pi-roundtable-web 0.25.0 → 0.26.1

package/src/app/app.ts

@@ -6,6 +6,7 @@ import type {
 	ConversationModes,
 	ConversationPort,
 	DirectChannelProvider,
+	EventSink,
 	IdentityService,
 	Logger,
 	Migration,
@@ -13,9 +14,21 @@ import type {
 	WebSocketRoute,
 } from "pi-roundtable";
 import { channelKey } from "pi-roundtable";
+import { APP_CLOSE_EXPIRED } from "../api-types.ts";
 import type { Authenticated, Authenticator } from "../auth/authenticator.ts";
 import type { ConsolePresentation } from "../features.ts";
-import { PushApi } from "../push/api.ts";
+import type { Gate } from "../gate.ts";
+import { HostCardLog } from "../host/cards.ts";
+import { HostApp } from "../host/host-app.ts";
+import { RoomReads } from "../host/reads.ts";
+import {
+	mountNotices,
+	NOTICE_MIGRATIONS,
+	type NoticesMount,
+	type NoticesMountOptions,
+} from "../notices/mount.ts";
+import type { ResolvedOptions } from "../options.ts";
+import type { PushApi } from "../push/api.ts";
 import { webPushChannel } from "../push/channel.ts";
 import { EndpointPolicy } from "../push/endpoint.ts";
 import { PushMutes, roomMuted } from "../push/mutes.ts";
@@ -24,6 +37,7 @@ import { PushSender } from "../push/sender.ts";
 import { PushSubscriptions } from "../push/subscriptions.ts";
 import { PushService } from "../push/triggers.ts";
 import type { Vapid } from "../push/vapid.ts";
+import type { WebAppRegistry } from "../web-app.ts";
 import { CardLog } from "./card-log.ts";
 import { OwnerDesk } from "./desk.ts";
 import { FileDir } from "./files.ts";
@@ -33,7 +47,7 @@ import { RoomLog } from "./room-log.ts";
 import { Rooms } from "./rooms.ts";
 import { AppApi, type AppApiOptions, partsOf } from "./routes.ts";
 import { SocketRoute } from "./socket.ts";
-import { type AppSocket, Sockets } from "./sockets.ts";
+import { type AppSocket, type Audience, Sockets } from "./sockets.ts";
 import { AppSurface } from "./surface.ts";
 import { WebThreads } from "./threads.ts";
 import { Uploads } from "./uploads.ts";
@@ -47,11 +61,18 @@ const SWEEP_EVERY_MS = 3_600_000;
 /** The tables the app keeps; the plugin lists them as its own migrations. */
 export const APP_MIGRATIONS: readonly Migration[] = [
 	RoomLog.migration,
+	RoomLog.hostMigration,
+	RoomLog.noteMigration,
+	HostCardLog.migration,
+	HostCardLog.keepMigration,
+	RoomReads.migration,
 	CardLog.migration,
 	WebThreads.migration,
+	WebThreads.dismissedMigration,
 	PushSubscriptions.migration,
 	PushMutes.migration,
 	RoomLayout.migration,
+	...NOTICE_MIGRATIONS,
 ];
 
 export interface OwnerAppOptions {
@@ -69,14 +90,36 @@ export interface OwnerAppOptions {
 	cardGraceSeconds: number;
 	/** The most bytes of one uploaded file. */
 	uploadMaxBytes: number;
-	authenticator: Pick<Authenticator, "authenticate">;
+	/** How many days a stored file of an agent room is kept; default 30. */
+	uploadKeepDays?: number;
+	/** The name the app shows for a person; default the principal's own. */
+	nameOf?(principalId: string): Promise<string>;
+	/** The same-origin URL of a room, and of one of its messages, for a host's links. */
+	roomUrl(room: ChannelKey, message?: number): string;
+	/** Where the app reports what people do in it (a press on a host's button). */
+	events?: Pick<EventSink, "action">;
+	authenticator: Pick<Authenticator, "authenticate" | "recheck">;
 	/** How the console signs the person in. */
-	authMode: "none" | "password" | "verifier";
+	authMode: ResolvedOptions["auth"]["mode"];
+	/** Who the app admits; the page and the session report the tier only where it admits more than owners. */
+	admission: ResolvedOptions["admission"];
+	/** What the pieces of the app plug in: the kinds of host room, their handlers, who reads them. */
+	registry: WebAppRegistry;
+	/** The onboarding gate. */
+	gate: Gate;
+	/** The tiers whose people may use push. */
+	pushTiers: ResolvedOptions["push"]["tiers"];
+	/** Whether the yolo and long-running switches are served. */
+	modeSwitches: boolean;
 	/** The longest an open socket lives; for a credential that logout or a new password does not reach. */
 	socketLifeMs?: number;
-	/** Web Push: the server's key, and how notifications read. */
+	/** The notices, onboarding and profile pieces: what they read of the options. */
+	extras: Pick<NoticesMountOptions, "profiles" | "routing" | "onboarding"> & {
+		push: NoticesMountOptions["push"];
+	};
+	/** Web Push: the server's key (absent with an external sender, which holds it), and how notifications read. */
 	push: {
-		vapid: Vapid;
+		vapid?: Vapid;
 		/** The `sub` of the VAPID token; absent = push is not set up and nothing is sent. */
 		subject: string | undefined;
 		preview: boolean;
@@ -124,10 +167,12 @@ export class OwnerApp {
 	readonly directChannel: DirectChannelProvider;
 	readonly #api: AppApi;
 	readonly #push: PushApi;
+	readonly #mounted: NoticesMount;
 	readonly #sockets: Sockets;
 	readonly #desk: OwnerDesk;
 	readonly #presence: Presence;
 	readonly #uploads: Uploads;
+	readonly #host: HostApp;
 	readonly #options: OwnerAppOptions;
 	readonly #unsubscribe: (() => void)[] = [];
 	#sweeper: ReturnType<typeof setInterval> | undefined;
@@ -143,7 +188,17 @@ export class OwnerApp {
 		const waiting = new FileDir(join(options.dataDir, "web", "uploads"));
 		const uploads = new Uploads(waiting, stored, {
 			maxBytes: options.uploadMaxBytes,
+			...(options.uploadKeepDays === undefined
+				? {}
+				: { keepDays: options.uploadKeepDays }),
 		});
+		const reads = new RoomReads(options.database);
+		const hostCards = new HostCardLog(options.database);
+		const nameOf =
+			options.nameOf ??
+			(async (id: string) => (await identity.principal(id))?.displayName ?? id);
+		// The host rooms read their context once the surface exists; the surface asks for it per turn.
+		let hostApp: HostApp | undefined;
 		const threads = new WebThreads(options.database);
 		const subscriptions = new PushSubscriptions(options.database);
 		const mutes = new PushMutes(options.database);
@@ -151,34 +206,63 @@ export class OwnerApp {
 		const quietClock = options.push.quietHours
 			? new QuietClock(options.push.quietHours, options.push.timeZone)
 			: undefined;
+		const quiet = quietClock
+			? (at: number) => quietClock.quietAt(at)
+			: undefined;
+		const mounted = mountNotices({
+			database: options.database,
+			logger,
+			registry: options.registry,
+			gate: options.gate,
+			sockets,
+			identity,
+			...(options.extras.profiles ? { profiles: options.extras.profiles } : {}),
+			subscriptions,
+			policy,
+			mount: options.mount,
+			routing: options.extras.routing,
+			push: options.extras.push,
+			...(quiet ? { quiet } : {}),
+			...(options.push.vapid ? { vapid: options.push.vapid } : {}),
+			onboarding: options.extras.onboarding,
+		});
 		const push = new PushService({
+			hostRoom: (room) => options.registry.isHostRoom(room),
 			subscriptions,
-			sender: new PushSender({
-				vapid: options.push.vapid,
-				subject: options.push.subject,
-				policy,
-				...(options.push.fetch ? { fetch: options.push.fetch } : {}),
-				logger,
-			}),
+			// The app signs only with its own key; with an external sender it queues for it instead.
+			...(options.push.vapid
+				? {
+						sender: new PushSender({
+							vapid: options.push.vapid,
+							subject: options.push.subject,
+							policy,
+							...(options.push.fetch ? { fetch: options.push.fetch } : {}),
+							logger,
+						}),
+					}
+				: {}),
+			...(mounted.route ? { route: mounted.route } : {}),
 			identity,
 			visible: (principalId) => sockets.anyVisible(principalId),
 			preview: options.push.preview,
-			...(quietClock ? { quiet: (at: number) => quietClock.quietAt(at) } : {}),
+			...(quiet ? { quiet } : {}),
 			muted: roomMuted(mutes, threads, channelKey(options.surface, "thread.")),
 			urlOf: options.push.urlOf,
 			logger,
 		});
-		this.#push = new PushApi({
-			vapid: options.push.vapid,
-			policy,
-			subscriptions,
-			identity,
-			enabled: options.push.subject !== undefined,
-		});
+		this.#mounted = mounted;
+		this.#push = mounted.pushApi;
+		const { registry } = options;
+		sockets.setRoomReader((connection, room) =>
+			registry.access.readNow(connection, room),
+		);
+		// An agent room's frames are the owners'; a host room's are its readers'.
+		const audienceOf = (room: string): Audience =>
+			registry.isHostRoom(room) ? { room } : { owners: true };
 		// The desk starts a late answer's turn through the socket route, which is made after it.
 		let route: SocketRoute | undefined;
 		const desk = new OwnerDesk({
-			broadcast: (frame) => sockets.broadcast(frame),
+			broadcast: (frame, room) => sockets.deliver(frame, audienceOf(room)),
 			graceMs: options.cardGraceSeconds * 1000,
 			closed: (card) => cards.record(card),
 			opened: (room, frame) => {
@@ -213,6 +297,20 @@ export class OwnerApp {
 				const room = await rooms.resolve(parent);
 				return room !== undefined && room.kind !== "thread";
 			},
+			audienceOf,
+			isHostRoom: (room) => registry.isHostRoom(room),
+			fileBinding: (room) => {
+				const kind = registry.hostKindOf(room)?.kind;
+				return {
+					room,
+					...(kind?.retention
+						? { expiresAt: Date.now() + kind.retention.fileDays * 86_400_000 }
+						: {}),
+				};
+			},
+			channelContext: (message, contextOptions) =>
+				hostApp?.channelContext(message, contextOptions) ??
+				Promise.resolve(undefined),
 			changed: () => this.changed(),
 			unprompted: (room, author, text) => {
 				push.reply(room, author, text).catch(() => undefined);
@@ -237,7 +335,30 @@ export class OwnerApp {
 			modes,
 			mutes,
 			activity: (room) => surface.activityOf(room),
+			// The agent rooms are the owners'; where there are several, they can leave each other notes.
+			readers: async () => (await identity.owners()).length > 1,
 		});
+		hostApp = new HostApp({
+			surface: options.surface,
+			registry,
+			sockets,
+			app: surface,
+			desk,
+			log,
+			cards: hostCards,
+			reads,
+			files: stored,
+			uploads,
+			rooms,
+			conversations: options.conversations,
+			nameOf,
+			roomUrl: options.roomUrl,
+			maxFileBytes: options.uploadMaxBytes,
+			...(options.events ? { events: options.events } : {}),
+			logger,
+		});
+		hostApp.install();
+		this.#host = hostApp;
 		route = new SocketRoute({
 			path: `${options.mount}/api/socket`,
 			origin: options.origin,
@@ -251,10 +372,17 @@ export class OwnerApp {
 			rooms,
 			uploads,
 			presence,
-			identity,
+			registry,
+			gate: options.gate,
+			audienceOf,
+			opened: (connection) => mounted.opened(connection),
 			conversations: options.conversations,
 			logger,
 		});
+		const socketRoute = route;
+		this.#unsubscribe.push(
+			options.gate.onChanged((principalId) => socketRoute.refresh(principalId)),
+		);
 		this.websocket = route.route();
 		this.directChannel = webPushChannel({
 			surface: options.surface,
@@ -291,8 +419,16 @@ export class OwnerApp {
 			...(options.skills ? { skills: options.skills } : {}),
 			...(options.prompts ? { prompts: options.prompts } : {}),
 			avatars: agents.avatars,
+			reads,
+			host: hostApp,
+			nameOf,
 			mount: options.mount,
 			authMode: options.authMode,
+			admission: options.admission,
+			registry,
+			gate: options.gate,
+			pushTiers: options.pushTiers,
+			modeSwitches: options.modeSwitches,
 			...(options.push.quietHours
 				? {
 						quietHours: {
@@ -312,12 +448,15 @@ export class OwnerApp {
 		this.#unsubscribe.push(
 			modes.onChange((channel, mode) => {
 				if (!rooms.ownsKey(channel)) return;
-				sockets.broadcast({
-					type: "mode",
-					room: channel,
-					yolo: mode.yolo,
-					longRunning: mode.longRunning,
-				});
+				sockets.deliver(
+					{
+						type: "mode",
+						room: channel,
+						yolo: mode.yolo,
+						longRunning: mode.longRunning,
+					},
+					{ owners: true },
+				);
 			}),
 			modes.onAutoApproved((entry) => {
 				if (!rooms.ownsKey(entry.channel)) return;
@@ -342,17 +481,28 @@ export class OwnerApp {
 		return pushed ?? this.#api.handle(request, rest, admission);
 	}
 
-	/** Tells every open socket the team or the room list may differ, once changes settle. */
+	/** Closes the sockets that came in on a session that has ended. */
+	sessionEnded(id: string): void {
+		this.#sockets.closeWhere(
+			(connection) => connection.session === id,
+			APP_CLOSE_EXPIRED,
+			"expired",
+		);
+	}
+
+	/** Tells the owners' sockets the team or the room list may differ, once changes settle. */
 	changed(): void {
 		if (this.#pending) return;
 		this.#pending = setTimeout(() => {
 			this.#pending = undefined;
-			this.#sockets.broadcast({ type: "changed" });
+			this.#sockets.deliver({ type: "changed" }, { owners: true });
 		}, CHANGED_COALESCE_MS);
 	}
 
 	start(): void {
 		this.#uploads.adopt();
+		this.#host.start();
+		this.#mounted.start();
 		this.#sweep();
 		this.#sweeper = setInterval(() => this.#sweep(), SWEEP_EVERY_MS);
 	}
@@ -364,6 +514,8 @@ export class OwnerApp {
 		clearTimeout(this.#pending);
 		this.#pending = undefined;
 		for (const unsubscribe of this.#unsubscribe.splice(0)) unsubscribe();
+		this.#host.stop();
+		this.#mounted.stop().catch(() => undefined);
 		this.#desk.stop();
 		this.#presence.stop();
 		this.#sockets.closeAll(1001, "stopping");
@@ -377,6 +529,20 @@ export class OwnerApp {
 		} catch (error) {
 			this.#options.logger.warn({ err: error }, "old app files not deleted");
 		}
+		this.#host.sweep().then(
+			(gone) => {
+				if (gone.messages + gone.cards + gone.files > 0)
+					this.#options.logger.info(
+						gone,
+						"host room history past retention deleted",
+					);
+			},
+			(error: unknown) =>
+				this.#options.logger.warn(
+					{ err: error },
+					"host room history not swept",
+				),
+		);
 	}
 
 	/** Records and shows that yolo mode approved a held call in a room. */
@@ -391,6 +557,9 @@ export class OwnerApp {
 			author: "Yolo mode",
 			text: `Yolo mode approved: ${action}`,
 		});
-		this.#sockets.broadcast({ type: "auto_approved", room, tool, action });
+		this.#sockets.deliver(
+			{ type: "auto_approved", room, tool, action },
+			{ owners: true },
+		);
 	}
 }

package/src/app/desk.ts

@@ -50,13 +50,15 @@ export interface Answerer {
 	/** The identity they spoke as, `<provider>:<subject>`. */
 	speakerId: string;
 	name: string;
+	/** The roles their sign-in carried. */
+	roles?: readonly string[];
 	/** The actor their credential vouched for, which a message they start is written as. */
 	actor?: ActorFacts;
 }
 
 export interface OwnerDeskOptions {
-	/** Sends a frame to every open socket of every owner. */
-	broadcast(frame: ServerFrame): void;
+	/** Puts a frame about a room on the sockets that may have it: the owners' for an agent room, the room's readers' for a host room. */
+	broadcast(frame: ServerFrame, room: ChannelKey): void;
 	/** How long a turn that can be resumed waits on its card before it goes on without the answer. */
 	graceMs: number;
 	/** A card nobody answers closes after this long; default 24 hours. */
@@ -143,9 +145,14 @@ function answerOf(ended: Ended): CardAnswer | undefined {
  * after a day. A turn that can be resumed stops waiting after the grace period while the card
  * stays open (`late`); answered then, the card starts a turn in its room with the answer.
  *
- * Who answers: any owner, except a card that is the speaker's alone (`speakerOnly`), which only
- * the speaker's principal answers, and a card in a private conversation, which only its person
- * does. An approval is answered at the tier it needs, read again when the answer comes.
+ * Who answers (the same rule as Discord's `CardAudiences`, so a room's readers cannot widen it):
+ * - an approval that names approvers: a named approver who holds its tier now, or an owner;
+ * - an approval that names none: the turn's speaker at its tier, and the owners when the scope
+ *   escalates;
+ * - a question: the speaker, and the owners when the scope escalates;
+ * - a card that is the speaker's alone (`speakerOnly`): only the speaker's principal;
+ * - without a scope: the owners.
+ * It applies to approve, decline, answer and cancel alike, and the tier is the answerer's now.
  */
 export class OwnerDesk {
 	readonly #open = new Map<string, Open>();
@@ -273,15 +280,19 @@ export class OwnerDesk {
 		};
 	}
 
-	/** The open cards as frames, to send again when a socket opens. */
-	openFrames(): ServerFrame[] {
+	/** The open cards as frames with their rooms, to send again when a socket opens; each goes only to those who may have its room. */
+	openFrames(): { room: ChannelKey; frame: ServerFrame }[] {
 		return [...this.#open.values()].map((open) => ({
-			type: "prompt",
 			room: open.room,
-			prompt: open.frame,
+			frame: { type: "prompt", room: open.room, prompt: open.frame },
 		}));
 	}
 
+	/** The room a card belongs to, while it is open. */
+	roomOf(prompt: string): ChannelKey | undefined {
+		return this.#open.get(prompt)?.room;
+	}
+
 	/** Whether the card is open and past its grace, so an answer to it starts a turn. */
 	isLate(prompt: string): boolean {
 		const frame = this.#open.get(prompt)?.frame;
@@ -357,7 +368,7 @@ export class OwnerDesk {
 
 	/**
 	 * Who may approve a call held at `minTier`, as a test of the person who answers; undefined when
-	 * no one may, so the call is unavailable at once. The primary audience is every owner.
+	 * no one may, so the call is unavailable at once.
 	 */
 	#approvalAudience(
 		scope: PromptScope | undefined,
@@ -366,6 +377,7 @@ export class OwnerDesk {
 		speakerOnly: boolean,
 	): ((from: Answerer) => boolean) | undefined {
 		const tierOk = (from: Answerer) => atLeast(from.tier, minTier);
+		const owner = (from: Answerer) => from.tier === "owner";
 		if (speakerOnly) {
 			// The speaker's alone: below the tier, or a speaker who is no person, no one answers.
 			if (
@@ -377,28 +389,38 @@ export class OwnerDesk {
 			const speaker = scope.principalId;
 			return (from) => from.principalId === speaker && tierOk(from);
 		}
-		if (scope?.escalate === "none") {
+		// Without a scope a card is the owners'.
+		if (!scope) return owner;
+		const person = scope.principalId;
+		if (scope.escalate === "none") {
 			// A private conversation's person is the only one who answers, and a call naming others is theirs only if named or an owner.
 			if (!atLeast(scope.tier, minTier)) return undefined;
 			if (
 				approvers?.length &&
-				!approvers.includes(scope.principalId) &&
+				!approvers.includes(person) &&
 				scope.tier !== "owner"
 			)
 				return undefined;
-			const person = scope.principalId;
 			return (from) => from.principalId === person && tierOk(from);
 		}
-		return tierOk;
+		if (approvers?.length) {
+			// Named approvers answer it, at the tier it needs now, and so do the owners; the speaker does not unless named.
+			const named = new Set(approvers);
+			return (from) =>
+				(named.has(from.principalId) && tierOk(from)) || owner(from);
+		}
+		return (from) =>
+			(from.principalId === person && tierOk(from)) || owner(from);
 	}
 
-	/** Who may answer a question: every owner, or a private conversation's person alone. */
+	/** Who may answer a question: the speaker, and the owners where the scope escalates; without a scope, the owners. */
 	#questionAudience(scope: PromptScope | undefined) {
-		if (scope?.escalate === "none") {
-			const person = scope.principalId;
+		if (!scope) return (from: Answerer) => from.tier === "owner";
+		const person = scope.principalId;
+		if (scope.escalate === "none")
 			return (from: Answerer) => from.principalId === person;
-		}
-		return (_from: Answerer) => true;
+		return (from: Answerer) =>
+			from.principalId === person || from.tier === "owner";
 	}
 
 	/**
@@ -463,7 +485,10 @@ export class OwnerDesk {
 				};
 				// Kept before the sockets are told, so a page that reloads on the news finds it.
 				this.#keep({ room, frame: open.frame, ...ended, closedAt });
-				broadcast({ type: "prompt_closed", prompt: id, ...ended, closedAt });
+				broadcast(
+					{ type: "prompt_closed", prompt: id, ...ended, closedAt },
+					room,
+				);
 			};
 			const onAbort = () => {
 				if (!this.#open.has(id)) return;
@@ -488,13 +513,13 @@ export class OwnerDesk {
 					late = true;
 					signal?.removeEventListener("abort", onAbort);
 					open.frame = { ...open.frame, late: true } as PromptFrame;
-					broadcast({ type: "prompt", room, prompt: open.frame });
+					broadcast({ type: "prompt", room, prompt: open.frame }, room);
 					resolve(card.pending as T);
 				}, graceMs);
 			signal?.addEventListener("abort", onAbort, { once: true });
 			supersede?.addEventListener("abort", onWithdraw, { once: true });
 			this.#open.set(id, open);
-			broadcast({ type: "prompt", room, prompt: open.frame });
+			broadcast({ type: "prompt", room, prompt: open.frame }, room);
 			try {
 				this.#options.opened?.(room, open.frame);
 			} catch (error) {

package/src/app/files.ts

@@ -73,6 +73,16 @@ interface Meta {
 	name: string;
 	type: string;
 	size: number;
+	/** The host room the file is bound to: only someone who may read that room is served it. */
+	room?: string;
+	/** Epoch milliseconds after which the sweep deletes the file; absent = the file is kept. */
+	expiresAt?: number;
+}
+
+/** What binds a stored file to a host room. */
+export interface FileBinding {
+	room: string;
+	expiresAt?: number;
 }
 
 /** A file being written as its bytes arrive; `finish` makes it a stored file, `abort` leaves nothing. */
@@ -85,6 +95,13 @@ export interface FileWriter {
 	abort(): Promise<void>;
 }
 
+const bindingFields = (
+	binding: FileBinding,
+): Pick<Meta, "room" | "expiresAt"> => ({
+	room: binding.room,
+	...(binding.expiresAt === undefined ? {} : { expiresAt: binding.expiresAt }),
+});
+
 /**
  * A directory of files kept by id, each with a small record of its name and type beside it.
  * Both stores of the app, the files of replies and sent messages and the uploads waiting for a
@@ -101,20 +118,61 @@ export class FileDir {
 		return join(this.dir, id);
 	}
 
-	/** Keeps the bytes under a new id. */
+	/** Keeps the bytes under a new id, bound to a host room when `binding` is given. */
 	put(
 		name: string,
 		type: string,
 		bytes: Uint8Array,
 		id = crypto.randomUUID(),
+		binding?: FileBinding,
 	): RoomFile {
 		mkdirSync(this.dir, { recursive: true, mode: 0o700 });
-		const meta: Meta = { name: safeName(name), type, size: bytes.byteLength };
+		const meta: Meta = {
+			name: safeName(name),
+			type,
+			size: bytes.byteLength,
+			...(binding ? bindingFields(binding) : {}),
+		};
 		writeFileSync(this.#path(id), bytes, { mode: 0o600 });
 		writeFileSync(`${this.#path(id)}.json`, JSON.stringify(meta), {
 			mode: 0o600,
 		});
-		return { id, ...meta };
+		return { id, name: meta.name, type, size: meta.size };
+	}
+
+	#read(id: string): Meta | undefined {
+		if (!isFileId(id)) return undefined;
+		try {
+			return JSON.parse(readFileSync(`${this.#path(id)}.json`, "utf8")) as Meta;
+		} catch {
+			return undefined;
+		}
+	}
+
+	/** The room a file is bound to and when it expires; undefined for a file that is bound to none. */
+	binding(id: string): FileBinding | undefined {
+		const meta = this.#read(id);
+		return meta?.room === undefined
+			? undefined
+			: {
+					room: meta.room,
+					...(meta.expiresAt === undefined
+						? {}
+						: { expiresAt: meta.expiresAt }),
+				};
+	}
+
+	/** Binds a stored file to a host room, or changes its expiry; false when there is no such file. */
+	bind(id: string, binding: FileBinding): boolean {
+		const meta = this.#read(id);
+		if (!meta || !existsSync(this.#path(id))) return false;
+		const { room: _room, expiresAt: _expiresAt, ...plain } = meta;
+		writeFileSync(
+			`${this.#path(id)}.json`,
+			JSON.stringify({ ...plain, ...bindingFields(binding) }),
+			{ mode: 0o600 },
+		);
+		return true;
 	}
 
 	/** Starts a file under a new id whose bytes arrive in pieces, so it is never held whole. */
@@ -161,12 +219,20 @@ export class FileDir {
 	}
 
 	meta(id: string): RoomFile | undefined {
+		const meta = this.#read(id);
+		return meta && { id, name: meta.name, type: meta.type, size: meta.size };
+	}
+
+	/** Whether the file's bytes are still stored. */
+	has(id: string): boolean {
+		return isFileId(id) && existsSync(this.#path(id));
+	}
+
+	/** How long ago the file was written, in milliseconds; undefined when there is none. */
+	ageOf(id: string, now: number): number | undefined {
 		if (!isFileId(id)) return undefined;
 		try {
-			const meta = JSON.parse(
-				readFileSync(`${this.#path(id)}.json`, "utf8"),
-			) as Meta;
-			return { id, name: meta.name, type: meta.type, size: meta.size };
+			return now - statSync(this.#path(id)).mtimeMs;
 		} catch {
 			return undefined;
 		}

package/src/app/presence.ts

@@ -46,7 +46,7 @@ export class Presence {
 		return { type: "presence", agents };
 	}
 
-	/** Sends the table to every socket once changes settle, if it changed. */
+	/** Sends the table to the owners' sockets once changes settle, if it changed. */
 	schedule(): void {
 		if (this.#pending || this.#stopped) return;
 		this.#pending = setTimeout(() => {
@@ -62,7 +62,7 @@ export class Presence {
 		const text = JSON.stringify(frame.agents);
 		if (text === this.#last || this.#stopped) return;
 		this.#last = text;
-		this.#options.sockets.broadcast(frame);
+		this.#options.sockets.deliver(frame, { owners: true });
 	}
 
 	stop(): void {