papilot 0.3.0 → 0.4.0

package/dist/index.html

@@ -8,6 +8,6 @@
   document.documentElement.dataset.theme = dark ? 'dark' : 'light';
   document.querySelector('meta[name="theme-color"]').content = dark ? '#26272b' : '#ffffff';
 })();
-</script><style>html{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light;background:#fff}html[data-theme=dark]{--lightningcss-light: ;--lightningcss-dark:initial;color-scheme:dark;background:#26272b}</style>  <script type="module" crossorigin src="/assets/index-BkowXmKr.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-Dq3s-vhH.css">
+</script><style>html{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light;background:#fff}html[data-theme=dark]{--lightningcss-light: ;--lightningcss-dark:initial;color-scheme:dark;background:#26272b}</style>  <script type="module" crossorigin src="/assets/index-DTScOfwx.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-BB0zC0wj.css">
 </head><body><div id="root"></div></body></html>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "papilot",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A Cursor-like workspace for your papers: annotate and review PDFs directly without ever touching LaTeX.",
   "keywords": [
     "latex",
@@ -62,7 +62,7 @@
     "doctor": "node bin/papilot.mjs doctor",
     "service:install": "tsx scripts/service.ts install",
     "service:stop": "tsx scripts/service.ts stop",
-    "test:ui": "npm run build && node scripts/check-ui.mjs && node scripts/check-review-notes.mjs && node --import tsx scripts/check-review-flow.mjs && node scripts/check-skills.mjs",
+    "test:ui": "npm run build && node scripts/check-ui.mjs && node scripts/check-review-notes.mjs && node --import tsx scripts/check-review-flow.mjs && node scripts/check-skills.mjs && node --import tsx scripts/check-accounts.mjs",
     "site": "node scripts/build-site.mjs",
     "site:video": "node scripts/build-site.mjs --video",
     "prepack": "npm run build && npm run setup:review"
@@ -70,6 +70,7 @@
   "dependencies": {
     "@fastify/compress": "^9.2.2",
     "@fastify/static": "^10.1.7",
+    "@simplewebauthn/server": "^14.0.3",
     "commander": "^15.0.0",
     "diff": "^9.0.0",
     "fastify": "^5.12.7",
@@ -80,6 +81,7 @@
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.311",
     "@openai/codex": "0.164.0",
+    "@simplewebauthn/browser": "^14.0.0",
     "@types/node": "^22.20.5",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",

package/src/notes.ts

@@ -14,7 +14,7 @@ export function reviewNotesInstructions(notes: NoteSummary[]) {
 
 export function notesInstructions(notes: Annotation[]) {
   const items = notes.map((note, index) => {
-    const where = [`Page ${note.page + 1}`, note.source ? `${note.source.file} ${note.source.lines[0] === note.source.lines[1] ? `line ${note.source.lines[0]}` : `lines ${note.source.lines[0]}–${note.source.lines[1]}`}` : ''].filter(Boolean).join(' · ');
+    const where = [`Page ${note.page + 1}`, note.source ? `${note.source.file} ${note.source.lines[0] === note.source.lines[1] ? `line ${note.source.lines[0]}` : `lines ${note.source.lines[0]}–${note.source.lines[1]}`}` : '', note.author ? `from ${note.author.name}` : ''].filter(Boolean).join(' · ');
     const source = note.source?.excerpt ? ['   LaTeX source of the marked region:', '   ```latex', ...note.source.excerpt.split('\n').map(line => '   ' + line), '   ```'] : [];
     return [`${index + 1}. ${where}`, ...source, note.quote ? `${QUOTE}${note.quote}"` : REGION, `${NOTE.slice(1)}${note.comment.trim().replace(/\n/g, '\n   ')}`].join('\n');
   });

package/src/server/access.ts

@@ -0,0 +1,170 @@
+import { timingSafeEqual } from 'node:crypto';
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import { authorize } from './security.ts';
+import type { Accounts, Session, User } from './accounts.ts';
+import type { Store } from './store.ts';
+import type { Author, PendingRequest, Snapshot, Viewer as ViewerInfo } from '../shared.ts';
+
+// Who may use a route. Every route declares one, and the server refuses to
+// start if one does not, so a new route cannot skip the check:
+// public: anyone, including people not signed in (sign-in, the app's files)
+// any: anyone signed in
+// owner: the owner only (adding papers by path, managing people)
+// { project | task | request: param }: a signed-in person who can see the
+// paper that the named route parameter (or body field, from: 'body') belongs to
+export type Access = 'public' | 'any' | 'owner' | { project: string; from?: 'body' } | { task: string } | { request: string };
+// The local listener serves this host and the owner's Tailscale Serve endpoint;
+// the account listener serves the public URL, where people sign in with passkeys.
+// hsts is off when the tailnet endpoint uses plain HTTP on the same host name,
+// which a year of HSTS would break.
+export type Listener = { kind: 'local'; port: number; publicOrigin: string; owner: string } | { kind: 'account'; origin: string; hsts?: boolean };
+export type Viewer = { listener: 'local' } | { listener: 'account'; user: User; session: Session };
+
+declare module 'fastify' {
+  // hidden: 'ok' answers { ok: true } for a hidden paper's resource, as the route does for a missing one.
+  interface FastifyContextConfig { access?: Access; csrf?: false; hidden?: 'ok' }
+  interface FastifyRequest { viewer?: Viewer }
+}
+
+export const SESSION_COOKIE = '__Host-papilot-session';
+export const equals = (a: string, b: string) => { const x = Buffer.from(a), y = Buffer.from(b); return x.length === y.length && timingSafeEqual(x, y); };
+export function cookie(header: string | undefined, name: string) {
+  for (const part of (header || '').split(';')) {
+    const [key, ...value] = part.trim().split('=');
+    if (key === name) return value.join('=');
+  }
+  return '';
+}
+export const isOwner = (viewer: Viewer | undefined) => viewer?.listener === 'local' || viewer?.user.role === 'owner';
+// Messages and notes record who wrote them; the owner's carry no author.
+export const author = (viewer: Viewer | undefined): Author | undefined => viewer?.listener === 'account' && viewer.user.role !== 'owner' ? { id: viewer.user.id, name: viewer.user.name } : undefined;
+export function viewerInfo(viewer: Viewer, accounts: Accounts): ViewerInfo {
+  const user = viewer.listener === 'local' ? accounts.owner() : viewer.user;
+  return { id: user.id, name: user.name, role: user.role, listener: viewer.listener, owner: accounts.owner().name };
+}
+
+// What a person sees of the workspace: the papers shared with them, their
+// tasks and pending requests, and the agents without the owner's login.
+export function visibleSnapshot(snapshot: Snapshot, viewer: Viewer, accounts: Accounts): Snapshot {
+  if (isOwner(viewer) || viewer.listener !== 'account') return snapshot;
+  const shown = new Set(snapshot.projects.filter(project => accounts.canSee(viewer.user, project.id)).map(project => project.id));
+  const tasks = snapshot.tasks.filter(task => shown.has(task.projectId)), taskIds = new Set(tasks.map(task => task.id));
+  const redact = <T extends { account: string | null } | undefined>(runtime: T): T => runtime && runtime.account ? { ...runtime, account: 'Signed in' } : runtime;
+  return {
+    ...snapshot, projects: snapshot.projects.filter(project => shown.has(project.id)), tasks,
+    requests: snapshot.requests.filter(request => taskIds.has(request.taskId)),
+    runtime: redact(snapshot.runtime),
+    ...(snapshot.runtimes ? { runtimes: Object.fromEntries(Object.entries(snapshot.runtimes).map(([id, runtime]) => [id, redact(runtime)])) } : {}),
+  };
+}
+
+// Attempts per client per minute for the sign-in endpoints. There is no
+// overall cap, which one client could use up to lock everyone out; requests a
+// proxy sent without the client's address share one larger allowance.
+export class Limiter {
+  private windows = new Map<string, { count: number; reset: number }>();
+  constructor(private perClient = 30, private unknown = 600, private now = () => Date.now()) {}
+  take(client: string) {
+    const now = this.now();
+    let window = this.windows.get(client);
+    if (!window || window.reset <= now) {
+      if (this.windows.size >= 1000) this.windows.delete(this.windows.keys().next().value!);
+      window = { count: 0, reset: now + 60000 };
+      this.windows.delete(client); this.windows.set(client, window);
+    }
+    if (window.count >= (client === 'unknown' ? this.unknown : this.perClient)) return false;
+    window.count++;
+    return true;
+  }
+}
+// Every public connection reaches Papilot from the proxy on this host, which
+// appends the client's address last. An IPv6 client counts by its /64, since
+// one host can use any address in it.
+export function clientAddress(request: FastifyRequest) {
+  const address = String(request.headers['x-forwarded-for'] || '').split(',').map(part => part.trim()).filter(Boolean).at(-1)?.replace(/%.*$/, '') || '';
+  if (!address) return 'unknown';
+  const v4 = address.match(/(\d{1,3}(?:\.\d{1,3}){3})$/);
+  if (v4 || !address.includes(':')) return v4 ? v4[1] : address;
+  const [head, tail] = address.toLowerCase().split('::'), front = head ? head.split(':') : [], back = tail ? tail.split(':') : [];
+  const groups = tail === undefined ? front : [...front, ...Array(Math.max(0, 8 - front.length - back.length)).fill('0'), ...back];
+  return groups.slice(0, 4).map(group => group.replace(/^0+(?=.)/, '')).join(':') + '::/64';
+}
+
+const deny = (reply: FastifyReply, code: number, error: string) => reply.code(code).send({ error });
+
+export function guard(app: FastifyInstance, options: { listener: Listener; accounts: Accounts; store: Store; csrf: string; request: (id: string) => PendingRequest | undefined }) {
+  const { listener, accounts, store } = options;
+  app.addHook('onRoute', route => {
+    // @fastify/static serves the built app's files under /*; it takes no config.
+    const access = route.config?.access ?? (route.url === '/*' ? 'public' : undefined);
+    if (!access) throw new Error(`${route.method} ${route.url} has no access rule.`);
+    if (typeof access === 'object' && !('from' in access && access.from === 'body')) {
+      const param = Object.values(access)[0];
+      if (!new RegExp(`:${param}(/|$)`).test(route.url)) throw new Error(`${route.method} ${route.url} has no :${param} parameter for its access rule.`);
+    }
+    route.config = { ...route.config, access };
+  });
+  const csrfFor = (viewer: Viewer) => viewer.listener === 'local' ? options.csrf : viewer.session.csrf;
+  // A paper the person cannot see answers like one that does not exist: the
+  // error its route gives for a missing paper, task or request.
+  const hidden = (viewer: Viewer, access: Access, values: Record<string, unknown>) => {
+    if (isOwner(viewer) || typeof access !== 'object' || viewer.listener !== 'account') return null;
+    const can = (projectId: string) => accounts.canSee(viewer.user, projectId);
+    const value = String(values?.[Object.values(access)[0] as string] ?? '');
+    if ('project' in access && !can(value)) return 'Paper project not found.';
+    if ('task' in access) { const task = store.tasks().find(task => task.id === value); if (task && !can(task.projectId)) return 'Task not found.'; }
+    if ('request' in access) {
+      const pending = options.request(value), task = pending && store.tasks().find(task => task.id === pending.taskId);
+      if (pending && (!task || !can(task.projectId))) return 'This request has ended or the connection has restarted.';
+    }
+    return null;
+  };
+  const refuse = (request: FastifyRequest, reply: FastifyReply, message: string) => request.routeOptions.config.hidden === 'ok' ? reply.send({ ok: true }) : deny(reply, 400, message);
+  app.addHook('onRequest', async (request, reply) => {
+    reply.header('X-Content-Type-Options', 'nosniff').header('Referrer-Policy', 'same-origin').header('X-Frame-Options', 'SAMEORIGIN').header('Cache-Control', 'no-store');
+    // A request no route matched gets the app or a plain 404 from the not-found handler.
+    const config = request.routeOptions.config, access = request.is404 ? 'public' : config?.access;
+    if (listener.kind === 'local') {
+      const denied = authorize(request.headers, request.raw.socket.remoteAddress, listener.port, listener.publicOrigin, listener.owner);
+      if (denied) return deny(reply, 403, denied);
+      // Funnel switched on for the tailnet endpoint would put it on the internet.
+      if (request.headers['tailscale-funnel-request']) return deny(reply, 403, 'This address is only for your tailnet. People outside it sign in at PAPILOT_ACCOUNT_ORIGIN.');
+      request.viewer = { listener: 'local' };
+    } else {
+      // Everything here came from the internet, whatever its headers claim.
+      const origin = new URL(listener.origin);
+      if (request.headers.host !== origin.host) return deny(reply, 403, 'Open Papilot at its public address.');
+      // Other sites may link to the app's pages, such as an invite link in a
+      // web mail, but may not request anything else from them.
+      const site = request.headers['sec-fetch-site'];
+      const page = (request.method === 'GET' || request.method === 'HEAD') && access === 'public' && request.headers['sec-fetch-mode'] === 'navigate' && request.headers['sec-fetch-dest'] === 'document';
+      if ((site === 'same-site' || site === 'cross-site') && !page) return deny(reply, 403, 'The request origin does not match.');
+      if ((request.headers.origin || (request.method !== 'GET' && request.method !== 'HEAD')) && request.headers.origin !== listener.origin) return deny(reply, 403, 'The request origin does not match.');
+      if (listener.hsts) reply.header('Strict-Transport-Security', 'max-age=31536000');
+      const found = accounts.session(cookie(request.headers.cookie, SESSION_COOKIE));
+      if (found) request.viewer = { listener: 'account', user: found.user, session: found.session };
+    }
+    if (!access) return deny(reply, 404, 'Not found');
+    const viewer = request.viewer;
+    if (access === 'public') return;
+    if (!viewer) return deny(reply, 401, 'Sign in to continue.');
+    if (request.method === 'POST' && config.csrf !== false && !equals(String(request.headers['x-papilot-token'] || ''), csrfFor(viewer))) return deny(reply, 403, 'This page has expired. Refresh it and try again.');
+    if (access === 'owner' && !isOwner(viewer)) return deny(reply, 403, 'Only the owner of this Papilot can do this.');
+    const message = typeof access === 'object' && !('from' in access) ? hidden(viewer, access, request.params as Record<string, unknown>) : null;
+    if (message) return refuse(request, reply, message);
+  });
+  // The body can arrive long after the headers, so a signed-in person's
+  // session and papers are checked again once it has, along with a paper
+  // named in the body. Removal or unsharing meanwhile stops the request.
+  app.addHook('preHandler', async (request, reply) => {
+    const config = request.routeOptions.config, access = config?.access;
+    if (request.viewer?.listener !== 'account' || request.is404 || !access || access === 'public') return;
+    const found = accounts.session(cookie(request.headers.cookie, SESSION_COOKIE));
+    if (!found || found.session.id !== request.viewer.session.id) return deny(reply, 401, 'Sign in to continue.');
+    const viewer: Viewer = request.viewer = { listener: 'account', user: found.user, session: found.session };
+    if (access === 'owner' && !isOwner(viewer)) return deny(reply, 403, 'Only the owner of this Papilot can do this.');
+    const message = typeof access === 'object' ? hidden(viewer, access, ('from' in access ? request.body : request.params) as Record<string, unknown>) : null;
+    if (message) return refuse(request, reply, message);
+  });
+  return { csrfFor };
+}

package/src/server/accounts.ts

@@ -0,0 +1,226 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import os from 'node:os';
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
+import type { AuthenticationResponseJSON, AuthenticatorTransport, RegistrationResponseJSON } from '@simplewebauthn/server';
+import { isoBase64URL } from '@simplewebauthn/server/helpers';
+import type { Store } from './store.ts';
+import type { Device, People, Person } from '../shared.ts';
+
+// People who sign in at the public URL, their passkeys, invites and browser
+// sessions. None of these writes emit the store's change event: every change
+// makes each open workspace reload its state, which would itself touch a session.
+export interface User { id: string; name: string; role: 'owner' | 'member'; handle: string; createdAt: number; lastSeenAt: number | null }
+interface Credential { id: string; userId: string; publicKey: string; counter: number; transports?: string[]; label: string; createdAt: number; lastUsedAt: number | null }
+interface Invite { userId: string; createdAt: number }
+export interface Session { id: string; userId: string; csrf: string; label: string; createdAt: number; seenAt: number; expires: number }
+interface Challenge { type: 'register' | 'authenticate'; invite?: string; userId?: string; expires: number }
+
+const MINUTE = 60000, DAY = 1440 * MINUTE;
+// A session slides for 30 days of use and ends 90 days after sign-in regardless.
+const SESSION = 30 * DAY, SESSION_LIMIT = 90 * DAY, SEEN = 10 * MINUTE;
+// An owner invite signs in as the owner from anywhere, so it is short-lived.
+const INVITE = { member: 7 * DAY, owner: 15 * MINUTE }, CHALLENGE = 5 * MINUTE, CHALLENGES = 1000;
+const digest = (token: string) => createHash('sha256').update(token).digest('hex');
+const secret = () => randomBytes(32).toString('base64url');
+
+export class AccountError extends Error { statusCode = 400 }
+
+// The passkey ceremonies, which tests replace with fakes.
+export const ceremonies = { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse };
+
+export class Accounts extends EventEmitter {
+  private challenges = new Map<string, Challenge>();
+  constructor(private store: Store, readonly origin: string | null, private passkeys = ceremonies, private now = () => Date.now()) {
+    super();
+    if (!this.users().some(user => user.role === 'owner')) this.saveUser({ id: randomUUID(), name: os.userInfo().username || 'Owner', role: 'owner', handle: secret(), createdAt: this.now(), lastSeenAt: null });
+    this.purge();
+  }
+  private get db() { return this.store.db; }
+  private rows<T>(sql: string, ...values: (string | number)[]) { return (this.db.prepare(sql).all(...values) as { data: string }[]).map(row => JSON.parse(row.data) as T); }
+  users() { return this.rows<User>('SELECT data FROM users ORDER BY rowid'); }
+  user(id: string) { return this.users().find(user => user.id === id); }
+  owner() { return this.users().find(user => user.role === 'owner')!; }
+  private saveUser(user: User) { this.db.prepare('INSERT INTO users VALUES(?,?) ON CONFLICT(id) DO UPDATE SET data=excluded.data').run(user.id, JSON.stringify(user)); return user; }
+  private member(id: string) {
+    const user = this.user(id);
+    if (!user) throw new AccountError('This person is no longer in Papilot.');
+    return user;
+  }
+  projects(userId: string) { return (this.db.prepare('SELECT project_id FROM members WHERE user_id=? ORDER BY project_id').all(userId) as { project_id: string }[]).map(row => row.project_id); }
+  // Read on every request, so unsharing a paper takes effect at once.
+  canSee(user: User, projectId: string) { return user.role === 'owner' || Boolean(this.db.prepare('SELECT 1 FROM members WHERE project_id=? AND user_id=?').get(projectId, user.id)); }
+  private credentials(userId: string) { return this.rows<Credential>('SELECT data FROM credentials WHERE user_id=? ORDER BY rowid', userId); }
+  private sessions(userId: string) { return this.rows<Session>('SELECT data FROM sessions WHERE user_id=? AND expires>? ORDER BY rowid', userId, this.now()); }
+
+  people(): People {
+    const devices = (user: User): Device[] => [
+      ...this.credentials(user.id).map(c => ({ id: c.id, kind: 'passkey' as const, label: c.label, createdAt: c.createdAt, lastUsedAt: c.lastUsedAt })),
+      ...this.sessions(user.id).map(s => ({ id: s.id, kind: 'session' as const, label: s.label, createdAt: s.createdAt, lastUsedAt: s.seenAt })),
+    ];
+    const person = (user: User): Person => ({ id: user.id, name: user.name, role: user.role, joined: this.credentials(user.id).length > 0, projects: user.role === 'owner' ? [] : this.projects(user.id), lastSeenAt: user.lastSeenAt, devices: devices(user) });
+    return { origin: this.origin, people: this.users().map(person) };
+  }
+  // A new person sees the chosen papers once they open their invite.
+  addPerson(name: string, projects: string[]) {
+    const user = this.saveUser({ id: randomUUID(), name, role: 'member', handle: secret(), createdAt: this.now(), lastSeenAt: null });
+    this.share(user.id, projects);
+    return { id: user.id, link: this.invite(user.id) };
+  }
+  rename(userId: string, name: string) { this.saveUser({ ...this.member(userId), name }); }
+  share(userId: string, projects: string[]) {
+    if (this.member(userId).role === 'owner') throw new AccountError('The owner sees every paper.');
+    this.store.transaction(() => {
+      this.db.prepare('DELETE FROM members WHERE user_id=?').run(userId);
+      for (const project of new Set(projects)) this.db.prepare('INSERT INTO members VALUES(?,?)').run(project, userId);
+    });
+    this.emit('revoked', { userId });
+  }
+  // One link registers one passkey: a new person's first, or another device's.
+  invite(userId: string) {
+    const user = this.member(userId);
+    if (!this.origin) throw new AccountError('Set PAPILOT_ACCOUNT_ORIGIN to the public URL before inviting people.');
+    const token = secret(), invite: Invite = { userId, createdAt: this.now() };
+    this.db.prepare('INSERT INTO invites VALUES(?,?,?,?)').run(digest(token), userId, this.now() + INVITE[user.role], JSON.stringify(invite));
+    return `${this.origin}/invite#${token}`;
+  }
+  remove(userId: string) {
+    if (this.member(userId).role === 'owner') throw new AccountError('The owner cannot be removed.');
+    this.store.transaction(() => {
+      for (const table of ['credentials', 'invites', 'sessions', 'members']) this.db.prepare(`DELETE FROM ${table} WHERE user_id=?`).run(userId);
+      this.db.prepare('DELETE FROM users WHERE id=?').run(userId);
+    });
+    for (const [key, challenge] of this.challenges) if (challenge.userId === userId) this.challenges.delete(key);
+    this.emit('revoked', { userId });
+  }
+  // A lost device: its passkey or its signed-in session.
+  revoke(userId: string, deviceId: string) {
+    const removed = Number(this.db.prepare('DELETE FROM credentials WHERE id=? AND user_id=?').run(deviceId, userId).changes)
+      + Number(this.db.prepare('DELETE FROM sessions WHERE id=? AND user_id=?').run(deviceId, userId).changes);
+    if (!removed) throw new AccountError('This device is no longer signed in.');
+    this.emit('revoked', { userId, sessionId: deviceId });
+  }
+  signOutEverywhere(userId: string) {
+    this.db.prepare('DELETE FROM sessions WHERE user_id=?').run(userId);
+    this.emit('revoked', { userId });
+  }
+
+  private startSession(userId: string, label: string) {
+    const token = secret(), now = this.now();
+    const session: Session = { id: randomUUID(), userId, csrf: secret(), label, createdAt: now, seenAt: now, expires: now + SESSION };
+    this.db.prepare('INSERT INTO sessions VALUES(?,?,?,?,?)').run(digest(token), session.id, userId, session.expires, JSON.stringify(session));
+    return { token, session };
+  }
+  // The signed-in person for a session cookie. Use slides the expiry, but at
+  // most every ten minutes, so ordinary polling does not write.
+  session(token: string) {
+    if (!token) return null;
+    const hash = digest(token), now = this.now();
+    const row = this.db.prepare('SELECT data FROM sessions WHERE token_hash=? AND expires>?').get(hash, now) as { data: string } | undefined;
+    if (!row) return null;
+    let session = JSON.parse(row.data) as Session;
+    const user = this.user(session.userId);
+    if (!user) return null;
+    if (now - session.seenAt > SEEN) {
+      session = { ...session, seenAt: now, expires: Math.min(now + SESSION, session.createdAt + SESSION_LIMIT) };
+      this.db.prepare('UPDATE sessions SET expires=?, data=? WHERE token_hash=?').run(session.expires, JSON.stringify(session), hash);
+      this.saveUser({ ...user, lastSeenAt: now });
+    }
+    return { session, user };
+  }
+  endSession(sessionId: string) { this.db.prepare('DELETE FROM sessions WHERE id=?').run(sessionId); this.emit('revoked', { sessionId }); }
+  purge() {
+    this.db.prepare('DELETE FROM invites WHERE expires<=?').run(this.now());
+    this.db.prepare('DELETE FROM sessions WHERE expires<=?').run(this.now());
+  }
+
+  private get rpID() {
+    if (!this.origin) throw new AccountError('Sign-in is not set up on this Papilot.');
+    return new URL(this.origin).hostname;
+  }
+  private remember(challenge: string, value: Omit<Challenge, 'expires'>) {
+    const now = this.now();
+    for (const [key, entry] of this.challenges) if (entry.expires <= now) this.challenges.delete(key);
+    while (this.challenges.size >= CHALLENGES) this.challenges.delete(this.challenges.keys().next().value!);
+    this.challenges.set(challenge, { ...value, expires: now + CHALLENGE });
+  }
+  // Each challenge is used once, whatever the ceremony's outcome.
+  private take(challenge: string) {
+    const entry = this.challenges.get(challenge);
+    this.challenges.delete(challenge);
+    return entry && entry.expires > this.now() ? entry : undefined;
+  }
+  private openInvite(token: string) {
+    const hash = digest(String(token || ''));
+    const row = this.db.prepare('SELECT user_id FROM invites WHERE token_hash=? AND expires>?').get(hash, this.now()) as { user_id: string } | undefined;
+    const user = row && this.user(row.user_id);
+    if (!user) throw new AccountError('This invite link has expired or was already used. Ask for a new one.');
+    return { hash, user };
+  }
+  inviteInfo(token: string, paperName: (id: string) => string | undefined) {
+    const { user } = this.openInvite(token);
+    return { name: user.name, owner: user.role === 'owner', inviter: this.owner().name, papers: this.projects(user.id).map(paperName).filter(Boolean), adding: this.credentials(user.id).length > 0 };
+  }
+  async registrationOptions(token: string) {
+    const { hash, user } = this.openInvite(token);
+    const options = await this.passkeys.generateRegistrationOptions({
+      rpName: 'Papilot', rpID: this.rpID, userName: user.name, userDisplayName: user.name, userID: isoBase64URL.toBuffer(user.handle),
+      attestationType: 'none', excludeCredentials: this.credentials(user.id).map(c => ({ id: c.id, transports: c.transports as AuthenticatorTransport[] | undefined })),
+      authenticatorSelection: { residentKey: 'required', userVerification: 'required' },
+    });
+    this.remember(options.challenge, { type: 'register', invite: hash, userId: user.id });
+    return options;
+  }
+  async register(token: string, response: RegistrationResponseJSON, label: string) {
+    const { hash } = this.openInvite(token);
+    let bound: Challenge | undefined;
+    const result = await this.passkeys.verifyRegistrationResponse({
+      response, expectedOrigin: this.origin!, expectedRPID: this.rpID, requireUserVerification: true,
+      expectedChallenge: challenge => { bound = this.take(challenge); return bound?.type === 'register' && bound.invite === hash; },
+    }).catch(() => ({ verified: false as const }));
+    if (!result.verified || !bound?.userId) throw new AccountError('The passkey could not be created. Try again.');
+    const { credential } = result.registrationInfo, userId = bound.userId;
+    // Verification awaited; using the invite, saving the passkey and signing in
+    // happen together or not at all, so one link cannot register twice.
+    return this.store.transaction(() => {
+      if (Number(this.db.prepare('DELETE FROM invites WHERE token_hash=? AND expires>?').run(hash, this.now()).changes) !== 1) throw new AccountError('This invite link has expired or was already used. Ask for a new one.');
+      if (!this.user(userId)) throw new AccountError('This person is no longer in Papilot.');
+      const saved: Credential = { id: credential.id, userId, publicKey: isoBase64URL.fromBuffer(credential.publicKey), counter: credential.counter, transports: credential.transports, label, createdAt: this.now(), lastUsedAt: null };
+      this.db.prepare('INSERT INTO credentials VALUES(?,?,?)').run(saved.id, userId, JSON.stringify(saved));
+      return this.startSession(userId, label);
+    });
+  }
+  async authenticationOptions() {
+    const options = await this.passkeys.generateAuthenticationOptions({ rpID: this.rpID, userVerification: 'required', allowCredentials: [] });
+    this.remember(options.challenge, { type: 'authenticate' });
+    return options;
+  }
+  async authenticate(response: AuthenticationResponseJSON, label: string) {
+    const failed = () => new AccountError('This passkey could not sign you in. Ask the owner for a new invite if it was removed.');
+    const row = this.db.prepare('SELECT data FROM credentials WHERE id=?').get(String(response?.id || '')) as { data: string } | undefined;
+    const credential = row && JSON.parse(row.data) as Credential, user = credential && this.user(credential.userId);
+    // A discoverable passkey names its user; it must be the user it was registered to.
+    if (!credential || !user || response.response?.userHandle !== user.handle) throw failed();
+    let bound: Challenge | undefined;
+    const result = await this.passkeys.verifyAuthenticationResponse({
+      response, expectedOrigin: this.origin!, expectedRPID: this.rpID, requireUserVerification: true,
+      credential: { id: credential.id, publicKey: isoBase64URL.toBuffer(credential.publicKey), counter: credential.counter, transports: credential.transports },
+      expectedChallenge: challenge => { bound = this.take(challenge); return bound?.type === 'authenticate'; },
+    }).catch(() => ({ verified: false as const }));
+    if (!result.verified || !bound) throw failed();
+    return this.store.transaction(() => {
+      if (!this.user(user.id) || !this.db.prepare('SELECT 1 FROM credentials WHERE id=?').get(credential.id)) throw failed();
+      const used: Credential = { ...credential, counter: result.authenticationInfo.newCounter, lastUsedAt: this.now() };
+      this.db.prepare('UPDATE credentials SET data=? WHERE id=?').run(JSON.stringify(used), credential.id);
+      return this.startSession(user.id, label);
+    });
+  }
+}
+
+// A short name for the browser a session or passkey came from.
+export function deviceLabel(agent: string | undefined) {
+  const ua = agent || '';
+  const browser = /Edg\//.test(ua) ? 'Edge' : /Firefox\//.test(ua) ? 'Firefox' : /Chrome\//.test(ua) ? 'Chrome' : /Safari\//.test(ua) ? 'Safari' : 'Browser';
+  const system = /iPhone/.test(ua) ? 'iPhone' : /iPad/.test(ua) ? 'iPad' : /Android/.test(ua) ? 'Android' : /Mac OS X/.test(ua) ? 'macOS' : /Windows/.test(ua) ? 'Windows' : /Linux/.test(ua) ? 'Linux' : '';
+  return system ? `${browser} on ${system}` : browser;
+}