@walkhi/code-relax 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/src/self-relay/diagnostics.mjs

@@ -1,54 +1,54 @@
-const MAX_BATCH = 200;
-
-export function relayDiagnostics(pool, onError = () => {}) {
-  let tail = Promise.resolve();
-  function validSource(source) {
-    if (!/^[a-z-]{1,32}$/.test(source)) throw new Error('Invalid diagnostic source');
-    return source;
-  }
-  function serialize(action) {
-    const result = tail.then(action);
-    tail = result.catch(error => { onError(error); });
-    return result;
-  }
-  function record(source, event, detail) {
-    validSource(source);
-    if (!/^[a-z-]{1,32}$/.test(event) || !/^[a-z-]{1,64}$/.test(detail)) throw new Error('Invalid diagnostic event');
-    void serialize(async () => {
-      await pool.execute('INSERT INTO relay_diagnostics (created_at,source,event,detail) VALUES (UTC_TIMESTAMP(3),?,?,?)', [source, event, detail]);
-      await pool.execute('DELETE FROM relay_diagnostics WHERE created_at < UTC_TIMESTAMP(3) - INTERVAL 1 DAY');
-    }).catch(() => {});
-  }
-  async function read(source) {
-    validSource(source);
-    return serialize(async () => {
-      const [rows] = await pool.execute(`SELECT id,created_at,source,event,detail FROM relay_diagnostics
-        WHERE source=? ORDER BY id LIMIT ${MAX_BATCH + 1}`, [source]);
-      return { rows: rows.slice(0, MAX_BATCH), hasMore: rows.length > MAX_BATCH };
-    });
-  }
-  async function clear(source) {
-    validSource(source);
-    return serialize(async () => {
-      const [result] = await pool.execute('DELETE FROM relay_diagnostics WHERE source=?', [source]);
-      return { cleared: result.affectedRows };
-    });
-  }
-  async function drain(source) {
-    validSource(source);
-    return serialize(async () => {
-      const db = await pool.getConnection();
-      try {
-        await db.beginTransaction();
-        const [rows] = await db.execute(`SELECT id,created_at,source,event,detail FROM relay_diagnostics
-          WHERE source=? ORDER BY id LIMIT ${MAX_BATCH + 1} FOR UPDATE`, [source]);
-        const selected = rows.slice(0, MAX_BATCH);
-        if (selected.length) await db.execute('DELETE FROM relay_diagnostics WHERE source=? AND id <= ?', [source, selected.at(-1).id]);
-        await db.commit();
-        return { rows: selected, hasMore: rows.length > MAX_BATCH };
-      } catch (error) { await db.rollback(); throw error; }
-      finally { db.release(); }
-    });
-  }
-  return { record, read, clear, drain };
-}
+const MAX_BATCH = 200;
+
+export function relayDiagnostics(pool, onError = () => {}) {
+  let tail = Promise.resolve();
+  function validSource(source) {
+    if (!/^[a-z-]{1,32}$/.test(source)) throw new Error('Invalid diagnostic source');
+    return source;
+  }
+  function serialize(action) {
+    const result = tail.then(action);
+    tail = result.catch(error => { onError(error); });
+    return result;
+  }
+  function record(source, event, detail) {
+    validSource(source);
+    if (!/^[a-z-]{1,32}$/.test(event) || !/^[a-z0-9=;.-]{1,64}$/.test(detail)) throw new Error('Invalid diagnostic event');
+    return serialize(async () => {
+      await pool.execute('INSERT INTO relay_diagnostics (created_at,source,event,detail) VALUES (UTC_TIMESTAMP(3),?,?,?)', [source, event, detail]);
+      await pool.execute('DELETE FROM relay_diagnostics WHERE created_at < UTC_TIMESTAMP(3) - INTERVAL 1 DAY');
+    }).catch(() => {});
+  }
+  async function read(source) {
+    validSource(source);
+    return serialize(async () => {
+      const [rows] = await pool.execute(`SELECT id,created_at,source,event,detail FROM relay_diagnostics
+        WHERE source=? ORDER BY id LIMIT ${MAX_BATCH + 1}`, [source]);
+      return { rows: rows.slice(0, MAX_BATCH), hasMore: rows.length > MAX_BATCH };
+    });
+  }
+  async function clear(source) {
+    validSource(source);
+    return serialize(async () => {
+      const [result] = await pool.execute('DELETE FROM relay_diagnostics WHERE source=?', [source]);
+      return { cleared: result.affectedRows };
+    });
+  }
+  async function drain(source) {
+    validSource(source);
+    return serialize(async () => {
+      const db = await pool.getConnection();
+      try {
+        await db.beginTransaction();
+        const [rows] = await db.execute(`SELECT id,created_at,source,event,detail FROM relay_diagnostics
+          WHERE source=? ORDER BY id LIMIT ${MAX_BATCH + 1} FOR UPDATE`, [source]);
+        const selected = rows.slice(0, MAX_BATCH);
+        if (selected.length) await db.execute('DELETE FROM relay_diagnostics WHERE source=? AND id <= ?', [source, selected.at(-1).id]);
+        await db.commit();
+        return { rows: selected, hasMore: rows.length > MAX_BATCH };
+      } catch (error) { await db.rollback(); throw error; }
+      finally { db.release(); }
+    });
+  }
+  return { record, read, clear, drain };
+}

package/dist/src/self-relay/email-accounts.mjs

@@ -1,141 +1,158 @@
-import fs from 'node:fs';
-import { createHash, createHmac, randomBytes, randomInt, randomUUID, timingSafeEqual } from 'node:crypto';
-import { tencentAccountProvider } from '../../relay-admin/tencent-account-provider.mjs';
-
-const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
-const isoTime = value => value.replace(' ', 'T') + 'Z';
-const error = (status, message) => Object.assign(new Error(message), { status });
-const tokenHash = token => createHash('sha256').update(token).digest('hex');
-const normalizeEmail = value => {
-  if (typeof value !== 'string') throw error(400, 'Invalid email address');
-  const email = value.trim().toLowerCase();
-  if (email.length > 254 || !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(email)) {
-    throw error(400, 'Invalid email address');
-  }
-  return email;
-};
-
-export function openEmailAccounts(pool, configFile, providerOverride) {
-  const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
-  if (![config.secretId, config.secretKey, config.captchaAppSecretKey, config.fromEmailAddress, config.sesRegion]
-    .every(value => typeof value === 'string' && value.length > 0) ||
-    !Number.isSafeInteger(config.captchaAppId) || config.captchaAppId < 1 ||
-    !Number.isSafeInteger(config.emailTemplateId) || config.emailTemplateId < 1 ||
-    typeof config.codePepper !== 'string' || config.codePepper.length < 32) {
-    throw new Error('Incomplete relay account configuration');
-  }
-  const provider = providerOverride || tencentAccountProvider(config);
-  const codeHash = (email, code) => createHmac('sha256', config.codePepper).update(`${email}\0${code}`).digest('hex');
-  const scopeHash = value => createHmac('sha256', config.codePepper).update(value).digest('hex');
-
-  async function requestCode({ email: rawEmail, ticket, randstr }, ip) {
-    const email = normalizeEmail(rawEmail);
-    if (typeof ticket !== 'string' || !ticket || ticket.length > 2048 ||
-        typeof randstr !== 'string' || !randstr || randstr.length > 128) throw error(400, 'Invalid human verification');
-    if (!ip || ip.length > 64) throw error(400, 'Invalid client address');
-    // A cheap pre-check precedes the billable human verification.
-    const [recent] = await pool.execute('SELECT sent_at FROM email_login_challenges WHERE email = ? AND sent_at > UTC_TIMESTAMP(3) - INTERVAL 60 SECOND', [email]);
-    if (recent.length) throw error(429, 'Please wait before requesting another code');
-    const [ipLimit] = await pool.execute(`SELECT request_count FROM email_send_limits
-      WHERE scope_hash=? AND window_start>=UTC_TIMESTAMP() - INTERVAL 1 HOUR ORDER BY window_start DESC LIMIT 1`, [scopeHash(`ip:${ip}`)]);
-    if (ipLimit[0]?.request_count >= 20) throw error(429, 'Too many email requests');
-    if (!await provider.verifyHuman(ticket, randstr, ip)) throw error(403, 'Human verification failed');
-    const code = String(randomInt(0, 1000000)).padStart(6, '0');
-    const hash = codeHash(email, code);
-    const windowStart = sqlTime(new Date(Math.floor(Date.now() / 3600000) * 3600000).toISOString()).slice(0, 19);
-    const db = await pool.getConnection();
-    try {
-      await db.beginTransaction();
-      for (const [scope, limit] of [[`email:${email}`, 5], [`ip:${ip}`, 20]]) {
-        const key = scopeHash(scope);
-        await db.execute('INSERT INTO email_send_limits (scope_hash,window_start,request_count) VALUES (?,?,1) ON DUPLICATE KEY UPDATE request_count=request_count+1', [key, windowStart]);
-        const [rows] = await db.execute('SELECT request_count FROM email_send_limits WHERE scope_hash=? AND window_start=? FOR UPDATE', [key, windowStart]);
-        if (rows[0].request_count > limit) throw error(429, 'Too many email requests');
-      }
-      const [existing] = await db.execute('SELECT sent_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
-      if (existing.length && Date.now() - new Date(`${existing[0].sent_at.replace(' ', 'T')}Z`).getTime() < 60000) {
-        throw error(429, 'Please wait before requesting another code');
-      }
-      await db.execute(`INSERT INTO email_login_challenges (email,code_hash,expires_at,attempts,sent_at)
-        VALUES (?, ?, UTC_TIMESTAMP(3) + INTERVAL 10 MINUTE, 0, UTC_TIMESTAMP(3))
-        ON DUPLICATE KEY UPDATE code_hash=VALUES(code_hash),expires_at=VALUES(expires_at),attempts=0,sent_at=VALUES(sent_at)`, [email, hash]);
-      await db.commit();
-    } catch (failure) { await db.rollback(); throw failure; }
-    finally { db.release(); }
-    try { await provider.sendLoginCode(email, code); }
-    catch (failure) {
-      await pool.execute('DELETE FROM email_login_challenges WHERE email=? AND code_hash=?', [email, hash]);
-      throw error(503, 'Email delivery unavailable');
-    }
-    return { sent: true, expiresInSeconds: 600 };
-  }
-
-  async function verifyCode({ email: rawEmail, code }) {
-    const email = normalizeEmail(rawEmail);
-    if (typeof code !== 'string' || !/^\d{6}$/.test(code)) throw error(400, 'Invalid code');
-    const db = await pool.getConnection();
-    try {
-      await db.beginTransaction();
-      const [challenges] = await db.execute('SELECT code_hash,attempts,expires_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
-      const challenge = challenges[0];
-      if (!challenge || new Date(`${challenge.expires_at.replace(' ', 'T')}Z`).getTime() <= Date.now()) throw error(401, 'Code expired or incorrect');
-      const supplied = Buffer.from(codeHash(email, code), 'hex');
-      if (!timingSafeEqual(supplied, Buffer.from(challenge.code_hash, 'hex'))) {
-        if (challenge.attempts >= 4) await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
-        else await db.execute('UPDATE email_login_challenges SET attempts=attempts+1 WHERE email=?', [email]);
-        await db.commit();
-        throw error(401, 'Code expired or incorrect');
-      }
-      await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
-      const [identities] = await db.execute(`SELECT u.id,u.status FROM user_login_identities i
-        JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?`, [email]);
-      let userId = identities[0]?.id;
-      if (identities[0]?.status === 'disabled') throw error(403, 'Account unavailable');
-      if (!userId) {
-        userId = randomUUID();
-        await db.execute('INSERT INTO users (id,status,created_at,updated_at) VALUES (?,\'active\',UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))', [userId]);
-        await db.execute(`INSERT INTO user_login_identities (user_id,kind,normalized_value,verified_at,created_at)
-          VALUES (?,'email',?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))`, [userId, email]);
-      }
-      const token = randomBytes(32).toString('base64url');
-      await db.execute(`INSERT INTO user_sessions (token_hash,user_id,created_at,expires_at)
-        VALUES (?,?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3) + INTERVAL 30 DAY)`, [tokenHash(token), userId]);
-      await db.commit();
-      return { token, user: { id: userId, email }, expiresInSeconds: 30 * 86400 };
-    } catch (failure) { await db.rollback(); throw failure; }
-    finally { db.release(); }
-  }
-
-  async function current(token) {
-    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) throw error(401, 'Unauthorized');
-    const [rows] = await pool.execute(`SELECT u.id,i.normalized_value AS email,s.expires_at FROM user_sessions s
-      JOIN users u ON u.id=s.user_id JOIN user_login_identities i ON i.user_id=u.id AND i.kind='email'
-      WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>UTC_TIMESTAMP(3) AND u.status='active'`, [tokenHash(token)]);
-    if (!rows.length) throw error(401, 'Unauthorized');
-    return { id: rows[0].id, email: rows[0].email, expiresAt: isoTime(rows[0].expires_at) };
-  }
-
-  async function usage(userId) {
-    const [settings] = await pool.query('SELECT mode FROM relay_usage_settings WHERE id=1');
-    if (settings.length !== 1) throw new Error('Missing relay usage settings');
-    const [budgets] = await pool.execute(`SELECT period_start,period_end,limit_seconds,used_seconds FROM relay_usage_budgets
-      WHERE user_id=? AND period_start<=UTC_TIMESTAMP(3) AND period_end>UTC_TIMESTAMP(3)
-      ORDER BY period_start DESC LIMIT 2`, [userId]);
-    if (budgets.length > 1) throw new Error('Overlapping relay usage budgets');
-    const budget = budgets[0];
-    const [totals] = await pool.execute('SELECT task_seconds FROM relay_usage_totals WHERE user_id=?', [userId]);
-    return { mode: settings[0].mode, periodStart: budget ? isoTime(budget.period_start) : null,
-      periodEnd: budget ? isoTime(budget.period_end) : null,
-      limitSeconds: budget?.limit_seconds == null ? null : Number(budget.limit_seconds),
-      usedSeconds: budget ? Number(budget.used_seconds) : 0,
-      taskSeconds: Number(totals[0]?.task_seconds || 0) };
-  }
-
-  async function logout(token) {
-    await current(token);
-    await pool.execute('UPDATE user_sessions SET revoked_at=UTC_TIMESTAMP(3) WHERE token_hash=? AND revoked_at IS NULL', [tokenHash(token)]);
-    return { ok: true };
-  }
-
-  return { captchaAppId: config.captchaAppId, requestCode, verifyCode, current, usage, logout };
-}
+import fs from 'node:fs';
+import { createHash, createHmac, randomBytes, randomInt, randomUUID, timingSafeEqual } from 'node:crypto';
+import { tencentAccountProvider } from '../../relay-admin/tencent-account-provider.mjs';
+
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const isoTime = value => value.replace(' ', 'T') + 'Z';
+const error = (status, message) => Object.assign(new Error(message), { status });
+const tokenHash = token => createHash('sha256').update(token).digest('hex');
+const normalizeEmail = value => {
+  if (typeof value !== 'string') throw error(400, 'Invalid email address');
+  const email = value.trim().toLowerCase();
+  if (email.length > 254 || !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(email)) {
+    throw error(400, 'Invalid email address');
+  }
+  return email;
+};
+
+export function openEmailAccounts(pool, configFile, providerOverride) {
+  const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  if (![config.secretId, config.secretKey, config.captchaAppSecretKey, config.fromEmailAddress, config.sesRegion]
+    .every(value => typeof value === 'string' && value.length > 0) ||
+    !Number.isSafeInteger(config.captchaAppId) || config.captchaAppId < 1 ||
+    !Number.isSafeInteger(config.emailTemplateId) || config.emailTemplateId < 1 ||
+    typeof config.codePepper !== 'string' || config.codePepper.length < 32) {
+    throw new Error('Incomplete relay account configuration');
+  }
+  const provider = providerOverride || tencentAccountProvider(config);
+  const codeHash = (email, code) => createHmac('sha256', config.codePepper).update(`${email}\0${code}`).digest('hex');
+  const scopeHash = value => createHmac('sha256', config.codePepper).update(value).digest('hex');
+
+  async function requestCode({ email: rawEmail, ticket, randstr }, ip) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof ticket !== 'string' || !ticket || ticket.length > 2048 ||
+        typeof randstr !== 'string' || !randstr || randstr.length > 128) throw error(400, 'Invalid human verification');
+    if (!ip || ip.length > 64) throw error(400, 'Invalid client address');
+    const [identities] = await pool.execute("SELECT u.status FROM user_login_identities i JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?", [email]);
+    if (identities[0]?.status === 'cancelled') throw error(409, '该邮箱关联的账号正在注销清理中，暂时无法注册或登录。相关信息将在注销后7天内删除，清理完成后可重新注册。');
+    // A cheap pre-check precedes the billable human verification.
+    const [recent] = await pool.execute('SELECT sent_at FROM email_login_challenges WHERE email = ? AND sent_at > UTC_TIMESTAMP(3) - INTERVAL 60 SECOND', [email]);
+    if (recent.length) throw error(429, 'Please wait before requesting another code');
+    const [ipLimit] = await pool.execute(`SELECT request_count FROM email_send_limits
+      WHERE scope_hash=? AND window_start>=UTC_TIMESTAMP() - INTERVAL 1 HOUR ORDER BY window_start DESC LIMIT 1`, [scopeHash(`ip:${ip}`)]);
+    if (ipLimit[0]?.request_count >= 20) throw error(429, 'Too many email requests');
+    if (!await provider.verifyHuman(ticket, randstr, ip)) throw error(403, 'Human verification failed');
+    const code = String(randomInt(0, 1000000)).padStart(6, '0');
+    const hash = codeHash(email, code);
+    const windowStart = sqlTime(new Date(Math.floor(Date.now() / 3600000) * 3600000).toISOString()).slice(0, 19);
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      for (const [scope, limit] of [[`email:${email}`, 5], [`ip:${ip}`, 20]]) {
+        const key = scopeHash(scope);
+        await db.execute('INSERT INTO email_send_limits (scope_hash,window_start,request_count) VALUES (?,?,1) ON DUPLICATE KEY UPDATE request_count=request_count+1', [key, windowStart]);
+        const [rows] = await db.execute('SELECT request_count FROM email_send_limits WHERE scope_hash=? AND window_start=? FOR UPDATE', [key, windowStart]);
+        if (rows[0].request_count > limit) throw error(429, 'Too many email requests');
+      }
+      const [existing] = await db.execute('SELECT sent_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      if (existing.length && Date.now() - new Date(`${existing[0].sent_at.replace(' ', 'T')}Z`).getTime() < 60000) {
+        throw error(429, 'Please wait before requesting another code');
+      }
+      await db.execute(`INSERT INTO email_login_challenges (email,code_hash,expires_at,attempts,sent_at)
+        VALUES (?, ?, UTC_TIMESTAMP(3) + INTERVAL 10 MINUTE, 0, UTC_TIMESTAMP(3))
+        ON DUPLICATE KEY UPDATE code_hash=VALUES(code_hash),expires_at=VALUES(expires_at),attempts=0,sent_at=VALUES(sent_at)`, [email, hash]);
+      await db.commit();
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+    try { await provider.sendLoginCode(email, code); }
+    catch (failure) {
+      await pool.execute('DELETE FROM email_login_challenges WHERE email=? AND code_hash=?', [email, hash]);
+      throw error(503, 'Email delivery unavailable');
+    }
+    return { sent: true, expiresInSeconds: 600 };
+  }
+
+  async function verifyCode({ email: rawEmail, code }) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof code !== 'string' || !/^\d{6}$/.test(code)) throw error(400, 'Invalid code');
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [challenges] = await db.execute('SELECT code_hash,attempts,expires_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      const challenge = challenges[0];
+      if (!challenge || new Date(`${challenge.expires_at.replace(' ', 'T')}Z`).getTime() <= Date.now()) throw error(401, 'Code expired or incorrect');
+      const supplied = Buffer.from(codeHash(email, code), 'hex');
+      if (!timingSafeEqual(supplied, Buffer.from(challenge.code_hash, 'hex'))) {
+        if (challenge.attempts >= 4) await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        else await db.execute('UPDATE email_login_challenges SET attempts=attempts+1 WHERE email=?', [email]);
+        await db.commit();
+        throw error(401, 'Code expired or incorrect');
+      }
+      await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+      const [identities] = await db.execute(`SELECT u.id,u.status FROM user_login_identities i
+        JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?`, [email]);
+      let userId = identities[0]?.id;
+      if (identities[0]?.status === 'cancelled') throw error(409, '该邮箱关联的账号正在注销清理中，暂时无法注册或登录。相关信息将在注销后7天内删除，清理完成后可重新注册。');
+      if (identities[0]?.status === 'disabled') throw error(403, 'Account unavailable');
+      if (!userId) {
+        userId = randomUUID();
+        await db.execute('INSERT INTO users (id,status,created_at,updated_at) VALUES (?,\'active\',UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))', [userId]);
+        await db.execute(`INSERT INTO user_login_identities (user_id,kind,normalized_value,verified_at,created_at)
+          VALUES (?,'email',?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))`, [userId, email]);
+      }
+      const token = randomBytes(32).toString('base64url');
+      await db.execute(`INSERT INTO user_sessions (token_hash,user_id,created_at,expires_at)
+        VALUES (?,?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3) + INTERVAL 30 DAY)`, [tokenHash(token), userId]);
+      await db.commit();
+      return { token, user: { id: userId, email }, expiresInSeconds: 30 * 86400 };
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+  }
+
+  async function current(token) {
+    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) throw error(401, 'Unauthorized');
+    const [rows] = await pool.execute(`SELECT u.id,i.normalized_value AS email,s.expires_at FROM user_sessions s
+      JOIN users u ON u.id=s.user_id JOIN user_login_identities i ON i.user_id=u.id AND i.kind='email'
+      WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>UTC_TIMESTAMP(3) AND u.status='active'`, [tokenHash(token)]);
+    if (!rows.length) throw error(401, 'Unauthorized');
+    return { id: rows[0].id, email: rows[0].email, expiresAt: isoTime(rows[0].expires_at) };
+  }
+
+  async function usage(userId) {
+    const [settings] = await pool.query('SELECT mode FROM relay_usage_settings WHERE id=1');
+    if (settings.length !== 1) throw new Error('Missing relay usage settings');
+    const [budgets] = await pool.execute(`SELECT period_start,period_end,limit_seconds,used_seconds FROM relay_usage_budgets
+      WHERE user_id=? AND period_start<=UTC_TIMESTAMP(3) AND period_end>UTC_TIMESTAMP(3)
+      ORDER BY period_start DESC LIMIT 2`, [userId]);
+    if (budgets.length > 1) throw new Error('Overlapping relay usage budgets');
+    const budget = budgets[0];
+    const [totals] = await pool.execute('SELECT task_seconds FROM relay_usage_totals WHERE user_id=?', [userId]);
+    return { mode: settings[0].mode, periodStart: budget ? isoTime(budget.period_start) : null,
+      periodEnd: budget ? isoTime(budget.period_end) : null,
+      limitSeconds: budget?.limit_seconds == null ? null : Number(budget.limit_seconds),
+      usedSeconds: budget ? Number(budget.used_seconds) : 0,
+      taskSeconds: Number(totals[0]?.task_seconds || 0) };
+  }
+
+  async function logout(token) {
+    await current(token);
+    await pool.execute('UPDATE user_sessions SET revoked_at=UTC_TIMESTAMP(3) WHERE token_hash=? AND revoked_at IS NULL', [tokenHash(token)]);
+    return { ok: true };
+  }
+
+  async function cancelAccount(token) {
+    const user = await current(token);
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      await db.execute("UPDATE users SET status='cancelled',cancelled_at=UTC_TIMESTAMP(3),updated_at=UTC_TIMESTAMP(3) WHERE id=? AND status='active'", [user.id]);
+      await db.execute('UPDATE user_sessions SET revoked_at=COALESCE(revoked_at,UTC_TIMESTAMP(3)) WHERE user_id=?', [user.id]);
+      await db.execute('UPDATE relay_usage_sessions SET ended_at=confirmed_until WHERE user_id=? AND ended_at IS NULL', [user.id]);
+      await db.commit();
+      return { ok: true };
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+  }
+
+  return { captchaAppId: config.captchaAppId, requestCode, verifyCode, current, usage, logout, cancelAccount };
+}

package/dist/src/self-relay/privacy-page.mjs

@@ -0,0 +1,26 @@
+// Public policy page: no scripts, cookies, external assets or native bridge.
+export const privacyPage = `<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="light dark"><title>Code Relax 隐私政策</title>
+<style>:root{--page-background:#ffffff;--primary-text:#202520;--secondary-text:#667066;--surface-border:#d5ddd8;--space:16px;--body:14px;--title:20px}@media(prefers-color-scheme:dark){:root{--page-background:#181d1a;--primary-text:#eef4ef;--secondary-text:#a5afa7;--surface-border:#354139}}*{box-sizing:border-box}body{margin:0;padding:24px var(--space);background:var(--page-background);color:var(--primary-text);font:var(--body)/1.8 system-ui,sans-serif;overflow-wrap:anywhere}main{max-width:720px;margin:auto}h1{font-size:var(--title)}h2{font-size:16px;margin-top:24px}p,li{margin-block:8px}.meta{color:var(--secondary-text)}a{color:inherit}footer{margin-top:24px;border-top:1px solid var(--surface-border);padding-top:var(--space)}</style></head><body><main>
+<h1>Code Relax 隐私政策</h1><p class="meta">更新及生效日期：2026 年 9 月 26 日<br>运营者：房鹤<br>联系邮箱：wyshmily@126.com</p>
+<p>Code Relax 用于通过手机访问您已授权的电脑上的 Codex。本文说明当前私测版本如何处理信息。请在使用邮箱账号、配对、语音、图片或文件功能前阅读；相关权限在您使用对应功能时申请。</p>
+<h2>一、我们处理哪些信息</h2>
+<ul><li><strong>邮箱账号：</strong>邮箱地址、验证状态、账号标识、登录会话及验证码校验记录，用于登录、身份校验和注销。验证码不以明文保存；服务端保存登录令牌的哈希。</li>
+<li><strong>工作站配对：</strong>工作站标识、名称、连接地址和配对授权标识，用于发现、鉴权和重新连接。工作站及手机凭据保存在各自设备的受保护存储中，云端保存凭据哈希。</li>
+<li><strong>聊天与附件：</strong>您输入的文本、所选图片或文件、Codex 的回复和工具状态，用于远程交互。局域网直连不经过 Code Relax 云中继；使用 Code Relax 中继时，业务数据可能经服务器转发，采用 TLS 传输，目前不提供端到端加密。中继不以聊天历史库或附件库的形式保存这些内容。工作站会保存收到的附件，Codex 历史由电脑上的 Codex 管理。</li>
+<li><strong>用量与诊断：</strong>账号、工作站、手机授权标识、消息/轮次标识、数量、任务时长及时间记录，用于展示服务用量与排障；服务还会产生必要的连接、错误和访问日志，可能包含 IP 地址、设备标识和时间。我们不以用量统计为目的记录聊天正文。</li>
+<li><strong>手机缓存：</strong>手机保留配对记录、账号凭据、展示历史、缩略图和诊断日志，以支持恢复和显示。当前历史与图片缓存有容量淘汰策略，缓存并非电脑原始历史的唯一副本。</li></ul>
+<h2>二、权限与第三方服务</h2>
+<p>扫码时使用相机，语音录入时使用麦克风与华为系统语音识别，添加附件时读取您选择的图片或文件。语音识别由手机系统能力完成，识别结果用于输入框；Code Relax 不建立云端录音库。系统服务自身的信息处理以对应服务说明为准。</p>
+<p>邮箱验证码使用腾讯云邮件推送；人机验证使用腾讯云验证码服务，涉及邮箱、IP 及验证票据等完成验证所需信息。服务部署于腾讯云基础设施。使用 OpenAI 登录、官方中继及 Codex 时，相关账号与业务数据由 OpenAI 按其政策处理；Code Relax 邮箱账号不等于 OpenAI 账号。我们不出售您的个人信息，不使用广告 SDK。</p>
+<h2>三、保存和删除</h2>
+<p>邮箱账号信息与账号用量明细在账号存续期间保存。注销后账号立即停用，相关个人信息及账号用量记录将在7天内删除。清理期间该邮箱暂时无法注册或登录；清理完成后，同一邮箱可重新注册为新用户，不继承原账号记录或额度。登录会话有效期为 30 天，邮件验证码有效期为 10 分钟；有效期指授权或验证有效时间，不代表数据库记录恰好在该时刻物理清除。安全限流记录、诊断及系统日志按其用途和清理策略保留；您可通过上述邮箱申请查询或删除与您相关的信息。</p>
+<p>服务器部署会生成受访问限制的数据库备份，仅用于故障恢复；这些备份定时过期清理，注销相关账号数据及备份副本的清理纳入上述7天期限。</p>
+<h2>四、账号注销与您的选择</h2>
+<p>您可在“我的账号 → 注销账号”确认注销。确认后账号被标记为已注销，全部登录会话失效，停止账号计时并断开该账号中继业务连接；如有管理员权限，也不能继续使用。邮箱登录身份、会话、账号用量和账号关联记录将在7天内删除；7天是最长期限，不代表必须保留满7天。清理完成前不能用同一邮箱注册或登录，清理完成后可重新注册。</p>
+<p><strong>注销 Code Relax 账号不会删除电脑上的 Codex 对话和文件、OpenAI 账号，也不会撤销独立的工作站与手机配对授权。</strong>如需撤销配对，请在工作站授权管理中处理。工作站级汇总统计与独立设备授权记录可能继续保留；这些记录不应被理解为完全匿名数据。手机已有历史缓存也不会因邮箱账号注销而全部清除；可通过清除 App 数据或卸载清理本地数据，此操作会丢失本机保存的配对凭据。</p>
+<p>您可联系运营者申请查询、更正、删除相关个人信息、说明保存期限或提出投诉。我们会核验请求者身份，并在收到有效请求后 15 个工作日内答复处理情况；必要的核验只用于保护您的账号与数据。</p>
+<h2>五、政策更新</h2>
+<p>当处理目的、信息类型或服务发生变化时，我们会更新本页面，并按变化情况在应用中告知、取得必要的授权。本页面的说明必须与实际功能一致；未启用的社区、广告或付费功能不作为本政策已实施的内容。</p>
+<footer>运营者：房鹤<br>个人信息与账号问题：wyshmily@126.com</footer>
+</main></body></html>`;