@7ots/cli 0.1.1 → 0.1.4

package/server/platform/auth.mjs

@@ -7,7 +7,7 @@
  *   POST /auth/email/confirm  token=…    gasta el enlace, abre sesión y lleva a /app/
  *   GET  /auth/notlogin                   → notlogin.com/authorize
  *   GET  /auth/notlogin/callback          ?code&state → sesión y /app/
- *   POST /auth/logout
+ *   POST /auth/logout · /auth/logout-all (cierra todas las sesiones de la cuenta)
  *
  * Variables:
  *   PLATFORM_URL             origen público (https://7ots.com); los enlaces nunca salen de la cabecera Host
@@ -22,7 +22,7 @@
 import { createHash, createPublicKey, randomBytes, verify as cryptoVerify } from 'node:crypto';
 import { reqT, teamT } from '../i18n.mjs';
 import { signValue, unsignValue } from './crypto.mjs';
-import { SESSION_TTL, consumeLoginToken, createLoginToken, createSession, deleteSession, recentLoginTokens, sessionAccount, upsertAccount } from './store.mjs';
+import { SESSION_TTL, accountExists, consumeLoginToken, createLoginToken, createSession, deleteAccountSessions, deleteSession, recentLoginTokens, sessionAccount, upsertAccount } from './store.mjs';
 
 const penv = process.env;
 export const SESSION_COOKIE = 'ots_session';
@@ -56,6 +56,22 @@ export function createAuth({ send, readJson, originOf, clientIp }) {
   const base = (req) => (penv.PLATFORM_URL || originOf(req)).replace(/\/+$/, '');
   const secure = (req) => base(req).startsWith('https:');
   const ipHits = new Map();
+  const newAccounts = new Map(); // ip → timestamps of accounts created in the last day
+  const MAX_NEW_ACCOUNTS = () => Number(penv.PLATFORM_NEW_ACCOUNTS_PER_IP_DAY || 3);
+
+  /** New accounts per IP and day (each one brings a free quota). Returns the account, or null when over the cap. */
+  function login(req, who) {
+    if (accountExists(who)) return upsertAccount(who);
+    const ip = clientIp(req);
+    const now = Date.now();
+    const recent = (newAccounts.get(ip) || []).filter((t) => now - t < 86400_000);
+    if (recent.length >= MAX_NEW_ACCOUNTS()) return null;
+    const account = upsertAccount(who);
+    recent.push(now);
+    newAccounts.set(ip, recent);
+    if (newAccounts.size > 5000) newAccounts.clear();
+    return account;
+  }
 
   function cookie(req, name, value, { path = '/', maxAge }) {
     return `${name}=${encodeURIComponent(value)}; Path=${path}; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(maxAge / 1000)}${secure(req) ? '; Secure' : ''}`;
@@ -152,12 +168,13 @@ export function createAuth({ send, readJson, originOf, clientIp }) {
       const j = await r.json().catch(() => ({}));
       if (!r.ok || !j.id_token) throw new Error(`token ${r.status}`);
       const claims = await verifyIdToken(j.id_token, st.n);
-      const account = upsertAccount({ notloginSub: claims.sub, email: claims.email_verified ? claims.email : null });
+      const account = login(req, { notloginSub: claims.sub, email: claims.email_verified ? claims.email : null });
+      if (!account) return fail(res, 'platform.api.tooManyAccounts');
       startSession(req, res, account, 'notlogin');
       redirect(res, '/app/');
     } catch (e) {
       console.warn('[7ots] notlogin:', e.message);
-      fail(res, 'platform.api.notloginFailed');
+      fail(res, e.i18n?.key || 'platform.api.notloginFailed');
     }
   }
 
@@ -206,7 +223,9 @@ export function createAuth({ send, readJson, originOf, clientIp }) {
       const form = await readForm(req);
       const email = consumeLoginToken(form.get('token'));
       if (!email) return fail(res, 'platform.api.linkInvalid'), true;
-      startSession(req, res, upsertAccount({ email }), 'email');
+      const account = login(req, { email });
+      if (!account) return fail(res, 'platform.api.tooManyAccounts'), true;
+      startSession(req, res, account, 'email');
       redirect(res, '/app/');
       return true;
     }
@@ -214,7 +233,13 @@ export function createAuth({ send, readJson, originOf, clientIp }) {
     if (p === '/auth/notlogin' && req.method === 'GET') return notloginStart(req, res), true;
     if (p === '/auth/notlogin/callback' && req.method === 'GET') return await notloginCallback(req, res, url), true;
 
-    if (p === '/auth/logout' && write) {
+    if ((p === '/auth/logout' || p === '/auth/logout-all') && write) {
+      if (p === '/auth/logout-all') {
+        // Same-origin only (the dashboard always sends Origin), so no other site can sign the user out.
+        const account = currentAccount(req);
+        if (!origin) return send(res, 403, { error: t('server.admin.sameOrigin') }), true;
+        if (account) deleteAccountSessions(account.id);
+      }
       deleteSession(parseCookies(req.headers.cookie)[SESSION_COOKIE]);
       res.setHeader('Set-Cookie', cookie(req, SESSION_COOKIE, '', { maxAge: 0 }));
       send(res, 200, { ok: true });
@@ -240,10 +265,14 @@ async function readForm(req) {
 function confirmPage(t, token) {
   const esc = (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c]);
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>7ots.com</title>
-<style>body{margin:0;min-height:100vh;display:grid;place-items:center;font:16px/1.5 system-ui,sans-serif;background:#f8f7fc;color:#16152a}
-main{text-align:center;padding:32px}button{font:600 16px system-ui,sans-serif;background:#5b47f0;color:#fff;border:0;border-radius:8px;padding:12px 28px;cursor:pointer}
-@media (prefers-color-scheme:dark){body{background:#0b0a14;color:#f0eff7}button{background:#8b7cff;color:#0b0a14}}</style></head>
-<body><main><p>${esc(t('platform.mail.confirm'))}</p><form method="post" action="/auth/email/confirm"><input type="hidden" name="token" value="${esc(token)}"><button type="submit">${esc(t('platform.mail.button'))}</button></form></main></body></html>`;
+<link rel="icon" type="image/svg+xml" href="/brand/favicon.svg">
+<style>body{margin:0;min-height:100vh;display:grid;place-items:center;font:16px/1.5 Inter,system-ui,sans-serif;color:#fff;
+background:radial-gradient(60% 50% at 20% 10%,rgb(168 85 247/.35),transparent 70%),radial-gradient(50% 40% at 85% 80%,rgb(34 211 238/.22),transparent 70%),#120d33}
+main{text-align:center;padding:40px 32px;margin:16px;max-width:380px;border-radius:24px;background:rgb(255 255 255/.06);border:1px solid rgb(255 255 255/.14);backdrop-filter:blur(12px)}
+img{width:56px;height:56px;margin-bottom:8px}p{margin:0 0 22px;color:rgb(255 255 255/.85)}
+button{font:800 18px/1 system-ui,sans-serif;background:linear-gradient(180deg,#fef08a,#fde047 45%,#facc15);color:#1e1850;border:0;border-radius:999px;padding:15px 34px;cursor:pointer;box-shadow:0 6px 0 #ca8a04,0 14px 34px rgb(250 204 21/.25)}
+button:active{transform:translateY(5px);box-shadow:0 1px 0 #ca8a04}</style></head>
+<body><main><img src="/brand/mark.svg" alt="7ots"><p>${esc(t('platform.mail.confirm'))}</p><form method="post" action="/auth/email/confirm"><input type="hidden" name="token" value="${esc(token)}"><button type="submit">${esc(t('platform.mail.button'))}</button></form></main></body></html>`;
 }
 
 // ───────────────────────────── id_token de notlogin (EdDSA) ─────────────────────────────

package/server/platform/connect.mjs

@@ -0,0 +1,347 @@
+/**
+ * Dashboard routes of the platform's integrations: an apuchat identity per ot and Orquesta tasks.
+ * Mounted by routes.mjs (same session, same-origin and X-7ots-Admin rules as the rest of /api/platform).
+ *
+ * Account:
+ *   DELETE /api/platform/apuchat/link               forget the linked apuchat account
+ *   GET    /api/platform/orquesta/projects          projects of the connected Orquesta account
+ *   POST   /api/platform/orquesta/key { key }       connect with an oak_ key · DELETE /api/platform/orquesta
+ * One ot:
+ *   GET    …/ots/:id/apuchat                         its identity, the account's apuchat state, open checkouts
+ *   POST   …/ots/:id/apuchat/identity                new free identity · DELETE (detach; deletes free ones)
+ *   POST   …/ots/:id/apuchat/key { key }             use an existing identity key
+ *   GET    …/ots/:id/apuchat/quote?callsign=         price of a permanent handle
+ *   POST   …/ots/:id/apuchat/checkout { callsign }   → { url } (card payment on apuchat; back to /app/?apuchat_ots=<id>)
+ *   GET    …/ots/:id/apuchat/checkout/:cid           result; a newly revealed key is stored in the ot
+ *   POST   …/ots/:id/apuchat/claim                   move the ot's identity into the linked apuchat account
+ *   GET|PUT …/ots/:id/orquesta                       project, tasks on/off, allowed senders, daily cap; recent tasks
+ *   POST   …/ots/:id/orquesta/ask { message, history }   the owner talks to the ot (only place with tools + owner)
+ *   GET    …/ots/:id/orquesta/tasks/:tid · POST …/cancel
+ * Browser redirects (state in a signed cookie, bound to the session's account):
+ *   GET /auth/apuchat?ots= → apuchat /link → GET /auth/apuchat/callback?state&code
+ *   GET /auth/orquesta?ots= → Orquesta OAuth (PKCE) → GET /auth/orquesta/callback?code&state
+ *   Both end in /app/?notice=<key>#ots/<id>/<tab>.
+ */
+
+import { randomBytes } from 'node:crypto';
+import { reqT, requestLocale } from '../i18n.mjs';
+import { currentAccount, parseCookies } from './auth.mjs';
+import { signValue, unsignValue } from './crypto.mjs';
+import { getOwnOts, listTasks, tasksLastDay } from './store.mjs';
+import { otsChannels, otsStep } from './runtime.mjs';
+import {
+  CALLSIGN_RE, apuchatAccountView, apuchatHub, callsignOf, checkout, checkoutStatus, claimIdentity, createFreeIdentity, defaultOwner, deleteIdentity,
+  exchangeLink, linkUrl, pendingCheckouts, quote, unlink,
+} from './apuchat.mjs';
+import {
+  askOt, authorizeUrl, cancelTask, disconnect, exchangeCode, listProjects, orquestaAccountView, orquestaUrl, otsOrquesta, parseAllow, projectUrl, saveKey, taskStatus,
+} from './orquesta.mjs';
+
+const penv = process.env;
+const STATE_TTL = 10 * 60_000;
+const COOKIES = { apuchat: 'ots_apuchat_link', orquesta: 'ots_orquesta_oauth' };
+const IDENTITY_KEYS = ['APUCHAT_AGENT_CALLSIGN', 'APUCHAT_AGENT_FREE', 'APUCHAT_AGENT_OWNER'];
+
+/**
+ * @param {{ send: Function, readJson: Function, originOf: Function, save: (ots, patch) => Promise<object> }} deps
+ */
+export function createConnect({ send, readJson, originOf, save }) {
+  const base = (req) => (penv.PLATFORM_URL || originOf(req)).replace(/\/+$/, '');
+
+  function cookie(req, name, value, path, maxAge) {
+    return `${name}=${encodeURIComponent(value)}; Path=${path}; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(maxAge / 1000)}${base(req).startsWith('https:') ? '; Secure' : ''}`;
+  }
+  const putState = (req, res, kind, st) => res.setHeader('Set-Cookie', cookie(req, COOKIES[kind], signValue(Buffer.from(JSON.stringify(st)).toString('base64url')), `/auth/${kind}`, STATE_TTL));
+  function takeState(req, res, kind) {
+    res.setHeader('Set-Cookie', cookie(req, COOKIES[kind], '', `/auth/${kind}`, 0));
+    const raw = unsignValue(parseCookies(req.headers.cookie)[COOKIES[kind]]);
+    try {
+      const st = raw && JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+      return st && st.e > Date.now() ? st : null;
+    } catch {
+      return null;
+    }
+  }
+  function redirect(res, to) {
+    res.writeHead(303, { Location: to, 'Cache-Control': 'no-store' });
+    res.end();
+  }
+  const back = (res, notice, otsId, tab) => redirect(res, `/app/?notice=${encodeURIComponent(notice)}${otsId ? `#ots/${otsId}/${tab}` : ''}`);
+
+  // ───────────────────────────── apuchat identity of an ot ─────────────────────────────
+
+  const hasIdentity = (ots) => !!ots.secrets.APUCHAT_AGENT_IDENTITY_KEY;
+  const isFree = (ots) => hasIdentity(ots) && ots.settings.APUCHAT_AGENT_FREE === '1';
+  // A paid handle held by the platform's anonymous account would be lost if the ot let go of its key.
+  const wouldLose = (ots) => hasIdentity(ots) && !isFree(ots) && ots.settings.APUCHAT_AGENT_OWNER === 'managed';
+
+  function apuchatView(account, ots) {
+    const st = otsChannels(ots).status().apuchat || null;
+    const has = hasIdentity(ots);
+    return {
+      hub: apuchatHub(),
+      mintUrl: `${apuchatHub()}/account/mint`,
+      identity: has ? { callsign: ots.settings.APUCHAT_AGENT_CALLSIGN || st?.callsign || null, free: isFree(ots), owner: ots.settings.APUCHAT_AGENT_OWNER || 'own' } : null,
+      paused: ots.status !== 'on',
+      listening: !!st && !st.lastError,
+      error: st?.lastError || null,
+      account: apuchatAccountView(account.id),
+      checkouts: pendingCheckouts(account.id, ots.id),
+    };
+  }
+
+  /** Puts an identity in the ot (its key is a channel setting: the apuchat channel restarts with it). */
+  function setIdentity(ots, { key, callsign, free, owner }) {
+    const settings = { ...ots.settings };
+    for (const k of IDENTITY_KEYS) delete settings[k];
+    const secrets = { ...ots.secrets };
+    if (key) {
+      secrets.APUCHAT_AGENT_IDENTITY_KEY = key;
+      if (callsign) settings.APUCHAT_AGENT_CALLSIGN = callsign;
+      if (free) settings.APUCHAT_AGENT_FREE = '1';
+      if (owner) settings.APUCHAT_AGENT_OWNER = owner;
+    } else delete secrets.APUCHAT_AGENT_IDENTITY_KEY;
+    return save(ots, { settings, secrets });
+  }
+
+  /** New free identity for an ot that has none (also used when creating an ot with the box ticked). */
+  async function freeIdentity(account, ots) {
+    const id = await createFreeIdentity(account.id);
+    return setIdentity(ots, { key: id.identityKey, callsign: id.callsign, free: id.free, owner: id.owner });
+  }
+
+  async function apuchatOts(req, res, account, ots, sub) {
+    const t = reqT(req);
+    const url = new URL(req.url, 'http://x');
+    if (sub === '/apuchat' && req.method === 'GET') return send(res, 200, apuchatView(account, ots));
+
+    if (sub === '/apuchat/identity' && req.method === 'POST') {
+      // One live free identity per ot; a paid or pasted one has to be detached first.
+      if (isFree(ots)) return send(res, 409, { error: t('platform.apuchat.alreadyFree') });
+      if (hasIdentity(ots)) return send(res, 409, { error: t('platform.apuchat.hasIdentity') });
+      const next = await freeIdentity(account, ots);
+      return send(res, 201, apuchatView(account, next));
+    }
+    if (sub === '/apuchat/identity' && req.method === 'DELETE') {
+      if (!hasIdentity(ots)) return send(res, 200, apuchatView(account, ots));
+      if (wouldLose(ots)) return send(res, 409, { error: t('platform.apuchat.claimFirst') });
+      const { APUCHAT_AGENT_CALLSIGN: cs, APUCHAT_AGENT_OWNER: owner } = ots.settings;
+      const free = isFree(ots);
+      const next = await setIdentity(ots, {});
+      if (free && cs) await deleteIdentity(account.id, owner, cs);
+      return send(res, 200, apuchatView(account, next));
+    }
+    if (sub === '/apuchat/key' && req.method === 'POST') {
+      const { key } = await readJson(req, 8 * 1024);
+      const k = String(key || '').trim();
+      if (!k || k.length > 400 || /\s/.test(k)) return send(res, 400, { error: t('platform.apuchat.badKey') });
+      if (wouldLose(ots)) return send(res, 409, { error: t('platform.apuchat.claimFirst') });
+      const callsign = await callsignOf(k);
+      if (!callsign) return send(res, 400, { error: t('platform.apuchat.keyRefused') });
+      const next = await setIdentity(ots, { key: k, callsign, owner: 'own' });
+      return send(res, 200, apuchatView(account, next));
+    }
+    if (sub === '/apuchat/quote' && req.method === 'GET') {
+      const callsign = String(url.searchParams.get('callsign') || '').trim().replace(/^@/, '').toLowerCase();
+      if (!CALLSIGN_RE.test(callsign)) return send(res, 400, { error: t('platform.apuchat.badCallsign') });
+      const upgrade = isFree(ots) && ots.settings.APUCHAT_AGENT_CALLSIGN === callsign;
+      const q = await quote(account.id, upgrade ? ots.settings.APUCHAT_AGENT_OWNER : defaultOwner(account.id, 'identities:mint'), callsign);
+      return send(res, 200, { ...q, upgrade, available: upgrade || (q.valid && !q.taken) });
+    }
+    if (sub === '/apuchat/checkout' && req.method === 'POST') {
+      const { callsign: raw } = await readJson(req, 4 * 1024);
+      const callsign = String(raw || '').trim().replace(/^@/, '').toLowerCase();
+      if (!CALLSIGN_RE.test(callsign)) return send(res, 400, { error: t('platform.apuchat.badCallsign') });
+      // Same callsign as the ot's free identity → in-place upgrade, made by the account that owns it.
+      const upgrade = isFree(ots) && ots.settings.APUCHAT_AGENT_CALLSIGN === callsign;
+      if (!upgrade && wouldLose(ots)) return send(res, 409, { error: t('platform.apuchat.claimFirst') });
+      const owner = upgrade ? ots.settings.APUCHAT_AGENT_OWNER : defaultOwner(account.id, 'identities:mint');
+      // No #fragment: apuchat appends ?apuchat_checkout=<id>&status=… to it; the dashboard opens the ot's tab from apuchat_ots.
+      const out = await checkout(account.id, owner, { otsId: ots.id, callsign, returnUrl: `${base(req)}/app/?apuchat_ots=${ots.id}` });
+      return send(res, 200, { url: out.url, checkoutId: out.checkoutId, priceUsd: out.priceUsd, tier: out.tier });
+    }
+    const ck = sub.match(/^\/apuchat\/checkout\/([A-Za-z0-9_-]{4,100})$/);
+    if (ck && req.method === 'GET') {
+      const st = await checkoutStatus(account.id, ots.id, ck[1]);
+      if (!st) return send(res, 404, { error: t('server.http.notFound') });
+      let next = ots;
+      if (st.status === 'fulfilled') {
+        if (st.identityKey) {
+          const { APUCHAT_AGENT_CALLSIGN: old, APUCHAT_AGENT_OWNER: oldOwner } = ots.settings;
+          const wasFree = isFree(ots);
+          next = await setIdentity(ots, { key: st.identityKey, callsign: st.callsign, owner: st.owner });
+          // The free handle it replaces goes back to apuchat (best effort).
+          if (wasFree && old && old !== st.callsign) await deleteIdentity(account.id, oldOwner, old).catch(() => {});
+        } else if (st.upgraded && ots.settings.APUCHAT_AGENT_CALLSIGN === st.callsign) {
+          const settings = { ...ots.settings };
+          delete settings.APUCHAT_AGENT_FREE;
+          next = await save(ots, { settings });
+        }
+      }
+      return send(res, 200, { status: st.status, callsign: st.callsign, upgraded: st.upgraded, applied: next !== ots, apuchat: apuchatView(account, next) });
+    }
+    if (sub === '/apuchat/claim' && req.method === 'POST') {
+      if (!hasIdentity(ots)) return send(res, 409, { error: t('platform.apuchat.noIdentity') });
+      await claimIdentity(account.id, ots.secrets.APUCHAT_AGENT_IDENTITY_KEY);
+      const next = await save(ots, { settings: { ...ots.settings, APUCHAT_AGENT_OWNER: 'linked' } });
+      return send(res, 200, apuchatView(account, next));
+    }
+    return false;
+  }
+
+  // ───────────────────────────── Orquesta panel of an ot ─────────────────────────────
+
+  function orquestaView(account, ots) {
+    const cfg = otsOrquesta(ots);
+    return {
+      url: orquestaUrl(),
+      account: orquestaAccountView(account.id),
+      ...cfg,
+      projectUrl: cfg.project ? projectUrl(cfg.project) : null,
+      usedToday: tasksLastDay(ots.id),
+      recent: listTasks(ots.id, 20).map((x) => ({ id: x.id, who: x.who, channel: x.channel, task: x.task.slice(0, 300), status: x.status, result: x.result.slice(0, 2000), error: x.error, createdAt: x.createdAt, updatedAt: x.updatedAt })),
+    };
+  }
+
+  async function orquestaOts(req, res, account, ots, sub) {
+    const t = reqT(req);
+    if (sub === '/orquesta' && req.method === 'GET') return send(res, 200, orquestaView(account, ots));
+    if (sub === '/orquesta' && req.method === 'PUT') {
+      const body = await readJson(req, 16 * 1024);
+      const settings = { ...ots.settings };
+      if (body.project !== undefined) {
+        const id = String(body.project || '').trim();
+        if (!id) {
+          delete settings.ORQUESTA_PROJECT;
+          delete settings.ORQUESTA_PROJECT_NAME;
+        } else {
+          const p = (await listProjects(account.id)).find((x) => x.id === id);
+          if (!p) return send(res, 400, { error: t('platform.orquesta.noProject') });
+          settings.ORQUESTA_PROJECT = p.id;
+          settings.ORQUESTA_PROJECT_NAME = p.name;
+        }
+      }
+      if (body.tasks !== undefined) {
+        if (body.tasks) settings.ORQUESTA_TASKS = '1';
+        else delete settings.ORQUESTA_TASKS;
+      }
+      if (body.allow !== undefined) {
+        const { list, bad } = parseAllow(body.allow);
+        if (bad.length) return send(res, 400, { error: t('platform.orquesta.badAllow', { list: bad.slice(0, 5).join(', ') }) });
+        if (list.length) settings.ORQUESTA_ALLOW = list.join(', ');
+        else delete settings.ORQUESTA_ALLOW;
+      }
+      if (body.daily !== undefined) settings.ORQUESTA_DAILY = String(Math.min(200, Math.max(1, Math.floor(Number(body.daily)) || 20)));
+      if (settings.ORQUESTA_TASKS && !settings.ORQUESTA_PROJECT) return send(res, 400, { error: t('platform.orquesta.pickProject') });
+      return send(res, 200, orquestaView(account, await save(ots, { settings })));
+    }
+    if (sub === '/orquesta/ask' && req.method === 'POST') {
+      const { message, history } = await readJson(req, 128 * 1024);
+      const msg = String(message || '').trim();
+      if (!msg) return send(res, 400, { error: t('server.http.badRequest') });
+      if (ots.status !== 'on') return send(res, 409, { error: t('platform.api.paused') });
+      const out = await askOt(ots, { message: msg, history, ownerEmail: account.email || account.id, locale: requestLocale(req) }, (a) => otsStep(ots, a));
+      return send(res, 200, out);
+    }
+    const tm = sub.match(/^\/orquesta\/tasks\/([A-Za-z0-9_-]{4,100})(\/cancel)?$/);
+    if (tm && !tm[2] && req.method === 'GET') {
+      const out = await taskStatus(ots, tm[1]);
+      return out.ok ? send(res, 200, out) : send(res, 404, { error: out.error });
+    }
+    if (tm && tm[2] && req.method === 'POST') {
+      const row = await cancelTask(ots, tm[1]);
+      return row ? send(res, 200, { id: row.id, status: row.status }) : send(res, 404, { error: t('server.http.notFound') });
+    }
+    return false;
+  }
+
+  // ───────────────────────────── account-level routes ─────────────────────────────
+
+  async function accountApi(req, res, account, path) {
+    if (path === '/apuchat/link' && req.method === 'DELETE') {
+      unlink(account.id);
+      return send(res, 200, { apuchat: apuchatAccountView(account.id) });
+    }
+    if (path === '/orquesta/projects' && req.method === 'GET') return send(res, 200, { projects: await listProjects(account.id) });
+    if (path === '/orquesta/key' && req.method === 'POST') {
+      const { key } = await readJson(req, 4 * 1024);
+      await saveKey(account.id, key);
+      return send(res, 200, { orquesta: orquestaAccountView(account.id) });
+    }
+    if (path === '/orquesta' && req.method === 'DELETE') {
+      disconnect(account.id);
+      return send(res, 200, { orquesta: orquestaAccountView(account.id) });
+    }
+    return false;
+  }
+
+  // ───────────────────────────── browser redirects ─────────────────────────────
+
+  async function authRoutes(req, res, url) {
+    const p = url.pathname;
+    if (!/^\/auth\/(apuchat|orquesta)(\/callback)?$/.test(p) || req.method !== 'GET') return false;
+    const account = currentAccount(req);
+    if (!account) {
+      redirect(res, '/app/');
+      return true;
+    }
+    const kind = p.split('/')[2];
+    const tab = kind;
+
+    if (!p.endsWith('/callback')) {
+      const ots = getOwnOts(account.id, url.searchParams.get('ots'));
+      const st = { s: randomBytes(16).toString('base64url'), acc: account.id, ots: ots?.id || null, e: Date.now() + STATE_TTL };
+      if (kind === 'apuchat') {
+        putState(req, res, kind, st);
+        redirect(res, linkUrl(`${base(req)}/auth/apuchat/callback?state=${st.s}`));
+        return true;
+      }
+      try {
+        const { url: to, verifier } = await authorizeUrl({ redirectUri: `${base(req)}/auth/orquesta/callback`, state: st.s });
+        putState(req, res, kind, { ...st, v: verifier });
+        redirect(res, to);
+      } catch (e) {
+        console.warn('[7ots] orquesta connect:', e.message);
+        back(res, 'orquestaFailed', st.ots, tab);
+      }
+      return true;
+    }
+
+    const st = takeState(req, res, kind);
+    const code = url.searchParams.get('code');
+    // The flow must come back to the same browser AND the same 7ots account that started it.
+    const ok = st && st.acc === account.id && code && url.searchParams.get('state') === st.s;
+    const otsId = st?.ots && getOwnOts(account.id, st.ots) ? st.ots : null;
+    if (!ok) {
+      back(res, url.searchParams.get('error') === 'access_denied' ? `${kind}Denied` : `${kind}Failed`, otsId, tab);
+      return true;
+    }
+    try {
+      if (kind === 'apuchat') await exchangeLink(account.id, code);
+      else await exchangeCode(account.id, { code, verifier: st.v, redirectUri: `${base(req)}/auth/orquesta/callback` });
+      back(res, kind === 'apuchat' ? 'apuchatLinked' : 'orquestaConnected', otsId, tab);
+    } catch (e) {
+      console.warn(`[7ots] ${kind} callback:`, e.message);
+      back(res, `${kind}Failed`, otsId, tab);
+    }
+    return true;
+  }
+
+  return {
+    /** /api/platform/<path> for the account; false if not one of these routes. */
+    account: accountApi,
+    /** /api/platform/ots/:id<sub>; false if not one of these routes. */
+    async ots(req, res, account, ots, sub) {
+      if (sub.startsWith('/apuchat')) return (await apuchatOts(req, res, account, ots, sub)) !== false;
+      if (sub.startsWith('/orquesta')) return (await orquestaOts(req, res, account, ots, sub)) !== false;
+      return false;
+    },
+    auth: authRoutes,
+    freeIdentity,
+    integrations: (account) => ({ apuchat: apuchatAccountView(account.id), orquesta: { ...orquestaAccountView(account.id), url: orquestaUrl() } }),
+    /** When an ot is deleted: give its free identity back to apuchat (best effort). */
+    async release(account, ots) {
+      if (isFree(ots) && ots.settings.APUCHAT_AGENT_CALLSIGN) await deleteIdentity(account.id, ots.settings.APUCHAT_AGENT_OWNER, ots.settings.APUCHAT_AGENT_CALLSIGN).catch(() => {});
+    },
+  };
+}

package/server/platform/db.mjs

@@ -11,8 +11,12 @@
  *   conversations  una por visitante y sesión del widget (o contacto de un canal)
  *   messages       lo que dijo cada uno (texto, sin el `raw` del proveedor)
  *   usage          contadores por ots, mes y tipo
+ *   integrations   cuentas conectadas de cada cuenta (apuchat, Orquesta), cifradas
+ *   platform_state valores de la plataforma (p. ej. el client_id de OAuth registrado en Orquesta)
+ *   ots_tasks      tareas que un ots mandó a Orquesta: quién la pidió, por dónde y cómo acabó
  */
 
+import { lookPrint } from './look.mjs';
 import { DatabaseSync } from 'node:sqlite';
 import { mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
@@ -87,6 +91,33 @@ CREATE TABLE IF NOT EXISTS usage (
   PRIMARY KEY (ots_id, month, kind)
 );
 CREATE INDEX IF NOT EXISTS usage_account ON usage(account_id, month);
+CREATE TABLE IF NOT EXISTS integrations (
+  account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+  kind TEXT NOT NULL,
+  data TEXT NOT NULL DEFAULT '',
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (account_id, kind)
+);
+CREATE TABLE IF NOT EXISTS platform_state (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS ots_tasks (
+  id TEXT PRIMARY KEY,
+  ots_id TEXT NOT NULL REFERENCES ots(id) ON DELETE CASCADE,
+  account_id TEXT NOT NULL,
+  project_id TEXT NOT NULL DEFAULT '',
+  who TEXT NOT NULL DEFAULT '',
+  channel TEXT NOT NULL DEFAULT '',
+  task TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'pending',
+  result TEXT NOT NULL DEFAULT '',
+  error TEXT NOT NULL DEFAULT '',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS ots_tasks_ots ON ots_tasks(ots_id, created_at DESC);
 `;
 
 let db = null;
@@ -99,6 +130,7 @@ export function openDb(path = process.env.PLATFORM_DB) {
   db = new DatabaseSync(file);
   db.exec('PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 3000;');
   db.exec(SCHEMA);
+  migrateLookPrints(db);
   return db;
 }
 
@@ -106,6 +138,29 @@ export function getDb() {
   return db || openDb();
 }
 
+/**
+ * Cada ot es único: huella del aspecto (ver look.mjs) con índice UNIQUE. Las bases viejas ganan la
+ * columna y se rellenan; si ya había repetidos, el más antiguo se queda la huella y los demás quedan
+ * sin ella (y se avisa) hasta que se les cambie la cara: guardarlos de nuevo exige una libre.
+ */
+function migrateLookPrints(d) {
+  if (!d.prepare('PRAGMA table_info(ots)').all().some((c) => c.name === 'look_print')) d.exec('ALTER TABLE ots ADD COLUMN look_print TEXT');
+  d.exec('CREATE UNIQUE INDEX IF NOT EXISTS ots_look ON ots(look_print)');
+  const seen = new Set(d.prepare('SELECT look_print p FROM ots WHERE look_print IS NOT NULL').all().map((r) => r.p));
+  const set = d.prepare('UPDATE ots SET look_print = ? WHERE id = ?');
+  for (const row of d.prepare('SELECT id, identity FROM ots WHERE look_print IS NULL ORDER BY created_at').all()) {
+    let p = null;
+    try {
+      p = lookPrint(JSON.parse(row.identity));
+    } catch {
+      /* identidad rota: sin huella */
+    }
+    if (!p) continue;
+    if (seen.has(p)) console.warn(`[7ots] plataforma: ${row.id} repite la cara de otro ot; queda sin huella hasta que se le cambie`);
+    else set.run(p, row.id), seen.add(p);
+  }
+}
+
 /** Cierra la base de datos (tests). */
 export function closeDb() {
   db?.close();

package/server/platform/look.mjs

@@ -0,0 +1,20 @@
+/**
+ * Huella del aspecto de un ot: cada ot de 7ots.com es único, no puede haber dos con la misma cara.
+ *
+ * La huella sale del personaje ya normalizado (identity.look.character, el mismo que dibujan el 2D y
+ * el 3D), con las claves ordenadas para que el orden no cuente. El estilo artístico (filtro) no la
+ * cambia: el mismo ot en acuarela sigue siendo el mismo ot. Un ot con foto propia usa la URL.
+ */
+import { createHash } from 'node:crypto';
+
+const stable = (v) =>
+  Array.isArray(v) ? `[${v.map(stable).join(',')}]` : v && typeof v === 'object' ? `{${Object.keys(v).sort().filter((k) => v[k] !== undefined).map((k) => `${JSON.stringify(k)}:${stable(v[k])}`).join(',')}}` : JSON.stringify(typeof v === 'string' ? v.toLowerCase() : v);
+
+/** identity (normalizada por defineIdentity) → huella hex de 32, o null si no tiene aspecto propio. */
+export function lookPrint(identity) {
+  const look = identity?.look || {};
+  if (look.kind === 'image' && look.image) return createHash('sha256').update(`image:${look.image}`).digest('hex').slice(0, 32);
+  const { style, ...character } = look.character || {};
+  if (!Object.keys(character).length) return null;
+  return createHash('sha256').update(`character:${stable(character)}`).digest('hex').slice(0, 32);
+}