@hadoku/worker-utils 0.0.0-stage → 1.6.19

package/dist/authPage.js

@@ -0,0 +1,833 @@
+// authPage.ts
+function escapeAttr(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var SIGN_IN_CLIENT = `
+      // Device fingerprint \u2014 see the header comment. Hashed here so only
+      // digests are sent; every trait is optional and a missing one is simply
+      // left out, which the server scores as "unknown", not as "different".
+      async function digest(value) {
+        const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
+        return Array.from(new Uint8Array(d).slice(0, 8), function (b) {
+          return b.toString(16).padStart(2, '0');
+        }).join('');
+      }
+      function canvasTrait() {
+        try {
+          const cv = document.createElement('canvas');
+          cv.width = 240;
+          cv.height = 60;
+          const g = cv.getContext('2d');
+          if (!g) return '';
+          g.textBaseline = 'top';
+          g.font = '16px Arial';
+          g.fillStyle = 'rgb(255,102,0)';
+          g.fillRect(100, 1, 62, 20);
+          g.fillStyle = 'rgba(102,204,0,0.7)';
+          g.fillText('Hadoku 0123 \xE9\u4E2D', 2, 15);
+          return cv.toDataURL();
+        } catch (_) {
+          return '';
+        }
+      }
+      function webglTrait() {
+        try {
+          const gl = document.createElement('canvas').getContext('webgl');
+          if (!gl) return '';
+          const info = gl.getExtension('WEBGL_debug_renderer_info');
+          return info
+            ? gl.getParameter(info.UNMASKED_VENDOR_WEBGL) + '|' + gl.getParameter(info.UNMASKED_RENDERER_WEBGL)
+            : String(gl.getParameter(gl.RENDERER));
+        } catch (_) {
+          return '';
+        }
+      }
+      async function collectFingerprint() {
+        const n = navigator;
+        // Sorted so rotating a phone does not read as a different screen.
+        const dims = [screen.width, screen.height].sort(function (a, b) { return b - a; });
+        const traits = {
+          tz: Intl.DateTimeFormat().resolvedOptions().timeZone || '',
+          langs: (n.languages && n.languages.length ? n.languages : [n.language]).join(','),
+          screen: dims.concat([screen.colorDepth, window.devicePixelRatio]).join(':'),
+          hw: [n.hardwareConcurrency || 0, n.deviceMemory || 0].join('/'),
+          touch: String(n.maxTouchPoints || 0),
+          platform: n.platform || '',
+          canvas: canvasTrait(),
+          webgl: webglTrait(),
+        };
+        const out = {};
+        for (const k of Object.keys(traits)) {
+          if (traits[k]) out[k] = await digest(traits[k]);
+        }
+        return out;
+      }
+      function fingerprintWithin(ms) {
+        return Promise.race([
+          collectFingerprint().catch(function () { return null; }),
+          new Promise(function (resolve) { setTimeout(function () { resolve(null); }, ms); }),
+        ]);
+      }
+      // The model, for the ledger's display label. Real Chrome reduces its UA
+      // to "Android 10; K" and only sends the Sec-CH-UA-Model hint on a request
+      // the page asked for it on, which an app's fetch is not; so ask the
+      // browser directly too. Display only, never scored.
+      function modelHint() {
+        try {
+          const d = navigator.userAgentData;
+          if (!d || !d.getHighEntropyValues) return Promise.resolve('');
+          return Promise.race([
+            d.getHighEntropyValues(['model']).then(function (v) { return v.model || ''; }, function () { return ''; }),
+            new Promise(function (resolve) { setTimeout(function () { resolve(''); }, 300); }),
+          ]);
+        } catch (_) {
+          return Promise.resolve('');
+        }
+      }
+
+      // The graphics card's name, for a desktop's display label: a desktop has
+      // no model, and this is the nearest thing to one. Readable rather than
+      // hashed, and display only, never scored; the hashed WebGL trait above is
+      // what the ledger matches on.
+      function gpuHint() {
+        try {
+          const gl = document.createElement('canvas').getContext('webgl');
+          const info = gl && gl.getExtension('WEBGL_debug_renderer_info');
+          return info ? String(gl.getParameter(info.UNMASKED_RENDERER_WEBGL)).slice(0, 200) : '';
+        } catch (_) {
+          return '';
+        }
+      }
+
+      // Create the session: the server sets the cookie. Resolves to the
+      // server's answer; throws an Error carrying its message on a refusal.
+      // A passkey assertion signs in in place of a key (key is then '').
+      // A new member's account (signup) also signs in in place of a key.
+      async function createSession(key, ft, fp, passkey, signup) {
+        const model = await modelHint();
+        const gpu = gpuHint();
+        const headers = { 'Content-Type': 'application/json' };
+        if (key) headers['X-User-Key'] = key;
+        const res = await fetch('/session/create', {
+          method: 'POST',
+          headers: headers,
+          body: JSON.stringify(Object.assign({ ft: ft }, fp ? { fp: fp } : {}, model ? { model: model } : {}, gpu ? { gpu: gpu } : {}, passkey ? { passkey: passkey } : {}, signup ? { signup: signup } : {})),
+          credentials: 'same-origin'
+        });
+        const data = await res.json().catch(function () { return {}; });
+        if (!res.ok || !data.valid) {
+          const err = new Error(data.error || 'Invalid key');
+          if (data.forgetPasskey) err.forget = true;
+          throw err;
+        }
+        // sessionId + tier speed up mf-loader's boot-time identity resolution;
+        // the cookie is what authenticates. The raw key is never stored.
+        if (data.sessionId) {
+          localStorage.setItem('hadoku_session_id', data.sessionId);
+          if (data.userType) localStorage.setItem('hadoku_user_type', data.userType);
+        }
+        return data;
+      }
+
+      // Passkeys (edge-router passkeys.ts): saved from a signed-in browser,
+      // used in place of a key. WebAuthn speaks bytes and the
+      // server speaks base64url; no backslashes, so split/join, not regexes.
+      function b64url(buf) {
+        const b = new Uint8Array(buf);
+        let s = '';
+        for (let i = 0; i < b.length; i++) s += String.fromCharCode(b[i]);
+        return btoa(s).split('+').join('-').split('/').join('_').split('=').join('');
+      }
+      function unb64url(s) {
+        const t = s.split('-').join('+').split('_').join('/');
+        const bin = atob(t + '==='.slice(0, (4 - (t.length % 4)) % 4));
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+        return out;
+      }
+      async function postJson(url, body) {
+        const res = await fetch(url, {
+          method: 'POST',
+          credentials: 'same-origin',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(body || {})
+        });
+        const data = await res.json().catch(function () { return {}; });
+        if (!res.ok) throw new Error(data.error || 'Request failed');
+        return data;
+      }
+      // A dismissed or timed-out browser prompt is NotAllowedError, whose
+      // message is browser boilerplate.
+      function passkeyMessage(err, cancelled) {
+        if (err && (err.name === 'NotAllowedError' || err.name === 'AbortError')) return cancelled;
+        if (err && err.name === 'InvalidStateError') return 'This device already has your passkey';
+        return (err && err.message) || cancelled;
+      }
+
+      // How long a passkey prompt may stay open. A password manager that takes
+      // the prompt over (Bitwarden, Vaultwarden) can leave the browser's
+      // promise unsettled when it is dismissed, so the page bounds the wait
+      // itself rather than trusting the prompt to answer.
+      const PASSKEY_WAIT_MS = 90000;
+
+      function cancelledError() {
+        const e = new Error('cancelled');
+        e.name = 'NotAllowedError';
+        return e;
+      }
+
+      // One browser prompt. Settles when the browser answers, when the caller
+      // aborts (a Cancel button) or at PASSKEY_WAIT_MS, whichever comes
+      // first, and a late answer from an abandoned prompt is ignored.
+      function passkeyPrompt(run, signal) {
+        const ctl = new AbortController();
+        return new Promise(function (resolve, reject) {
+          let done = false;
+          let timer = 0;
+          function finish(settle, value) {
+            if (done) return;
+            done = true;
+            clearTimeout(timer);
+            if (signal) signal.removeEventListener('abort', stop);
+            ctl.abort();
+            settle(value);
+          }
+          function stop() { finish(reject, cancelledError()); }
+          if (signal && signal.aborted) return stop();
+          timer = setTimeout(stop, PASSKEY_WAIT_MS);
+          if (signal) signal.addEventListener('abort', stop);
+          run(ctl.signal).then(function (cred) {
+            if (cred) finish(resolve, cred);
+            else stop();
+          }, function (err) { finish(reject, err); });
+        });
+      }
+
+      // A passkey the server will never accept (unknown to it, or retired by
+      // ROTATE): ask the authenticator to forget it, so the browser stops
+      // offering it. Best effort; most browsers do not have this yet.
+      function forgetPasskey(rpId, id) {
+        try {
+          if (window.PublicKeyCredential && PublicKeyCredential.signalUnknownCredential) {
+            PublicKeyCredential.signalUnknownCredential({ rpId: rpId, credentialId: id })
+              .catch(function () { /* nothing more to do */ });
+          }
+        } catch (_) { /* nothing more to do */ }
+      }
+
+      // Sign in with a passkey: the assertion goes to /session/create in place
+      // of a key. Throws like createSession; a dead passkey is forgotten first.
+      async function passkeySession(ft, fp, signal) {
+        const opt = await postJson('/auth/passkey/challenge');
+        const cred = await passkeyPrompt(function (s) {
+          return navigator.credentials.get({ signal: s, publicKey: {
+            challenge: new TextEncoder().encode(opt.challenge),
+            rpId: opt.rpId,
+            userVerification: 'preferred',
+            timeout: PASSKEY_WAIT_MS
+          } });
+        }, signal);
+        const r = cred.response;
+        const id = b64url(cred.rawId);
+        try {
+          return await createSession('', ft, fp, {
+            id: id,
+            clientDataJSON: b64url(r.clientDataJSON),
+            authenticatorData: b64url(r.authenticatorData),
+            signature: b64url(r.signature),
+            userHandle: r.userHandle ? b64url(r.userHandle) : null
+          });
+        } catch (err) {
+          if (err && err.forget) forgetPasskey(opt.rpId, id);
+          throw err;
+        }
+      }
+
+      async function savePasskey(signal) {
+        const opt = await postJson('/auth/passkey/register/options');
+        const cred = await passkeyPrompt(function (s) {
+          return navigator.credentials.create({ signal: s, publicKey: {
+            challenge: new TextEncoder().encode(opt.challenge),
+            rp: { id: opt.rpId, name: 'hadoku.me' },
+            user: { id: unb64url(opt.userHandle), name: opt.userName, displayName: opt.userName },
+            pubKeyCredParams: opt.algs.map(function (alg) { return { type: 'public-key', alg: alg }; }),
+            excludeCredentials: opt.exclude.map(function (id) { return { type: 'public-key', id: unb64url(id) }; }),
+            authenticatorSelection: { residentKey: 'required', requireResidentKey: true, userVerification: 'preferred' },
+            attestation: 'none',
+            timeout: PASSKEY_WAIT_MS
+          } });
+        }, signal);
+        const r = cred.response;
+        const publicKey = r.getPublicKey ? r.getPublicKey() : null;
+        if (!publicKey || !r.getAuthenticatorData) throw new Error('This browser cannot save a passkey');
+        return postJson('/auth/passkey/register', {
+          id: b64url(cred.rawId),
+          clientDataJSON: b64url(r.clientDataJSON),
+          authenticatorData: b64url(r.getAuthenticatorData()),
+          publicKey: b64url(publicKey),
+          alg: r.getPublicKeyAlgorithm()
+        });
+      }
+      // Sign up: the name is checked and a challenge minted for a new account,
+      // the browser makes its first passkey, and /session/create makes the
+      // account and signs it in. One prompt, no key, no password.
+      async function signUpSession(name, ft, fp, signal) {
+        const opt = await postJson('/auth/signup/options', { name: name });
+        const cred = await passkeyPrompt(function (s) {
+          return navigator.credentials.create({ signal: s, publicKey: {
+            challenge: new TextEncoder().encode(opt.challenge),
+            rp: { id: opt.rpId, name: 'hadoku.me' },
+            user: { id: unb64url(opt.userHandle), name: opt.name, displayName: opt.name },
+            pubKeyCredParams: opt.algs.map(function (alg) { return { type: 'public-key', alg: alg }; }),
+            authenticatorSelection: { residentKey: 'required', requireResidentKey: true, userVerification: 'preferred' },
+            attestation: 'none',
+            timeout: PASSKEY_WAIT_MS
+          } });
+        }, signal);
+        const r = cred.response;
+        const publicKey = r.getPublicKey ? r.getPublicKey() : null;
+        if (!publicKey || !r.getAuthenticatorData) throw new Error('This browser cannot save a passkey');
+        return createSession('', ft, fp, null, {
+          userId: opt.userId,
+          name: opt.name,
+          credential: {
+            id: b64url(cred.rawId),
+            clientDataJSON: b64url(r.clientDataJSON),
+            authenticatorData: b64url(r.getAuthenticatorData()),
+            publicKey: b64url(publicKey),
+            alg: r.getPublicKeyAlgorithm()
+          }
+        });
+      }
+      function passkeysSupported() {
+        return !!(window.PublicKeyCredential && navigator.credentials);
+      }
+`;
+function renderSignInModule() {
+  return `${SIGN_IN_CLIENT}
+const fpPromise = fingerprintWithin(1500);
+
+function funnelToken() {
+  return fetch('/auth/funnel-token', { credentials: 'same-origin', cache: 'no-store' })
+    .then(function (r) { return r.ok ? r.json() : {}; })
+    .then(function (t) { return t.ft || ''; }, function () { return ''; });
+}
+
+export async function signIn(key) {
+  const k = String(key || '').trim();
+  if (!k) throw new Error('Please enter a key');
+  return createSession(k, await funnelToken(), await fpPromise);
+}
+
+export { passkeysSupported };
+
+export async function signInWithPasskey(opts) {
+  const signal = opts && opts.signal;
+  try {
+    return await passkeySession(await funnelToken(), await fpPromise, signal);
+  } catch (err) {
+    throw new Error(passkeyMessage(err, 'Passkey sign-in cancelled'));
+  }
+}
+
+export async function addPasskey(opts) {
+  try {
+    return await savePasskey(opts && opts.signal);
+  } catch (err) {
+    throw new Error(passkeyMessage(err, 'Passkey not saved'));
+  }
+}
+
+export async function signUp(name, opts) {
+  try {
+    return await signUpSession(String(name || '').trim(), await funnelToken(), await fpPromise, opts && opts.signal);
+  } catch (err) {
+    throw new Error(passkeyMessage(err, 'Account not created'));
+  }
+}
+`;
+}
+function renderAuthPage(options = {}) {
+  const {
+    title = "Authentication Required",
+    description = "Enter your admin key to access this page.",
+    targetPath = "",
+    errorMessage = "",
+    ogTitle = title,
+    ogDescription = description,
+    ogImage = "",
+    ogImageWidth,
+    ogImageHeight,
+    ogUrl = "",
+    funnelToken = "",
+    signup = false
+  } = options;
+  const targetPathAttr = escapeAttr(targetPath);
+  const errorAttr = escapeAttr(errorMessage);
+  const errorClass = errorMessage ? "error visible" : "error";
+  const ogTitleAttr = escapeAttr(ogTitle);
+  const ogDescriptionAttr = escapeAttr(ogDescription);
+  const imageMeta = ogImage ? `  <meta property="og:image" content="${escapeAttr(ogImage)}">
+  <meta name="twitter:image" content="${escapeAttr(ogImage)}">
+` + (ogImageWidth && ogImageHeight ? `  <meta property="og:image:width" content="${ogImageWidth}">
+  <meta property="og:image:height" content="${ogImageHeight}">
+` : "") : "";
+  const urlMeta = ogUrl ? `  <meta property="og:url" content="${escapeAttr(ogUrl)}">
+` : "";
+  const twitterCard = ogImage ? "summary_large_image" : "summary";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${title}</title>
+  <meta name="description" content="${description}">
+  <meta property="og:type" content="website">
+  <meta property="og:site_name" content="hadoku.me">
+  <meta property="og:title" content="${ogTitleAttr}">
+  <meta property="og:description" content="${ogDescriptionAttr}">
+${urlMeta}${imageMeta}  <meta name="twitter:card" content="${twitterCard}">
+  <meta name="twitter:title" content="${ogTitleAttr}">
+  <meta name="twitter:description" content="${ogDescriptionAttr}">
+  <meta name="theme-color" content="#2563eb">
+  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
+  <script src="/theme-bootstrap.js"></script>
+  <link rel="stylesheet" href="/themes.css">
+  <style>
+    :root {
+      --bg-primary: var(--color-bg, #0a0a0a);
+      --bg-secondary: var(--color-bg-card, #1a1a1a);
+      --text-primary: var(--color-text, #f0f0f0);
+      --text-secondary: var(--color-text-secondary, #888);
+      --border-color: var(--color-border, #333);
+      --accent: var(--color-primary, #2563eb);
+      --accent-hover: var(--color-primary-hover, #1d4ed8);
+      --on-accent: var(--color-on-primary, #fff);
+      --error: var(--color-danger, #ef4444);
+    }
+
+    * {
+      box-sizing: border-box;
+      margin: 0;
+      padding: 0;
+    }
+
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+      background: var(--bg-primary);
+      color: var(--text-primary);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+
+    .auth-container {
+      background: var(--bg-secondary);
+      border: 1px solid var(--border-color);
+      border-radius: 0.75rem;
+      padding: 2rem;
+      width: 100%;
+      max-width: 400px;
+      margin: 1rem;
+    }
+
+    h1 {
+      font-size: 1.5rem;
+      margin-bottom: 0.5rem;
+    }
+
+    .description {
+      color: var(--text-secondary);
+      font-size: 0.875rem;
+      margin-bottom: 1.5rem;
+    }
+
+    .error {
+      color: var(--error);
+      font-size: 0.875rem;
+      margin-bottom: 1rem;
+      display: none;
+    }
+
+    .error.visible {
+      display: block;
+    }
+
+    input {
+      width: 100%;
+      background: var(--bg-primary);
+      border: 1px solid var(--border-color);
+      border-radius: 0.5rem;
+      padding: 0.75rem 1rem;
+      color: var(--text-primary);
+      font-size: 1rem;
+      margin-bottom: 1rem;
+    }
+
+    input:focus {
+      outline: none;
+      border-color: var(--accent);
+    }
+
+    button {
+      width: 100%;
+      background: var(--accent);
+      border: none;
+      border-radius: 0.5rem;
+      padding: 0.75rem 1rem;
+      color: var(--on-accent);
+      font-size: 1rem;
+      font-weight: 500;
+      cursor: pointer;
+      transition: background 0.2s;
+    }
+
+    button:hover {
+      background: var(--accent-hover);
+    }
+
+    button:disabled {
+      opacity: 0.6;
+      cursor: not-allowed;
+    }
+
+    button.secondary {
+      margin-top: 0.75rem;
+      background: transparent;
+      border: 1px solid var(--border-color);
+      color: var(--text-primary);
+    }
+
+    button.secondary:hover {
+      background: var(--bg-primary);
+    }
+
+    #passkey-offer h2,
+    #signup h2 {
+      font-size: 1.125rem;
+      margin: 0 0 0.5rem;
+    }
+
+    #signup {
+      margin-top: 1.5rem;
+      padding-top: 1.25rem;
+      border-top: 1px solid var(--border-color);
+    }
+
+    .visually-hidden {
+      position: absolute;
+      width: 1px;
+      height: 1px;
+      overflow: hidden;
+      clip: rect(0 0 0 0);
+      white-space: nowrap;
+    }
+
+    .home-link {
+      display: block;
+      text-align: center;
+      margin-top: 1rem;
+      color: var(--text-secondary);
+      font-size: 0.875rem;
+      text-decoration: none;
+    }
+
+    .home-link:hover {
+      color: var(--text-primary);
+    }
+  </style>
+</head>
+<body>
+  <main class="auth-container">
+    <h1>${title}</h1>
+    <p class="description">${description}</p>
+    <p id="error" class="${errorClass}">${errorAttr}</p>
+    <form id="auth-form" action="/session/create" method="POST">
+      <input type="hidden" name="return" value="${targetPathAttr}" />
+      <input type="hidden" name="fp" id="auth-fp" value="" />
+      <input type="hidden" name="ft" id="auth-ft" value="${escapeAttr(funnelToken)}" />
+      <input type="text" name="username" value="hadoku" autocomplete="username" hidden />
+      <label for="auth-key" class="visually-hidden">Access key</label>
+      <input
+        type="password"
+        id="auth-key"
+        name="key"
+        placeholder="Enter access key"
+        autocomplete="current-password"
+        autocapitalize="none"
+        spellcheck="false"
+        autofocus
+      />
+      <button type="submit" id="submit-btn">Sign in</button>
+    </form>
+    <button type="button" id="passkey-btn" class="secondary" hidden>Sign in with a passkey</button>
+    <section id="passkey-offer" hidden>
+      <h2>Save a passkey?</h2>
+      <p class="description">Sign in next time without a code.</p>
+      <button type="button" id="passkey-save">Save passkey</button>
+      <button type="button" id="passkey-skip" class="secondary">Not now</button>
+    </section>
+    <section id="signup" hidden>
+      <h2>New here?</h2>
+      <label for="signup-name" class="visually-hidden">Display name</label>
+      <input type="text" id="signup-name" placeholder="Pick a name" maxlength="24" autocomplete="nickname" autocapitalize="none" spellcheck="false" />
+      <button type="button" id="signup-btn">Create account</button>
+    </section>
+    <button type="button" id="passkey-cancel" class="secondary" hidden>Cancel</button>
+    <a href="/" class="home-link">Continue without signing in &rarr;</a>
+  </main>
+
+  <script>
+    (function() {
+      const form = document.getElementById('auth-form');
+      const keyInput = document.getElementById('auth-key');
+      const errorEl = document.getElementById('error');
+      const submitBtn = document.getElementById('submit-btn');
+      const passkeyBtn = document.getElementById('passkey-btn');
+      const passkeyOffer = document.getElementById('passkey-offer');
+      const passkeySave = document.getElementById('passkey-save');
+      const passkeySkip = document.getElementById('passkey-skip');
+      const passkeyCancel = document.getElementById('passkey-cancel');
+      const signupSection = document.getElementById('signup');
+      const signupName = document.getElementById('signup-name');
+      const signupBtn = document.getElementById('signup-btn');
+      const targetPath = '${targetPath}' || window.location.pathname;
+      // ?passkey=add: a signed-in visitor saving a passkey on this browser,
+      // so the self-heal below must not send them straight on.
+      const addingPasskey = new URLSearchParams(window.location.search).get('passkey') === 'add';
+
+      // A URL that DIFFERS from this one, for the places that must make the browser
+      // issue a real request when the natural destination is the page it is on (an
+      // identical URL with a fragment is a same-document hop: no request at all).
+      //
+      // A single-segment mount root WITHOUT its trailing slash 404s the moment it
+      // carries a query string (/cardtable?sh=1, /merchant?sh=1 \u2014 measured
+      // 2026-10-02; the other apps 301 to the slash form), while the slash form
+      // takes a query and is every app's canonical mount. So for those, the slash
+      // twin is the distinct URL and no marker is needed; anywhere else, append
+      // the marker param every consumer ignores.
+      function distinctUrl() {
+        const p = window.location.pathname;
+        const s = window.location.search;
+        const h = window.location.hash;
+        if (p.charAt(p.length - 1) !== '/' && p.split('/').length === 2) return p + '/' + s + h;
+        return p + s + (s ? '&' : '?') + 'sh=1' + h;
+      }
+
+      // A cross-site navigation (a bookmarklet, a link on another site)
+      // withholds our SameSite=Strict session cookie, so a signed-in visitor
+      // still lands here looking anonymous. A same-site fetch DOES carry the
+      // cookie, so ask who they are: a signed-in answer means one reload \u2014
+      // now initiated from this same-site document \u2014 will pass the gate with
+      // the URL, fragment included, untouched.
+      //
+      // Only when the server rendered no error: a non-empty error means the
+      // cookie WAS presented and the tier fell short, where reloading would
+      // just loop back here. The timestamp guard bounds even a pathological
+      // case to one reload per 10 seconds.
+      //
+      // Never with ?switch=1: that is a signed-in visitor asking to sign in
+      // with a DIFFERENT key (an app's "switch key" control links here), and
+      // sending them on would make switching impossible.
+      const hadServerError = ${errorMessage ? "true" : "false"};
+      const switching = new URLSearchParams(window.location.search).has('switch');
+      const lastRetry = Number(sessionStorage.getItem('hadoku_auth_retry') || 0);
+      if (addingPasskey) {
+        fetch('/session/whoami', { credentials: 'same-origin' })
+          .then(function (r) { return r.json(); })
+          .then(function (d) { if (d && d.valid) offerPasskey(); })
+          .catch(function () { /* stay on the sign-in form */ });
+      } else if (!hadServerError && !switching && Date.now() - lastRetry > 10000) {
+        fetch('/session/whoami', { credentials: 'same-origin' })
+          .then(function (r) { return r.json(); })
+          .then(function (d) {
+            if (d && d.valid) {
+              sessionStorage.setItem('hadoku_auth_retry', String(Date.now()));
+              // NOT location.reload(): a reload re-issues the navigation with
+              // its ORIGINAL initiator, so a tab opened from another site
+              // stays cross-site forever and the Strict cookie stays withheld
+              // \u2014 F5 on this page demonstrates it. A replace() to a distinct
+              // URL is a fresh navigation initiated by THIS same-site
+              // document, so the cookie flows. The marker param makes the URL
+              // differ (an identical URL with a fragment would be a
+              // same-document hop and no request at all); every consumer
+              // ignores unknown query params.
+              // On /auth itself there is no gate to re-pass, and its slash twin
+              // is a static-site 404: go where the sign-in was headed.
+              const here = window.location.pathname;
+              const onAuth = here === '/auth' || here === '/auth/';
+              window.location.replace(onAuth ? targetPath + window.location.hash : distinctUrl());
+            }
+          })
+          .catch(function () { /* stay on the sign-in form */ });
+      }
+
+${SIGN_IN_CLIENT}
+      // The native-form fallback carries it too, when the script got this far.
+      const fpPromise = fingerprintWithin(1500);
+      fpPromise.then(function (fp) {
+        if (fp) document.getElementById('auth-fp').value = JSON.stringify(fp);
+      });
+
+      function showError(msg) {
+        errorEl.textContent = msg;
+        errorEl.classList.add('visible');
+      }
+
+      // Leave for the destination, once signed in.
+      //
+      // Carry the fragment: it never reaches the server, so targetPath cannot
+      // contain it, and dropping it breaks fragment-carried state like the
+      // merchant console's #import payload.
+      //
+      // But when the destination IS the URL we are already on and it has a
+      // fragment (a hash-routed app: /cardtable#/), replace() is a
+      // same-document hop: NO request, no reload, and the button sits on
+      // "Signing in..." forever with the cookie already set. Seen live on
+      // 2026-10-02 (the telemetry row shows the server answered in 1.1s);
+      // reproduced in a browser. Same cure as the cross-site self-heal above:
+      // make the URL differ with a marker param every consumer ignores.
+      function leave() {
+        const here = window.location.pathname + window.location.search + window.location.hash;
+        let dest = targetPath + window.location.hash;
+        if (dest === here && window.location.hash) dest = distinctUrl();
+        window.location.replace(dest);
+
+        // Tripwire, not a fix: if we are STILL here a moment after asking to
+        // leave, the redirect did not take. Say so to the edge (a request
+        // logged as POST /auth/stall in the telemetry table) so the next
+        // variant of this is visible instead of reported as "it's just slow".
+        setTimeout(function () {
+          try { navigator.sendBeacon('/auth/stall'); } catch (_) { /* best effort */ }
+        }, 3000);
+      }
+
+      // Signed in already: offer to save a passkey instead of leaving.
+      function offerPasskey() {
+        if (!passkeysSupported()) {
+          if (addingPasskey) showError('This browser cannot save a passkey');
+          else leave();
+          return;
+        }
+        form.hidden = true;
+        passkeyBtn.hidden = true;
+        passkeyOffer.hidden = false;
+      }
+
+      // One passkey prompt at a time, cancellable: a prompt that never answers
+      // (a password manager dismissed without saying so) must not strand the
+      // button. Cancel shows only while one is open.
+      let pending = null;
+      async function withPasskeyPrompt(btn, run, cancelled, done) {
+        btn.disabled = true;
+        errorEl.classList.remove('visible');
+        pending = new AbortController();
+        passkeyCancel.hidden = false;
+        try {
+          await run(pending.signal);
+          done();
+        } catch (err) {
+          showError(passkeyMessage(err, cancelled));
+          btn.disabled = false;
+        }
+        pending = null;
+        passkeyCancel.hidden = true;
+      }
+      passkeyCancel.addEventListener('click', function () {
+        if (pending) pending.abort();
+      });
+
+      passkeySave.addEventListener('click', function () {
+        return withPasskeyPrompt(passkeySave, savePasskey, 'Passkey not saved', leave);
+      });
+      passkeySkip.addEventListener('click', function () {
+        if (pending) pending.abort();
+        leave();
+      });
+
+      if (passkeysSupported() && !addingPasskey) passkeyBtn.hidden = false;
+      if (${signup ? "true" : "false"} && passkeysSupported() && !addingPasskey) signupSection.hidden = false;
+      signupBtn.addEventListener('click', function () {
+        return withPasskeyPrompt(signupBtn, function (signal) {
+          return fpPromise.then(function (fp) {
+            return signUpSession(signupName.value.trim(), document.getElementById('auth-ft').value, fp, signal);
+          });
+        }, 'Account not created', leave);
+      });
+      passkeyBtn.addEventListener('click', function () {
+        return withPasskeyPrompt(passkeyBtn, function (signal) {
+          return fpPromise.then(function (fp) {
+            return passkeySession(document.getElementById('auth-ft').value, fp, signal);
+          });
+        }, 'Passkey sign-in cancelled', leave);
+      });
+
+      // Check for key in URL - auto-fill and auto-validate if present
+      const urlParams = new URLSearchParams(window.location.search);
+      const keyFromUrl = urlParams.get('key');
+      if (keyFromUrl) {
+        // Clean URL immediately for security (remove key from browser history)
+        urlParams.delete('key');
+        const cleanUrl = window.location.pathname +
+          (urlParams.toString() ? '?' + urlParams.toString() : '');
+        window.history.replaceState({}, '', cleanUrl);
+
+        // Auto-fill the input and trigger validation
+        keyInput.value = keyFromUrl;
+        submitBtn.disabled = true;
+        submitBtn.textContent = 'Validating...';
+
+        // Auto-submit after brief delay for UX
+        setTimeout(function() {
+          form.dispatchEvent(new Event('submit'));
+        }, 100);
+      }
+
+      form.addEventListener('submit', async function(e) {
+        e.preventDefault();
+        const key = keyInput.value.trim();
+
+        if (!key) {
+          showError('Please enter a key');
+          return;
+        }
+
+        submitBtn.disabled = true;
+        submitBtn.textContent = 'Signing in...';
+        errorEl.classList.remove('visible');
+
+        try {
+          // Display names are assigned out-of-band via registry-set-name
+          // when a key is handed out, not self-served at login.
+          const data = await createSession(key, document.getElementById('auth-ft').value, await fpPromise);
+
+          // A one-time code vouched for this device (the server says so), or
+          // the visitor came to save one: offer a passkey before leaving.
+          if (data.offerPasskey || addingPasskey) offerPasskey();
+          else leave();
+        } catch (err) {
+          showError(err.message || 'Authentication failed');
+          submitBtn.disabled = false;
+          submitBtn.textContent = 'Sign in';
+        }
+      });
+    })();
+  </script>
+</body>
+</html>`;
+}
+function authPageResponse(options = {}) {
+  return new Response(renderAuthPage(options), {
+    status: 200,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store"
+    }
+  });
+}
+export {
+  authPageResponse,
+  renderAuthPage,
+  renderSignInModule
+};