mdeck 2.3.0

package/src/live/rooms.js

@@ -0,0 +1,249 @@
+// Rooms for audience interaction. A room is a list of small messages that
+// phones post and slides follow live; the server never interprets them, so a
+// new kind of activity (poll, word cloud, questions) needs no server change.
+// A room also has one state value that only the presenter sets: the deck's
+// session room holds the activity on screen, which the answer page shows.
+// Everything lives in memory: nothing is written to disk, and idle rooms are
+// forgotten. The same handler runs inside `mdeck run` and as `mdeck server`.
+import { timingSafeEqual } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { CODE_RE } from './code.js'
+
+// The phones' answer page, served by the server itself at /<code>.
+const ANSWER_FILES = Object.fromEntries(['answer.html', 'answer.js', 'answer.css'].map(name => [name, readFileSync(new URL(`./answer/${name}`, import.meta.url))]))
+const ANSWER_TYPES = { html: 'text/html; charset=utf-8', js: 'text/javascript; charset=utf-8', css: 'text/css; charset=utf-8' }
+
+export const ROOM_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/
+// What a connected window may say it is, for the presenter's overview of
+// who is connected (src/components/ConnectedViews.jsx); phones only count.
+export const VIEWS = ['presenter', 'audience', 'deck', 'phone']
+export const DEVICES = ['computer', 'ipad', 'tablet', 'phone']
+const HOUR = 60 * 60 * 1000
+
+export function createRooms({ maxMessages = 5000, maxInk = 5000, maxRooms = 500, idleMs = 12 * HOUR, now = Date.now } = {}) {
+  const rooms = new Map()
+  const prune = () => { for (const [id, room] of rooms) if (!room.listeners.size && now() - room.touched > idleMs) rooms.delete(id) }
+  const get = id => {
+    let room = rooms.get(id)
+    if (!room) {
+      if (rooms.size >= maxRooms) prune()
+      if (rooms.size >= maxRooms) throw Object.assign(new Error('Too many rooms are open on this server'), { status: 503 })
+      room = { messages: [], state: null, stamp: 0, screens: new Map(), ink: [], listeners: new Set(), present: new Map(), next: 1, touched: now() }
+      rooms.set(id, room)
+    }
+    room.touched = now()
+    return room
+  }
+  const broadcast = (room, event) => { for (const listener of room.listeners) listener(event) }
+  // A session is a room and the rooms named after it (`<code>.stage`, …).
+  const sessionRooms = id => { const session = id.split('.')[0]; return [...rooms].filter(([name]) => name === session || name.startsWith(`${session}.`)).map(([, room]) => room) }
+  const presence = id => {
+    const present = sessionRooms(id).flatMap(room => [...room.present.values()])
+    const views = present.filter(entry => entry.view !== 'phone').sort((a, b) => VIEWS.indexOf(a.view) - VIEWS.indexOf(b.view))
+    return { views, phones: present.length - views.length }
+  }
+  const announcePresence = id => { const event = { type: 'presence', presence: presence(id) }; for (const room of sessionRooms(id)) broadcast(room, event) }
+  return {
+    post(id, { from = null, data }) {
+      const room = get(id)
+      if (room.messages.length >= maxMessages) throw Object.assign(new Error('This room is full'), { status: 429 })
+      const message = { n: room.next++, at: new Date(now()).toISOString(), from, data }
+      room.messages.push(message)
+      broadcast(room, { type: 'message', message })
+      return message
+    },
+    reset(id) {
+      const room = get(id)
+      room.messages = []
+      broadcast(room, { type: 'reset' })
+    },
+    // A state carries `at`, when its screen last changed it. The latest change
+    // wins: a state older than the current one is ignored (returns false), so
+    // a forgotten screen repeating an old slide cannot take the phones back.
+    // States that name their `screen` are ordered by when this server first
+    // heard of the change, not by the clocks of the devices (an iPad and a
+    // laptop rarely agree to the second); a screen that just opened says
+    // `at: 0` and is the oldest.
+    setState(id, state) {
+      const room = get(id)
+      const next = state ?? null
+      const at = Number.isFinite(next?.at) ? next.at : 0
+      let stamp = at
+      if (typeof next?.screen === 'string' && at) {
+        const seen = room.screens.get(next.screen)
+        stamp = seen?.at === at ? seen.stamp : Math.max(now(), room.stamp + 1)
+        room.screens.delete(next.screen)
+        room.screens.set(next.screen, { at, stamp })
+        if (room.screens.size > 50) room.screens.delete(room.screens.keys().next().value)
+      }
+      // A state without `at`, as from an outdated page, counts as the oldest.
+      if (next && room.state && stamp < room.stamp) return false
+      room.stamp = next ? stamp : 0
+      // The presenter repeats its state; listeners only hear changes.
+      if (JSON.stringify(next) === JSON.stringify(room.state)) return true
+      room.state = next
+      broadcast(room, { type: 'state', state: room.state })
+      return true
+    },
+    // Live ink (src/runtime/ink/bus.js): passed on at once and not kept,
+    // except the changes of the saved ink, which a screen that opens later
+    // gets with the snapshot. Returns how many listen.
+    relayInk(id, messages) {
+      const room = get(id)
+      const changes = messages.filter(message => message?.type === 'op')
+      if (changes.length) room.ink = [...room.ink, ...changes].slice(-maxInk)
+      broadcast(room, { type: 'ink', messages })
+      return room.listeners.size
+    },
+    ink: id => get(id).ink,
+    snapshot: id => get(id).messages,
+    state: id => get(id).state,
+    presence: id => { get(id); return presence(id) },
+    // A listener that says what it is ({ view, device }) counts in the
+    // session's presence; every change reaches all of the session's rooms.
+    subscribe(id, listener, present = null) {
+      const room = get(id)
+      room.listeners.add(listener)
+      if (present) { room.present.set(listener, present); announcePresence(id) }
+      return () => {
+        room.listeners.delete(listener)
+        room.touched = now()
+        if (room.present.delete(listener)) announcePresence(id)
+      }
+    },
+    get size() { return rooms.size },
+  }
+}
+
+// Per-address token bucket: `burst` messages at once, refilled over `perMs`.
+export function createLimiter({ burst = 30, perMs = 10000, now = Date.now } = {}) {
+  const buckets = new Map()
+  return key => {
+    const t = now()
+    const bucket = buckets.get(key) ?? { tokens: burst, at: t }
+    bucket.tokens = Math.min(burst, bucket.tokens + ((t - bucket.at) / perMs) * burst)
+    bucket.at = t
+    buckets.set(key, bucket)
+    if (buckets.size > 10000) for (const [k, b] of buckets) if (b.tokens >= burst) buckets.delete(k)
+    if (bucket.tokens < 1) return false
+    bucket.tokens -= 1
+    return true
+  }
+}
+
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])
+export const isLoopbackAddress = address => LOOPBACK.has(address)
+
+// Behind a proxy on the same machine (nginx), the client is the forwarded one.
+export function clientAddress(request) {
+  const direct = request.socket?.remoteAddress ?? ''
+  const forwarded = request.headers['x-forwarded-for']
+  return isLoopbackAddress(direct) && forwarded ? forwarded.split(',')[0].trim() : direct
+}
+
+export function keyMatches(request, key) {
+  if (!key) return false
+  const given = Buffer.from((request.headers.authorization ?? '').replace(/^Bearer\s+/i, ''))
+  const wanted = Buffer.from(key)
+  return given.length === wanted.length && timingSafeEqual(given, wanted)
+}
+
+const MAX_BODY = 4096
+const MAX_STATE = 32768
+const MAX_INK = 65536
+
+function readBody(request, limit = MAX_BODY) {
+  return new Promise((done, fail) => {
+    if (!/^application\/json\b/i.test(request.headers['content-type'] ?? '')) return fail(Object.assign(new Error('Send JSON'), { status: 415 }))
+    let size = 0
+    const chunks = []
+    request.on('data', chunk => {
+      size += chunk.length
+      if (size > limit) { request.pause(); fail(Object.assign(new Error('Message too large'), { status: 413, close: true })); return }
+      chunks.push(chunk)
+    })
+    request.on('end', () => { try { done(JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}')) } catch { fail(Object.assign(new Error('Not valid JSON'), { status: 400 })) } })
+    request.on('error', fail)
+  })
+}
+
+function reply(response, status, body) {
+  const text = JSON.stringify(body)
+  response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' })
+  response.end(text)
+}
+
+// Routes, relative to where the handler is mounted:
+//   GET  /<code>               the phones' answer page (and answer.js, answer.css)
+//   GET  /info                 { canReset, ...extra }
+//   GET  /rooms/<id>/events    Server-Sent Events: snapshot, message, reset, state;
+//                              ?view=…&device=… counts this window as connected,
+//                              ?presence=1 adds who is connected to the session
+//   GET  /rooms/<id>/presence  who is connected to the session, once
+//   POST /rooms/<id>           { from, data } → { n }
+//   POST /rooms/<id>/reset     presenter only
+//   POST /rooms/<id>/state     { state } — presenter only
+//   POST /rooms/<id>/ink       { messages } — presenter only, live ink
+// Answers carry no cookies and no personal data, so any page may use them.
+export function liveHandler({ rooms = createRooms(), canReset = () => false, info = () => ({}), limit = createLimiter(), inkLimit = createLimiter({ burst: 60, perMs: 3000 }), heartbeatMs = 20000 } = {}) {
+  return async (request, response, next = () => reply(response, 404, { error: 'Not found' })) => {
+    const { pathname, searchParams } = new URL(request.url, 'http://localhost')
+    response.setHeader('Access-Control-Allow-Origin', '*')
+    response.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization')
+    response.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
+    if (request.method === 'OPTIONS') { response.writeHead(204); response.end(); return }
+    try {
+      if (pathname === '/info' && request.method === 'GET') return reply(response, 200, { canReset: !!canReset(request, searchParams.get('session')), ...info(request) })
+      const page = pathname.slice(1)
+      if (request.method === 'GET' && (CODE_RE.test(page) || Object.hasOwn(ANSWER_FILES, page))) {
+        const name = CODE_RE.test(page) ? 'answer.html' : page
+        response.writeHead(200, { 'Content-Type': ANSWER_TYPES[name.split('.').pop()], 'Cache-Control': 'no-cache', 'X-Content-Type-Options': 'nosniff' })
+        return response.end(ANSWER_FILES[name])
+      }
+      const match = pathname.match(/^\/rooms\/([^/]+)(\/events|\/presence|\/reset|\/state|\/ink)?$/)
+      if (!match) return next()
+      const id = decodeURIComponent(match[1])
+      if (!ROOM_RE.test(id)) return reply(response, 400, { error: 'Room names use letters, digits, dots, hyphens and underscores' })
+      if (match[2] === '/events' && request.method === 'GET') {
+        response.writeHead(200, { 'Content-Type': 'text/event-stream; charset=utf-8', 'Cache-Control': 'no-store', 'Connection': 'keep-alive', 'X-Accel-Buffering': 'no' })
+        const write = (event, data) => response.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`)
+        const ink = rooms.ink(id)
+        const view = searchParams.get('view'), device = searchParams.get('device')
+        const present = VIEWS.includes(view) ? { view, device: DEVICES.includes(device) ? device : 'computer' } : null
+        const wantsPresence = searchParams.get('presence') === '1'
+        write('snapshot', { messages: rooms.snapshot(id), state: rooms.state(id), ...(ink.length ? { ink } : {}), ...(wantsPresence ? { presence: rooms.presence(id) } : {}) })
+        const unsubscribe = rooms.subscribe(id, event => {
+          if (event.type === 'presence') { if (wantsPresence) write('presence', event.presence); return }
+          write(event.type, event.type === 'message' ? event.message : event.type === 'state' ? { state: event.state } : event.type === 'ink' ? { messages: event.messages } : {})
+        }, present)
+        const beat = setInterval(() => response.write(': ping\n\n'), heartbeatMs)
+        request.on('close', () => { clearInterval(beat); unsubscribe() })
+        return
+      }
+      if (match[2] === '/presence' && request.method === 'GET') return reply(response, 200, rooms.presence(id))
+      if (request.method !== 'POST') return reply(response, 405, { error: 'Method not allowed' })
+      if (match[2] === '/ink') {
+        if (!canReset(request, id)) return reply(response, 403, { error: 'Only the presenter can draw' })
+        if (!inkLimit(clientAddress(request))) return reply(response, 429, { error: 'Too much ink at once' })
+        const { messages } = await readBody(request, MAX_INK)
+        if (!Array.isArray(messages) || messages.length > 100) return reply(response, 400, { error: 'Send { messages: [...] }' })
+        return reply(response, 200, { ok: true, listeners: rooms.relayInk(id, messages) })
+      }
+      if (match[2] === '/reset' || match[2] === '/state') {
+        if (!canReset(request, id)) return reply(response, 403, { error: 'Only the presenter can change a room' })
+        if (match[2] === '/reset') rooms.reset(id)
+        else if (!rooms.setState(id, (await readBody(request, MAX_STATE)).state)) return reply(response, 200, { ok: true, ignored: true })
+        return reply(response, 200, { ok: true })
+      }
+      if (!limit(clientAddress(request))) return reply(response, 429, { error: 'Too many answers at once; wait a moment' })
+      const body = await readBody(request)
+      if (!('data' in body)) return reply(response, 400, { error: 'Send { data }' })
+      const from = typeof body.from === 'string' ? body.from.slice(0, 64) : null
+      return reply(response, 201, { n: rooms.post(id, { from, data: body.data }).n })
+    } catch (error) {
+      // An oversized body is not read to the end; answer, then drop the connection.
+      if (error.close) { response.setHeader('Connection', 'close'); response.on('finish', () => request.destroy()) }
+      if (!response.headersSent) reply(response, error.status ?? 500, { error: error.message })
+    }
+  }
+}

package/src/live/server.js

@@ -0,0 +1,82 @@
+// The server for audience interaction, two ways: inside `mdeck run`
+// at /__mdeck/live, or on its own with `mdeck server` for hosted decks.
+import { createServer } from 'node:http'
+import { liveHandler, createRooms, keyMatches } from './rooms.js'
+import { isAllowedRequest } from '../build/editorPlugin.js'
+import { createTunnels } from './tunnel.js'
+import http from 'node:http'
+import https from 'node:https'
+
+// In the dev server only the presenter's own browser, on this computer and on
+// a page this server served, or a paired device (src/build/pairing.js) may
+// reset rooms; phones in the network may answer.
+export function livePlugin({ pairing = null, upstream = null, key = null, session = () => null } = {}) {
+  return {
+    name: 'vite-plugin-mdeck-live',
+    configureServer(server) {
+      const handler = liveHandler({
+        rooms: createRooms(),
+        canReset: (request, room) => isAllowedRequest(request) || (!!pairing?.allows(request) && (room == null || room === session() || room.startsWith(`${session()}.`))),
+        info: () => ({ network: server.resolvedUrls?.network?.[0] ?? null }),
+      })
+      server.middlewares.use('/__mdeck/live', (request, response, next) => {
+        const address = typeof upstream === 'function' ? upstream() : upstream
+        // The stage room (position and live ink between the presenter's
+        // devices and the audience window) stays here, on the local network,
+        // even when polls go to a standalone server: the projector follows
+        // the iPad without a detour over the internet, or without internet.
+        if (address && key && !isStageRequest(request.url, session())) return controlProxy({ upstream: address, key, session, authorize: request => isAllowedRequest(request) || !!pairing?.allows(request) })(request, response)
+        return handler(request, response, next)
+      })
+    },
+  }
+}
+
+// A request for the deck's stage room: /rooms/<code>.stage[/…], or its
+// /info?stage=1 (src/live/client.js).
+function isStageRequest(url, code) {
+  try {
+    const { pathname, searchParams } = new URL(url, 'http://localhost')
+    return decodeURIComponent(pathname).startsWith(`/rooms/${code}.stage`) || (pathname === '/info' && searchParams.has('stage'))
+  } catch { return false }
+}
+
+// Standalone: put it behind a web server (proxy / to it) and give the deck
+// `server: https://…`. Resetting a room needs the key. With a key it
+// is also the relay for `mdeck run --server` (src/live/tunnel.js), which needs
+// the web server to pass WebSocket upgrades on.
+export function startLiveServer({ port = 8787, host = '127.0.0.1', key = null } = {}) {
+  const tunnels = createTunnels({ key })
+  const handler = liveHandler({ rooms: createRooms(), canReset: (request, room) => keyMatches(request, key) || tunnels.allows(request, room) })
+  const server = createServer((request, response) => { if (!tunnels.handleRequest(request, response)) handler(request, response) })
+  server.on('upgrade', (request, socket, head) => { if (!tunnels.handleUpgrade(request, socket, head)) socket.destroy() })
+  return new Promise((done, fail) => {
+    server.once('error', fail)
+    server.listen(port, host, () => done({ server, tunnels, url: `http://${host.includes(':') ? `[${host}]` : host}:${server.address().port}`, close: () => new Promise(resolve => { tunnels.close(); server.closeAllConnections?.(); server.close(resolve) }) }))
+  })
+}
+
+// Network pairing with a standalone room server keeps its master key on the
+// presenter's computer. Devices send their revocable token to this proxy.
+export function controlProxy({ upstream, key, session, authorize }) {
+  return (request, response) => {
+    const url = new URL(request.url, 'http://localhost')
+    let room
+    try { room = decodeURIComponent(url.pathname.match(/^\/rooms\/([^/]+)(?:\/(?:events|presence|reset|state|ink))?$/)?.[1] ?? '') } catch {}
+    const code = session()
+    const scoped = room === code || room?.startsWith(`${code}.`)
+    const allowed = authorize(request)
+    if ((url.pathname !== '/info' && !scoped) || (url.pathname === '/info' && url.searchParams.has('session') && url.searchParams.get('session') !== code) || (request.method === 'POST' && !allowed) || !['GET', 'POST', 'OPTIONS'].includes(request.method)) {
+      response.writeHead(403, { 'Content-Type': 'application/json' }); response.end(JSON.stringify({ error: 'This device cannot control that room' })); return
+    }
+    const target = new URL(`${upstream.replace(/\/+$/, '')}${url.pathname}${url.search}`)
+    const headers = { 'Content-Type': request.headers['content-type'] ?? 'application/json', ...(allowed ? { Authorization: `Bearer ${key}` } : {}) }
+    const forward = (target.protocol === 'https:' ? https : http).request(target, { method: request.method, headers }, result => {
+      response.writeHead(result.statusCode, { ...result.headers, 'referrer-policy': 'no-referrer' })
+      result.pipe(response)
+    })
+    forward.on('error', () => { if (!response.headersSent) response.writeHead(502); response.end() })
+    response.on('close', () => forward.destroy())
+    request.pipe(forward)
+  }
+}

package/src/live/tunnel.js

@@ -0,0 +1,180 @@
+// The server as a relay for `mdeck run --server`. The presenter's computer
+// opens one outbound WebSocket to /tunnel/<id>, authenticated with the room
+// server's key. A browser, such as an iPad, then opens /t/<id>/… on this
+// server; each request is passed down that connection to the computer, which
+// answers it from its own dev server, and the answer is passed back. The
+// slides are never stored here, and the computer needs no open port.
+//
+// Messages are JSON text frames, bodies are base64 in chunks:
+//   server → computer   req {id, method, path, headers, body?}   abort {id}
+//                       wsopen {id, path, protocols}   wsmsg {id, b, bin}   wsclose {id, code}
+//   computer → server   head {id, status, headers}   data {id, b}   end {id}   err {id, status, message}
+//                       tokens {tokens}   wsmsg {id, b, bin}   wsclose {id, code}
+// `tokens` are the computer's paired devices: while the tunnel is open they
+// may steer rooms here like the key does.
+import { timingSafeEqual } from 'node:crypto'
+import { WebSocketServer } from 'ws'
+import { keyMatches } from './rooms.js'
+
+export const TUNNEL_ID_RE = /^[A-Za-z0-9_-]{16,64}$/
+const ROUTE_RE = /^\/t\/([A-Za-z0-9_-]{16,64})(\/.*)?$/
+const MB = 1024 * 1024
+// Hop-by-hop headers are not passed on, and neither are the ones the two ends
+// decide for themselves.
+const HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'proxy-connection', 'te', 'trailer', 'transfer-encoding', 'upgrade'])
+const NOT_REQUEST = new Set([...HOP, 'host', 'accept-encoding', 'content-length', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip', 'x-mdeck-tunnel', 'cookie'])
+const NOT_RESPONSE = new Set([...HOP, 'content-length', 'content-encoding'])
+const same = (a, b) => { const x = Buffer.from(a), y = Buffer.from(b); return x.length === y.length && timingSafeEqual(x, y) }
+
+function forward(headers, skip) {
+  const out = {}
+  for (const [name, value] of Object.entries(headers)) if (!skip.has(name.toLowerCase())) out[name.toLowerCase()] = value
+  return out
+}
+
+function text(response, status, message) {
+  if (response.headersSent) return response.end()
+  response.writeHead(status, { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer' })
+  response.end(message)
+}
+
+export function createTunnels({ key = null, bodyLimit = 2 * MB, maxTunnels = 50, maxPending = 128, requestTimeoutMs = 60000, pingMs = 25000 } = {}) {
+  const tunnels = new Map()
+  const sockets = new WebSocketServer({ noServer: true, maxPayload: 16 * MB, handleProtocols: protocols => [...protocols][0] ?? false })
+
+  function open(id, socket) {
+    tunnels.get(id)?.socket.close(4000, 'Replaced by a newer connection')
+    const tunnel = { socket, pending: new Map(), peers: new Map(), tokens: new Set(), session: null, next: 1, alive: true }
+    tunnels.set(id, tunnel)
+    const send = message => { if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(message)) }
+    tunnel.send = send
+    socket.on('pong', () => { tunnel.alive = true })
+    const beat = setInterval(() => {
+      if (!tunnel.alive) return socket.terminate()
+      tunnel.alive = false
+      socket.ping()
+    }, pingMs)
+    socket.on('message', raw => {
+      let message
+      try { message = JSON.parse(raw.toString()) } catch { return }
+      if (!message || typeof message !== 'object') return
+      const pending = tunnel.pending.get(message.id)
+      switch (message.t) {
+        case 'head':
+          if (pending && !pending.headersSent) pending.writeHead(Number(message.status) || 502, { ...forward(message.headers ?? {}, NOT_RESPONSE), 'referrer-policy': 'no-referrer' })
+          break
+        case 'data':
+          if (pending && typeof message.b === 'string') pending.write(Buffer.from(message.b, 'base64'))
+          break
+        case 'end':
+          if (pending) { pending.end(); tunnel.pending.delete(message.id) }
+          break
+        case 'err':
+          if (pending) { text(pending, Number(message.status) || 502, String(message.message ?? 'The presenter\'s computer could not answer')); tunnel.pending.delete(message.id) }
+          break
+        case 'tokens':
+          tunnel.session = /^\d{4,8}$/.test(message.session ?? '') ? String(message.session) : null
+          tunnel.tokens = new Set((Array.isArray(message.tokens) ? message.tokens : []).filter(token => typeof token === 'string' && token.length >= 16 && token.length <= 200).slice(0, 50))
+          break
+        case 'wsmsg': {
+          const peer = tunnel.peers.get(message.id)
+          if (peer && typeof message.b === 'string') peer.send(message.bin ? Buffer.from(message.b, 'base64') : Buffer.from(message.b, 'base64').toString('utf8'))
+          break
+        }
+        case 'wsclose': {
+          const peer = tunnel.peers.get(message.id)
+          if (peer) { tunnel.peers.delete(message.id); peer.close(Number.isInteger(message.code) && message.code >= 1000 && message.code < 5000 && ![1004, 1005, 1006, 1015].includes(message.code) ? message.code : 1011) }
+          break
+        }
+      }
+    })
+    socket.on('close', () => {
+      clearInterval(beat)
+      for (const response of tunnel.pending.values()) text(response, 502, 'The presenter\'s computer went away')
+      for (const peer of tunnel.peers.values()) peer.close(1001)
+      if (tunnels.get(id) === tunnel) tunnels.delete(id)
+    })
+  }
+
+  return {
+    /** Whether the request carries the token of a device paired through an open tunnel. */
+    allows(request, room = null) {
+      const given = (request.headers.authorization ?? '').replace(/^Bearer\s+/i, '')
+      if (!given) return false
+      for (const tunnel of tunnels.values()) {
+        if (!tunnel.session || (room !== null && room !== tunnel.session && !room.startsWith(`${tunnel.session}.`))) continue
+        for (const token of tunnel.tokens) if (same(token, given)) return true
+      }
+      return false
+    },
+
+    get size() { return tunnels.size },
+
+    /** A browser's request for /t/<id>/…; false when the path is not a tunnel's. */
+    handleRequest(request, response) {
+      const match = new URL(request.url, 'http://localhost').pathname.match(ROUTE_RE)
+      if (!match) return false
+      if (!key) { text(response, 404, 'Not found'); return true }
+      const tunnel = tunnels.get(match[1])
+      if (!tunnel) { text(response, 404, 'This presentation is not shared right now. Start it again with mdeck run --server.'); return true }
+      if (tunnel.pending.size >= maxPending) { text(response, 503, 'Too many requests at once'); return true }
+      const id = tunnel.next++
+      const chunks = []
+      let size = 0
+      let over = false
+      request.on('data', chunk => {
+        size += chunk.length
+        if (size > bodyLimit) { over = true; return }
+        chunks.push(chunk)
+      })
+      request.on('end', () => {
+        if (over) return text(response, 413, 'Request body too large')
+        if (tunnel.socket.readyState !== tunnel.socket.OPEN) return text(response, 502, 'The presenter\'s computer went away')
+        tunnel.pending.set(id, response)
+        const timer = setTimeout(() => { if (!response.headersSent) { text(response, 504, 'The presenter\'s computer did not answer in time'); tunnel.pending.delete(id); tunnel.send({ t: 'abort', id }) } }, requestTimeoutMs)
+        response.on('close', () => {
+          clearTimeout(timer)
+          if (tunnel.pending.delete(id)) tunnel.send({ t: 'abort', id })
+        })
+        response.on('finish', () => clearTimeout(timer))
+        tunnel.send({ t: 'req', id, method: request.method, path: request.url, headers: forward(request.headers, NOT_REQUEST), ...(chunks.length ? { body: Buffer.concat(chunks).toString('base64') } : {}) })
+      })
+      request.on('error', () => {})
+      return true
+    },
+
+    /** An upgrade: the computer's /tunnel/<id>, or a browser's WebSocket to /t/<id>/…. False when not ours. */
+    handleUpgrade(request, socket, head) {
+      const { pathname } = new URL(request.url, 'http://localhost')
+      const refuse = (status, reason) => { socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`); socket.destroy() }
+      const own = pathname.match(/^\/tunnel\/([A-Za-z0-9_-]{16,64})$/)
+      if (own) {
+        if (!key) { refuse(404, 'Not Found'); return true }
+        if (!keyMatches(request, key)) { refuse(401, 'Unauthorized'); return true }
+        if (!tunnels.has(own[1]) && tunnels.size >= maxTunnels) { refuse(503, 'Service Unavailable'); return true }
+        sockets.handleUpgrade(request, socket, head, ws => open(own[1], ws))
+        return true
+      }
+      const match = pathname.match(ROUTE_RE)
+      if (!match) return false
+      const tunnel = key ? tunnels.get(match[1]) : null
+      if (!tunnel) { refuse(404, 'Not Found'); return true }
+      const protocols = String(request.headers['sec-websocket-protocol'] ?? '').split(',').map(item => item.trim()).filter(Boolean)
+      sockets.handleUpgrade(request, socket, head, ws => {
+        const id = tunnel.next++
+        tunnel.peers.set(id, ws)
+        tunnel.send({ t: 'wsopen', id, path: request.url, protocols })
+        ws.on('message', (data, bin) => tunnel.send({ t: 'wsmsg', id, b: Buffer.from(data).toString('base64'), bin }))
+        ws.on('close', code => { if (tunnel.peers.delete(id)) tunnel.send({ t: 'wsclose', id, code }) })
+        ws.on('error', () => {})
+      })
+      return true
+    },
+
+    close() {
+      for (const tunnel of tunnels.values()) tunnel.socket.close(1001)
+      for (const client of sockets.clients) client.terminate()
+      sockets.close()
+    },
+  }
+}

package/src/paths.js

@@ -0,0 +1,9 @@
+import { fileURLToPath } from 'node:url'
+import { resolve } from 'node:path'
+
+// Files installed with mdeck are located relative to this module, never cwd.
+export const frameworkRoot = fileURLToPath(new URL('../', import.meta.url))
+export const runtimeRoot = resolve(frameworkRoot, 'src/runtime')
+export const assetsRoot = resolve(frameworkRoot, 'assets')
+export const docsRoot = resolve(frameworkRoot, 'docs/site')
+export const builtinExtensionsRoot = resolve(assetsRoot, 'extensions')