@walkhi/code-relax 0.1.0-beta.3 → 0.1.0-beta.30

package/dist/src/self-relay/debug-allowlist.mjs

@@ -1,33 +1,33 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { validId } from './device-store.mjs';
-
-export function readDebugAllowlist(file) {
-  if (!file || !fs.existsSync(file)) return { version: 1, devices: [] };
-  const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-  if (value.version !== 1 || !Array.isArray(value.devices) || value.devices.some(entry => !validId(entry.deviceId))) {
-    throw new Error('Invalid debug allowlist');
-  }
-  return value;
-}
-
-export function debugAllowed(allowlist, deviceId, client) {
-  return Boolean(client && allowlist.devices.some(entry => entry.deviceId === deviceId));
-}
-
-// Administrator-only file; never invoked by the relay wire protocol or Desktop CLI.
-export function updateDebugAllowlist(file, deviceId, enabled) {
-  if (!validId(deviceId)) throw new Error('Invalid debug device');
-  const value = readDebugAllowlist(file);
-  const previous = fs.existsSync(file) ? fs.statSync(file) : null;
-  value.devices = value.devices.filter(entry => entry.deviceId !== deviceId);
-  if (enabled) value.devices.push({ deviceId });
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const temporary = `${file}.${randomUUID()}.tmp`;
-  try {
-    fs.writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { mode: 0o640, flag: 'wx' });
-    if (previous && process.platform !== 'win32') fs.chownSync(temporary, previous.uid, previous.gid);
-    fs.renameSync(temporary, file);
-  } finally { fs.rmSync(temporary, { force: true }); }
-}
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { validId } from './device-store.mjs';
+
+export function readDebugAllowlist(file) {
+  if (!file || !fs.existsSync(file)) return { version: 1, devices: [] };
+  const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (value.version !== 1 || !Array.isArray(value.devices) || value.devices.some(entry => !validId(entry.deviceId))) {
+    throw new Error('Invalid debug allowlist');
+  }
+  return value;
+}
+
+export function debugAllowed(allowlist, deviceId, client) {
+  return Boolean(client && allowlist.devices.some(entry => entry.deviceId === deviceId));
+}
+
+// Administrator-only file; never invoked by the relay wire protocol or Desktop CLI.
+export function updateDebugAllowlist(file, deviceId, enabled) {
+  if (!validId(deviceId)) throw new Error('Invalid debug device');
+  const value = readDebugAllowlist(file);
+  const previous = fs.existsSync(file) ? fs.statSync(file) : null;
+  value.devices = value.devices.filter(entry => entry.deviceId !== deviceId);
+  if (enabled) value.devices.push({ deviceId });
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    fs.writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { mode: 0o640, flag: 'wx' });
+    if (previous && process.platform !== 'win32') fs.chownSync(temporary, previous.uid, previous.gid);
+    fs.renameSync(temporary, file);
+  } finally { fs.rmSync(temporary, { force: true }); }
+}

package/dist/src/self-relay/demo.mjs

@@ -6,8 +6,8 @@ import { connectBridgeRelay } from './connector.mjs';
 import { connectRelayClient } from './client.mjs';
 import { secret } from './wire.mjs';
 
-export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispatch, remoteRelay, hostName = 'TEST-PC', lanCandidates = [], relayOptions = {} } = {}) {
-  if (!['lan-legacy', 'lan-shared'].includes(mode)) throw new Error('Invalid demo mode');
+export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispatch, remoteRelay, hostName = 'TEST-PC', lanCandidates = [], relayOptions = {} } = {}) {
+  if (mode !== 'lan-shared') throw new Error('Invalid demo mode');
   const token = secret(), calls = [];
   const bridge = http.createServer((_request, response) => { response.writeHead(404); response.end(); });
   const lan = attachLanSocket(bridge, { token, dispatch: async (request, reply) => {
@@ -17,16 +17,15 @@ export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispat
     if (request.url.split('?')[0] === '/api/threads/demo/events') {
       reply.startEvents(); reply.event('update', { thread: { id: 'demo' }, simulated: true }); return;
     }
-    if (request.url === '/api/demo/stop') return reply.json(mode === 'lan-shared' ? 200 : 409,
-      mode === 'lan-shared' ? { stopped: true, simulated: true } : { error: '基础控制不支持停止任务' });
-    reply.json(404, { error: '模拟 Bridge 不执行真实任务' });
+    if (request.url === '/api/demo/stop') return reply.json(200, { stopped: true, simulated: true });
+    reply.json(404, { error: '模拟桌面服务不执行真实任务' });
   } });
   await new Promise(resolve => bridge.listen(0, '127.0.0.1', resolve));
-  const relay = remoteRelay ? { ...remoteRelay, async close() {} } : await startSelfRelay({ pairingTtlMs, ...relayOptions });
+  const relay = remoteRelay ? { ...remoteRelay, async close() {} } : await startSelfRelay({ pairingTtlMs, ...relayOptions });
   const bridgeUrl = `ws://127.0.0.1:${bridge.address().port}/api/socket`;
   const identity = remoteRelay ? { id: randomUUID(), secret: secret() } : undefined;
   const clientId = randomUUID(), credential = secret();
-  const connector = connectBridgeRelay({ identity, relayUrl: relay.url, hostKey: relay.hostKey, bridgeUrl, bridgeToken: token, hostName, lanCandidates });
+  const connector = connectBridgeRelay({ identity, relayUrl: relay.url, hostKey: relay.hostKey, bridgeUrl, bridgeToken: token, hostName, lanCandidates });
   let pairing;
   try { pairing = await connector.ready; }
   catch (error) { connector.close(); await relay.close(); lan.close(); await new Promise(resolve => bridge.close(resolve)); throw error; }

package/dist/src/self-relay/device-store.mjs

@@ -1,84 +1,84 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-
-export const validId = value => typeof value === 'string' && /^[\w-]{16,128}$/.test(value);
-const hash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
-export function deviceStore(file, { initialize = false } = {}) {
-  let devices = new Map();
-  function validate(record) {
-    if (!validId(record.id) || !hash(record.hostHash) || !['active', 'revoked'].includes(record.status) ||
-        !Number.isSafeInteger(record.revision) || record.revision < 0 ||
-        !Array.isArray(record.clients) || record.clients.length > 16 ||
-        record.clients.some(client => !validId(client.id) || !hash(client.hash) ||
-          !Number.isFinite(Date.parse(client.createdAt)) || !Number.isFinite(Date.parse(client.updatedAt))) ||
-        new Set(record.clients.map(client => client.id)).size !== record.clients.length ||
-        !Number.isFinite(Date.parse(record.createdAt)) || !Number.isFinite(Date.parse(record.updatedAt)) ||
-        !validOfficialComputer(record.officialComputer)) {
-      throw new Error('Invalid relay device record');
-    }
-  }
-  function write(next) {
-    if (!file) return;
-    const temporary = `${file}.${randomUUID()}.tmp`;
-    let fd;
-    try {
-      fd = fs.openSync(temporary, 'wx', 0o600);
-      fs.writeFileSync(fd, JSON.stringify({ version: 4, devices: [...next.values()] }));
-      fs.fsyncSync(fd); fs.closeSync(fd); fd = undefined;
-      fs.renameSync(temporary, file);
-      if (process.platform !== 'win32') {
-        const directory = fs.openSync(path.dirname(file), 'r');
-        try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); }
-      }
-    } finally {
-      if (fd !== undefined) fs.closeSync(fd);
-      fs.rmSync(temporary, { force: true });
-    }
-  }
-  if (file) {
-    if (!fs.existsSync(file)) {
-      if (!initialize) throw new Error('Device store missing; explicit --init-state required for first installation');
-      fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 }); write(devices);
-    } else {
-      if (initialize) throw new Error('Device store already exists; initialization refused');
-      const saved = JSON.parse(fs.readFileSync(file, 'utf8'));
-      if (![2, 3, 4].includes(saved.version) || !Array.isArray(saved.devices)) throw new Error('Invalid relay device store version');
-      for (const source of saved.devices) {
-        const record = saved.version === 2 ? {
-          ...source,
-          clients: source.clientHash == null ? [] : [{
-            id: source.clientId,
-            hash: source.clientHash,
-            createdAt: source.updatedAt,
-            updatedAt: source.updatedAt,
-          }],
-        } : source;
-        delete record.clientHash; delete record.clientId;
-        validate(record);
-        if (devices.has(record.id)) throw new Error('Duplicate relay device identity');
-        devices.set(record.id, record);
-      }
-    }
-  }
-  return {
-    entries: () => [...devices.values()],
-    // Synchronous single-writer commit: publish only after durable replacement.
-    save(record) {
-      validate(record);
-      const next = new Map(devices); next.set(record.id, record); write(next); devices = next;
-    },
-  };
-}
-
-function validOfficialComputer(value) {
-  if (value === undefined) return true;
-  return value && typeof value === 'object' && plain(value.environmentId, 256, false) &&
-    plain(value.name, 80, true) && plain(value.hostname, 80, true) &&
-    Number.isFinite(Date.parse(value.updatedAt));
-}
-
-function plain(value, limit, empty) {
-  return typeof value === 'string' && (empty || value.trim().length > 0) &&
-    value.trim().length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
-}
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const validId = value => typeof value === 'string' && /^[\w-]{16,128}$/.test(value);
+const hash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+export function deviceStore(file, { initialize = false } = {}) {
+  let devices = new Map();
+  function validate(record) {
+    if (!validId(record.id) || !hash(record.hostHash) || !['active', 'revoked'].includes(record.status) ||
+        !Number.isSafeInteger(record.revision) || record.revision < 0 ||
+        !Array.isArray(record.clients) || record.clients.length > 16 ||
+        record.clients.some(client => !validId(client.id) || !hash(client.hash) ||
+          !Number.isFinite(Date.parse(client.createdAt)) || !Number.isFinite(Date.parse(client.updatedAt))) ||
+        new Set(record.clients.map(client => client.id)).size !== record.clients.length ||
+        !Number.isFinite(Date.parse(record.createdAt)) || !Number.isFinite(Date.parse(record.updatedAt)) ||
+        !validOfficialComputer(record.officialComputer)) {
+      throw new Error('Invalid relay device record');
+    }
+  }
+  function write(next) {
+    if (!file) return;
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    let fd;
+    try {
+      fd = fs.openSync(temporary, 'wx', 0o600);
+      fs.writeFileSync(fd, JSON.stringify({ version: 4, devices: [...next.values()] }));
+      fs.fsyncSync(fd); fs.closeSync(fd); fd = undefined;
+      fs.renameSync(temporary, file);
+      if (process.platform !== 'win32') {
+        const directory = fs.openSync(path.dirname(file), 'r');
+        try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); }
+      }
+    } finally {
+      if (fd !== undefined) fs.closeSync(fd);
+      fs.rmSync(temporary, { force: true });
+    }
+  }
+  if (file) {
+    if (!fs.existsSync(file)) {
+      if (!initialize) throw new Error('Device store missing; explicit --init-state required for first installation');
+      fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 }); write(devices);
+    } else {
+      if (initialize) throw new Error('Device store already exists; initialization refused');
+      const saved = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (![2, 3, 4].includes(saved.version) || !Array.isArray(saved.devices)) throw new Error('Invalid relay device store version');
+      for (const source of saved.devices) {
+        const record = saved.version === 2 ? {
+          ...source,
+          clients: source.clientHash == null ? [] : [{
+            id: source.clientId,
+            hash: source.clientHash,
+            createdAt: source.updatedAt,
+            updatedAt: source.updatedAt,
+          }],
+        } : source;
+        delete record.clientHash; delete record.clientId;
+        validate(record);
+        if (devices.has(record.id)) throw new Error('Duplicate relay device identity');
+        devices.set(record.id, record);
+      }
+    }
+  }
+  return {
+    entries: () => [...devices.values()],
+    // Synchronous single-writer commit: publish only after durable replacement.
+    save(record) {
+      validate(record);
+      const next = new Map(devices); next.set(record.id, record); write(next); devices = next;
+    },
+  };
+}
+
+function validOfficialComputer(value) {
+  if (value === undefined) return true;
+  return value && typeof value === 'object' && plain(value.environmentId, 256, false) &&
+    plain(value.name, 80, true) && plain(value.hostname, 80, true) &&
+    Number.isFinite(Date.parse(value.updatedAt));
+}
+
+function plain(value, limit, empty) {
+  return typeof value === 'string' && (empty || value.trim().length > 0) &&
+    value.trim().length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
+}

package/dist/src/self-relay/diagnostics.mjs

@@ -0,0 +1,54 @@
+const MAX_BATCH = 200;
+
+export function relayDiagnostics(pool, onError = () => {}) {
+  let tail = Promise.resolve();
+  function validSource(source) {
+    if (!/^[a-z-]{1,32}$/.test(source)) throw new Error('Invalid diagnostic source');
+    return source;
+  }
+  function serialize(action) {
+    const result = tail.then(action);
+    tail = result.catch(error => { onError(error); });
+    return result;
+  }
+  function record(source, event, detail) {
+    validSource(source);
+    if (!/^[a-z-]{1,32}$/.test(event) || !/^[a-z0-9=;.-]{1,64}$/.test(detail)) throw new Error('Invalid diagnostic event');
+    return serialize(async () => {
+      await pool.execute('INSERT INTO relay_diagnostics (created_at,source,event,detail) VALUES (UTC_TIMESTAMP(3),?,?,?)', [source, event, detail]);
+      await pool.execute('DELETE FROM relay_diagnostics WHERE created_at < UTC_TIMESTAMP(3) - INTERVAL 1 DAY');
+    }).catch(() => {});
+  }
+  async function read(source) {
+    validSource(source);
+    return serialize(async () => {
+      const [rows] = await pool.execute(`SELECT id,created_at,source,event,detail FROM relay_diagnostics
+        WHERE source=? ORDER BY id LIMIT ${MAX_BATCH + 1}`, [source]);
+      return { rows: rows.slice(0, MAX_BATCH), hasMore: rows.length > MAX_BATCH };
+    });
+  }
+  async function clear(source) {
+    validSource(source);
+    return serialize(async () => {
+      const [result] = await pool.execute('DELETE FROM relay_diagnostics WHERE source=?', [source]);
+      return { cleared: result.affectedRows };
+    });
+  }
+  async function drain(source) {
+    validSource(source);
+    return serialize(async () => {
+      const db = await pool.getConnection();
+      try {
+        await db.beginTransaction();
+        const [rows] = await db.execute(`SELECT id,created_at,source,event,detail FROM relay_diagnostics
+          WHERE source=? ORDER BY id LIMIT ${MAX_BATCH + 1} FOR UPDATE`, [source]);
+        const selected = rows.slice(0, MAX_BATCH);
+        if (selected.length) await db.execute('DELETE FROM relay_diagnostics WHERE source=? AND id <= ?', [source, selected.at(-1).id]);
+        await db.commit();
+        return { rows: selected, hasMore: rows.length > MAX_BATCH };
+      } catch (error) { await db.rollback(); throw error; }
+      finally { db.release(); }
+    });
+  }
+  return { record, read, clear, drain };
+}

package/dist/src/self-relay/email-accounts.mjs

@@ -0,0 +1,183 @@
+import fs from 'node:fs';
+import { createHash, createHmac, randomBytes, randomInt, randomUUID, timingSafeEqual } from 'node:crypto';
+import { tencentAccountProvider } from '../../relay-admin/tencent-account-provider.mjs';
+
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const isoTime = value => value.replace(' ', 'T') + 'Z';
+const error = (status, message) => Object.assign(new Error(message), { status });
+const tokenHash = token => createHash('sha256').update(token).digest('hex');
+const normalizeEmail = value => {
+  if (typeof value !== 'string') throw error(400, 'Invalid email address');
+  const email = value.trim().toLowerCase();
+  if (email.length > 254 || !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(email)) {
+    throw error(400, 'Invalid email address');
+  }
+  return email;
+};
+
+export function openEmailAccounts(pool, configFile, providerOverride) {
+  const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  if (![config.secretId, config.secretKey, config.captchaAppSecretKey, config.fromEmailAddress, config.sesRegion]
+    .every(value => typeof value === 'string' && value.length > 0) ||
+    !Number.isSafeInteger(config.captchaAppId) || config.captchaAppId < 1 ||
+    !Number.isSafeInteger(config.emailTemplateId) || config.emailTemplateId < 1 ||
+    typeof config.codePepper !== 'string' || config.codePepper.length < 32) {
+    throw new Error('Incomplete relay account configuration');
+  }
+  const provider = providerOverride || tencentAccountProvider(config);
+  const codeHash = (email, code) => createHmac('sha256', config.codePepper).update(`${email}\0${code}`).digest('hex');
+  const scopeHash = value => createHmac('sha256', config.codePepper).update(value).digest('hex');
+  const review = config.reviewLogin?.enabled === true ? config.reviewLogin : null;
+  if (review && (review.email !== normalizeEmail(review.email) || !/^[a-f0-9]{64}$/.test(review.codeHash || '')
+    || !Number.isFinite(Date.parse(review.startsAt)) || !Number.isFinite(Date.parse(review.expiresAt))
+    || Date.parse(review.startsAt) >= Date.parse(review.expiresAt))) {
+    throw new Error('Invalid review login configuration');
+  }
+
+  async function requestCode({ email: rawEmail, ticket, randstr }, ip) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof ticket !== 'string' || !ticket || ticket.length > 2048 ||
+        typeof randstr !== 'string' || !randstr || randstr.length > 128) throw error(400, 'Invalid human verification');
+    if (!ip || ip.length > 64) throw error(400, 'Invalid client address');
+    const [identities] = await pool.execute("SELECT u.status FROM user_login_identities i JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?", [email]);
+    if (identities[0]?.status === 'cancelled') throw error(409, '该邮箱关联的账号正在注销清理中，暂时无法注册或登录。相关信息将在注销后7天内删除，清理完成后可重新注册。');
+    // A cheap pre-check precedes the billable human verification.
+    const [recent] = await pool.execute('SELECT sent_at FROM email_login_challenges WHERE email = ? AND sent_at > UTC_TIMESTAMP(3) - INTERVAL 60 SECOND', [email]);
+    if (recent.length) throw error(429, 'Please wait before requesting another code');
+    const [ipLimit] = await pool.execute(`SELECT request_count FROM email_send_limits
+      WHERE scope_hash=? AND window_start>=UTC_TIMESTAMP() - INTERVAL 1 HOUR ORDER BY window_start DESC LIMIT 1`, [scopeHash(`ip:${ip}`)]);
+    if (ipLimit[0]?.request_count >= 20) throw error(429, 'Too many email requests');
+    if (!await provider.verifyHuman(ticket, randstr, ip)) throw error(403, 'Human verification failed');
+    const code = String(randomInt(0, 1000000)).padStart(6, '0');
+    const hash = codeHash(email, code);
+    const windowStart = sqlTime(new Date(Math.floor(Date.now() / 3600000) * 3600000).toISOString()).slice(0, 19);
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      for (const [scope, limit] of [[`email:${email}`, 5], [`ip:${ip}`, 20]]) {
+        const key = scopeHash(scope);
+        await db.execute('INSERT INTO email_send_limits (scope_hash,window_start,request_count) VALUES (?,?,1) ON DUPLICATE KEY UPDATE request_count=request_count+1', [key, windowStart]);
+        const [rows] = await db.execute('SELECT request_count FROM email_send_limits WHERE scope_hash=? AND window_start=? FOR UPDATE', [key, windowStart]);
+        if (rows[0].request_count > limit) throw error(429, 'Too many email requests');
+      }
+      const [existing] = await db.execute('SELECT sent_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      if (existing.length && Date.now() - new Date(`${existing[0].sent_at.replace(' ', 'T')}Z`).getTime() < 60000) {
+        throw error(429, 'Please wait before requesting another code');
+      }
+      await db.execute(`INSERT INTO email_login_challenges (email,code_hash,expires_at,attempts,sent_at)
+        VALUES (?, ?, UTC_TIMESTAMP(3) + INTERVAL 10 MINUTE, 0, UTC_TIMESTAMP(3))
+        ON DUPLICATE KEY UPDATE code_hash=VALUES(code_hash),expires_at=VALUES(expires_at),attempts=0,sent_at=VALUES(sent_at)`, [email, hash]);
+      await db.commit();
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+    try { await provider.sendLoginCode(email, code); }
+    catch (failure) {
+      await pool.execute('DELETE FROM email_login_challenges WHERE email=? AND code_hash=?', [email, hash]);
+      throw error(503, 'Email delivery unavailable');
+    }
+    return { sent: true, expiresInSeconds: 600 };
+  }
+
+  async function verifyCode({ email: rawEmail, code }) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof code !== 'string' || !/^\d{6}$/.test(code)) throw error(400, 'Invalid code');
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const reviewActive = review?.email === email && Date.now() >= Date.parse(review.startsAt)
+        && Date.now() < Date.parse(review.expiresAt);
+      let reviewLogin = false;
+      if (reviewActive) {
+        // Reuse the persisted rate-limit table so restarts cannot reset guesses.
+        const windowStart = sqlTime(new Date(Math.floor(Date.now() / 3600000) * 3600000).toISOString()).slice(0, 19);
+        const key = scopeHash(`review-login:${email}`);
+        await db.execute('INSERT INTO email_send_limits (scope_hash,window_start,request_count) VALUES (?,?,1) ON DUPLICATE KEY UPDATE request_count=request_count+1', [key, windowStart]);
+        const [attempts] = await db.execute('SELECT request_count FROM email_send_limits WHERE scope_hash=? AND window_start=? FOR UPDATE', [key, windowStart]);
+        await db.commit();
+        if (attempts[0].request_count > 10) throw error(429, 'Too many login attempts');
+        await db.beginTransaction();
+        reviewLogin = timingSafeEqual(Buffer.from(codeHash(email, code), 'hex'), Buffer.from(review.codeHash, 'hex'));
+      }
+      if (!reviewLogin) {
+        const [challenges] = await db.execute('SELECT code_hash,attempts,expires_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+        const challenge = challenges[0];
+        if (!challenge || new Date(`${challenge.expires_at.replace(' ', 'T')}Z`).getTime() <= Date.now()) throw error(401, 'Code expired or incorrect');
+        const supplied = Buffer.from(codeHash(email, code), 'hex');
+        if (!timingSafeEqual(supplied, Buffer.from(challenge.code_hash, 'hex'))) {
+          if (challenge.attempts >= 4) await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+          else await db.execute('UPDATE email_login_challenges SET attempts=attempts+1 WHERE email=?', [email]);
+          await db.commit();
+          throw error(401, 'Code expired or incorrect');
+      }
+      await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+      }
+      const [identities] = await db.execute(`SELECT u.id,u.status FROM user_login_identities i
+        JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?`, [email]);
+      let userId = identities[0]?.id;
+      if (identities[0]?.status === 'cancelled') throw error(409, '该邮箱关联的账号正在注销清理中，暂时无法注册或登录。相关信息将在注销后7天内删除，清理完成后可重新注册。');
+      if (identities[0]?.status === 'disabled') throw error(403, 'Account unavailable');
+      if (!userId) {
+        userId = randomUUID();
+        await db.execute('INSERT INTO users (id,status,created_at,updated_at) VALUES (?,\'active\',UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))', [userId]);
+        await db.execute(`INSERT INTO user_login_identities (user_id,kind,normalized_value,verified_at,created_at)
+          VALUES (?,'email',?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))`, [userId, email]);
+      }
+      const token = randomBytes(32).toString('base64url');
+      const expiresAt = Math.min(Date.now() + 30 * 86400000, reviewLogin ? Date.parse(review.expiresAt) : Infinity);
+      if (expiresAt <= Date.now()) throw error(401, 'Code expired or incorrect');
+      await db.execute(`INSERT INTO user_sessions (token_hash,user_id,created_at,expires_at)
+        VALUES (?,?,UTC_TIMESTAMP(3),?)`, [tokenHash(token), userId, sqlTime(new Date(expiresAt).toISOString())]);
+      await db.commit();
+      if (reviewLogin) console.info(JSON.stringify({ event: 'review-login', userId, expiresAt: new Date(expiresAt).toISOString() }));
+      return { token, user: { id: userId, email }, expiresInSeconds: Math.max(0, Math.floor((expiresAt - Date.now()) / 1000)) };
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+  }
+
+  async function current(token) {
+    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) throw error(401, 'Unauthorized');
+    const [rows] = await pool.execute(`SELECT u.id,i.normalized_value AS email,s.expires_at FROM user_sessions s
+      JOIN users u ON u.id=s.user_id JOIN user_login_identities i ON i.user_id=u.id AND i.kind='email'
+      WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>UTC_TIMESTAMP(3) AND u.status='active'`, [tokenHash(token)]);
+    if (!rows.length) throw error(401, 'Unauthorized');
+    return { id: rows[0].id, email: rows[0].email, expiresAt: isoTime(rows[0].expires_at) };
+  }
+
+  async function usage(userId) {
+    const [settings] = await pool.query('SELECT mode FROM relay_usage_settings WHERE id=1');
+    if (settings.length !== 1) throw new Error('Missing relay usage settings');
+    const [budgets] = await pool.execute(`SELECT period_start,period_end,limit_seconds,used_seconds FROM relay_usage_budgets
+      WHERE user_id=? AND period_start<=UTC_TIMESTAMP(3) AND period_end>UTC_TIMESTAMP(3)
+      ORDER BY period_start DESC LIMIT 2`, [userId]);
+    if (budgets.length > 1) throw new Error('Overlapping relay usage budgets');
+    const budget = budgets[0];
+    const [totals] = await pool.execute('SELECT task_seconds FROM relay_usage_totals WHERE user_id=?', [userId]);
+    return { mode: settings[0].mode, periodStart: budget ? isoTime(budget.period_start) : null,
+      periodEnd: budget ? isoTime(budget.period_end) : null,
+      limitSeconds: budget?.limit_seconds == null ? null : Number(budget.limit_seconds),
+      usedSeconds: budget ? Number(budget.used_seconds) : 0,
+      taskSeconds: Number(totals[0]?.task_seconds || 0) };
+  }
+
+  async function logout(token) {
+    await current(token);
+    await pool.execute('UPDATE user_sessions SET revoked_at=UTC_TIMESTAMP(3) WHERE token_hash=? AND revoked_at IS NULL', [tokenHash(token)]);
+    return { ok: true };
+  }
+
+  async function cancelAccount(token) {
+    const user = await current(token);
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      await db.execute("UPDATE users SET status='cancelled',cancelled_at=UTC_TIMESTAMP(3),updated_at=UTC_TIMESTAMP(3) WHERE id=? AND status='active'", [user.id]);
+      await db.execute('UPDATE user_sessions SET revoked_at=COALESCE(revoked_at,UTC_TIMESTAMP(3)) WHERE user_id=?', [user.id]);
+      await db.execute('UPDATE relay_usage_sessions SET ended_at=confirmed_until WHERE user_id=? AND ended_at IS NULL', [user.id]);
+      await db.commit();
+      return { ok: true };
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+  }
+
+  return { captchaAppId: config.captchaAppId, requestCode, verifyCode, current, usage, logout, cancelAccount };
+}

package/dist/src/self-relay/file-wire.mjs

@@ -0,0 +1,13 @@
+// The relay adds the authenticated session only on its workstation-facing leg.
+// Phones never select another client's session.
+const MAX_BYTES = 256 * 1024;
+export function routedFileBytes(session, bytes) {
+  if (!/^[a-f0-9-]{36}$/.test(session) || !bytes.length || bytes.length > MAX_BYTES) throw new Error('Invalid file frame');
+  return Buffer.concat([Buffer.from(session, 'ascii'), bytes]);
+}
+export function parseFileBytes(bytes) {
+  if (bytes.length <= 36 || bytes.length > MAX_BYTES + 36) throw new Error('Invalid file frame');
+  const session = bytes.subarray(0, 36).toString('ascii');
+  if (!/^[a-f0-9-]{36}$/.test(session)) throw new Error('Invalid file session');
+  return { session, data: bytes.subarray(36) };
+}

package/dist/src/self-relay/lan-authorizations.mjs

@@ -1,29 +1,42 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { digest, matches } from './wire.mjs';
-import { validId } from './device-store.mjs';
-
-const recordPath = stateRoot => path.join(stateRoot, 'lan-device-authorizations.json');
-const validHash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
-
-export function saveLanAuthorizations(stateRoot, hostId, clients, revision) {
-  if (!validId(hostId) || !Array.isArray(clients) || clients.length > 16 ||
-      clients.some(client => !validId(client.id) || !validHash(client.hash)) ||
-      !Number.isSafeInteger(revision) || revision < 0) throw new Error('Invalid LAN device authorization state');
-  const file = recordPath(stateRoot), temporary = `${file}.${randomUUID()}.tmp`;
-  const record = { version: 1, hostId, revision, clients: clients.map(client => ({ id: client.id, hash: client.hash })) };
-  try {
-    fs.writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: 'wx' });
-    fs.renameSync(temporary, file);
-  } finally { fs.rmSync(temporary, { force: true }); }
-}
-export function authorizeLanDevice(stateRoot, clientId, credential) {
-  if (!validId(clientId)) return false;
-  let record;
-  try { record = JSON.parse(fs.readFileSync(recordPath(stateRoot), 'utf8')); }
-  catch (error) { if (error.code === 'ENOENT') return false; throw error; }
-  if (record?.version !== 1 || !validId(record.hostId) || !Array.isArray(record.clients)) return false;
-  const client = record.clients.find(item => item?.id === clientId && validHash(item.hash));
-  return Boolean(client && matches(credential, client.hash));
-}
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import { digest, matches } from './wire.mjs';
+import { validId } from './device-store.mjs';
+
+const recordPath = stateRoot => path.join(stateRoot, 'lan-device-authorizations.json');
+const validHash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const authorizationChanges = new EventEmitter();
+const authorizationKey = stateRoot => {
+  const resolved = path.resolve(stateRoot);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+};
+
+export function onLanAuthorizationsChanged(stateRoot, listener) {
+  const key = authorizationKey(stateRoot);
+  authorizationChanges.on(key, listener);
+  return () => authorizationChanges.off(key, listener);
+}
+
+export function saveLanAuthorizations(stateRoot, hostId, clients, revision) {
+  if (!validId(hostId) || !Array.isArray(clients) || clients.length > 16 ||
+      clients.some(client => !validId(client.id) || !validHash(client.hash)) ||
+      !Number.isSafeInteger(revision) || revision < 0) throw new Error('Invalid LAN device authorization state');
+  const file = recordPath(stateRoot), temporary = `${file}.${randomUUID()}.tmp`;
+  const record = { version: 1, hostId, revision, clients: clients.map(client => ({ id: client.id, hash: client.hash })) };
+  try {
+    fs.writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: 'wx' });
+    fs.renameSync(temporary, file);
+  } finally { fs.rmSync(temporary, { force: true }); }
+  authorizationChanges.emit(authorizationKey(stateRoot));
+}
+export function authorizeLanDevice(stateRoot, clientId, credential) {
+  if (!validId(clientId)) return false;
+  let record;
+  try { record = JSON.parse(fs.readFileSync(recordPath(stateRoot), 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return false; throw error; }
+  if (record?.version !== 1 || !validId(record.hostId) || !Array.isArray(record.clients)) return false;
+  const client = record.clients.find(item => item?.id === clientId && validHash(item.hash));
+  return Boolean(client && matches(credential, client.hash));
+}