "string" && isRecord(m.author) && (m.author.kind === "user" || m.author.kind === "agent"))
   );
-  for (const t of threads) if (!isRecord(t.location)) t.location = {};
+  for (const t of threads) {
+    if (!isRecord(t.location)) t.location = {};
+    for (const m of t.messages) if (m.author.principal !== void 0 && typeof m.author.principal !== "string") delete m.author.principal;
+  }
   return { version: COMMENTS_VERSION, threads };
 }
 var formatDoc = (doc) => `${JSON.stringify(doc, null, 2)}
@@ -127,10 +133,10 @@ function addMessage(thread, author, text, now) {
   }
   return message;
 }
-function editMessage(thread, messageId, text, now) {
+function editMessage(thread, messageId, text, now, by) {
   const message = thread.messages.find((m) => m.id === messageId);
   if (!message) throw new CommentsError("MESSAGE_NOT_FOUND", `No message ${messageId} in ${thread.id}.`, 404);
-  if (message.author.kind !== "user") throw new CommentsError("MESSAGE_NOT_EDITABLE", "Only your own messages can be edited.", 403);
+  if (message.author.kind !== "user" || by && !sameAuthor(message.author, by)) throw new CommentsError("MESSAGE_NOT_EDITABLE", "Only your own messages can be edited.", 403);
   if (message.text !== text) {
     message.text = text;
     message.editedAt = now;
@@ -332,9 +338,10 @@ function defaultUserName() {
 function createCommentsService(options) {
   const { root, log, agentHook } = options;
   const userName = (options.userName ?? defaultUserName()).slice(0, 100);
-  const user = { kind: "user", name: userName };
+  const owner = { author: { kind: "user", name: userName }, canComment: true, canSend: true, admin: true };
+  const viewerOf = options.viewer ?? (() => owner);
   const allowWrite = options.allowWrite ?? (() => true);
-  const clients = /* @__PURE__ */ new Set();
+  const clients = /* @__PURE__ */ new Map();
   const waiters = [];
   const hookRunning = /* @__PURE__ */ new Set();
   const requests = [];
@@ -354,9 +361,19 @@ function createCommentsService(options) {
     const hook = Boolean(agentHook);
     return { available: listening || busy || hook || at - lastWaitEnded < AGENT_GRACE_MS, listening, busy, hook };
   }
-  async function snapshot() {
+  const meOf = (viewer) => ({
+    name: viewer.author.name,
+    ...viewer.author.principal ? { principal: viewer.author.principal } : {},
+    canComment: viewer.canComment,
+    canSend: viewer.canSend,
+    admin: viewer.admin
+  });
+  async function shared() {
     lastDoc = await readComments(root);
-    return { threads: lastDoc.threads, agent: presence(), me: { name: userName } };
+    return { threads: lastDoc.threads, agent: presence() };
+  }
+  async function snapshot(viewer) {
+    return { ...await shared(), me: meOf(viewer) };
   }
   const frame = (snap) => `event: comments
 data: ${JSON.stringify(snap)}
@@ -365,18 +382,18 @@ data: ${JSON.stringify(snap)}
   function broadcast() {
     queue = queue.then(async () => {
       if (closed) return;
-      let snap;
+      let base;
       try {
-        snap = await snapshot();
+        base = await shared();
       } catch (error) {
         log(`comments: reading ${COMMENTS_FILE} failed: ${error.message}`);
         return;
       }
-      const text = frame(snap);
-      lastPresence = JSON.stringify(snap.agent);
+      const text = JSON.stringify(base);
+      lastPresence = JSON.stringify(base.agent);
       if (text === lastSent) return;
       lastSent = text;
-      for (const client of clients) client.write(text);
+      for (const [client, viewer] of clients) client.write(frame({ ...base, me: meOf(viewer) }));
     });
     return queue;
   }
@@ -532,16 +549,21 @@ data: ${JSON.stringify(snap)}
     await broadcast();
     if (sent) await deliver();
   }
-  async function create(request, response) {
+  function need(allowed, message) {
+    if (!allowed) throw new CommentsError("NOT_ALLOWED", message, 403);
+  }
+  const ONLY_OWNER_SENDS = "Only the owner can send comments to the agent.";
+  async function create(request, response, viewer) {
     const input = readNewThread(await readJson(request));
     if (!input) throw new CommentsError("INVALID_COMMENT", "expected {anchor, label, text} with a non-empty text");
+    need(!input.send || viewer.canSend, ONLY_OWNER_SENDS);
     let location = {};
     try {
       location = await options.locate?.(input) ?? {};
     } catch (error) {
       log(`comments: could not resolve where a comment points: ${error.message}`);
     }
-    const created = await updateComments(root, (doc) => addThread(doc, input, location, user, now()));
+    const created = await updateComments(root, (doc) => addThread(doc, input, location, viewer.author, now()));
     log(`comments: ${created.id} added on ${created.label}${location.file ? ` (${location.file})` : ""}${input.send ? ", sent to the agent" : ""}`);
     sendJson(response, 201, { thread: created });
     await afterChange(Boolean(input.send));
@@ -556,7 +578,7 @@ data: ${JSON.stringify(snap)}
     sendJson(response, 202, { request: queued });
     await deliver();
   }
-  async function events(request, response) {
+  async function events(request, response, viewer) {
     response.writeHead(200, {
       "Content-Type": "text/event-stream; charset=utf-8",
       "Cache-Control": "no-store",
@@ -564,8 +586,8 @@ data: ${JSON.stringify(snap)}
       "X-Accel-Buffering": "no"
     });
     response.write(": connected\n\n");
-    response.write(frame(await snapshot()));
-    clients.add(response);
+    response.write(frame(await snapshot(viewer)));
+    clients.set(response, viewer);
     const keepAlive = setInterval(() => response.write(": ping\n\n"), SSE_KEEPALIVE_MS);
     keepAlive.unref?.();
     response.on("close", () => {
@@ -601,14 +623,26 @@ data: ${JSON.stringify(snap)}
         request.resume();
         throw new CommentsError("NOT_ALLOWED", "cross-origin request", 403);
       }
+      const viewer = viewerOf(request);
+      if (!viewer) {
+        request.resume();
+        throw new CommentsError("NOT_ALLOWED", "not shared with you", 403);
+      }
+      const commenting = !reading && parts[0] !== "agent" && parts[1] !== "send";
+      if (commenting && !viewer.canComment) {
+        request.resume();
+        throw new CommentsError("NOT_ALLOWED", "You can read the comments here, not add or change them.", 403);
+      }
       if (parts.length === 0) {
-        if (reading) return sendJson(response, 200, await snapshot());
-        if (method === "POST") return await create(request, response);
+        if (reading) return sendJson(response, 200, await snapshot(viewer));
+        if (method === "POST") return await create(request, response, viewer);
       } else if (parts.length === 1 && parts[0] === "events") {
-        if (reading) return await events(request, response);
+        if (reading) return await events(request, response, viewer);
       } else if (parts.length === 2 && parts[0] === "agent" && parts[1] === "wait") {
+        need(viewer.canSend, "Only the owner's agent waits for comments.");
         if (reading) return await wait(request, response, url);
       } else if (parts.length === 2 && parts[0] === "agent" && parts[1] === "requests") {
+        need(viewer.canSend, ONLY_OWNER_SENDS);
         if (method === "POST") return await ask(request, response);
       } else if (parts.length === 1) {
         const id = parts[0];
@@ -627,6 +661,8 @@ data: ${JSON.stringify(snap)}
         if (method === "DELETE") {
           await updateComments(root, (doc) => {
             const found = findThread(doc, id);
+            const first = found.messages[0];
+            need(viewer.admin || first !== void 0 && sameAuthor(first.author, viewer.author), "Only the person who started this comment, or the owner, can delete it.");
             doc.threads.splice(doc.threads.indexOf(found), 1);
           });
           log(`comments: ${id} deleted`);
@@ -638,9 +674,10 @@ data: ${JSON.stringify(snap)}
           const id = parts[0];
           const input = readReply(await readJson(request));
           if (!input) throw new CommentsError("INVALID_COMMENT", "expected {text} with a non-empty text");
+          need(!input.send || viewer.canSend, ONLY_OWNER_SENDS);
           const t = await updateComments(root, (doc) => {
             const found = findThread(doc, id);
-            addMessage(found, user, input.text, now());
+            addMessage(found, viewer.author, input.text, now());
             if (input.send) sendToAgent(found, now());
             return found;
           });
@@ -654,9 +691,10 @@ data: ${JSON.stringify(snap)}
           const messageId = parts[2];
           const input = readEdit(await readJson(request));
           if (!input) throw new CommentsError("INVALID_COMMENT", "expected {text} with a non-empty text");
+          need(!input.send || viewer.canSend, ONLY_OWNER_SENDS);
           const t = await updateComments(root, (doc) => {
             const found = findThread(doc, id);
-            editMessage(found, messageId, input.text, now());
+            editMessage(found, messageId, input.text, now(), viewer.author);
             if (input.send && canSendToAgent(found)) sendToAgent(found, now());
             return found;
           });
@@ -668,6 +706,7 @@ data: ${JSON.stringify(snap)}
         if (method === "POST") {
           const id = parts[0];
           request.resume();
+          need(viewer.canSend, ONLY_OWNER_SENDS);
           const t = await updateComments(root, (doc) => {
             const found = findThread(doc, id);
             if (!canSendToAgent(found)) throw new CommentsError("NOTHING_TO_SEND", "the agent already has everything in this comment", 409);
@@ -696,13 +735,15 @@ data: ${JSON.stringify(snap)}
     clearTimeout(debounce);
     watcher?.close();
     for (const waiter of [...waiters]) finishWaiter(waiter, { threads: [], closed: true });
-    for (const client of clients) client.end();
+    for (const client of clients.keys()) client.end();
     clients.clear();
   }
   return { handle, presence, deliver, close };
 }
 
 import fs3 from "node:fs";
+import net from "node:net";
+import os2 from "node:os";
 import path2 from "node:path";
 var STATE_FILE = ".artifact-server.json";
 function readState(root) {
@@ -749,6 +790,54 @@ async function listen(server2, port, host) {
   const address = server2.address();
   return typeof address === "object" && address ? address.port : port;
 }
+var DEFAULT_PORTS = { slides: 4710, design: 4720, "design-system": 4730, dashboard: 4740, docs: 4750, motion: 4760 };
+var PORT_TRIES = 100;
+var PortsTaken = class extends Error {
+  code = "PORT_IN_USE";
+  from;
+  to;
+  constructor(from, to) {
+    super(`${from === to ? `Port ${from} is` : `Ports ${from} to ${to} are all`} in use; pick another --port (0 takes any free one).`);
+    this.from = from;
+    this.to = to;
+  }
+};
+function lanAddresses() {
+  const out = [];
+  for (const list of Object.values(os2.networkInterfaces())) {
+    for (const entry of list ?? []) if (entry.family === "IPv4" && !entry.internal && !entry.address.startsWith("169.254.")) out.push(entry.address);
+  }
+  return [...new Set(out)];
+}
+function answers(host, port) {
+  return new Promise((resolve) => {
+    const socket = net.connect({ host, port });
+    const done = (taken) => {
+      socket.destroy();
+      resolve(taken);
+    };
+    socket.setTimeout(300, () => done(true));
+    socket.once("connect", () => done(true));
+    socket.once("error", (error) => done(!["ECONNREFUSED", "EADDRNOTAVAIL", "ENETUNREACH", "EHOSTUNREACH"].includes(error.code ?? "")));
+  });
+}
+async function listenFree(server2, from, host, first) {
+  if (from === 0) return listen(server2, 0, host);
+  const to = Math.min(from + PORT_TRIES - 1, 65535);
+  const range = Array.from({ length: to - from + 1 }, (_, i) => from + i);
+  const ports = first ? [first, ...range.filter((port) => port !== first)] : range;
+  const wildcard = host === "0.0.0.0" || host === "::";
+  const probes = [.../* @__PURE__ */ new Set([...wildcard ? [] : [host], "127.0.0.1", "::1", ...lanAddresses()])];
+  for (const port of ports) {
+    if ((await Promise.all(probes.map((address) => answers(address, port)))).some(Boolean)) continue;
+    try {
+      return await listen(server2, port, host);
+    } catch (error) {
+      if (error.code !== "EADDRINUSE") throw error;
+    }
+  }
+  throw new PortsTaken(from, to);
+}
 function serverOrigin(host, port) {
   const shown = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host.includes(":") ? `[${host}]` : host;
   return `http://${shown}:${port}`;
@@ -813,6 +902,575 @@ function sendFile(request, response, file, headers) {
 }
 var errorText = (error) => error instanceof Error ? error.message : String(error);
 
+import { createHash } from "node:crypto";
+import fs5 from "node:fs";
+import os3 from "node:os";
+import path4 from "node:path";
+
+import crypto from "node:crypto";
+import fs4 from "node:fs";
+import path3 from "node:path";
+var GUEST_ROLES = ["editor", "commenter", "viewer"];
+var isGuestRole = (value) => typeof value === "string" && GUEST_ROLES.includes(value);
+var SHARING_FILE = ".sharing.json";
+var MAX_GUESTS = 200;
+var MAX_NAME = 40;
+var token = (bytes = 18) => crypto.randomBytes(bytes).toString("base64url");
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function fresh() {
+  return { lan: false, links: { editor: { token: token(), on: true }, commenter: { token: token(), on: true }, viewer: { token: token(), on: true } }, guests: [] };
+}
+function cleanName(raw) {
+  const name = typeof raw === "string" ? raw.replace(/[\u0000-\u001f\u007f@<>]/g, "").replace(/\s+/g, " ").trim() : "";
+  return [...name].slice(0, MAX_NAME).join("");
+}
+function guestUser(guest) {
+  return { id: `guest-${guest.id}`, name: guest.name, email: `${guest.name}@${guest.id}.guest` };
+}
+function isLoopback(address) {
+  if (!address) return false;
+  const a = address.startsWith("::ffff:") ? address.slice(7) : address;
+  return a === "::1" || a.startsWith("127.");
+}
+var Sharing = class _Sharing {
+  file;
+  state;
+  constructor(root) {
+    this.file = path3.join(root, SHARING_FILE);
+    this.state = _Sharing.read(this.file);
+  }
+  static read(file) {
+    let raw;
+    try {
+      raw = JSON.parse(fs4.readFileSync(file, "utf8"));
+    } catch {
+      return fresh();
+    }
+    const state = fresh();
+    if (!isRecord2(raw)) return state;
+    state.lan = raw.lan === true;
+    if (typeof raw.port === "number" && Number.isInteger(raw.port) && raw.port > 0 && raw.port < 65536) state.port = raw.port;
+    if (isRecord2(raw.links)) {
+      for (const role of GUEST_ROLES) {
+        const link = raw.links[role];
+        if (isRecord2(link) && typeof link.token === "string" && link.token.length >= 16) state.links[role] = { token: link.token, on: link.on !== false };
+      }
+    }
+    if (Array.isArray(raw.guests)) {
+      for (const g of raw.guests) {
+        if (!isRecord2(g) || typeof g.id !== "string" || typeof g.secret !== "string" || !isGuestRole(g.role) || typeof g.link !== "string") continue;
+        state.guests.push({
+          id: g.id,
+          secret: g.secret,
+          name: cleanName(g.name) || "Guest",
+          role: g.role,
+          link: g.link,
+          joined: typeof g.joined === "string" ? g.joined : (/* @__PURE__ */ new Date(0)).toISOString(),
+          ...typeof g.seen === "string" ? { seen: g.seen } : {}
+        });
+      }
+    }
+    return state;
+  }
+  save() {
+    const tmp = `${this.file}.${process.pid}.tmp`;
+    fs4.writeFileSync(tmp, `${JSON.stringify(this.state, null, 2)}
+`, { mode: 384 });
+    fs4.renameSync(tmp, this.file);
+  }
+  /** The role whose link has this token, while that link is on. */
+  linkRole(tokenGiven) {
+    for (const role of GUEST_ROLES) {
+      const link = this.state.links[role];
+      if (link.on && tokenGiven.length === link.token.length && crypto.timingSafeEqual(Buffer.from(tokenGiven), Buffer.from(link.token))) return role;
+    }
+    return null;
+  }
+  /** The guest a cookie names, if they still have access (their link on and not reset). */
+  guest(secret) {
+    if (!secret) return null;
+    const guest = this.state.guests.find((g) => g.secret === secret);
+    return guest && this.valid(guest) ? guest : null;
+  }
+  valid(guest) {
+    const link = this.state.links[guest.role];
+    return link.on && link.token === guest.link && this.state.guests.includes(guest);
+  }
+  join(role, name) {
+    const guest = { id: token(4), secret: token(24), name: cleanName(name) || "Guest", role, link: this.state.links[role].token, joined: (/* @__PURE__ */ new Date()).toISOString() };
+    this.state.guests.push(guest);
+    if (this.state.guests.length > MAX_GUESTS) this.state.guests.splice(0, this.state.guests.length - MAX_GUESTS);
+    this.save();
+    return guest;
+  }
+  /** Marks a guest seen now (saved at most once a minute per guest). */
+  seen(guest) {
+    const now = /* @__PURE__ */ new Date();
+    if (guest.seen && now.getTime() - Date.parse(guest.seen) < 6e4) return;
+    guest.seen = now.toISOString();
+    this.save();
+  }
+  setLan(on, port) {
+    this.state.lan = on;
+    if (on && port) this.state.port = port;
+    this.save();
+  }
+  setLink(role, on) {
+    this.state.links[role].on = on;
+    this.save();
+  }
+  /** A new token for the link: the old link stops working and the guests who came through it are dropped. */
+  resetLink(role) {
+    const old = this.state.links[role].token;
+    this.state.links[role] = { token: token(), on: this.state.links[role].on };
+    this.state.guests = this.state.guests.filter((g) => g.link !== old);
+    this.save();
+  }
+  /**
+   * Gives a guest another role. They now hang on that role's link (turning it off or resetting it drops them), so a role
+   * whose link is off would shut them out: false then, as for a guest who isn't there.
+   */
+  setRole(id, role) {
+    const guest = this.state.guests.find((g) => g.id === id);
+    if (!guest || !this.state.links[role].on) return false;
+    guest.role = role;
+    guest.link = this.state.links[role].token;
+    this.save();
+    return true;
+  }
+  removeGuest(id) {
+    const before = this.state.guests.length;
+    this.state.guests = this.state.guests.filter((g) => g.id !== id);
+    if (this.state.guests.length === before) return false;
+    this.save();
+    return true;
+  }
+};
+
+var NOUNS = {
+  docs: { en: "doc", zh: "\u6587\u6863", zhThis: "\u8FD9\u7BC7\u6587\u6863" },
+  slides: { en: "deck", zh: "\u6F14\u793A\u6587\u7A3F", zhThis: "\u8FD9\u4EFD\u6F14\u793A\u6587\u7A3F" },
+  design: { en: "design", zh: "\u8BBE\u8BA1\u7A3F", zhThis: "\u8FD9\u4EFD\u8BBE\u8BA1\u7A3F" },
+  "design-system": { en: "design system", zh: "\u8BBE\u8BA1\u7CFB\u7EDF", zhThis: "\u8FD9\u4E2A\u8BBE\u8BA1\u7CFB\u7EDF" },
+  dashboard: { en: "dashboard", zh: "\u4EEA\u8868\u76D8", zhThis: "\u8FD9\u4E2A\u4EEA\u8868\u76D8" },
+  motion: { en: "animation", zh: "\u52A8\u753B", zhThis: "\u8FD9\u4E2A\u52A8\u753B" }
+};
+var ShareError = class extends Error {
+};
+var canEditAs = (role) => role === "owner" || role === "editor";
+function commentsViewer(viewer) {
+  return {
+    author: viewer.guest ? { kind: "user", name: viewer.user.name, principal: viewer.user.email } : { kind: "user", name: viewer.user.name },
+    canComment: viewer.role !== "viewer",
+    canSend: viewer.role === "owner",
+    admin: viewer.role === "owner"
+  };
+}
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var esc = (text) => text.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+var script = (value) => JSON.stringify(value).replace(/</g, "\\u003c");
+function ownHosts(host, port) {
+  const named = host === "0.0.0.0" || host === "::" ? [] : [host.includes(":") ? `[${host}]:${port}` : `${host}:${port}`];
+  return [.../* @__PURE__ */ new Set([`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`, ...named])];
+}
+function localOwner() {
+  let name = "You";
+  try {
+    name = os3.userInfo().username.trim() || name;
+  } catch {
+  }
+  return { id: "local", name, email: `${name}@localhost` };
+}
+var guestCookieName = (kind, root) => `${kind.replace(/-/g, "_")}_guest_${createHash("sha256").update(path4.resolve(root)).digest("hex").slice(0, 12)}`;
+var ShareHost = class {
+  sharing;
+  options;
+  /** The port the server listens on (set by `listening`); the LAN listeners take the same one. */
+  port = 0;
+  hosts = /* @__PURE__ */ new Set();
+  /** One listener per LAN address while the artifact is open to the network. */
+  lanServers = /* @__PURE__ */ new Map();
+  live = /* @__PURE__ */ new Set();
+  constructor(options) {
+    this.options = options;
+    this.sharing = new Sharing(options.root);
+  }
+  /**
+   * Starts `server` on the first free port from `port` (a shared artifact tries the port its links were given out with
+   * first, so they keep working, unless the port was given), shares it on the network with `lan` (or as it was left)
+   * and answers the port taken. If this throws, the caller closes what it started.
+   */
+  async listen(server2, { port, host, lan = false, portGiven = false }) {
+    const { state } = this.sharing;
+    const linksPort = !portGiven && (lan || state.lan) && state.port ? state.port : void 0;
+    const taken = await listenFree(server2, port, host, linksPort);
+    if (linksPort && taken !== linksPort) this.options.log(`port ${linksPort} (the shared links') is in use; took ${taken}: give the new links out again`);
+    else if (!linksPort && port && taken !== port) this.options.log(`port ${port} is in use; took ${taken}`);
+    if (lan && !this.sharing.state.lan) this.sharing.setLan(true, taken);
+    await this.listening(taken, ownHosts(host, taken));
+    return taken;
+  }
+  /** The artifact at each LAN address it is shared on ([] while it is not). */
+  lanUrls() {
+    return [...this.lanServers.keys()].map((a) => `http://${a}:${this.port}/`);
+  }
+  /** The main listener is up on `port` (answering `hosts`): open to the network now if the artifact was left shared. */
+  async listening(port, hosts) {
+    this.port = port;
+    this.hosts = new Set(hosts);
+    if (this.sharing.state.lan) await this.setLan(true);
+  }
+  /** Open to the local network now. */
+  get shared() {
+    return this.lanServers.size > 0;
+  }
+  /** A Host header this server answers: its own names, and while shared, its LAN addresses and machine name. */
+  hostAllowed(request) {
+    const host = request.headers.host ?? "";
+    if (this.hosts.has(host)) return true;
+    if (!this.lanServers.size) return false;
+    const suffix = `:${this.port}`;
+    if (!host.endsWith(suffix)) return false;
+    const name = host.slice(0, -suffix.length).toLowerCase();
+    const machine = os3.hostname().toLowerCase();
+    return this.lanServers.has(name) || name === machine || name === `${machine.replace(/\.local$/, "")}.local`;
+  }
+  /**
+   * Opens the artifact to the local network (a listener on each LAN address, on the server's port) or closes it.
+   * Returns the addresses it listens on. Guests already in keep their place for when it opens again.
+   */
+  async setLan(on) {
+    if (!on) {
+      this.closeLan();
+      for (const live of [...this.live]) if (live.viewer.guest) live.close("unshared");
+      if (this.sharing.state.lan) this.sharing.setLan(false);
+      return [];
+    }
+    for (const address of lanAddresses()) {
+      if (this.lanServers.has(address)) continue;
+      const server2 = this.options.createServer();
+      try {
+        await listen(server2, this.port, address);
+        this.lanServers.set(address, server2);
+      } catch (error) {
+        server2.close();
+        this.options.log(`not listening on ${address}:${this.port}: ${error.message}`);
+      }
+    }
+    if (!this.sharing.state.lan || this.sharing.state.port !== this.port) this.sharing.setLan(true, this.port);
+    this.options.log(`shared on the local network: ${[...this.lanServers.keys()].map((a) => `http://${a}:${this.port}/`).join(", ") || "(no LAN address)"}`);
+    return [...this.lanServers.keys()];
+  }
+  closeLan() {
+    for (const server2 of this.lanServers.values()) {
+      server2.close();
+      server2.closeAllConnections?.();
+    }
+    this.lanServers.clear();
+  }
+  /** Stops the LAN listeners (the server closes its own). */
+  close() {
+    this.closeLan();
+  }
+  // ---- who is asking ---------------------------------------------------------------------------------------------
+  cookie(request) {
+    for (const part of (request.headers.cookie ?? "").split(";")) {
+      const eq = part.indexOf("=");
+      if (eq > 0 && part.slice(0, eq).trim() === this.options.cookieName) return part.slice(eq + 1).trim();
+    }
+    return void 0;
+  }
+  /**
+   * Who a request is: the owner over loopback, a guest by their cookie (while their link is on and the artifact is
+   * shared), else nobody. Loopback is always the owner, so trying a link on this computer can't lock the owner out of
+   * their own artifact; a guest comes over a LAN address (this computer's own included: that is how the owner sees
+   * what a role sees).
+   */
+  viewerOf(request) {
+    if (isLoopback(request.socket.remoteAddress)) return { role: "owner", user: this.options.owner };
+    const guest = this.lanServers.size ? this.sharing.guest(this.cookie(request)) : null;
+    if (!guest) return null;
+    this.sharing.seen(guest);
+    return { role: guest.role, user: guestUser(guest), guest };
+  }
+  /** Keeps track of a stream or socket `viewer` holds open; call the returned function when it closes. */
+  attach(viewer, close) {
+    const live = { viewer, close };
+    this.live.add(live);
+    return () => this.live.delete(live);
+  }
+  /** `attach` for an HTTP stream (server-sent events): it ends when its person loses access. */
+  hold(viewer, response) {
+    const detach = this.attach(viewer, () => response.end());
+    response.on("close", detach);
+  }
+  /** Still allowed in: the owner, or a guest whose link is on and who was not removed. */
+  stillIn(viewer) {
+    return !viewer.guest || this.shared && this.sharing.valid(viewer.guest);
+  }
+  /** Ends the streams of guests who lost access (a link turned off or reset, a guest removed). */
+  dropRevoked() {
+    for (const live of [...this.live]) if (live.viewer.guest && !this.sharing.valid(live.viewer.guest)) live.close("revoked");
+  }
+  me(viewer) {
+    return { role: viewer.role, id: viewer.user.id, name: viewer.user.name, email: viewer.user.email };
+  }
+  // ---- routes ----------------------------------------------------------------------------------------------------
+  /** Answers the share link and /__share paths; false for any other path. */
+  async route(request, response) {
+    const p = new URL(request.url ?? "/", "http://local").pathname;
+    const method = request.method ?? "GET";
+    const link = /^\/s\/([A-Za-z0-9_-]{16,64})$/.exec(p);
+    const ours = link || p === "/__share" || p.startsWith("/__share/");
+    if (!ours) return false;
+    if (method === "POST" && !sameOrigin(request)) {
+      request.resume();
+      sendJson2(response, 403, { code: "not_granted", message: "Cross-origin write refused." });
+      return true;
+    }
+    if (link) {
+      if (method === "GET" || method === "POST") await this.join(request, response, method, link[1]);
+      else response.writeHead(405, { Allow: "GET, POST" }).end();
+      return true;
+    }
+    const viewer = this.viewerOf(request);
+    if (!viewer) {
+      this.denied(request, response);
+      return true;
+    }
+    if (method === "GET" && p === "/__share/me") return sendJson2(response, 200, this.me(viewer)), true;
+    if (method === "GET" && p === "/__share/boot.js") {
+      const body = this.bootScript(viewer);
+      response.writeHead(200, { "Content-Type": "text/javascript; charset=utf-8", "Content-Length": Buffer.byteLength(body), "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" }).end(body);
+      return true;
+    }
+    if (method === "GET" && p === "/__share/invite") return sendJson2(response, 200, this.invites(viewer, request.headers.host ?? "")), true;
+    if (method === "GET" && p === "/__share/ui.js") {
+      fs5.stat(this.options.uiFile, (error, stat) => {
+        if (error || !stat.isFile()) return sendJson2(response, 404, { code: "not_found", message: "The Share panel is missing." });
+        sendFile(request, response, this.options.uiFile, { "Content-Type": "text/javascript; charset=utf-8", "Content-Length": stat.size, "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" });
+      });
+      return true;
+    }
+    if (viewer.role !== "owner") return sendJson2(response, 403, { code: "not_granted", message: "Only the owner can do this." }), true;
+    if (p === "/__share") return await this.shareApi(request, response, method), true;
+    sendJson2(response, 404, { code: "not_found", message: "Not found" });
+    return true;
+  }
+  /** The tags a page puts first in its <head>: the boot script and the Share panel (the owner's, or a guest's). */
+  headTags(_viewer) {
+    let tags = '<script src="/__share/boot.js"></script>';
+    if (fs5.existsSync(this.options.uiFile)) tags += '<script type="module" src="/__share/ui.js"></script>';
+    return tags;
+  }
+  /** `html` with the head tags first in its <head>; null when it has none. */
+  injectHead(html, viewer) {
+    const at = html.search(/<head(\s[^>]*)?>/i);
+    if (at < 0) return null;
+    const end = html.indexOf(">", at) + 1;
+    return html.slice(0, end) + this.headTags(viewer) + html.slice(end);
+  }
+  /** What the page runs before anything else (see SECURE_CONTEXT_SHIM and GUEST_WATCH). */
+  bootScript(viewer) {
+    const share = { ...this.me(viewer), noun: this.options.noun, title: this.options.title(), ...this.options.reactions ? { reactions: true } : {} };
+    let js = `${SECURE_CONTEXT_SHIM}window.__baoyuShare=${script(share)};`;
+    for (const [name, value] of Object.entries(this.options.globals?.(viewer) ?? {})) js += `window[${script(name)}]=${script(value)};`;
+    if (viewer.guest) js += GUEST_WATCH;
+    return js;
+  }
+  /** Nobody's request: a page for a browser's navigation, JSON for anything else. */
+  denied(request, response) {
+    request.resume();
+    const navigation = (request.method === "GET" || request.method === "HEAD") && /\btext\/html\b/.test(request.headers.accept ?? "");
+    if (!navigation) return sendJson2(response, 403, { code: "not_granted", message: `This ${this.options.noun.en} is not shared with you.` });
+    const t = this.words(request);
+    this.sendPage(response, 403, t.noAccessTitle, `<h1>${esc(t.noAccessTitle)}</h1><p>${esc(t.noAccess)}</p>${this.ownerHint(request, t)}`);
+  }
+  /** A small page of our own (the join form, the refusal), in the reader's language. */
+  sendPage(response, status, title, body, headers = {}) {
+    const html = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${esc(title)}</title><style>${PAGE_CSS}</style></head><body><main>${body}</main></body></html>`;
+    response.writeHead(status, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store",
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'",
+      ...headers
+    }).end(html);
+  }
+  /** On the computer that shares the artifact, over its LAN address: the way back to the owner's page. */
+  ownerHint(request, t) {
+    const from = (request.socket.remoteAddress ?? "").replace(/^::ffff:/, "");
+    if (!this.lanServers.has(from)) return "";
+    const url = `http://127.0.0.1:${this.port}/`;
+    return `<p class="note">${esc(t.ownerHere)} <a href="${esc(url)}">${esc(url)}</a></p>`;
+  }
+  /** GET /s/<token>: the name form (or straight in, for a guest already in through this link); POST: join. */
+  async join(request, response, method, token2) {
+    const t = this.words(request);
+    const role = this.sharing.linkRole(token2);
+    const local = isLoopback(request.socket.remoteAddress);
+    const form = method === "POST" ? await readBody(request, 8 << 10).then((body) => body.toString("utf8"), () => "") : "";
+    const title = this.options.title();
+    if (!role || !local && !this.lanServers.size) return this.sendPage(response, 404, t.linkGoneTitle, `<h1>${esc(t.linkGoneTitle)}</h1><p>${esc(t.linkGone)}</p>`);
+    if (local) {
+      const lan = [...this.lanServers.keys()][0];
+      const there = lan ? `http://${lan}:${this.port}/s/${token2}` : "";
+      const tryIt = there ? `<p>${esc(t.tryRole(t.roles[role]))} <a href="${esc(there)}">${esc(there)}</a></p>` : "";
+      return this.sendPage(response, 200, title, `<h1>${esc(title)}</h1><p>${esc(t.youOwn)} <a href="/">${esc(t.openAsOwner)}</a></p>${tryIt}`);
+    }
+    const current = this.sharing.guest(this.cookie(request));
+    if (method === "GET" && current && current.link === this.sharing.state.links[role].token) {
+      response.writeHead(303, { Location: "/", "Cache-Control": "no-store" }).end();
+      return;
+    }
+    if (method === "GET") {
+      return this.sendPage(
+        response,
+        200,
+        title,
+        `<h1>${esc(title)}</h1><p>${esc(t.invited(t.roles[role]))}</p><form method="post"><label for="n">${esc(t.yourName)}</label><input id="n" name="name" maxlength="${MAX_NAME}" value="${esc(current?.name ?? "")}" required autofocus autocomplete="name"><button type="submit">${esc(t.open)}</button></form><p class="note">${esc(t.nameNote)}</p>`
+      );
+    }
+    const name = new URLSearchParams(form).get("name") ?? "";
+    const guest = this.sharing.join(role, name);
+    this.options.log(`share: ${guest.name} joined as ${role} (${request.socket.remoteAddress})`);
+    const cookie = `${this.options.cookieName}=${guest.secret}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000`;
+    response.writeHead(303, { Location: "/", "Set-Cookie": cookie, "Cache-Control": "no-store" }).end();
+  }
+  /**
+   * The links this person may pass on: their own role's and the ones below it that are on (the owner: every one on), at
+   * the address they came by (`host`, a Host header hostAllowed let in). A guest could forward the link they joined
+   * with anyway; a lower one gives no more than that. Who joins through one shows in the owner's panel like anyone else.
+   */
+  invites(viewer, host) {
+    const { links } = this.sharing.state;
+    const from = viewer.role === "owner" ? 0 : GUEST_ROLES.indexOf(viewer.role);
+    return { links: GUEST_ROLES.slice(from).filter((role) => links[role].on).map((role) => ({ role, url: `http://${host}/s/${links[role].token}` })) };
+  }
+  /** Links, addresses and people, for the share panel and `artifact.mjs share`. */
+  shareView() {
+    const addresses = [...this.lanServers.keys()];
+    const base = addresses.length ? `http://${addresses[0]}:${this.port}` : `http://127.0.0.1:${this.port}`;
+    const online = /* @__PURE__ */ new Set();
+    for (const live of this.live) if (live.viewer.guest) online.add(live.viewer.guest.id);
+    const { links, guests } = this.sharing.state;
+    return {
+      title: this.options.title(),
+      lan: this.lanServers.size > 0,
+      port: this.port,
+      addresses,
+      local: `http://127.0.0.1:${this.port}/`,
+      links: Object.fromEntries(GUEST_ROLES.map((role) => [role, { on: links[role].on, url: `${base}/s/${links[role].token}` }])),
+      guests: guests.filter((g) => this.sharing.valid(g) || links[g.role].token === g.link).map((g) => ({ id: g.id, name: g.name, role: g.role, joined: g.joined, ...g.seen ? { seen: g.seen } : {}, online: online.has(g.id), active: this.sharing.valid(g) }))
+    };
+  }
+  /**
+   * The owner's sharing calls: `lan` {on}, `link` {role, on}, `reset` {role} (a new link: the old one and the guests
+   * who came through it stop working), `role` {guest, role} (a guest's role, while that role's link is on), `remove`
+   * {guest}. Answers the view after.
+   */
+  async share(action) {
+    const role = action.role;
+    switch (action.action) {
+      case "lan": {
+        const addresses = await this.setLan(action.on === true);
+        if (action.on === true && !addresses.length) throw new ShareError("This computer has no local network address to share on.");
+        break;
+      }
+      case "link":
+        if (!isGuestRole(role)) throw new ShareError("role: editor, commenter or viewer");
+        this.sharing.setLink(role, action.on === true);
+        break;
+      case "reset":
+        if (!isGuestRole(role)) throw new ShareError("role: editor, commenter or viewer");
+        this.sharing.resetLink(role);
+        break;
+      case "role": {
+        if (!isGuestRole(role)) throw new ShareError("role: editor, commenter or viewer");
+        if (typeof action.guest !== "string" || !this.sharing.state.guests.some((g) => g.id === action.guest)) throw new ShareError("no such guest");
+        if (!this.sharing.setRole(action.guest, role)) throw new ShareError(`The ${role} link is off: turn it on first.`);
+        for (const live of [...this.live]) if (live.viewer.guest?.id === action.guest) live.close("revoked");
+        break;
+      }
+      case "remove":
+        if (typeof action.guest !== "string" || !this.sharing.removeGuest(action.guest)) throw new ShareError("no such guest");
+        break;
+      default:
+        throw new ShareError("action: lan, link, reset, role or remove");
+    }
+    this.options.log(`share: ${JSON.stringify(action)}`);
+    this.dropRevoked();
+    return this.shareView();
+  }
+  async shareApi(request, response, method) {
+    if (method === "GET") return sendJson2(response, 200, this.shareView());
+    if (method !== "POST") return sendJson2(response, 405, { code: "method_not_allowed", message: `${method} is not allowed here.` });
+    let action;
+    try {
+      action = JSON.parse((await readBody(request, 64 << 10)).toString("utf8"));
+    } catch {
+      return sendJson2(response, 400, { code: "invalid_argument", message: "The call is not JSON." });
+    }
+    if (!isRecord3(action)) return sendJson2(response, 400, { code: "invalid_argument", message: "Expected {action, ...}." });
+    try {
+      return sendJson2(response, 200, await this.share(action));
+    } catch (error) {
+      if (error instanceof ShareError) return sendJson2(response, 400, { code: "invalid_argument", message: error.message });
+      throw error;
+    }
+  }
+  words(request) {
+    const zh = /^zh\b/i.test(request.headers["accept-language"] ?? "");
+    return (zh ? ZH : EN)(this.options.noun);
+  }
+};
+var SECURE_CONTEXT_SHIM = "if(window.crypto&&!crypto.randomUUID)crypto.randomUUID=function(){var b=crypto.getRandomValues(new Uint8Array(16)),h='',i;b[6]=b[6]&15|64;b[8]=b[8]&63|128;for(i=0;i<16;i++){h+=(b[i]+256).toString(16).slice(1);if(i==3||i==5||i==7||i==9)h+='-'}return h};";
+var GUEST_WATCH = "setInterval(function(){fetch('/__share/me',{cache:'no-store'}).then(function(r){if(r.status===403)return location.reload();return r.json().then(function(m){if(m&&m.role&&m.role!==window.__baoyuShare.role)location.reload()})},function(){})},5000);";
+var PAGE_CSS = `
+:root { color-scheme: light dark; --bg: #f7f6f3; --card: #fff; --fg: #1f1e1d; --muted: #6b6a66; --line: #e3e1dc; --accent: #c96442; }
+@media (prefers-color-scheme: dark) { :root { --bg: #1f1e1d; --card: #2a2927; --fg: #f2f1ee; --muted: #a8a6a0; --line: #3a3936; } }
+* { box-sizing: border-box; }
+body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: var(--bg); color: var(--fg); font: 15px/1.5 system-ui, -apple-system, "PingFang SC", "Microsoft YaHei", sans-serif; padding: 16px; }
+main { width: min(420px, 100%); background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 28px; }
+h1 { font-size: 20px; margin: 0 0 8px; word-break: break-word; }
+p { margin: 0 0 16px; color: var(--muted); }
+label { display: block; font-size: 13px; margin: 0 0 6px; color: var(--muted); }
+input { width: 100%; font: inherit; padding: 9px 11px; border: 1px solid var(--line); border-radius: 8px; background: transparent; color: inherit; margin: 0 0 14px; }
+button { width: 100%; font: inherit; font-weight: 600; padding: 10px; border: 0; border-radius: 8px; background: var(--accent); color: #fff; cursor: pointer; }
+.note { font-size: 12px; margin: 14px 0 0; }
+a { color: var(--accent); overflow-wrap: anywhere; }
+`;
+var EN = (noun) => ({
+  noAccessTitle: "No access",
+  noAccess: `This ${noun.en} is not shared with you. Ask its owner for a link.`,
+  linkGoneTitle: "This link does not work",
+  linkGone: `The link was turned off or replaced, or the ${noun.en} is no longer shared. Ask its owner for a new one.`,
+  invited: (what) => `You were invited to ${what} this ${noun.en}.`,
+  yourName: "Your name (others see it on your comments and edits)",
+  open: `Open the ${noun.en}`,
+  nameNote: "This browser keeps your place; the owner can remove it at any time.",
+  roles: { editor: "edit", commenter: "comment on", viewer: "view" },
+  youOwn: `This is your ${noun.en}: on this computer you are its owner.`,
+  openAsOwner: "Open it",
+  tryRole: (what) => `To see it as someone invited to ${what} it does, open the link at the network address, here or on another device:`,
+  ownerHere: `You are on the computer that shares this ${noun.en}. Open it as the owner at`
+});
+var ZH = (noun) => ({
+  noAccessTitle: "\u65E0\u6743\u8BBF\u95EE",
+  noAccess: `${noun.zhThis}\u6CA1\u6709\u5206\u4EAB\u7ED9\u4F60\u3002\u8BF7\u5411\u6240\u6709\u8005\u8981\u4E00\u4E2A\u94FE\u63A5\u3002`,
+  linkGoneTitle: "\u94FE\u63A5\u5DF2\u5931\u6548",
+  linkGone: `\u8FD9\u4E2A\u94FE\u63A5\u5DF2\u88AB\u5173\u95ED\u6216\u91CD\u7F6E\uFF0C\u6216\u8005${noun.zhThis}\u5DF2\u505C\u6B62\u5206\u4EAB\u3002\u8BF7\u5411\u6240\u6709\u8005\u8981\u4E00\u4E2A\u65B0\u94FE\u63A5\u3002`,
+  invited: (what) => `\u4F60\u88AB\u9080\u8BF7${what}${noun.zhThis}\u3002`,
+  yourName: "\u4F60\u7684\u540D\u5B57\uFF08\u522B\u4EBA\u4F1A\u5728\u4F60\u7684\u8BC4\u8BBA\u548C\u7F16\u8F91\u4E0A\u770B\u5230\u5B83\uFF09",
+  open: `\u6253\u5F00${noun.zh}`,
+  nameNote: "\u8FD9\u4E2A\u6D4F\u89C8\u5668\u4F1A\u8BB0\u4F4F\u4F60\u7684\u8EAB\u4EFD\uFF1B\u6240\u6709\u8005\u53EF\u4EE5\u968F\u65F6\u79FB\u9664\u3002",
+  roles: { editor: "\u7F16\u8F91", commenter: "\u8BC4\u8BBA", viewer: "\u67E5\u770B" },
+  youOwn: `\u8FD9\u662F\u4F60\u7684${noun.zh}\uFF1A\u5728\u8FD9\u53F0\u7535\u8111\u4E0A\u4F60\u662F\u6240\u6709\u8005\u3002`,
+  openAsOwner: `\u6253\u5F00${noun.zh}`,
+  tryRole: (what) => `\u60F3\u770B\u770B\u53D7\u9080${what}\u7684\u4EBA\u770B\u5230\u4EC0\u4E48\uFF0C\u7528\u5C40\u57DF\u7F51\u5730\u5740\u6253\u5F00\u8FD9\u4E2A\u94FE\u63A5\uFF08\u5728\u8FD9\u53F0\u7535\u8111\u6216\u522B\u7684\u8BBE\u5907\u4E0A\u90FD\u884C\uFF09\uFF1A`,
+  ownerHere: `\u4F60\u5728\u5206\u4EAB${noun.zhThis}\u7684\u7535\u8111\u4E0A\u3002\u4EE5\u6240\u6709\u8005\u8EAB\u4EFD\u6253\u5F00\uFF1A`
+});
+
 var KIND = "";
 var NOUN = "";
 var INDEX_FILE = "";
@@ -903,7 +1561,8 @@ var SSE_KEEPALIVE_MS2 = 25e3;
 var WATCH_DEBOUNCE_MS2 = 300;
 var POLL_MS2 = 2e3;
 var CHANGE_LOG_SIZE = 64;
-var sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var CLIENT_ID = /^[A-Za-z0-9_-]{8,64}$/;
+var sha256 = (bytes) => createHash2("sha256").update(bytes).digest("hex");
 function contentTypeOf(file) {
   const ext = file.slice(file.lastIndexOf(".") + 1).toLowerCase();
   return MIME[ext] ?? "application/octet-stream";
@@ -951,7 +1610,7 @@ async function collectFiles(root, limit) {
   const seen = /* @__PURE__ */ new Set();
   let truncated = false;
   const visit = async (relDir, descend) => {
-    const dir = relDir === "" ? root : path3.join(root, ...relDir.split("/"));
+    const dir = relDir === "" ? root : path5.join(root, ...relDir.split("/"));
     let entries;
     try {
       entries = await fsp2.readdir(dir, { withFileTypes: true });
@@ -982,8 +1641,8 @@ async function collectFiles(root, limit) {
   return { rels, truncated };
 }
 async function writeFileAtomic(file, bytes) {
-  await fsp2.mkdir(path3.dirname(file), { recursive: true });
-  const tmp = path3.join(path3.dirname(file), `.${path3.basename(file)}.${randomUUID()}.tmp`);
+  await fsp2.mkdir(path5.dirname(file), { recursive: true });
+  const tmp = path5.join(path5.dirname(file), `.${path5.basename(file)}.${randomUUID()}.tmp`);
   try {
     await fsp2.writeFile(tmp, bytes);
     await fsp2.rename(tmp, file);
@@ -1025,11 +1684,11 @@ var Store = class {
   async diskPath(rel) {
     const realRoot = await fsp2.realpath(this.root).catch(() => null);
     if (realRoot === null) return null;
-    const file = path3.join(realRoot, ...rel.split("/"));
-    for (let dir = path3.dirname(file); ; dir = path3.dirname(dir)) {
+    const file = path5.join(realRoot, ...rel.split("/"));
+    for (let dir = path5.dirname(file); ; dir = path5.dirname(dir)) {
       const real = await fsp2.realpath(dir).catch(() => null);
       if (real === null) {
-        if (path3.dirname(dir) === dir) return null;
+        if (path5.dirname(dir) === dir) return null;
         continue;
       }
       if (real !== dir) return null;
@@ -1142,7 +1801,7 @@ var Store = class {
   }
   async findBlobFile(id) {
     try {
-      const names = await fsp2.readdir(path3.join(this.root, LAYOUT.blobDir));
+      const names = await fsp2.readdir(path5.join(this.root, LAYOUT.blobDir));
       const name = names.find((n) => n.startsWith(`${id}.`) && !n.endsWith(".tmp"));
       if (name === void 0) return null;
       const file = await this.diskPath(`${LAYOUT.blobDir}/${name}`);
@@ -1197,13 +1856,13 @@ function watchArtifact(store, onChange, onError) {
     const directories = /* @__PURE__ */ new Map();
     const visit = (rel, descend) => {
       if (directories.size >= maxDirectories) return;
-      const dir = rel === "" ? store.root : path3.join(store.root, ...rel.split("/"));
-      if (directories.has(dir) || !fs4.existsSync(dir)) return;
-      const info = fs4.lstatSync(dir);
+      const dir = rel === "" ? store.root : path5.join(store.root, ...rel.split("/"));
+      if (directories.has(dir) || !fs6.existsSync(dir)) return;
+      const info = fs6.lstatSync(dir);
       if (!info.isDirectory()) return;
       directories.set(dir, `${info.dev}:${info.ino}`);
       if (!descend) return;
-      for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
+      for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
         const child = rel === "" ? entry.name : `${rel}/${entry.name}`;
         if (LAYOUT.descendInto(child)) visit(child, true);
@@ -1220,19 +1879,19 @@ function watchArtifact(store, onChange, onError) {
       if (watchers.has(dir)) continue;
       let watcher;
       try {
-        watcher = fs4.watch(dir, (event, name) => {
+        watcher = fs6.watch(dir, (event, name) => {
           if (stopped) return;
           if (name) {
-            const changed = path3.join(dir, String(name));
+            const changed = path5.join(dir, String(name));
             if (event === "rename" && watchers.has(changed)) {
               for (const [watchedDir, item] of watchers) {
-                if (watchedDir === changed || watchedDir.startsWith(changed + path3.sep)) {
+                if (watchedDir === changed || watchedDir.startsWith(changed + path5.sep)) {
                   item.watcher.close();
                   watchers.delete(watchedDir);
                 }
               }
             }
-            const rel = path3.relative(store.root, changed).split(path3.sep).join("/");
+            const rel = path5.relative(store.root, changed).split(path5.sep).join("/");
             if (isIgnoredPath(rel) || !LAYOUT.watches(rel)) return;
           }
           schedule();
@@ -1266,7 +1925,7 @@ function watchArtifact(store, onChange, onError) {
     const { rels } = await collectFiles(store.root, LAYOUT.maxFiles);
     const parts = [];
     for (const rel of rels) {
-      const info = await fsp2.lstat(path3.join(store.root, ...rel.split("/"))).catch(() => null);
+      const info = await fsp2.lstat(path5.join(store.root, ...rel.split("/"))).catch(() => null);
       parts.push(info ? `${rel}\0${info.size}\0${info.mtimeMs}\0${info.ino}` : `${rel}\0-`);
     }
     return parts.join("\n");
@@ -1295,23 +1954,39 @@ function watchArtifact(store, onChange, onError) {
   };
 }
 var publishError = (response, status, code, message) => sendJson2(response, status, { code, message });
-async function startServer({ root, port = 0, host = "127.0.0.1", log = (line) => process.stderr.write(`${line}
-`), agentHook }) {
-  const project = path3.join(root, "project");
+async function startServer({ root, port = DEFAULT_PORTS[KIND], host = "127.0.0.1", log = (line) => process.stderr.write(`${line}
+`), agentHook, lan = false, portGiven = false }) {
+  const project = path5.join(root, "project");
   const stamp = (line) => log(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${line}`);
   const projectDir = await fsp2.realpath(project);
   const store = new Store(projectDir, stamp);
+  const owner = localOwner();
+  const share = new ShareHost({
+    root,
+    cookieName: guestCookieName(KIND, root),
+    owner,
+    noun: NOUNS[KIND] ?? { en: NOUN, zh: NOUN, zhThis: NOUN },
+    title: () => artifactTitle(root, projectDir),
+    log: stamp,
+    createServer: () => http.createServer(handle),
+    uiFile: path5.join(EDITOR_DIR, "share-ui.js")
+  });
   const comments = createCommentsService({
     root,
     log: stamp,
     locate: commentLocation ? (input) => commentLocation(input, projectDir) : void 0,
     agentHook,
-    allowWrite: sameOrigin
+    userName: owner.name,
+    allowWrite: sameOrigin,
+    viewer: (request) => {
+      const viewer = share.viewerOf(request);
+      return viewer ? commentsViewer(viewer) : null;
+    }
   });
   const grant = randomBytes(24).toString("base64url");
   const editorPath = `/${KIND}/${grant}/`;
   const boot = randomBytes(6).toString("hex");
-  const clients = /* @__PURE__ */ new Set();
+  const clients = /* @__PURE__ */ new Map();
   const changes = [];
   let changeSeq = 0;
   const pageCache = /* @__PURE__ */ new Map();
@@ -1321,18 +1996,23 @@ event: ${event.type}
 data: ${JSON.stringify(event)}
 
 `;
+  const changed = (event, from) => {
+    changeSeq += 1;
+    changes.push({ seq: changeSeq, paths: event.paths, ...from ? { from } : {} });
+    if (changes.length > CHANGE_LOG_SIZE) changes.shift();
+    for (const [client, id] of clients) if (!from || id !== from) client.write(frame(event));
+  };
   const stopWatch = watchArtifact(
     store,
     (event) => {
-      changeSeq += 1;
-      changes.push({ seq: changeSeq, paths: event.paths });
-      if (changes.length > CHANGE_LOG_SIZE) changes.shift();
       stamp(`changed on disk: ${event.paths.join(", ")}${clients.size ? "" : " (no page open)"}`);
-      for (const client of clients) client.write(frame(event));
+      changed(event);
     },
     (error) => stamp(`watching failed: ${errorText(error)}`)
   );
-  const events = async (request, response) => {
+  const events = async (request, response, viewer) => {
+    const given = new URL(request.url ?? "/", "http://local").searchParams.get("client") ?? "";
+    const client = CLIENT_ID.test(given) ? given : "";
     response.writeHead(200, {
       "Content-Type": "text/event-stream; charset=utf-8",
       "Cache-Control": "no-store",
@@ -1342,16 +2022,18 @@ data: ${JSON.stringify(event)}
     response.write(": connected\n\n");
     const last = /^([0-9a-f]+)\.(\d+)$/.exec(String(request.headers["last-event-id"] ?? ""));
     const missedSince = last && last[1] === boot ? Number(last[2]) : null;
-    if (missedSince !== null && missedSince < changeSeq) {
-      const missed = changes.filter((c) => c.seq > missedSince);
-      const paths = [...new Set((missed.length ? missed : changes).flatMap((c) => c.paths))];
+    const truncated = missedSince !== null && changes.length > 0 && changes[0].seq > missedSince + 1;
+    const missed = missedSince === null ? [] : truncated ? changes : changes.filter((c) => c.seq > missedSince && (!client || c.from !== client));
+    if (missed.length) {
+      const paths = [...new Set(missed.flatMap((c) => c.paths))];
       response.write(frame({ type: "external-change", paths, ver: (await store.listing()).ver }));
     } else {
       response.write(`id: ${eventId()}
 
 `);
     }
-    clients.add(response);
+    clients.set(response, client);
+    share.hold(viewer, response);
     const keepAlive = setInterval(() => response.write(": ping\n\n"), SSE_KEEPALIVE_MS2);
     keepAlive.unref?.();
     const done = () => {
@@ -1381,11 +2063,11 @@ data: ${JSON.stringify(event)}
       "Content-Security-Policy": DATA_CSP
     });
   };
-  const serveEditor = async (request, response, rest) => {
+  const serveEditor = async (request, response, rest, viewer) => {
     const parts = rest === "" ? ["index.html"] : rest.split("/");
     const invalid = parts.some((p) => p === "" || p === "." || p === ".." || p.startsWith(".") || p.includes("\\")) || parts[0] === "node";
     const realDist = invalid ? null : await fsp2.realpath(EDITOR_DIR).catch(() => null);
-    const file = realDist === null ? null : path3.join(realDist, ...parts);
+    const file = realDist === null ? null : path5.join(realDist, ...parts);
     const real = file === null ? null : await fsp2.realpath(file).catch(() => null);
     const info = real === null ? null : await fsp2.lstat(real).catch(() => null);
     if (file === null || real !== file || !info?.isFile()) {
@@ -1396,25 +2078,26 @@ data: ${JSON.stringify(event)}
       response.writeHead(404, { "Cache-Control": "no-store" }).end();
       return;
     }
-    const ext = path3.extname(file).toLowerCase();
+    const ext = path5.extname(file).toLowerCase();
     const type = STATIC_TYPES[ext] ?? "application/octet-stream";
     if (ext === ".html") {
       const key = parts.join("/");
       let page = pageCache.get(key);
       if (!page || page.mtimeMs !== info.mtimeMs) {
         const html = await fsp2.readFile(file, "utf8");
-        page = { mtimeMs: info.mtimeMs, body: Buffer.from(html), csp: pageCsp(pageScriptSrc(html)) };
+        page = { mtimeMs: info.mtimeMs, html, csp: pageCsp(pageScriptSrc(html)) };
         pageCache.set(key, page);
       }
+      const body = Buffer.from(share.injectHead(page.html, viewer) ?? page.html);
       response.writeHead(200, {
         "Content-Type": type,
-        "Content-Length": page.body.length,
+        "Content-Length": body.length,
         "Cache-Control": "no-cache",
         "X-Content-Type-Options": "nosniff",
         "Referrer-Policy": "no-referrer",
         "Content-Security-Policy": page.csp
       });
-      response.end(request.method === "HEAD" ? void 0 : page.body);
+      response.end(request.method === "HEAD" ? void 0 : body);
       return;
     }
     sendFile(request, response, file, {
@@ -1445,6 +2128,10 @@ data: ${JSON.stringify(event)}
     const names = Object.keys(files).map((p) => p.replace(/^project\//, ""));
     stamp(`saved from the page (${outcome.status}${outcome.body.code ? ` ${outcome.body.code}` : ""}): ${names.join(", ")}`);
     sendJson2(response, outcome.status, outcome.body);
+    if (outcome.status === 200 && clients.size > 0) {
+      const from = String(request.headers["x-deck-client"] ?? "");
+      changed({ type: "external-change", paths: Object.keys(files), ver: String(outcome.body.version ?? "") }, CLIENT_ID.test(from) ? from : void 0);
+    }
   };
   const upload = async (request, response) => {
     const contentType = request.headers["content-type"] ?? "application/octet-stream";
@@ -1458,9 +2145,18 @@ data: ${JSON.stringify(event)}
     stamp(`uploaded from the page: ${result.url} (${contentType}, ${bytes.length} bytes)`);
     sendJson2(response, 200, result);
   };
-  const route = async (request, response, rest) => {
+  const session = (viewer) => {
+    const extras = sessionExtras();
+    if (viewer.guest && "userName" in extras) extras.userName = viewer.user.name;
+    return { canEdit: canEditAs(viewer.role), ...extras, role: viewer.role };
+  };
+  const route = async (request, response, rest, viewer) => {
     const method = request.method ?? "GET";
-    if (rest === COMMENTS_ROUTE || rest.startsWith(`${COMMENTS_ROUTE}/`)) return comments.handle(request, response, rest.slice(COMMENTS_ROUTE.length));
+    if (rest === COMMENTS_ROUTE || rest.startsWith(`${COMMENTS_ROUTE}/`)) {
+      const sub = rest.slice(COMMENTS_ROUTE.length);
+      if (sub === "/events") share.hold(viewer, response);
+      return comments.handle(request, response, sub);
+    }
     if (rest === ROUTES.publish || rest === ROUTES.assets) {
       if (method !== "POST") {
         response.writeHead(405, { Allow: "POST" }).end();
@@ -1471,6 +2167,11 @@ data: ${JSON.stringify(event)}
         publishError(response, 403, "not_writer", "cross-origin request");
         return;
       }
+      if (!canEditAs(viewer.role)) {
+        request.resume();
+        publishError(response, 403, "not_writer", `You can view this ${NOUN} but not edit it.`);
+        return;
+      }
       if (rest === ROUTES.publish) await publish(request, response);
       else await upload(request, response);
       return;
@@ -1480,8 +2181,8 @@ data: ${JSON.stringify(event)}
       return;
     }
     if (rest === ROUTES.listing) return sendJson2(response, 200, await store.listing());
-    if (rest === ROUTES.session) return sendJson2(response, 200, { canEdit: true, ...sessionExtras() });
-    if (rest === ROUTES.events) return events(request, response);
+    if (rest === ROUTES.session) return sendJson2(response, 200, session(viewer));
+    if (rest === ROUTES.events) return events(request, response, viewer);
     if (rest.startsWith("project/")) {
       const bytes = await store.readProjectFile(rest);
       if (bytes === null) {
@@ -1500,7 +2201,7 @@ data: ${JSON.stringify(event)}
     }
     const blob = BLOB_PATH.exec(rest);
     if (blob) return serveBlob(request, response, blob[1]);
-    return serveEditor(request, response, rest);
+    return serveEditor(request, response, rest, viewer);
   };
   const guard = async (response, work) => {
     try {
@@ -1515,17 +2216,25 @@ data: ${JSON.stringify(event)}
       else response.destroy();
     }
   };
-  const server2 = http.createServer((request, response) => {
-    const url2 = new URL(request.url ?? "/", "http://localhost");
-    const pathname = url2.pathname;
-    if (pathname === "/" || pathname === "/index.html") {
-      response.writeHead(302, { Location: editorPath, "Cache-Control": "no-store" }).end();
+  async function handle(request, response) {
+    if (!share.hostAllowed(request)) {
+      request.resume();
+      response.writeHead(421, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" }).end("Misdirected request");
       return;
     }
+    const url2 = new URL(request.url ?? "/", "http://localhost");
+    const pathname = url2.pathname;
     if (pathname === "/favicon.ico") {
       response.writeHead(204).end();
       return;
     }
+    if (await share.route(request, response)) return;
+    const viewer = share.viewerOf(request);
+    if (!viewer) return share.denied(request, response);
+    if (pathname === "/" || pathname === "/index.html") {
+      response.writeHead(302, { Location: editorPath, "Cache-Control": "no-store" }).end();
+      return;
+    }
     const rootBlob = BLOB_PATH.exec(pathname.slice(1));
     if (rootBlob) {
       void guard(response, () => serveBlob(request, response, rootBlob[1]));
@@ -1547,30 +2256,41 @@ data: ${JSON.stringify(event)}
       response.writeHead(400).end();
       return;
     }
-    void guard(response, () => route(request, response, rest));
-  });
+    void guard(response, () => route(request, response, rest, viewer));
+  }
+  const server2 = http.createServer((request, response) => void guard(response, () => handle(request, response)));
   const close = () => {
     stopWatch();
     comments.close();
-    for (const client of clients) client.end();
+    share.close();
+    for (const client of clients.keys()) client.end();
     clients.clear();
     server2.close();
     server2.closeAllConnections?.();
   };
-  const actualPort = await listen(server2, port, host).catch((error) => {
+  const actualPort = await share.listen(server2, { port, host, lan, portGiven }).catch((error) => {
     close();
     throw error;
   });
   const url = `${serverOrigin(host, actualPort)}${editorPath}`;
   stamp(`serving ${project} at ${url}`);
-  return { url, port: actualPort, grant, close };
+  const lanUrls = share.lanUrls();
+  return { url, port: actualPort, grant, close, ...lanUrls.length ? { lan: lanUrls } : {} };
+}
+function artifactTitle(root, projectDir) {
+  try {
+    const index = JSON.parse(fs6.readFileSync(path5.join(projectDir, INDEX_FILE), "utf8"));
+    for (const value of [index.title, index.name]) if (typeof value === "string" && value.trim() && value.trim() !== "project") return value.trim();
+  } catch {
+  }
+  return path5.basename(root);
 }
 var runningServer2 = (root) => runningServer(root, KIND, ROUTES.session);
-async function serveForeground({ root, port, host, agentHook }) {
-  const running = await startServer({ root, port, host, agentHook });
+async function serveForeground({ root, port, host, agentHook, lan, portGiven }) {
+  const running = await startServer({ root, port, host, agentHook, lan, portGiven });
   const state = { pid: process.pid, url: running.url, port: running.port, root, kind: KIND, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
   recordServer(state, running.close);
-  return state;
+  return { ...state, ...running.lan ? { lan: running.lan } : {} };
 }
 async function main(argv) {
   const positional = [];
@@ -1579,26 +2299,27 @@ async function main(argv) {
     const arg = argv[i];
     if (!arg.startsWith("--")) positional.push(arg);
     else if (arg.includes("=")) flags.set(arg.slice(2, arg.indexOf("=")), arg.slice(arg.indexOf("=") + 1));
+    else if (arg === "--lan") flags.set("lan", "true");
     else flags.set(arg.slice(2), argv[++i] ?? "");
   }
   if (positional.length !== 1 || flags.has("help")) {
     process.stderr.write(
-      `Usage: node ${path3.basename(SCRIPT)} <root> [--port n] [--host h] [--agent-hook "<command>"]
+      `Usage: node ${path5.basename(SCRIPT)} <root> [--port n] [--host h] [--lan] [--agent-hook "<command>"]
 <root> holds project/${INDEX_FILE}.
 `
     );
     return 2;
   }
-  let root = path3.resolve(positional[0]);
-  if (path3.basename(root) === "project" && fs4.existsSync(path3.join(root, INDEX_FILE)) && !fs4.existsSync(path3.join(root, "project"))) {
-    root = path3.dirname(root);
+  let root = path5.resolve(positional[0]);
+  if (path5.basename(root) === "project" && fs6.existsSync(path5.join(root, INDEX_FILE)) && !fs6.existsSync(path5.join(root, "project"))) {
+    root = path5.dirname(root);
   }
-  if (!fs4.statSync(path3.join(root, "project", INDEX_FILE), { throwIfNoEntry: false })?.isFile()) {
-    process.stderr.write(`${JSON.stringify({ error: "NOT_FOUND", message: `${path3.join(root, "project", INDEX_FILE)} does not exist.` })}
+  if (!fs6.statSync(path5.join(root, "project", INDEX_FILE), { throwIfNoEntry: false })?.isFile()) {
+    process.stderr.write(`${JSON.stringify({ error: "NOT_FOUND", message: `${path5.join(root, "project", INDEX_FILE)} does not exist.` })}
 `);
     return 2;
   }
-  const port = Number(flags.get("port") ?? 0);
+  const port = flags.has("port") ? Number(flags.get("port")) : DEFAULT_PORTS[KIND];
   if (!Number.isInteger(port) || port < 0 || port > 65535) {
     process.stderr.write(`${JSON.stringify({ error: "INVALID_PORT", message: "--port is a number from 0 to 65535." })}
 `);
@@ -1611,14 +2332,14 @@ async function main(argv) {
     return 0;
   }
   const agentHook = flags.get("agent-hook") || void 0;
-  const state = await serveForeground({ root, port, host: flags.get("host") ?? "127.0.0.1", agentHook });
-  process.stdout.write(`${JSON.stringify({ url: state.url, root, pid: state.pid }, null, 2)}
+  const state = await serveForeground({ root, port, host: flags.get("host") ?? "127.0.0.1", agentHook, lan: flags.has("lan"), portGiven: flags.has("port") });
+  process.stdout.write(`${JSON.stringify({ url: state.url, root, pid: state.pid, ...state.lan ? { lan: state.lan } : {} }, null, 2)}
 `);
   return -1;
 }
 function isMain(moduleUrl) {
   try {
-    return Boolean(process.argv[1]) && pathToFileURL(fs4.realpathSync(process.argv[1])).href === moduleUrl;
+    return Boolean(process.argv[1]) && pathToFileURL(fs6.realpathSync(process.argv[1])).href === moduleUrl;
   } catch {
     return false;
   }
@@ -1632,7 +2353,7 @@ function createArtifactServer(kind, moduleUrl) {
   sessionExtras = kind.sessionExtras;
   commentLocation = kind.commentLocation;
   SCRIPT = fileURLToPath(moduleUrl);
-  EDITOR_DIR = path3.join(path3.dirname(SCRIPT), "editor");
+  EDITOR_DIR = path5.join(path5.dirname(SCRIPT), "editor");
   const runIfMain = () => {
     if (!isMain(moduleUrl)) return;
     main(process.argv.slice(2)).then(
@@ -1640,7 +2361,8 @@ function createArtifactServer(kind, moduleUrl) {
         if (code >= 0) process.exitCode = code;
       },
       (error) => {
-        process.stderr.write(`${JSON.stringify({ error: "SERVER_FAILED", message: errorText(error) })}
+        const code = error.code === "PORT_IN_USE" ? "PORT_IN_USE" : "SERVER_FAILED";
+        process.stderr.write(`${JSON.stringify({ error: code, message: errorText(error) })}
 `);
         process.exitCode = 2;
       }
@@ -1681,7 +2403,7 @@ function commentLocation2(input, projectDir) {
   });
   let boards = [];
   try {
-    const listed = JSON.parse(fs5.readFileSync(path4.join(projectDir, INDEX_FILE2), "utf8")).boards;
+    const listed = JSON.parse(fs7.readFileSync(path6.join(projectDir, INDEX_FILE2), "utf8")).boards;
     if (listed && typeof listed === "object") boards = Object.keys(listed);
   } catch {
   }