const esc = (s: string) => s.replace(/[&<>"']/g, c => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' })[c]!) export interface LoginPageProps { request: string clientName: string | null storeName: string require2fa: boolean error?: string | undefined username?: string | undefined } /** Server-rendered sign-in page. No scripts; posts to /login. */ export function renderLoginPage(p: LoginPageProps): string { const client = p.clientName ? esc(p.clientName) : 'An AI assistant' return ` Sign in ยท ${esc(p.storeName)}

Sign in with Magento

${client} wants read-only access to ${esc(p.storeName)}. Use your Magento admin account.

${p.error ? `` : ''}
${p.require2fa ? ` ` : ''}

Your password is checked by Magento and never stored. Access is read-only and every request is logged.

` }