accelr8 3.8.2 → 4.0.0-next.1

package/dist/chunks/chunk-FVC2UPMV.js

@@ -0,0 +1,306 @@
+#!/usr/bin/env node
+import {
+  accelr8Dir
+} from "./chunk-62O2F73J.js";
+
+// src/accounts.ts
+import fs from "node:fs";
+import path from "node:path";
+var HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,19}$/;
+var DEFAULT_MODEL = {
+  anthropic: "claude-opus-4-8",
+  openai: "gpt-4o"
+};
+var DEFAULT_MAX_CALLS_PER_HOUR = 30;
+var DEFAULT_MAX_CALLS_PER_REQUESTER_HOUR = 10;
+var DEFAULT_MAX_OUTPUT_TOKENS = 1024;
+var ACCOUNTS_FILE = "accounts.json";
+var TOKENS_FILE = "agent-tokens.json";
+function dirOf(baseDir) {
+  return baseDir ?? accelr8Dir();
+}
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    fs.chmodSync(dir, 448);
+  } catch {
+  }
+}
+function readJson(file) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    if ((fs.statSync(file).mode & 63) !== 0) {
+      try {
+        fs.chmodSync(file, 384);
+      } catch {
+      }
+      if ((fs.statSync(file).mode & 63) !== 0) {
+        process.stderr.write(`accelr8: refusing to load ${file}: it is readable by others and could not be locked to 600. run: chmod 600 ${file}
+`);
+        return void 0;
+      }
+    }
+  } catch {
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+function writeJson(file, value) {
+  ensureDir(path.dirname(file));
+  const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+  fs.chmodSync(tmp, 384);
+  fs.renameSync(tmp, file);
+  fs.chmodSync(file, 384);
+}
+function isAccount(v) {
+  if (!v || typeof v !== "object") return false;
+  const a = v;
+  const auth = a.auth;
+  return typeof a.id === "string" && (a.provider === "anthropic" || a.provider === "openai") && !!auth && typeof auth === "object" && (auth.kind === "api_key" ? typeof auth.apiKey === "string" : auth.kind === "claude_code_login") && typeof a.model === "string" && typeof a.handle === "string" && typeof a.maxCallsPerHour === "number" && typeof a.maxCallsPerRequesterHour === "number" && typeof a.maxOutputTokens === "number" && typeof a.createdAt === "number";
+}
+function loadAccounts(baseDir) {
+  const data = readJson(path.join(dirOf(baseDir), ACCOUNTS_FILE));
+  if (!Array.isArray(data)) return [];
+  return data.filter(isAccount).map((a) => ({ ...a, mode: a.mode ?? "approve" }));
+}
+function saveAccounts(list, baseDir) {
+  writeJson(path.join(dirOf(baseDir), ACCOUNTS_FILE), list);
+}
+function addAccount(partial, baseDir) {
+  if (!HANDLE_RE.test(partial.handle)) {
+    throw new Error(`invalid handle '${partial.handle}' (want 3-20 chars of a-z 0-9 -, starting alphanumeric)`);
+  }
+  if (partial.auth.kind === "api_key" && !partial.auth.apiKey) {
+    throw new Error("apiKey must not be empty");
+  }
+  const account = {
+    id: "acct_" + Math.random().toString(36).slice(2, 10) + Math.random().toString(36).slice(2, 6),
+    provider: partial.provider,
+    auth: partial.auth,
+    model: partial.model || DEFAULT_MODEL[partial.provider],
+    handle: partial.handle,
+    mode: partial.mode ?? "approve",
+    maxCallsPerHour: partial.maxCallsPerHour ?? DEFAULT_MAX_CALLS_PER_HOUR,
+    maxCallsPerRequesterHour: partial.maxCallsPerRequesterHour ?? DEFAULT_MAX_CALLS_PER_REQUESTER_HOUR,
+    maxOutputTokens: partial.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS,
+    createdAt: Date.now()
+  };
+  const list = loadAccounts(baseDir);
+  list.push(account);
+  saveAccounts(list, baseDir);
+  return account;
+}
+function removeAccount(id, baseDir) {
+  const list = loadAccounts(baseDir);
+  const next = list.filter((a) => a.id !== id);
+  if (next.length === list.length) return false;
+  saveAccounts(next, baseDir);
+  return true;
+}
+var tokenKey = (projectId, agentId) => `${projectId}:${agentId}`;
+function loadTokens(baseDir) {
+  const data = readJson(path.join(dirOf(baseDir), TOKENS_FILE));
+  if (!data || typeof data !== "object" || Array.isArray(data)) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(data)) if (typeof v === "string") out[k] = v;
+  return out;
+}
+function saveToken(projectId, agentId, token, baseDir) {
+  const tokens = loadTokens(baseDir);
+  tokens[tokenKey(projectId, agentId)] = token;
+  writeJson(path.join(dirOf(baseDir), TOKENS_FILE), tokens);
+}
+function getToken(projectId, agentId, baseDir) {
+  return loadTokens(baseDir)[tokenKey(projectId, agentId)];
+}
+var AUTH_FILE = "auth.json";
+var IDENTITY_FILE = "identity.json";
+function credentialsKey(serverUrl) {
+  let raw = serverUrl.trim();
+  if (!/^[a-z]+:\/\//i.test(raw)) raw = "ws://" + raw;
+  const u = new URL(raw);
+  const scheme = u.protocol === "https:" || u.protocol === "wss:" ? "wss" : "ws";
+  const port = u.port && !(scheme === "wss" && u.port === "443" || scheme === "ws" && u.port === "80") ? ":" + u.port : "";
+  return `${scheme}://${u.hostname.toLowerCase()}${port}`;
+}
+function isCredentials(v) {
+  const c = v;
+  return !!c && typeof c === "object" && typeof c.server === "string" && typeof c.accessToken === "string" && typeof c.refreshToken === "string" && typeof c.accessExpiresAt === "number" && !!c.user && typeof c.user.id === "string" && typeof c.user.name === "string";
+}
+function loadAuthFile(baseDir) {
+  const data = readJson(path.join(dirOf(baseDir), AUTH_FILE));
+  const out = {};
+  for (const [k, v] of Object.entries(data?.servers ?? {})) if (isCredentials(v)) out[k] = v;
+  return out;
+}
+function loadCredentials(serverUrl, baseDir) {
+  return loadAuthFile(baseDir)[credentialsKey(serverUrl)];
+}
+function listCredentials(baseDir) {
+  return Object.values(loadAuthFile(baseDir));
+}
+function saveCredentials(creds, baseDir) {
+  const servers = loadAuthFile(baseDir);
+  servers[creds.server] = creds;
+  writeJson(path.join(dirOf(baseDir), AUTH_FILE), { v: 1, servers });
+}
+function deleteCredentials(serverUrl, baseDir, onlyIf) {
+  const servers = loadAuthFile(baseDir);
+  const key = credentialsKey(serverUrl);
+  if (!servers[key]) return false;
+  if (onlyIf && !onlyIf(servers[key])) return false;
+  delete servers[key];
+  writeJson(path.join(dirOf(baseDir), AUTH_FILE), { v: 1, servers });
+  return true;
+}
+function loadLegacyIdentity(baseDir) {
+  try {
+    const v = JSON.parse(fs.readFileSync(path.join(dirOf(baseDir), IDENTITY_FILE), "utf8"));
+    return {
+      id: typeof v.id === "string" ? v.id : void 0,
+      name: typeof v.name === "string" ? v.name : void 0
+    };
+  } catch {
+    return {};
+  }
+}
+var AuthLockTimeout = class extends Error {
+};
+async function withAuthLock(fn, baseDir, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 2e4;
+  const staleMs = opts.staleMs ?? 3e4;
+  const heartbeatMs = opts.heartbeatMs ?? 5e3;
+  const dir = dirOf(baseDir);
+  ensureDir(dir);
+  const lock = path.join(dir, "auth.lock");
+  const nonce = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const readLock = () => {
+    try {
+      return fs.readFileSync(lock, "utf8");
+    } catch {
+      return null;
+    }
+  };
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    try {
+      const fd = fs.openSync(lock, "wx", 384);
+      try {
+        fs.writeSync(fd, nonce);
+      } finally {
+        fs.closeSync(fd);
+      }
+      break;
+    } catch {
+      try {
+        const st = fs.statSync(lock);
+        if (Date.now() - st.mtimeMs > staleMs) {
+          const seen = readLock();
+          if (seen !== null && fs.statSync(lock).mtimeMs === st.mtimeMs && readLock() === seen) fs.unlinkSync(lock);
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() > deadline) throw new AuthLockTimeout("another accelr8 process is holding the sign-in lock");
+      await new Promise((r) => setTimeout(r, 25));
+    }
+  }
+  const beat = setInterval(() => {
+    try {
+      if (readLock() === nonce) {
+        const t = /* @__PURE__ */ new Date();
+        fs.utimesSync(lock, t, t);
+      }
+    } catch {
+    }
+  }, heartbeatMs);
+  beat.unref?.();
+  try {
+    return await fn();
+  } finally {
+    clearInterval(beat);
+    try {
+      if (readLock() === nonce) fs.unlinkSync(lock);
+    } catch {
+    }
+  }
+}
+function redact(obj) {
+  return redactInner(obj, /* @__PURE__ */ new WeakSet());
+}
+var SECRET_KEYS = /* @__PURE__ */ new Set(["apiKey", "accessToken", "refreshToken", "deviceCode"]);
+function redactInner(v, seen) {
+  if (v === null || typeof v !== "object") return v;
+  if (seen.has(v)) return "[circular]";
+  seen.add(v);
+  if (Array.isArray(v)) return v.map((x) => redactInner(x, seen));
+  const out = {};
+  for (const [k, val] of Object.entries(v)) {
+    out[k] = SECRET_KEYS.has(k) && typeof val === "string" ? "***" : redactInner(val, seen);
+  }
+  return out;
+}
+function detectClaudeCode() {
+  const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
+  for (const dir of dirs) {
+    const candidate = path.join(dir, "claude");
+    try {
+      if (!fs.existsSync(candidate)) continue;
+      fs.accessSync(candidate, fs.constants.X_OK);
+      if (fs.statSync(candidate).isFile()) return { available: true, path: candidate };
+    } catch {
+    }
+  }
+  return { available: false };
+}
+function detectEnvKeys() {
+  const out = {};
+  const a = process.env.ANTHROPIC_API_KEY?.trim();
+  const o = process.env.OPENAI_API_KEY?.trim();
+  if (a) out.anthropic = a;
+  if (o) out.openai = o;
+  return out;
+}
+function defaultHandle(userName, provider) {
+  const suffix = "s" + (provider === "anthropic" ? "claude" : "gpt");
+  let name = userName.toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/^-+/, "");
+  if (!name) name = "my";
+  return name.slice(0, 20 - suffix.length) + suffix;
+}
+
+export {
+  HANDLE_RE,
+  DEFAULT_MODEL,
+  DEFAULT_MAX_CALLS_PER_HOUR,
+  DEFAULT_MAX_CALLS_PER_REQUESTER_HOUR,
+  DEFAULT_MAX_OUTPUT_TOKENS,
+  loadAccounts,
+  saveAccounts,
+  addAccount,
+  removeAccount,
+  loadTokens,
+  saveToken,
+  getToken,
+  credentialsKey,
+  loadCredentials,
+  listCredentials,
+  saveCredentials,
+  deleteCredentials,
+  loadLegacyIdentity,
+  AuthLockTimeout,
+  withAuthLock,
+  redact,
+  detectClaudeCode,
+  detectEnvKeys,
+  defaultHandle
+};

package/dist/chunks/{chunk-3JNUWI22.js → chunk-NRXIFJGR.js}

@@ -1,149 +1,7 @@
 #!/usr/bin/env node
-
-// src/accounts.ts
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-var HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,19}$/;
-var DEFAULT_MODEL = {
-  anthropic: "claude-opus-4-8",
-  openai: "gpt-4o"
-};
-var DEFAULT_MAX_CALLS_PER_HOUR = 30;
-var DEFAULT_MAX_CALLS_PER_REQUESTER_HOUR = 10;
-var DEFAULT_MAX_OUTPUT_TOKENS = 1024;
-var ACCOUNTS_FILE = "accounts.json";
-var TOKENS_FILE = "agent-tokens.json";
-function dirOf(baseDir) {
-  return baseDir ?? path.join(os.homedir(), ".accelr8");
-}
-function ensureDir(dir) {
-  fs.mkdirSync(dir, { recursive: true, mode: 448 });
-  try {
-    fs.chmodSync(dir, 448);
-  } catch {
-  }
-}
-function readJson(file) {
-  let raw;
-  try {
-    raw = fs.readFileSync(file, "utf8");
-  } catch {
-    return void 0;
-  }
-  try {
-    if ((fs.statSync(file).mode & 63) !== 0) {
-      try {
-        fs.chmodSync(file, 384);
-      } catch {
-      }
-      if ((fs.statSync(file).mode & 63) !== 0) {
-        process.stderr.write(`accelr8: refusing to load ${file}: it is readable by others and could not be locked to 600. run: chmod 600 ${file}
-`);
-        return void 0;
-      }
-    }
-  } catch {
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return void 0;
-  }
-}
-function writeJson(file, value) {
-  ensureDir(path.dirname(file));
-  const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
-  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
-  fs.chmodSync(tmp, 384);
-  fs.renameSync(tmp, file);
-  fs.chmodSync(file, 384);
-}
-function isAccount(v) {
-  if (!v || typeof v !== "object") return false;
-  const a = v;
-  const auth = a.auth;
-  return typeof a.id === "string" && (a.provider === "anthropic" || a.provider === "openai") && !!auth && typeof auth === "object" && (auth.kind === "api_key" ? typeof auth.apiKey === "string" : auth.kind === "claude_code_login") && typeof a.model === "string" && typeof a.handle === "string" && typeof a.maxCallsPerHour === "number" && typeof a.maxCallsPerRequesterHour === "number" && typeof a.maxOutputTokens === "number" && typeof a.createdAt === "number";
-}
-function loadAccounts(baseDir) {
-  const data = readJson(path.join(dirOf(baseDir), ACCOUNTS_FILE));
-  if (!Array.isArray(data)) return [];
-  return data.filter(isAccount).map((a) => ({ ...a, mode: a.mode ?? "approve" }));
-}
-function saveAccounts(list, baseDir) {
-  writeJson(path.join(dirOf(baseDir), ACCOUNTS_FILE), list);
-}
-function addAccount(partial, baseDir) {
-  if (!HANDLE_RE.test(partial.handle)) {
-    throw new Error(`invalid handle '${partial.handle}' (want 3-20 chars of a-z 0-9 -, starting alphanumeric)`);
-  }
-  if (partial.auth.kind === "api_key" && !partial.auth.apiKey) {
-    throw new Error("apiKey must not be empty");
-  }
-  const account = {
-    id: "acct_" + Math.random().toString(36).slice(2, 10) + Math.random().toString(36).slice(2, 6),
-    provider: partial.provider,
-    auth: partial.auth,
-    model: partial.model || DEFAULT_MODEL[partial.provider],
-    handle: partial.handle,
-    mode: partial.mode ?? "approve",
-    maxCallsPerHour: partial.maxCallsPerHour ?? DEFAULT_MAX_CALLS_PER_HOUR,
-    maxCallsPerRequesterHour: partial.maxCallsPerRequesterHour ?? DEFAULT_MAX_CALLS_PER_REQUESTER_HOUR,
-    maxOutputTokens: partial.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS,
-    createdAt: Date.now()
-  };
-  const list = loadAccounts(baseDir);
-  list.push(account);
-  saveAccounts(list, baseDir);
-  return account;
-}
-function removeAccount(id, baseDir) {
-  const list = loadAccounts(baseDir);
-  const next = list.filter((a) => a.id !== id);
-  if (next.length === list.length) return false;
-  saveAccounts(next, baseDir);
-  return true;
-}
-var tokenKey = (projectId, agentId) => `${projectId}:${agentId}`;
-function loadTokens(baseDir) {
-  const data = readJson(path.join(dirOf(baseDir), TOKENS_FILE));
-  if (!data || typeof data !== "object" || Array.isArray(data)) return {};
-  const out = {};
-  for (const [k, v] of Object.entries(data)) if (typeof v === "string") out[k] = v;
-  return out;
-}
-function saveToken(projectId, agentId, token, baseDir) {
-  const tokens = loadTokens(baseDir);
-  tokens[tokenKey(projectId, agentId)] = token;
-  writeJson(path.join(dirOf(baseDir), TOKENS_FILE), tokens);
-}
-function detectClaudeCode() {
-  const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
-  for (const dir of dirs) {
-    const candidate = path.join(dir, "claude");
-    try {
-      if (!fs.existsSync(candidate)) continue;
-      fs.accessSync(candidate, fs.constants.X_OK);
-      if (fs.statSync(candidate).isFile()) return { available: true, path: candidate };
-    } catch {
-    }
-  }
-  return { available: false };
-}
-function detectEnvKeys() {
-  const out = {};
-  const a = process.env.ANTHROPIC_API_KEY?.trim();
-  const o = process.env.OPENAI_API_KEY?.trim();
-  if (a) out.anthropic = a;
-  if (o) out.openai = o;
-  return out;
-}
-function defaultHandle(userName, provider) {
-  const suffix = "s" + (provider === "anthropic" ? "claude" : "gpt");
-  let name = userName.toLowerCase().replace(/[^a-z0-9-]/g, "").replace(/^-+/, "");
-  if (!name) name = "my";
-  return name.slice(0, 20 - suffix.length) + suffix;
-}
+import {
+  detectClaudeCode
+} from "./chunk-FVC2UPMV.js";
 
 // src/executor.ts
 import { spawn } from "node:child_process";
@@ -548,16 +406,6 @@ function errMsg(e) {
 }
 
 export {
-  DEFAULT_MODEL,
-  loadAccounts,
-  saveAccounts,
-  addAccount,
-  removeAccount,
-  loadTokens,
-  saveToken,
-  detectClaudeCode,
-  detectEnvKeys,
-  defaultHandle,
   execute,
   verifyAccount
 };

package/dist/chunks/chunk-RZ4OBBLX.js

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+
+// src/authpage.ts
+function esc(v) {
+  return String(v ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function ago(ms) {
+  const s = Math.floor(ms / 1e3);
+  if (s < 5) return "just now";
+  if (s < 60) return `${s} seconds ago`;
+  const m = Math.floor(s / 60);
+  return m === 1 ? "1 minute ago" : `${m} minutes ago`;
+}
+function minutes(ms) {
+  const n = Math.max(1, Math.ceil(ms / 6e4));
+  return n === 1 ? "1 minute" : `${n} minutes`;
+}
+function platformName(p) {
+  return { darwin: "macOS", win32: "Windows", linux: "Linux", freebsd: "FreeBSD", openbsd: "OpenBSD" }[p] ?? (p || "unknown");
+}
+var STYLE = `
+:root { --bg:#f7f7f5; --fg:#1b1b1b; --dim:#5d5d5d; --card:#ffffff; --line:#d9d9d4; --accent:#2457d6; --warnbg:#fff4e5; --warnfg:#7a3d00; --danger:#a1271d; }
+@media (prefers-color-scheme: dark) { :root { --bg:#121314; --fg:#ececea; --dim:#a3a3a0; --card:#1c1d1f; --line:#34363a; --accent:#7ea2ff; --warnbg:#3a2a12; --warnfg:#ffd59a; --danger:#ff8f84; } }
+* { box-sizing:border-box; }
+body { margin:0; background:var(--bg); color:var(--fg); font:16px/1.5 system-ui,-apple-system,Segoe UI,sans-serif; }
+main { max-width:520px; margin:0 auto; padding:40px 16px 64px; }
+h1 { font-size:24px; margin:0 0 8px; }
+h2 { font-size:17px; margin:28px 0 8px; }
+p { margin:8px 0; }
+.dim { color:var(--dim); }
+.card { background:var(--card); border:1px solid var(--line); border-radius:10px; padding:16px; margin:16px 0; }
+dl { display:grid; grid-template-columns:auto 1fr; gap:6px 16px; margin:0; }
+dt { color:var(--dim); }
+dd { margin:0; font-weight:600; overflow-wrap:anywhere; }
+.warn { background:var(--warnbg); color:var(--warnfg); border-radius:10px; padding:14px 16px; margin:16px 0; }
+.error { color:var(--danger); font-weight:600; }
+label { display:block; font-weight:600; margin:12px 0 6px; }
+input[type=text] { width:100%; font:inherit; padding:10px 12px; border:1px solid var(--line); border-radius:8px; background:var(--card); color:var(--fg); }
+input.code { font:600 22px/1.2 ui-monospace,Menlo,monospace; letter-spacing:3px; text-transform:uppercase; }
+button { font:inherit; font-weight:600; padding:10px 16px; border-radius:8px; border:1px solid var(--accent); background:var(--accent); color:#fff; cursor:pointer; margin:12px 8px 0 0; }
+button.quiet { background:transparent; color:var(--accent); }
+button.deny { background:transparent; color:var(--danger); border-color:var(--danger); }
+form { margin:0; }
+`;
+function layout(title, body) {
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer"><title>${esc(title)}</title><style>${STYLE}</style></head>
+<body><main>${body}</main></body></html>`;
+}
+function hidden(fields) {
+  return Object.entries(fields).map(([k, v]) => `<input type="hidden" name="${esc(k)}" value="${esc(v)}">`).join("");
+}
+function enterCodePage(o) {
+  return layout("Sign in a terminal to accelr8", `
+<h1>Sign in a terminal</h1>
+<p>Type the code your terminal is showing after <code>accelr8 login</code>.</p>
+${o.error ? `<p class="error" role="alert">${esc(o.error)}</p>` : ""}
+${o.note ? `<p>${esc(o.note)}</p>` : ""}
+<form method="post" action="/approve">${hidden({ csrf: o.csrf, step: "code" })}
+<label for="code">Code</label>
+<input class="code" id="code" name="code" type="text" inputmode="text" autocomplete="off" autocapitalize="characters" spellcheck="false" maxlength="12" placeholder="XXXX-XXXX" required autofocus>
+<button type="submit">Continue</button>
+</form>
+${o.signedInAs ? `<div class="card"><p>This browser is signed in as <strong>${esc(o.signedInAs)}</strong>.</p>
+<form method="post" action="/approve">${hidden({ csrf: o.csrf, action: "signout" })}<button class="quiet" type="submit">Sign out of this browser</button></form></div>` : ""}
+`);
+}
+var DIFFERENT_NETWORK = "This code was asked for from a different network than this browser. If someone sent you this code, deny it.";
+function confirmPage(o) {
+  const v = o.view;
+  const base = { csrf: o.csrf, step: "decide", code: v.userCode };
+  const legacyName = v.legacy?.name ? ` as <strong>${esc(v.legacy.name)}</strong>` : "";
+  const legacy = v.legacy?.willLink ? `<p>This terminal used accelr8 before${legacyName}, and proved it with an agent key it holds. The projects it was in are added to the account you approve with.</p>` : v.legacy && !v.legacy.proved ? `<p class="dim">This terminal says it used accelr8 before${legacyName}, but it holds no agent key to prove it, so its old projects are not added. To get back into one, ask someone in it for the join code.</p>` : "";
+  const network = v.sameNetwork === false ? `<div class="warn" role="alert"><strong>${esc(DIFFERENT_NETWORK)}</strong></div>` : "";
+  const asExisting = o.signedInAs ? `<form method="post" action="/approve">${hidden({ ...base, action: "approve" })}
+<button type="submit">Approve and sign in as ${esc(o.signedInAs)}</button></form>
+<h2>Or use a new account</h2>` : `<h2>Create your account</h2>
+<p class="dim">Already use accelr8 on another machine? Do not make a second account here. On that machine, run <code>accelr8 approve ${esc(v.userCode)}</code> instead.</p>`;
+  return layout("Approve this sign-in? \xB7 accelr8", `
+<h1>Approve this sign-in?</h1>
+<p>A terminal is asking to sign in to accelr8. The name and system below are what it says about itself, so anyone can make them match your machine.</p>
+<div class="card"><dl>
+<dt>Says it is</dt><dd>${esc(v.machine)}</dd>
+<dt>Says it runs</dt><dd>${esc(platformName(v.platform))}</dd>
+<dt>Asked</dt><dd>${esc(ago(v.ageMs))}</dd>
+${v.ip ? `<dt>From</dt><dd>${esc(v.ip)}</dd>` : ""}
+<dt>Code</dt><dd>${esc(v.userCode)}</dd>
+</dl></div>
+${network}
+<div class="warn" role="alert"><strong>Only approve if you ran accelr8 login yourself, in the last few minutes.</strong>
+Approving lets that terminal use your accelr8 account: your projects, your chat and your agents.
+If someone else gave you this code or asked you to type it here, deny it.</div>
+${legacy}
+${asExisting}
+<form method="post" action="/approve">${hidden({ ...base, action: "create" })}
+<label for="name">Your name</label>
+<input id="name" name="name" type="text" maxlength="16" autocomplete="nickname" value="${esc(v.name)}" required>
+<button type="submit"${o.signedInAs ? ' class="quiet"' : ""}>Create account and approve</button></form>
+<form method="post" action="/approve">${hidden({ ...base, action: "deny" })}
+<button class="deny" type="submit">Deny</button></form>
+<p class="dim">This code stops working in ${minutes(v.expiresInMs)}.</p>
+`);
+}
+function donePage(o) {
+  return layout("Signed in \xB7 accelr8", `
+<h1>Signed in</h1>
+<p>The terminal that calls itself <strong>${esc(o.machine)}</strong> is now signed in as <strong>${esc(o.name)}</strong>. Go back to your terminal.</p>
+${o.rememberedBrowser ? `<p class="dim">This browser now remembers you as ${esc(o.name)}, so the next sign-in is one click.</p>` : ""}
+<p class="dim">You can close this tab.</p>
+`);
+}
+function deniedPage() {
+  return layout("Sign-in denied \xB7 accelr8", `
+<h1>Sign-in denied</h1>
+<p>That terminal was not signed in. If you did not ask for this code, you do not need to do anything else.</p>
+`);
+}
+
+export {
+  esc,
+  ago,
+  platformName,
+  enterCodePage,
+  DIFFERENT_NETWORK,
+  confirmPage,
+  donePage,
+  deniedPage
+};