@7ots/cli 0.1.1 → 0.1.4

package/server/platform/runtime.mjs

@@ -5,7 +5,9 @@
  *   1. lo que fija la plataforma (hub de apuchat, API de apumail, servicio de voz),
  *   2. sus ajustes y claves (solo las de OTS_KEYS),
  *   3. si no trae clave de IA o de voz, la de la plataforma, con cupo gratis por cuenta y mes:
- *        PLATFORM_ANTHROPIC_API_KEY   · PLATFORM_LLM_MODEL (defecto claude-sonnet-5-5)
+ *        PLATFORM_LLM_PROVIDER (anthropic | openai, compatibles como DeepSeek) · PLATFORM_LLM_API_KEY
+ *        PLATFORM_LLM_BASE_URL (openai compatibles) · PLATFORM_LLM_MODEL
+ *        (PLATFORM_ANTHROPIC_API_KEY sigue valiendo: equivale a provider anthropic + esa clave)
  *        PLATFORM_FREE_MESSAGES       respuestas de IA gratis por cuenta y mes (defecto 100)
  *        PLATFORM_APUCHAT_VOICE_TOKEN · PLATFORM_FREE_TTS (audios gratis por cuenta y mes, defecto 100)
  * Así un ots nunca ve las claves del proceso ni las de otro ots.
@@ -18,22 +20,38 @@ import { apumailConfigFromEnv } from '../channels/apumail.mjs';
 import { apuchatConfigFromEnv } from '../channels/apuchat.mjs';
 import { i18nError } from '../i18n.mjs';
 import { OTS_KEYS, accountUsage, addUsage, allLiveOts, getOts } from './store.mjs';
+import { orquestaTools } from './orquesta.mjs';
 
 const penv = process.env;
 const FIXED = ['APUCHAT_HUB', 'APUMAIL_API', 'APUCHAT_VOICE_URL'];
+// Where tenants' tokens are sent: read once at boot, so nothing that writes process.env later can redirect them.
+const BOOT_FIXED = Object.freeze(Object.fromEntries(FIXED.filter((k) => penv[k]).map((k) => [k, penv[k]])));
+// Platform-paid calls in flight per account (counted with usage, so parallel requests can't overrun the quota).
+const inflight = new Map(); // `${accountId}:${kind}` → n
+const MAX_INFLIGHT = () => Number(penv.PLATFORM_MAX_INFLIGHT || 4);
 const LLM_KEYS = ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY'];
 const TTS_KEYS = ['APUCHAT_VOICE_TOKEN', 'ELEVENLABS_API_KEY', 'XAI_API_KEY', 'FISH_API_KEY', 'OPENAI_API_KEY'];
 
+/** IA de la plataforma, o null si no hay. Nunca se mezcla con ajustes del ots (ni base URL ni modelo). */
+export function platformLlmEnv() {
+  const key = penv.PLATFORM_LLM_API_KEY || penv.PLATFORM_ANTHROPIC_API_KEY;
+  if (!key) return null;
+  const provider = (penv.PLATFORM_LLM_PROVIDER || (penv.PLATFORM_LLM_API_KEY ? 'openai' : 'anthropic')).toLowerCase();
+  const base = { LLM_EFFORT: 'low', LLM_MAX_TOKENS: '4000' };
+  if (provider === 'openai') return { ...base, LLM_PROVIDER: 'openai', OPENAI_API_KEY: key, LLM_BASE_URL: penv.PLATFORM_LLM_BASE_URL || '', LLM_MODEL: penv.PLATFORM_LLM_MODEL || 'gpt-4.1-mini' };
+  return { ...base, LLM_PROVIDER: 'anthropic', ANTHROPIC_API_KEY: key, LLM_MODEL: penv.PLATFORM_LLM_MODEL || 'claude-sonnet-5-5' };
+}
+
 export const freeMessages = () => Number(penv.PLATFORM_FREE_MESSAGES ?? 100);
 export const freeTts = () => Number(penv.PLATFORM_FREE_TTS ?? 100);
 
 /**
  * Entorno del ots.
- * @returns {{ env: object, platformLlm: boolean, platformTts: boolean }}
+ * @returns {{ env: object, llmEnv: object, platformLlm: boolean, platformTts: boolean }}
  */
 export function otsEnv(ots) {
   const env = {};
-  for (const k of FIXED) if (penv[k]) env[k] = penv[k];
+  Object.assign(env, BOOT_FIXED);
   for (const [k, meta] of Object.entries(OTS_KEYS)) {
     const v = meta.secret ? ots.secrets[k] : ots.settings[k];
     if (v == null || v === '') continue;
@@ -46,20 +64,25 @@ export function otsEnv(ots) {
   const ownLlm = provider === 'openai' ? !!env.OPENAI_API_KEY : provider === 'anthropic' ? !!env.ANTHROPIC_API_KEY : LLM_KEYS.some((k) => env[k]);
   if (provider === 'mock') {
     // Modo de pruebas: sin IA real.
-  } else if (!ownLlm && penv.PLATFORM_ANTHROPIC_API_KEY) {
+  } else if (!ownLlm && platformLlmEnv()) {
     platformLlm = true;
-    Object.assign(env, { LLM_PROVIDER: 'anthropic', ANTHROPIC_API_KEY: penv.PLATFORM_ANTHROPIC_API_KEY, LLM_MODEL: penv.PLATFORM_LLM_MODEL || 'claude-sonnet-5-5', LLM_EFFORT: 'low', LLM_MAX_TOKENS: '4000' });
   } else if (!ownLlm) {
     env.LLM_PROVIDER = 'mock';
   }
+  // The platform key lives only in llmEnv (never in env, which voice and channels see), and none of the
+  // ot's own settings (provider, model, base URL) reach it.
+  const llmEnv = platformLlm ? platformLlmEnv() : env;
 
   // Voz: la suya o la de apuchat de la plataforma.
   let platformTts = false;
-  if (!env.TTS_PROVIDER && !TTS_KEYS.some((k) => env[k]) && penv.PLATFORM_APUCHAT_VOICE_TOKEN) {
+  if (!TTS_KEYS.some((k) => env[k]) && penv.PLATFORM_APUCHAT_VOICE_TOKEN && (!env.TTS_PROVIDER || env.TTS_PROVIDER === 'apuchat')) {
     platformTts = true;
+    // On the platform's token the engine and model are the platform's, not the ot's.
+    delete env.APUCHAT_VOICE_PROVIDER;
+    delete env.APUCHAT_VOICE_MODEL;
     Object.assign(env, { TTS_PROVIDER: 'apuchat', APUCHAT_VOICE_TOKEN: penv.PLATFORM_APUCHAT_VOICE_TOKEN });
   }
-  return { env, platformLlm, platformTts };
+  return { env, llmEnv, platformLlm, platformTts };
 }
 
 // ───────────────────────────── LLM con cupo ─────────────────────────────
@@ -71,8 +94,8 @@ function rawLlm(ots) {
   const stamp = ots.updatedAt;
   const hit = llms.get(ots.id);
   if (hit?.stamp === stamp) return hit;
-  const { env, platformLlm } = otsEnv(ots);
-  const entry = { stamp, llm: createLLM(env), platformLlm };
+  const { llmEnv, platformLlm } = otsEnv(ots);
+  const entry = { stamp, llm: createLLM(llmEnv), platformLlm };
   if (llms.size > 2000) llms.clear();
   llms.set(ots.id, entry);
   return entry;
@@ -84,16 +107,45 @@ export function llmAllowed(ots) {
   return !platformLlm || accountUsage(ots.accountId, 'llm_platform') < freeMessages();
 }
 
+/**
+ * Takes one unit of the account's free quota before a platform-paid call (synchronous, so it is atomic in Node).
+ * Returns release(spent): on success the unit becomes usage; on failure it is given back.
+ */
+function reserve(ots, kind, limit, errorKey) {
+  const k = `${ots.accountId}:${kind}`;
+  const n = inflight.get(k) || 0;
+  if (accountUsage(ots.accountId, kind) + n >= limit) throw i18nError(402, errorKey);
+  if (n >= MAX_INFLIGHT()) throw i18nError(429, 'server.http.rateLimited');
+  inflight.set(k, n + 1);
+  return (spent) => {
+    const left = (inflight.get(k) || 1) - 1;
+    if (left > 0) inflight.set(k, left);
+    else inflight.delete(k);
+    if (spent) addUsage(ots, kind);
+  };
+}
+
 /**
  * Un paso de LLM para este ots, contando el uso.
  * Sin cupo lanza 402 con clave `platform.quota.llm` (la ruta lo convierte en una respuesta amable).
  */
 export async function otsStep(ots, args) {
   const { llm, platformLlm } = rawLlm(ots);
-  if (platformLlm && accountUsage(ots.accountId, 'llm_platform') >= freeMessages()) throw i18nError(402, 'platform.quota.llm');
-  const out = await llm.step(args);
+  const release = platformLlm ? reserve(ots, 'llm_platform', freeMessages(), 'platform.quota.llm') : null;
+  let out;
+  try {
+    out = await llm.step(args);
+  } catch (e) {
+    release?.(false);
+    // The platform's provider errors stay in our logs (they can echo parts of the platform key).
+    if (platformLlm) {
+      console.error('[7ots] platform llm', e?.status || '', e?.message || e);
+      throw i18nError(502, 'server.http.internal');
+    }
+    throw e;
+  }
+  release?.(true);
   addUsage(ots, 'llm');
-  if (platformLlm) addUsage(ots, 'llm_platform');
   return out;
 }
 
@@ -106,10 +158,16 @@ export function otsLlmInfo(ots) {
 
 export async function otsSynthesize(ots, { text, voice = ots.identity.voice }) {
   const { env, platformTts } = otsEnv(ots);
-  if (platformTts && accountUsage(ots.accountId, 'tts_platform') >= freeTts()) throw i18nError(402, 'platform.quota.tts');
-  const out = await synthesizeWith({ text, voice, env });
+  const release = platformTts ? reserve(ots, 'tts_platform', freeTts(), 'platform.quota.tts') : null;
+  let out;
+  try {
+    out = await synthesizeWith({ text, voice: platformTts && voice && typeof voice === 'object' ? { ...voice, model: undefined } : voice, env });
+  } catch (e) {
+    release?.(false);
+    throw e;
+  }
+  release?.(true);
   addUsage(ots, 'tts');
-  if (platformTts) addUsage(ots, 'tts_platform');
   return out;
 }
 
@@ -153,6 +211,8 @@ export function otsChannels(ots) {
     instructions: () => current().settings.SERVER_INSTRUCTIONS || '',
     config: { apumail: { ...apumailConfigFromEnv(env), webhookSecret: '' }, apuchat: apuchatConfigFromEnv(env) },
     log: (...a) => console.log(`[7ots:${id}]`, ...a),
+    // Orquesta tasks: only for senders on the ot's own list (see orquesta.mjs), read on every message.
+    tools: (ctx) => orquestaTools(current(), ctx),
   });
   channels.set(id, { stamp, ch });
   return ch;

package/server/platform/store.mjs

@@ -5,6 +5,9 @@
 
 import { defineIdentity } from '../../src/identity/schema.js';
 import { getDb, monthOf, tx } from './db.mjs';
+import { lookPrint } from './look.mjs';
+import { randomIdentity, newSeed } from '../../src/identity/random.js';
+import { i18nError } from '../i18n.mjs';
 import { newId, open, seal, sha256, token } from './crypto.mjs';
 
 const now = () => Date.now();
@@ -26,6 +29,8 @@ export const MAX_OTS_PER_ACCOUNT = () => Number(process.env.PLATFORM_MAX_OTS ||
  *   secret: se guarda cifrado y nunca se devuelve.
  *   max:    tope numérico.
  *   channels: al cambiar, se reinician los canales de ese ots.
+ *   managed:  only the dashboard's own routes write it (apuchat identity, Orquesta panel);
+ *             the backoffice's /server PUT ignores it and a duplicate doesn't copy it.
  */
 export const OTS_KEYS = {
   LLM_PROVIDER: {}, LLM_MODEL: {}, LLM_EFFORT: {}, LLM_MAX_TOKENS: { max: 16000 },
@@ -42,6 +47,13 @@ export const OTS_KEYS = {
   APUMAIL_AGENT_DAILY: { channels: true, max: 100 },
   APUCHAT_AGENT_IDENTITY_KEY: { secret: true, channels: true }, APUCHAT_AGENT_ALLOW: { channels: true },
   AGENT_MAX_CALLS: { channels: true, max: 3 }, AGENT_CALL_MAX_MINUTES: { channels: true, max: 30 }, AGENT_CALL_MAX_TURNS: { channels: true, max: 60 },
+  // apuchat identity made from the dashboard: its @callsign, '1' while it is a free one, and who holds it
+  // ('managed' = the platform's anonymous apuchat account for this 7ots account, 'linked' = the user's own).
+  APUCHAT_AGENT_CALLSIGN: { managed: true }, APUCHAT_AGENT_FREE: { managed: true }, APUCHAT_AGENT_OWNER: { managed: true },
+  // Orquesta tasks: project, on/off, who may ask outside the dashboard (explicit list, empty = nobody), daily cap.
+  // Read on every message, so changing them never restarts the channels.
+  ORQUESTA_PROJECT: { managed: true }, ORQUESTA_PROJECT_NAME: { managed: true }, ORQUESTA_TASKS: { managed: true },
+  ORQUESTA_ALLOW: { managed: true }, ORQUESTA_DAILY: { managed: true, max: 200 },
 };
 
 // ───────────────────────────── cuentas ─────────────────────────────
@@ -59,6 +71,8 @@ export function upsertAccount({ email = null, notloginSub = null, name = '' }) {
   return tx((d) => {
     let acc = notloginSub ? d.prepare('SELECT * FROM accounts WHERE notlogin_sub = ?').get(notloginSub) : null;
     if (!acc && email) acc = d.prepare('SELECT * FROM accounts WHERE email = ?').get(email);
+    // An email account already tied to a different notlogin identity is not taken over.
+    if (acc && notloginSub && acc.notlogin_sub && acc.notlogin_sub !== notloginSub) throw i18nError(409, 'platform.api.accountLinked');
     if (acc) {
       if (notloginSub && !acc.notlogin_sub) d.prepare('UPDATE accounts SET notlogin_sub = ? WHERE id = ?').run(notloginSub, acc.id);
       if (email && !acc.email && !d.prepare('SELECT 1 FROM accounts WHERE email = ?').get(email)) d.prepare('UPDATE accounts SET email = ? WHERE id = ?').run(email, acc.id);
@@ -94,6 +108,17 @@ export function deleteSession(raw) {
   if (raw) getDb().prepare('DELETE FROM sessions WHERE id = ?').run(sha256(raw));
 }
 
+/** Closes every session of the account (sign out everywhere). */
+export function deleteAccountSessions(accountId) {
+  getDb().prepare('DELETE FROM sessions WHERE account_id = ?').run(accountId);
+}
+
+/** Does a login (email or notlogin sub) already have an account? */
+export function accountExists({ email = null, notloginSub = null }) {
+  const d = getDb();
+  return !!((notloginSub && d.prepare('SELECT 1 FROM accounts WHERE notlogin_sub = ?').get(notloginSub)) || (email && d.prepare('SELECT 1 FROM accounts WHERE email = ?').get(String(email).trim().toLowerCase())));
+}
+
 // ───────────────────────────── enlaces por email ─────────────────────────────
 
 export const LOGIN_TOKEN_TTL = 15 * 60_000;
@@ -136,6 +161,7 @@ function hydrate(row) {
     widget: parse(row.widget, {}),
     settings: parse(row.settings, {}),
     secrets: open(row.secrets),
+    lookPrint: row.look_print || null,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
   };
@@ -159,30 +185,64 @@ export function countOts(accountId) {
   return getDb().prepare('SELECT COUNT(*) n FROM ots WHERE account_id = ?').get(accountId).n;
 }
 
+// Cada ot es único (ver look.mjs): la base rechaza una cara repetida con este error.
+const isLookClash = (e) => /UNIQUE/i.test(e?.message || '') && /look_print/.test(e.message);
+const lookTakenError = () => i18nError(409, 'platform.api.lookTaken');
+
+/** ¿Esa cara ya la tiene otro ot? (`exceptId`: el propio, al guardarlo). */
+export function lookTaken(identity, exceptId = '') {
+  const p = lookPrint(defineIdentity(identity));
+  return !!p && !!getDb().prepare('SELECT 1 FROM ots WHERE look_print = ? AND id != ?').get(p, String(exceptId));
+}
+
+/**
+ * La misma identidad con una cara nueva que nadie tenga: la de la semilla `seed` si está libre y si no,
+ * semillas al azar. Lo usan crear (un ot sin cara elegida) y duplicar.
+ */
+export function withFreeLook(identity, seed = null) {
+  for (let i = 0; i < 40; i++) {
+    const look = randomIdentity(i === 0 && seed ? seed : newSeed()).look;
+    const next = { ...identity, look: { ...identity.look, kind: 'character', character: look.character } };
+    if (!lookTaken(next)) return next;
+  }
+  throw lookTakenError();
+}
+
 export function createOts(accountId, { name, identity = {}, widget = {}, settings = {}, secrets = {}, domains = [] } = {}) {
   const id = newId('ots');
   const nm = cleanName(name) || 'Ots';
   const ident = defineIdentity({ ...identity, name: identity.name || nm });
-  getDb()
-    .prepare('INSERT INTO ots (id, account_id, name, status, domains, identity, widget, settings, secrets, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
-    .run(id, accountId, nm, 'on', JSON.stringify(cleanDomains(domains)), JSON.stringify(ident), JSON.stringify(widget), JSON.stringify(settings), seal(secrets), now(), now());
+  try {
+    getDb()
+      .prepare('INSERT INTO ots (id, account_id, name, status, domains, identity, widget, settings, secrets, look_print, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+      .run(id, accountId, nm, 'on', JSON.stringify(cleanDomains(domains)), JSON.stringify(ident), JSON.stringify(widget), JSON.stringify(settings), seal(secrets), lookPrint(ident), now(), now());
+  } catch (e) {
+    throw isLookClash(e) ? lookTakenError() : e;
+  }
   return getOts(id);
 }
 
-/** Copia un ots (sin sus claves ni canales propios: un @handle no puede estar en dos ots). */
+/** Copia un ots (sin sus claves ni canales propios: un @handle no puede estar en dos ots) con otra cara: no hay dos iguales. */
 export function duplicateOts(accountId, src) {
   const settings = { ...src.settings };
-  for (const k of Object.keys(settings)) if (OTS_KEYS[k]?.channels) delete settings[k];
-  return createOts(accountId, { name: `${src.name} (copia)`, identity: src.identity, widget: src.widget, settings, domains: src.domains });
+  for (const k of Object.keys(settings)) if (OTS_KEYS[k]?.channels || OTS_KEYS[k]?.managed) delete settings[k];
+  return createOts(accountId, { name: `${src.name} (copia)`, identity: withFreeLook(src.identity), widget: src.widget, settings, domains: src.domains });
 }
 
 export function updateOts(id, patch) {
   const cur = getOts(id);
   if (!cur) return null;
   const next = { ...cur, ...patch };
-  getDb()
-    .prepare('UPDATE ots SET name = ?, status = ?, domains = ?, identity = ?, widget = ?, settings = ?, secrets = ?, updated_at = ? WHERE id = ?')
-    .run(cleanName(next.name) || cur.name, next.status === 'off' ? 'off' : 'on', JSON.stringify(cleanDomains(next.domains)), JSON.stringify(next.identity), JSON.stringify(next.widget), JSON.stringify(next.settings), seal(next.secrets), now(), id);
+  // Un ot viejo que ya repetía cara (sin huella) se puede seguir guardando mientras no la cambie.
+  let print = lookPrint(next.identity);
+  if (!cur.lookPrint && print === lookPrint(cur.identity) && lookTaken(next.identity, id)) print = null;
+  try {
+    getDb()
+      .prepare('UPDATE ots SET name = ?, status = ?, domains = ?, identity = ?, widget = ?, settings = ?, secrets = ?, look_print = ?, updated_at = ? WHERE id = ?')
+      .run(cleanName(next.name) || cur.name, next.status === 'off' ? 'off' : 'on', JSON.stringify(cleanDomains(next.domains)), JSON.stringify(next.identity), JSON.stringify(next.widget), JSON.stringify(next.settings), seal(next.secrets), print, now(), id);
+  } catch (e) {
+    throw isLookClash(e) ? lookTakenError() : e;
+  }
   return getOts(id);
 }
 
@@ -329,3 +389,64 @@ export function usageHistory(otsId, months = 6) {
   }
   return [...by.values()].slice(0, months);
 }
+
+// ───────────────────────────── integraciones ─────────────────────────────
+
+/** Connected service of an account ('apuchat' | 'orquesta'): its tokens, decrypted. null if none. */
+export function getIntegration(accountId, kind) {
+  const row = getDb().prepare('SELECT data FROM integrations WHERE account_id = ? AND kind = ?').get(accountId, kind);
+  return row ? open(row.data) : null;
+}
+
+/** Saves (sealed) or, with null, forgets an account's integration. */
+export function setIntegration(accountId, kind, data) {
+  if (data == null) return void getDb().prepare('DELETE FROM integrations WHERE account_id = ? AND kind = ?').run(accountId, kind);
+  getDb()
+    .prepare('INSERT INTO integrations (account_id, kind, data, updated_at) VALUES (?, ?, ?, ?) ON CONFLICT(account_id, kind) DO UPDATE SET data = excluded.data, updated_at = excluded.updated_at')
+    .run(accountId, kind, seal(data), now());
+}
+
+export function getPlatformState(key) {
+  return getDb().prepare('SELECT value FROM platform_state WHERE key = ?').get(key)?.value ?? null;
+}
+
+export function setPlatformState(key, value) {
+  getDb().prepare('INSERT INTO platform_state (key, value, updated_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at').run(key, String(value), now());
+}
+
+// ───────────────────────────── tareas de Orquesta ─────────────────────────────
+
+const taskOf = (r) => r && { id: r.id, otsId: r.ots_id, projectId: r.project_id, who: r.who, channel: r.channel, task: r.task, status: r.status, result: r.result, error: r.error, createdAt: r.created_at, updatedAt: r.updated_at };
+export const TASK_FINAL = ['completed', 'failed', 'cancelled'];
+
+export function addTask(ots, { id, projectId, who, channel, task, status = 'pending' }) {
+  getDb()
+    .prepare('INSERT INTO ots_tasks (id, ots_id, account_id, project_id, who, channel, task, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+    .run(String(id), ots.id, ots.accountId, String(projectId || ''), String(who).slice(0, 200), String(channel).slice(0, 20), String(task).slice(0, 8000), status, now(), now());
+  return getTask(ots.id, id);
+}
+
+export function updateTask(id, { status, result, error }) {
+  getDb()
+    .prepare('UPDATE ots_tasks SET status = COALESCE(?, status), result = COALESCE(?, result), error = COALESCE(?, error), updated_at = ? WHERE id = ?')
+    .run(status ?? null, result == null ? null : String(result).slice(0, 20000), error == null ? null : String(error).slice(0, 2000), now(), String(id));
+}
+
+/** The task only if it belongs to that ot. */
+export function getTask(otsId, id) {
+  return taskOf(getDb().prepare('SELECT * FROM ots_tasks WHERE id = ? AND ots_id = ?').get(String(id || ''), otsId)) || null;
+}
+
+export function listTasks(otsId, limit = 20) {
+  return getDb().prepare('SELECT * FROM ots_tasks WHERE ots_id = ? ORDER BY created_at DESC LIMIT ?').all(otsId, Math.min(100, Math.max(1, Number(limit) || 20))).map(taskOf);
+}
+
+/** Tasks the ot sent in the last 24 h (its daily cap). */
+export function tasksLastDay(otsId) {
+  return getDb().prepare('SELECT COUNT(*) n FROM ots_tasks WHERE ots_id = ? AND created_at > ?').get(otsId, now() - 24 * 3600_000).n;
+}
+
+/** Tasks not finished yet (newest first). */
+export function openTasks(otsId) {
+  return getDb().prepare(`SELECT * FROM ots_tasks WHERE ots_id = ? AND status NOT IN (${TASK_FINAL.map(() => '?').join(', ')}) ORDER BY created_at DESC LIMIT 5`).all(otsId, ...TASK_FINAL).map(taskOf);
+}

package/server/server.mjs

@@ -119,10 +119,14 @@ const server = createServer(async (req, res) => {
     if (publicIdentityRoute(req, res, url)) return; // tarjeta pública: cualquier origen puede leerla
     if (await publicWidgetRoute(req, res, url)) return; // config pública y embed.js
     if (url.pathname.startsWith(`${PREFIX}/admin/`)) {
+      // In platform mode each ot has its own admin under /api/platform; the single-tenant one would rule them all.
+      if (PLATFORM) return send(res, 404, { error: t('server.http.notFound') });
       if (await admin(req, res, url.pathname.slice(PREFIX.length))) return;
     }
     if (url.pathname === '/backoffice' || url.pathname.startsWith('/backoffice/')) return await serveBackoffice(req, res, url.pathname);
     if (!cors(req, res)) return send(res, 403, { error: t('server.http.originNotAllowed') });
+    // In platform mode the operator's /api/agent (the landing demo) only answers the platform's own pages.
+    if (PLATFORM && url.pathname.startsWith(PREFIX) && req.method === 'POST' && !sameOrigin(req)) return send(res, 403, { error: t('server.http.originNotAllowed') });
     if (req.method === 'OPTIONS') return send(res, 204);
 
     if (url.pathname.startsWith(PREFIX)) return await api(req, res, url.pathname.slice(PREFIX.length));
@@ -130,7 +134,8 @@ const server = createServer(async (req, res) => {
     if (SERVE_STATIC && req.method === 'GET') return await serveStatic(req, res, url.pathname);
     send(res, 404, { error: t('server.http.notFound') });
   } catch (err) {
-    const status = err.status || 500;
+    // Only our own (i18n) errors reach the visitor as text; provider/SDK errors can echo keys or bodies.
+    const status = err.i18n ? err.status || 500 : err.status ? 502 : 500;
     if (status >= 500 && status !== 501) console.error('[7ots]', req.method, url.pathname, err);
     if (!res.headersSent) send(res, status, { error: status >= 500 && status !== 501 ? t('server.http.internal') : errorText(err, t) });
   }
@@ -358,6 +363,11 @@ function cors(req, res) {
   return true;
 }
 
+function sameOrigin(req) {
+  const origin = req.headers.origin;
+  return !!origin && (origin === originOf(req) || (env.PLATFORM_URL && origin === new URL(env.PLATFORM_URL).origin));
+}
+
 function send(res, status, body) {
   if (body === undefined) {
     res.writeHead(status);
@@ -386,7 +396,8 @@ async function readJson(req, limit) {
 
 const buckets = new Map();
 function clientIp(req) {
-  return (env.TRUST_PROXY === 'true' && String(req.headers['x-forwarded-for'] || '').split(',')[0].trim()) || req.socket.remoteAddress;
+  // The right-most X-Forwarded-For entry is the one our proxy added; the ones before it are client-controlled.
+  return (env.TRUST_PROXY === 'true' && String(req.headers['x-forwarded-for'] || '').split(',').pop().trim()) || req.socket.remoteAddress;
 }
 
 function rateLimit(req) {
@@ -412,7 +423,7 @@ const STATIC_DIRS = ['site', 'brand', 'examples', 'src', 'dist'];
 
 async function serveStatic(req, res, pathname) {
   if (pathname === '/') {
-    res.writeHead(302, { Location: '/site/' });
+    res.writeHead(302, { Location: '/site/start/' });
     return res.end();
   }
   let rel = normalize(decodeURIComponent(pathname)).replace(/^([/\\])+/, '');

package/src/avatar/AvatarStage.js

@@ -10,6 +10,11 @@
  * gestos; o el retrato (`image`) con un halo que late al hablar; o una cara SVG mínima.
  * `mode: '2d'` fuerza el modo 2D aunque haya WebGL (también si hay `character` y no `url`).
  *
+ * Modo '3d-plush': el MISMO personaje (`character`) como peluche/vinilo 3D (src/character3d),
+ * con la misma API (habla, ánimos, gestos, metamorfosis y efectos). `material`: 'plush'|'vinyl'.
+ * three se trae del CDN aunque la página no tenga importmap (src/avatar/three.js); ante
+ * cualquier fallo (sin WebGL, CSP, red) se queda en 2D.
+ *
  * Requisito del modo 3D en la página anfitriona (TalkingHead importa "three" por nombre):
  *
  *   <script type="importmap">
@@ -24,7 +29,7 @@
  *   await stage.mimic({ text, durationMs })  // sin audio (speechSynthesis): solo mueve la boca
  *   stage.mimicSync(charIndex)              // resincroniza con SpeechSynthesisUtterance.onboundary
  *   stage.stop(); stage.setMood('happy'); stage.gesture('thumbup');
- *   stage.morph('wings') / stage.effect('hearts')   // solo 2D (transformaciones y efectos del ot)
+ *   stage.morph('wings') / stage.effect('hearts')   // ot 2D y 3D-plush (transformaciones y efectos)
  *
  * Gestos: en 2D valen todos los de CHARACTER_GESTURES (y sus alias: handup, index, ok…);
  * en 3D se traducen al gesto de TalkingHead más parecido (GESTURE_3D).
@@ -35,6 +40,7 @@ export const DEFAULT_AVATAR_URL = 'https://cdn.jsdelivr.net/gh/met4citizen/Talki
 
 /** Enums cerrados: el LLM solo puede pedir estos valores (TalkingHead lanza con otros). */
 import { createCharacter, CHARACTER_GESTURES, CHARACTER_GESTURE_ALIAS } from '../character/Character.js';
+import { loadCharacter3D, ensureImportMap } from './three.js';
 
 export const MOODS = ['neutral', 'happy', 'angry', 'sad', 'fear', 'disgust', 'love', 'sleep'];
 export const GESTURES = ['handup', 'index', 'ok', 'thumbup', 'thumbdown', 'side', 'shrug', 'namaste'];
@@ -59,7 +65,7 @@ export class AvatarStage {
   /**
    * @param {object} o
    * @param {HTMLElement} o.container  nodo dentro del Shadow DOM del widget
-   * @param {object|false} o.config    { url, body:'F'|'M', mood, cameraView, lipsyncLang, module, name, image, face, mode }
+   * @param {object|false} o.config    { url, body:'F'|'M', mood, cameraView, lipsyncLang, module, name, image, face, mode:'2d'|'3d'|'3d-plush', material }
    * @param {string} [o.language]      idioma del agente (para elegir lip-sync)
    */
   constructor({ container, config = {}, language = document.documentElement.lang || 'es' }) {
@@ -84,12 +90,14 @@ export class AvatarStage {
 
   /** Carga el avatar 3D o cae al 2D. Nunca lanza. */
   async load(onProgress) {
-    if (this.cfg === false || this.cfg.mode === '2d' || (this.cfg.character && !this.cfg.url && this.cfg.mode !== '3d')) return this._load2D();
+    if (this.cfg && this.cfg.mode === '3d-plush' && this.cfg.character && !this.cfg.image) return this._loadPlush();
+    if (this.cfg === false || this.cfg.mode === '2d' || this.cfg.mode === '3d-plush' || (this.cfg.character && !this.cfg.url && this.cfg.mode !== '3d')) return this._load2D();
     if (!hasWebGL()) {
       console.info('[7ots] el navegador no tiene WebGL: avatar 2D');
       return this._load2D();
     }
     try {
+      ensureImportMap(); // TalkingHead importa "three" por nombre
       const { TalkingHead } = await import(/* @vite-ignore */ /* webpackIgnore: true */ this.cfg.module);
       this.head = new TalkingHead(this.container, {
         ttsEndpoint: '', // no usamos el TTS de Google de TalkingHead: el audio viene de VoiceEngine
@@ -117,6 +125,37 @@ export class AvatarStage {
     return this.mode;
   }
 
+  /** El ot como peluche 3D (misma spec que el 2D). Nunca lanza: ante cualquier fallo, 2D. */
+  async _loadPlush() {
+    const token = (this._plushToken = {});
+    if (!hasWebGL()) return this._load2D();
+    try {
+      const m = await loadCharacter3D();
+      if (this._plushToken !== token || !this.cfg) return this.mode; // otro load/dispose entre medias
+      this._ch?.destroy();
+      this.container.replaceChildren();
+      this._mouth = null;
+      this._face = null;
+      const ch = m.createCharacter3D(this.container, this.cfg.character, {
+        material: this.cfg.material === 'vinyl' ? 'vinyl' : 'plush',
+        orbit: this.cfg.orbit === true,
+        quality: this.cfg.quality || 'high',
+        // escenario propio por encima del panel del widget (z-index 2147483000)
+        stage: { key: 'overlay', zIndex: 2147483001, maxDpr: 1.5 },
+      });
+      this._ch = ch;
+      this.mode = ch.fallback ? '2d' : '3d-plush';
+      if (this.cfg.mood) ch.mood(this.cfg.mood, { fx: false });
+    } catch (err) {
+      console.warn('[7ots] ot 3D no disponible, uso 2D:', err?.message || err);
+      this._ch?.destroy?.();
+      this._ch = null;
+      this.container.replaceChildren();
+      this._load2D();
+    }
+    return this.mode;
+  }
+
   _load2D() {
     this.mode = '2d';
     this._ch?.destroy();
@@ -174,7 +213,7 @@ export class AvatarStage {
     if (image !== undefined) this.cfg.image = image;
     if (face !== undefined) this.cfg.face = face;
     if (character !== undefined) this.cfg.character = character;
-    if (this._ch && character && image === undefined) return void this._ch.update(character);
+    if (this._ch && character && image === undefined) return void this._ch.update(character, { material: this.cfg.material });
     if (this.mode === '2d') this._load2D();
   }
 
@@ -184,17 +223,22 @@ export class AvatarStage {
    */
   async applyLook(look = {}) {
     if (!this.cfg) return this.mode;
-    const want3d = look.mode === '3d' || (look.mode !== '2d' && !!look.url);
+    const plush = look.mode === '3d-plush' && !!look.character && !look.image;
+    const want3d = !plush && (look.mode === '3d' || (look.mode !== '2d' && !!look.url));
     if (this.mode === 'none') {
       Object.assign(this.cfg, { image: '', character: null }, look);
       return this.mode;
     }
     const next = { image: '', character: null, ...look };
-    if (want3d !== (this.mode === '3d') || (this.mode === '3d' && ((look.url || '') !== (this.cfg.url || '') || (look.body && look.body !== this.cfg.body)))) {
+    const isPlush = this.mode === '3d-plush';
+    if (plush !== isPlush || want3d !== (this.mode === '3d') || (this.mode === '3d' && ((look.url || '') !== (this.cfg.url || '') || (look.body && look.body !== this.cfg.body)))) {
       return this.reload(next);
     }
     Object.assign(this.cfg, next);
-    if (this.mode === '2d') {
+    if (isPlush) {
+      this._ch.update(next.character, { material: next.material === 'vinyl' ? 'vinyl' : 'plush' });
+      if (next.mood) this.setMood(next.mood);
+    } else if (this.mode === '2d') {
       if (this._ch && next.character && !next.image) this._ch.update(next.character);
       else this._load2D();
       if (next.mood) this.setMood(next.mood);
@@ -358,12 +402,12 @@ export class AvatarStage {
     return this._ch.gesture(name, { mirror, ...(seconds ? { ms: seconds * 1000 } : {}) });
   }
 
-  /** Transformación temporal del personaje 2D ('wings', 'spikes', 'hands', 'shape:heart'…). No hace nada en 3D. */
+  /** Transformación temporal del ot ('wings', 'spikes', 'hands', 'shape:heart'…), 2D o 3D-plush. No hace nada con TalkingHead. */
   morph(name, opts) {
     return this._ch ? this._ch.morph(name, opts) : false;
   }
 
-  /** Efecto 2D ('hearts', 'sparkles', 'zzz'…). No hace nada en 3D. */
+  /** Efecto del ot ('hearts', 'sparkles', 'zzz'…), 2D o 3D-plush. No hace nada con TalkingHead. */
   effect(name, opts) {
     return this._ch ? this._ch.effect(name, opts) : false;
   }
@@ -409,6 +453,7 @@ export class AvatarStage {
   }
 
   dispose() {
+    this._plushToken = null;
     this.stop();
     if (this._vis) document.removeEventListener('visibilitychange', this._vis);
     try { this.head?.dispose?.(); } catch {}

package/src/avatar/three.js

@@ -0,0 +1,62 @@
+/**
+ * Carga de three para los avatares 3D, sin depender de que la página anfitriona declare el
+ * importmap (el widget vive en webs de terceros).
+ *
+ *   - Bundle (dist/7ots.*.js): scripts/build.mjs cambia `import 'three'` y sus addons por
+ *     lecturas de globalThis.__OTS_THREE__, y src/character3d queda dentro del bundle con
+ *     evaluación perezosa. loadThree() rellena ese global desde el CDN (+esm de jsDelivr: los
+ *     addons importan la MISMA instancia de three) antes del import dinámico.
+ *   - Fuentes sin empaquetar (site/3d, desarrollo): `import 'three'` lo resuelve el importmap;
+ *     si la página no lo tiene, ensureImportMap() lo inyecta (vale mientras no se haya cargado
+ *     ningún módulo todavía, o en navegadores con varios importmaps).
+ *
+ * Este archivo NO importa three: se puede cargar siempre.
+ */
+
+export const THREE_VERSION = '0.170.0';
+const CDN = `https://cdn.jsdelivr.net/npm/three@${THREE_VERSION}`;
+const base = () => String(globalThis.OTS_THREE_BASE || CDN).replace(/\/$/, '');
+
+/** Importmap de three (el mismo que declaran site/3d, backoffice, app y site/start). */
+export function threeImportMap() {
+  return { imports: { three: `${base()}/build/three.module.js`, 'three/addons/': `${base()}/examples/jsm/` } };
+}
+
+/** ¿Resuelve ya la página el especificador 'three'? Si no, inyecta el importmap. */
+export function ensureImportMap() {
+  if (typeof document === 'undefined') return false;
+  for (const s of document.querySelectorAll('script[type="importmap"]')) {
+    try { if (JSON.parse(s.textContent || '{}').imports?.three) return true; } catch {}
+  }
+  const s = document.createElement('script');
+  s.type = 'importmap';
+  s.textContent = JSON.stringify(threeImportMap());
+  (document.head || document.documentElement).prepend(s);
+  return true;
+}
+
+let threeP = null;
+
+/** three + los addons que usa src/character3d, en globalThis.__OTS_THREE__. */
+export function loadThree() {
+  threeP ??= (async () => {
+    if (globalThis.__OTS_THREE__?.three) return globalThis.__OTS_THREE__;
+    const u = (p) => `${base()}/${p}/+esm`;
+    const [three, BufferGeometryUtils, RoomEnvironment] = await Promise.all([
+      import(/* @vite-ignore */ /* webpackIgnore: true */ `${base()}/+esm`),
+      import(/* @vite-ignore */ /* webpackIgnore: true */ u('examples/jsm/utils/BufferGeometryUtils.js')),
+      import(/* @vite-ignore */ /* webpackIgnore: true */ u('examples/jsm/environments/RoomEnvironment.js')),
+    ]);
+    return (globalThis.__OTS_THREE__ = { three, BufferGeometryUtils, RoomEnvironment });
+  })();
+  threeP.catch(() => { threeP = null; });
+  return threeP;
+}
+
+/** Módulo de los ots 3D (src/character3d/index.js) listo para usar. Lanza si no se puede. */
+export async function loadCharacter3D() {
+  ensureImportMap();
+  // __OTS_BUNDLE__ lo define scripts/build.mjs; sin empaquetar, three viene del importmap
+  if (typeof __OTS_BUNDLE__ !== 'undefined') await loadThree();
+  return import('../character3d/index.js');
+}