rechrome 1.36.1 → 1.37.0

package/serve.ts

@@ -1,7 +1,10 @@
 import { receiveUpload, readRequestJson } from "./scoped-upload.ts";
 import { readListeners, listenerAddress, authorizeProfileRequest, canReadProfileFile, profileOutputPrefix, normalizePrefix, resolveAllowedProfile, type Listener } from "./listeners.ts";
+import { WEBRTC, authorizeCredential, credentialForBearer, readShares, redeemInvite, shareProblem, updateShares, webrtcCredentials, type Credential, type ShareConfig } from "./shares.ts";
+import { bearerOf, safeEqual } from "./secret.ts";
+import { WebrtcHost } from "./webrtc.ts";
 import { file } from "bun";
-import { createHash, X509Certificate } from "crypto";
+import { createHash, randomBytes, X509Certificate } from "crypto";
 import { mkdirSync, lstatSync, chmodSync, unlinkSync, accessSync, readdirSync, realpathSync, constants as fsConstants } from "fs";
 import { join, resolve, relative, isAbsolute } from "path";
 import { tmpdir } from "os";
@@ -518,7 +521,7 @@ a { color: var(--accent); }
 <p>Someone shared a Chrome profile with you through <a href="https://github.com/snomiao/rechrome">rechrome</a>.
 On your computer, inside the project folder that should use it, run these two lines
 (the same in macOS/Linux terminals, PowerShell and cmd):</p>
-<p id="nokey" class="warn" hidden>This link is missing its key (the part after #key=). Ask for the full link from <code>rech share</code>.</p>
+<p id="nokey" class="warn" hidden>This link is missing its key (the part after # — #key=… or #rech1_…). Ask for the full link from <code>rech share</code>.</p>
 <div id="cmds"></div>
 <div id="profiles" hidden><p>Profiles this link can use (pick one to make it the default in the command above):</p><div id="plist"></div></div>
 <p class="small">Needs <a href="https://bun.sh">Bun</a>. Then try <code>rechrome open https://example.com</code>.
@@ -528,13 +531,14 @@ This link contains a secret key: anyone with it can use this browser profile, so
 (() => {
   let url = location.href;
   const key = (location.hash.match(/[#&]key=([^&]*)/) || [])[1];
-  if (!/[#&?]key=/.test(location.hash)) document.getElementById("nokey").hidden = false;
+  const invite = /^#rech1_[1-9A-HJ-NP-Za-km-z]{28}$/.test(location.hash);
+  if (!/[#&?]key=/.test(location.hash) && !invite) document.getElementById("nokey").hidden = false;
   // One command for every shell: two lines (no && vs ; split), one double-quoted URL. Characters a
   // shell expands inside double quotes ($ \` " \\ !) are percent-encoded, which the URL reads the same;
   // %40 goes back to a readable @ (valid in a query, and one less % for cmd to try to expand).
   const quote = s => '"' + s.replace(/%40/g, "@").replace(/[$\`"\\\\!]/g, c => "%" + c.charCodeAt(0).toString(16).toUpperCase()) + '"';
   const build = u => "bun i -g rechrome\\nrechrome connect " + quote(u);
-  const mask = s => s.replace(/(key=)[^&"\\n]+/, "$1…");
+  const mask = s => s.replace(/(key=)[^&"\\n]+/, "$1…").replace(/(#rech1_[1-9A-HJ-NP-Za-km-z]{4})[1-9A-HJ-NP-Za-km-z]+/, "$1…");
   const root = document.getElementById("cmds");
   const row = document.createElement("div"); row.className = "row";
   const line = document.createElement("div"); line.className = "cmd";
@@ -643,24 +647,23 @@ export async function serve() {
   const legacy: Listener = { name: "legacy", host: listenHost, port, key, profiles: "*" };
   const policies = new Map<string, Listener>();
   const servers = new Map<string, ReturnType<typeof Bun.serve>>();
-  const startServer = (initial: Listener, reusePort = false) => Bun.serve({
-    hostname: initial.host,
-    port: initial.port,
-    // reusePort is used only as a last-resort fallback (see bindAtStartup below): if an orphaned
-    // holder can't be killed, binding with SO_REUSEADDR keeps serve up (degraded, port-shared)
-    // instead of crash-looping on EADDRINUSE. The normal path binds a clean, exclusive socket.
-    reusePort,
-    tls,
-    error(err) {
-      log(`unhandled error: ${err.message}`);
-      return Response.json({ status: 1, stdout: "", stderr: err.message }, { status: 500 });
-    },
-    async fetch(req, server) {
-      const listener = policies.get(listenerAddress(initial));
-      if (!listener) return new Response("Listener removed", { status: 403 });
-      const key = listener.key;
-      const listenHost = listener.host;
-      const scoped = listener.profiles !== "*";
+  // Shares (shares.json) are reloaded with the listeners below. sessionOwners remembers which
+  // credential drove each session, for `rech session ls` and for closing a revoked share's sessions.
+  let shares: ShareConfig = { version: 1, shares: [] };
+  const sessionOwners = new Map<string, { owner: string; label: string; profile?: string; name: string; lastUsed: number }>();
+  const deviceSeen = new Map<string, number>();
+  const noteDeviceUse = (cred: Credential & { kind: "device" }) => {
+    const now = Date.now();
+    if (now - (deviceSeen.get(cred.device.id) ?? cred.device.lastSeen ?? 0) < 10 * 60_000) return;
+    deviceSeen.set(cred.device.id, now);
+    void updateShares(config => {
+      const device = config.shares.find(s => s.id === cred.share.id)?.devices.find(d => d.id === cred.device.id);
+      if (device) device.lastSeen = now;
+    }).catch(error => log(`could not record device use: ${error}`));
+  };
+
+  const handle = async (req: Request, initialListener: Listener, remoteAddr: () => string): Promise<Response> => {
+      let listener = initialListener;
       const reqUrl = new URL(req.url);
       const prefix = normalizePrefix(listener.prefix);
       // Accept the path with or without the prefix, so a proxy works whether it keeps the
@@ -671,18 +674,70 @@ export async function serve() {
         else if (reqUrl.pathname.startsWith(prefix)) reqUrl.pathname = "/" + reqUrl.pathname.slice(prefix.length);
       }
 
+      // Who is asking: the listener's own key (legacy links, the local management key), or a
+      // share credential (an invite or a device, see shares.ts) offered on this transport. A
+      // share narrows the listener to the share's own profiles.
+      const presented = req.headers.get("authorization")?.replace(/^Bearer /, "") ?? "";
+      const cred = presented && !safeEqual(presented, listener.key) ? credentialForBearer(shares, presented) : null;
+      if (cred) {
+        const route = reqUrl.pathname === "/ping" ? "ping" : reqUrl.pathname === "/redeem" ? "redeem" : "use";
+        const denial = authorizeCredential(cred, listener.name, route);
+        if (denial) return Response.json({ status: 1, stdout: "", stderr: `[rech] ${denial.message}\n`, error: denial.message, pending: denial.pending }, { status: denial.status });
+        if (cred.kind === "device") noteDeviceUse(cred);
+        listener = { ...listener, key: presented, profiles: cred.share.profiles };
+      }
+      const key = listener.key;
+      const listenHost = listener.host;
+      const scoped = listener.profiles !== "*";
+      const owner = cred?.kind === "device" ? `share:${cred.share.id}:${cred.device.id}` : `listener:${listener.name}`;
+
+      if (reqUrl.pathname === "/redeem" && req.method === "POST") {
+        if (cred?.kind !== "invite") return Response.json({ error: "Only an invite link can be redeemed." }, { status: 400 });
+        const { name } = await req.json().catch(() => ({})) as { name?: string };
+        try {
+          const device = await updateShares(config => redeemInvite(config, cred.share.id, String(name ?? "")));
+          shares = await readShares();
+          log(`share ${cred.share.label}: invite redeemed by device ${device.id} (${device.name})${device.approved ? "" : ", waiting for approval"}`);
+          return Response.json({ token: device.token, device: { id: device.id, name: device.name, approved: device.approved }, share: cred.share.label, profiles: cred.share.profiles });
+        } catch (error) { return Response.json({ error: error instanceof Error ? error.message : String(error) }, { status: 403 }); }
+      }
+
+      if (reqUrl.pathname === "/profiles") {
+        const denied = authCheck(req, key);
+        if (denied) return denied;
+        const registry = await readTokenRegistry().catch(() => ({} as Awaited<ReturnType<typeof readTokenRegistry>>));
+        const cache = await readChromeProfileCache().catch(() => null) ?? {};
+        const keys = listener.profiles === "*" ? Object.keys(registry) : listener.profiles;
+        return Response.json({ share: cred?.share.label, profiles: keys.map(k => ({ key: k, name: cache[registry[k]?.profileDir ?? ""]?.name ?? "", registered: !!registry[k] })) });
+      }
+
+      if (reqUrl.pathname === "/sessions") {
+        const denied = authCheck(req, key);
+        if (denied) return denied;
+        let live = new Set<string>();
+        try { live = new Set(readdirSync(tmpSocketRoot()).filter(f => f.endsWith(".sock")).map(f => f.slice(0, -5))); } catch {}
+        const all = listener.profiles === "*" && !cred;
+        const rows = [...sessionOwners.entries()]
+          .filter(([, o]) => all || o.owner === owner)
+          .map(([session, o]) => ({ session: o.name, profile: o.profile, client: o.label, owner: all ? o.owner : undefined, lastUsed: o.lastUsed, live: live.has(session) }))
+          .sort((a, b) => b.lastUsed - a.lastUsed);
+        return Response.json({ sessions: rows });
+      }
+
       // Serve files from output dir
       if (reqUrl.pathname.startsWith("/files/")) {
         const denied = authCheck(req, key);
         if (denied) return denied;
         const name = decodeURIComponent(reqUrl.pathname.slice(7));
         if (!isUnderDir(workDir, name)) return new Response("Forbidden", { status: 403 });
-        if (!canReadProfileFile(listener, name)) return new Response("Forbidden", { status: 403 });
+        const readable = (path: string) => canReadProfileFile(listener, path)
+          && (cred?.kind !== "device" || cred.share.profiles.some(p => path.startsWith(`${profileOutputPrefix(p)}d-${cred.device.id}/`)));
+        if (!readable(name)) return new Response("Forbidden", { status: 403 });
         const resolved = resolve(workDir, name);
         const f = file(resolved);
         if (!(await f.exists())) return new Response("Not found", { status: 404 });
         const real = realpathSync(resolved);
-        if (!isUnderDir(realpathSync(workDir), real) || !canReadProfileFile(listener, relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
+        if (!isUnderDir(realpathSync(workDir), real) || !readable(relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
         return new Response(f);
       }
 
@@ -694,7 +749,10 @@ export async function serve() {
         // clients / `rech status` can see trouble without an active probe.
         const degraded = consecutiveTimeouts > 0;
         if (scoped || !reqUrl.searchParams.get("deep"))
-          return Response.json({ ok: true, bind: listenHost, listener: listener.name, profiles: listener.profiles, multiListener: true, consecutiveTimeouts, degraded, chromeAccessProblem });
+          return Response.json({
+            ok: true, bind: listenHost, listener: listener.name, profiles: listener.profiles, multiListener: true, consecutiveTimeouts, degraded, chromeAccessProblem,
+            ...(cred ? { share: cred.share.label, kind: cred.kind, ...(cred.kind === "device" ? { device: { id: cred.device.id, name: cred.device.name, approved: cred.device.approved } } : {}), expiresAt: cred.share.expiresAt } : {}),
+          });
         // Deep probe: exercise the relay read-only via `tab-list` (opens nothing) against the
         // most-recently-used session — never a fresh one, which could spawn a browser window.
         const target = [...recentSessions.entries()].sort((a, b) => b[1] - a[1])[0]?.[0];
@@ -754,7 +812,9 @@ export async function serve() {
             PLAYWRIGHT_MCP_USER_DATA_DIR: entry.userDataDir || "",
             PLAYWRIGHT_MCP_LOAD_EXTENSION: entry.loadExtension || "",
           };
-          body.identity.key = `scoped:${body.identity.key}`;
+          // A share's devices never share browser state with each other or with legacy links.
+          body.identity.key = cred?.kind === "device" ? `share:${cred.share.id}:${cred.device.id}:${body.identity.key}` : `scoped:${body.identity.key}`;
+          if (cred) body.identity.label = cred.share.label;
           body.env = {}; // Server-owned profile configuration wins over every client override.
         } catch (error) {
           if (Array.isArray(body?.args) && body.args.filter((a: unknown) => typeof a !== "string" || !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a))[0] === "upload")
@@ -762,7 +822,9 @@ export async function serve() {
           return Response.json({ status: 1, stdout: "", stderr: `${error instanceof Error ? error.message : String(error)}\n` }, { status: 403 });
         }
       }
-      const outputPrefix = scopedProfile ? profileOutputPrefix(scopedProfile) : "";
+      // A share device's files live under its own folder, so other devices and links on the same
+      // profile can't fetch them (see the /files check above).
+      const outputPrefix = scopedProfile ? profileOutputPrefix(scopedProfile) + (cred?.kind === "device" ? `d-${cred.device.id}/` : "") : "";
       const runWorkDir = scopedProfile ? join(workDir, outputPrefix) : workDir;
       mkdirSync(runWorkDir, { recursive: true });
       let args: string[];
@@ -771,7 +833,7 @@ export async function serve() {
       let clientEnv: Record<string, string> = {};
       if (Array.isArray(body)) {
         args = body;
-        const clientAddr = `${req.headers.get("x-forwarded-for") || server.requestIP(req)?.address || "unknown"}`;
+        const clientAddr = remoteAddr();
         sessionId = createHash("sha256").update(clientAddr).digest("hex").slice(0, 8);
         clientName = clientAddr;
         log(`session from client IP: ${clientAddr} -> ${sessionId}`);
@@ -792,7 +854,7 @@ export async function serve() {
           clientName = labelBase || keyBase;
           log(`session from identity: ${clientName}${id?.profile ? ` profile:${id.profile}` : ""} [${keyBase}] -> ${sessionId}`);
         } else {
-          const clientAddr = `${req.headers.get("x-forwarded-for") || server.requestIP(req)?.address || "unknown"}`;
+          const clientAddr = remoteAddr();
           sessionId = createHash("sha256").update(clientAddr).digest("hex").slice(0, 8);
           clientName = clientAddr;
           log(`session from client IP fallback: ${clientAddr} -> ${sessionId}`);
@@ -817,6 +879,8 @@ export async function serve() {
       const namespacedSession = clientSession ? `${sessionId}-${clientSession}` : sessionId;
       // Track --isolate sessions so the idle-TTL reaper can close them later.
       const nowMs = Date.now();
+      sessionOwners.set(namespacedSession, { owner, label: cred ? `${cred.share.label}/${(cred as any).device?.name ?? ""}` : clientName, profile: scopedProfile ?? (body as any)?.identity?.profile, name: clientSession || "default", lastUsed: nowMs });
+      if (sessionOwners.size > 512) sessionOwners.delete(sessionOwners.keys().next().value!);
       if (isIsoSession(namespacedSession)) isoLastUsed.set(namespacedSession, nowMs);
       else noteSession(namespacedSession, nowMs); // for the deep health probe to target
 
@@ -1075,6 +1139,33 @@ export async function serve() {
         // a cross-OS daemon↔client (e.g. Windows daemon serving a Linux container client).
         files: outputFiles.map((p) => (outputPrefix + p).replaceAll("\\", "/")),
       });
+  };
+
+  // WebRTC: the same handler, reached over an encrypted DataChannel. Each request carries the
+  // bearer of the credential whose room it came in on, so share checks apply unchanged.
+  const webrtcListener: Listener = { name: WEBRTC, host: "webrtc", port: 0, key: randomBytes(24).toString("base64url"), profiles: [] };
+  const webrtc = new WebrtcHost(async (req, token) => {
+    const headers = new Headers(req.headers);
+    headers.set("Authorization", `Bearer ${bearerOf(token)}`);
+    return handle(new Request(req, { headers }), webrtcListener, () => "webrtc");
+  }, log);
+
+  const startServer = (initial: Listener, reusePort = false) => Bun.serve({
+    hostname: initial.host,
+    port: initial.port,
+    // reusePort is used only as a last-resort fallback (see bindAtStartup below): if an orphaned
+    // holder can't be killed, binding with SO_REUSEADDR keeps serve up (degraded, port-shared)
+    // instead of crash-looping on EADDRINUSE. The normal path binds a clean, exclusive socket.
+    reusePort,
+    tls,
+    error(err) {
+      log(`unhandled error: ${err.message}`);
+      return Response.json({ status: 1, stdout: "", stderr: err.message }, { status: 500 });
+    },
+    async fetch(req, server) {
+      const listener = policies.get(listenerAddress(initial));
+      if (!listener) return new Response("Listener removed", { status: 403 });
+      return handle(req, listener, () => `${req.headers.get("x-forwarded-for") || server.requestIP(req)?.address || "unknown"}`);
     },
   });
 
@@ -1143,12 +1234,42 @@ export async function serve() {
     configured ||= !!config;
     applied = fingerprint;
   };
+  // Shares change independently of listeners (redeem, approve, revoke); a bad shares.json keeps
+  // the previous one, like listeners.json.
+  let appliedShares = "";
+  const reloadShares = async () => {
+    const next = await readShares();
+    // Expiry is time-based: fold "what is live right now" into the fingerprint so an expiring
+    // share or invite closes its rooms and sessions without anyone touching the file.
+    const now = Date.now();
+    const fingerprint = JSON.stringify(next) + JSON.stringify(next.shares.map(s => [!!shareProblem(s, now), !!(s.inviteExpiresAt && now >= s.inviteExpiresAt)]));
+    if (fingerprint === appliedShares) return;
+    const allowed = new Set(next.shares.filter(s => !shareProblem(s, now)).flatMap(s => s.devices.map(d => `share:${s.id}:${d.id}`)));
+    const dropped = [...sessionOwners.entries()].filter(([, o]) => o.owner.startsWith("share:") && !allowed.has(o.owner));
+    shares = next;
+    appliedShares = fingerprint;
+    // A revoked share or a removed device loses its browser sessions too.
+    if (dropped.length) {
+      const [bin, ...binArgs] = splitCommand(resolvePlaywrightCli());
+      for (const [session, o] of dropped) {
+        sessionOwners.delete(session);
+        try { Bun.spawn([bin, ...binArgs, "close", `-s=${session}`], { cwd: workDir, stdin: "ignore", stdout: "ignore", stderr: "ignore", windowsHide: true, env: playwrightCliEnv() }); } catch {}
+        log(`closed session ${session} of ${o.label}: its share was revoked or its device removed`);
+      }
+    }
+    const creds = webrtcCredentials(next);
+    webrtc.sync(creds.map(c => ({ token: c.token, signal: c.share.signal!, label: c.kind === "device" ? `${c.share.label}/${c.device.name}` : `${c.share.label} (invite)` })));
+    if (creds.length || webrtc.size) log(`webrtc: listening for ${creds.length} share credential(s)`);
+  };
+  await reloadShares().catch(error => log(`shares.json rejected: ${error}`));
   await reload(true);
   let reloading = false;
   let lastError = "";
   setInterval(async () => {
     if (reloading) return;
     reloading = true;
+    // Independent: a broken listeners.json must not freeze revocations (and vice versa).
+    try { await reloadShares(); } catch (error) { log(`shares.json reload rejected; previous shares retained: ${error}`); }
     try { await reload(); lastError = ""; }
     catch (error) {
       const message = String(error);

package/shares.js

@@ -0,0 +1,349 @@
+// @bun
+// shares.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { homedir } from "os";
+import { join } from "path";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
+
+// secret.ts
+import { hkdfSync, randomBytes, timingSafeEqual } from "crypto";
+var TOKEN_PREFIX = "rech1_";
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var B58 = "[1-9A-HJ-NP-Za-km-z]";
+var BODY_LEN = 22;
+var SUM_LEN = 6;
+var SECRET_BYTES = 16;
+var TOKEN_PATTERN = new RegExp(`\\brech1_${B58}{${BODY_LEN + SUM_LEN}}\\b`, "g");
+var EXACT = new RegExp(`^rech1_(${B58}{${BODY_LEN}})(${B58}{${SUM_LEN}})$`);
+function base58(bytes, width) {
+  let n = 0n;
+  for (const b of bytes)
+    n = n << 8n | BigInt(b);
+  let s = "";
+  while (n > 0n) {
+    s = ALPHABET[Number(n % 58n)] + s;
+    n /= 58n;
+  }
+  if (s.length > width)
+    throw new Error("base58 value wider than its field");
+  return s.padStart(width, "1");
+}
+function unbase58(text, length) {
+  let n = 0n;
+  for (const c of text) {
+    const i = ALPHABET.indexOf(c);
+    if (i < 0)
+      return null;
+    n = n * 58n + BigInt(i);
+  }
+  const out = new Uint8Array(length);
+  for (let i = length - 1;i >= 0; i--) {
+    out[i] = Number(n & 0xffn);
+    n >>= 8n;
+  }
+  return n === 0n ? out : null;
+}
+var CRC_TABLE = (() => {
+  const t = new Uint32Array(256);
+  for (let i = 0;i < 256; i++) {
+    let c = i;
+    for (let k = 0;k < 8; k++)
+      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+    t[i] = c >>> 0;
+  }
+  return t;
+})();
+function crc32(bytes) {
+  let c = 4294967295;
+  for (const b of bytes)
+    c = CRC_TABLE[(c ^ b) & 255] ^ c >>> 8;
+  return (c ^ 4294967295) >>> 0;
+}
+var u32 = (n) => new Uint8Array([n >>> 24, n >>> 16 & 255, n >>> 8 & 255, n & 255]);
+function formatToken(secret) {
+  if (secret.length !== SECRET_BYTES)
+    throw new Error(`a share secret is ${SECRET_BYTES} bytes`);
+  return `${TOKEN_PREFIX}${base58(secret, BODY_LEN)}${base58(u32(crc32(secret)), SUM_LEN)}`;
+}
+function newToken() {
+  return formatToken(new Uint8Array(randomBytes(SECRET_BYTES)));
+}
+function parseToken(token) {
+  const m = EXACT.exec(token.trim());
+  if (!m)
+    return { ok: false, reason: "format" };
+  const secret = unbase58(m[1], SECRET_BYTES), sum = unbase58(m[2], 4);
+  if (!secret || !sum)
+    return { ok: false, reason: "format" };
+  const expected = u32(crc32(secret));
+  return sum.every((b, i) => b === expected[i]) ? { ok: true, secret } : { ok: false, reason: "checksum" };
+}
+function secretOf(token) {
+  const parsed = parseToken(token);
+  if (!parsed.ok)
+    throw new Error(parsed.reason === "checksum" ? "This rech1_ link is damaged (checksum mismatch): it was copied incompletely or mistyped." : "Not a rech1_ link.");
+  return parsed.secret;
+}
+var derive = (token, label, bytes) => new Uint8Array(hkdfSync("sha256", secretOf(token), new Uint8Array(0), `rech/${label}`, bytes));
+var bearerOf = (token) => `rb_${base58(derive(token, "bearer", 24), 33)}`;
+var credentialIdOf = (token) => base58(derive(token, "id", 6), 9);
+function safeEqual(a, b) {
+  const x = Buffer.from(a), y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+
+// shares.ts
+var WEBRTC = "webrtc";
+var DEFAULT_SIGNAL = "https://rechrome.pages.dev/";
+var SHARES_FILE = join(homedir(), ".rechrome", "shares.json");
+var LABEL = /^[a-z0-9][a-z0-9_-]{0,39}$/;
+function validateShares(value) {
+  const config = value;
+  if (config?.version !== 1 || !Array.isArray(config.shares))
+    throw new Error("shares.json requires version 1 and a shares list");
+  const labels = new Set;
+  for (const s of config.shares) {
+    if (!s || typeof s.id !== "string" || !LABEL.test(s.label) || typeof s.invite !== "string" || !Array.isArray(s.profiles) || !Array.isArray(s.via) || !s.via.length || !Array.isArray(s.devices) || !Number.isInteger(s.maxDevices) || s.maxDevices < 1)
+      throw new Error(`shares.json: malformed share ${JSON.stringify(s?.label ?? s?.id ?? "?")}`);
+    if (labels.has(s.label))
+      throw new Error(`shares.json: duplicate share name "${s.label}"`);
+    labels.add(s.label);
+  }
+  return config;
+}
+async function readShares(path = SHARES_FILE) {
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { version: 1, shares: [] };
+    throw error;
+  }
+  return validateShares(JSON.parse(raw));
+}
+async function writeShares(config, path = SHARES_FILE) {
+  validateShares(config);
+  await mkdir(join(path, ".."), { recursive: true });
+  const temp = `${path}.${randomBytes2(6).toString("hex")}.tmp`;
+  await writeFile(temp, JSON.stringify(config, null, 2) + `
+`, { mode: 384 });
+  await rename(temp, path);
+}
+async function updateShares(fn, path = SHARES_FILE) {
+  const lock = `${path}.lock`;
+  await mkdir(join(path, ".."), { recursive: true });
+  for (;; ) {
+    try {
+      await mkdir(lock);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      if (await staleLock(lock)) {
+        await rm(lock, { recursive: true, force: true });
+        continue;
+      }
+      await new Promise((r) => setTimeout(r, 25 + Math.random() * 50));
+    }
+  }
+  await writeFile(join(lock, "owner"), JSON.stringify({ pid: process.pid, at: Date.now() }));
+  try {
+    const config = await readShares(path);
+    const result = await fn(config);
+    await writeShares(config, path);
+    return result;
+  } finally {
+    await rm(lock, { recursive: true, force: true });
+  }
+}
+async function staleLock(lock) {
+  try {
+    const { pid, at } = JSON.parse(await readFile(join(lock, "owner"), "utf8"));
+    if (Date.now() - at > 30000)
+      return true;
+    try {
+      process.kill(pid, 0);
+      return false;
+    } catch (error) {
+      return error.code === "ESRCH";
+    }
+  } catch {
+    const st = await stat(lock).catch(() => null);
+    return !!st && Date.now() - st.mtimeMs > 30000;
+  }
+}
+function findShare(config, name) {
+  const share = config.shares.find((s) => s.label === name || s.id === name);
+  if (!share)
+    throw new Error(`No share named "${name}". See: rech share ls`);
+  return share;
+}
+function createShare(config, opts) {
+  const now = opts.now ?? Date.now();
+  if (!LABEL.test(opts.label))
+    throw new Error(`Share names use a-z, 0-9, "-" and "_" (up to 40), e.g. alice or ci-bot; got "${opts.label}"`);
+  if (config.shares.some((s) => s.label === opts.label))
+    throw new Error(`A share named "${opts.label}" already exists. Pick another --name, or: rech share rotate ${opts.label}`);
+  if (!opts.profiles.length)
+    throw new Error("A share needs at least one profile.");
+  if (!opts.via.length)
+    throw new Error("A share needs at least one transport (--via).");
+  const share = {
+    id: randomBytes2(4).toString("hex"),
+    label: opts.label,
+    invite: newToken(),
+    inviteExpiresAt: opts.inviteTtlMs ? now + opts.inviteTtlMs : undefined,
+    inviteTtlMs: opts.inviteTtlMs,
+    profiles: [...new Set(opts.profiles)],
+    via: [...new Set(opts.via)],
+    signal: opts.via.includes(WEBRTC) ? normalizeSignal(opts.signal ?? DEFAULT_SIGNAL) : undefined,
+    createdAt: now,
+    expiresAt: opts.expiresAt,
+    maxDevices: opts.maxDevices ?? 1,
+    approve: !!opts.approve,
+    devices: []
+  };
+  config.shares.push(share);
+  return share;
+}
+function normalizeSignal(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`Signal server must be an http(s) URL, e.g. https://signal.example.com; got "${value}"`);
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+    throw new Error("Signal server must be a plain http(s) URL, without credentials, query or fragment");
+  if (!url.pathname.endsWith("/"))
+    url.pathname += "/";
+  return url.toString();
+}
+function inviteLink(share, origin) {
+  const base = origin.endsWith("/") ? origin : `${origin}/`;
+  return `${base}#${share.invite}`;
+}
+var bearerCache = new Map;
+var cachedBearer = (token) => {
+  let b = bearerCache.get(token);
+  if (!b) {
+    b = bearerOf(token);
+    bearerCache.set(token, b);
+  }
+  return b;
+};
+function credentialForBearer(config, bearer) {
+  if (!bearer)
+    return null;
+  for (const share of config.shares) {
+    if (safeEqual(cachedBearer(share.invite), bearer))
+      return { share, kind: "invite", token: share.invite };
+    for (const device of share.devices)
+      if (safeEqual(cachedBearer(device.token), bearer))
+        return { share, kind: "device", token: device.token, device };
+  }
+  return null;
+}
+var day = (ms) => new Date(ms).toISOString().slice(0, 10);
+function shareProblem(share, now = Date.now()) {
+  if (share.revokedAt)
+    return `Share "${share.label}" was revoked by its host.`;
+  if (share.expiresAt && now >= share.expiresAt)
+    return `Share "${share.label}" expired on ${day(share.expiresAt)}. Ask the host to renew it: rech share renew ${share.label}`;
+  return null;
+}
+function inviteProblem(share, now = Date.now()) {
+  if (share.inviteExpiresAt && now >= share.inviteExpiresAt)
+    return `This invite expired unused. Ask the host for a fresh one: rech share rotate ${share.label}`;
+  if (share.devices.length >= share.maxDevices)
+    return `This invite was already used${share.maxDevices > 1 ? ` by ${share.maxDevices} devices` : ""}. Ask the host for a fresh one (rech share rotate ${share.label}); if you didn't use it, tell them, since someone else did.`;
+  return null;
+}
+function authorizeCredential(cred, via, route, now = Date.now()) {
+  const problem = shareProblem(cred.share, now);
+  if (problem)
+    return { status: 403, message: problem };
+  if (!cred.share.via.includes(via))
+    return { status: 403, message: `Share "${cred.share.label}" is not offered on this connection.` };
+  if (cred.kind === "invite") {
+    if (route === "ping")
+      return null;
+    const inv = inviteProblem(cred.share, now);
+    if (inv)
+      return { status: 403, message: inv };
+    if (route === "redeem")
+      return null;
+    return { status: 403, message: "This link is an invite: run `rech connect '<link>'` once to register this device." };
+  }
+  if (!cred.device.approved && route !== "ping")
+    return { status: 403, pending: true, message: `Waiting for the host to approve this device (${cred.device.name}, ${cred.device.id}). On the host: rech share approve ${cred.share.label} ${cred.device.id}` };
+  return null;
+}
+function redeemInvite(config, shareId, name, now = Date.now()) {
+  const share = config.shares.find((s) => s.id === shareId);
+  if (!share)
+    throw new Error("This share no longer exists.");
+  const problem = shareProblem(share, now) ?? inviteProblem(share, now);
+  if (problem)
+    throw new Error(problem);
+  const token = newToken();
+  const device = {
+    id: credentialIdOf(token),
+    name: (name || "device").replace(/[^\w .@-]/g, "").slice(0, 40) || "device",
+    token,
+    addedAt: now,
+    approved: !share.approve
+  };
+  share.devices.push(device);
+  return device;
+}
+function findDevice(share, id) {
+  const device = share.devices.find((d) => d.id === id || d.name === id);
+  if (!device)
+    throw new Error(`Share "${share.label}" has no device "${id}". See: rech share devices ${share.label}`);
+  return device;
+}
+function parseDuration(text) {
+  const t = text.trim().toLowerCase();
+  if (["never", "none", "0", "off"].includes(t))
+    return;
+  const m = /^(\d+(?:\.\d+)?)\s*(m|min|h|d|w)$/.exec(t);
+  if (!m)
+    throw new Error(`Durations look like 90m, 24h, 30d or 2w (or "never"); got "${text}"`);
+  const unit = { m: 60000, min: 60000, h: 3600000, d: 86400000, w: 604800000 }[m[2]];
+  return Math.round(Number(m[1]) * unit);
+}
+function webrtcCredentials(config, now = Date.now()) {
+  const out = [];
+  for (const share of config.shares) {
+    if (!share.via.includes(WEBRTC) || shareProblem(share, now))
+      continue;
+    if (!(share.inviteExpiresAt && now >= share.inviteExpiresAt))
+      out.push({ share, kind: "invite", token: share.invite });
+    for (const device of share.devices)
+      out.push({ share, kind: "device", token: device.token, device });
+  }
+  return out;
+}
+export {
+  DEFAULT_SIGNAL,
+  SHARES_FILE,
+  WEBRTC,
+  authorizeCredential,
+  createShare,
+  credentialForBearer,
+  findDevice,
+  findShare,
+  inviteLink,
+  inviteProblem,
+  normalizeSignal,
+  parseDuration,
+  readShares,
+  redeemInvite,
+  shareProblem,
+  updateShares,
+  validateShares,
+  webrtcCredentials,
+  writeShares
+};