@cogenta/cli 0.2.2 → 0.4.0

package/dist/commands/links.d.ts

@@ -0,0 +1,24 @@
+import { type Logger } from '@cogenta/core';
+import type { Output, Writer } from '../output.js';
+export type LinksSubcommand = 'check';
+export interface LinksOptions {
+    readonly subcommand: string | undefined;
+    readonly cwd?: string;
+    readonly env?: Record<string, string | undefined>;
+    readonly logger?: Logger;
+    readonly out: Output;
+    readonly stderr: Writer;
+    /** Also follow `http(s)` links that leave the site. Off unless asked. */
+    readonly external?: boolean;
+}
+/**
+ * `cogenta links check` (L14 task 3).
+ *
+ * Exit codes are the ones a cron entry can act on: 0 nothing broken, 1 broken
+ * links were found or the site could not be read, 2 the command line was
+ * wrong. A non-zero exit for "found broken links" is deliberate — that is what
+ * makes this usable as a CI or scheduled check rather than something whose
+ * output somebody has to read.
+ */
+export declare function runLinks(options: LinksOptions): Promise<number>;
+//# sourceMappingURL=links.d.ts.map

package/dist/commands/links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../src/commands/links.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,MAAM,EAEZ,MAAM,eAAe,CAAA;AAStB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAGlD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAA;AAErC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AA+BD;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA+ErE"}

package/dist/commands/links.js

@@ -0,0 +1,109 @@
+import { dirname, resolve as resolvePath } from 'node:path';
+import process from 'node:process';
+import { createDatabaseRegistry, createLogger, isCogentaError, loadConfig, } from '@cogenta/core';
+import { checkLinks, createContentStore, createSchemaTables, } from '@cogenta/schema';
+import { loadCollections } from './serve.js';
+const USAGE = `Usage
+  cogenta links check [--external]
+
+Walks every published entry, follows every link it holds, and reports the ones
+that lead nowhere: a reference to a deleted or still-unpublished entry, a
+site-relative path that matches no route, and — with --external — an outside
+URL that answers with an error or cannot be reached at all.
+
+Nothing about this runs on its own. This project guarantees no durable
+background worker (rule R1), so "periodically" means a cron entry calling this
+command, not a scheduler pretending to exist inside the site.
+`;
+const REASON_TEXT = {
+    unknown_collection: 'points at a collection this site does not have',
+    target_missing: 'points at content that does not exist',
+    target_unpublished: 'points at content that is not published',
+    unroutable_path: 'is a path no route can serve',
+    http_error: 'answered with an error status',
+    unreachable: 'could not be reached',
+};
+function describe(broken) {
+    const target = broken.link.kind === 'url' ? broken.link.href : `${broken.link.collection}/${broken.link.id}`;
+    const status = broken.status === undefined ? '' : ` (${broken.status})`;
+    return `${broken.collection}/${broken.entryId} [${broken.locale}] ${broken.at}\n    → ${target}${status} — ${REASON_TEXT[broken.reason]}`;
+}
+/**
+ * `cogenta links check` (L14 task 3).
+ *
+ * Exit codes are the ones a cron entry can act on: 0 nothing broken, 1 broken
+ * links were found or the site could not be read, 2 the command line was
+ * wrong. A non-zero exit for "found broken links" is deliberate — that is what
+ * makes this usable as a CI or scheduled check rather than something whose
+ * output somebody has to read.
+ */
+export async function runLinks(options) {
+    const { out, stderr } = options;
+    const env = options.env ?? process.env;
+    const logger = options.logger ?? createLogger({ level: 'silent' });
+    if (options.subcommand === undefined) {
+        stderr(`cogenta links needs a subcommand.\n\n${USAGE}`);
+        return 2;
+    }
+    if (options.subcommand !== 'check') {
+        stderr(`Unknown subcommand "${options.subcommand}". Only "check" exists today.\n\n${USAGE}`);
+        return 2;
+    }
+    const loaded = await loadConfig({
+        ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
+        env,
+    });
+    const projectRoot = loaded.path === null ? resolvePath(options.cwd ?? process.cwd()) : dirname(loaded.path);
+    let selection = null;
+    try {
+        const collections = await loadCollections(projectRoot);
+        selection = await createDatabaseRegistry({ logger }).select(loaded.config.database);
+        const db = selection.instance;
+        await createSchemaTables(db, collections);
+        const stores = new Map();
+        const storeFor = (collection) => {
+            const existing = stores.get(collection.name);
+            if (existing !== undefined)
+                return existing;
+            const created = createContentStore({ db, collection });
+            stores.set(collection.name, created);
+            return created;
+        };
+        const report = await checkLinks({
+            collections,
+            storeFor,
+            locales: loaded.config.site.locales,
+            defaultLocale: loaded.config.site.defaultLocale,
+            ...(options.external === true ? { checkExternal: true } : {}),
+        });
+        if (report.broken.length === 0) {
+            out.ok(`Checked ${report.checkedLinks} link(s) across ${report.checkedEntries} published entries. Nothing broken.`);
+            if (report.skippedExternal > 0) {
+                out.detail(`${report.skippedExternal} external link(s) were not followed. Pass --external to check them.`);
+            }
+            return 0;
+        }
+        out.warn(`${report.broken.length} broken link(s) in ${report.checkedEntries} published entries:`);
+        for (const broken of report.broken)
+            out.detail(describe(broken));
+        if (report.skippedExternal > 0) {
+            out.detail(`${report.skippedExternal} external link(s) were not followed. Pass --external to check them.`);
+        }
+        return 1;
+    }
+    catch (error) {
+        if (isCogentaError(error)) {
+            stderr(`${error.code}: ${error.message}\n`);
+            if (error.hint !== undefined)
+                stderr(`${error.hint}\n`);
+        }
+        else {
+            stderr(`${error instanceof Error ? error.stack : String(error)}\n`);
+        }
+        return 1;
+    }
+    finally {
+        await selection?.instance.close();
+    }
+}
+//# sourceMappingURL=links.js.map

package/dist/commands/links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../../src/commands/links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,cAAc,EAEd,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAIL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAe5C,MAAM,KAAK,GAAG;;;;;;;;;;;CAWb,CAAA;AAED,MAAM,WAAW,GAAyC;IACxD,kBAAkB,EAAE,gDAAgD;IACpE,cAAc,EAAE,uCAAuC;IACvD,kBAAkB,EAAE,yCAAyC;IAC7D,eAAe,EAAE,8BAA8B;IAC/C,UAAU,EAAE,+BAA+B;IAC3C,WAAW,EAAE,sBAAsB;CACpC,CAAA;AAED,SAAS,QAAQ,CAAC,MAAkB;IAClC,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAA;IACvE,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,WAAW,MAAM,GAAG,MAAM,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;AAC3I,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAElE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,CAAC,uBAAuB,OAAO,CAAC,UAAU,oCAAoC,KAAK,EAAE,CAAC,CAAA;QAC5F,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG;KACJ,CAAC,CAAA;IACF,MAAM,WAAW,GACf,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAEzF,IAAI,SAAS,GACX,IAAI,CAAA;IACN,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAA;QACtD,SAAS,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACnF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAA;QAC7B,MAAM,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAEzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAA;QAC9C,MAAM,QAAQ,GAAG,CAAC,UAAgC,EAAgB,EAAE;YAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;YAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;YACtD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACpC,OAAO,OAAO,CAAA;QAChB,CAAC,CAAA;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,WAAW;YACX,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;YACnC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;YAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAA;QAEF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,EAAE,CACJ,WAAW,MAAM,CAAC,YAAY,mBAAmB,MAAM,CAAC,cAAc,qCAAqC,CAC5G,CAAA;YACD,IAAI,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,MAAM,CACR,GAAG,MAAM,CAAC,eAAe,qEAAqE,CAC/F,CAAA;YACH,CAAC;YACD,OAAO,CAAC,CAAA;QACV,CAAC;QAED,GAAG,CAAC,IAAI,CACN,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,sBAAsB,MAAM,CAAC,cAAc,qBAAqB,CACxF,CAAA;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAChE,IAAI,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,CACR,GAAG,MAAM,CAAC,eAAe,qEAAqE,CAC/F,CAAA;QACH,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAA;YAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAA;QACzD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;IACnC,CAAC;AACH,CAAC"}

package/dist/commands/media-images.d.ts

@@ -0,0 +1,67 @@
+import type { ImageSize, MediaImageProcessor } from '@cogenta/api';
+import type { Logger } from '@cogenta/core';
+import { contentTypeOf, type ImageFormat, type ImageTransformer } from '@cogenta/render';
+/**
+ * `@cogenta/render`'s image pipeline, wired to the media upload (L10 task 5).
+ *
+ * The pipeline, `srcset.ts` and the two driver tiers (sharp, WASM libvips)
+ * have existed since L3 and were called by nothing. This module is where they
+ * meet a real upload.
+ *
+ * ## Why variants are produced at upload rather than on demand
+ *
+ * `createImagePipeline` is deliberately lazy — it renders a variant the first
+ * time a browser asks for one — and that is the right design for a build step
+ * that would otherwise materialise N formats × M widths × K images. It is the
+ * wrong design here, and the lot says so explicitly ("au moment de l'upload,
+ * pas à la volée"), for a reason worth writing down: `cogenta serve` has no
+ * durable variant cache. `createMemoryVariantStore` dies with the process, so
+ * a lazy pipeline behind it re-decodes every image after every restart, and
+ * on the shared hosting Cogenta targets (R10's own list) that is the slowest
+ * possible answer on the coldest possible machine.
+ *
+ * Producing a bounded, deterministic set once — the `SRCSET_WIDTHS` ladder,
+ * capped at the intrinsic width, in WebP — makes the set nameable, which is
+ * what lets `variantNames` clean them up on delete without a `list` call the
+ * `StorageDriver` interface does not have.
+ *
+ * ## Why WebP and not AVIF
+ *
+ * WebP is universally supported in 2026 and encodes in a fraction of AVIF's
+ * time. AVIF's extra compression is real, but paying it per upload on a
+ * WASM tier — the tier that always exists (R10) — would make an upload of a
+ * handful of images take minutes. A second format can be added the day the
+ * pipeline is asked for one, and the ladder is the only thing that has to
+ * change.
+ */
+declare const VARIANT_FORMAT: ImageFormat;
+/** The name of one rendition under an asset's variant prefix. */
+export declare function variantName(width: number, format?: ImageFormat): string;
+/**
+ * The widths actually produced for an image.
+ *
+ * `candidateWidths` caps the ladder at the intrinsic width, so a 500px logo
+ * yields 320 and 500 rather than five upscaled copies of itself — upscaling
+ * costs bytes and gains nothing.
+ */
+export declare function variantWidthsFor(intrinsic: ImageSize): readonly number[];
+export interface MediaImageProcessorOptions {
+    readonly transformer: ImageTransformer;
+    readonly quality?: number;
+}
+export declare function createMediaImageProcessor(options: MediaImageProcessorOptions): MediaImageProcessor;
+/**
+ * The processor for the driver this host can actually run, or `null`.
+ *
+ * `null` rather than a throw: an install where neither tier loads must still
+ * upload and serve images at their original size. That is the same "absent,
+ * not broken" degradation R2 applies to the LLM and R1 to every other driver
+ * — a CMS that refuses an upload because a WebAssembly module would not boot
+ * is worse than one that serves a full-size JPEG.
+ */
+export declare function selectMediaImageProcessor(logger: Logger): Promise<{
+    processor: MediaImageProcessor;
+    driver: string;
+} | null>;
+export { contentTypeOf, VARIANT_FORMAT };
+//# sourceMappingURL=media-images.d.ts.map

package/dist/commands/media-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-images.d.ts","sourceRoot":"","sources":["../../src/commands/media-images.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAwB,MAAM,cAAc,CAAA;AACxF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAEL,aAAa,EAGb,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAItB,MAAM,iBAAiB,CAAA;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,QAAA,MAAM,cAAc,EAAE,WAAoB,CAAA;AAE1C,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,WAA4B,GAAG,MAAM,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAExE;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAsCrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,SAAS,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAapE;AAED,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,CAAA"}

package/dist/commands/media-images.js

@@ -0,0 +1,107 @@
+import { candidateWidths, contentTypeOf, createImageRegistry, DEFAULT_QUALITY, planTransform, SRCSET_WIDTHS, suffixOf, } from '@cogenta/render';
+/**
+ * `@cogenta/render`'s image pipeline, wired to the media upload (L10 task 5).
+ *
+ * The pipeline, `srcset.ts` and the two driver tiers (sharp, WASM libvips)
+ * have existed since L3 and were called by nothing. This module is where they
+ * meet a real upload.
+ *
+ * ## Why variants are produced at upload rather than on demand
+ *
+ * `createImagePipeline` is deliberately lazy — it renders a variant the first
+ * time a browser asks for one — and that is the right design for a build step
+ * that would otherwise materialise N formats × M widths × K images. It is the
+ * wrong design here, and the lot says so explicitly ("au moment de l'upload,
+ * pas à la volée"), for a reason worth writing down: `cogenta serve` has no
+ * durable variant cache. `createMemoryVariantStore` dies with the process, so
+ * a lazy pipeline behind it re-decodes every image after every restart, and
+ * on the shared hosting Cogenta targets (R10's own list) that is the slowest
+ * possible answer on the coldest possible machine.
+ *
+ * Producing a bounded, deterministic set once — the `SRCSET_WIDTHS` ladder,
+ * capped at the intrinsic width, in WebP — makes the set nameable, which is
+ * what lets `variantNames` clean them up on delete without a `list` call the
+ * `StorageDriver` interface does not have.
+ *
+ * ## Why WebP and not AVIF
+ *
+ * WebP is universally supported in 2026 and encodes in a fraction of AVIF's
+ * time. AVIF's extra compression is real, but paying it per upload on a
+ * WASM tier — the tier that always exists (R10) — would make an upload of a
+ * handful of images take minutes. A second format can be added the day the
+ * pipeline is asked for one, and the ladder is the only thing that has to
+ * change.
+ */
+const VARIANT_FORMAT = 'webp';
+/** The name of one rendition under an asset's variant prefix. */
+export function variantName(width, format = VARIANT_FORMAT) {
+    return `${width}.${suffixOf(format)}`;
+}
+/**
+ * The widths actually produced for an image.
+ *
+ * `candidateWidths` caps the ladder at the intrinsic width, so a 500px logo
+ * yields 320 and 500 rather than five upscaled copies of itself — upscaling
+ * costs bytes and gains nothing.
+ */
+export function variantWidthsFor(intrinsic) {
+    return candidateWidths(intrinsic.width, intrinsic.width, SRCSET_WIDTHS);
+}
+export function createMediaImageProcessor(options) {
+    const { transformer } = options;
+    const quality = options.quality ?? DEFAULT_QUALITY;
+    return {
+        probe: async (bytes) => {
+            try {
+                const metadata = await transformer.metadata(bytes);
+                return { width: metadata.width, height: metadata.height };
+            }
+            catch {
+                // Not an image this tier can decode. The upload is still legitimate —
+                // `verifyRealType` already sniffed the container — so the honest
+                // answer is "no dimensions", not a refusal.
+                return null;
+            }
+        },
+        variants: async (bytes, intrinsic) => {
+            const metadata = await transformer.metadata(bytes);
+            const produced = [];
+            for (const width of variantWidthsFor(intrinsic)) {
+                const rendered = await transformer.transform(bytes, planTransform(metadata, { width, format: VARIANT_FORMAT, quality }));
+                produced.push({
+                    name: variantName(width, VARIANT_FORMAT),
+                    bytes: rendered.bytes,
+                    contentType: rendered.contentType,
+                });
+            }
+            return produced;
+        },
+        variantNames: (intrinsic) => variantWidthsFor(intrinsic).map((width) => variantName(width)),
+    };
+}
+/**
+ * The processor for the driver this host can actually run, or `null`.
+ *
+ * `null` rather than a throw: an install where neither tier loads must still
+ * upload and serve images at their original size. That is the same "absent,
+ * not broken" degradation R2 applies to the LLM and R1 to every other driver
+ * — a CMS that refuses an upload because a WebAssembly module would not boot
+ * is worse than one that serves a full-size JPEG.
+ */
+export async function selectMediaImageProcessor(logger) {
+    try {
+        const selection = await createImageRegistry({ logger }).select({});
+        return {
+            processor: createMediaImageProcessor({ transformer: selection.instance }),
+            driver: selection.driver,
+        };
+    }
+    catch (error) {
+        logger.warn('no image driver available; uploads will carry no variants', {
+            error: String(error),
+        });
+        return null;
+    }
+}
+export { contentTypeOf, VARIANT_FORMAT };
+//# sourceMappingURL=media-images.js.map

package/dist/commands/media-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-images.js","sourceRoot":"","sources":["../../src/commands/media-images.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,eAAe,EAGf,aAAa,EACb,aAAa,EACb,QAAQ,GACT,MAAM,iBAAiB,CAAA;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,cAAc,GAAgB,MAAM,CAAA;AAE1C,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAM,GAAgB,cAAc;IAC7E,OAAO,GAAG,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAoB;IACnD,OAAO,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;AACzE,CAAC;AAOD,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAA;IAElD,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBAClD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,iEAAiE;gBACjE,4CAA4C;gBAC5C,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAClD,MAAM,QAAQ,GAA2B,EAAE,CAAA;YAE3C,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAC1C,KAAK,EACL,aAAa,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CACpE,CAAA;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC;oBACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;iBAClC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,YAAY,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;KAC5F,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClE,OAAO;YACL,SAAS,EAAE,yBAAyB,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;YACzE,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;YACvE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACrB,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,CAAA"}

package/dist/commands/search-page.d.ts

@@ -0,0 +1,40 @@
+import type { AccessContext, ContentGateway, SearchRouter } from '@cogenta/api';
+import { type CollectionDefinition } from '@cogenta/schema';
+/**
+ * `GET /search?q=…` — the public half of L10 task 3.
+ *
+ * The lot asks for "un bloc `search` optionnel côté thème public (formulaire
+ * + page de résultats)". The form and the results page are here; the **block**
+ * deliberately is not.
+ *
+ * Contract B is frozen (2026-08-13) and AGENTS.md forbids adding a block to
+ * the vocabulary without an RFC. A `search` block would be a contract B
+ * addition, so it would need a major version bump and a migration note — a
+ * decision that does not belong inside a lot whose whole premise is "no new
+ * capability, only wiring". A real route serving a real results page gives a
+ * visitor the same thing without touching the contract at all; when an RFC
+ * for a `search` block does happen, it can render through this same query.
+ *
+ * The page is `noindex`: a search results page is exactly the kind of thin,
+ * infinitely-many-URLs page a crawler must not index, and `buildMetaTags`
+ * takes `noindex` as an option precisely for it.
+ */
+export interface SearchPageOptions {
+    readonly router: SearchRouter;
+    readonly gateway: ContentGateway;
+    readonly collections: readonly CollectionDefinition[];
+    readonly site: {
+        readonly name: string;
+        readonly url: string;
+        readonly locales: readonly string[];
+        readonly defaultLocale: string;
+    };
+    /** The joined skin+theme stylesheet `cogenta serve` serves at `STYLESHEET_PATH` (`theme-render.ts`'s `joinStyles`). `null` when neither could be loaded — served unstyled rather than refused. */
+    readonly styles: string | null;
+}
+/**
+ * The whole page. Returns HTML; the caller decides the status code (always
+ * 200 — an empty result set is an answer, not a failure).
+ */
+export declare function renderSearchPage(query: string, options: SearchPageOptions, context: AccessContext): Promise<string>;
+//# sourceMappingURL=search-page.d.ts.map

package/dist/commands/search-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-page.d.ts","sourceRoot":"","sources":["../../src/commands/search-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC/E,OAAO,EAAa,KAAK,oBAAoB,EAAkB,MAAM,iBAAiB,CAAA;AAItF;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC/B,CAAA;IACD,kMAAkM;IAClM,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AA+ED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,CAmDjB"}

package/dist/commands/search-page.js

@@ -0,0 +1,104 @@
+import { buildPath } from '@cogenta/schema';
+import { escapeHtmlAttribute, escapeHtmlText } from '@cogenta/seo';
+import { STYLESHEET_PATH } from './theme-render.js';
+/**
+ * Turns hits into links.
+ *
+ * The hit itself carries no URL — the index stores text, not routes — so each
+ * one is read back through the same permission-checked gateway that answered
+ * the search. An entry in a collection with no `routing`, or whose route
+ * parameters are incomplete, is listed without a link rather than with a URL
+ * that 404s.
+ */
+async function resolveHits(hits, options, context) {
+    const byName = new Map(options.collections.map((collection) => [collection.name, collection]));
+    const resolved = [];
+    for (const hit of hits) {
+        const collection = byName.get(hit.collection);
+        if (collection === undefined)
+            continue;
+        let href = null;
+        if (collection.routing !== undefined) {
+            const entry = await options.gateway.read(hit.collection, hit.id, context);
+            if (entry !== null) {
+                const params = Object.fromEntries(Object.entries(entry.values).filter((pair) => typeof pair[1] === 'string'));
+                const complete = collection.routing.pattern
+                    .split('/')
+                    .filter((segment) => segment.startsWith(':'))
+                    .every((segment) => params[segment.slice(1)] !== undefined || segment === ':id');
+                if (complete) {
+                    href = buildPath(collection, { ...params, id: entry.id }, collection.routing.locale === true ? entry.locale : undefined);
+                }
+            }
+        }
+        resolved.push({ title: hit.title.length > 0 ? hit.title : hit.id, href });
+    }
+    return resolved;
+}
+/** The form on its own, so an empty query still gets a usable page. */
+function searchForm(query) {
+    return `<form class="cg-search__form" action="/search" method="get" role="search">
+<label for="cg-search-q">Search</label>
+<input id="cg-search-q" type="search" name="q" value="${escapeHtmlAttribute(query)}" required>
+<button type="submit">Search</button>
+</form>`;
+}
+function resultList(results) {
+    if (results.length === 0)
+        return `<p class="cg-search__empty">Nothing matched that search.</p>`;
+    return `<ol class="cg-search__results">
+${results
+        .map((result) => result.href === null
+        ? `<li>${escapeHtmlText(result.title)}</li>`
+        : `<li><a href="${escapeHtmlAttribute(result.href)}">${escapeHtmlText(result.title)}</a></li>`)
+        .join('\n')}
+</ol>`;
+}
+/**
+ * The whole page. Returns HTML; the caller decides the status code (always
+ * 200 — an empty result set is an answer, not a failure).
+ */
+export async function renderSearchPage(query, options, context) {
+    const trimmed = query.trim();
+    let results = [];
+    let failure = null;
+    if (trimmed.length > 0) {
+        const response = await options.router.handle({ method: 'GET', path: '/api/search', query: { q: trimmed } }, context);
+        if (response.status === 200) {
+            const body = response.body;
+            results = await resolveHits(body.data, options, context);
+        }
+        else {
+            // The router's own message, never a rewritten one: it already says what
+            // failed and what to do about it, and inventing a second wording here
+            // is how the two drift apart.
+            const body = response.body;
+            failure = body.error?.message ?? 'The search could not be completed.';
+        }
+    }
+    const heading = trimmed.length === 0 ? 'Search' : `Search results for “${escapeHtmlText(trimmed)}”`;
+    const main = failure !== null
+        ? `<p class="cg-search__error" role="alert">${escapeHtmlText(failure)}</p>`
+        : trimmed.length === 0
+            ? ''
+            : resultList(results);
+    return `<!doctype html>
+<html lang="${escapeHtmlAttribute(options.site.defaultLocale)}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${heading} — ${escapeHtmlText(options.site.name)}</title>
+<meta name="robots" content="noindex, follow" />
+${options.styles === null ? '' : `<link rel="stylesheet" href="${STYLESHEET_PATH}">`}
+</head>
+<body>
+<main class="cg-main" id="cg-main">
+<h1 class="cg-page__title">${heading}</h1>
+${searchForm(trimmed)}
+${main}
+</main>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=search-page.js.map

package/dist/commands/search-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-page.js","sourceRoot":"","sources":["../../src/commands/search-page.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAA6C,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAyCnD;;;;;;;;GAQG;AACH,KAAK,UAAU,WAAW,CACxB,IAA0B,EAC1B,OAA0B,EAC1B,OAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAElC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,UAAU,KAAK,SAAS;YAAE,SAAQ;QAEtC,IAAI,IAAI,GAAkB,IAAI,CAAA;QAC9B,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YACzE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CACjC,CAAC,IAAI,EAA4B,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAChE,CACF,CAAA;gBACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO;qBACxC,KAAK,CAAC,GAAG,CAAC;qBACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;qBAC5C,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAC,CAAA;gBAClF,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,GAAG,SAAS,CACd,UAAU,EACV,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAC3B,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAC9D,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO;;wDAE+C,mBAAmB,CAAC,KAAK,CAAC;;QAE1E,CAAA;AACR,CAAC;AAED,SAAS,UAAU,CAAC,OAA+B;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,8DAA8D,CAAA;IAC/F,OAAO;EACP,OAAO;SACN,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACd,MAAM,CAAC,IAAI,KAAK,IAAI;QAClB,CAAC,CAAC,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;QAC5C,CAAC,CAAC,gBAAgB,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CACjG;SACA,IAAI,CAAC,IAAI,CAAC;MACP,CAAA;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,OAA0B,EAC1B,OAAsB;IAEtB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAE5B,IAAI,OAAO,GAA2B,EAAE,CAAA;IACxC,IAAI,OAAO,GAAkB,IAAI,CAAA;IAEjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAC1C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAC7D,OAAO,CACR,CAAA;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+C,CAAA;YACrE,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA0D,CAAA;YAChF,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,oCAAoC,CAAA;QACvE,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAA;IAErF,MAAM,IAAI,GACR,OAAO,KAAK,IAAI;QACd,CAAC,CAAC,4CAA4C,cAAc,CAAC,OAAO,CAAC,MAAM;QAC3E,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAE3B,OAAO;cACK,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;;;;SAIpD,OAAO,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;EAErD,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,eAAe,IAAI;;;;6BAIvD,OAAO;EAClC,UAAU,CAAC,OAAO,CAAC;EACnB,IAAI;;;;CAIL,CAAA;AACD,CAAC"}

package/dist/commands/security-alerts.d.ts

@@ -0,0 +1,24 @@
+import type { RateLimiter } from '@cogenta/auth';
+import type { Logger } from '@cogenta/core';
+export interface SecurityAlertOptions {
+    readonly rateLimit: RateLimiter;
+    /** Where the alert is delivered. `null` disables the outbound half entirely. */
+    readonly send: ((event: string, data: Readonly<Record<string, unknown>>) => Promise<void>) | null;
+    /** Absolute base URL of the site, for the alert's required admin link. */
+    readonly siteUrl: string;
+    readonly logger: Logger;
+    /** Attempts inside the limiter's window past which an alert is worth sending. */
+    readonly minAttempts?: number;
+    readonly cooldownMs?: number;
+    readonly now?: () => number;
+}
+export interface SecurityAlertWatch {
+    /**
+     * Called after every `/api/auth/*` response. Cheap and silent for the
+     * overwhelming majority — a successful sign-in never touches the database
+     * here at all.
+     */
+    observe(status: number): Promise<void>;
+}
+export declare function createSecurityAlertWatch(options: SecurityAlertOptions): SecurityAlertWatch;
+//# sourceMappingURL=security-alerts.d.ts.map

package/dist/commands/security-alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-alerts.d.ts","sourceRoot":"","sources":["../../src/commands/security-alerts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuB,WAAW,EAAE,MAAM,eAAe,CAAA;AAErE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AA2B3C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IACjG,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvC;AAcD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,CAuD1F"}

package/dist/commands/security-alerts.js

@@ -0,0 +1,82 @@
+import { buildAlert } from '@cogenta/channels';
+/**
+ * The outbound half of L14 task 4 — "exposer ça comme alerte dans le
+ * dashboard/canaux, réutilisant `@cogenta/channels`".
+ *
+ * The dashboard half is `createSuspiciousActivitySource` in `@cogenta/api`.
+ * This is the half that leaves the site, and it deliberately reuses two things
+ * that already exist rather than inventing a third: `buildAlert` (L6, with its
+ * enforced title/severity/context/expected-action/admin-link shape and its
+ * screen budget) and the signed webhook sender L14 task 1 just connected. No
+ * second notification path, no second signature.
+ *
+ * **Why the trigger is a failed request, not a timer.** Rule R1 guarantees no
+ * durable worker, so anything that "checks periodically" here would be a
+ * promise the deployment cannot keep. A brute-force run *is* a stream of
+ * requests, so the requests themselves are the clock — which also means the
+ * alert arrives while the attack is happening rather than up to a poll
+ * interval later.
+ */
+/** Statuses that mean a sign-in attempt was refused. 429 is the limiter itself. */
+const REFUSED_STATUSES = new Set([401, 429]);
+/** At most one alert per this long, however many attempts arrive. */
+const DEFAULT_COOLDOWN_MS = 5 * 60 * 1000;
+function summarise(summaries) {
+    return {
+        attempts: summaries.reduce((total, summary) => total + summary.attempts, 0),
+        subjects: summaries.length,
+        blocked: summaries.filter((summary) => summary.blocked).length,
+    };
+}
+export function createSecurityAlertWatch(options) {
+    const now = options.now ?? Date.now;
+    const cooldownMs = options.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+    let lastAlertAt = 0;
+    return {
+        observe: async (status) => {
+            if (options.send === null)
+                return;
+            if (!REFUSED_STATUSES.has(status))
+                return;
+            // The cooldown is checked *before* the query, not after: a script making
+            // twenty attempts a second must not turn into twenty aggregate queries a
+            // second. The alert is about a situation, not about one request.
+            if (now() - lastAlertAt < cooldownMs)
+                return;
+            try {
+                const summaries = await options.rateLimit.recentFailures(options.minAttempts === undefined ? undefined : { minAttempts: options.minAttempts });
+                if (summaries.length === 0)
+                    return;
+                const totals = summarise(summaries);
+                lastAlertAt = now();
+                const adminUrl = new URL('/admin', options.siteUrl).toString();
+                // Counts, never the accounts — same rule as the admin notice. An
+                // outbound message travels further than a screen does, and an email
+                // address in it is an address in somebody else's inbox and logs.
+                const alert = buildAlert({
+                    title: 'Repeated failed sign-in attempts',
+                    severity: totals.blocked > 0 ? 'critical' : 'warning',
+                    context: `${totals.attempts} failed sign-in attempts across ${totals.subjects} account(s) in the last 15 minutes${totals.blocked > 0 ? `, ${totals.blocked} of them now rate-limited` : ''}.`,
+                    expectedAction: 'Check the audit log, and confirm the affected accounts still have strong passwords and a second factor.',
+                    adminUrl,
+                });
+                await options.send('security.suspicious_activity', {
+                    severity: alert.severity,
+                    title: alert.title,
+                    context: alert.context,
+                    expectedAction: alert.expectedAction,
+                    adminUrl: alert.adminUrl,
+                    attempts: totals.attempts,
+                    subjects: totals.subjects,
+                    blocked: totals.blocked,
+                });
+            }
+            catch (error) {
+                // Never let watching a failure turn into a second failure: the sign-in
+                // response has already been written by the time this runs.
+                options.logger.error('suspicious activity alert failed', { error: String(error) });
+            }
+        },
+    };
+}
+//# sourceMappingURL=security-alerts.js.map

package/dist/commands/security-alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-alerts.js","sourceRoot":"","sources":["../../src/commands/security-alerts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C;;;;;;;;;;;;;;;;;GAiBG;AAEH,mFAAmF;AACnF,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAEjE,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAwBzC,SAAS,SAAS,CAAC,SAAyC;IAK1D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,QAAQ,EAAE,SAAS,CAAC,MAAM;QAC1B,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM;KAC/D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA6B;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC5D,IAAI,WAAW,GAAG,CAAC,CAAA;IAEnB,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAM;YACjC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAM;YACzC,yEAAyE;YACzE,yEAAyE;YACzE,iEAAiE;YACjE,IAAI,GAAG,EAAE,GAAG,WAAW,GAAG,UAAU;gBAAE,OAAM;YAE5C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,cAAc,CACtD,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CACrF,CAAA;gBACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAM;gBAElC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;gBACnC,WAAW,GAAG,GAAG,EAAE,CAAA;gBAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;gBAC9D,iEAAiE;gBACjE,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,KAAK,GAAG,UAAU,CAAC;oBACvB,KAAK,EAAE,kCAAkC;oBACzC,QAAQ,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;oBACrD,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,mCAAmC,MAAM,CAAC,QAAQ,qCAC3E,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,EACxE,GAAG;oBACH,cAAc,EACZ,yGAAyG;oBAC3G,QAAQ;iBACT,CAAC,CAAA;gBAEF,MAAM,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uEAAuE;gBACvE,2DAA2D;gBAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACpF,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}