@cogenta/cli 0.3.0 → 0.4.0

package/dist/commands/serve.js

@@ -3,10 +3,15 @@ import { createServer } from 'node:http';
 import { dirname, join } from 'node:path';
 import process from 'node:process';
 import { pathToFileURL } from 'node:url';
-import { buildContentSchema, createAgentsRouter, createAssistantRouter, createAuditRouter, createAuthRouter, createContentGateway, createContentService, createMediaRouter, createMfaRecommendationSource, createNoticeDismissalStore, createNoticeRouter, createPermissionLayer, createRestRouter, createSearchRouter, createSitePlanRouter, createSuspiciousActivitySource, createTaxonomyRouter, createUsersRouter, errorResponse, executeGraphQL, resolveActor, variantKeyFor, } from '@cogenta/api';
+import { createAnalyticsStore, ensureAnalyticsTables, } from '@cogenta/analytics';
+import { buildContentSchema, createAgentsRouter, createAnalyticsRouter, createApiKeysRouter, createAssistantRouter, createAuditRouter, createAuthRouter, createContentGateway, createContentService, createImportRouter, createMarketplaceRouter, createMediaRouter, createMenuRouter, createMfaRecommendationSource, createNoticeDismissalStore, createNoticeRouter, createOpsStatusRouter, createPermissionLayer, createRedirectRouter, createRestRouter, createSearchRouter, createSitePlanRouter, createSuspiciousActivitySource, createTaxonomyRouter, createUsersRouter, errorResponse, executeGraphQL, resolveActor, variantKeyFor, } from '@cogenta/api';
 import { createAuthStore } from '@cogenta/auth';
-import { CogentaError, createDatabaseMediaStore, createDatabaseRegistry, createLogger, createStorageRegistry, isCogentaError, loadConfig, } from '@cogenta/core';
-import { buildSchemaDocument, createContentStore, createRedirectStore, createSchemaTables, createSearchIndex, createTaxonomyStore, withLifecycleEvents, withReadOnlyStore, withSearchIndexing, } from '@cogenta/schema';
+import { createCartStore, createCatalogStore, createCommerceAdminRouter, createCommercePermissions, createCouponStore, createCustomerStore, createInvoiceStore, createManualPaymentGateway, createOrderStore, createPaymentStore, createShippingStore, createSubscriptionStore, createTaxStore, ensureCommerceTables, } from '@cogenta/commerce';
+import { CogentaError, createDatabaseMediaStore, createDatabaseQueue, createDatabaseRegistry, createLogger, createStorageRegistry, isCogentaError, loadConfig, } from '@cogenta/core';
+import { importWordPress } from '@cogenta/import';
+import { createMarketplaceCatalog, createMarketplaceInstaller, createPluginGrantStore, ensureMarketplaceTables, ensurePluginTables, } from '@cogenta/plugins';
+import { buildPath, buildSchemaDocument, createContentStore, createMenuStore, createRedirectStore, createSchemaTables, createSearchIndex, createTaxonomyStore, ensureMenuTables, registerScheduledPublishing, withLifecycleEvents, withReadOnlyStore, withScheduledPublishEnqueue, withSearchIndexing, } from '@cogenta/schema';
+import { sendResetMail } from '../reset-mail.js';
 import { serveAdminAsset } from './admin-assets.js';
 import { buildAssistant, withVectorIndexing } from './assistant.js';
 import { createContentWebhookEmitter } from './content-webhooks.js';
@@ -170,6 +175,14 @@ async function assembleSite(options) {
     // assistant so the semantic half can be fused with *this* index rather than
     // with a second one over the same table.
     const searchIndex = options.searchIndex ?? (await createSearchIndex({ db }));
+    // Scheduled publication (L1's `schedulePublication`/`registerScheduledPublishing`,
+    // written and tested from the start but never wired to anything — the admin
+    // showed "Scheduled" as a read-only badge). The `database` queue driver is
+    // the R1-honest choice: no Redis, no external worker, just a table in the
+    // site's own database, drained by `runServe`'s own `setInterval` tick — see
+    // the comment there for the lateness this trades for not requiring a
+    // persistent process.
+    const scheduledPublishQueue = createDatabaseQueue({ db, logger });
     const stores = new Map();
     const storeFor = (collection) => {
         const existing = stores.get(collection.name);
@@ -180,9 +193,20 @@ async function assembleSite(options) {
         // left to refuse at that moment.
         const created = createContentStore({ db, collection, siblings: collections });
         const guarded = readOnly ? withReadOnlyStore(created) : created;
+        // Queues the real publish job for a save that lands as `status:
+        // 'scheduled'`. Placed right after the read-only guard so a write that
+        // guard refused never reaches the queue either.
+        const schedulable = withScheduledPublishEnqueue(guarded, {
+            collection,
+            queue: scheduledPublishQueue,
+            onError: (error) => logger.error('scheduled publish enqueue failed', {
+                collection: collection.name,
+                error: String(error),
+            }),
+        });
         // Outermost, so a read-only refusal happens *before* anything is indexed:
         // a write that never landed must not change the index either.
-        const indexed = withSearchIndexing(guarded, {
+        const indexed = withSearchIndexing(schedulable, {
             collection,
             index: searchIndex,
             onError: (error) => logger.error('search index write failed', {
@@ -232,6 +256,19 @@ async function assembleSite(options) {
     // same, already-complete map.
     for (const collection of collections)
         storeFor(collection);
+    // The publish half of scheduling: re-reads the entry before acting, so an
+    // entry edited back to `draft` — or already published by hand — before its
+    // hour comes is left alone rather than redone by a job still sitting in
+    // the queue (see `withScheduledPublishEnqueue`, which enqueues again on
+    // every save rather than tracking a previous job id).
+    registerScheduledPublishing(scheduledPublishQueue, async (publication) => {
+        const target = stores.get(publication.collection);
+        if (target === undefined)
+            return;
+        const entry = await target.read(publication.entryId, { state: 'working' });
+        if (entry?.status === 'scheduled')
+            await target.publish(publication.entryId);
+    }, { logger });
     const redirects = createRedirectStore({ db });
     await redirects.ensureTable();
     const permissions = createPermissionLayer({ collections });
@@ -262,11 +299,127 @@ async function assembleSite(options) {
     const mediaStore = createDatabaseMediaStore({ db });
     const noticeDismissals = createNoticeDismissalStore(db);
     await noticeDismissals.ensureTable();
+    // L17: a local/embedded catalog, not a distant service — L13's API keys,
+    // which the lot names as that dependency, were never built. Empty until a
+    // site configures one; a marketplace router that always answers is what
+    // lets the admin screen render instead of guessing whether one exists.
+    await ensurePluginTables(db);
+    await ensureMarketplaceTables(db);
+    const marketplaceGrants = createPluginGrantStore(db);
+    const marketplaceCatalog = createMarketplaceCatalog(options.marketplace?.catalog ?? []);
+    const marketplaceInstaller = createMarketplaceInstaller(db, {
+        grantStore: marketplaceGrants,
+        ...(options.marketplace?.trustedPublicKeys === undefined
+            ? {}
+            : { trustedPublicKeys: options.marketplace.trustedPublicKeys }),
+    });
+    // Menus (navigation). Not schema-declared, so one fixed pair of tables
+    // rather than one per taxonomy — see `menu-tables.ts`.
+    await ensureMenuTables(db);
+    const menuStore = createMenuStore({ db });
+    const gateway = createContentGateway({ collections, stores, permissions });
+    // Resolves an `entry`-kind menu item to a display label and public route,
+    // through the same permission-checked gateway everything else reads
+    // through. `ANONYMOUS`: a menu is public navigation, so an item is only
+    // ever resolved to what an anonymous visitor could also reach — an
+    // unpublished target resolves to `null` rather than leaking a draft's
+    // title into a public nav response.
+    const resolveMenuEntry = async (collectionName, entryId) => {
+        const collection = collections.find((candidate) => candidate.name === collectionName);
+        if (collection === undefined)
+            return null;
+        const entry = await gateway.read(collectionName, entryId, {
+            actor: { id: null, roles: ['public'] },
+        });
+        if (entry === null)
+            return null;
+        const stringValues = Object.fromEntries(Object.entries(entry.values).filter((pair) => typeof pair[1] === 'string'));
+        const label = typeof entry.values['title'] === 'string'
+            ? entry.values['title']
+            : typeof entry.values['name'] === 'string'
+                ? entry.values['name']
+                : entryId;
+        let route = null;
+        if (collection.routing !== undefined) {
+            try {
+                route = buildPath(collection, stringValues, entry.locale ?? undefined);
+            }
+            catch {
+                // A route field is missing on this entry (e.g. an empty slug on a
+                // draft). The item still resolves — with a label, no link — rather
+                // than failing the whole menu response over one broken reference.
+                route = null;
+            }
+        }
+        return { label, route };
+    };
+    // Contract E (ADR-0024): a whole separate domain, wired the same way the
+    // taxonomy tables are — created idempotently, once, here, so a site that
+    // never sells anything pays nothing beyond a handful of `create table if
+    // not exists` statements it never queries.
+    await ensureCommerceTables(db);
+    const commerceCatalog = createCatalogStore(db);
+    const commerceCustomers = createCustomerStore(db);
+    const commerceTax = createTaxStore(db);
+    const commerceShipping = createShippingStore(db);
+    const commerceCoupons = createCouponStore(db);
+    const commerceCarts = createCartStore(db, {
+        catalog: commerceCatalog,
+        tax: commerceTax,
+        shipping: commerceShipping,
+        coupons: commerceCoupons,
+    });
+    const commerceOrders = createOrderStore(db, {
+        catalog: commerceCatalog,
+        carts: commerceCarts,
+        customers: commerceCustomers,
+        coupons: commerceCoupons,
+    });
+    // The manual/bank-transfer driver: the one payment gateway that needs no
+    // provider keys, so a shop is sellable before anyone configures Stripe
+    // (mirrors R1 — a real degraded implementation, not a stub).
+    const commercePayments = createPaymentStore(db, {
+        gateway: createManualPaymentGateway(),
+        orders: commerceOrders,
+    });
+    const commercePermissions = createCommercePermissions();
+    const commerceSubscriptions = createSubscriptionStore(db, {
+        catalog: commerceCatalog,
+        customers: commerceCustomers,
+        orders: commerceOrders,
+        payments: commercePayments,
+    });
+    // Absent until the site fills in `billing` (contract E, ADR-0024): an
+    // invoice with a made-up seller address is worse than no invoicing at all,
+    // so the route stays unreachable rather than issuing one anyway.
+    const billing = options.billing;
+    const commerceInvoices = billing === undefined
+        ? undefined
+        : createInvoiceStore(db, {
+            orders: commerceOrders,
+            seller: {
+                address: [billing.legalName, ...billing.address],
+                ...(() => {
+                    const footer = [billing.taxId, billing.footer]
+                        .filter((part) => part !== undefined)
+                        .join(' — ');
+                    return footer === '' ? {} : { footer };
+                })(),
+            },
+        });
+    await ensureAnalyticsTables(db);
+    const analyticsStore = createAnalyticsStore(db);
+    const siteHost = new URL(site.url).hostname;
     return {
         db,
         auth,
         restRouter: createRestRouter({ service, siteUrl: site.url }),
-        authRouter: createAuthRouter({ auth }),
+        authRouter: createAuthRouter({
+            auth,
+            ...(options.onForgotPassword == null ? {} : { onForgotPassword: options.onForgotPassword }),
+        }),
+        analyticsStore,
+        analyticsRouter: createAnalyticsRouter({ store: analyticsStore, siteHost }),
         mediaRouter: createMediaRouter({
             store: mediaStore,
             storage,
@@ -280,6 +433,26 @@ async function assembleSite(options) {
             permissions,
             storeFor: (taxonomy) => taxonomyStoreFor(taxonomy),
         }),
+        marketplaceRouter: createMarketplaceRouter({
+            catalog: marketplaceCatalog,
+            installer: marketplaceInstaller,
+        }),
+        menuRouter: createMenuRouter({ store: menuStore, resolveEntry: resolveMenuEntry }),
+        commerceRouter: createCommerceAdminRouter({
+            catalog: commerceCatalog,
+            orders: commerceOrders,
+            customers: commerceCustomers,
+            payments: commercePayments,
+            coupons: commerceCoupons,
+            subscriptions: commerceSubscriptions,
+            ...(commerceInvoices === undefined ? {} : { invoices: commerceInvoices }),
+            permissions: commercePermissions,
+        }),
+        redirectRouter: createRedirectRouter({ store: redirects }),
+        opsStatusRouter: createOpsStatusRouter({
+            security: options.security,
+            webhooks: options.webhooks,
+        }),
         searchRouter: createSearchRouter({
             index: searchIndex,
             collections,
@@ -309,6 +482,7 @@ async function assembleSite(options) {
             dismissals: noticeDismissals,
         }),
         usersRouter: createUsersRouter({ auth }),
+        apiKeysRouter: createApiKeysRouter({ auth }),
         assistantRouter: createAssistantRouter({
             toolset: (options.assistant?.toolset ?? EMPTY_TOOLSET),
             collections,
@@ -320,11 +494,18 @@ async function assembleSite(options) {
         ...(options.sitePlans === undefined
             ? {}
             : { sitePlanRouter: createSitePlanRouter(options.sitePlans) }),
+        importRouter: createImportRouter({
+            // `db`/`storage` are the very ones already in scope for the rest of
+            // this function — `@cogenta/import`'s real importer, unchanged, never
+            // reimplemented here (R9: this package gains no dependency on it, only
+            // `@cogenta/cli` does, which already had one for the terminal command).
+            runWordPressImport: (xml) => importWordPress(xml, { db, storage }),
+        }),
         mediaStore,
         storage,
         images: options.images ?? null,
         graphqlSchema: buildContentSchema({ collections }),
-        gateway: createContentGateway({ collections, stores, permissions }),
+        gateway,
         permissions,
         schemaDocument: buildSchemaDocument(collections, { locales: site.locales, defaultLocale: site.defaultLocale }, taxonomies),
         redirects,
@@ -334,7 +515,9 @@ async function assembleSite(options) {
         styles,
         security: options.security,
         health: options.health,
+        tickScheduledPublishing: () => scheduledPublishQueue.tick(),
         dispose: async () => {
+            await scheduledPublishQueue.close();
             await db.close();
         },
     };
@@ -408,6 +591,35 @@ function toRestRequest(req, url, body) {
         ...(body === undefined ? {} : { body }),
     };
 }
+/**
+ * `CommerceRequest`'s `query` is single-valued (contract E has no route that
+ * takes a repeated key), unlike `RestRequest`'s — so this is its own small
+ * adapter rather than a cast of `toRestRequest`'s output.
+ */
+function toCommerceRequest(req, url, body) {
+    const query = {};
+    for (const key of url.searchParams.keys()) {
+        query[key] = url.searchParams.get(key) ?? undefined;
+    }
+    return {
+        method: req.method ?? 'GET',
+        path: url.pathname,
+        query,
+        ...(body === undefined ? {} : { body }),
+    };
+}
+/**
+ * The connecting socket's address — never trusted as anything more than an
+ * input to the daily session hash (`@cogenta/analytics`'s `hashSession`).
+ * No `x-forwarded-for` handling: trusting a client-supplied header for
+ * anything security- or privacy-relevant needs a configured trusted-proxy
+ * list this server does not have, and a wrong guess here would only ever
+ * make analytics *less* accurate, never leak anything (the header is never
+ * stored, only hashed).
+ */
+function clientIpOf(req) {
+    return req.socket.remoteAddress ?? 'unknown';
+}
 function responseId(response) {
     const data = response.body?.data;
     return typeof data?.id === 'string' ? data.id : undefined;
@@ -491,6 +703,28 @@ async function recordMediaAudit(site, actor, method, pathname, response, logger)
     })
         .catch((error) => logger.error('audit record failed', { error: String(error) }));
 }
+/**
+ * One entry per successful `POST /api/import/wordpress` — who ran it and how
+ * much it brought in, the same field the terminal command prints as
+ * `formatConversionReport`'s opening line. Never the document itself: a WXR
+ * export can carry a whole site's content, and the audit log is not a backup.
+ */
+async function recordImportAudit(site, actor, method, pathname, response, logger) {
+    if (method !== 'POST' || response.status < 200 || response.status >= 300)
+        return;
+    if (!pathname.startsWith('/api/import/'))
+        return;
+    const report = response.body?.data
+        ?.imported;
+    await site.auth.audit
+        .record({
+        actorId: actor.id,
+        actorRoles: actor.roles,
+        action: 'import.wordpress',
+        ...(report === undefined ? {} : { diff: report }),
+    })
+        .catch((error) => logger.error('audit record failed', { error: String(error) }));
+}
 async function recordAuthAudit(site, actor, method, pathname, response, logger) {
     if (response.status < 200 || response.status >= 300)
         return;
@@ -557,6 +791,37 @@ async function recordUserAudit(site, actor, method, pathname, response, logger)
     })
         .catch((error) => logger.error('audit record failed', { error: String(error) }));
 }
+/**
+ * Who minted or revoked a machine credential, in the same append-only log as
+ * every other account action (L13 task 8). The raw key itself never reaches
+ * this function — `POST`'s response carries it once, but the audit entry
+ * only ever names the key's id, exactly like `recordUserAudit` never logs a
+ * password.
+ */
+async function recordApiKeyAudit(site, actor, method, pathname, response, logger) {
+    if (response.status < 200 || response.status >= 300)
+        return;
+    const segments = pathname.split('/').filter((segment) => segment.length > 0);
+    // ['api', 'api-keys', <id?>]
+    const target = segments[2];
+    const action = method === 'POST' && target === undefined
+        ? 'apikey.create'
+        : method === 'DELETE' && target !== undefined
+            ? 'apikey.revoke'
+            : null;
+    if (action === null)
+        return;
+    const created = response.body?.data;
+    const subjectId = typeof created?.id === 'string' ? created.id : (target ?? null);
+    await site.auth.audit
+        .record({
+        actorId: actor.id,
+        actorRoles: actor.roles,
+        action,
+        ...(subjectId === null ? {} : { entryId: subjectId }),
+    })
+        .catch((error) => logger.error('audit record failed', { error: String(error) }));
+}
 function writeRestResponse(res, response) {
     res.writeHead(response.status, response.headers);
     res.end(response.body === null || response.body === undefined
@@ -834,6 +1099,40 @@ export function createRequestListener(site, logger) {
                 writeRestResponse(res, await site.taxonomyRouter.handle(request, context));
                 return;
             }
+            if (url.pathname.startsWith('/api/marketplace')) {
+                const body = req.method === 'GET' || req.method === 'DELETE' ? undefined : await readBody(req);
+                const request = toRestRequest(req, url, body);
+                writeRestResponse(res, await site.marketplaceRouter.handle(request, context.actor));
+                return;
+            }
+            // A menu is not schema-declared like a taxonomy, but it gets its own
+            // mount for the same reason: it is not a collection, and its router owns
+            // its own (fixed, not per-site-configurable) permission door.
+            if (url.pathname.startsWith('/api/menus')) {
+                const body = req.method === 'GET' || req.method === 'DELETE' ? undefined : await readBody(req);
+                const request = toRestRequest(req, url, body);
+                writeRestResponse(res, await site.menuRouter.handle(request, context));
+                return;
+            }
+            // Contract E's own back office, gated by its own permission vocabulary
+            // (`commerce.*`, ADR-0024) — never contract A's five actions, which do
+            // not stretch to "refund" or "issue an invoice".
+            if (url.pathname.startsWith('/api/commerce')) {
+                const body = req.method === 'GET' || req.method === 'DELETE' ? undefined : await readBody(req);
+                const request = toCommerceRequest(req, url, body);
+                const response = await site.commerceRouter.handle(request, context.actor);
+                // The one route whose body is not JSON: an invoice PDF. Checked by
+                // shape, not by path — the router already decided what to send, this
+                // layer only has to notice how.
+                if (response.body instanceof Uint8Array) {
+                    res.writeHead(response.status, { 'content-type': 'application/pdf' });
+                    res.end(Buffer.from(response.body));
+                    return;
+                }
+                res.writeHead(response.status, { 'content-type': 'application/json; charset=utf-8' });
+                res.end(response.body === null ? undefined : JSON.stringify(response.body));
+                return;
+            }
             if (url.pathname.startsWith('/api/media')) {
                 const body = req.method === 'GET' || req.method === 'DELETE' ? undefined : await readBody(req);
                 const request = toRestRequest(req, url, body);
@@ -842,6 +1141,23 @@ export function createRequestListener(site, logger) {
                 await recordMediaAudit(site, actor, req.method ?? 'GET', url.pathname, response, logger);
                 return;
             }
+            // The admin screen the redirect table never had: creating and removing
+            // a rule from a browser instead of the database directly (audit
+            // follow-up to L10 task 2). Admin-only, checked by the router itself.
+            if (url.pathname === '/api/redirects') {
+                const body = req.method === 'POST' ? await readBody(req) : undefined;
+                const request = toRestRequest(req, url, body);
+                writeRestResponse(res, await site.redirectRouter.handle(request, context));
+                return;
+            }
+            // Read-only mirrors of `security`/`webhooks` from the config file (audit
+            // follow-up to L10 task 6 / L14 task 1) — see `ops-status-router.ts` for
+            // why editing them here would be the wrong architecture.
+            if (url.pathname === '/api/security-status' || url.pathname === '/api/webhooks-status') {
+                const request = toRestRequest(req, url, undefined);
+                writeRestResponse(res, await site.opsStatusRouter.handle(request, context));
+                return;
+            }
             // The full-text index, reachable at last (L10 task 3). Its own router
             // decides which collections this actor may search — never this layer.
             if (url.pathname === '/api/search') {
@@ -849,6 +1165,14 @@ export function createRequestListener(site, logger) {
                 writeRestResponse(res, await site.searchRouter.handle(request, context));
                 return;
             }
+            // `/api/analytics/beacon` (public) and `/api/analytics/summary`
+            // (admin-only) — see `@cogenta/analytics` and `analytics-router.ts` for
+            // why both live behind one router with opposite trust models.
+            if (url.pathname.startsWith('/api/analytics')) {
+                const request = toRestRequest(req, url, undefined);
+                writeRestResponse(res, await site.analyticsRouter.handle(request, { actor: context.actor, ip: clientIpOf(req) }));
+                return;
+            }
             if (url.pathname.startsWith('/api/audit')) {
                 const request = toRestRequest(req, url, undefined);
                 writeRestResponse(res, await site.auditRouter.handle(request, context.actor));
@@ -867,6 +1191,15 @@ export function createRequestListener(site, logger) {
                 await recordUserAudit(site, actor, req.method ?? 'GET', url.pathname, response, logger);
                 return;
             }
+            // Machine-to-machine bearer credentials, admin-only (L13 task 8).
+            if (url.pathname.startsWith('/api/api-keys')) {
+                const body = req.method === 'GET' || req.method === 'DELETE' ? undefined : await readBody(req);
+                const request = toRestRequest(req, url, body);
+                const response = await site.apiKeysRouter.handle(request, context.actor);
+                writeRestResponse(res, response);
+                await recordApiKeyAudit(site, actor, req.method ?? 'GET', url.pathname, response, logger);
+                return;
+            }
             if (url.pathname.startsWith('/api/site-plans') && site.sitePlanRouter !== undefined) {
                 // `SitePlanRouter` itself refuses every route to a non-admin actor,
                 // but only after `readBody` has already buffered the whole request —
@@ -884,6 +1217,22 @@ export function createRequestListener(site, logger) {
                 writeRestResponse(res, await site.sitePlanRouter.handle(request, context.actor));
                 return;
             }
+            // The admin's WordPress importer. Same defensive order as
+            // `/api/site-plans` just above and for the same reason: this route
+            // invites a multi-megabyte upload by design, so the role is checked
+            // before `readBody` buffers anything at all.
+            if (url.pathname.startsWith('/api/import')) {
+                if (!context.actor.roles.includes('admin')) {
+                    jsonError(res, 403, 'FORBIDDEN', 'Only the admin role may import content.');
+                    return;
+                }
+                const body = req.method === 'GET' ? undefined : await readBody(req);
+                const request = toRestRequest(req, url, body);
+                const response = await site.importRouter.handle(request, context.actor);
+                writeRestResponse(res, response);
+                await recordImportAudit(site, actor, req.method ?? 'GET', url.pathname, response, logger);
+                return;
+            }
             // Always mounted, on every site (L18). On one with no AI provider it is
             // the route that answers `{available: false}`, which is precisely what
             // lets the admin panel disappear instead of failing.
@@ -971,6 +1320,15 @@ export function createRequestListener(site, logger) {
                         site: site.site,
                         styles: site.styles,
                         loadMedia: (ids) => loadRenderMedia(site, ids),
+                        // Present so the preview's `<body>` stays byte-identical to the
+                        // published page's (the property `theme-render-fidelity`
+                        // proves) — a POST carries no navigation `Referer` to report,
+                        // so this omits `referrer` the same way an ordinary page view
+                        // with no referrer does. The preview does still count as a
+                        // view; there is no distinct "not a real visit" signal to send
+                        // that would not itself become a body difference.
+                        analyticsBeacon: {},
+                        menuRouter: site.menuRouter,
                     }, context);
                 }
                 catch (error) {
@@ -1077,6 +1435,12 @@ export function createRequestListener(site, logger) {
                     site: site.site,
                     styles: site.styles,
                     loadMedia: (ids) => loadRenderMedia(site, ids),
+                    // Self-hosted analytics (`@cogenta/analytics`): the referrer is read
+                    // from *this* request's own header, server-side — see
+                    // `analyticsBeaconTag` in `theme-render.ts` for why that, rather
+                    // than a client script, is how this page's beacon pixel gets it.
+                    analyticsBeacon: { referrer: req.headers.referer },
+                    menuRouter: site.menuRouter,
                 };
                 const html = await renderRequestedPage(url.pathname, renderOptions, context);
                 if (html !== null) {
@@ -1126,6 +1490,18 @@ const DEFAULT_PORT = 4000;
 const DEFAULT_HOST = '127.0.0.1';
 /** How long a shutdown waits for open connections before cutting them. */
 const SHUTDOWN_GRACE_MS = 2_000;
+/**
+ * How often `runServe` drains due scheduled-publication jobs (R1).
+ *
+ * `cogenta serve` has no persistent worker process beyond itself, so this
+ * `setInterval` *is* the cron a hosted deployment with no worker would
+ * otherwise need to configure by hand. The honest trade this makes: a page
+ * scheduled for 09:00 goes live between 09:00 and 09:01, not exactly on the
+ * hour. If the process is stopped when a publication comes due, nothing is
+ * lost — the job is still in the `database` queue's table — it simply runs
+ * on the first tick after the next start, however late that is.
+ */
+const SCHEDULED_PUBLISH_TICK_MS = 60_000;
 /**
  * Runs until `options.signal` aborts. Returns 0 on a clean shutdown, 1 if
  * startup failed — nothing here calls `process.exit` (same convention as
@@ -1205,6 +1581,8 @@ export async function runServe(options) {
         styles,
         images: images?.processor ?? null,
         security: loaded.config.security,
+        webhooks: loaded.config.webhooks,
+        billing: loaded.config.billing,
         sitePlans: await createSitePlanning({
             projectRoot,
             db: selection.instance,
@@ -1222,6 +1600,14 @@ export async function runServe(options) {
         // endpoint, or configured one without a signing secret.
         onContentEvent: webhooks.emit,
         onSecurityEvent: webhooks.send,
+        // Same mail this site's `cogenta users reset-password --email` already
+        // sends (`../reset-mail.js`), just pointed at the admin's reset screen
+        // instead of a terminal command — see that file for why the wording is
+        // written once rather than twice.
+        onForgotPassword: ({ user, token, expiresAt }) => sendResetMail({
+            mailDir: join(projectRoot, '.cogenta', 'mail'),
+            resetUrl: new URL('/admin/reset-password', loaded.config.site.url).toString(),
+        }, loaded.config.site, user.email, token, expiresAt).then(() => undefined),
     });
     const server = createServer(createRequestListener(site, logger));
     const port = options.port ?? DEFAULT_PORT;
@@ -1239,6 +1625,21 @@ export async function runServe(options) {
     out.detail(`${collections.length} collection(s), db driver: ${selection.driver}, storage driver: ${storageSelection.driver}, image driver: ${images?.driver ?? 'none'}`);
     out.detail(assistant.summary);
     options.onListening?.({ port: boundPort, host });
+    // Scheduled publication (task 1): a first tick right away catches up on
+    // anything that came due while the process was down, then one every
+    // `SCHEDULED_PUBLISH_TICK_MS` for as long as this server runs. A failed
+    // tick is logged, never fatal — a scheduling hiccup must not take the
+    // whole site down.
+    const runScheduledPublishTick = () => {
+        site.tickScheduledPublishing().catch((error) => {
+            logger.error('scheduled publish tick failed', { error: String(error) });
+        });
+    };
+    runScheduledPublishTick();
+    const scheduledPublishTimer = setInterval(runScheduledPublishTick, options.scheduledPublishTickMs ?? SCHEDULED_PUBLISH_TICK_MS);
+    // Never keeps the process alive on its own: a `signal`-driven shutdown with
+    // no open connections must still be able to exit.
+    scheduledPublishTimer.unref();
     await new Promise((resolve) => {
         if (options.signal === undefined)
             return;
@@ -1248,6 +1649,7 @@ export async function runServe(options) {
         }
         options.signal.addEventListener('abort', () => resolve(), { once: true });
     });
+    clearInterval(scheduledPublishTimer);
     await new Promise((resolve, reject) => {
         server.close((error) => (error ? reject(error) : resolve()));
         // `close()` alone waits for every open connection to end, and a client