@drawbridge/drawbridge-utils 0.0.87 → 0.0.88

package/dist/axios.cjs

@@ -36,7 +36,8 @@ __export(axios_exports, {
 module.exports = __toCommonJS(axios_exports);
 var import_axios = __toESM(require("axios"), 1);
 var import_dns = __toESM(require("dns"), 1);
-var import_https = __toESM(require("https"), 1);
+var http = __toESM(require("http"), 1);
+var https = __toESM(require("https"), 1);
 var import_net = __toESM(require("net"), 1);
 var dnsLookup = import_dns.default.promises.lookup;
 var isBlockedIPv4 = (ip) => {
@@ -101,7 +102,7 @@ var safeGet = async (url, axiosOptions = {}) => {
   }
   ;
   const pinned = records[0];
-  const agent = new import_https.default.Agent({
+  const agent = new https.Agent({
     lookup: (hostname, options, callback) => {
       if (options == null ? void 0 : options.all) {
         callback(null, [{ address: pinned.address, family: pinned.family }]);
@@ -112,6 +113,9 @@ var safeGet = async (url, axiosOptions = {}) => {
     }
   });
   return import_axios.default.get(url, {
+    // Default bound for user-supplied URLs; callers override via
+    // axiosOptions.timeout (listed first so the spread wins).
+    timeout: 15e3,
     ...axiosOptions,
     httpsAgent: agent,
     maxRedirects: 0,
@@ -122,7 +126,11 @@ var safeGet = async (url, axiosOptions = {}) => {
 var safe = {
   get: safeGet
 };
-var axios = import_axios.default;
+var axios = import_axios.default.create({
+  timeout: 3e4,
+  httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
+  httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
+});
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   axios,

package/dist/axios.d.cts

@@ -1,6 +1,7 @@
 import axiosLib from 'axios';
 import dns from 'dns';
-import https from 'https';
+import * as http from 'node:http';
+import * as https from 'node:https';
 import net from 'net';
 
 const dnsLookup = dns.promises.lookup;
@@ -130,6 +131,9 @@ const safeGet = async ( url, axiosOptions = {} ) => {
 	});
 
 	return axiosLib.get( url, {
+		// Default bound for user-supplied URLs; callers override via
+		// axiosOptions.timeout (listed first so the spread wins).
+		timeout : 15000,
 		...axiosOptions,
 		httpsAgent : agent,
 		maxRedirects : 0,
@@ -145,9 +149,21 @@ const safe = {
 	get : safeGet
 };
 
-// Raw axios passthrough. Use for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
+// Raw axios instance for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
 //   await axios.get( 'https://api.stripe.com/...' );
 //   await axios.post( ... );
-const axios = axiosLib;
+//
+// Bounded by default so a forgotten per-call override can never hang a request
+// handler or queue worker indefinitely (the classic unguarded-await failure
+// under load). Every call site can still override: per-request `timeout`,
+// `signal` (used by streaming downloads whose 30s would be wrong), and
+// per-request `httpAgent`/`httpsAgent` (used by the SSRF-pinned agents) all
+// take precedence over these defaults. Audited 2026-07-24: every existing
+// call site already sets its own bound, so this changes no current behavior.
+const axios = axiosLib.create({
+	timeout : 30000,
+	httpAgent : new http.Agent({ keepAlive : true, maxSockets : 128 }),
+	httpsAgent : new https.Agent({ keepAlive : true, maxSockets : 128 })
+});
 
 export { axios, isBlockedIP, safe };

package/dist/axios.d.ts

@@ -1,6 +1,7 @@
 import axiosLib from 'axios';
 import dns from 'dns';
-import https from 'https';
+import * as http from 'node:http';
+import * as https from 'node:https';
 import net from 'net';
 
 const dnsLookup = dns.promises.lookup;
@@ -130,6 +131,9 @@ const safeGet = async ( url, axiosOptions = {} ) => {
 	});
 
 	return axiosLib.get( url, {
+		// Default bound for user-supplied URLs; callers override via
+		// axiosOptions.timeout (listed first so the spread wins).
+		timeout : 15000,
 		...axiosOptions,
 		httpsAgent : agent,
 		maxRedirects : 0,
@@ -145,9 +149,21 @@ const safe = {
 	get : safeGet
 };
 
-// Raw axios passthrough. Use for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
+// Raw axios instance for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
 //   await axios.get( 'https://api.stripe.com/...' );
 //   await axios.post( ... );
-const axios = axiosLib;
+//
+// Bounded by default so a forgotten per-call override can never hang a request
+// handler or queue worker indefinitely (the classic unguarded-await failure
+// under load). Every call site can still override: per-request `timeout`,
+// `signal` (used by streaming downloads whose 30s would be wrong), and
+// per-request `httpAgent`/`httpsAgent` (used by the SSRF-pinned agents) all
+// take precedence over these defaults. Audited 2026-07-24: every existing
+// call site already sets its own bound, so this changes no current behavior.
+const axios = axiosLib.create({
+	timeout : 30000,
+	httpAgent : new http.Agent({ keepAlive : true, maxSockets : 128 }),
+	httpsAgent : new https.Agent({ keepAlive : true, maxSockets : 128 })
+});
 
 export { axios, isBlockedIP, safe };

package/dist/axios.js

@@ -1,7 +1,8 @@
 // lib/axios.js
 import axiosLib from "axios";
 import dns from "dns";
-import https from "https";
+import * as http from "http";
+import * as https from "https";
 import net from "net";
 var dnsLookup = dns.promises.lookup;
 var isBlockedIPv4 = (ip) => {
@@ -77,6 +78,9 @@ var safeGet = async (url, axiosOptions = {}) => {
     }
   });
   return axiosLib.get(url, {
+    // Default bound for user-supplied URLs; callers override via
+    // axiosOptions.timeout (listed first so the spread wins).
+    timeout: 15e3,
     ...axiosOptions,
     httpsAgent: agent,
     maxRedirects: 0,
@@ -87,7 +91,11 @@ var safeGet = async (url, axiosOptions = {}) => {
 var safe = {
   get: safeGet
 };
-var axios = axiosLib;
+var axios = axiosLib.create({
+  timeout: 3e4,
+  httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
+  httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
+});
 export {
   axios,
   isBlockedIP,

package/dist/cloudflare.cjs

@@ -0,0 +1,292 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/cloudflare.js
+var cloudflare_exports = {};
+__export(cloudflare_exports, {
+  pageEdgeUrls: () => pageEdgeUrls,
+  purge: () => purge
+});
+module.exports = __toCommonJS(cloudflare_exports);
+
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetch(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// index.js
+var import_currency_codes = require("currency-codes");
+var import_nanoid = require("nanoid");
+
+// lib/color.js
+var import_tinycolor2 = __toESM(require("tinycolor2"), 1);
+var colorFormatted = (value) => {
+  const color = (0, import_tinycolor2.default)(value);
+  const attributes = {
+    brightness: color.getBrightness(),
+    dark: color.isDark(),
+    light: color.isLight(),
+    luminance: color.getLuminance()
+  };
+  return {
+    attributes,
+    hex: color.toHexString(),
+    hsl: color.toHsl(),
+    hsv: color.toHsv(),
+    rgb: color.toRgbString()
+  };
+};
+var colorAccessible = (background2) => {
+  const white = "#ffffff";
+  const black = "#000000";
+  return import_tinycolor2.default.isReadable(
+    background2,
+    white,
+    {
+      level: "AA",
+      size: "normal"
+    }
+  ) ? white : black;
+};
+
+// lib/constants.js
+var font = {
+  family: "Roboto Flex",
+  transform: "none",
+  weight: "regular"
+};
+var background = "#ffffff";
+var style = {
+  background: {
+    color: colorFormatted(background)
+  },
+  body: font,
+  button: {
+    background: {
+      color: colorFormatted(background)
+    },
+    radius: 0,
+    text: {
+      color: colorFormatted(colorAccessible(background))
+    }
+  },
+  heading: font,
+  input: {
+    radius: 0
+  },
+  text: {
+    color: colorFormatted(colorAccessible(background))
+  }
+};
+
+// index.js
+var nanoid = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var megabyte = 1024 * 1024;
+var gigabyte = megabyte * 1024;
+var urlRoot = (string) => (string == null ? void 0 : string.includes("https")) ? "https://" : "http://";
+var shareUrls = ({
+  formUri,
+  organization,
+  page
+}) => {
+  var _a;
+  const resolvedFormUri = formUri || (typeof process !== "undefined" ? (_a = process.env) == null ? void 0 : _a.APP_CLIENT_FORM_URI : void 0);
+  const preface = urlRoot(resolvedFormUri);
+  const base = resolvedFormUri;
+  const qr = preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId) + "?qr=1";
+  const short = preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId);
+  const url = preface + (organization == null ? void 0 : organization.subdomain) + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.slug);
+  const clients = [
+    base,
+    qr,
+    short,
+    url
+  ];
+  const urls = {
+    qr,
+    short,
+    url
+  };
+  if ((organization == null ? void 0 : organization.subdomain) && (page == null ? void 0 : page.shortId)) {
+    clients.push(preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId));
+    clients.push(preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId) + "?qr=1");
+    clients.push(preface + organization.subdomain + "." + (base == null ? void 0 : base.replace(preface, "")));
+    clients.push(preface + organization.subdomain + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId));
+  }
+  ;
+  if ((organization == null ? void 0 : organization.shortId) && (page == null ? void 0 : page.slug) && (page == null ? void 0 : page.shortId)) {
+    clients.push(preface + organization.shortId + "." + (base == null ? void 0 : base.replace(preface, "")));
+    clients.push(preface + organization.shortId + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.slug));
+    clients.push(preface + organization.shortId + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId));
+  }
+  ;
+  return {
+    clients,
+    urls
+  };
+};
+var currencies = import_currency_codes.data.map((item) => ({
+  ...item,
+  key: item.currency,
+  value: item.code
+}));
+
+// lib/cloudflare.js
+var PURGE_BATCH = 30;
+var endpoint = (zoneId) => "https://api.cloudflare.com/client/v4/zones/" + zoneId + "/purge_cache";
+var pageEdgeUrls = ({
+  formUri,
+  organization,
+  page
+}) => {
+  if (!page) return [];
+  const { clients } = shareUrls({
+    formUri,
+    organization,
+    page
+  });
+  const set = /* @__PURE__ */ new Set();
+  for (const client of clients || []) {
+    try {
+      const url = new URL(client);
+      if (url.pathname && url.pathname !== "/") {
+        set.add(url.toString());
+      }
+      ;
+    } catch {
+      continue;
+    }
+    ;
+  }
+  ;
+  if (page == null ? void 0 : page.slug) {
+    for (const item of [...set]) {
+      const url = new URL(item);
+      if (url.pathname === "/" + page.slug && !url.search) {
+        set.add(url.origin + "/" + page.slug + "/embed");
+      }
+      ;
+    }
+    ;
+  }
+  ;
+  return [...set];
+};
+var purge = async ({
+  files = [],
+  logger,
+  transport = request
+} = {}) => {
+  var _a, _b;
+  const apiToken = typeof process !== "undefined" ? (_a = process.env) == null ? void 0 : _a.CLOUDFLARE_API_TOKEN : void 0;
+  const zoneId = typeof process !== "undefined" ? (_b = process.env) == null ? void 0 : _b.CLOUDFLARE_ZONE_ID : void 0;
+  if (!apiToken || !zoneId) {
+    return {
+      purged: 0,
+      skipped: true
+    };
+  }
+  ;
+  const unique = [...new Set(files.filter(Boolean))];
+  let purged = 0;
+  for (let index = 0; index < unique.length; index += PURGE_BATCH) {
+    const batch = unique.slice(index, index + PURGE_BATCH);
+    try {
+      await transport({
+        method: "POST",
+        url: endpoint(zoneId),
+        headers: {
+          Authorization: "Bearer " + apiToken
+        },
+        body: {
+          files: batch
+        }
+      });
+      purged += batch.length;
+    } catch (error) {
+      if (logger == null ? void 0 : logger.error) {
+        logger.error(error, {
+          extra: {
+            batch: batch.length,
+            files: batch.slice(0, 5)
+          }
+        });
+      }
+      ;
+    }
+    ;
+  }
+  ;
+  return {
+    purged,
+    skipped: false
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  pageEdgeUrls,
+  purge
+});

package/dist/cloudflare.d.cts

@@ -0,0 +1,153 @@
+import { request } from './http.cjs';
+import { shareUrls } from './index.cjs';
+import 'currency-codes';
+import 'nanoid';
+import './color.cjs';
+import 'tinycolor2';
+import './usage.cjs';
+
+// Cloudflare edge-cache helpers (spike-readiness A1). Server-only — the token
+// is read from plain env (never NEXT_PUBLIC_*), so Next never bundles it.
+//
+// purge() is deliberately safe to wire BEFORE Cloudflare exists in front of
+// the domain: with CLOUDFLARE_API_TOKEN / CLOUDFLARE_ZONE_ID unset it is a
+// no-op, so the sync invalidation paths can carry edge purges today and they
+// simply start working the day the zone goes live. Errors are swallowed and
+// logged — a failed edge purge must never break a stream handler or write
+// path (same contract as drawbridge-redis cache.delete).
+//
+// pageEdgeUrls() enumerates every public HTML URL a page is reachable at —
+// the subdomain + org-shortId hosts with the slug and shortId paths, the
+// shortId redirect on the bare domain (plus its ?qr=1 twin, a distinct edge
+// cache key), and the /embed twin of each full-page URL — derived from the
+// same shareUrls() the rest of the family uses, so the purge set can never
+// drift from the real URL scheme.
+
+
+const PURGE_BATCH = 30; // Cloudflare's per-request purge-by-URL cap
+
+const endpoint = ( zoneId ) =>
+	'https://api.cloudflare.com/client/v4/zones/' + zoneId + '/purge_cache';
+
+const pageEdgeUrls = ({
+	formUri,
+	organization,
+	page
+}) => {
+
+	if( ! page ) return [];
+
+	const { clients } = shareUrls({
+		formUri,
+		organization,
+		page
+	});
+
+	const set = new Set();
+
+	for( const client of clients || [] ){
+
+		// Only page-specific URLs — bare hosts (the org/domain roots) are not
+		// this page's cache entries and purging them here would be collateral.
+		try {
+
+			const url = new URL( client );
+
+			if( url.pathname && url.pathname !== '/' ){
+
+				set.add( url.toString() );
+
+			};
+
+		} catch {
+
+			continue;
+
+		}
+	}
+	// The form-only embed renders at <host>/<slug>/embed for each full-page
+	// host — a second cached HTML surface that must die with the page.
+	if( page?.slug ){
+
+		for( const item of [ ...set ] ){
+
+			const url = new URL( item );
+
+			if( url.pathname === '/' + page.slug && ! url.search ){
+
+				set.add( url.origin + '/' + page.slug + '/embed' );
+
+			}
+		}
+	}
+	return [ ...set ];
+
+};
+
+// transport is injectable for tests (mirrors how stripe injects the shared
+// http request); production callers never pass it.
+const purge = async ({
+	files = [],
+	logger,
+	transport = request
+} = {}) => {
+
+	const apiToken = typeof process !== 'undefined' ? process.env?.CLOUDFLARE_API_TOKEN : undefined;
+	const zoneId = typeof process !== 'undefined' ? process.env?.CLOUDFLARE_ZONE_ID : undefined;
+
+	// Not configured = deliberate no-op (ships before Cloudflare is live).
+	if( ! apiToken || ! zoneId ){
+
+		return {
+			purged : 0,
+			skipped : true
+		};
+
+	}
+	const unique = [ ...new Set( files.filter( Boolean ) ) ];
+
+	let purged = 0;
+
+	for( let index = 0; index < unique.length; index += PURGE_BATCH ){
+
+		const batch = unique.slice( index, index + PURGE_BATCH );
+
+		try {
+
+			await transport({
+				method : 'POST',
+				url : endpoint( zoneId ),
+				headers : {
+					Authorization : 'Bearer ' + apiToken
+				},
+				body : {
+					files : batch
+				}
+			});
+
+			purged += batch.length;
+
+		} catch ( error ) {
+
+			// Swallow — the edge self-heals via TTL; the caller's write path
+			// must not fail because a purge did.
+			if( logger?.error ){
+
+				logger.error( error, {
+					extra : {
+						batch : batch.length,
+						files : batch.slice( 0, 5 )
+					}
+				});
+
+			}
+		}
+	}
+	return {
+		purged,
+		skipped : false
+	};
+
+};
+
+export { pageEdgeUrls, purge };

package/dist/cloudflare.d.ts

@@ -0,0 +1,153 @@
+import { request } from './http.js';
+import { shareUrls } from './index.js';
+import 'currency-codes';
+import 'nanoid';
+import './color.js';
+import 'tinycolor2';
+import './usage.js';
+
+// Cloudflare edge-cache helpers (spike-readiness A1). Server-only — the token
+// is read from plain env (never NEXT_PUBLIC_*), so Next never bundles it.
+//
+// purge() is deliberately safe to wire BEFORE Cloudflare exists in front of
+// the domain: with CLOUDFLARE_API_TOKEN / CLOUDFLARE_ZONE_ID unset it is a
+// no-op, so the sync invalidation paths can carry edge purges today and they
+// simply start working the day the zone goes live. Errors are swallowed and
+// logged — a failed edge purge must never break a stream handler or write
+// path (same contract as drawbridge-redis cache.delete).
+//
+// pageEdgeUrls() enumerates every public HTML URL a page is reachable at —
+// the subdomain + org-shortId hosts with the slug and shortId paths, the
+// shortId redirect on the bare domain (plus its ?qr=1 twin, a distinct edge
+// cache key), and the /embed twin of each full-page URL — derived from the
+// same shareUrls() the rest of the family uses, so the purge set can never
+// drift from the real URL scheme.
+
+
+const PURGE_BATCH = 30; // Cloudflare's per-request purge-by-URL cap
+
+const endpoint = ( zoneId ) =>
+	'https://api.cloudflare.com/client/v4/zones/' + zoneId + '/purge_cache';
+
+const pageEdgeUrls = ({
+	formUri,
+	organization,
+	page
+}) => {
+
+	if( ! page ) return [];
+
+	const { clients } = shareUrls({
+		formUri,
+		organization,
+		page
+	});
+
+	const set = new Set();
+
+	for( const client of clients || [] ){
+
+		// Only page-specific URLs — bare hosts (the org/domain roots) are not
+		// this page's cache entries and purging them here would be collateral.
+		try {
+
+			const url = new URL( client );
+
+			if( url.pathname && url.pathname !== '/' ){
+
+				set.add( url.toString() );
+
+			};
+
+		} catch {
+
+			continue;
+
+		}
+	}
+	// The form-only embed renders at <host>/<slug>/embed for each full-page
+	// host — a second cached HTML surface that must die with the page.
+	if( page?.slug ){
+
+		for( const item of [ ...set ] ){
+
+			const url = new URL( item );
+
+			if( url.pathname === '/' + page.slug && ! url.search ){
+
+				set.add( url.origin + '/' + page.slug + '/embed' );
+
+			}
+		}
+	}
+	return [ ...set ];
+
+};
+
+// transport is injectable for tests (mirrors how stripe injects the shared
+// http request); production callers never pass it.
+const purge = async ({
+	files = [],
+	logger,
+	transport = request
+} = {}) => {
+
+	const apiToken = typeof process !== 'undefined' ? process.env?.CLOUDFLARE_API_TOKEN : undefined;
+	const zoneId = typeof process !== 'undefined' ? process.env?.CLOUDFLARE_ZONE_ID : undefined;
+
+	// Not configured = deliberate no-op (ships before Cloudflare is live).
+	if( ! apiToken || ! zoneId ){
+
+		return {
+			purged : 0,
+			skipped : true
+		};
+
+	}
+	const unique = [ ...new Set( files.filter( Boolean ) ) ];
+
+	let purged = 0;
+
+	for( let index = 0; index < unique.length; index += PURGE_BATCH ){
+
+		const batch = unique.slice( index, index + PURGE_BATCH );
+
+		try {
+
+			await transport({
+				method : 'POST',
+				url : endpoint( zoneId ),
+				headers : {
+					Authorization : 'Bearer ' + apiToken
+				},
+				body : {
+					files : batch
+				}
+			});
+
+			purged += batch.length;
+
+		} catch ( error ) {
+
+			// Swallow — the edge self-heals via TTL; the caller's write path
+			// must not fail because a purge did.
+			if( logger?.error ){
+
+				logger.error( error, {
+					extra : {
+						batch : batch.length,
+						files : batch.slice( 0, 5 )
+					}
+				});
+
+			}
+		}
+	}
+	return {
+		purged,
+		skipped : false
+	};
+
+};
+
+export { pageEdgeUrls, purge };

package/dist/cloudflare.js

@@ -0,0 +1,255 @@
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetch(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// index.js
+import { code, data } from "currency-codes";
+import { customAlphabet } from "nanoid";
+
+// lib/color.js
+import tinycolor from "tinycolor2";
+var colorFormatted = (value) => {
+  const color = tinycolor(value);
+  const attributes = {
+    brightness: color.getBrightness(),
+    dark: color.isDark(),
+    light: color.isLight(),
+    luminance: color.getLuminance()
+  };
+  return {
+    attributes,
+    hex: color.toHexString(),
+    hsl: color.toHsl(),
+    hsv: color.toHsv(),
+    rgb: color.toRgbString()
+  };
+};
+var colorAccessible = (background2) => {
+  const white = "#ffffff";
+  const black = "#000000";
+  return tinycolor.isReadable(
+    background2,
+    white,
+    {
+      level: "AA",
+      size: "normal"
+    }
+  ) ? white : black;
+};
+
+// lib/constants.js
+var font = {
+  family: "Roboto Flex",
+  transform: "none",
+  weight: "regular"
+};
+var background = "#ffffff";
+var style = {
+  background: {
+    color: colorFormatted(background)
+  },
+  body: font,
+  button: {
+    background: {
+      color: colorFormatted(background)
+    },
+    radius: 0,
+    text: {
+      color: colorFormatted(colorAccessible(background))
+    }
+  },
+  heading: font,
+  input: {
+    radius: 0
+  },
+  text: {
+    color: colorFormatted(colorAccessible(background))
+  }
+};
+
+// index.js
+var nanoid = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var megabyte = 1024 * 1024;
+var gigabyte = megabyte * 1024;
+var urlRoot = (string) => (string == null ? void 0 : string.includes("https")) ? "https://" : "http://";
+var shareUrls = ({
+  formUri,
+  organization,
+  page
+}) => {
+  var _a;
+  const resolvedFormUri = formUri || (typeof process !== "undefined" ? (_a = process.env) == null ? void 0 : _a.APP_CLIENT_FORM_URI : void 0);
+  const preface = urlRoot(resolvedFormUri);
+  const base = resolvedFormUri;
+  const qr = preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId) + "?qr=1";
+  const short = preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId);
+  const url = preface + (organization == null ? void 0 : organization.subdomain) + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.slug);
+  const clients = [
+    base,
+    qr,
+    short,
+    url
+  ];
+  const urls = {
+    qr,
+    short,
+    url
+  };
+  if ((organization == null ? void 0 : organization.subdomain) && (page == null ? void 0 : page.shortId)) {
+    clients.push(preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId));
+    clients.push(preface + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId) + "?qr=1");
+    clients.push(preface + organization.subdomain + "." + (base == null ? void 0 : base.replace(preface, "")));
+    clients.push(preface + organization.subdomain + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId));
+  }
+  ;
+  if ((organization == null ? void 0 : organization.shortId) && (page == null ? void 0 : page.slug) && (page == null ? void 0 : page.shortId)) {
+    clients.push(preface + organization.shortId + "." + (base == null ? void 0 : base.replace(preface, "")));
+    clients.push(preface + organization.shortId + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.slug));
+    clients.push(preface + organization.shortId + "." + (base == null ? void 0 : base.replace(preface, "")) + "/" + (page == null ? void 0 : page.shortId));
+  }
+  ;
+  return {
+    clients,
+    urls
+  };
+};
+var currencies = data.map((item) => ({
+  ...item,
+  key: item.currency,
+  value: item.code
+}));
+
+// lib/cloudflare.js
+var PURGE_BATCH = 30;
+var endpoint = (zoneId) => "https://api.cloudflare.com/client/v4/zones/" + zoneId + "/purge_cache";
+var pageEdgeUrls = ({
+  formUri,
+  organization,
+  page
+}) => {
+  if (!page) return [];
+  const { clients } = shareUrls({
+    formUri,
+    organization,
+    page
+  });
+  const set = /* @__PURE__ */ new Set();
+  for (const client of clients || []) {
+    try {
+      const url = new URL(client);
+      if (url.pathname && url.pathname !== "/") {
+        set.add(url.toString());
+      }
+      ;
+    } catch {
+      continue;
+    }
+    ;
+  }
+  ;
+  if (page == null ? void 0 : page.slug) {
+    for (const item of [...set]) {
+      const url = new URL(item);
+      if (url.pathname === "/" + page.slug && !url.search) {
+        set.add(url.origin + "/" + page.slug + "/embed");
+      }
+      ;
+    }
+    ;
+  }
+  ;
+  return [...set];
+};
+var purge = async ({
+  files = [],
+  logger,
+  transport = request
+} = {}) => {
+  var _a, _b;
+  const apiToken = typeof process !== "undefined" ? (_a = process.env) == null ? void 0 : _a.CLOUDFLARE_API_TOKEN : void 0;
+  const zoneId = typeof process !== "undefined" ? (_b = process.env) == null ? void 0 : _b.CLOUDFLARE_ZONE_ID : void 0;
+  if (!apiToken || !zoneId) {
+    return {
+      purged: 0,
+      skipped: true
+    };
+  }
+  ;
+  const unique = [...new Set(files.filter(Boolean))];
+  let purged = 0;
+  for (let index = 0; index < unique.length; index += PURGE_BATCH) {
+    const batch = unique.slice(index, index + PURGE_BATCH);
+    try {
+      await transport({
+        method: "POST",
+        url: endpoint(zoneId),
+        headers: {
+          Authorization: "Bearer " + apiToken
+        },
+        body: {
+          files: batch
+        }
+      });
+      purged += batch.length;
+    } catch (error) {
+      if (logger == null ? void 0 : logger.error) {
+        logger.error(error, {
+          extra: {
+            batch: batch.length,
+            files: batch.slice(0, 5)
+          }
+        });
+      }
+      ;
+    }
+    ;
+  }
+  ;
+  return {
+    purged,
+    skipped: false
+  };
+};
+export {
+  pageEdgeUrls,
+  purge
+};

package/package.json

@@ -146,6 +146,11 @@
       "types": "./dist/plans.d.ts",
       "import": "./dist/plans.js",
       "require": "./dist/plans.cjs"
+    },
+    "./cloudflare": {
+      "types": "./dist/cloudflare.d.ts",
+      "import": "./dist/cloudflare.js",
+      "require": "./dist/cloudflare.cjs"
     }
   },
   "files": [
@@ -164,5 +169,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.87"
+  "version": "0.0.88"
 }