pi-roundtable-web 0.26.0 → 0.26.2

package/src/app/routes.ts

@@ -19,11 +19,14 @@ import type {
 	CharacterRefusal,
 	MessagesView,
 	ModelsView,
+	RoomOneView,
 	RoomsView,
 	SchedulesView,
 	ScheduleView,
 	SessionView,
 	SkillView,
+	ThreadsDismissed,
+	ThreadsRestored,
 	WorkspaceConflict,
 	WorkspaceNew,
 	WorkspaceRefusalBody,
@@ -48,7 +51,7 @@ import type { LayoutStore } from "./layout.ts";
 import { LayoutRoutes } from "./layout-routes.ts";
 import { PromptApi, type PromptApiOptions } from "./prompt-routes.ts";
 import { PAGE_LIMIT, type RoomLog } from "./room-log.ts";
-import type { Rooms } from "./rooms.ts";
+import type { ResolvedRoom, Rooms } from "./rooms.ts";
 import { SkillDocApi } from "./skill-doc-routes.ts";
 import type { AppSurface } from "./surface.ts";
 import { TeamApi } from "./team-routes.ts";
@@ -61,6 +64,9 @@ import {
 	WorkspaceRefusal,
 } from "./workspace-files.ts";
 
+/** The most threads one request puts back on the room list: more than the list ever shows. */
+const MAX_RESTORED = 100;
+
 export interface AppApiOptions {
 	/** The host's wording: a refusal reaches a client of the API in this locale when the catalog has it. */
 	presentation?: ConsolePresentation;
@@ -75,7 +81,15 @@ export interface AppApiOptions {
 	/** The rooms whose push the owners muted. */
 	mutes: Pick<PushMutes, "set" | "setMany">;
 	/** The dispatch threads, which go with the room they hang under. */
-	threads: Pick<WebThreads, "under" | "removeUnder">;
+	threads: Pick<
+		WebThreads,
+		| "under"
+		| "removeUnder"
+		| "dismiss"
+		| "dismissFinished"
+		| "restore"
+		| "restoreFinished"
+	>;
 	/** The owners' shared arrangement of the room list: pins and folders. */
 	layout: LayoutStore;
 	conversations: Pick<ConversationPort, "startFresh">;
@@ -496,6 +510,24 @@ export class AppApi {
 		}
 		const room = await rooms.resolve(key);
 		if (!room) throw notFound();
+		if (!action && method === "GET") {
+			// A thread dismissed from the list still opens by its address; the page asks for its view.
+			const view = await rooms.threadView(room.key);
+			if (!view) throw notFound();
+			return json({ room: view } satisfies RoomOneView);
+		}
+		if (action === "dismiss" && method === "POST" && parts.length === 4)
+			return this.#dismiss(room, admission);
+		if (action === "dismiss-threads" && method === "POST" && parts.length === 4)
+			return this.#dismissFinished(room, admission);
+		if (action === "undismiss" && method === "POST" && parts.length === 4)
+			return this.#restore(room, admission);
+		if (
+			action === "undismiss-threads" &&
+			method === "POST" &&
+			parts.length === 4
+		)
+			return this.#restoreFinished(room, request, admission);
 		if (action === "messages" && method === "GET" && parts.length === 4) {
 			const params = new URL(request.url).searchParams;
 			const before = params.get("before");
@@ -573,6 +605,68 @@ export class AppApi {
 		throw new HttpError(404, "There is no such API.");
 	}
 
+	/** Takes one finished thread off the room list for every owner; an open one is refused. */
+	async #dismiss(
+		room: ResolvedRoom,
+		admission: Authenticated,
+	): Promise<Response> {
+		if (room.kind !== "thread") throw notFound();
+		await this.#owner(admission);
+		const outcome = await this.#options.threads.dismiss(room.name);
+		if (outcome === "missing") throw notFound();
+		if (outcome === "open")
+			throw new HttpError(409, "The thread is still open.");
+		this.#options.changed();
+		return json({ dismissed: 1 } satisfies ThreadsDismissed);
+	}
+
+	/** Takes every finished thread of a room off the room list; the open ones stay. */
+	async #dismissFinished(
+		room: ResolvedRoom,
+		admission: Authenticated,
+	): Promise<Response> {
+		if (room.kind === "thread") throw notFound();
+		await this.#owner(admission);
+		const dismissed = await this.#options.threads.dismissFinished(room.key);
+		if (dismissed) this.#options.changed();
+		return json({ dismissed } satisfies ThreadsDismissed);
+	}
+
+	/** Puts one dismissed thread back on the room list for every owner: the undo of a dismissal. */
+	async #restore(
+		room: ResolvedRoom,
+		admission: Authenticated,
+	): Promise<Response> {
+		if (room.kind !== "thread") throw notFound();
+		await this.#owner(admission);
+		const outcome = await this.#options.threads.restore(room.name);
+		if (outcome === "missing") throw notFound();
+		this.#options.changed();
+		return json({ restored: 1 } satisfies ThreadsRestored);
+	}
+
+	/** Puts back the threads of a room that one clear-all dismissed, named by their keys. */
+	async #restoreFinished(
+		room: ResolvedRoom,
+		request: Request,
+		admission: Authenticated,
+	): Promise<Response> {
+		if (room.kind === "thread") throw notFound();
+		await this.#owner(admission);
+		const { threads } = await bodyOf(request);
+		if (
+			!Array.isArray(threads) ||
+			threads.length > MAX_RESTORED ||
+			!threads.every((one) => typeof one === "string")
+		)
+			throw bad("threads must be a list of at most 100 keys.");
+		// A key is `<surface>:<thread id>`; the store knows the id.
+		const ids = threads.map((key: string) => key.slice(key.indexOf(":") + 1));
+		const restored = await this.#options.threads.restoreFinished(room.key, ids);
+		if (restored) this.#options.changed();
+		return json({ restored } satisfies ThreadsRestored);
+	}
+
 	async #file(id: string, admission: Authenticated): Promise<Response> {
 		if (!isFileId(id)) throw notFound();
 		const { files, host } = this.#options;

package/src/app/socket.ts

@@ -559,7 +559,9 @@ export class SocketRoute {
 			this.#refuse(connection, code, frame.id);
 		// The agent rooms are the owners', and they take only turns.
 		if (who.tier !== "owner") return refuse("forbidden");
-		if (frame.mode === "note") return refuse("bad_frame");
+		// A note is for the other people who read the rooms; where nobody else does, it is no frame.
+		const note = frame.mode === "note";
+		if (note && !(await rooms.notesOn())) return refuse("bad_frame");
 		const room = await rooms.resolve(frame.room);
 		if (!room) return refuse("unknown_room");
 		if (room.readOnly) return refuse("read_only");
@@ -567,18 +569,22 @@ export class SocketRoute {
 		if (text.length > MAX_MESSAGE_CHARS) return refuse("too_long");
 		const ids = frame.uploads ?? [];
 		if (text === "" && ids.length === 0) return refuse("empty");
-		// Without the actor the credential vouched for, the router cannot tell whose message it is.
-		if (!who.actor) return refuse("forbidden");
+		// Without the actor the credential vouched for, the router cannot tell whose message it is;
+		// a note goes to no router.
+		if (!note && !who.actor) return refuse("forbidden");
 		const files = uploads.claim(ids, who.principalId);
 		if (!files) return refuse("unknown_upload");
 		if (!surface.started) return refuse("not_accepted");
 		try {
-			await this.say(room.key, who, text, files, connection, (message) =>
-				sockets.deliver(
-					{ type: "accepted", id: frame.id, room: room.key, message },
-					{ connection },
-				),
-			);
+			if (note)
+				await this.#note(connection, who, room.key, frame.id, text, files);
+			else
+				await this.say(room.key, who, text, files, connection, (message) =>
+					sockets.deliver(
+						{ type: "accepted", id: frame.id, room: room.key, message },
+						{ connection },
+					),
+				);
 		} catch (error) {
 			logger.warn(
 				{ room: room.key, err: error },
@@ -588,6 +594,36 @@ export class SocketRoute {
 		}
 	}
 
+	/**
+	 * Keeps an owner's internal note in a room: stored and shown to the other readers, and given to
+	 * no one else. It does not reach the host, so the agent runs no turn, the note is not in its
+	 * conversation, and nothing about the room reads as asked.
+	 */
+	async #note(
+		connection: AppSocket,
+		who: Answerer,
+		room: ChannelKey,
+		id: string,
+		text: string,
+		files: readonly RoomFile[],
+	): Promise<void> {
+		const { surface, uploads, sockets } = this.#options;
+		const message = await surface.publish(
+			{
+				room,
+				kind: "owner",
+				principalId: who.principalId,
+				author: who.name,
+				text,
+				files: [...files],
+				note: true,
+			},
+			connection,
+		);
+		uploads.use(files.map((file) => file.id));
+		sockets.deliver({ type: "accepted", id, room, message }, { connection });
+	}
+
 	/**
 	 * Takes a message of the owner into a room: stores it, shows it to the other sockets, and
 	 * hands it to the host as the owner's. `files` are uploads the sender claimed, which move to

package/src/app/surface-threads.ts

@@ -9,7 +9,7 @@ import type { NewRoomMessage } from "./room-log.ts";
 import type { WebThreads } from "./threads.ts";
 
 /** The name a post shows when its sender names none. */
-const ASSISTANT = "Assistant";
+const ASSISTANT = "Knight";
 /** Discord's small-print marker, which the notices of the host carry. */
 const NOTICE = /^-# /;
 

package/src/app/surface.ts

@@ -31,7 +31,7 @@ const APP_FORMATTING =
 	"Reply formatting (web app): Markdown renders, including tables, headings, lists, quotes, links, inline code and fenced code blocks. Raw HTML does not render. Files you attach appear under your message.";
 
 /** The name a reply shows when its sender names none. */
-const ASSISTANT = "Assistant";
+const ASSISTANT = "Knight";
 
 export interface AppSurfaceOptions {
 	/** The key prefix of the rooms, such as `app`. */
@@ -105,6 +105,7 @@ export interface RoomActivity {
 export class AppSurface implements ChatSurface {
 	readonly surface: string;
 	readonly agentRooms = true;
+	readonly label = "the web app";
 	readonly supportsFiles = true;
 	readonly formatting = APP_FORMATTING;
 	/** The turn takes an upload up to the most the app lets a person upload. */

package/src/app/threads.ts

@@ -60,6 +60,15 @@ export class WebThreads {
 		},
 	};
 
+	/** The mark of a finished thread the owners took off the room list; the thread itself stays. */
+	static readonly dismissedMigration: Migration = {
+		name: "web-threads-dismissed",
+		up: async (sql) => {
+			await sql`
+				ALTER TABLE web_threads ADD COLUMN IF NOT EXISTS dismissed_at timestamptz`;
+		},
+	};
+
 	/** Starts a thread under `parent`. */
 	async open(parent: string, title: string): Promise<WebThread> {
 		const id = `thread.${crypto.randomUUID()}`;
@@ -76,6 +85,46 @@ export class WebThreads {
 		await this.#sql`UPDATE web_threads SET open = false WHERE id = ${id}`;
 	}
 
+	/**
+	 * Takes a finished thread off the room list. It stays readable by its address, and asking again
+	 * changes nothing. An open thread is refused: `open` says so, `missing` that there is none.
+	 */
+	async dismiss(id: string): Promise<"dismissed" | "open" | "missing"> {
+		const rows: unknown[] = await this.#sql`
+			UPDATE web_threads SET dismissed_at = COALESCE(dismissed_at, now())
+			WHERE id = ${id} AND NOT open RETURNING 1`;
+		if (rows.length) return "dismissed";
+		return (await this.get(id)) ? "open" : "missing";
+	}
+
+	/** Dismisses every finished thread under `parent` that is still listed; returns how many. */
+	async dismissFinished(parent: string): Promise<number> {
+		const rows: unknown[] = await this.#sql`
+			UPDATE web_threads SET dismissed_at = now()
+			WHERE parent = ${parent} AND NOT open AND dismissed_at IS NULL RETURNING 1`;
+		return rows.length;
+	}
+
+	/** Puts a dismissed thread back on the room list; asking again changes nothing. */
+	async restore(id: string): Promise<"restored" | "missing"> {
+		const rows: unknown[] = await this.#sql`
+			UPDATE web_threads SET dismissed_at = NULL WHERE id = ${id} RETURNING 1`;
+		return rows.length ? "restored" : "missing";
+	}
+
+	/** Puts back the dismissed threads of `ids` that hang under `parent`; returns how many were dismissed. */
+	async restoreFinished(
+		parent: string,
+		ids: readonly string[],
+	): Promise<number> {
+		if (ids.length === 0) return 0;
+		const rows: unknown[] = await this.#sql`
+			UPDATE web_threads SET dismissed_at = NULL
+			WHERE parent = ${parent} AND id IN ${this.#sql([...ids])}
+				AND dismissed_at IS NOT NULL RETURNING 1`;
+		return rows.length;
+	}
+
 	async get(id: string): Promise<WebThread | undefined> {
 		const [row]: Row[] = await this
 			.#sql`SELECT * FROM web_threads WHERE id = ${id}`;
@@ -98,14 +147,14 @@ export class WebThreads {
 
 	/**
 	 * The threads the room list shows, newest first: every open one, and the `closedLimit` newest
-	 * closed ones, which stay readable but are not kept in view for ever.
+	 * closed ones that were not dismissed. The rest stay readable but are not kept in view.
 	 */
 	async list(closedLimit = CLOSED_LISTED): Promise<WebThread[]> {
 		const rows: Row[] = await this.#sql`
 			SELECT * FROM (
 				SELECT * FROM web_threads WHERE open
 				UNION ALL
-				(SELECT * FROM web_threads WHERE NOT open
+				(SELECT * FROM web_threads WHERE NOT open AND dismissed_at IS NULL
 					ORDER BY created_at DESC, id LIMIT ${closedLimit})
 			) shown ORDER BY created_at DESC, id`;
 		return rows.map(threadOf);

package/src/auth/authenticator.ts

@@ -78,8 +78,10 @@ export interface AuthenticatorOptions {
 	listener: { id: string; address: Readonly<ListenerAddress> | undefined };
 	/** The sign-in flow and the session store, for `oidc`. */
 	oidc?: {
-		login: Pick<OidcLogin, "open" | "credential">;
+		login: Pick<OidcLogin, "open" | "credential" | "verified">;
 		sessions: Pick<WebSessions, "alive">;
+		/** Hours the provider's word holds for one session; unset for no limit. */
+		reauthHours?: number | undefined;
 	};
 	/** Where the password is read from; default `process.env`. */
 	env?: Readonly<Record<string, string | undefined>>;
@@ -205,6 +207,8 @@ export function createAuthenticator(
 			)
 				return denied("foreign origin");
 			const { session } = checked as Admitted;
+			if (session)
+				options.oidc?.login.verified(session, identified.visitor.principal.id);
 			return {
 				visitor: identified.visitor,
 				...(checked.actor ? { actor: checked.actor } : {}),
@@ -215,16 +219,25 @@ export function createAuthenticator(
 		async recheck(held) {
 			if (held.session) {
 				try {
-					if (!(await options.oidc?.sessions.alive(held.session)))
+					if (
+						!(await options.oidc?.sessions.alive(
+							held.session,
+							options.oidc?.reauthHours,
+						))
+					)
 						return signedOut("session ended");
 				} catch {
 					return denied("session lookup failed");
 				}
 			}
 			const identified = await identify(held.actor);
-			return "refusal" in identified
-				? denied(String(identified.refusal))
-				: { visitor: identified.visitor };
+			if ("refusal" in identified) return denied(String(identified.refusal));
+			if (held.session)
+				options.oidc?.login.verified(
+					held.session,
+					identified.visitor.principal.id,
+				);
+			return { visitor: identified.visitor };
 		},
 	};
 }

package/src/auth/login-page.ts

@@ -1,9 +1,10 @@
 import { type ConsolePresentation, message } from "../features.ts";
 import { escapeHtml } from "../http.ts";
+import { iconLinks } from "../page-presentation.ts";
 
-/** The login page's CSP: no script at all, one inline style, and the form posts only to this origin. */
+/** The login page's CSP: no script at all, one inline style, its own icon, and the form posts only to this origin. */
 export const LOGIN_CSP =
-	"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
+	"default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
 
 /** The login page, as one server-rendered document with no script; `note` is a line above the field. */
 export function loginPage(
@@ -19,6 +20,7 @@ export function loginPage(
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="robots" content="noindex">
+${iconLinks(mount, false)}
 <title>${escapeHtml(title)}</title>
 <style>
 body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#f6f6f4;color:#1c1c1a}

package/src/auth/oidc-pages.ts

@@ -1,5 +1,6 @@
 import { type ConsolePresentation, message } from "../features.ts";
 import { escapeHtml } from "../http.ts";
+import { iconLinks } from "../page-presentation.ts";
 import { LOGIN_CSP } from "./login-page.ts";
 
 /** What a page of the sign-in flow tells, and the link it offers. */
@@ -30,6 +31,7 @@ export function oidcPage(
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="robots" content="noindex">
+${iconLinks(mount, false)}
 <title>${escapeHtml(title)}</title>
 <style>
 body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#f6f6f4;color:#1c1c1a}

package/src/auth/oidc.ts

@@ -27,6 +27,10 @@ const MAX_NAME_CHARS = 100;
 const MAX_SUBJECT_CHARS = 256;
 /** The most characters of one stored claim, as JSON. */
 const MAX_CLAIM_CHARS = 2000;
+/** How seldom a live session is reported again to `onSessionVerified`. */
+const VERIFIED_EVERY_MS = 300_000;
+/** The most sessions whose last report is remembered before the lapsed ones are dropped. */
+const VERIFIED_PRUNE_AT = 1024;
 /** Answers to a silent request that mean "the person must be asked", not "something is wrong". */
 const INTERACTION_NEEDED = new Set([
 	"login_required",
@@ -133,6 +137,8 @@ export interface OidcLoginOptions {
 	onSignIn?(info: SignedIn): void | Promise<void>;
 	/** A session ended (logout), so the sockets on it can close. */
 	onEnded?(sessionId: string): void;
+	/** A request or an open socket proved a live session of this person: the host's `onSessionVerified`. */
+	onSessionVerified?(principalId: string): void | Promise<void>;
 	logger: Logger;
 	/** The provider's signing keys; the published ones by default. */
 	keys?: JWTVerifyGetKey;
@@ -210,6 +216,8 @@ export class OidcLogin {
 	readonly #outCookie = "__Secure-rt_out";
 	/** States already used, until they would have lapsed. */
 	readonly #spent = new Map<string, number>();
+	/** When each session was last reported to `onSessionVerified`, by session id. */
+	readonly #verified = new Map<string, number>();
 
 	constructor(options: OidcLoginOptions) {
 		this.#options = options;
@@ -576,6 +584,33 @@ export class OidcLogin {
 		return { admitted: true, actor: facts, session: session.id };
 	};
 
+	/**
+	 * Reports that a request or an open socket proved this session live, so the host may count the
+	 * person as present. At most once per session every few minutes; never waits for the hook and
+	 * never throws: a hook that fails is logged.
+	 */
+	verified(session: string, principalId: string): void {
+		const hook = this.#options.onSessionVerified;
+		if (!hook) return;
+		const now = this.#now();
+		const last = this.#verified.get(session);
+		if (last !== undefined && now - last < VERIFIED_EVERY_MS) return;
+		if (this.#verified.size >= VERIFIED_PRUNE_AT)
+			for (const [id, at] of this.#verified)
+				if (now - at >= VERIFIED_EVERY_MS) this.#verified.delete(id);
+		this.#verified.set(session, now);
+		const failed = (cause: unknown) =>
+			this.#options.logger.warn(
+				{ err: cause },
+				"web-console: the session-verified hook failed",
+			);
+		try {
+			Promise.resolve(hook(principalId)).catch(failed);
+		} catch (cause) {
+			failed(cause);
+		}
+	}
+
 	async #logout(request: Request): Promise<Response> {
 		const { mount, origin, settings, metadata } = this.#options;
 		if (request.headers.get("origin") !== origin)
@@ -589,7 +624,10 @@ export class OidcLogin {
 		);
 		if (token) {
 			const id = await this.#options.sessions.end(token).catch(() => undefined);
-			if (id) this.#options.onEnded?.(id);
+			if (id) {
+				this.#verified.delete(id);
+				this.#options.onEnded?.(id);
+			}
 		}
 		const base = `${mount}/`;
 		let to = `${mount}/auth/signed-out`;

package/src/auth/sessions.ts

@@ -154,11 +154,18 @@ export class WebSessions {
 		return { ...found, lastSeenAt: now, expiresAt: expires };
 	}
 
-	/** Whether the session still stands, without moving its limit; for the recheck of an open socket. */
-	async alive(id: string): Promise<boolean> {
+	/**
+	 * Whether the session still stands, without moving its limit; for the recheck of an open socket.
+	 * With `reauthHours`, a session the provider has not vouched for within that many hours does not
+	 * stand, as on a request.
+	 */
+	async alive(id: string, reauthHours?: number): Promise<boolean> {
+		const now = this.#now();
 		const [row]: { n: number }[] = await this.#sql`
 			SELECT count(*)::int AS n FROM web_sessions
-			WHERE id_hash = ${Buffer.from(id, "hex")} AND expires_at > ${this.#now()}`;
+			WHERE id_hash = ${Buffer.from(id, "hex")} AND expires_at > ${now}
+			AND (${reauthHours ?? null}::float8 IS NULL
+				OR verified_at >= ${now}::timestamptz - make_interval(secs => ${(reauthHours ?? 0) * 3600}))`;
 		return (row?.n ?? 0) > 0;
 	}
 

package/src/authz.ts

@@ -50,7 +50,8 @@ export const ROUTES: readonly Rule[] = [
 	row("*", "api/notes", "V"),
 	row("*", "api/notes/:id", "V"),
 	row("*", "api/principals", "V"),
-	// The agent rooms are the owners'. The route says 404, not 403, to anyone else.
+	// The agent rooms are the owners'. The route says 404, not 403, to anyone else. Their threads are under
+	// it too: a thread's view and `…/dismiss`, and `…/dismiss-threads` of its parent.
 	row("*", "api/rooms", "O", true),
 	row("*", "api/rooms/**", "O", true),
 	row("*", "api/folders/**", "O"),

package/src/console-server.ts

@@ -12,8 +12,12 @@ import type { ConsoleApi } from "./console-api.ts";
 import { type ConsolePresentation, message } from "./features.ts";
 import type { Gate } from "./gate.ts";
 import { json } from "./http.ts";
-import { presentPage } from "./page-presentation.ts";
-import { servePwa } from "./pwa.ts";
+import {
+	defaultDescription,
+	type PageMeta,
+	presentPage,
+} from "./page-presentation.ts";
+import { hasMarkSvg, isPublicStatic, servePwa } from "./pwa.ts";
 import type { Visitor } from "./visitors.ts";
 import { viewerOf } from "./web-app.ts";
 
@@ -76,6 +80,10 @@ export interface ConsoleServerOptions {
 	/** Where the install icons come from; default the ones this package ships. */
 	iconsDir?: string;
 	look?: "modern" | "camelot";
+	/** The console's own origin, for the absolute `og:image` of a link preview. */
+	origin?: string;
+	/** What the page says about itself in a search result and a link preview; default derived from the title. */
+	description?: string;
 }
 
 /**
@@ -89,6 +97,7 @@ export interface ConsoleServerOptions {
 export class ConsoleServer {
 	readonly #options: ConsoleServerOptions;
 	readonly #base: string;
+	readonly #meta: PageMeta | undefined;
 	readonly #streams = new Set<ReadableStreamDefaultController<Uint8Array>>();
 	#pending: ReturnType<typeof setTimeout> | undefined;
 	#ping: ReturnType<typeof setInterval> | undefined;
@@ -96,6 +105,16 @@ export class ConsoleServer {
 	constructor(options: ConsoleServerOptions) {
 		this.#options = options;
 		this.#base = `${options.mount}/`;
+		const title = options.title ?? "Roundtable";
+		this.#meta = options.origin
+			? {
+					title,
+					description: options.description ?? defaultDescription(title),
+					origin: options.origin,
+					mount: options.mount,
+					svg: hasMarkSvg(options.iconsDir),
+				}
+			: undefined;
 		options.subscribe(() => this.#changed());
 	}
 
@@ -157,6 +176,11 @@ export class ConsoleServer {
 		if (path !== this.#options.mount && !path.startsWith(this.#base))
 			return new Response("Not found", { status: 404 });
 		const rest = path.slice(this.#base.length);
+		// Static and the same for everyone: a sign-in page and a link preview show the icon without a session.
+		if (READ_METHODS.has(request.method) && isPublicStatic(rest)) {
+			const shown = servePwa(rest, this.#pwa());
+			if (shown) return shown;
+		}
 		const open = await this.#options.authenticator.open?.(request, rest);
 		if (open) return open;
 		const admission = await this.#options.authenticator.authenticate(request);
@@ -183,10 +207,7 @@ export class ConsoleServer {
 			);
 		if (!READ_METHODS.has(request.method))
 			return new Response("Method not allowed", { status: 405 });
-		const installable = servePwa(rest, {
-			...this.#options,
-			title: this.#options.title ?? "Roundtable",
-		});
+		const installable = servePwa(rest, this.#pwa());
 		if (installable) return installable;
 		const asset = this.#options.assets.get(rest);
 		if (asset && rest !== "index.html" && rest !== "sw.js")
@@ -205,6 +226,7 @@ export class ConsoleServer {
 						this.#options.pathRouting ? this.#options.mount : undefined,
 						this.#options.presentation,
 						this.#options.look,
+						this.#meta,
 					),
 					{
 						headers: {
@@ -223,6 +245,10 @@ export class ConsoleServer {
 		return new Response("Not found", { status: 404 });
 	}
 
+	#pwa(): Parameters<typeof servePwa>[1] {
+		return { ...this.#options, title: this.#options.title ?? "Roundtable" };
+	}
+
 	async #gated(visitor: Visitor): Promise<boolean> {
 		const { gate } = this.#options;
 		if (!gate) return false;

package/src/host/cards.ts

@@ -49,11 +49,20 @@ export class HostCardLog {
 		},
 	};
 
+	/** The mark of a card the host keeps past its kind's retention (`HostCard.keep`). */
+	static readonly keepMigration: Migration = {
+		name: "web-host-cards-keep",
+		up: async (sql) => {
+			await sql`
+				ALTER TABLE web_host_cards ADD COLUMN IF NOT EXISTS keep boolean NOT NULL DEFAULT false`;
+		},
+	};
+
 	async create(room: string, card: HostCard): Promise<StoredHostCard> {
 		const id = crypto.randomUUID();
 		const [row]: Row[] = await this.#sql`
-			INSERT INTO web_host_cards (id, room, card, state)
-			VALUES (${id}, ${room}, ${JSON.stringify(card)}::jsonb, ${card.state ?? null})
+			INSERT INTO web_host_cards (id, room, card, state, keep)
+			VALUES (${id}, ${room}, ${JSON.stringify(card)}::jsonb, ${card.state ?? null}, ${card.keep === true})
 			RETURNING *`;
 		if (!row) throw new Error("the card log stored nothing");
 		return cardOf(row);
@@ -67,7 +76,7 @@ export class HostCardLog {
 	): Promise<StoredHostCard | undefined> {
 		const [row]: Row[] = await this.#sql`
 			UPDATE web_host_cards
-			SET card = ${JSON.stringify(card)}::jsonb, state = ${card.state ?? null}, updated_at = now()
+			SET card = ${JSON.stringify(card)}::jsonb, state = ${card.state ?? null}, keep = ${card.keep === true}, updated_at = now()
 			WHERE id = ${id} AND room = ${room} RETURNING *`;
 		return row && cardOf(row);
 	}
@@ -85,11 +94,15 @@ export class HostCardLog {
 		return rows.map(cardOf);
 	}
 
-	/** Deletes the cards of the rooms whose key starts with `prefix` that are older than `before`; how many. */
+	/**
+	 * Deletes the cards of the rooms whose key starts with `prefix` that are older than `before`,
+	 * except those the host marked `keep`; how many.
+	 */
 	async sweepKind(prefix: string, before: Date): Promise<number> {
 		const rows: unknown[] = await this.#sql`
 			DELETE FROM web_host_cards
-			WHERE starts_with(room, ${prefix}) AND created_at < ${before} RETURNING 1`;
+			WHERE starts_with(room, ${prefix}) AND created_at < ${before}
+			AND NOT keep RETURNING 1`;
 		return rows.length;
 	}