@walkhi/code-relax 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/src/self-relay/connector.mjs

@@ -1,33 +1,179 @@
-import { randomUUID } from 'node:crypto';
-import { EventEmitter } from 'node:events';
-import WebSocket from 'ws';
+import { randomUUID } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import WebSocket from 'ws';
 import { decode, loopbackUrl, relayAddress, send } from './wire.mjs';
 import { createP2pProbe, validProbeSignal } from './p2p-probe.mjs';
 import { createWindowsRouteHelper } from './windows-route-helper.mjs';
 
 // Reuse the actual LAN dispatcher, including its normal/shared capability boundary.
 // The LAN token never travels to the relay. No requests are replayed after a close.
-export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken, identity, bridgeConnection, hostName = 'Codex-PC', lanCandidates = [], p2pProbe = false, iceServers = [], p2pWindowsRouteHelper = false, p2pWindowsRouteHelperToken = '' }) {
+export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken, identity, bridgeConnection, usageCacheFile,
+  hostName = 'Codex-PC', lanCandidates = [], p2pProbe = false, iceServers = [], p2pWindowsRouteHelper = false, p2pWindowsRouteHelperToken = '' }) {
   relayAddress(relayUrl); loopbackUrl(bridgeUrl, '/api/socket');
-  if (!bridgeToken) throw new Error('Bridge token required');
+  if (!bridgeToken) throw new Error('Desktop service credential required');
   const events = new EventEmitter();
   const remote = new WebSocket(relayUrl, { maxPayload: 64 * 1024 * 1024, perMessageDeflate: {
     serverNoContextTakeover: true, clientNoContextTakeover: true,
     threshold: 1024, zlibDeflateOptions: { level: 3 },
   } });
-  const locals = new Map();
-  let heartbeat, operation, lastClose;
+  const locals = new Map();
+  const fileLocals = new Map();
+  const activeTurns = new Map();
+  const completedTurns = new Map();
+  const trackedTurns = new Map();
+  if (usageCacheFile) {
+    try {
+      const saved = JSON.parse(fs.readFileSync(usageCacheFile, 'utf8'));
+      if (saved.version === 1 && Array.isArray(saved.turns)) {
+        for (const item of saved.turns.slice(0, 128)) {
+          if (typeof item.threadId === 'string' && item.threadId.length <= 80 &&
+              typeof item.turnId === 'string' && item.turnId.length <= 80) trackedTurns.set(item.threadId, item.turnId);
+        }
+      }
+    } catch (error) { if (error.code !== 'ENOENT') events.emit('diagnostic', `Usage task cache: ${error.message}`); }
+  }
+  function saveTrackedTurns() {
+    if (!usageCacheFile) return;
+    try {
+      const temp = `${usageCacheFile}.tmp`;
+      fs.writeFileSync(temp, JSON.stringify({ version: 1, turns: [...trackedTurns].map(([threadId, turnId]) => ({ threadId, turnId })) }), { mode: 0o600 });
+      fs.renameSync(temp, usageCacheFile);
+    } catch (error) { events.emit('diagnostic', `Usage task cache: ${error.message}`); }
+  }
+  let fileRemote, fileRetryTimer, turnLocal, turnRetryTimer, turnPulseTimer, turnObserverReady = false,
+    queueTurnResync = () => {}, heartbeat, operation, lastClose, closing = false;
   const alive = () => { clearTimeout(heartbeat); heartbeat = setTimeout(() => remote.terminate(), 75000); };
   remote.on('open', alive); remote.on('ping', alive); remote.on('message', alive);
-  function dropLocal(session) {
-    const current = locals.get(session);
-    if (!current) return;
-    locals.delete(session); clearTimeout(current.timer); current.socket?.terminate();
-    current.probe?.then(probe => probe.close());
-  }
-  function dropLocals() {
-    for (const session of [...locals.keys()]) dropLocal(session);
+  function dropLocal(session) {
+    const current = locals.get(session);
+    if (!current) return;
+    locals.delete(session); clearTimeout(current.timer);
+    if (current.ready && current.socket?.readyState === WebSocket.OPEN && current.usageRequests.size &&
+        remote.readyState === WebSocket.OPEN && !closing) {
+      // Keep only the in-flight submission receipt; no late response goes to the phone.
+      current.detached = true;
+      current.detachedTimer = setTimeout(() => current.socket?.terminate(), 35000);
+    } else current.socket?.terminate();
+    current.probe?.then(probe => probe.close());
+    current.diagnosticProbe?.then(probe => probe.close());
   }
+  function dropLocals() {
+    for (const session of [...locals.keys()]) dropLocal(session);
+    for (const socket of fileLocals.values()) socket.terminate();
+    fileLocals.clear(); clearTimeout(fileRetryTimer); fileRemote?.terminate(); fileRemote = undefined;
+    clearTimeout(turnRetryTimer); clearInterval(turnPulseTimer); turnLocal?.terminate(); turnLocal = undefined;
+    turnObserverReady = false; activeTurns.clear(); completedTurns.clear();
+  }
+  function startTurnReceiver() {
+    if (closing || remote.readyState !== WebSocket.OPEN) return;
+    let connection;
+    try { connection = bridgeConnection?.() || { url: bridgeUrl, token: bridgeToken }; loopbackUrl(connection.url, '/api/socket'); }
+    catch { turnRetryTimer = setTimeout(startTurnReceiver, 3000); return; }
+    const socket = turnLocal = new WebSocket(connection.url, { maxPayload: 64 * 1024, perMessageDeflate: false });
+    const resyncPending = new Map();
+    let resyncId = 1, resyncQueue = [];
+    function resyncNext() {
+      if (!turnObserverReady || turnLocal !== socket) return;
+      while (resyncPending.size < 8 && resyncQueue.length) {
+        const [threadId, turnId] = resyncQueue.shift();
+        if (trackedTurns.get(threadId) !== turnId) continue;
+        const id = ++resyncId;
+        resyncPending.set(id, { threadId, turnId });
+        send(socket, { type: 'request', id, method: 'GET', path: `/api/threads/${encodeURIComponent(threadId)}/active-turn` });
+      }
+    }
+    queueTurnResync = (threadId, turnId) => { resyncQueue.push([threadId, turnId]); resyncNext(); };
+    socket.on('open', () => send(socket, { type: 'auth', token: connection.token }));
+    socket.on('error', error => events.emit('diagnostic', `Local turn observer: ${error.message}`));
+    socket.on('close', () => {
+      if (turnLocal !== socket) return;
+      turnLocal = undefined;
+      if (turnObserverReady) send(remote, { type: 'usage-observer-lost' });
+      turnObserverReady = false;
+      queueTurnResync = () => {};
+      activeTurns.clear(); completedTurns.clear();
+      if (!closing && remote.readyState === WebSocket.OPEN) turnRetryTimer = setTimeout(startTurnReceiver, 3000);
+    });
+    socket.on('message', (bytes, binary) => {
+      if (binary || turnLocal !== socket) return socket.terminate();
+      try {
+        const message = decode(bytes, false);
+        if (message.type === 'ready') { send(socket, { type: 'subscribe', id: 1, path: '/api/turn-events' }); return; }
+        if (message.type === 'subscribed' && message.id === 1) {
+          turnObserverReady = true; resyncQueue = [...trackedTurns]; resyncNext(); return;
+        }
+        if (message.type === 'response' && resyncPending.has(message.id)) {
+          const { threadId, turnId } = resyncPending.get(message.id);
+          resyncPending.delete(message.id);
+          if (trackedTurns.get(threadId) === turnId) {
+            if (message.status === 200 && message.body?.turnId === turnId) {
+              activeTurns.set(threadId, turnId);
+              send(remote, { type: 'usage-turn', method: 'resume', threadId, turnId });
+            } else if (message.status === 200 || message.status === 404) {
+              trackedTurns.delete(threadId); saveTrackedTurns();
+            } else { socket.close(); return; }
+          }
+          resyncNext(); return;
+        }
+        if (message.type === 'event' && message.id === 1 && message.event === 'turn') {
+          const { method, threadId, turnId } = message.data || {};
+          if (!['turn/started', 'turn/completed'].includes(method) || typeof threadId !== 'string' || typeof turnId !== 'string') return;
+          const key = `${threadId}:${turnId}`;
+          if (method === 'turn/started') activeTurns.set(threadId, turnId);
+          else {
+            if (activeTurns.get(threadId) === turnId) activeTurns.delete(threadId);
+            if (trackedTurns.get(threadId) === turnId) { trackedTurns.delete(threadId); saveTrackedTurns(); }
+            completedTurns.set(key, Date.now());
+            if (completedTurns.size > 100) completedTurns.delete(completedTurns.keys().next().value);
+          }
+          send(remote, { type: 'usage-turn', method, threadId, turnId });
+        } else if (message.type === 'end' || (message.type === 'response' && message.status >= 400)) socket.close();
+      } catch (error) { events.emit('diagnostic', error.message); socket.terminate(); }
+    });
+  }
+  function startFileReceiver() {
+    if (!identity || closing || remote.readyState !== WebSocket.OPEN) return;
+    const receiver = fileRemote = new WebSocket(relayUrl, { maxPayload: 512 * 1024, perMessageDeflate: false });
+    receiver.on('open', () => send(receiver, { type: 'file-host', deviceId: identity.id, deviceSecret: identity.secret }));
+    receiver.on('error', error => events.emit('diagnostic', `File receiver: ${error.message}`));
+    receiver.on('close', () => {
+      for (const socket of fileLocals.values()) socket.terminate();
+      fileLocals.clear();
+      if (fileRemote === receiver) {
+        fileRemote = undefined;
+        if (!closing && remote.readyState === WebSocket.OPEN) fileRetryTimer = setTimeout(startFileReceiver, 3000);
+      }
+    });
+    receiver.on('message', (bytes, binary) => {
+      try {
+        const message = decode(bytes, binary);
+        if (message.type === 'file-host-ready') return;
+        if (message.type === 'file-open') {
+          const connection = bridgeConnection?.() || { url: bridgeUrl, token: bridgeToken };
+          const url = new URL(connection.url); url.pathname = '/api/file-transfer';
+          loopbackUrl(url.href, '/api/file-transfer');
+          const socket = new WebSocket(url.href, { maxPayload: 512 * 1024, perMessageDeflate: false });
+          fileLocals.set(message.session, socket);
+          socket.on('open', () => send(socket, { type: 'auth', token: connection.token }));
+          socket.on('error', error => events.emit('diagnostic', `Local file receiver: ${error.message}`));
+          socket.on('close', () => {
+            if (fileLocals.get(message.session) !== socket) return;
+            fileLocals.delete(message.session);
+            send(receiver, { type: 'file-close', session: message.session });
+          });
+          socket.on('message', (data, isBinary) => {
+            if (isBinary || fileLocals.get(message.session) !== socket) return socket.terminate();
+            send(receiver, { type: 'file-frame', session: message.session, payload: data.toString() });
+          });
+        } else if (message.type === 'file-frame') {
+          const socket = fileLocals.get(message.session);
+          if (socket?.readyState === WebSocket.OPEN) socket.send(message.payload);
+        } else if (message.type === 'file-close') fileLocals.get(message.session)?.terminate();
+        else throw new Error('Invalid file receiver frame');
+      } catch (error) { events.emit('diagnostic', error.message); receiver.close(1008, 'Invalid file frame'); }
+    });
+  }
   const ready = new Promise((resolve, reject) => {
     let registered = false;
     const timer = setTimeout(() => { reject(new Error('Relay registration timeout')); remote.terminate(); }, 5000);
@@ -44,7 +190,13 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     remote.on('message', (bytes, binary) => {
       try {
         const message = decode(bytes, binary);
-        if (message.type === 'registered' && !registered) { registered = true; clearTimeout(timer); resolve(message); return; }
+        if (message.type === 'registered' && !registered) {
+          registered = true; clearTimeout(timer); startFileReceiver(); startTurnReceiver();
+          turnPulseTimer = setInterval(() => {
+            for (const [threadId, turnId] of activeTurns) send(remote, { type: 'usage-turn', method: 'heartbeat', threadId, turnId });
+          }, 10000);
+          resolve(message); return;
+        }
         if (!registered) throw new Error('Relay not registered');
         if (message.type === 'pair-code' || message.type === 'revoked' || message.type === 'status') {
           if (operation && message.commandId === operation.id && message.type === operation.responseType) {
@@ -60,7 +212,7 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
           events.emit('attached', { session: message.session, clientId: message.clientId });
           dropLocal(message.session);
           const current = { socket: undefined, ready: false, timer: undefined, p2pProbe: p2pProbe && message.p2pProbe === 1,
-            bridgeOutbound: Promise.resolve() };
+            bridgeOutbound: Promise.resolve(), usageRequests: new Map(), detached: false, detachedTimer: undefined };
           locals.set(message.session, current);
           let connection;
           try {
@@ -68,30 +220,65 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
             loopbackUrl(connection.url, '/api/socket');
           } catch {
             send(remote, { type: 'detach', session: message.session }); dropLocal(message.session); events.emit('detached', { session: message.session });
-            events.emit('diagnostic', 'Local Bridge connection not ready'); return;
+            events.emit('diagnostic', 'Local desktop service connection not ready'); return;
           }
           const socket = current.socket = new WebSocket(connection.url, { maxPayload: 64 * 1024 * 1024, perMessageDeflate: false });
           current.forwardToBridge = payload => {
-            if (locals.get(message.session) !== current || !current.ready) throw new Error('Local Bridge connection not ready');
+            if (locals.get(message.session) !== current || !current.ready) throw new Error('Local desktop service connection not ready');
             const request = decode(payload, false);
             if (!['request', 'subscribe', 'unsubscribe'].includes(request.type)) throw new Error('Unsupported LAN message');
+            if (request.type === 'request' && request.method === 'POST' && Number.isSafeInteger(request.id)) {
+              const path = (request.path || '').split('?')[0];
+              const existing = /^\/api\/threads\/([^/?]+)\/(?:messages|queue)$/.exec(path);
+              const created = /^\/api\/projects\/[^/?]+\/threads$/.test(path);
+              if (existing || created) {
+                const threadId = existing ? decodeURIComponent(existing[1]) : null;
+                const messageKey = typeof request.body?.clientUserMessageId === 'string' && request.body.clientUserMessageId.length <= 64
+                  ? request.body.clientUserMessageId : `${message.session}:${request.id}`;
+                current.usageRequests.set(request.id, { threadId, messageKey, created });
+                send(remote, { type: 'usage-arm', session: message.session, requestId: request.id, threadId });
+              }
+            }
             send(socket, request);
           };
           current.timer = setTimeout(() => socket.terminate(), 5000);
           socket.on('open', () => send(socket, { type: 'auth', token: connection.token }));
-          socket.on('error', error => events.emit('diagnostic', `Local Bridge: ${error.message}`));
-          socket.on('close', () => {
-            if (locals.get(message.session)?.socket !== socket) return;
+          socket.on('error', error => events.emit('diagnostic', `Local desktop service: ${error.message}`));
+          socket.on('close', () => {
+            clearTimeout(current.detachedTimer);
+            if (locals.get(message.session)?.socket !== socket) return;
             send(remote, { type: 'detach', session: message.session }); dropLocal(message.session); events.emit('detached', { session: message.session });
           });
-          socket.on('message', (data, isBinary) => {
-            if (locals.get(message.session)?.socket !== socket) return;
+          socket.on('message', (data, isBinary) => {
+            if (locals.get(message.session)?.socket !== socket && !current.detached) return;
             try {
               const response = decode(data, isBinary);
               if (!current.ready) {
-                if (response.type !== 'ready') throw new Error('Local Bridge authentication failed');
+                if (response.type !== 'ready') throw new Error('Local desktop service authentication failed');
                 clearTimeout(current.timer); current.ready = true; send(remote, { type: 'ready', session: message.session });
               } else {
+                const usage = response.type === 'response' ? current.usageRequests.get(response.id) : null;
+                if (usage) {
+                  current.usageRequests.delete(response.id);
+                  const threadId = usage.threadId || response.body?.threadId;
+                  if (response.status >= 200 && response.status < 300 && typeof threadId === 'string') {
+                    const turnId = usage.created ? response.body?.turnId : response.body?.usage?.turnId;
+                    const turnKind = usage.created ? 'start' : response.body?.usage?.kind;
+                    send(remote, { type: 'usage-message', session: message.session, requestId: response.id,
+                      threadId, messageKey: usage.messageKey, turnId, turnKind,
+                      completed: completedTurns.has(`${threadId}:${turnId}`), observerReady: turnObserverReady,
+                      active: activeTurns.get(threadId) === turnId });
+                    if (['start', 'steer'].includes(turnKind) && typeof turnId === 'string' &&
+                        !completedTurns.has(`${threadId}:${turnId}`)) {
+                      trackedTurns.set(threadId, turnId); saveTrackedTurns();
+                      if (turnObserverReady && !activeTurns.has(threadId)) queueTurnResync(threadId, turnId);
+                    }
+                  } else send(remote, { type: 'usage-cancel', session: message.session, requestId: response.id });
+                }
+                if (current.detached) {
+                  if (!current.usageRequests.size) socket.terminate();
+                  return;
+                }
                 const payload = data.toString();
                 current.bridgeOutbound = current.bridgeOutbound.then(async () => {
                   const probe = await current.probe;
@@ -102,10 +289,36 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
               }
             } catch (error) { events.emit('diagnostic', error.message); socket.terminate(); }
           });
-        } else if (message.type === 'p2p-probe' && locals.has(message.session)) {
-          const current = locals.get(message.session);
-          if (!current.ready || !current.p2pProbe || !validProbeSignal(message)) throw new Error('Invalid probe signal');
-          if (message.kind === 'start' && current.probeId !== message.probeId) {
+        } else if (message.type === 'p2p-probe' && locals.has(message.session)) {
+          const current = locals.get(message.session);
+          if (!current.ready || !current.p2pProbe || !validProbeSignal(message)) throw new Error('Invalid probe signal');
+          if (message.purpose === 'diagnostic') {
+            if (message.kind === 'start' && current.diagnosticProbeId !== message.probeId) {
+              void current.diagnosticProbe?.then(probe => probe.close());
+              current.diagnosticProbeId = message.probeId;
+              const probeId = message.probeId;
+              current.diagnosticProbe = createP2pProbe({ iceServers,
+                signal: signal => {
+                  if (locals.get(message.session) === current && current.diagnosticProbeId === probeId) {
+                    send(remote, { type: 'p2p-probe', purpose: 'diagnostic', session: message.session,
+                      version: 1, probeId, ...signal });
+                  }
+                },
+                report: (state, diagnostic) => events.emit('p2p-probe', { state, diagnostic })
+              }).catch(() => {
+                if (locals.get(message.session) === current && current.diagnosticProbeId === probeId) {
+                  send(remote, { type: 'p2p-probe', purpose: 'diagnostic', session: message.session,
+                    version: 1, probeId, kind: 'close' });
+                }
+                return { receive() {}, close() {} };
+              });
+            } else if (current.diagnosticProbe && current.diagnosticProbeId === message.probeId) {
+              void current.diagnosticProbe.then(probe => probe.receive(message));
+            }
+            return;
+          }
+          if (message.purpose) throw new Error('Invalid probe purpose');
+          if (message.kind === 'start' && current.probeId !== message.probeId) {
             void current.probe?.then(probe => probe.close());
             current.probeId = message.probeId;
             current.routeSignals = Promise.resolve();
@@ -157,6 +370,6 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     updateLanCandidates(candidates) {
       if (!send(remote, { type: 'lan-candidates', candidates })) throw new Error('中继未连接');
     },
-    close() { clearTimeout(heartbeat); dropLocals(); remote.terminate(); }
+    close() { closing = true; clearTimeout(heartbeat); dropLocals(); remote.terminate(); }
   };
 }

package/dist/src/self-relay/demo.mjs

@@ -7,7 +7,7 @@ import { connectRelayClient } from './client.mjs';
 import { secret } from './wire.mjs';
 
 export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispatch, remoteRelay, hostName = 'TEST-PC', lanCandidates = [], relayOptions = {} } = {}) {
-  if (!['lan-legacy', 'lan-shared'].includes(mode)) throw new Error('Invalid demo mode');
+  if (mode !== 'lan-shared') throw new Error('Invalid demo mode');
   const token = secret(), calls = [];
   const bridge = http.createServer((_request, response) => { response.writeHead(404); response.end(); });
   const lan = attachLanSocket(bridge, { token, dispatch: async (request, reply) => {
@@ -17,9 +17,8 @@ export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispat
     if (request.url.split('?')[0] === '/api/threads/demo/events') {
       reply.startEvents(); reply.event('update', { thread: { id: 'demo' }, simulated: true }); return;
     }
-    if (request.url === '/api/demo/stop') return reply.json(mode === 'lan-shared' ? 200 : 409,
-      mode === 'lan-shared' ? { stopped: true, simulated: true } : { error: '基础控制不支持停止任务' });
-    reply.json(404, { error: '模拟 Bridge 不执行真实任务' });
+    if (request.url === '/api/demo/stop') return reply.json(200, { stopped: true, simulated: true });
+    reply.json(404, { error: '模拟桌面服务不执行真实任务' });
   } });
   await new Promise(resolve => bridge.listen(0, '127.0.0.1', resolve));
   const relay = remoteRelay ? { ...remoteRelay, async close() {} } : await startSelfRelay({ pairingTtlMs, ...relayOptions });

package/dist/src/self-relay/email-accounts.mjs

@@ -0,0 +1,141 @@
+import fs from 'node:fs';
+import { createHash, createHmac, randomBytes, randomInt, randomUUID, timingSafeEqual } from 'node:crypto';
+import { tencentAccountProvider } from '../../relay-admin/tencent-account-provider.mjs';
+
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const isoTime = value => value.replace(' ', 'T') + 'Z';
+const error = (status, message) => Object.assign(new Error(message), { status });
+const tokenHash = token => createHash('sha256').update(token).digest('hex');
+const normalizeEmail = value => {
+  if (typeof value !== 'string') throw error(400, 'Invalid email address');
+  const email = value.trim().toLowerCase();
+  if (email.length > 254 || !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(email)) {
+    throw error(400, 'Invalid email address');
+  }
+  return email;
+};
+
+export function openEmailAccounts(pool, configFile, providerOverride) {
+  const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  if (![config.secretId, config.secretKey, config.captchaAppSecretKey, config.fromEmailAddress, config.sesRegion]
+    .every(value => typeof value === 'string' && value.length > 0) ||
+    !Number.isSafeInteger(config.captchaAppId) || config.captchaAppId < 1 ||
+    !Number.isSafeInteger(config.emailTemplateId) || config.emailTemplateId < 1 ||
+    typeof config.codePepper !== 'string' || config.codePepper.length < 32) {
+    throw new Error('Incomplete relay account configuration');
+  }
+  const provider = providerOverride || tencentAccountProvider(config);
+  const codeHash = (email, code) => createHmac('sha256', config.codePepper).update(`${email}\0${code}`).digest('hex');
+  const scopeHash = value => createHmac('sha256', config.codePepper).update(value).digest('hex');
+
+  async function requestCode({ email: rawEmail, ticket, randstr }, ip) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof ticket !== 'string' || !ticket || ticket.length > 2048 ||
+        typeof randstr !== 'string' || !randstr || randstr.length > 128) throw error(400, 'Invalid human verification');
+    if (!ip || ip.length > 64) throw error(400, 'Invalid client address');
+    // A cheap pre-check precedes the billable human verification.
+    const [recent] = await pool.execute('SELECT sent_at FROM email_login_challenges WHERE email = ? AND sent_at > UTC_TIMESTAMP(3) - INTERVAL 60 SECOND', [email]);
+    if (recent.length) throw error(429, 'Please wait before requesting another code');
+    const [ipLimit] = await pool.execute(`SELECT request_count FROM email_send_limits
+      WHERE scope_hash=? AND window_start>=UTC_TIMESTAMP() - INTERVAL 1 HOUR ORDER BY window_start DESC LIMIT 1`, [scopeHash(`ip:${ip}`)]);
+    if (ipLimit[0]?.request_count >= 20) throw error(429, 'Too many email requests');
+    if (!await provider.verifyHuman(ticket, randstr, ip)) throw error(403, 'Human verification failed');
+    const code = String(randomInt(0, 1000000)).padStart(6, '0');
+    const hash = codeHash(email, code);
+    const windowStart = sqlTime(new Date(Math.floor(Date.now() / 3600000) * 3600000).toISOString()).slice(0, 19);
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      for (const [scope, limit] of [[`email:${email}`, 5], [`ip:${ip}`, 20]]) {
+        const key = scopeHash(scope);
+        await db.execute('INSERT INTO email_send_limits (scope_hash,window_start,request_count) VALUES (?,?,1) ON DUPLICATE KEY UPDATE request_count=request_count+1', [key, windowStart]);
+        const [rows] = await db.execute('SELECT request_count FROM email_send_limits WHERE scope_hash=? AND window_start=? FOR UPDATE', [key, windowStart]);
+        if (rows[0].request_count > limit) throw error(429, 'Too many email requests');
+      }
+      const [existing] = await db.execute('SELECT sent_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      if (existing.length && Date.now() - new Date(`${existing[0].sent_at.replace(' ', 'T')}Z`).getTime() < 60000) {
+        throw error(429, 'Please wait before requesting another code');
+      }
+      await db.execute(`INSERT INTO email_login_challenges (email,code_hash,expires_at,attempts,sent_at)
+        VALUES (?, ?, UTC_TIMESTAMP(3) + INTERVAL 10 MINUTE, 0, UTC_TIMESTAMP(3))
+        ON DUPLICATE KEY UPDATE code_hash=VALUES(code_hash),expires_at=VALUES(expires_at),attempts=0,sent_at=VALUES(sent_at)`, [email, hash]);
+      await db.commit();
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+    try { await provider.sendLoginCode(email, code); }
+    catch (failure) {
+      await pool.execute('DELETE FROM email_login_challenges WHERE email=? AND code_hash=?', [email, hash]);
+      throw error(503, 'Email delivery unavailable');
+    }
+    return { sent: true, expiresInSeconds: 600 };
+  }
+
+  async function verifyCode({ email: rawEmail, code }) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof code !== 'string' || !/^\d{6}$/.test(code)) throw error(400, 'Invalid code');
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [challenges] = await db.execute('SELECT code_hash,attempts,expires_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      const challenge = challenges[0];
+      if (!challenge || new Date(`${challenge.expires_at.replace(' ', 'T')}Z`).getTime() <= Date.now()) throw error(401, 'Code expired or incorrect');
+      const supplied = Buffer.from(codeHash(email, code), 'hex');
+      if (!timingSafeEqual(supplied, Buffer.from(challenge.code_hash, 'hex'))) {
+        if (challenge.attempts >= 4) await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        else await db.execute('UPDATE email_login_challenges SET attempts=attempts+1 WHERE email=?', [email]);
+        await db.commit();
+        throw error(401, 'Code expired or incorrect');
+      }
+      await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+      const [identities] = await db.execute(`SELECT u.id,u.status FROM user_login_identities i
+        JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?`, [email]);
+      let userId = identities[0]?.id;
+      if (identities[0]?.status === 'disabled') throw error(403, 'Account unavailable');
+      if (!userId) {
+        userId = randomUUID();
+        await db.execute('INSERT INTO users (id,status,created_at,updated_at) VALUES (?,\'active\',UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))', [userId]);
+        await db.execute(`INSERT INTO user_login_identities (user_id,kind,normalized_value,verified_at,created_at)
+          VALUES (?,'email',?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))`, [userId, email]);
+      }
+      const token = randomBytes(32).toString('base64url');
+      await db.execute(`INSERT INTO user_sessions (token_hash,user_id,created_at,expires_at)
+        VALUES (?,?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3) + INTERVAL 30 DAY)`, [tokenHash(token), userId]);
+      await db.commit();
+      return { token, user: { id: userId, email }, expiresInSeconds: 30 * 86400 };
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+  }
+
+  async function current(token) {
+    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) throw error(401, 'Unauthorized');
+    const [rows] = await pool.execute(`SELECT u.id,i.normalized_value AS email,s.expires_at FROM user_sessions s
+      JOIN users u ON u.id=s.user_id JOIN user_login_identities i ON i.user_id=u.id AND i.kind='email'
+      WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>UTC_TIMESTAMP(3) AND u.status='active'`, [tokenHash(token)]);
+    if (!rows.length) throw error(401, 'Unauthorized');
+    return { id: rows[0].id, email: rows[0].email, expiresAt: isoTime(rows[0].expires_at) };
+  }
+
+  async function usage(userId) {
+    const [settings] = await pool.query('SELECT mode FROM relay_usage_settings WHERE id=1');
+    if (settings.length !== 1) throw new Error('Missing relay usage settings');
+    const [budgets] = await pool.execute(`SELECT period_start,period_end,limit_seconds,used_seconds FROM relay_usage_budgets
+      WHERE user_id=? AND period_start<=UTC_TIMESTAMP(3) AND period_end>UTC_TIMESTAMP(3)
+      ORDER BY period_start DESC LIMIT 2`, [userId]);
+    if (budgets.length > 1) throw new Error('Overlapping relay usage budgets');
+    const budget = budgets[0];
+    const [totals] = await pool.execute('SELECT task_seconds FROM relay_usage_totals WHERE user_id=?', [userId]);
+    return { mode: settings[0].mode, periodStart: budget ? isoTime(budget.period_start) : null,
+      periodEnd: budget ? isoTime(budget.period_end) : null,
+      limitSeconds: budget?.limit_seconds == null ? null : Number(budget.limit_seconds),
+      usedSeconds: budget ? Number(budget.used_seconds) : 0,
+      taskSeconds: Number(totals[0]?.task_seconds || 0) };
+  }
+
+  async function logout(token) {
+    await current(token);
+    await pool.execute('UPDATE user_sessions SET revoked_at=UTC_TIMESTAMP(3) WHERE token_hash=? AND revoked_at IS NULL', [tokenHash(token)]);
+    return { ok: true };
+  }
+
+  return { captchaAppId: config.captchaAppId, requestCode, verifyCode, current, usage, logout };
+}