@cogenta/cli 0.2.2 → 0.3.0

package/dist/commands/search-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-page.js","sourceRoot":"","sources":["../../src/commands/search-page.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAA6C,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAyCnD;;;;;;;;GAQG;AACH,KAAK,UAAU,WAAW,CACxB,IAA0B,EAC1B,OAA0B,EAC1B,OAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAElC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,UAAU,KAAK,SAAS;YAAE,SAAQ;QAEtC,IAAI,IAAI,GAAkB,IAAI,CAAA;QAC9B,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YACzE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CACjC,CAAC,IAAI,EAA4B,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAChE,CACF,CAAA;gBACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO;qBACxC,KAAK,CAAC,GAAG,CAAC;qBACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;qBAC5C,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAC,CAAA;gBAClF,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,GAAG,SAAS,CACd,UAAU,EACV,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAC3B,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAC9D,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO;;wDAE+C,mBAAmB,CAAC,KAAK,CAAC;;QAE1E,CAAA;AACR,CAAC;AAED,SAAS,UAAU,CAAC,OAA+B;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,8DAA8D,CAAA;IAC/F,OAAO;EACP,OAAO;SACN,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACd,MAAM,CAAC,IAAI,KAAK,IAAI;QAClB,CAAC,CAAC,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;QAC5C,CAAC,CAAC,gBAAgB,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CACjG;SACA,IAAI,CAAC,IAAI,CAAC;MACP,CAAA;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,OAA0B,EAC1B,OAAsB;IAEtB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAE5B,IAAI,OAAO,GAA2B,EAAE,CAAA;IACxC,IAAI,OAAO,GAAkB,IAAI,CAAA;IAEjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAC1C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAC7D,OAAO,CACR,CAAA;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+C,CAAA;YACrE,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA0D,CAAA;YAChF,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,oCAAoC,CAAA;QACvE,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAA;IAErF,MAAM,IAAI,GACR,OAAO,KAAK,IAAI;QACd,CAAC,CAAC,4CAA4C,cAAc,CAAC,OAAO,CAAC,MAAM;QAC3E,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAE3B,OAAO;cACK,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;;;;SAIpD,OAAO,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;EAErD,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,eAAe,IAAI;;;;6BAIvD,OAAO;EAClC,UAAU,CAAC,OAAO,CAAC;EACnB,IAAI;;;;CAIL,CAAA;AACD,CAAC"}

package/dist/commands/security-alerts.d.ts

@@ -0,0 +1,24 @@
+import type { RateLimiter } from '@cogenta/auth';
+import type { Logger } from '@cogenta/core';
+export interface SecurityAlertOptions {
+    readonly rateLimit: RateLimiter;
+    /** Where the alert is delivered. `null` disables the outbound half entirely. */
+    readonly send: ((event: string, data: Readonly<Record<string, unknown>>) => Promise<void>) | null;
+    /** Absolute base URL of the site, for the alert's required admin link. */
+    readonly siteUrl: string;
+    readonly logger: Logger;
+    /** Attempts inside the limiter's window past which an alert is worth sending. */
+    readonly minAttempts?: number;
+    readonly cooldownMs?: number;
+    readonly now?: () => number;
+}
+export interface SecurityAlertWatch {
+    /**
+     * Called after every `/api/auth/*` response. Cheap and silent for the
+     * overwhelming majority — a successful sign-in never touches the database
+     * here at all.
+     */
+    observe(status: number): Promise<void>;
+}
+export declare function createSecurityAlertWatch(options: SecurityAlertOptions): SecurityAlertWatch;
+//# sourceMappingURL=security-alerts.d.ts.map

package/dist/commands/security-alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-alerts.d.ts","sourceRoot":"","sources":["../../src/commands/security-alerts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuB,WAAW,EAAE,MAAM,eAAe,CAAA;AAErE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AA2B3C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IACjG,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvC;AAcD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,CAuD1F"}

package/dist/commands/security-alerts.js

@@ -0,0 +1,82 @@
+import { buildAlert } from '@cogenta/channels';
+/**
+ * The outbound half of L14 task 4 — "exposer ça comme alerte dans le
+ * dashboard/canaux, réutilisant `@cogenta/channels`".
+ *
+ * The dashboard half is `createSuspiciousActivitySource` in `@cogenta/api`.
+ * This is the half that leaves the site, and it deliberately reuses two things
+ * that already exist rather than inventing a third: `buildAlert` (L6, with its
+ * enforced title/severity/context/expected-action/admin-link shape and its
+ * screen budget) and the signed webhook sender L14 task 1 just connected. No
+ * second notification path, no second signature.
+ *
+ * **Why the trigger is a failed request, not a timer.** Rule R1 guarantees no
+ * durable worker, so anything that "checks periodically" here would be a
+ * promise the deployment cannot keep. A brute-force run *is* a stream of
+ * requests, so the requests themselves are the clock — which also means the
+ * alert arrives while the attack is happening rather than up to a poll
+ * interval later.
+ */
+/** Statuses that mean a sign-in attempt was refused. 429 is the limiter itself. */
+const REFUSED_STATUSES = new Set([401, 429]);
+/** At most one alert per this long, however many attempts arrive. */
+const DEFAULT_COOLDOWN_MS = 5 * 60 * 1000;
+function summarise(summaries) {
+    return {
+        attempts: summaries.reduce((total, summary) => total + summary.attempts, 0),
+        subjects: summaries.length,
+        blocked: summaries.filter((summary) => summary.blocked).length,
+    };
+}
+export function createSecurityAlertWatch(options) {
+    const now = options.now ?? Date.now;
+    const cooldownMs = options.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+    let lastAlertAt = 0;
+    return {
+        observe: async (status) => {
+            if (options.send === null)
+                return;
+            if (!REFUSED_STATUSES.has(status))
+                return;
+            // The cooldown is checked *before* the query, not after: a script making
+            // twenty attempts a second must not turn into twenty aggregate queries a
+            // second. The alert is about a situation, not about one request.
+            if (now() - lastAlertAt < cooldownMs)
+                return;
+            try {
+                const summaries = await options.rateLimit.recentFailures(options.minAttempts === undefined ? undefined : { minAttempts: options.minAttempts });
+                if (summaries.length === 0)
+                    return;
+                const totals = summarise(summaries);
+                lastAlertAt = now();
+                const adminUrl = new URL('/admin', options.siteUrl).toString();
+                // Counts, never the accounts — same rule as the admin notice. An
+                // outbound message travels further than a screen does, and an email
+                // address in it is an address in somebody else's inbox and logs.
+                const alert = buildAlert({
+                    title: 'Repeated failed sign-in attempts',
+                    severity: totals.blocked > 0 ? 'critical' : 'warning',
+                    context: `${totals.attempts} failed sign-in attempts across ${totals.subjects} account(s) in the last 15 minutes${totals.blocked > 0 ? `, ${totals.blocked} of them now rate-limited` : ''}.`,
+                    expectedAction: 'Check the audit log, and confirm the affected accounts still have strong passwords and a second factor.',
+                    adminUrl,
+                });
+                await options.send('security.suspicious_activity', {
+                    severity: alert.severity,
+                    title: alert.title,
+                    context: alert.context,
+                    expectedAction: alert.expectedAction,
+                    adminUrl: alert.adminUrl,
+                    attempts: totals.attempts,
+                    subjects: totals.subjects,
+                    blocked: totals.blocked,
+                });
+            }
+            catch (error) {
+                // Never let watching a failure turn into a second failure: the sign-in
+                // response has already been written by the time this runs.
+                options.logger.error('suspicious activity alert failed', { error: String(error) });
+            }
+        },
+    };
+}
+//# sourceMappingURL=security-alerts.js.map

package/dist/commands/security-alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-alerts.js","sourceRoot":"","sources":["../../src/commands/security-alerts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C;;;;;;;;;;;;;;;;;GAiBG;AAEH,mFAAmF;AACnF,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAEjE,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAwBzC,SAAS,SAAS,CAAC,SAAyC;IAK1D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,QAAQ,EAAE,SAAS,CAAC,MAAM;QAC1B,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM;KAC/D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA6B;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC5D,IAAI,WAAW,GAAG,CAAC,CAAA;IAEnB,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAM;YACjC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAM;YACzC,yEAAyE;YACzE,yEAAyE;YACzE,iEAAiE;YACjE,IAAI,GAAG,EAAE,GAAG,WAAW,GAAG,UAAU;gBAAE,OAAM;YAE5C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,cAAc,CACtD,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CACrF,CAAA;gBACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAM;gBAElC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;gBACnC,WAAW,GAAG,GAAG,EAAE,CAAA;gBAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC9D,iEAAiE;gBACjE,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,KAAK,GAAG,UAAU,CAAC;oBACvB,KAAK,EAAE,kCAAkC;oBACzC,QAAQ,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;oBACrD,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,mCAAmC,MAAM,CAAC,QAAQ,qCAC3E,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,EACxE,GAAG;oBACH,cAAc,EACZ,yGAAyG;oBAC3G,QAAQ;iBACT,CAAC,CAAA;gBAEF,MAAM,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uEAAuE;gBACvE,2DAA2D;gBAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACpF,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/commands/seo.d.ts

@@ -0,0 +1,88 @@
+import { type AccessContext, type ContentGateway } from '@cogenta/api';
+import type { CollectionDefinition, ContentEntry } from '@cogenta/schema';
+import { type HreflangAlternate, type SeoImage, type SeoResource, type SeoSite, type SitemapFile } from '@cogenta/seo';
+/**
+ * `@cogenta/seo`, actually wired to the server (L10, tasks 1-2).
+ *
+ * The package was written and tested against values, never against a running
+ * `cogenta serve` — the lot names that gap explicitly. This module is the one
+ * place the two meet: it converts what `serve.ts` holds (a `ContentGateway`,
+ * a `CollectionDefinition`, a `ContentEntry`) into what `@cogenta/seo` takes
+ * (`SeoSite`, `SeoResource`) and nothing else. No SEO decision is re-made
+ * here — every tag, every URL and every published/not-published judgement is
+ * still the package's own.
+ */
+export interface SiteIdentity {
+    readonly name: string;
+    readonly url: string;
+    readonly locales: readonly string[];
+    readonly defaultLocale: string;
+}
+/**
+ * The site as the SEO layer sees it.
+ *
+ * `unprefixedDefaultLocale` is `true` because that is what this server
+ * actually does: `createRequestListener` hands `matchPath` a `defaultLocale`,
+ * and `matchPath` then resolves `/blog/hello` as well as `/en/blog/hello`.
+ * Saying otherwise would emit canonicals that redirect to themselves — the
+ * exact failure `SeoSite`'s own doc comment warns about.
+ */
+export declare function seoSiteFor(site: SiteIdentity): SeoSite;
+/**
+ * Every published entry of every routed collection, as SEO resources.
+ *
+ * Read as `ANONYMOUS` on purpose, whoever asked for the sitemap: a sitemap is
+ * a public document, and building it from the requesting actor's permissions
+ * would give a signed-in editor a different — larger — sitemap than the one a
+ * crawler fetches. `indexableResources` filters the unpublished half again on
+ * its way out, so the guarantee is doubled rather than trusted once.
+ */
+export declare function collectRoutedResources(collections: readonly CollectionDefinition[], gateway: ContentGateway): Promise<readonly SeoResource[]>;
+/**
+ * The `hreflang` alternates for one entry, or an empty list.
+ *
+ * Skipped outright on a single-locale site: `alternatesFor` would return
+ * nothing anyway, and the family lookup is a filtered scan of the collection —
+ * work every page render on a monolingual site would pay for a guaranteed
+ * empty answer.
+ *
+ * The family is read through the same permission-checked gateway as the page
+ * itself, with the same actor, so a translation the caller may not see never
+ * becomes an alternate.
+ */
+export declare function alternatesForEntry(site: SeoSite, collection: CollectionDefinition, entry: ContentEntry, gateway: ContentGateway, context: AccessContext, locales: readonly string[]): Promise<readonly HreflangAlternate[]>;
+export interface HeadOptions {
+    readonly alternates?: readonly HreflangAlternate[];
+    /** Resolves a media id to something a crawler can use. Absent means no social image. */
+    readonly media?: (id: string) => SeoImage | null;
+    /** Forces `noindex` — a search results page, a preview. */
+    readonly noindex?: boolean;
+    /** Overrides the derived title. Used for pages that are not one entry. */
+    readonly title?: string;
+}
+/**
+ * The whole `<head>` an entry earns: title, description, canonical,
+ * `hreflang`, Open Graph, Twitter Card and a JSON-LD block.
+ *
+ * Returned as one HTML string because that is what the page template needs;
+ * every escaping decision inside it belongs to `@cogenta/seo` (`renderMetaTags`
+ * for attributes, `renderJsonLdScript` for the `</script>` hazard), never to
+ * this file.
+ */
+export declare function renderSeoHead(site: SeoSite, resource: SeoResource, options?: HeadOptions): string;
+/**
+ * The sitemap files a site needs — one below the protocol limits, an index
+ * plus chunks above them.
+ *
+ * Returned as the whole set rather than one document because the split is not
+ * this layer's decision to hide: `serve.ts` routes `/sitemap.xml` *and*
+ * `/sitemap-N.xml` from the same array, so a site that grows past 50 000 URLs
+ * starts serving an index without anybody changing a route.
+ */
+export declare function buildSitemapFiles(site: SeoSite, resources: readonly SeoResource[]): readonly SitemapFile[];
+export interface RobotsRenderOptions {
+    /** False on a staging or preview host: blocks every crawler outright. */
+    readonly allowIndexing?: boolean;
+}
+export declare function renderRobots(site: SeoSite, options?: RobotsRenderOptions): string;
+//# sourceMappingURL=seo.d.ts.map

package/dist/commands/seo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo.d.ts","sourceRoot":"","sources":["../../src/commands/seo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAa,KAAK,cAAc,EAAE,MAAM,cAAc,CAAA;AAEjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAML,KAAK,iBAAiB,EAItB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,WAAW,EAEjB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAQtD;AAQD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAuCjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,oBAAoB,EAChC,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CA0BvC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAA;IAChD,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,WAAgB,GACxB,MAAM,CAkBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,WAAW,EAAE,GAChC,SAAS,WAAW,EAAE,CAExB;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAUrF"}

package/dist/commands/seo.js

@@ -0,0 +1,155 @@
+import { ANONYMOUS } from '@cogenta/api';
+import { isCogentaError } from '@cogenta/core';
+import { alternatesFor, buildJsonLd, buildMetaTags, buildSitemap, groupTranslationFamilies, renderJsonLdScript, renderMetaTags, renderRobotsTxt, sitemapUrlsFor, } from '@cogenta/seo';
+/**
+ * The site as the SEO layer sees it.
+ *
+ * `unprefixedDefaultLocale` is `true` because that is what this server
+ * actually does: `createRequestListener` hands `matchPath` a `defaultLocale`,
+ * and `matchPath` then resolves `/blog/hello` as well as `/en/blog/hello`.
+ * Saying otherwise would emit canonicals that redirect to themselves — the
+ * exact failure `SeoSite`'s own doc comment warns about.
+ */
+export function seoSiteFor(site) {
+    return {
+        baseUrl: site.url,
+        name: site.name,
+        defaultLocale: site.defaultLocale,
+        locales: site.locales,
+        unprefixedDefaultLocale: true,
+    };
+}
+/** How many entries one collection contributes to a sitemap before it is cut off. */
+const MAX_SITEMAP_ENTRIES_PER_COLLECTION = 5_000;
+/** Page size used to walk a collection. The gateway's own ceiling is 100. */
+const SCAN_PAGE = 100;
+/**
+ * Every published entry of every routed collection, as SEO resources.
+ *
+ * Read as `ANONYMOUS` on purpose, whoever asked for the sitemap: a sitemap is
+ * a public document, and building it from the requesting actor's permissions
+ * would give a signed-in editor a different — larger — sitemap than the one a
+ * crawler fetches. `indexableResources` filters the unpublished half again on
+ * its way out, so the guarantee is doubled rather than trusted once.
+ */
+export async function collectRoutedResources(collections, gateway) {
+    const context = { actor: ANONYMOUS };
+    const resources = [];
+    for (const collection of collections) {
+        if (collection.routing === undefined)
+            continue;
+        // A routed collection the `public` role may not read at all makes the
+        // gateway *throw* `FORBIDDEN` rather than answer an empty page. Skipping
+        // it is the right answer — such a collection has no public URLs to list —
+        // and catching is what keeps one login-only section from turning
+        // `/sitemap.xml` into a 500 for every crawler. Found by the security
+        // review of L10 task 2.
+        try {
+            let cursor;
+            let read = 0;
+            for (;;) {
+                const page = await gateway.list({
+                    collection: collection.name,
+                    limit: SCAN_PAGE,
+                    ...(cursor === undefined ? {} : { after: cursor }),
+                }, context);
+                for (const entry of page.items)
+                    resources.push({ collection, entry });
+                read += page.items.length;
+                const next = page.nextCursor;
+                if (next === null || read >= MAX_SITEMAP_ENTRIES_PER_COLLECTION)
+                    break;
+                cursor = next;
+            }
+        }
+        catch (error) {
+            if (isCogentaError(error) && error.code === 'FORBIDDEN')
+                continue;
+            throw error;
+        }
+    }
+    return resources;
+}
+/**
+ * The `hreflang` alternates for one entry, or an empty list.
+ *
+ * Skipped outright on a single-locale site: `alternatesFor` would return
+ * nothing anyway, and the family lookup is a filtered scan of the collection —
+ * work every page render on a monolingual site would pay for a guaranteed
+ * empty answer.
+ *
+ * The family is read through the same permission-checked gateway as the page
+ * itself, with the same actor, so a translation the caller may not see never
+ * becomes an alternate.
+ */
+export async function alternatesForEntry(site, collection, entry, gateway, context, locales) {
+    if (locales.length < 2)
+        return [];
+    const sourceId = entry.translationOf ?? entry.id;
+    const page = await gateway.list({
+        collection: collection.name,
+        filter: {
+            or: [
+                { field: 'id', operator: 'eq', value: sourceId },
+                { field: 'translationOf', operator: 'eq', value: sourceId },
+            ],
+        },
+        limit: SCAN_PAGE,
+    }, context);
+    const resources = page.items.map((found) => ({ collection, entry: found }));
+    const family = groupTranslationFamilies(site, resources).find((candidate) => candidate.sourceId === sourceId);
+    // A family of one is not a family: a self-referencing `hreflang` is noise,
+    // and `buildHreflangMap` drops it for the same reason.
+    if (family === undefined || family.members.length < 2)
+        return [];
+    return alternatesFor(site, family);
+}
+/**
+ * The whole `<head>` an entry earns: title, description, canonical,
+ * `hreflang`, Open Graph, Twitter Card and a JSON-LD block.
+ *
+ * Returned as one HTML string because that is what the page template needs;
+ * every escaping decision inside it belongs to `@cogenta/seo` (`renderMetaTags`
+ * for attributes, `renderJsonLdScript` for the `</script>` hazard), never to
+ * this file.
+ */
+export function renderSeoHead(site, resource, options = {}) {
+    const tags = buildMetaTags(site, resource, {
+        ...(options.alternates === undefined ? {} : { alternates: options.alternates }),
+        ...(options.media === undefined ? {} : { resolvers: { media: options.media } }),
+        ...(options.noindex === undefined ? {} : { noindex: options.noindex }),
+        ...(options.title === undefined ? {} : { title: options.title }),
+    });
+    const parts = [renderMetaTags(tags)];
+    const graph = buildJsonLd(site, resource, {
+        ...(options.media === undefined ? {} : { resolvers: { media: options.media } }),
+    });
+    if (graph !== null && options.noindex !== true) {
+        parts.push(`<script type="application/ld+json">${renderJsonLdScript(graph)}</script>`);
+    }
+    return parts.join('\n');
+}
+/**
+ * The sitemap files a site needs — one below the protocol limits, an index
+ * plus chunks above them.
+ *
+ * Returned as the whole set rather than one document because the split is not
+ * this layer's decision to hide: `serve.ts` routes `/sitemap.xml` *and*
+ * `/sitemap-N.xml` from the same array, so a site that grows past 50 000 URLs
+ * starts serving an index without anybody changing a route.
+ */
+export function buildSitemapFiles(site, resources) {
+    return buildSitemap(site, sitemapUrlsFor(site, resources));
+}
+export function renderRobots(site, options = {}) {
+    return renderRobotsTxt({
+        site,
+        sitemaps: ['/sitemap.xml'],
+        // The admin is a signed-in application, not content. Nothing there is
+        // reachable without a session anyway, but a crawler has no reason to
+        // spend requests discovering that.
+        groups: [{ userAgent: '*', allow: ['/'], disallow: ['/admin', '/api/'] }],
+        ...(options.allowIndexing === undefined ? {} : { allowIndexing: options.allowIndexing }),
+    });
+}
+//# sourceMappingURL=seo.js.map

package/dist/commands/seo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo.js","sourceRoot":"","sources":["../../src/commands/seo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,SAAS,EAAuB,MAAM,cAAc,CAAA;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,EACb,YAAY,EACZ,wBAAwB,EAExB,kBAAkB,EAClB,cAAc,EACd,eAAe,EAKf,cAAc,GACf,MAAM,cAAc,CAAA;AAqBrB;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,IAAkB;IAC3C,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,GAAG;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,uBAAuB,EAAE,IAAI;KAC9B,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,kCAAkC,GAAG,KAAK,CAAA;AAEhD,6EAA6E;AAC7E,MAAM,SAAS,GAAG,GAAG,CAAA;AAErB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAA4C,EAC5C,OAAuB;IAEvB,MAAM,OAAO,GAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACnD,MAAM,SAAS,GAAkB,EAAE,CAAA;IAEnC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;YAAE,SAAQ;QAE9C,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,qEAAqE;QACrE,wBAAwB;QACxB,IAAI,CAAC;YACH,IAAI,MAA0B,CAAA;YAC9B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAC7B;oBACE,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,KAAK,EAAE,SAAS;oBAChB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;iBACnD,EACD,OAAO,CACR,CAAA;gBACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK;oBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;gBACrE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;gBAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAA;gBAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,kCAAkC;oBAAE,MAAK;gBACtE,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAQ;YACjE,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,UAAgC,EAChC,KAAmB,EACnB,OAAuB,EACvB,OAAsB,EACtB,OAA0B;IAE1B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAEjC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE,CAAA;IAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAC7B;QACE,UAAU,EAAE,UAAU,CAAC,IAAI;QAC3B,MAAM,EAAE;YACN,EAAE,EAAE;gBACF,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE;gBAChD,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE;aAC5D;SACF;QACD,KAAK,EAAE,SAAS;KACjB,EACD,OAAO,CACR,CAAA;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAC3E,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAC3D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAC/C,CAAA;IACD,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAChE,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,QAAqB,EACrB,OAAO,GAAgB,EAAE;IAEzB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE;QACzC,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KACjE,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;IAEpC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE;QACxC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;KAChF,CAAC,CAAA;IACF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,sCAAsC,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACxF,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAa,EACb,SAAiC;IAEjC,OAAO,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;AAC5D,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,OAAO,GAAwB,EAAE;IAC3E,OAAO,eAAe,CAAC;QACrB,IAAI;QACJ,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC1B,sEAAsE;QACtE,qEAAqE;QACrE,mCAAmC;QACnC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;KACzF,CAAC,CAAA;AACJ,CAAC"}

package/dist/commands/serve.d.ts

@@ -1,10 +1,12 @@
 import { type IncomingMessage, type ServerResponse } from 'node:http';
-import { type AgentsRouter, type AuditRouter, type AuthRouter, createContentGateway, type MediaRouter, type RestRouter } from '@cogenta/api';
+import { type AgentsRouter, type AssistantRouter, type AuditRouter, type AuthRouter, createContentGateway, type MediaImageProcessor, type MediaRouter, type NoticeRouter, type PermissionLayer, type RestRouter, type SearchRouter, type SitePlanRouter, type TaxonomyRouter, type UsersRouter } from '@cogenta/api';
 import { type AuthStore } from '@cogenta/auth';
 import { type DatabaseHandle, type HealthReport, type Logger, type MediaStore, type StorageDriver } from '@cogenta/core';
-import { type CollectionDefinition, type SchemaDocument } from '@cogenta/schema';
+import { type CollectionDefinition, type RedirectStore, type SchemaDocument, type TaxonomyDefinition } from '@cogenta/schema';
 import type { GraphQLSchema } from 'graphql';
 import type { Output, Writer } from '../output.js';
+import { type SecurityConfig } from './http-security.js';
+import { type SecurityAlertWatch } from './security-alerts.js';
 /**
  * Loads a project's content model.
  *
@@ -15,6 +17,30 @@ import type { Output, Writer } from '../output.js';
  * collections has nothing to serve.
  */
 export declare function loadCollections(projectRoot: string): Promise<readonly CollectionDefinition[]>;
+/** What a project's schema file declares: collections, and since `schema@2.0` taxonomies. */
+export interface LoadedSchema {
+    readonly collections: readonly CollectionDefinition[];
+    readonly taxonomies: readonly TaxonomyDefinition[];
+}
+/**
+ * The same file, read for both halves of the content model.
+ *
+ * Taxonomies arrive as a **named** export beside the default one
+ * (`export const taxonomies = [...]`), so every schema file written before
+ * `schema@2.0` keeps loading unchanged and simply declares none.
+ */
+export declare function loadSchemaModule(projectRoot: string): Promise<LoadedSchema>;
+/**
+ * The schema file this project actually loads, or `undefined` when it has
+ * none.
+ *
+ * Anything that *writes* the schema back has to target this, not a guessed
+ * name: `loadCollections` prefers `cogenta.schema.ts` (the form ADR-0010
+ * calls for — TypeScript in git), so a writer that assumed `.mjs` would
+ * create tables and then write a file nothing reads, leaving an operator
+ * with orphan tables and no collections after the restart it was told to do.
+ */
+export declare function findSchemaFile(projectRoot: string): Promise<string | undefined>;
 interface Site {
     readonly db: DatabaseHandle;
     readonly auth: AuthStore;
@@ -22,24 +48,69 @@ interface Site {
     readonly authRouter: AuthRouter;
     readonly mediaRouter: MediaRouter;
     readonly auditRouter: AuditRouter;
+    /** `GET /api/search` — the full-text index, reachable for the first time (L10 task 3). */
+    readonly searchRouter: SearchRouter;
+    /** `/api/taxonomies/*` — terms, mounted apart from content because a taxonomy is not a collection (`schema@2.0`, ADR-0022). */
+    readonly taxonomyRouter: TaxonomyRouter;
+    /** ADR-0021's half that replaces the MFA sign-in gate: recommendations the admin shows, never a block. */
+    readonly noticeRouter: NoticeRouter;
+    /** Refused sign-ins, watched for a run worth alerting on (L14 task 4). `null` when nothing is configured to receive one. */
+    readonly securityAlerts: SecurityAlertWatch | null;
+    /** Account management from the admin instead of `cogenta users create` on a terminal (L11 task 3). */
+    readonly usersRouter: UsersRouter;
     /** Only set when a caller passes `agents` into `assembleSite` — no site constructs one today (R2: agents are optional, not a hard dependency of the CMS). */
     readonly agentsRouter?: AgentsRouter;
+    /**
+     * `/api/site-plans` — L19 task 7's document-driven planning on a live site.
+     *
+     * Always mounted, even with no LLM provider: the drafts an installer left
+     * behind must still be readable, and the router itself answers
+     * `SITE_PLAN_NO_PROVIDER` for the routes that would need a model.
+     */
+    readonly sitePlanRouter?: SitePlanRouter;
+    /**
+     * `/api/assistant` — L18. Always mounted, even on a site with no AI provider:
+     * it is the route that *answers* `{available: false}`, which is what lets the
+     * admin panel disappear instead of erroring.
+     */
+    readonly assistantRouter: AssistantRouter;
     /** Not routed through `mediaRouter`: serving a binary body is outside the JSON-only `RestResponse` shape, so the file route is handled directly (same treatment `/api/schema` already gets). */
     readonly mediaStore: MediaStore;
     readonly storage: StorageDriver;
+    /** `null` when no image driver loaded — `/_image` then serves originals only. */
+    readonly images: MediaImageProcessor | null;
     readonly graphqlSchema: GraphQLSchema;
     readonly gateway: ReturnType<typeof createContentGateway>;
+    /**
+     * The same layer the gateway and the REST service already ask. Held here so
+     * the routes this file serves itself — the page builder's draft render — can
+     * ask the one authority too, rather than re-deciding who may edit (R4).
+     */
+    readonly permissions: PermissionLayer;
     /** `.cogenta/schema.json`'s in-memory twin — the admin's only view of the collections (never the schema modules themselves, which are Node code). */
     readonly schemaDocument: SchemaDocument;
+    /**
+     * The redirect table, applied to *every* GET before routing (L10 task 2).
+     *
+     * It was already reachable through `/api/content/-/by-path`, which only the
+     * API's own clients call — a browser asking for a renamed URL never went
+     * near it and got a 404 instead of the 301 the rename created.
+     */
+    readonly redirects: RedirectStore;
     readonly collections: readonly CollectionDefinition[];
+    readonly taxonomies: readonly TaxonomyDefinition[];
     readonly site: {
         readonly name: string;
         readonly url: string;
         readonly locales: readonly string[];
         readonly defaultLocale: string;
+        /** Which page answers an unmatched URL (L14 task 2). `/404` by default. */
+        readonly notFoundPath: string;
     };
-    /** `null` when the project has no `theme.tokens.json` — the theme-render fallback serves unstyled HTML rather than refusing. */
-    readonly skinCss: string | null;
+    /** The skin's custom properties plus the theme's own stylesheet, minified into one. `null` when neither could be loaded — the theme-render fallback serves unstyled HTML rather than refusing. */
+    readonly styles: string | null;
+    /** CORS, security headers and cache-control, applied to every response (L10 task 6). */
+    readonly security: SecurityConfig;
     /** Live, not cached: a driver that just went down must show as down the next time this is called, not until the process restarts. */
     readonly health: () => Promise<{
         readonly database: HealthReport;
@@ -79,6 +150,18 @@ export interface ServeOptions {
      * decision for whoever deploys a read-only instance, not made here.
      */
     readonly readOnly?: boolean;
+    /**
+     * `cogenta dev` sets this; `cogenta serve` does not.
+     *
+     * It gates exactly one thing today: whether an approved site plan may be
+     * **applied** (L19 task 7). ADR-0010 is explicit — "l'éditeur visuel de
+     * schéma écrit ces fichiers, mais uniquement en mode développement. En
+     * production le schéma est en lecture seule" — and applying a plan writes
+     * `cogenta.schema.*` and creates tables, which is exactly that editor by
+     * another name. Proposing and reviewing a plan stay available everywhere;
+     * only the write is held to the decision.
+     */
+    readonly development?: boolean;
 }
 /**
  * Runs until `options.signal` aborts. Returns 0 on a clean shutdown, 1 if

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAInF,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,WAAW,EAChB,KAAK,UAAU,EAKf,oBAAoB,EAMpB,KAAK,WAAW,EAGhB,KAAK,UAAU,EAEhB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,KAAK,SAAS,EAAmB,MAAM,eAAe,CAAA;AAC/D,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EAEjB,KAAK,MAAM,EAEX,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAEL,KAAK,oBAAoB,EAKzB,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAWlD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAgC1C;AAyBD,UAAU,IAAI;IACZ,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,6JAA6J;IAC7J,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IACpC,gMAAgM;IAChM,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;IACzD,qJAAqJ;IACrJ,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC/B,CAAA;IACD,gIAAgI;IAChI,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,qIAAqI;IACrI,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;QAC/B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;KAC/B,CAAC,CAAA;IACF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AA+TD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,GACb,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAkM9D;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IAC/D,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAKD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAsFrE"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAInF,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,eAAe,EAEpB,KAAK,WAAW,EAChB,KAAK,UAAU,EAMf,oBAAoB,EAepB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,eAAe,EAGpB,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAEjB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,KAAK,SAAS,EAAmB,MAAM,eAAe,CAAA;AAC/D,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EAEjB,KAAK,MAAM,EAEX,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAGL,KAAK,oBAAoB,EAQzB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEnB,KAAK,kBAAkB,EAKxB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAIlD,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGvE,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AA+BxF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAE1C;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACnD;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDjF;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWrF;AAuCD,UAAU,IAAI;IACZ,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,+HAA+H;IAC/H,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,4HAA4H;IAC5H,QAAQ,CAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAClD,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,6JAA6J;IAC7J,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC,gMAAgM;IAChM,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;IACzD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAA;IACrC,qJAAqJ;IACrJ,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,2EAA2E;QAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,kMAAkM;IAClM,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,qIAAqI;IACrI,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;QAC/B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;KAC/B,CAAC,CAAA;IACF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AA+rBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,GACb,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA2e9D;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IAC/D,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC/B;AAQD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAgJrE"}