@walkhi/code-relax 0.1.0-beta.11 → 0.1.0-beta.13

package/dist/src/platform/windows/resident-startup.ps1

@@ -5,7 +5,9 @@ $ErrorActionPreference = 'Stop'
 $taskName = 'Code Relax Bridge'
 $taskSource = '@walkhi/code-relax'
 $taskPath = '\' + $taskName
-$arguments = '"' + $Entry + '" start --json'
+$launcher = Join-Path $PSScriptRoot 'resident-start.js'
+$wscript = Join-Path $env:WINDIR 'System32\wscript.exe'
+$arguments = '//B //Nologo "' + $launcher + '" "' + $NodePath + '" "' + $Entry + '"'
 $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
 
 $scheduler = New-Object -ComObject 'Schedule.Service'
@@ -30,7 +32,8 @@ if ($Action -ne 'status' -and $legacyExists) {
 }
 
 if ($Action -eq 'enable') {
-    if (-not (Test-Path -LiteralPath $NodePath) -or -not (Test-Path -LiteralPath $Entry)) { throw 'Installed runtime is missing.' }
+    if (-not (Test-Path -LiteralPath $NodePath) -or -not (Test-Path -LiteralPath $Entry) -or
+        -not (Test-Path -LiteralPath $launcher) -or -not (Test-Path -LiteralPath $wscript)) { throw 'Installed runtime is missing.' }
     $definition = $scheduler.NewTask(0)
     $definition.RegistrationInfo.Description = 'Start the Code Relax Bridge when this user signs in.'
     $definition.RegistrationInfo.Source = $taskSource
@@ -48,7 +51,7 @@ if ($Action -eq 'enable') {
     $trigger.UserId = $currentUser
     $trigger.Enabled = $true
     $exec = $definition.Actions.Create(0) # TASK_ACTION_EXEC
-    $exec.Path = $NodePath
+    $exec.Path = $wscript
     $exec.Arguments = $arguments
     $exec.WorkingDirectory = $env:USERPROFILE
     [void]$root.RegisterTaskDefinition($taskName, $definition, 6, $null, $null, 3, $null) # TASK_CREATE_OR_UPDATE

package/dist/src/self-relay/admin-state.mjs

@@ -2,19 +2,20 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 
-export function relayAdminState(file, initialMaxRelaySessions) {
-  let value = { version: 3, maxRelaySessions: initialMaxRelaySessions, announcement: null, announcements: [] };
+export function relayAdminState(file, initialMaxRelaySessions, { initial, persist } = {}) {
+  let value = initial ? validate(initial) : { version: 3, maxRelaySessions: initialMaxRelaySessions, announcement: null, announcements: [] };
   if (file && fs.existsSync(file)) value = validate(JSON.parse(fs.readFileSync(file, 'utf8')));
 
-  function save(next) {
-    value = validate(next);
-    if (!file) return value;
+  async function save(next) {
+    const validated = validate(next);
+    if (persist) await persist(validated);
+    if (!file) { value = validated; return value; }
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     const temporary = `${file}.${randomUUID()}.tmp`;
     let descriptor;
     try {
       descriptor = fs.openSync(temporary, 'wx', 0o600);
-      fs.writeFileSync(descriptor, JSON.stringify(value));
+      fs.writeFileSync(descriptor, JSON.stringify(validated));
       fs.fsyncSync(descriptor); fs.closeSync(descriptor); descriptor = undefined;
       fs.renameSync(temporary, file);
       if (process.platform !== 'win32') {
@@ -25,6 +26,7 @@ export function relayAdminState(file, initialMaxRelaySessions) {
       if (descriptor !== undefined) fs.closeSync(descriptor);
       fs.rmSync(temporary, { force: true });
     }
+    value = validated;
     return value;
   }
 

package/dist/src/self-relay/email-accounts.mjs

@@ -0,0 +1,125 @@
+import fs from 'node:fs';
+import { createHash, createHmac, randomBytes, randomInt, randomUUID, timingSafeEqual } from 'node:crypto';
+import { tencentAccountProvider } from '../../relay-admin/tencent-account-provider.mjs';
+
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const isoTime = value => value.replace(' ', 'T') + 'Z';
+const error = (status, message) => Object.assign(new Error(message), { status });
+const tokenHash = token => createHash('sha256').update(token).digest('hex');
+const normalizeEmail = value => {
+  if (typeof value !== 'string') throw error(400, 'Invalid email address');
+  const email = value.trim().toLowerCase();
+  if (email.length > 254 || !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(email)) {
+    throw error(400, 'Invalid email address');
+  }
+  return email;
+};
+
+export function openEmailAccounts(pool, configFile, providerOverride) {
+  const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  if (![config.secretId, config.secretKey, config.captchaAppSecretKey, config.fromEmailAddress, config.sesRegion]
+    .every(value => typeof value === 'string' && value.length > 0) ||
+    !Number.isSafeInteger(config.captchaAppId) || config.captchaAppId < 1 ||
+    !Number.isSafeInteger(config.emailTemplateId) || config.emailTemplateId < 1 ||
+    typeof config.codePepper !== 'string' || config.codePepper.length < 32) {
+    throw new Error('Incomplete relay account configuration');
+  }
+  const provider = providerOverride || tencentAccountProvider(config);
+  const codeHash = (email, code) => createHmac('sha256', config.codePepper).update(`${email}\0${code}`).digest('hex');
+  const scopeHash = value => createHmac('sha256', config.codePepper).update(value).digest('hex');
+
+  async function requestCode({ email: rawEmail, ticket, randstr }, ip) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof ticket !== 'string' || !ticket || ticket.length > 2048 ||
+        typeof randstr !== 'string' || !randstr || randstr.length > 128) throw error(400, 'Invalid human verification');
+    if (!ip || ip.length > 64) throw error(400, 'Invalid client address');
+    // A cheap pre-check precedes the billable human verification.
+    const [recent] = await pool.execute('SELECT sent_at FROM email_login_challenges WHERE email = ? AND sent_at > UTC_TIMESTAMP(3) - INTERVAL 60 SECOND', [email]);
+    if (recent.length) throw error(429, 'Please wait before requesting another code');
+    const [ipLimit] = await pool.execute(`SELECT request_count FROM email_send_limits
+      WHERE scope_hash=? AND window_start>=UTC_TIMESTAMP() - INTERVAL 1 HOUR ORDER BY window_start DESC LIMIT 1`, [scopeHash(`ip:${ip}`)]);
+    if (ipLimit[0]?.request_count >= 20) throw error(429, 'Too many email requests');
+    if (!await provider.verifyHuman(ticket, randstr, ip)) throw error(403, 'Human verification failed');
+    const code = String(randomInt(0, 1000000)).padStart(6, '0');
+    const hash = codeHash(email, code);
+    const windowStart = sqlTime(new Date(Math.floor(Date.now() / 3600000) * 3600000).toISOString()).slice(0, 19);
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      for (const [scope, limit] of [[`email:${email}`, 5], [`ip:${ip}`, 20]]) {
+        const key = scopeHash(scope);
+        await db.execute('INSERT INTO email_send_limits (scope_hash,window_start,request_count) VALUES (?,?,1) ON DUPLICATE KEY UPDATE request_count=request_count+1', [key, windowStart]);
+        const [rows] = await db.execute('SELECT request_count FROM email_send_limits WHERE scope_hash=? AND window_start=? FOR UPDATE', [key, windowStart]);
+        if (rows[0].request_count > limit) throw error(429, 'Too many email requests');
+      }
+      const [existing] = await db.execute('SELECT sent_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      if (existing.length && Date.now() - new Date(`${existing[0].sent_at.replace(' ', 'T')}Z`).getTime() < 60000) {
+        throw error(429, 'Please wait before requesting another code');
+      }
+      await db.execute(`INSERT INTO email_login_challenges (email,code_hash,expires_at,attempts,sent_at)
+        VALUES (?, ?, UTC_TIMESTAMP(3) + INTERVAL 10 MINUTE, 0, UTC_TIMESTAMP(3))
+        ON DUPLICATE KEY UPDATE code_hash=VALUES(code_hash),expires_at=VALUES(expires_at),attempts=0,sent_at=VALUES(sent_at)`, [email, hash]);
+      await db.commit();
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+    try { await provider.sendLoginCode(email, code); }
+    catch (failure) {
+      await pool.execute('DELETE FROM email_login_challenges WHERE email=? AND code_hash=?', [email, hash]);
+      throw error(503, 'Email delivery unavailable');
+    }
+    return { sent: true, expiresInSeconds: 600 };
+  }
+
+  async function verifyCode({ email: rawEmail, code }) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof code !== 'string' || !/^\d{6}$/.test(code)) throw error(400, 'Invalid code');
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [challenges] = await db.execute('SELECT code_hash,attempts,expires_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      const challenge = challenges[0];
+      if (!challenge || new Date(`${challenge.expires_at.replace(' ', 'T')}Z`).getTime() <= Date.now()) throw error(401, 'Code expired or incorrect');
+      const supplied = Buffer.from(codeHash(email, code), 'hex');
+      if (!timingSafeEqual(supplied, Buffer.from(challenge.code_hash, 'hex'))) {
+        if (challenge.attempts >= 4) await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        else await db.execute('UPDATE email_login_challenges SET attempts=attempts+1 WHERE email=?', [email]);
+        await db.commit();
+        throw error(401, 'Code expired or incorrect');
+      }
+      await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+      const [identities] = await db.execute(`SELECT u.id,u.status FROM user_login_identities i
+        JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?`, [email]);
+      let userId = identities[0]?.id;
+      if (identities[0]?.status === 'disabled') throw error(403, 'Account unavailable');
+      if (!userId) {
+        userId = randomUUID();
+        await db.execute('INSERT INTO users (id,status,created_at,updated_at) VALUES (?,\'active\',UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))', [userId]);
+        await db.execute(`INSERT INTO user_login_identities (user_id,kind,normalized_value,verified_at,created_at)
+          VALUES (?,'email',?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))`, [userId, email]);
+      }
+      const token = randomBytes(32).toString('base64url');
+      await db.execute(`INSERT INTO user_sessions (token_hash,user_id,created_at,expires_at)
+        VALUES (?,?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3) + INTERVAL 30 DAY)`, [tokenHash(token), userId]);
+      await db.commit();
+      return { token, user: { id: userId, email }, expiresInSeconds: 30 * 86400 };
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+  }
+
+  async function current(token) {
+    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) throw error(401, 'Unauthorized');
+    const [rows] = await pool.execute(`SELECT u.id,i.normalized_value AS email,s.expires_at FROM user_sessions s
+      JOIN users u ON u.id=s.user_id JOIN user_login_identities i ON i.user_id=u.id AND i.kind='email'
+      WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>UTC_TIMESTAMP(3) AND u.status='active'`, [tokenHash(token)]);
+    if (!rows.length) throw error(401, 'Unauthorized');
+    return { id: rows[0].id, email: rows[0].email, expiresAt: isoTime(rows[0].expires_at) };
+  }
+
+  async function logout(token) {
+    await current(token);
+    await pool.execute('UPDATE user_sessions SET revoked_at=UTC_TIMESTAMP(3) WHERE token_hash=? AND revoked_at IS NULL', [tokenHash(token)]);
+    return { ok: true };
+  }
+
+  return { captchaAppId: config.captchaAppId, requestCode, verifyCode, current, logout };
+}

package/dist/src/self-relay/lifecycle.mjs

@@ -1,17 +1,14 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
-import { setTimeout as delay } from 'node:timers/promises';
-import { startBackground, processAlive } from '../background-process.mjs';
 import { promisify } from 'node:util';
 import { randomBytes, randomUUID } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
 import { hostname } from 'node:os';
 import QRCode from 'qrcode';
 import { credentialStore } from '../platform/windows/credential-store.mjs';
 import { readRecord, writeRecord } from '../service-lifecycle.mjs';
 import { serviceHealth } from '../service-health.mjs';
-import { openControl, controlRequest } from '../service-control.mjs';
+import { controlRequest } from '../service-control.mjs';
 import { connectBridgeRelay } from './connector.mjs';
 import { validProbeIceServers } from './p2p-probe.mjs';
 import { relayAddress, validSecret } from './wire.mjs';
@@ -19,8 +16,6 @@ import { saveLanAuthorizations } from './lan-authorizations.mjs';
 import { lanNetworks } from '../platform/windows/network-info.mjs';
 
 const exec = promisify(execFile);
-const script = fileURLToPath(import.meta.url);
-const recordPath = root => path.join(root, 'self-relay-session.json');
 const officialConfig = { url: 'wss://api.uulife.site/relay' };
 
 async function loadConfig(stateRoot) {
@@ -59,54 +54,16 @@ async function registrationKey(config) {
   return hostKey;
 }
 export async function selfRelay(command, stateRoot) {
-  const previous = readRecord(recordPath(stateRoot));
-  let current;
-  if (previous) {
-    try { current = await controlRequest(previous); }
-    catch (error) { if (error.code !== 'ECONNREFUSED') throw error; }
-  }
-  if (command === 'relay-status' && current) return controlRequest(previous, 'POST', 'inspect');
-  if (command === 'relay-status') return current || { running: false, displayText: '私有中继连接器未运行。' };
-  if (command === 'relay-stop') {
-    if (current) await controlRequest(previous, 'POST');
-    const deadline = Date.now() + 10000;
-    while (current && processAlive(previous.pid)) {
-      if (Date.now() >= deadline) throw new Error('私有中继未在 10 秒内退出，未继续恢复服务。');
-      await delay(100);
-    }
-    return { stopped: true, displayText: '私有中继连接器已停止；Bridge 和 Codex 保持运行。' };
-  }
-  if (current) {
-    if (command === 'relay-revoke') return controlRequest(previous, 'POST', 'revoke');
-    if (command === 'relay-pair' || (current.relayConnected && !current.paired && !current.qrPath)) return controlRequest(previous, 'POST', 'pair');
-    if (command === 'relay-start' && current.relayConnected) return controlRequest(previous, 'POST', 'refresh-lan');
-    return current;
-  }
-  if (command === 'relay-revoke') throw new Error('请先启动连接器，再撤销移动端授权。');
-  fs.mkdirSync(stateRoot, { recursive: true });
-  const instanceId = randomUUID();
-  const log = path.join(stateRoot, 'self-relay.log');
-  const readyPath = path.join(stateRoot, `relay-ready-${instanceId}.json`);
-  const pid = await startBackground(process.execPath, [script, '--worker', stateRoot, instanceId,
-    command === 'relay-pair' ? 'pair' : ''], process.env, [log, log]);
-  try {
-    const deadline = Date.now() + 25000;
-    while (true) {
-      const result = readRecord(readyPath);
-      if (result) {
-        if (result.pid !== pid || result.instanceId !== instanceId) throw new Error('私有中继启动实例不匹配。');
-        if (result.error) throw new Error(result.error);
-        return result.status;
-      }
-      if (!processAlive(pid)) throw new Error('私有中继启动失败，请查看 self-relay.log。');
-      if (Date.now() >= deadline) throw new Error('私有中继启动超时。');
-      await delay(100);
-    }
-  } catch (error) { if (processAlive(pid)) process.kill(pid); throw error; }
-  finally { fs.rmSync(readyPath, { force: true }); }
-}
-
-async function worker(stateRoot, instanceId, refresh = false) {
+  const session = readRecord(path.join(stateRoot, 'bridge-session.json'));
+  if (!session) {
+    if (command === 'relay-status') return { running: false, displayText: 'Bridge 未运行。' };
+    if (command === 'relay-stop') return { stopped: true, displayText: '中继连接已停止。' };
+    throw new Error('Bridge 尚未运行，请先执行 relax start。');
+  }
+  return controlRequest(session, 'POST', command);
+}
+
+async function createRelayRuntime(stateRoot) {
   const config = await loadConfig(stateRoot);
   const session = () => readRecord(path.join(stateRoot, 'bridge-session.json'));
   let health = await serviceHealth(session());
@@ -132,8 +89,7 @@ async function worker(stateRoot, instanceId, refresh = false) {
     try { health = await serviceHealth(session()) || { transportMode: health.transportMode, status: 'offline' }; bridgeError = ''; }
     catch (error) { bridgeError = error.message; health = { transportMode: health.transportMode, status: 'offline' }; }
   }
-  const secret = randomBytes(32).toString('base64url');
-  let connector, control, qrPath, expiresAt = 0, paired = false, clientCount = 0, attachedCount = 0;
+  let connector, qrPath, expiresAt = 0, paired = false, clientCount = 0, attachedCount = 0;
   let closing = false, online = false, connecting = false, retryTimer, attempts = 0, lastError = '';
   const audit = (event, details = {}) => console.log(JSON.stringify({ time: new Date().toISOString(), event, ...details }));
   async function currentLanCandidates() {
@@ -161,8 +117,6 @@ async function worker(stateRoot, instanceId, refresh = false) {
     if (closing) return;
     closing = true; clearTimeout(retryTimer);
     connector?.events.removeAllListeners(); connector?.close();
-    if (readRecord(recordPath(stateRoot))?.instanceId === instanceId) fs.rmSync(recordPath(stateRoot), { force: true });
-    await control?.close();
   }
   async function saveInvitation(message) {
     if (!message.code) return;
@@ -245,25 +199,39 @@ async function worker(stateRoot, instanceId, refresh = false) {
     audit('lan-candidates-updated', { count: candidates.length });
     return { ...status(), lanCandidateCount: candidates.length };
   }
-  try {
-    const freshStatus = async () => {
-      if (online) {
-        const remote = await connector.command('status'); paired = remote.paired;
-        await refreshHealth();
-      }
-      return status();
-    };
-    control = await openControl({ instanceId, secret, shutdown, status, actions: { pair, revoke, inspect: freshStatus, 'refresh-lan': refreshLan } });
-    writeRecord(recordPath(stateRoot), { pid: process.pid, instanceId, controlSecret: secret, controlPort: control.port });
-    await connect();
-    const result = refresh && online ? await pair() : status();
-    writeRecord(path.join(stateRoot, `relay-ready-${instanceId}.json`), { instanceId, pid: process.pid, status: { ...result, pid: process.pid } });
-  } catch (error) { await shutdown(); throw error; }
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === script && process.argv[2] === '--worker') {
-  worker(process.argv[3], process.argv[4], process.argv[5] === 'pair').catch(error => {
-    writeRecord(path.join(process.argv[3], `relay-ready-${process.argv[4]}.json`), { instanceId: process.argv[4], pid: process.pid, error: error.message });
-    console.error(error.message); process.exitCode = 1;
-  });
-}
+  const inspect = async () => {
+    if (online) {
+      const remote = await connector.command('status'); paired = remote.paired;
+      await refreshHealth();
+    }
+    return status();
+  };
+  try { await connect(); return { status, inspect, pair, revoke, refreshLan, shutdown }; }
+  catch (error) { await shutdown(); throw error; }
+}
+
+export function createRelayManager(stateRoot) {
+  let current;
+  let operation = Promise.resolve();
+  const run = command => {
+    const next = operation.then(async () => {
+      if (command === 'relay-status') return current ? current.inspect() : { running: false, displayText: '中继连接未运行。' };
+      if (command === 'relay-stop') {
+        await current?.shutdown(); current = undefined;
+        return { stopped: true, displayText: '中继连接已停止；Bridge 和 Codex 保持运行。' };
+      }
+      if (!current) {
+        if (command === 'relay-revoke') throw new Error('请先启动中继连接，再撤销移动端授权。');
+        current = await createRelayRuntime(stateRoot);
+        return command === 'relay-pair' && current.status().relayConnected ? current.pair() : current.status();
+      }
+      if (command === 'relay-revoke') return current.revoke();
+      if (command === 'relay-pair' || (current.status().relayConnected && !current.status().paired && !current.status().qrPath)) return current.pair();
+      if (command === 'relay-start' && current.status().relayConnected) return current.refreshLan();
+      return current.status();
+    });
+    operation = next.catch(() => {});
+    return next;
+  };
+  return { run, close: () => run('relay-stop'), status: () => current?.status() || { running: false } };
+}

package/dist/src/self-relay/mysql-state.mjs

@@ -0,0 +1,104 @@
+import fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import mysql from 'mysql2/promise';
+import { deviceStore } from './device-store.mjs';
+import { relayAdminState } from './admin-state.mjs';
+
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const isoTime = value => value.replace(' ', 'T') + 'Z';
+
+export async function openRelayMysql(configFile, initialMaxRelaySessions) {
+  const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  if (!config.database || !config.user || !config.password || !(config.socketPath || config.host)) {
+    throw new Error('Incomplete relay MySQL configuration');
+  }
+  const pool = mysql.createPool({ ...config, waitForConnections: true, connectionLimit: 4,
+    namedPlaceholders: false, dateStrings: true, timezone: 'Z', multipleStatements: false });
+  try {
+    const [versions] = await pool.query('SELECT version, sha256 FROM schema_migrations');
+    const knownVersions = ['001_relay_core', '002_email_accounts'];
+    if (!versions.some(row => row.version === knownVersions[0]) || versions.length > knownVersions.length) throw new Error('Unexpected relay database schema');
+    for (const row of versions) {
+      if (!knownVersions.includes(row.version)) throw new Error('Unexpected relay database schema');
+      const source = fs.readFileSync(fileURLToPath(new URL(`../../database/${row.version}.sql`, import.meta.url)));
+      if (row.sha256 !== createHash('sha256').update(source).digest('hex')) throw new Error(`Unexpected relay database schema: ${row.version}`);
+    }
+    const [computers] = await pool.query('SELECT id, host_hash, status, revision, created_at, updated_at FROM computers');
+    const [clients] = await pool.query('SELECT computer_id, client_id, credential_hash, created_at, updated_at FROM mobile_authorizations ORDER BY created_at');
+    const [official] = await pool.query('SELECT computer_id, environment_id, name, hostname, updated_at FROM official_computers');
+    const records = new Map(computers.map(row => [row.id, { id: row.id, hostHash: row.host_hash, status: row.status,
+      revision: Number(row.revision), createdAt: isoTime(row.created_at), updatedAt: isoTime(row.updated_at), clients: [] }]));
+    for (const row of clients) {
+      const record = records.get(row.computer_id);
+      if (!record) throw new Error('Orphan mobile authorization');
+      record.clients.push({ id: row.client_id, hash: row.credential_hash,
+        createdAt: isoTime(row.created_at), updatedAt: isoTime(row.updated_at) });
+    }
+    for (const row of official) {
+      const record = records.get(row.computer_id);
+      if (!record) throw new Error('Orphan official computer');
+      record.officialComputer = { environmentId: row.environment_id, name: row.name,
+        hostname: row.hostname, updatedAt: isoTime(row.updated_at) };
+    }
+    const validator = deviceStore();
+    for (const record of records.values()) validator.save(record);
+
+    const [settings] = await pool.query('SELECT max_relay_sessions FROM relay_settings WHERE id = 1');
+    if (settings.length !== 1) throw new Error('Missing relay settings');
+    const [rows] = await pool.query('SELECT id, title, message, status, created_at, updated_at, published_at FROM announcements ORDER BY created_at DESC');
+    const announcements = rows.map(row => ({ id: row.id, title: row.title, message: row.message, status: row.status,
+      createdAt: isoTime(row.created_at), updatedAt: isoTime(row.updated_at),
+      publishedAt: row.published_at ? isoTime(row.published_at) : null }));
+    const active = announcements.find(item => item.status === 'active');
+    const initial = { version: 3, maxRelaySessions: settings[0].max_relay_sessions, announcements,
+      announcement: active ? { id: active.id, title: active.title, message: active.message, publishedAt: active.publishedAt } : null };
+    const admin = relayAdminState(undefined, initialMaxRelaySessions, { initial, persist: async next => {
+      const connection = await pool.getConnection();
+      try {
+        await connection.beginTransaction();
+        await connection.execute('UPDATE relay_settings SET max_relay_sessions = ?, updated_at = UTC_TIMESTAMP(3) WHERE id = 1', [next.maxRelaySessions]);
+        await connection.query('DELETE FROM announcements');
+        for (const item of next.announcements) await connection.execute(
+          'INSERT INTO announcements (id,title,message,status,created_at,updated_at,published_at) VALUES (?,?,?,?,?,?,?)',
+          [item.id, item.title, item.message, item.status, sqlTime(item.createdAt), sqlTime(item.updatedAt),
+            item.publishedAt ? sqlTime(item.publishedAt) : null]);
+        await connection.commit();
+      } catch (error) { await connection.rollback(); throw error; }
+      finally { connection.release(); }
+    } });
+    return {
+      pool,
+      schemaVersions: versions.map(row => row.version),
+      devices: {
+        entries: () => [...records.values()],
+        async save(record) {
+          validator.save(record);
+          const connection = await pool.getConnection();
+          try {
+            await connection.beginTransaction();
+            await connection.execute(`INSERT INTO computers (id,host_hash,status,revision,created_at,updated_at)
+              VALUES (?,?,?,?,?,?) ON DUPLICATE KEY UPDATE host_hash=VALUES(host_hash),status=VALUES(status),
+              revision=VALUES(revision),updated_at=VALUES(updated_at)`,
+            [record.id, record.hostHash, record.status, record.revision, sqlTime(record.createdAt), sqlTime(record.updatedAt)]);
+            await connection.execute('DELETE FROM mobile_authorizations WHERE computer_id = ?', [record.id]);
+            for (const client of record.clients) await connection.execute(
+              'INSERT INTO mobile_authorizations (computer_id,client_id,credential_hash,created_at,updated_at) VALUES (?,?,?,?,?)',
+              [record.id, client.id, client.hash, sqlTime(client.createdAt), sqlTime(client.updatedAt)]);
+            if (record.officialComputer) {
+              const item = record.officialComputer;
+              await connection.execute(`INSERT INTO official_computers (computer_id,environment_id,name,hostname,updated_at)
+                VALUES (?,?,?,?,?) ON DUPLICATE KEY UPDATE environment_id=VALUES(environment_id),name=VALUES(name),
+                hostname=VALUES(hostname),updated_at=VALUES(updated_at)`,
+              [record.id, item.environmentId, item.name, item.hostname, sqlTime(item.updatedAt)]);
+            }
+            await connection.commit(); records.set(record.id, record);
+          } catch (error) { await connection.rollback(); throw error; }
+          finally { connection.release(); }
+        },
+      },
+      admin,
+      close: () => pool.end(),
+    };
+  } catch (error) { await pool.end(); throw error; }
+}