@curless/hotel-storefront 0.55.8 → 0.56.1

package/dist/account/index.js

@@ -0,0 +1,871 @@
+import { createHmac, randomBytes } from 'node:crypto';
+import { bodyLimit } from 'hono/body-limit';
+import { WindowCounter } from '../limits.js';
+import { LIMITS, MallError, makeMall, } from './mall.js';
+import { PAGE_HEADERS, accountPage, loginPage, say, signedInPage, statePage, } from './pages.js';
+import { CODE, createSignIns, hashOf, same, } from './requests.js';
+import { AccountStore, WEB_IDLE_MS, WebSessions, shownOf } from './store.js';
+/**
+ * The tools, by the deployment's prefix: three the assistant calls -
+ * `sign_in_otaless_account` - and one the card calls (`card`, app-only).
+ *
+ * ⚠️ THE ASSISTANT'S THREE NAME NO CONVERSATION (security review of 0.56.0,
+ * P2-1): they act on the conversation they are called in and no other - a
+ * trip id handed to them by a page or a shop is refused (server.ts). Only the
+ * card names the conversation it was drawn for (its trip), through `card`, a
+ * tool the host keeps from the assistant; a client that draws no card is
+ * refused it.
+ */
+export const accountToolNames = (prefix) => ({
+    signIn: `sign_in_${prefix}account`,
+    view: `view_${prefix}account`,
+    signOut: `sign_out_${prefix}account`,
+    card: `card_${prefix}account`,
+});
+/** Beside every answer of a deployment with an account, for the card's header. */
+export const ACCOUNT_META_KEY = 'curless/account';
+/** Beside a sign-in's answer where a card is drawn: the link and its short code, the card's alone. */
+export const SIGN_IN_META_KEY = 'curless/account-sign-in';
+/** The mall is asked at most this often whether a sign-in is still theirs. */
+export const CHECK_EVERY_MS = 5 * 60_000;
+export const COOKIE = '__Host-hotel_account';
+/** How many of what, and over how long - each refusal said as "too many requests". */
+export const ACCOUNT_LIMITS = {
+    /** Sign-in links one conversation may ask for in ten minutes. */
+    linksPerConversation: 10,
+    /**
+     * …one address in a minute, and everyone (review P3-2: one address with two
+     * hundred sessions filled the table). Wide per address: every Claude user
+     * arrives from a handful of Anthropic's.
+     */
+    linksPerIp: 120,
+    linksPerMinute: 600,
+    /** Page views from one address in a minute. */
+    pagesPerIp: 120,
+    /** Form posts from one address in ten minutes. */
+    postsPerIp: 30,
+    /** Sign-ins (or accounts made) by one user name in ten minutes. */
+    perName: 8,
+    /** Everyone's sign-ins in a minute, and accounts made. */
+    signInsPerMinute: 180,
+    registersPerMinute: 90,
+};
+/** The largest form our pages post (Caddy is told 16KB). */
+export const FORM_MAX_BYTES = 8 * 1024;
+/** The conversation, on a log line: never the key itself. */
+const tag = (key) => hashOf(key).slice(0, 8);
+/** The address the edge proxy saw - the LAST X-Forwarded-For entry (server.ts `clientIp`). */
+const ipOf = (c) => addressKey((c.req.header('x-forwarded-for') ?? '').split(',').at(-1)?.trim() || 'local');
+/** An IPv6 address by its /64 (review P3-1, as Nexva counts it): one machine has a whole /64. */
+export const addressKey = (ip) => {
+    const a = ip.replace(/^\[|\]$/g, '').replace(/%.*$/, '');
+    // IPv4, or IPv4 written in IPv6 (::ffff:1.2.3.4): as it is.
+    if (!a.includes(':') || a.includes('.'))
+        return ip;
+    // ⚠️ `::` FILLED IN FIRST (re-review P3-1): 2001:db8::1 cut at four groups was
+    // 2001:db8::1, a bucket of its own for every address of the /64.
+    const at = a.indexOf('::');
+    const head = (at < 0 ? a : a.slice(0, at)).split(':').filter(Boolean);
+    const tail = at < 0
+        ? []
+        : a
+            .slice(at + 2)
+            .split(':')
+            .filter(Boolean);
+    const groups = at < 0
+        ? head
+        : [...head, ...Array(Math.max(0, 8 - head.length - tail.length)).fill('0'), ...tail];
+    return `${groups
+        .slice(0, 4)
+        .map((g) => g.toLowerCase().replace(/^0+(?=.)/, ''))
+        .join(':')}::/64`;
+};
+const langOf = (v) => {
+    if (typeof v !== 'string')
+        return undefined;
+    const t = v.trim().toLowerCase();
+    if (t === 'zh' || t.startsWith('zh-') || t.startsWith('zh_'))
+        return 'zh';
+    if (t === 'en' || t.startsWith('en-'))
+        return 'en';
+    return undefined;
+};
+const acceptLang = (h) => {
+    for (const part of String(h ?? '').split(',')) {
+        const l = part.split(';')[0]?.trim().toLowerCase() ?? '';
+        if (l.startsWith('zh'))
+            return 'zh';
+        if (l.startsWith('en'))
+            return 'en';
+    }
+    return 'en';
+};
+/** A mall failure that says the sign-in is not theirs any more - not a blip on the way. */
+const refused = (e) => e instanceof MallError && (e.envelope || e.code === 401 || e.code === 403);
+/** The mall did not answer - not a no. */
+const notThere = (e) => e instanceof MallError &&
+    (e.code === 'timeout' ||
+        e.code === 'unreachable' ||
+        (typeof e.code === 'number' && e.code >= 500 && !e.envelope));
+export const makeAccount = (opts) => {
+    const now = opts.now ?? (() => Date.now());
+    const env = opts.env ?? process.env;
+    const prefix = opts.account.envPrefix ?? 'ACCOUNT';
+    const baseUrl = env[`${prefix}_API_URL`] || opts.account.baseUrl;
+    const tenant = env[`${prefix}_TENANT_ID`] || opts.account.tenant;
+    if (!baseUrl || !tenant)
+        throw new Error(`account: no mall address or tenant (account.baseUrl / account.tenant, or ${prefix}_API_URL / ${prefix}_TENANT_ID)`);
+    const mall = makeMall({
+        baseUrl,
+        tenant,
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+        now,
+    });
+    const log = opts.log ?? ((l) => console.log(l));
+    const names = accountToolNames(opts.prefix);
+    const requests = createSignIns({ now });
+    // A sign-in forgotten here - left two hours, past its tokens, or pushed out -
+    // is ended at the mall too (review P3-3).
+    const store = new AccountStore(now, (s) => end(s));
+    const web = new WebSessions(now);
+    // The form's token, from a secret of this process: a restart voids open
+    // forms, as it voids the requests they post for.
+    const secretKey = randomBytes(32);
+    const loginCsrf = (r) => createHmac('sha256', secretKey).update(`login:${r.codeHash}`).digest('base64url').slice(0, 32);
+    const counters = {
+        links: new WindowCounter(10 * 60_000, now),
+        linksIp: new WindowCounter(60_000, now),
+        linksAll: new WindowCounter(60_000, now),
+        pages: new WindowCounter(60_000, now),
+        posts: new WindowCounter(10 * 60_000, now),
+        names: new WindowCounter(10 * 60_000, now),
+        all: new WindowCounter(60_000, now),
+    };
+    const refusals = {
+        links: 0,
+        linksIp: 0,
+        linksAll: 0,
+        pages: 0,
+        posts: 0,
+        names: 0,
+        all: 0,
+        origin: 0,
+        csrf: 0,
+        full: 0,
+    };
+    const publicUrl = opts.publicUrl.replace(/\/+$/, '');
+    const origin = new URL(publicUrl).origin;
+    const base = new URL(publicUrl).pathname.replace(/\/+$/, '');
+    const brandPage = {
+        brand: opts.brand,
+        base,
+        ...(opts.logoUrl
+            ? { logo: new URL(opts.logoUrl).pathname + new URL(opts.logoUrl).search }
+            : {}),
+        ...(opts.logoDarkUrl
+            ? { logoDark: new URL(opts.logoDarkUrl).pathname + new URL(opts.logoDarkUrl).search }
+            : {}),
+        ...(opts.operator ? { operator: opts.operator } : {}),
+    };
+    const brand = opts.brand;
+    /** "an Otaless", "a Shangri-La". */
+    const aBrand = `${/^[aeiou]/i.test(brand) ? 'an' : 'a'} ${brand}`;
+    // ── Signing in and out ───────────────────────────────────────────────────
+    /** Signed in now, for this conversation: whatever was there before is ended. */
+    const signInWith = (key, member, tokens) => {
+        const was = store.clear(key);
+        if (was)
+            end(was);
+        requests.cancelFor(key);
+        return store.set(key, member, tokens);
+    };
+    /** A sign-in that is over: its pages closed, its tokens ended at the mall (not waited for). */
+    const end = (s) => {
+        web.dropFor(s.sid);
+        mall
+            .logout(s.tokens)
+            .catch((e) => log(`[account] the mall's sign-out did not answer (${codeOf(e)})`));
+    };
+    const signOut = (key) => {
+        const was = store.clear(key);
+        requests.cancelFor(key);
+        if (was)
+            end(was);
+        return was;
+    };
+    const codeOf = (e) => e instanceof MallError ? String(e.code).slice(0, 16) : e instanceof Error ? e.name : 'error';
+    /**
+     * Still theirs? Asked of the mall at most every five minutes: a token
+     * revoked there - signed out on another device - answers as nobody, and the
+     * sign-in here goes. A blip on the way is not that: kept, asked next time.
+     */
+    // ⚠️ ONE LOOK AT A TIME FOR A CONVERSATION (review P3-5): two at once spent
+    // the same refresh token, and the mall, rotating it, refused the second -
+    // read as signed out.
+    const looking = new Map();
+    const checked = (key) => {
+        const s = store.get(key);
+        if (!s || now() - s.checkedAt < CHECK_EVERY_MS)
+            return Promise.resolve(s);
+        const out = looking.get(key);
+        if (out)
+            return out;
+        const p = look(key, s).finally(() => looking.delete(key));
+        looking.set(key, p);
+        return p;
+    };
+    const look = async (key, s) => {
+        // ⚠️ ONLY A REFUSED RENEWAL, OR A TOKEN THE MALL SAYS IS NOBODY'S, SIGNS OUT:
+        // their envelope says 500 for a fault of theirs too (Nexva's audit M-18).
+        const GONE = new Error('gone');
+        const renew = async () => {
+            try {
+                s.tokens = await mall.refresh(s.tokens);
+            }
+            catch (e) {
+                throw refused(e) ? GONE : e;
+            }
+        };
+        const whoIs = () => mall.info(s.tokens).catch((e) => {
+            if (e instanceof MallError && (e.code === 401 || e.code === 403))
+                return null;
+            throw e;
+        });
+        try {
+            if (s.tokens.accessExpires - now() < 60_000)
+                await renew();
+            let who = await whoIs();
+            if (!who || who.id !== s.shown.id) {
+                await renew();
+                who = await whoIs();
+            }
+            if (!who || who.id !== s.shown.id)
+                throw GONE;
+            s.shown = shownOf(who);
+            s.checkedAt = now();
+            return s;
+        }
+        catch (e) {
+            // ⚠️ ONLY THE SIGN-IN THIS LOOK WAS FOR (re-review P3-2): signed out and in
+            // again while the mall kept it waiting, the conversation has a new one,
+            // which an old token's refusal says nothing about.
+            const nowIn = store.get(key);
+            if (nowIn?.sid !== s.sid)
+                return nowIn;
+            if (e === GONE) {
+                log(`[account] ${tag(key)} is not signed in at the mall any more: signed out here`);
+                signOut(key);
+                return undefined;
+            }
+            // Not now: the sign-in stands, and is asked about again next time.
+            log(`[account] ${tag(key)}: the mall could not be asked (${codeOf(e)}) - still signed in`);
+            return nowIn;
+        }
+    };
+    // ── The tools ────────────────────────────────────────────────────────────
+    const NO_PRICE = `Being signed in changes no price or room shown here: ${brand} has no member rate here yet.`;
+    const NEVER_IN_CHAT = 'never in this chat: do not ask for, or accept, a password, an email or a phone number here, and never write back one the guest typed - not even to say which to change';
+    const minutes = Math.round(requests.ttlMs / 60_000);
+    const accountUrl = `${publicUrl}/account`;
+    // ⚠️ THE NAME THE ACCOUNT GOES BY, AND NOTHING ELSE (review P2-2): the user
+    // name signs in - in front of a forwarded link's sender it would let them
+    // lock the account out with wrong tries - and the real name, the email and
+    // the phone are the member's. Those are on the account page, in the browser
+    // that typed the password. No nickname: no name at all.
+    const shownFor = (s) => s.shown.displayName ? { displayName: s.shown.displayName } : {};
+    const whoSaid = (s) => s.shown.displayName ? `the ${brand} account of ${s.shown.displayName}` : `${aBrand} account`;
+    const signedInAnswer = (s, lead) => ({
+        text: `${lead} Signed in to ${whoSaid(s)}. ${NO_PRICE} The guest sees the whole account - its user name, and its email and phone partly hidden - on ${brand}'s account page, ${accountUrl}, in the browser they signed in with, for ${WEB_IDLE_MS / 60_000} minutes after. ${names.signOut} signs them out.`.trim(),
+        structured: { view: 'account', brand, signedIn: true, account: shownFor(s), accountUrl },
+    });
+    const handle = async (name, args, call) => {
+        const { key, noCards } = call;
+        // The card's own: the same three, by `action`.
+        if (name === names.card) {
+            const act = args.action === 'sign_in'
+                ? names.signIn
+                : args.action === 'sign_out'
+                    ? names.signOut
+                    : names.view;
+            return handle(act, args, { ...call, noCards: false, fromCard: true });
+        }
+        if (name === names.view) {
+            const s = await checked(key);
+            if (s)
+                return signedInAnswer(s, '');
+            const waiting = requests.openFor(key);
+            // ⚠️ THE ASSISTANT, WHERE A CARD IS DRAWN, IS NOT TOLD "NOBODY" (0.56.1,
+            // robin 11-06): claude.ai sent one conversation's calls by several
+            // connections - the card signed the guest in on one, and the assistant's
+            // look on another found nothing, and said "not signed in" under a card
+            // that said signed in. What it finds is said as what it is: nothing here,
+            // the card is right.
+            if (!noCards && !call.fromCard)
+                return {
+                    text: `No ${brand} sign-in can be looked up from here. If the ${brand} card shows the guest signed in, the card is right: they are - tell them so plainly, for example 「这里查不到你的登录状态，以卡片上显示的为准」 or "I can't see your sign-in from here - what the card shows is right". If the card shows Sign in, they sign in there, or ${names.signIn} gives a one-time page. ${NEVER_IN_CHAT[0]?.toUpperCase()}${NEVER_IN_CHAT.slice(1)}. ${NO_PRICE}`,
+                    structured: {
+                        view: 'account',
+                        brand,
+                        signedIn: false,
+                        cardIsRight: true,
+                        ...(waiting ? { waiting: true } : {}),
+                    },
+                };
+            return {
+                text: `Nobody is signed in to ${aBrand} account in this conversation${waiting ? ': a sign-in link is open and not used yet' : ''}. ${names.signIn} gives the guest a one-time page to sign in or create an account on - ${NEVER_IN_CHAT}. ${NO_PRICE}`,
+                structured: {
+                    view: 'account',
+                    brand,
+                    signedIn: false,
+                    ...(waiting ? { waiting: true } : {}),
+                },
+            };
+        }
+        if (name === names.signOut) {
+            const was = signOut(key);
+            if (!was)
+                return {
+                    text: !noCards && !call.fromCard
+                        ? `No ${brand} sign-in can be found from here to sign out of. If the ${brand} card shows the guest signed in, they sign out on the card: its account button, then Sign out.`
+                        : `Nobody was signed in to ${aBrand} account in this conversation, so nothing changed.`,
+                    structured: { view: 'account-signed-out', brand, signedIn: false, was: false },
+                };
+            log(`[account] ${tag(key)} signed out`);
+            return {
+                text: `Signed out of ${whoSaid(was)} in this conversation, and at ${brand}. The trip is left as it is.`,
+                structured: { view: 'account-signed-out', brand, signedIn: false, was: true },
+            };
+        }
+        if (name !== names.signIn)
+            throw new Error(`not an account tool: ${name}`);
+        const s = await checked(key);
+        if (s)
+            return {
+                ...signedInAnswer(s, ''),
+                text: `Already signed in to ${whoSaid(s)}: there is nothing to open. To use another account, ${names.signOut} first. ${NO_PRICE}`,
+            };
+        if (counters.links.count(key) >= ACCOUNT_LIMITS.linksPerConversation) {
+            refusals.links++;
+            return {
+                text: `Too many sign-in links were asked for in this conversation just now. Wait a few minutes, then ask again. ${NEVER_IN_CHAT[0]?.toUpperCase()}${NEVER_IN_CHAT.slice(1)}.`,
+                structured: { view: 'error', brand, code: 'too_many_links' },
+                isError: true,
+            };
+        }
+        // …and one address, and everyone - after the conversation's own count.
+        const ip = call.ip ?? 'unknown';
+        const gate = (which, k, max) => {
+            if (counters[which].count(k) >= max) {
+                refusals[which]++;
+                return true;
+            }
+            return false;
+        };
+        if (gate('linksIp', ip, ACCOUNT_LIMITS.linksPerIp) ||
+            gate('linksAll', 'all', ACCOUNT_LIMITS.linksPerMinute))
+            return {
+                text: 'Too many sign-ins are being started just now. Try again in a minute.',
+                structured: { view: 'error', brand, code: 'busy' },
+                isError: true,
+            };
+        counters.links.add(key);
+        counters.linksIp.add(ip);
+        counters.linksAll.add('all');
+        const lang = langOf(args.lang);
+        const made = requests.create({ key, ...(lang ? { lang } : {}), words: !!noCards });
+        if (!made) {
+            log('[account] a sign-in link refused: the table is full of open ones');
+            return {
+                text: 'Too many sign-ins are open just now. Try again in a minute.',
+                structured: { view: 'error', brand, code: 'busy' },
+                isError: true,
+            };
+        }
+        const url = `${publicUrl}/login?code=${made.code}`;
+        const expiresAt = new Date(made.expiresAt).toISOString();
+        log(`[account] a sign-in link for ${tag(key)} (${requests.open()} open)${noCards ? ' in words' : ''}`);
+        if (noCards)
+            return {
+                text: `A one-time ${brand} sign-in page is ready: ${url} - the guest opens it in their browser and signs in, or creates ${aBrand} account, on that page, ${NEVER_IN_CHAT}. The page shows the code ${made.short}: tell the guest it must match the code you give them here, and to close the page if it does not. The link works once, for ${minutes} minutes. When they say they are done, ${names.view} shows that they are signed in. ${NO_PRICE}`,
+                structured: {
+                    view: 'account-sign-in',
+                    brand,
+                    signedIn: false,
+                    url,
+                    shortCode: made.short,
+                    expiresAt,
+                    expiresInSeconds: Math.round(requests.ttlMs / 1000),
+                },
+            };
+        // ⚠️ THE LINK AND THE CODE ARE THE CARD'S (Nexva's review P1-1): the model is
+        // never handed the short code where a card is drawn, so text a page slipped
+        // into the chat cannot show a matching one.
+        return {
+            text: `A one-time ${brand} sign-in page is ready for the guest, opened from the card: they sign in, or create ${aBrand} account, on that page, ${NEVER_IN_CHAT}. The card shows a code the page shows too, and shows them signed in when they are done; the link works once, for ${minutes} minutes. ${NO_PRICE}`,
+            structured: {
+                view: 'account-sign-in',
+                brand,
+                signedIn: false,
+                expiresAt,
+                expiresInSeconds: Math.round(requests.ttlMs / 1000),
+            },
+            meta: { [SIGN_IN_META_KEY]: { url, shortCode: made.short, expiresAt } },
+        };
+    };
+    const STR = { type: 'string' };
+    const tools = () => [
+        {
+            name: names.signIn,
+            // ⚠️ NOTHING ABOUT THE GUEST IS ASKED FOR HERE - see the top of this file.
+            description: `Starts signing the guest in to their ${brand} account, or creating one, on ${brand}'s own web page: answers with a one-time link and a short code the page shows too. Takes no personal details - the guest types them on that page, never in the chat. Being signed in changes no price shown here.`,
+            annotations: {
+                title: `Sign in to ${aBrand} account`,
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: false,
+                openWorldHint: true,
+            },
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    lang: {
+                        type: 'string',
+                        enum: ['zh', 'en'],
+                        description: 'The language the page opens in: zh for a guest writing Chinese, en otherwise. The page has a switch.',
+                    },
+                },
+            },
+        },
+        {
+            name: names.view,
+            description: `Whether the guest is signed in to their ${brand} account in this conversation, and the name the account goes by. Its user name and contact details are not given: they are on ${brand}'s account page.`,
+            annotations: {
+                title: `My ${brand} account`,
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: true,
+            },
+            inputSchema: { type: 'object', properties: {} },
+        },
+        {
+            name: names.signOut,
+            description: `Signs the guest out of their ${brand} account in this conversation, and ends that sign-in at ${brand}. The trip is left as it is.`,
+            annotations: {
+                title: `Sign out of the ${brand} account`,
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: true,
+            },
+            inputSchema: { type: 'object', properties: {} },
+        },
+        {
+            name: names.card,
+            // The card's own (app-only, server.ts): never offered to the assistant.
+            description: `The booking card's own way to sign in to the ${brand} account, see who is signed in, or sign out - for the conversation the card was drawn for. The assistant uses ${names.signIn}, ${names.view} and ${names.signOut}.`,
+            annotations: {
+                title: `${brand} account (card)`,
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: false,
+                openWorldHint: true,
+            },
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    action: { type: 'string', enum: ['sign_in', 'view', 'sign_out'] },
+                    lang: { type: 'string', enum: ['zh', 'en'] },
+                },
+                required: ['action'],
+            },
+        },
+    ];
+    const ACCOUNT_VIEWS = ['account-sign-in', 'account', 'account-signed-out', 'error'];
+    const outputSchemas = () => ({
+        [names.card]: {
+            type: 'object',
+            properties: {
+                view: { enum: ACCOUNT_VIEWS },
+                brand: STR,
+                signedIn: { type: 'boolean' },
+                waiting: { type: 'boolean' },
+                was: { type: 'boolean' },
+                expiresAt: STR,
+                expiresInSeconds: { type: 'number' },
+                account: { type: 'object' },
+                accountUrl: STR,
+                code: STR,
+            },
+            required: ['view'],
+        },
+        [names.signIn]: {
+            type: 'object',
+            properties: {
+                view: { enum: ['account-sign-in', 'account', 'error'] },
+                brand: STR,
+                signedIn: { type: 'boolean' },
+                url: STR,
+                shortCode: STR,
+                expiresAt: STR,
+                expiresInSeconds: { type: 'number' },
+                account: { type: 'object' },
+                accountUrl: STR,
+                code: STR,
+            },
+            required: ['view'],
+        },
+        [names.view]: {
+            type: 'object',
+            properties: {
+                view: { const: 'account' },
+                brand: STR,
+                signedIn: { type: 'boolean' },
+                waiting: { type: 'boolean' },
+                cardIsRight: { type: 'boolean' },
+                account: { type: 'object' },
+                accountUrl: STR,
+            },
+            required: ['view'],
+        },
+        [names.signOut]: {
+            type: 'object',
+            properties: {
+                view: { const: 'account-signed-out' },
+                brand: STR,
+                signedIn: { type: 'boolean' },
+                was: { type: 'boolean' },
+            },
+            required: ['view'],
+        },
+    });
+    const instructions = (noCards) => noCards
+        ? `${brand} ACCOUNT: a guest who wants to sign in to their ${brand} account, or create one, is given a one-time page by ${names.signIn}: pass on its link and its code exactly, and say they sign in or create the account on that page. Never ask for, or accept, a password, an email or a phone number in the chat; if the guest types one, never write it back - not even to say which one to change: call it \"the password you typed\" - and tell them to use the page and, as it went into a chat, to choose another. When they say they are done, ${names.view} shows who is signed in; ${names.signOut} signs them out. Being signed in changes no price here: say nothing of member rates.`
+        : `${brand} ACCOUNT: the card's Sign in opens ${brand}'s own page, where the guest signs in or creates an account; ${names.signIn} does the same when they ask in words. The card tells you when the guest signs in or out on it - take its word, and do not look again to check. Never ask for, or accept, a password, an email or a phone number in the chat; if the guest types one, never write it back - not even to say which one to change: call it \"the password you typed\" - and tell them to use the page and, as it went into a chat, to choose another. ${names.view} shows who is signed in; ${names.signOut} signs them out. Being signed in changes no price here: say nothing of member rates.`;
+    // ── The pages ────────────────────────────────────────────────────────────
+    const send = (c, status, html) => c.html(html, status, PAGE_HEADERS);
+    const langFor = (c, r, form) => langOf(c.req.query('lang')) ??
+        langOf(form?.lang) ??
+        r?.lang ??
+        acceptLang(c.req.header('accept-language'));
+    const linkHref = (code) => (l) => `${base}/login?code=${encodeURIComponent(code)}&lang=${l}`;
+    const plainHref = (path) => (l) => `${base}${path}?lang=${l}`;
+    const over = (c, which, key, max) => {
+        if (counters[which].count(key) >= max) {
+            refusals[which]++;
+            return true;
+        }
+        counters[which].add(key);
+        return false;
+    };
+    /**
+     * ⚠️ A POST COMES FROM OUR OWN PAGE (and with the form's token): its Origin is
+     * this site - the public origin, or the Host it was sent to (https; http only
+     * for a local address). A browser that sends `Origin: null` or none is asked
+     * for Sec-Fetch-Site instead, which a page cannot set.
+     */
+    const fromOurPage = (c) => {
+        const o = c.req.header('origin');
+        if (o && o !== 'null') {
+            const host = c.req.header('host') ?? '';
+            if (o === origin)
+                return true;
+            if (host && o === `https://${host}`)
+                return true;
+            return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/.test(host) && o === `http://${host}`;
+        }
+        return c.req.header('sec-fetch-site') === 'same-origin';
+    };
+    const cookieOf = (c) => {
+        for (const part of String(c.req.header('cookie') ?? '').split(';')) {
+            const at = part.indexOf('=');
+            if (at > 0 && part.slice(0, at).trim() === COOKIE)
+                return part.slice(at + 1).trim();
+        }
+        return null;
+    };
+    const setCookie = (c, id) => c.header('Set-Cookie', `${COOKIE}=${id}; Path=/; Max-Age=${WEB_IDLE_MS / 1000}; HttpOnly; Secure; SameSite=Strict`, { append: true });
+    const clearCookie = (c) => c.header('Set-Cookie', `${COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Strict`, {
+        append: true,
+    });
+    const statusOf = (state) => state === 'unknown'
+        ? 404
+        : state === 'tries' || state === 'limited'
+            ? 429
+            : state === 'pending'
+                ? 202
+                : state === 'checked'
+                    ? 403
+                    : 410;
+    const isSignedIn = (r) => !!r && !!store.get(r.key);
+    const formStr = (v, max) => typeof v === 'string' ? v.slice(0, max) : '';
+    const errorOf = (lang, code) => say(lang, code, brand);
+    /** The web session this request names, while its sign-in stands. */
+    const sessionOf = (c) => {
+        const id = cookieOf(c);
+        const ws = web.get(id);
+        if (!ws)
+            return { id };
+        const s = store.get(ws.key);
+        if (!s || s.sid !== ws.sid) {
+            web.drop(id);
+            return { id };
+        }
+        return { id, ws, s };
+    };
+    const mount = (app) => {
+        const form = bodyLimit({
+            maxSize: FORM_MAX_BYTES,
+            onError: (c) => send(c, 413, statePage(brandPage, langFor(c), 'checked', plainHref('/login'))),
+        });
+        const readForm = async (c) => {
+            if (!/^application\/x-www-form-urlencoded\b/i.test(c.req.header('content-type') ?? ''))
+                return null;
+            try {
+                const b = await c.req.parseBody();
+                return Object.keys(b).length > 20 ? null : b;
+            }
+            catch {
+                return null;
+            }
+        };
+        // A link being posted right now: "one moment", and a look again in two
+        // seconds; that look finding it used says it is done - nothing of whose.
+        const notOpen = (c, code, state, lang, wait) => {
+            const href = CODE.test(code) ? linkHref(code) : plainHref('/login');
+            if (state === 'pending')
+                return send(c, 202, statePage(brandPage, lang, 'pending', href, `${base}/login?code=${encodeURIComponent(code)}&lang=${lang}&wait=1`));
+            if (state === 'used' && wait)
+                return send(c, 200, statePage(brandPage, lang, 'finished', href));
+            return send(c, statusOf(state), statePage(brandPage, lang, state, href));
+        };
+        app.get('/login', (c) => {
+            const code = c.req.query('code') ?? '';
+            const r = requests.find(code);
+            const lang = langFor(c, r);
+            if (over(c, 'pages', ipOf(c), ACCOUNT_LIMITS.pagesPerIp))
+                return send(c, 429, statePage(brandPage, lang, 'limited', plainHref('/login')));
+            const state = requests.state(r, isSignedIn(r));
+            if (state !== 'open' || !r)
+                return notOpen(c, code, state === 'open' ? 'unknown' : state, lang, c.req.query('wait') === '1');
+            // Nothing is used up by looking: a link scanner's GET leaves it as it was.
+            return send(c, 200, loginPage(brandPage, { lang, short: r.short, code, csrf: loginCsrf(r), words: r.words }));
+        });
+        app.post('/login', form, async (c) => {
+            const body = await readForm(c);
+            const code = formStr(body?.code, 64);
+            const r = requests.find(code);
+            const lang = langFor(c, r, body ?? undefined);
+            if (over(c, 'posts', ipOf(c), ACCOUNT_LIMITS.postsPerIp))
+                return send(c, 429, statePage(brandPage, lang, 'limited', plainHref('/login')));
+            if (!body)
+                return send(c, 400, statePage(brandPage, lang, 'checked', plainHref('/login')));
+            if (!fromOurPage(c)) {
+                refusals.origin++;
+                return send(c, 403, statePage(brandPage, lang, 'checked', plainHref('/login')));
+            }
+            const state = requests.state(r, isSignedIn(r));
+            if (state !== 'open' || !r)
+                return notOpen(c, code, state === 'open' ? 'unknown' : state, lang, false);
+            if (!same(body.csrf, loginCsrf(r))) {
+                refusals.csrf++;
+                return send(c, 403, statePage(brandPage, lang, 'checked', linkHref(code)));
+            }
+            if (!requests.tried(r)) {
+                log(`[account] a sign-in link for ${tag(r.key)} refused after too many tries`);
+                return send(c, 429, statePage(brandPage, lang, 'tries', linkHref(code)));
+            }
+            const up = body.form === 'up';
+            const values = up
+                ? {
+                    userName: formStr(body.userName, LIMITS.userName).trim(),
+                    email: formStr(body.email, LIMITS.email).trim(),
+                    mobile: formStr(body.mobile, LIMITS.mobile).trim(),
+                    nickname: formStr(body.nickname, LIMITS.nickname).trim(),
+                }
+                : { account: formStr(body.account, LIMITS.account).trim() };
+            const password = formStr(body.password, LIMITS.password);
+            const again = (error, as = up ? 'up' : 'in', kept = values) => send(c, 200, loginPage(brandPage, {
+                lang,
+                short: r.short,
+                code,
+                csrf: loginCsrf(r),
+                words: r.words,
+                form: as,
+                values: kept,
+                error: errorOf(lang, error),
+            }));
+            // What the form itself can tell, without asking the mall.
+            const mobile = (values.mobile ?? '').replace(/[\s().-]/g, '');
+            if (up) {
+                if (!values.userName || !values.email || !password)
+                    return again('missing_up');
+                if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(values.email))
+                    return again('bad_email');
+                if (mobile && !/^\+\d{6,15}$/.test(mobile))
+                    return again('bad_mobile');
+                if (password.length < 6)
+                    return again('short_password');
+            }
+            else if (!values.account || !password)
+                return again('missing_in');
+            // ⚠️ BY THE NAME TOO (Nexva's member_sign_in): one user name's guesses,
+            // from however many links and addresses.
+            const who = `${up ? 'r' : 'a'}:${(up ? values.userName : values.account)?.toLowerCase()}`;
+            if (over(c, 'names', who, ACCOUNT_LIMITS.perName))
+                return again('too_many');
+            // ⚠️ AND FOR EVERYONE (Nexva's review P2-2) - taken only here, after the
+            // link, the Origin, the form's token and the link's tries have passed, so
+            // posts with no good link cannot spend it for everyone.
+            if (over(c, 'all', up ? 'up' : 'in', up ? ACCOUNT_LIMITS.registersPerMinute : ACCOUNT_LIMITS.signInsPerMinute))
+                return send(c, 429, statePage(brandPage, lang, 'limited', linkHref(code)));
+            // One POST at a time on a link: another meanwhile is told to wait.
+            if (!requests.begin(r))
+                return notOpen(c, code, 'pending', lang, false);
+            let tokens;
+            let member;
+            try {
+                if (up) {
+                    try {
+                        await mall.register({
+                            userName: values.userName ?? '',
+                            email: values.email ?? '',
+                            password,
+                            ...(mobile ? { mobile } : {}),
+                            ...(values.nickname ? { nickname: values.nickname } : {}),
+                        });
+                    }
+                    catch (e) {
+                        requests.reopen(r);
+                        log(`[account] an account for ${tag(r.key)} refused (${codeOf(e)})`);
+                        return again(notThere(e) ? 'busy' : 'register_failed');
+                    }
+                    try {
+                        ({ tokens, member } = await mall.login({ account: values.userName ?? '', password }));
+                    }
+                    catch (e) {
+                        requests.reopen(r);
+                        log(`[account] an account was made for ${tag(r.key)}; signing in refused (${codeOf(e)})`);
+                        return again('registered_not_signed_in', 'in', { account: values.userName ?? '' });
+                    }
+                }
+                else {
+                    ({ tokens, member } = await mall.login({ account: values.account ?? '', password }));
+                }
+            }
+            catch (e) {
+                requests.reopen(r);
+                log(`[account] a sign-in for ${tag(r.key)} refused (${codeOf(e)})`);
+                // ⚠️ OUR WORDS, NOT THE MALL'S (Nexva's review P3): theirs told a taken
+                // user name from a wrong password - a way to probe for accounts.
+                return again(notThere(e) ? 'busy' : 'sign_in_failed');
+            }
+            // The whole account, for its page: their sign-in's user_info is short of
+            // the email and phone. Theirs only if it is the same member.
+            const full = await mall.info(tokens).catch(() => null);
+            const m = full && (!member || full.id === member.id) ? full : member;
+            if (!m) {
+                requests.reopen(r);
+                mall.logout(tokens).catch(() => { });
+                log(`[account] a sign-in for ${tag(r.key)}: the mall named no member`);
+                return again('sign_in_failed');
+            }
+            const s = signInWith(r.key, m, tokens);
+            // Every place taken by a live sign-in: none is pushed out (review P3-3).
+            if (!s) {
+                requests.reopen(r);
+                refusals.full++;
+                mall.logout(tokens).catch(() => { });
+                log('[account] a sign-in refused: every place is taken by a live one');
+                return again('busy');
+            }
+            requests.done(r);
+            const id = web.open(r.key, s.sid);
+            if (id)
+                setCookie(c, id);
+            log(`[account] ${up ? 'an account was made and signed in' : 'signed in'} for ${tag(r.key)}`);
+            return send(c, 200, signedInPage(brandPage, {
+                lang,
+                name: s.shown.displayName || s.shown.userName || '',
+                account: !!id,
+            }));
+        });
+        app.get('/account', (c) => {
+            const lang = langFor(c);
+            if (over(c, 'pages', ipOf(c), ACCOUNT_LIMITS.pagesPerIp))
+                return send(c, 429, statePage(brandPage, lang, 'limited', plainHref('/account')));
+            const at = sessionOf(c);
+            if (!at.ws || !at.s) {
+                if (at.id)
+                    clearCookie(c);
+                return send(c, 401, statePage(brandPage, lang, 'nosession', plainHref('/account')));
+            }
+            if (at.id)
+                setCookie(c, at.id);
+            return send(c, 200, accountPage(brandPage, { lang, shown: at.s.shown, csrf: at.ws.csrf }));
+        });
+        app.post('/account', form, async (c) => {
+            const body = await readForm(c);
+            const lang = langFor(c, null, body ?? undefined);
+            if (over(c, 'posts', ipOf(c), ACCOUNT_LIMITS.postsPerIp))
+                return send(c, 429, statePage(brandPage, lang, 'limited', plainHref('/account')));
+            if (!body)
+                return send(c, 400, statePage(brandPage, lang, 'checked', plainHref('/account')));
+            if (!fromOurPage(c)) {
+                refusals.origin++;
+                return send(c, 403, statePage(brandPage, lang, 'checked', plainHref('/account')));
+            }
+            const at = sessionOf(c);
+            if (!at.ws || !at.s) {
+                if (at.id)
+                    clearCookie(c);
+                return send(c, 401, statePage(brandPage, lang, 'nosession', plainHref('/account')));
+            }
+            if (!same(body.csrf, at.ws.csrf)) {
+                refusals.csrf++;
+                return send(c, 403, statePage(brandPage, lang, 'checked', plainHref('/account')));
+            }
+            if (body.action !== 'signout')
+                return send(c, 400, statePage(brandPage, lang, 'checked', plainHref('/account')));
+            signOut(at.ws.key);
+            web.drop(at.id);
+            clearCookie(c);
+            log(`[account] ${tag(at.ws.key)} signed out on the account page`);
+            return send(c, 200, statePage(brandPage, lang, 'signedout', plainHref('/account')));
+        });
+    };
+    return {
+        names,
+        tools,
+        outputSchemas,
+        has: (name) => name === names.signIn || name === names.view || name === names.signOut || name === names.card,
+        handle,
+        meta: (key, cards) => {
+            const s = store.get(key);
+            return {
+                [ACCOUNT_META_KEY]: {
+                    from: opts.from,
+                    tools: names,
+                    signedIn: !!s,
+                    // ⚠️ THE USER NAME ON THE CARD ONLY (robin 11-06: 「登录完，我们卡片不显示
+                    // 用户名之类的吗」; 总线程 0.56.1): where a card is drawn its name is the
+                    // nickname, else the user name; where none is - and a client may hand
+                    // `_meta` to its model - the nickname or nothing, as every answer the
+                    // model reads (review P2-2).
+                    ...(s
+                        ? { name: cards ? s.shown.displayName || s.shown.userName || '' : s.shown.displayName }
+                        : {}),
+                },
+            };
+        },
+        instructions,
+        mount,
+        health: () => ({
+            accountsSignedIn: store.size,
+            accountLinksOpen: requests.open(),
+            accountPages: web.size,
+            ...Object.fromEntries(Object.entries(refusals).map(([k, v]) => [`accountRefused_${k}`, v])),
+        }),
+    };
+};
+//# sourceMappingURL=index.js.map