npm - vibeshare-live - Versions diffs - 0.1.0 → 0.2.0 - Mend

vibeshare-live 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/README.md +53 -67
package/dist/chunk-RY2ANOPC.js +1018 -0
package/dist/cli.d.ts +33 -35
package/dist/cli.js +393 -238
package/dist/index.d.ts +106 -47
package/dist/index.js +53 -22
package/dist/manager-uhMBJXtu.d.ts +259 -0
package/dist/mcp.d.ts +27 -38
package/dist/mcp.js +199 -14616
package/docs/launch-video-16x9.html +673 -0
package/docs/launch-video-9x16.html +673 -0
package/docs/launch-video.html +490 -0
package/docs/prototype.html +964 -0
package/docs/spec.md +61 -0
package/package.json +41 -23
package/dist/chunk-5OLI3WTU.js +0 -233
package/dist/share-CoX608sF.d.ts +0 -188

package/dist/chunk-RY2ANOPC.js ADDED Viewed

@@ -0,0 +1,1018 @@
+// src/consent.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { createConsentLedger } from "@pooriaarab/vibe-core";
+function vibeHome() {
+  return process.env["VIBESHARE_HOME"] ?? join(homedir(), ".vibeshare");
+}
+function ensureDir(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+}
+var FileConsentStore = class {
+  file;
+  constructor(file = join(vibeHome(), "consent.json")) {
+    this.file = file;
+  }
+  load() {
+    try {
+      if (!existsSync(this.file)) return [];
+      const parsed = JSON.parse(readFileSync(this.file, "utf8"));
+      if (!Array.isArray(parsed)) return [];
+      return parsed.filter(
+        (g) => typeof g === "object" && g !== null && typeof g.scope === "string" && typeof g.grantedAt === "string"
+      );
+    } catch {
+      return [];
+    }
+  }
+  save(grants) {
+    ensureDir(join(this.file, ".."));
+    writeFileSync(this.file, JSON.stringify(grants, null, 2), { mode: 384 });
+    try {
+      chmodSync(this.file, 384);
+    } catch {
+    }
+  }
+};
+function loadLedger(store) {
+  return createConsentLedger(store ?? new FileConsentStore());
+}
+function sharesDir() {
+  return join(vibeHome(), "shares");
+}
+function writeActiveShare(rec) {
+  const dir = sharesDir();
+  ensureDir(dir);
+  const file = join(dir, `${rec.id}.json`);
+  writeFileSync(file, JSON.stringify(rec, null, 2), { mode: 384 });
+  try {
+    chmodSync(file, 384);
+  } catch {
+  }
+}
+function readActiveShare(id) {
+  try {
+    const parsed = JSON.parse(readFileSync(join(sharesDir(), `${id}.json`), "utf8"));
+    return isActiveShareRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function listActiveShares() {
+  try {
+    const dir = sharesDir();
+    if (!existsSync(dir)) return [];
+    const records = [];
+    for (const name of readdirSync(dir)) {
+      if (!name.endsWith(".json")) continue;
+      try {
+        const parsed = JSON.parse(readFileSync(join(dir, name), "utf8"));
+        if (isActiveShareRecord(parsed)) records.push(parsed);
+      } catch {
+      }
+    }
+    return records.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+  } catch {
+    return [];
+  }
+}
+function clearActiveShare(id) {
+  try {
+    rmSync(join(sharesDir(), `${id}.json`), { force: true });
+  } catch {
+  }
+}
+function isActiveShareRecord(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  return typeof r["id"] === "string" && typeof r["url"] === "string" && typeof r["port"] === "number" && typeof r["hostToken"] === "string" && typeof r["pid"] === "number" && typeof r["startedAt"] === "string";
+}
+// src/spectatorPage.ts
+function spectatorPage(share) {
+  const config = JSON.stringify({
+    id: share.id,
+    name: share.name,
+    access: share.access
+  }).replace(/</g, "\\u003c");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>vibeshare \xB7 ${escapeHtml(share.name)}</title>
+<style>
+  :root{ --bg:#0a0b0f; --panel:#12141a; --panel-2:#171a22; --panel-3:#1d2129;
+    --border:rgba(255,255,255,.08); --border-2:rgba(255,255,255,.14);
+    --text:#edeef3; --dim:#9aa0b2; --faint:#666c7c; --cyan:#67e8f9;
+    --violet:#c4b5fd; --green:#7ee787; --red:#ff8b85;
+    --mono:ui-monospace,"SF Mono","Cascadia Code",Menlo,Consolas,monospace;
+    --sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif; }
+  *{ box-sizing:border-box; }
+  body{ margin:0; background:var(--bg); color:var(--text); font-family:var(--sans);
+    -webkit-font-smoothing:antialiased; min-height:100vh; }
+  .app{ max-width:860px; margin:0 auto; padding:26px 22px 48px; }
+  .topbar{ display:flex; align-items:center; justify-content:space-between; gap:14px;
+    padding-bottom:18px; margin-bottom:20px; border-bottom:1px solid var(--border); flex-wrap:wrap; }
+  .brand{ font-size:17px; font-weight:650; letter-spacing:-.01em; }
+  .brand span{ color:var(--faint); font-size:12.5px; font-weight:450; margin-left:9px; }
+  .p2p{ font-family:var(--mono); font-size:12px; color:var(--dim); background:var(--panel);
+    border:1px solid var(--border-2); border-radius:999px; padding:6px 13px; white-space:nowrap; }
+  .p2p b{ color:var(--green); font-weight:600; }
+  .meta{ display:flex; align-items:center; gap:12px; flex-wrap:wrap; margin-bottom:14px; }
+  .badge{ display:inline-flex; align-items:center; gap:6px; font-size:11.5px; font-weight:700;
+    letter-spacing:.03em; color:var(--cyan); background:rgba(103,232,249,.1);
+    border:1px solid rgba(103,232,249,.3); border-radius:999px; padding:5px 11px; }
+  .badge.collab{ color:var(--violet); background:rgba(196,181,253,.12); border-color:rgba(196,181,253,.35); }
+  .badge.ended{ color:var(--red); background:rgba(255,139,133,.1); border-color:rgba(255,139,133,.35); }
+  .badge .d{ width:6px; height:6px; border-radius:50%; background:currentColor; }
+  .count{ font-family:var(--mono); font-size:12.5px; color:var(--dim); }
+  .count b{ color:var(--text); }
+  .term{ background:#0d0f14; border:1px solid var(--border); border-radius:12px; overflow:hidden; }
+  .chrome{ display:flex; align-items:center; gap:6px; padding:10px 12px;
+    background:var(--panel-2); border-bottom:1px solid var(--border); }
+  .chrome span{ width:9px; height:9px; border-radius:50%; background:#3a3f4b; }
+  .chrome .path{ margin-left:8px; font-family:var(--mono); font-size:11.5px; color:var(--faint);
+    overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+  .body{ font-family:var(--mono); font-size:13px; line-height:1.7; padding:14px 16px;
+    min-height:280px; max-height:56vh; overflow-y:auto; }
+  .line{ white-space:pre-wrap; word-break:break-word; }
+  .line.stderr{ color:var(--dim); }
+  .line.milestone{ color:var(--violet); }
+  .line.system{ color:var(--faint); font-style:italic; }
+  .panel{ background:var(--panel); border:1px solid var(--border); border-radius:12px;
+    padding:18px; margin-bottom:16px; }
+  .panel h1{ font-size:15px; margin:0 0 4px; }
+  .panel p{ font-size:13px; color:var(--dim); margin:0 0 14px; }
+  .row{ display:flex; gap:10px; flex-wrap:wrap; }
+  input{ flex:1; min-width:160px; font-family:var(--mono); font-size:13px; color:var(--text);
+    background:var(--panel-2); border:1px solid var(--border); border-radius:8px; padding:10px 12px; }
+  input:focus{ outline:none; border-color:var(--cyan); }
+  .err{ color:var(--red); font-size:12.5px; margin-top:10px; display:none; }
+  button{ font-family:inherit; font-size:13px; font-weight:600; color:var(--text);
+    background:var(--panel-3); border:1px solid var(--border-2); border-radius:8px;
+    padding:10px 16px; cursor:pointer; }
+  button:hover{ background:#242933; }
+  button:disabled{ opacity:.6; cursor:default; }
+  .join-btn{ margin-top:14px; background:#3a3160; border-color:rgba(196,181,253,.5); color:#f2eeff; }
+  .join-btn:hover{ background:#453a78; }
+  .join-btn.pending{ background:var(--panel-3); border-color:var(--border-2); color:var(--dim); }
+  .join-btn.joined{ background:rgba(126,231,135,.12); border-color:rgba(126,231,135,.4); color:var(--green); }
+  .hidden{ display:none !important; }
+</style>
+</head>
+<body>
+<div class="app">
+  <header class="topbar">
+    <div class="brand">vibeshare<span id="sessionName"></span></div>
+    <div class="p2p"><b>\u25CF</b> p2p \xB7 nothing stored on a server</div>
+  </header>
+  <div class="panel" id="joinPanel">
+    <h1>Watch this session live</h1>
+    <p>Read-only. The stream comes straight from the host machine.</p>
+    <div class="row">
+      <input id="nameInput" placeholder="your name (optional)" maxlength="32">
+      <input id="passInput" placeholder="passphrase" type="password" class="hidden">
+      <button id="watchBtn">Watch</button>
+    </div>
+    <div class="err" id="joinErr"></div>
+  </div>
+  <div class="meta">
+    <span class="badge" id="badge"><span class="d"></span> CONNECTING</span>
+    <span class="count">\u{1F441} <b id="watching">0</b> watching</span>
+  </div>
+  <div class="term">
+    <div class="chrome"><span></span><span></span><span></span><span class="path" id="chromePath"></span></div>
+    <div class="body" id="termBody"></div>
+  </div>
+  <button class="join-btn hidden" id="reqBtn">Request to join</button>
+</div>
+<script>
+(function(){
+  "use strict";
+  var CFG = ${config};
+  var base = location.origin + "/s/" + CFG.id;
+  var viewer = null, source = null;
+  var joinPanel = document.getElementById("joinPanel");
+  var joinErr = document.getElementById("joinErr");
+  var passInput = document.getElementById("passInput");
+  var badge = document.getElementById("badge");
+  var watchingEl = document.getElementById("watching");
+  var termBody = document.getElementById("termBody");
+  var reqBtn = document.getElementById("reqBtn");
+  document.getElementById("sessionName").textContent = " \xB7 " + CFG.name;
+  document.getElementById("chromePath").textContent = CFG.name + " \u2014 live";
+  function setBadge(cls, text){ badge.className = "badge" + (cls ? " " + cls : ""); badge.innerHTML = '<span class="d"></span> ' + text; }
+  function showErr(msg){ joinErr.textContent = msg; joinErr.style.display = "block"; }
+  function line(cls, text){
+    var d = document.createElement("div");
+    d.className = "line " + cls;
+    d.textContent = text;
+    termBody.appendChild(d);
+    while(termBody.childNodes.length > 800) termBody.removeChild(termBody.firstChild);
+    termBody.scrollTop = termBody.scrollHeight;
+  }
+  fetch(base + "/meta").then(function(r){ return r.json(); }).then(function(meta){
+    if(meta.state !== "live"){ ended(meta.state); joinPanel.classList.add("hidden"); return; }
+    if(meta.requiresPassphrase) passInput.classList.remove("hidden");
+    watchingEl.textContent = meta.watching;
+  }).catch(function(){ setBadge("ended", "UNREACHABLE"); });
+  document.getElementById("watchBtn").addEventListener("click", function(){
+    joinErr.style.display = "none";
+    fetch(base + "/join", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ name: document.getElementById("nameInput").value, pass: passInput.value || undefined })
+    }).then(function(r){
+      if(r.status === 403){ passInput.classList.remove("hidden"); showErr("passphrase required or wrong \u2014 try again"); return null; }
+      if(!r.ok){ showErr("could not join (" + r.status + ")"); return null; }
+      return r.json();
+    }).then(function(res){
+      if(!res) return;
+      viewer = res;
+      joinPanel.classList.add("hidden");
+      setBadge("", "SPECTATING \xB7 read-only");
+      if(CFG.access === "invite") reqBtn.classList.remove("hidden");
+      openStream();
+    }).catch(function(){ showErr("could not reach the host"); });
+  });
+  function openStream(){
+    source = new EventSource(base + "/stream?token=" + encodeURIComponent(viewer.token));
+    source.addEventListener("entry", function(ev){
+      var e = JSON.parse(ev.data);
+      var cls = e.type === "milestone" ? "milestone" : e.type === "system" ? "system" : (e.stream === "stderr" ? "stderr" : "");
+      line(cls, e.text);
+    });
+    source.addEventListener("viewers", function(ev){ watchingEl.textContent = JSON.parse(ev.data).watching; });
+    source.addEventListener("join-approved", function(){
+      setBadge("collab", "COLLABORATING \xB7 live");
+      reqBtn.className = "join-btn joined"; reqBtn.disabled = true; reqBtn.textContent = "You\u2019re in \u2014 live";
+      line("system", "\u2192 handed off: the host approved you as a collaborator.");
+    });
+    source.addEventListener("join-denied", function(){
+      reqBtn.className = "join-btn"; reqBtn.disabled = false; reqBtn.textContent = "Request denied \u2014 try again";
+    });
+    source.addEventListener("kicked", function(){ source.close(); ended("kicked"); });
+    source.addEventListener("ended", function(ev){ source.close(); ended(JSON.parse(ev.data).state); });
+    source.onerror = function(){ if(badge.className.indexOf("ended") === -1) setBadge("", "RECONNECTING\u2026"); };
+    source.onopen = function(){ if(!viewer || reqBtn.className.indexOf("joined") === -1) setBadge("", "SPECTATING \xB7 read-only"); };
+  }
+  reqBtn.addEventListener("click", function(){
+    reqBtn.disabled = true; reqBtn.className = "join-btn pending"; reqBtn.textContent = "Waiting for host approval\u2026";
+    fetch(base + "/request-join", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token: viewer.token })
+    }).then(function(r){
+      if(!r.ok){ reqBtn.className = "join-btn"; reqBtn.disabled = false; reqBtn.textContent = "Request to join"; }
+    }).catch(function(){ reqBtn.className = "join-btn"; reqBtn.disabled = false; });
+  });
+  function ended(state){
+    setBadge("ended", state === "kicked" ? "REMOVED BY HOST" : "SHARE ENDED");
+    reqBtn.classList.add("hidden");
+    line("system", state === "kicked" ? "\u2014 the host removed you from this share \u2014" : "\u2014 the host ended this share \u2014");
+  }
+  window.addEventListener("beforeunload", function(){
+    if(viewer && navigator.sendBeacon) navigator.sendBeacon(base + "/leave?token=" + encodeURIComponent(viewer.token), "");
+  });
+})();
+</script>
+</body>
+</html>`;
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+// src/types.ts
+var ShareError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ShareError";
+    this.code = code;
+  }
+};
+// src/utils.ts
+import { randomBytes, scryptSync, timingSafeEqual } from "crypto";
+function newShareId() {
+  return randomBytes(9).toString("base64url");
+}
+function newToken(bytes = 16) {
+  return randomBytes(bytes).toString("hex");
+}
+var EXPIRY_RE = /^(\d+)(m|h|d)$/;
+function parseExpiry(spec) {
+  const s = spec.trim().toLowerCase();
+  if (s === "stop" || s === "never" || s === "until-stop") return null;
+  const m = EXPIRY_RE.exec(s);
+  if (!m) {
+    throw new Error(`invalid expiry "${spec}" \u2014 use 1h, 24h, 7d, \u2026 or "stop"`);
+  }
+  const n = Number(m[1]);
+  if (!Number.isSafeInteger(n) || n <= 0) {
+    throw new Error(`invalid expiry "${spec}" \u2014 duration must be positive`);
+  }
+  const unit = m[2];
+  const mult = unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
+  return n * mult;
+}
+function hashPassphrase(passphrase) {
+  const salt = randomBytes(16);
+  const hash = scryptSync(passphrase, salt, 32);
+  return `scrypt$${salt.toString("hex")}$${hash.toString("hex")}`;
+}
+function verifyPassphrase(passphrase, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 3 || parts[0] !== "scrypt") return false;
+  const salt = Buffer.from(parts[1], "hex");
+  const expected = Buffer.from(parts[2], "hex");
+  const actual = scryptSync(passphrase, salt, expected.length);
+  return timingSafeEqual(actual, expected);
+}
+// src/localHttp.ts
+import { createServer } from "http";
+import { networkInterfaces } from "os";
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+var MAX_BODY = 64 * 1024;
+var LocalHttpTransport = class {
+  kind = "local-http";
+  hostToken;
+  #host;
+  #port;
+  #baseUrl;
+  #onStop;
+  #shares = /* @__PURE__ */ new Map();
+  #gone = /* @__PURE__ */ new Set();
+  #sockets = /* @__PURE__ */ new Set();
+  #server = null;
+  #boundPort = 0;
+  constructor(opts = {}) {
+    this.#host = opts.host ?? "127.0.0.1";
+    this.#port = opts.port ?? 0;
+    this.#baseUrl = opts.baseUrl;
+    this.hostToken = opts.hostToken ?? newToken(24);
+    this.#onStop = opts.onStopRequested;
+  }
+  /** Bind the listener. Must be called before serve(). Idempotent. */
+  async listen() {
+    if (this.#server) return;
+    const server = createServer((req, res) => {
+      void this.#route(req, res).catch((err) => this.#handleError(res, err));
+    });
+    server.on("connection", (socket) => {
+      this.#sockets.add(socket);
+      socket.on("close", () => this.#sockets.delete(socket));
+    });
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(this.#port, this.#host, () => resolve());
+    });
+    const addr = server.address();
+    this.#boundPort = typeof addr === "object" && addr !== null ? addr.port : this.#port;
+    this.#server = server;
+  }
+  /** The port actually bound (useful with port 0). */
+  get port() {
+    return this.#boundPort;
+  }
+  async serve(share, feed, viewers) {
+    if (!this.#server) await this.listen();
+    const ctx = { share, feed, viewers, streams: /* @__PURE__ */ new Map() };
+    this.#shares.set(share.id, ctx);
+    this.#gone.delete(share.id);
+    this.#wire(ctx);
+    return `${this.#publicBase()}/s/${share.id}`;
+  }
+  async unserve(shareId) {
+    const ctx = this.#shares.get(shareId);
+    if (!ctx) return;
+    this.#shares.delete(shareId);
+    this.#gone.add(shareId);
+    this.#endAllStreams(ctx, ctx.share.state);
+  }
+  async close() {
+    for (const ctx of this.#shares.values()) this.#endAllStreams(ctx, ctx.share.state);
+    this.#shares.clear();
+    const server = this.#server;
+    this.#server = null;
+    if (!server) return;
+    for (const socket of this.#sockets) socket.destroy();
+    await new Promise((resolve) => server.close(() => resolve()));
+  }
+  /** Number of shares currently served (diagnostics/tests). */
+  get shareCount() {
+    return this.#shares.size;
+  }
+  // ------------------------------------------------------------- wiring
+  #wire(ctx) {
+    ctx.feed.on("close", () => {
+      if (this.#shares.has(ctx.share.id)) {
+        this.#shares.delete(ctx.share.id);
+        this.#gone.add(ctx.share.id);
+      }
+      this.#endAllStreams(ctx, ctx.share.state);
+    });
+    const broadcastCount = () => this.#broadcastViewers(ctx);
+    ctx.viewers.on("join", broadcastCount);
+    ctx.viewers.on("leave", (v) => {
+      this.#closeViewerStreams(ctx, v, null);
+      broadcastCount();
+    });
+    ctx.viewers.on("kick", (v) => {
+      this.#closeViewerStreams(ctx, v, "kicked");
+      broadcastCount();
+    });
+    ctx.viewers.on("approve", (v) => this.#sendToViewer(ctx, v, "join-approved", {}));
+    ctx.viewers.on("deny", (v) => this.#sendToViewer(ctx, v, "join-denied", {}));
+  }
+  // ------------------------------------------------------------- routing
+  async #route(req, res) {
+    setSecurityHeaders(res);
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const path = url.pathname;
+    if (path.startsWith("/control/")) {
+      this.#routeControl(req, res, path, url);
+      return;
+    }
+    const m = /^\/s\/([A-Za-z0-9_-]+)(?:\/(meta|stream|join|request-join|leave))?\/?$/.exec(path);
+    if (!m) {
+      sendJson(res, 404, { error: "not found" });
+      return;
+    }
+    const shareId = m[1];
+    const action = m[2] ?? "page";
+    const ctx = this.#shares.get(shareId);
+    if (!ctx) {
+      const status = this.#gone.has(shareId) ? 410 : 404;
+      if (action === "page") {
+        res.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+        res.end('<!DOCTYPE html><title>vibeshare</title><body style="background:#0a0b0f;color:#edeef3;font-family:sans-serif;display:grid;place-items:center;min-height:100vh;margin:0"><p>This share has ended.</p></body>');
+      } else {
+        sendJson(res, status, { error: status === 410 ? "share ended" : "not found" });
+      }
+      return;
+    }
+    switch (action) {
+      case "page": {
+        if (req.method !== "GET") return void sendJson(res, 405, { error: "method not allowed" });
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(spectatorPage(ctx.share));
+        return;
+      }
+      case "meta": {
+        sendJson(res, 200, {
+          id: ctx.share.id,
+          name: ctx.share.name,
+          access: ctx.share.access,
+          state: ctx.share.state,
+          requiresPassphrase: ctx.share.passphraseHash !== null,
+          watching: streamCount(ctx)
+        });
+        return;
+      }
+      case "join": {
+        if (req.method !== "POST") return void sendJson(res, 405, { error: "method not allowed" });
+        if (ctx.share.state !== "live") throw new ShareError("not-live", "share has ended");
+        const body = await readJsonBody(req);
+        if (ctx.share.passphraseHash !== null) {
+          const pass = typeof body["pass"] === "string" ? body["pass"] : "";
+          if (pass.length === 0) throw new ShareError("passphrase-required", "passphrase required");
+          if (!verifyPassphrase(pass, ctx.share.passphraseHash)) {
+            throw new ShareError("passphrase-invalid", "wrong passphrase");
+          }
+        }
+        const viewer = ctx.viewers.add(typeof body["name"] === "string" ? body["name"] : void 0);
+        sendJson(res, 200, { viewerId: viewer.id, token: viewer.token, role: viewer.role });
+        return;
+      }
+      case "stream": {
+        if (req.method !== "GET") return void sendJson(res, 405, { error: "method not allowed" });
+        const viewer = ctx.viewers.getByToken(url.searchParams.get("token") ?? "");
+        if (!viewer) return void sendJson(res, 401, { error: "unknown viewer token" });
+        this.#openStream(ctx, viewer, res);
+        return;
+      }
+      case "request-join": {
+        if (req.method !== "POST") return void sendJson(res, 405, { error: "method not allowed" });
+        const body = await readJsonBody(req);
+        const viewer = ctx.viewers.getByToken(typeof body["token"] === "string" ? body["token"] : "");
+        if (!viewer) return void sendJson(res, 401, { error: "unknown viewer token" });
+        ctx.viewers.requestJoin(viewer.id);
+        sendJson(res, 202, { status: "pending" });
+        return;
+      }
+      case "leave": {
+        if (req.method !== "POST") return void sendJson(res, 405, { error: "method not allowed" });
+        let token = url.searchParams.get("token") ?? "";
+        if (token.length === 0) {
+          const body = await readJsonBody(req);
+          if (typeof body["token"] === "string") token = body["token"];
+        }
+        const viewer = ctx.viewers.getByToken(token);
+        if (viewer) ctx.viewers.leave(viewer.id);
+        sendJson(res, 200, { ok: true });
+        return;
+      }
+    }
+  }
+  #routeControl(req, res, path, url) {
+    if (!isLoopback(req.socket.remoteAddress) || !tokenMatches(req.headers.authorization, this.hostToken)) {
+      sendJson(res, 401, { error: "host-only control API" });
+      return;
+    }
+    const respond = (fn) => {
+      try {
+        sendJson(res, 200, fn());
+      } catch (err) {
+        this.#handleError(res, err);
+      }
+    };
+    void (async () => {
+      switch (path) {
+        case "/control/shares":
+          respond(() => ({
+            shares: [...this.#shares.values()].map((c) => ({
+              id: c.share.id,
+              name: c.share.name,
+              access: c.share.access,
+              state: c.share.state,
+              watching: streamCount(c)
+            }))
+          }));
+          return;
+        case "/control/viewers": {
+          const ctx = this.#mustCtx(url.searchParams.get("share") ?? "");
+          respond(() => ({ viewers: ctx.viewers.list().map(publicViewer), watching: streamCount(ctx) }));
+          return;
+        }
+        case "/control/approve":
+        case "/control/deny":
+        case "/control/kick": {
+          if (req.method !== "POST") return void sendJson(res, 405, { error: "method not allowed" });
+          const body = await readJsonBody(req);
+          const ctx = this.#mustCtx(typeof body["share"] === "string" ? body["share"] : "");
+          const viewerId = typeof body["viewer"] === "string" ? body["viewer"] : "";
+          const action = path.slice("/control/".length);
+          respond(() => ({ viewer: publicViewer(ctx.viewers[action](viewerId)) }));
+          return;
+        }
+        case "/control/stop": {
+          if (req.method !== "POST") return void sendJson(res, 405, { error: "method not allowed" });
+          const body = await readJsonBody(req);
+          const shareId = typeof body["share"] === "string" ? body["share"] : "";
+          this.#mustCtx(shareId);
+          sendJson(res, 200, { stopped: shareId });
+          if (this.#onStop) this.#onStop(shareId);
+          else {
+            const ctx = this.#shares.get(shareId);
+            if (ctx) {
+              await this.unserve(shareId);
+              ctx.feed.close();
+            }
+          }
+          return;
+        }
+        default:
+          sendJson(res, 404, { error: "not found" });
+      }
+    })().catch((err) => this.#handleError(res, err));
+  }
+  #mustCtx(shareId) {
+    const ctx = this.#shares.get(shareId);
+    if (!ctx) throw new ShareError("not-found", `no live share ${shareId}`);
+    return ctx;
+  }
+  #handleError(res, err) {
+    if (res.writableEnded) return;
+    if (err instanceof ShareError) {
+      const status = err.code === "not-found" ? 404 : err.code === "not-live" ? 410 : err.code === "passphrase-required" || err.code === "passphrase-invalid" || err.code === "invite-disabled" ? 403 : err.code === "already-pending" || err.code === "not-pending" ? 409 : 400;
+      sendJson(res, status, { error: err.message, code: err.code });
+    } else {
+      sendJson(res, 500, { error: "internal" });
+      console.error("[vibeshare]", err);
+    }
+  }
+  // ------------------------------------------------------------- SSE
+  #openStream(ctx, viewer, res) {
+    res.writeHead(200, {
+      "content-type": "text/event-stream; charset=utf-8",
+      "cache-control": "no-store",
+      connection: "keep-alive"
+    });
+    for (const entry of ctx.feed.backlog()) sseSend(res, "entry", entry, entry.seq);
+    const unsubscribe = ctx.feed.subscribe((entry) => sseSend(res, "entry", entry, entry.seq));
+    let set = ctx.streams.get(viewer.id);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      ctx.streams.set(viewer.id, set);
+    }
+    set.add(res);
+    this.#broadcastViewers(ctx);
+    res.on("close", () => {
+      unsubscribe();
+      set.delete(res);
+      if (set.size === 0) ctx.streams.delete(viewer.id);
+      this.#broadcastViewers(ctx);
+    });
+  }
+  #sendToViewer(ctx, viewer, event, data) {
+    for (const res of ctx.streams.get(viewer.id) ?? []) sseSend(res, event, data);
+  }
+  #closeViewerStreams(ctx, viewer, event) {
+    const set = ctx.streams.get(viewer.id);
+    if (!set) return;
+    for (const res of set) {
+      if (event !== null) sseSend(res, event, {});
+      res.end();
+    }
+    ctx.streams.delete(viewer.id);
+  }
+  #broadcastViewers(ctx) {
+    const watching = streamCount(ctx);
+    for (const set of ctx.streams.values()) {
+      for (const res of set) sseSend(res, "viewers", { watching });
+    }
+  }
+  #endAllStreams(ctx, state) {
+    for (const set of ctx.streams.values()) {
+      for (const res of set) {
+        sseSend(res, "ended", { state });
+        res.end();
+      }
+    }
+    ctx.streams.clear();
+  }
+  // -------------------------------------------------------------
+  #publicBase() {
+    if (this.#baseUrl) return this.#baseUrl.replace(/\/$/, "");
+    const host = this.#host === "0.0.0.0" || this.#host === "::" ? lanAddress() ?? "127.0.0.1" : this.#host;
+    return `http://${host}:${this.#boundPort}`;
+  }
+};
+function streamCount(ctx) {
+  let n = 0;
+  for (const set of ctx.streams.values()) n += set.size;
+  return n;
+}
+function publicViewer(v) {
+  return { id: v.id, name: v.name, role: v.role, joinRequest: v.joinRequest, joinedAt: v.joinedAt };
+}
+function sseSend(res, event, data, id) {
+  if (res.writableEnded) return;
+  const idLine = id === void 0 ? "" : `id: ${id}
+`;
+  res.write(`${idLine}event: ${event}
+data: ${JSON.stringify(data)}
+`);
+}
+function sendJson(res, status, body) {
+  if (res.writableEnded) return;
+  res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+  res.end(JSON.stringify(body));
+}
+function setSecurityHeaders(res) {
+  res.setHeader("x-content-type-options", "nosniff");
+  res.setHeader("referrer-policy", "no-referrer");
+  res.setHeader("cache-control", "no-store");
+}
+async function readJsonBody(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buf = chunk;
+    size += buf.length;
+    if (size > MAX_BODY) throw new ShareError("bad-request", "body too large");
+    chunks.push(buf);
+  }
+  if (chunks.length === 0) return {};
+  try {
+    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function isLoopback(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+function tokenMatches(header, expected) {
+  if (!header?.startsWith("Bearer ")) return false;
+  const got = Buffer.from(header.slice(7));
+  const want = Buffer.from(expected);
+  return got.length === want.length && timingSafeEqual2(got, want);
+}
+function lanAddress() {
+  for (const infos of Object.values(networkInterfaces())) {
+    for (const info of infos ?? []) {
+      if (info.family === "IPv4" && !info.internal) return info.address;
+    }
+  }
+  return null;
+}
+// src/feed.ts
+import { EventEmitter } from "events";
+var SessionFeed = class extends EventEmitter {
+  #capacity;
+  #seq = 0;
+  #log = [];
+  #closed = false;
+  constructor(capacity = 1e3) {
+    super();
+    this.#capacity = Math.max(1, capacity);
+  }
+  get closed() {
+    return this.#closed;
+  }
+  /** Append a line to the log and fan it out to subscribers. */
+  publish(text, opts = {}) {
+    if (this.#closed) throw new Error("feed is closed");
+    const entry = {
+      seq: ++this.#seq,
+      ts: Date.now(),
+      type: opts.type ?? "output",
+      ...opts.stream !== void 0 ? { stream: opts.stream } : {},
+      text
+    };
+    this.#log.push(entry);
+    if (this.#log.length > this.#capacity) {
+      this.#log.splice(0, this.#log.length - this.#capacity);
+    }
+    this.emit("entry", entry);
+    return entry;
+  }
+  /** Publish a normalized vibe-core milestone event as a feed line. */
+  publishEvent(e) {
+    const detail = typeof e.payload?.["detail"] === "string" ? ` \u2014 ${e.payload["detail"]}` : "";
+    return this.publish(`\u25C6 ${e.kind} \xB7 ${e.agent}${detail}`, { type: "milestone" });
+  }
+  /** Publish a host-side status line (share opened, viewer joined, …). */
+  system(text) {
+    return this.publish(text, { type: "system" });
+  }
+  /** Recent entries for late-joiner replay, oldest first. */
+  backlog() {
+    return this.#log;
+  }
+  /** Subscribe to live entries. Returns an unsubscribe function. */
+  subscribe(listener) {
+    this.on("entry", listener);
+    return () => {
+      this.off("entry", listener);
+    };
+  }
+  /** End the feed: notifies subscribers, refuses further publishes. */
+  close() {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.emit("close");
+    this.removeAllListeners();
+  }
+};
+// src/registry.ts
+import { EventEmitter as EventEmitter2 } from "events";
+var ViewerRegistry = class extends EventEmitter2 {
+  #getAccess;
+  #viewers = /* @__PURE__ */ new Map();
+  constructor(getAccess) {
+    super();
+    this.#getAccess = getAccess;
+  }
+  /** Register a new spectator. Everyone enters read-only — no exceptions. */
+  add(name) {
+    const viewer = {
+      id: newShareId(),
+      name: sanitizeName(name),
+      role: "spectator",
+      token: newToken(),
+      joinedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      joinRequest: "none"
+    };
+    this.#viewers.set(viewer.id, viewer);
+    this.emit("join", viewer);
+    return viewer;
+  }
+  get(id) {
+    return this.#viewers.get(id);
+  }
+  getByToken(token) {
+    for (const v of this.#viewers.values()) {
+      if (v.token === token) return v;
+    }
+    return void 0;
+  }
+  list() {
+    return [...this.#viewers.values()];
+  }
+  count() {
+    return this.#viewers.size;
+  }
+  /**
+   * A spectator asks to be promoted to collaborator. Only possible on an
+   * `invite`-access share; the host still has to approve.
+   */
+  requestJoin(id) {
+    const v = this.#mustGet(id);
+    if (this.#getAccess() !== "invite") {
+      throw new ShareError("invite-disabled", "this share is spectate-only");
+    }
+    if (v.joinRequest === "pending") {
+      throw new ShareError("already-pending", "join request already pending");
+    }
+    if (v.role === "collaborator") return v;
+    v.joinRequest = "pending";
+    this.emit("request", v);
+    return v;
+  }
+  /** Host approves a pending request → the viewer becomes a collaborator. */
+  approve(id) {
+    const v = this.#mustGet(id);
+    if (v.joinRequest !== "pending") {
+      throw new ShareError("not-pending", "no pending join request from this viewer");
+    }
+    v.joinRequest = "approved";
+    v.role = "collaborator";
+    this.emit("approve", v);
+    return v;
+  }
+  /** Host denies a pending request; the viewer stays a spectator. */
+  deny(id) {
+    const v = this.#mustGet(id);
+    if (v.joinRequest !== "pending") {
+      throw new ShareError("not-pending", "no pending join request from this viewer");
+    }
+    v.joinRequest = "denied";
+    this.emit("deny", v);
+    return v;
+  }
+  /** Remove a viewer entirely (their streams are closed by the transport). */
+  kick(id) {
+    const v = this.#mustGet(id);
+    this.#viewers.delete(id);
+    this.emit("kick", v);
+    return v;
+  }
+  /** A viewer leaves on their own. */
+  leave(id) {
+    const v = this.#viewers.get(id);
+    if (!v) return;
+    this.#viewers.delete(id);
+    this.emit("leave", v);
+  }
+  /**
+   * The write-arbitration gate. The host writes by definition; a remote
+   * participant writes only as an approved collaborator. Any future input
+   * channel (vibelive cursors, shared terminal input) MUST consult this.
+   */
+  canWrite(viewerId) {
+    return this.#viewers.get(viewerId)?.role === "collaborator";
+  }
+  #mustGet(id) {
+    const v = this.#viewers.get(id);
+    if (!v) throw new ShareError("not-found", `no viewer ${id}`);
+    return v;
+  }
+};
+function sanitizeName(name) {
+  const cleaned = (name ?? "").trim().slice(0, 32);
+  return cleaned.length > 0 ? cleaned : `anon-${newToken(2)}`;
+}
+// src/manager.ts
+var SHARE_SCOPE = "share:session";
+var ConsentRequiredError = class extends ShareError {
+  constructor() {
+    super(
+      "consent-required",
+      `sharing requires a "${SHARE_SCOPE}" consent grant \u2014 run \`vibeshare\` interactively to grant it, or call consent.grant("${SHARE_SCOPE}")`
+    );
+    this.name = "ConsentRequiredError";
+  }
+};
+var ShareManager = class {
+  #consent;
+  #transport;
+  #live = /* @__PURE__ */ new Map();
+  #timers = /* @__PURE__ */ new Map();
+  constructor(deps) {
+    this.#consent = deps.consent;
+    this.#transport = deps.transport;
+  }
+  /**
+   * Create a share: `createShare({session, access, expiry, passphrase})`
+   * → `{share, url, feed, viewers, revoke}`.
+   *
+   * @throws ConsentRequiredError when the ledger has no `share:session` grant.
+   */
+  async createShare(opts = {}) {
+    if (!this.#consent.allows(SHARE_SCOPE)) throw new ConsentRequiredError();
+    const access = opts.access ?? "spectate";
+    const expiryMs = opts.expiryMs ?? parseExpiry(opts.expiry ?? "stop");
+    const now = Date.now();
+    const share = {
+      id: newShareId(),
+      name: opts.name ?? opts.session ?? "agent session",
+      access,
+      createdAt: new Date(now).toISOString(),
+      expiresAt: expiryMs === null ? null : new Date(now + expiryMs).toISOString(),
+      state: "live",
+      passphraseHash: opts.passphrase !== void 0 && opts.passphrase.length > 0 ? hashPassphrase(opts.passphrase) : null
+    };
+    const feed = new SessionFeed();
+    const viewers = new ViewerRegistry(() => share.access);
+    const url = await this.#transport.serve(share, feed, viewers);
+    const created = {
+      share,
+      url,
+      feed,
+      viewers,
+      revoke: () => this.revokeShare(share.id)
+    };
+    this.#live.set(share.id, created);
+    if (expiryMs !== null) {
+      const timer = setTimeout(() => {
+        void this.revokeShare(share.id, "expired");
+      }, expiryMs);
+      timer.unref?.();
+      this.#timers.set(share.id, timer);
+    }
+    feed.system(`share opened \xB7 access=${access} \xB7 ${share.expiresAt ?? "until stopped"}`);
+    return created;
+  }
+  /** End a share: disconnect viewers, 410 the URL, close the feed. */
+  async revokeShare(id, reason = "revoked") {
+    const created = this.#live.get(id);
+    if (!created) return;
+    created.share.state = reason;
+    const timer = this.#timers.get(id);
+    if (timer) clearTimeout(timer);
+    this.#timers.delete(id);
+    this.#live.delete(id);
+    await this.#transport.unserve(id);
+    if (!created.feed.closed) {
+      created.feed.system(`share ${reason}`);
+      created.feed.close();
+    }
+  }
+  get(id) {
+    return this.#live.get(id);
+  }
+  list() {
+    return [...this.#live.values()];
+  }
+  /** Revoke every live share and close the transport. */
+  async stopAll() {
+    for (const id of [...this.#live.keys()]) {
+      await this.revokeShare(id);
+    }
+    await this.#transport.close();
+  }
+};
+// src/version.ts
+var VERSION = "0.1.0";
+export {
+  vibeHome,
+  FileConsentStore,
+  loadLedger,
+  writeActiveShare,
+  readActiveShare,
+  listActiveShares,
+  clearActiveShare,
+  spectatorPage,
+  ShareError,
+  newShareId,
+  newToken,
+  parseExpiry,
+  hashPassphrase,
+  verifyPassphrase,
+  LocalHttpTransport,
+  SessionFeed,
+  ViewerRegistry,
+  SHARE_SCOPE,
+  ConsentRequiredError,
+  ShareManager,
+  VERSION
+};