@markusylisiurunen/tau 0.3.91 → 0.3.93

package/dist/nook/worker/index.js

@@ -1,1175 +0,0 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
-const RESERVED_PREFIX = "/__nook";
-const DEPLOY_SESSION_MS = 15 * 60 * 1000;
-const TEMPLATE_SAVE_SESSION_MS = 15 * 60 * 1000;
-const MAX_PENDING_DEPLOYMENTS = 3;
-const MAX_PENDING_TEMPLATE_SAVES = 3;
-const MAX_FILES = 1_000;
-const MAX_FILE_BYTES = 10 * 1024 * 1024;
-const MAX_TOTAL_BYTES = 100 * 1024 * 1024;
-const MAX_PATH_LENGTH = 512;
-const MAX_KV_KEY_LENGTH = 256;
-const MAX_KV_VALUE_BYTES = 64 * 1024;
-const MAX_KV_KEYS = 1_000;
-const MAX_KV_TOTAL_BYTES = 5 * 1024 * 1024;
-const DEPLOYED_ASSET_CACHE_CONTROL = "public, no-cache, must-revalidate";
-const RESERVED_SITE_SLUGS = new Set([
-    "admin",
-    "api",
-    "assets",
-    "login",
-    "logout",
-    "nook",
-    "quick",
-    "static",
-    "www",
-]);
-const accessJwksCache = new Map();
-const SKILL_MARKDOWN = `# Nook
-
-Nook deploys static mini-apps to path-based site URLs and gives each site same-origin JSON KV through window.nook. It also stores editable templates that can be copied to a working directory, modified, built, and deployed separately.
-
-Deploy a finished static directory only. The directory must contain /index.html, must not contain hidden files or symlinks, and must not contain files under /__nook/. Templates follow the same file safety rules but do not require /index.html. Copying a template requires an existing empty destination directory.
-
-Sites are served at https://<nook-domain>/<site>/.
-
-The Worker injects /<site>/__nook/client.js just after the opening HTML body tag.
-
-Code that runs from the document head should wait until DOMContentLoaded, or otherwise run after the page has loaded, before using window.nook:
-
-\`\`\`js
-window.addEventListener("DOMContentLoaded", async () => {
-  await window.nook.kv.put("settings", { theme: "dark" });
-  const settings = await window.nook.kv.get("settings");
-  await window.nook.kv.delete("settings");
-  const keys = await window.nook.kv.list({ prefix: "todos/" });
-});
-\`\`\`
-
-KV is per-site, JSON-only, and survives redeploys. Public deployments expose public writable per-site KV. Private deployments require Cloudflare Access identity.
-`;
-const CLIENT_JS = `(() => {
-  const script = document.currentScript;
-  const scriptUrl = script && script.src
-    ? new URL(script.src)
-    : new URL("/__nook/client.js", window.location.origin);
-  const basePath = scriptUrl.pathname.replace(/\\/__nook\\/client\\.js$/, "");
-  function apiPath(path) {
-    return basePath + path;
-  }
-  async function request(path, options = {}) {
-    const response = await fetch(path, {
-      ...options,
-      headers: {
-        ...(options.body !== undefined ? { "content-type": "application/json" } : {}),
-        ...(options.headers || {})
-      }
-    });
-    if (!response.ok) {
-      let message = response.statusText;
-      try {
-        const payload = await response.json();
-        message = payload && payload.error && payload.error.message ? payload.error.message : message;
-      } catch {}
-      if (response.status === 401) {
-        const authUrl = new URL("/__nook/auth", window.location.origin);
-        authUrl.searchParams.set(
-          "returnTo",
-          window.location.pathname + window.location.search + window.location.hash
-        );
-        window.location.assign(authUrl.toString());
-      }
-      throw new Error(message);
-    }
-    if (response.status === 204) return null;
-    return await response.json();
-  }
-  window.nook = {
-    kv: {
-      async get(key) {
-        const payload = await request(apiPath("/__nook/kv/" + encodeURIComponent(key)));
-        return payload.value;
-      },
-      async put(key, value) {
-        await request(apiPath("/__nook/kv/" + encodeURIComponent(key)), {
-          method: "PUT",
-          body: JSON.stringify(value)
-        });
-      },
-      async delete(key) {
-        await request(apiPath("/__nook/kv/" + encodeURIComponent(key)), { method: "DELETE" });
-      },
-      async list(options = {}) {
-        const url = new URL(apiPath("/__nook/kv"), window.location.origin);
-        if (options.prefix) url.searchParams.set("prefix", options.prefix);
-        const payload = await request(url.pathname + url.search);
-        return payload.keys;
-      }
-    }
-  };
-})();`;
-function json(data, status = 200) {
-    return new Response(JSON.stringify(data), {
-        status,
-        headers: { "content-type": "application/json; charset=utf-8" },
-    });
-}
-function error(code, message, status) {
-    return json({ error: { code, message } }, status);
-}
-function now() {
-    return new Date().toISOString();
-}
-function randomId(prefix) {
-    const bytes = crypto.getRandomValues(new Uint8Array(12));
-    return `${prefix}_${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
-}
-function accessTokenFromRequest(request) {
-    const headerToken = request.headers.get("Cf-Access-Jwt-Assertion");
-    if (headerToken?.trim())
-        return headerToken.trim();
-    const cookie = request.headers.get("Cookie") ?? "";
-    for (const segment of cookie.split(";")) {
-        const [name, ...rest] = segment.trim().split("=");
-        if (name === "CF_Authorization")
-            return rest.join("=");
-    }
-    return undefined;
-}
-function accessJwks(teamDomain) {
-    let jwks = accessJwksCache.get(teamDomain);
-    if (!jwks) {
-        jwks = createRemoteJWKSet(new URL(`${teamDomain}/cdn-cgi/access/certs`));
-        accessJwksCache.set(teamDomain, jwks);
-    }
-    return jwks;
-}
-function stringClaim(payload, claim) {
-    const value = payload[claim];
-    return typeof value === "string" && value ? value : undefined;
-}
-function accessActor(payload) {
-    return (stringClaim(payload, "email") ??
-        stringClaim(payload, "common_name") ??
-        payload.sub ??
-        "access-user");
-}
-async function verifyAccessJwt(token, env) {
-    const teamDomain = env.NOOK_ACCESS_TEAM_DOMAIN?.replace(/\/+$/, "");
-    const audience = env.NOOK_ACCESS_AUD?.trim();
-    if (!teamDomain || !audience) {
-        throw new ErrorResponse("access_not_configured", "Cloudflare Access is not configured", 500);
-    }
-    try {
-        const { payload } = await jwtVerify(token, accessJwks(teamDomain), {
-            issuer: teamDomain,
-            audience,
-            algorithms: ["RS256"],
-        });
-        if (!payload.exp) {
-            throw new ErrorResponse("unauthorized", "Cloudflare Access JWT has invalid claims", 401);
-        }
-        return { actor: accessActor(payload) };
-    }
-    catch (err) {
-        if (err instanceof ErrorResponse)
-            throw err;
-        throw new ErrorResponse("unauthorized", "Invalid Cloudflare Access JWT", 401);
-    }
-}
-async function requireAccessIdentity(request, env) {
-    const token = accessTokenFromRequest(request);
-    if (!token)
-        throw new ErrorResponse("unauthorized", "Authentication required", 401);
-    return await verifyAccessJwt(token, env);
-}
-async function optionalAccessIdentity(request, env) {
-    const token = accessTokenFromRequest(request);
-    if (!token)
-        return { actor: "anonymous" };
-    try {
-        return await verifyAccessJwt(token, env);
-    }
-    catch {
-        return { actor: "anonymous" };
-    }
-}
-async function privateAccessIdentity(request, env) {
-    try {
-        return await requireAccessIdentity(request, env);
-    }
-    catch (err) {
-        if (err instanceof ErrorResponse && err.status === 401)
-            return undefined;
-        throw err;
-    }
-}
-function accessLoginUrl(request) {
-    const requestUrl = new URL(request.url);
-    const loginUrl = new URL("/__nook/auth", requestUrl.origin);
-    loginUrl.searchParams.set("returnTo", `${requestUrl.pathname}${requestUrl.search}`);
-    return loginUrl.toString();
-}
-function accessReturnUrl(request) {
-    const requestUrl = new URL(request.url);
-    const returnTo = requestUrl.searchParams.get("returnTo");
-    if (!returnTo)
-        return undefined;
-    let returnUrl;
-    try {
-        returnUrl = new URL(returnTo, requestUrl.origin);
-    }
-    catch {
-        return undefined;
-    }
-    if (returnUrl.origin !== requestUrl.origin || !parseSitePath(returnUrl.pathname)) {
-        return undefined;
-    }
-    return returnUrl;
-}
-function validatePathLabel(value, label) {
-    if (!/^[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$/.test(value))
-        return `invalid ${label}`;
-    return undefined;
-}
-function validateSlug(slug) {
-    return (validatePathLabel(slug, "slug") ?? (RESERVED_SITE_SLUGS.has(slug) ? "reserved slug" : undefined));
-}
-function validateTemplateName(name) {
-    return validatePathLabel(name, "template name");
-}
-function normalizeAssetPath(pathname) {
-    if (!pathname ||
-        pathname.includes("\0") ||
-        !pathname.startsWith("/") ||
-        pathname.startsWith("//")) {
-        return undefined;
-    }
-    const parts = pathname.split("/");
-    const out = [];
-    for (const part of parts) {
-        if (!part || part === ".")
-            continue;
-        if (part === "..")
-            return undefined;
-        out.push(part);
-    }
-    const normalized = `/${out.join("/")}`;
-    if (normalized === RESERVED_PREFIX || normalized.startsWith(`${RESERVED_PREFIX}/`))
-        return undefined;
-    if (normalized.length > MAX_PATH_LENGTH)
-        return undefined;
-    return normalized;
-}
-function validateManifest(files, options) {
-    const label = options.artifactLabel;
-    if (!Array.isArray(files) || files.length === 0)
-        return "manifest must include files";
-    if (files.length > MAX_FILES)
-        return `${label} exceeds ${MAX_FILES} files`;
-    const paths = new Set();
-    let total = 0;
-    let hasIndex = false;
-    for (const file of files) {
-        const normalized = normalizeAssetPath(file.path);
-        if (!normalized || normalized !== file.path)
-            return `invalid asset path ${file.path}`;
-        if (paths.has(file.path))
-            return `duplicate asset path ${file.path}`;
-        if (file.path.split("/").some((segment) => segment.startsWith("."))) {
-            return `hidden deploy path ${file.path} is not allowed`;
-        }
-        if (typeof file.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(file.sha256)) {
-            return `invalid sha256 for ${file.path}`;
-        }
-        paths.add(file.path);
-        if (file.path === "/index.html")
-            hasIndex = true;
-        if (!Number.isInteger(file.sizeBytes) || file.sizeBytes < 0)
-            return `invalid size for ${file.path}`;
-        if (file.sizeBytes > MAX_FILE_BYTES)
-            return `${file.path} exceeds max file size`;
-        total += file.sizeBytes;
-        if (typeof file.contentType !== "string" || !file.contentType)
-            return `invalid content type for ${file.path}`;
-    }
-    if (options.requireIndex && !hasIndex)
-        return "root index.html is required";
-    if (total > MAX_TOTAL_BYTES)
-        return `${label} exceeds max total size`;
-    return undefined;
-}
-function parseHost(url, env) {
-    const domain = env.NOOK_DOMAIN.toLowerCase();
-    const host = url.hostname.toLowerCase();
-    if (host === domain)
-        return { kind: "base" };
-    return undefined;
-}
-function parseSitePath(pathname) {
-    const match = pathname.match(/^\/([^/]+)(\/.*)?$/);
-    if (!match)
-        return undefined;
-    let slug;
-    try {
-        slug = decodeURIComponent(match[1]);
-    }
-    catch {
-        return undefined;
-    }
-    const slugError = validateSlug(slug);
-    if (slugError)
-        return undefined;
-    const rest = match[2];
-    return {
-        slug,
-        sitePath: rest && rest !== "/" ? rest : "/index.html",
-        needsSlashRedirect: rest === undefined,
-    };
-}
-async function readJson(request) {
-    try {
-        return await request.json();
-    }
-    catch {
-        throw new ErrorResponse("invalid_json", "Invalid JSON body", 400);
-    }
-}
-async function registryFetch(env, path, init) {
-    return await env.REGISTRY_DO.get(env.REGISTRY_DO.idFromName("__nook_registry")).fetch(new Request(`https://registry.local${path}`, init));
-}
-async function siteFetch(env, site, path, init) {
-    return await env.SITE_DO.get(env.SITE_DO.idFromName(site)).fetch(new Request(`https://site.local${path}`, init));
-}
-function assetKey(site, deploymentId, path) {
-    return `sites/${site}/deployments/${deploymentId}${path}`;
-}
-function templateRevisionPrefix(name, revisionId) {
-    return `templates/${name}/revisions/${revisionId}/`;
-}
-function templateFileKey(name, revisionId, path) {
-    return `${templateRevisionPrefix(name, revisionId)}${path.replace(/^\/+/, "")}`;
-}
-function siteUrl(domain, site) {
-    return `https://${domain}/${site}/`;
-}
-async function sha256Hex(bytes) {
-    const digest = await crypto.subtle.digest("SHA-256", bytes);
-    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-async function deleteR2Prefix(bucket, prefix) {
-    let cursor;
-    let deleted = 0;
-    do {
-        const listed = await bucket.list({ prefix, cursor, limit: 1000 });
-        if (listed.objects.length > 0) {
-            await bucket.delete(listed.objects.map((object) => object.key));
-            deleted += listed.objects.length;
-        }
-        cursor = listed.cursor;
-        if (!listed.truncated)
-            break;
-    } while (cursor);
-    return deleted;
-}
-async function handleTemplateApi(request, env, url, ctx) {
-    const match = url.pathname.match(/^\/__nook\/api\/templates(?:\/([^/]+))?(?:\/save\/([^/]+)\/(file|finish)|\/save\/start|\/file)?$/);
-    if (!match)
-        return error("not_found", "Unknown Nook API route", 404);
-    const name = match[1] ? decodeURIComponent(match[1]) : undefined;
-    const saveId = match[2] ? decodeURIComponent(match[2]) : undefined;
-    const saveAction = match[3];
-    if (url.pathname === "/__nook/api/templates" && request.method === "GET") {
-        return await registryFetch(env, "/templates");
-    }
-    if (!name)
-        return error("template_not_found", "Template is required", 404);
-    const nameError = validateTemplateName(name);
-    if (nameError)
-        return error("invalid_template", nameError, 400);
-    if (request.method === "GET" && url.pathname === `/__nook/api/templates/${name}`) {
-        return await registryFetch(env, `/templates/${encodeURIComponent(name)}/manifest`);
-    }
-    if (request.method === "GET" && url.pathname === `/__nook/api/templates/${name}/file`) {
-        const revisionId = url.searchParams.get("revision");
-        if (!revisionId || !/^tpl_[a-f0-9]{24}$/.test(revisionId)) {
-            return error("invalid_revision", "Invalid template revision", 400);
-        }
-        const path = url.searchParams.get("path");
-        const normalized = path ? normalizeAssetPath(path) : undefined;
-        if (!normalized || normalized !== path)
-            return error("invalid_path", "Invalid template file path", 400);
-        const object = await env.ASSETS.get(templateFileKey(name, revisionId, normalized));
-        if (!object)
-            return error("not_found", "Template file not found", 404);
-        return new Response(object.body, {
-            headers: { "content-type": object.httpMetadata?.contentType ?? "application/octet-stream" },
-        });
-    }
-    if (request.method === "DELETE" && url.pathname === `/__nook/api/templates/${name}`) {
-        await deleteR2Prefix(env.ASSETS, `templates/${name}/`);
-        await registryFetch(env, `/templates/${encodeURIComponent(name)}`, { method: "DELETE" });
-        return json({ template: name, deleted: true });
-    }
-    if (request.method === "POST" && url.pathname.endsWith("/save/start")) {
-        const body = (await readJson(request));
-        const files = body.files ?? [];
-        const validationError = validateManifest(files, {
-            requireIndex: false,
-            artifactLabel: "template",
-        });
-        if (validationError)
-            return error("invalid_manifest", validationError, 400);
-        const start = await registryFetch(env, `/templates/${encodeURIComponent(name)}/save/start`, {
-            method: "POST",
-            body: JSON.stringify({ files }),
-        });
-        if (!start.ok)
-            return start;
-        const result = (await start.json());
-        for (const expiredSaveId of result.expiredSaveIds) {
-            ctx.waitUntil(deleteR2Prefix(env.ASSETS, templateRevisionPrefix(name, expiredSaveId)));
-        }
-        const { expiredSaveIds: _expiredSaveIds, ...response } = result;
-        return json(response);
-    }
-    if (!saveId)
-        return error("save_not_found", "Template save is required", 404);
-    const token = request.headers.get("x-nook-template-token");
-    if (!token)
-        return error("unauthorized", "Missing template save token", 401);
-    if (request.method === "PUT" && saveAction === "file") {
-        const path = url.searchParams.get("path");
-        if (!path)
-            return error("invalid_path", "Missing upload path", 400);
-        const verify = await registryFetch(env, `/templates/${encodeURIComponent(name)}/save/${encodeURIComponent(saveId)}/verify-upload`, {
-            method: "POST",
-            body: JSON.stringify({ token, path }),
-        });
-        if (!verify.ok)
-            return verify;
-        const payload = (await verify.json());
-        const bytes = await request.arrayBuffer();
-        if (bytes.byteLength !== payload.file.sizeBytes) {
-            return error("invalid_upload", "Uploaded file size does not match manifest", 400);
-        }
-        if ((await sha256Hex(bytes)) !== payload.file.sha256) {
-            return error("invalid_upload", "Uploaded file hash does not match manifest", 400);
-        }
-        await env.ASSETS.put(templateFileKey(name, saveId, payload.file.path), bytes, {
-            httpMetadata: { contentType: payload.file.contentType },
-        });
-        return await registryFetch(env, `/templates/${encodeURIComponent(name)}/save/${encodeURIComponent(saveId)}/mark-uploaded`, {
-            method: "POST",
-            body: JSON.stringify({ token, path }),
-        });
-    }
-    if (request.method === "POST" && saveAction === "finish") {
-        const finish = await registryFetch(env, `/templates/${encodeURIComponent(name)}/save/${encodeURIComponent(saveId)}/finish`, {
-            method: "POST",
-            body: JSON.stringify({ token }),
-        });
-        if (!finish.ok)
-            return finish;
-        const result = (await finish.json());
-        if (result.previousRevisionId) {
-            ctx.waitUntil(deleteR2Prefix(env.ASSETS, templateRevisionPrefix(name, result.previousRevisionId)));
-        }
-        const { previousRevisionId: _previousRevisionId, ...summary } = result;
-        return json(summary);
-    }
-    return error("not_found", "Unknown Nook API route", 404);
-}
-async function handleBaseApi(request, env, url, identity, ctx) {
-    if (url.pathname === "/__nook/api/templates" ||
-        url.pathname.startsWith("/__nook/api/templates/")) {
-        return await handleTemplateApi(request, env, url, ctx);
-    }
-    if (request.method === "POST" && url.pathname === "/__nook/api/destroy") {
-        const sitesResponse = await registryFetch(env, `/sites?domain=${encodeURIComponent(env.NOOK_DOMAIN)}`);
-        if (!sitesResponse.ok)
-            return sitesResponse;
-        const payload = (await sitesResponse.json());
-        for (const site of payload.sites) {
-            await deleteR2Prefix(env.ASSETS, `sites/${site.slug}/`);
-            await siteFetch(env, site.slug, "/delete", { method: "POST" });
-        }
-        await registryFetch(env, "/delete-all", { method: "POST" });
-        const objectsDeleted = await deleteR2Prefix(env.ASSETS, "");
-        return json({
-            deleted: true,
-            sitesDeleted: payload.sites.length,
-            objectsDeleted,
-            actor: identity.actor,
-        });
-    }
-    const kvMatch = url.pathname.match(/^\/__nook\/api\/sites\/([^/]+)\/kv(\/.*)?$/);
-    if (kvMatch) {
-        const site = decodeURIComponent(kvMatch[1]);
-        const slugError = validateSlug(site);
-        if (slugError)
-            return error("invalid_slug", slugError, 400);
-        const active = await siteFetch(env, site, "/active");
-        if (!active.ok)
-            return active;
-        return await handleKv(request, env, site, identity, `/__nook/kv${kvMatch[2] ?? ""}`);
-    }
-    const match = url.pathname.match(/^\/__nook\/api\/sites(?:\/([^/]+))?(?:\/deploy\/([^/]+)\/(file|finish)|\/deploy\/start|\/file)?$/);
-    if (!match)
-        return error("not_found", "Unknown Nook API route", 404);
-    const site = match[1] ? decodeURIComponent(match[1]) : undefined;
-    const deploymentId = match[2] ? decodeURIComponent(match[2]) : undefined;
-    const deployAction = match[3];
-    if (url.pathname === "/__nook/api/sites" && request.method === "GET") {
-        return await registryFetch(env, `/sites?domain=${encodeURIComponent(env.NOOK_DOMAIN)}`);
-    }
-    if (!site)
-        return error("site_not_found", "Site is required", 404);
-    const slugError = validateSlug(site);
-    if (slugError)
-        return error("invalid_slug", slugError, 400);
-    if (request.method === "DELETE" && url.pathname === `/__nook/api/sites/${site}`) {
-        await deleteR2Prefix(env.ASSETS, `sites/${site}/`);
-        await siteFetch(env, site, "/delete", { method: "POST" });
-        await registryFetch(env, `/sites/${encodeURIComponent(site)}`, { method: "DELETE" });
-        return json({ site, deleted: true });
-    }
-    if (request.method === "GET" && url.pathname === `/__nook/api/sites/${site}`) {
-        const active = await siteFetch(env, site, "/active");
-        if (!active.ok)
-            return active;
-        const deployment = (await active.json());
-        return json({
-            site,
-            deploymentId: deployment.deploymentId,
-            visibility: deployment.public ? "public" : "private",
-            fileCount: deployment.files.length,
-            byteCount: deployment.files.reduce((total, file) => total + file.sizeBytes, 0),
-            files: deployment.files,
-        });
-    }
-    if (request.method === "GET" && url.pathname === `/__nook/api/sites/${site}/file`) {
-        const deploymentId = url.searchParams.get("deployment");
-        if (!deploymentId || !/^dep_[a-f0-9]{24}$/.test(deploymentId)) {
-            return error("invalid_deployment", "Invalid deployment", 400);
-        }
-        const path = url.searchParams.get("path");
-        const normalized = path ? normalizeAssetPath(path) : undefined;
-        if (!normalized || normalized !== path)
-            return error("invalid_path", "Invalid site file path", 400);
-        const active = await siteFetch(env, site, "/active");
-        if (!active.ok)
-            return active;
-        const deployment = (await active.json());
-        if (deployment.deploymentId !== deploymentId) {
-            return error("deployment_changed", "Active deployment changed during copy", 409);
-        }
-        if (!deployment.files.some((file) => file.path === normalized)) {
-            return error("invalid_path", "Path is not in the active deployment manifest", 400);
-        }
-        const object = await env.ASSETS.get(assetKey(site, deploymentId, normalized));
-        if (!object)
-            return error("not_found", "Site file not found", 404);
-        return new Response(object.body, {
-            headers: { "content-type": object.httpMetadata?.contentType ?? "application/octet-stream" },
-        });
-    }
-    if (request.method === "POST" && url.pathname.endsWith("/deploy/start")) {
-        const body = (await readJson(request));
-        const files = body.files ?? [];
-        const validationError = validateManifest(files, {
-            requireIndex: true,
-            artifactLabel: "deployment",
-        });
-        if (validationError)
-            return error("invalid_manifest", validationError, 400);
-        await registryFetch(env, "/sites", {
-            method: "POST",
-            body: JSON.stringify({ slug: site, domain: env.NOOK_DOMAIN }),
-        });
-        return await siteFetch(env, site, "/deploy/start", {
-            method: "POST",
-            body: JSON.stringify({ files, public: body.public === true, actor: identity.actor }),
-        });
-    }
-    if (!deploymentId)
-        return error("deployment_not_found", "Deployment is required", 404);
-    const token = request.headers.get("x-nook-deploy-token");
-    if (!token)
-        return error("unauthorized", "Missing deploy token", 401);
-    if (request.method === "PUT" && deployAction === "file") {
-        const path = url.searchParams.get("path");
-        if (!path)
-            return error("invalid_path", "Missing upload path", 400);
-        const verify = await siteFetch(env, site, "/deploy/verify-upload", {
-            method: "POST",
-            body: JSON.stringify({ deploymentId, token, path }),
-        });
-        if (!verify.ok)
-            return verify;
-        const payload = (await verify.json());
-        const bytes = await request.arrayBuffer();
-        if (bytes.byteLength !== payload.file.sizeBytes) {
-            return error("invalid_upload", "Uploaded file size does not match manifest", 400);
-        }
-        if ((await sha256Hex(bytes)) !== payload.file.sha256) {
-            return error("invalid_upload", "Uploaded file hash does not match manifest", 400);
-        }
-        await env.ASSETS.put(assetKey(site, deploymentId, payload.file.path), bytes, {
-            httpMetadata: { contentType: payload.file.contentType },
-        });
-        return await siteFetch(env, site, "/deploy/mark-uploaded", {
-            method: "POST",
-            body: JSON.stringify({ deploymentId, token, path }),
-        });
-    }
-    if (request.method === "POST" && deployAction === "finish") {
-        const finish = await siteFetch(env, site, "/deploy/finish", {
-            method: "POST",
-            body: JSON.stringify({ deploymentId, token }),
-        });
-        if (!finish.ok)
-            return finish;
-        const rawResult = (await finish.json());
-        const result = {
-            ...rawResult,
-            site,
-            url: siteUrl(env.NOOK_DOMAIN, site),
-        };
-        await registryFetch(env, `/sites/${encodeURIComponent(site)}/deploy`, {
-            method: "POST",
-            body: JSON.stringify({
-                latestDeploymentId: result.deploymentId,
-                visibility: result.visibility,
-            }),
-        });
-        if (result.previousDeploymentId) {
-            ctx.waitUntil(deleteR2Prefix(env.ASSETS, `sites/${site}/deployments/${result.previousDeploymentId}/`));
-        }
-        return json(result);
-    }
-    return error("not_found", "Unknown Nook API route", 404);
-}
-async function handleKv(request, env, site, identity, sitePath) {
-    return await siteFetch(env, site, `/kv${sitePath.slice("/__nook/kv".length)}${new URL(request.url).search}`, {
-        method: request.method,
-        headers: { "x-nook-actor": identity.actor },
-        body: request.body,
-    });
-}
-function shouldSpaFallback(pathname) {
-    const segment = pathname.split("/").pop() ?? "";
-    return !segment.includes(".");
-}
-export function cacheControlForDeployedAsset() {
-    return DEPLOYED_ASSET_CACHE_CONTROL;
-}
-function nookClientScriptTag(site) {
-    return `<script src="/${site}/__nook/client.js"></script>`;
-}
-function injectNookClientScript(response, site) {
-    const scriptTag = nookClientScriptTag(site);
-    const injector = {
-        element(element) {
-            element.prepend(scriptTag, { html: true });
-            delete injector.end;
-        },
-        end(end) {
-            end.append(scriptTag, { html: true });
-        },
-    };
-    return new HTMLRewriter().on("body", injector).onDocument(injector).transform(response);
-}
-async function serveAsset(request, env, site, sitePath) {
-    const activeResponse = await siteFetch(env, site, "/active");
-    if (!activeResponse.ok)
-        return error("site_not_found", "Site has no active deployment", 404);
-    const active = (await activeResponse.json());
-    const identity = active.public
-        ? await optionalAccessIdentity(request, env)
-        : await privateAccessIdentity(request, env);
-    if (!identity) {
-        if (sitePath === "/__nook/kv" || sitePath.startsWith("/__nook/kv/")) {
-            return error("unauthorized", "Authentication required", 401);
-        }
-        return Response.redirect(accessLoginUrl(request), 302);
-    }
-    if (sitePath === "/__nook/client.js") {
-        return new Response(CLIENT_JS, {
-            headers: { "content-type": "application/javascript; charset=utf-8" },
-        });
-    }
-    if (sitePath === "/__nook/kv" || sitePath.startsWith("/__nook/kv/")) {
-        return await handleKv(request, env, site, identity, sitePath);
-    }
-    if (sitePath === RESERVED_PREFIX || sitePath.startsWith(`${RESERVED_PREFIX}/`)) {
-        return error("not_found", "Unknown Nook route", 404);
-    }
-    const normalized = normalizeAssetPath(sitePath);
-    if (!normalized)
-        return error("invalid_path", "Invalid path", 400);
-    let object = await env.ASSETS.get(assetKey(site, active.deploymentId, normalized));
-    let servedPath = normalized;
-    if (!object && shouldSpaFallback(normalized)) {
-        servedPath = "/index.html";
-        object = await env.ASSETS.get(assetKey(site, active.deploymentId, servedPath));
-    }
-    if (!object)
-        return new Response("Not found", { status: 404 });
-    const file = active.files.find((entry) => entry.path === servedPath);
-    const contentType = object.httpMetadata?.contentType ?? file?.contentType ?? "application/octet-stream";
-    const headers = new Headers({
-        "content-type": contentType,
-        "cache-control": cacheControlForDeployedAsset(),
-    });
-    if (contentType.startsWith("text/html")) {
-        return injectNookClientScript(new Response(object.body ?? "", { headers }), site);
-    }
-    return new Response(object.body, { headers });
-}
-export default {
-    async fetch(request, env, ctx) {
-        try {
-            const url = new URL(request.url);
-            const parsedHost = parseHost(url, env);
-            if (!parsedHost)
-                return error("not_found", "Unknown nook host", 404);
-            if (url.pathname === "/__nook/auth") {
-                if (request.method !== "GET") {
-                    return error("method_not_allowed", "Method not allowed", 405);
-                }
-                await requireAccessIdentity(request, env);
-                const returnUrl = accessReturnUrl(request);
-                if (!returnUrl)
-                    return error("invalid_return_url", "Invalid return URL", 400);
-                return Response.redirect(returnUrl.toString(), 303);
-            }
-            if (url.pathname === "/__nook/skill") {
-                await requireAccessIdentity(request, env);
-                return new Response(SKILL_MARKDOWN, {
-                    headers: { "content-type": "text/markdown; charset=utf-8" },
-                });
-            }
-            if (url.pathname.startsWith("/__nook/api/")) {
-                const identity = await requireAccessIdentity(request, env);
-                return await handleBaseApi(request, env, url, identity, ctx);
-            }
-            const sitePath = parseSitePath(url.pathname);
-            if (!sitePath)
-                return error("not_found", "Unknown Nook route", 404);
-            if (sitePath.needsSlashRedirect) {
-                const redirectUrl = new URL(request.url);
-                redirectUrl.pathname = `${redirectUrl.pathname}/`;
-                return Response.redirect(redirectUrl.toString(), 308);
-            }
-            return await serveAsset(request, env, sitePath.slug, sitePath.sitePath);
-        }
-        catch (err) {
-            if (err instanceof ErrorResponse)
-                return err.toResponse();
-            return error("internal_error", err instanceof Error ? err.message : String(err), 500);
-        }
-    },
-};
-export class RegistryDO {
-    state;
-    constructor(state) {
-        this.state = state;
-    }
-    async fetch(request) {
-        const url = new URL(request.url);
-        if (request.method === "POST" && url.pathname === "/delete-all") {
-            await this.state.storage.deleteAll();
-            return json({ deleted: true });
-        }
-        if (request.method === "GET" && url.pathname === "/templates") {
-            const records = await this.state.storage.list({ prefix: "template:" });
-            return json({ templates: [...records.values()] });
-        }
-        const templateManifestMatch = url.pathname.match(/^\/templates\/([^/]+)\/manifest$/);
-        if (request.method === "GET" && templateManifestMatch) {
-            const name = decodeURIComponent(templateManifestMatch[1]);
-            const template = await this.state.storage.get(`template:${name}`);
-            if (!template)
-                return error("template_not_found", "Template not found", 404);
-            const files = await this.state.storage.get(`template-files:${name}`);
-            return json({ template, files: files ?? [] });
-        }
-        const templateSaveStartMatch = url.pathname.match(/^\/templates\/([^/]+)\/save\/start$/);
-        if (request.method === "POST" && templateSaveStartMatch) {
-            const name = decodeURIComponent(templateSaveStartMatch[1]);
-            const body = (await readJson(request));
-            const timestamp = now();
-            const nowMs = Date.now();
-            const saves = await this.state.storage.list({
-                prefix: `template-save:${name}:`,
-            });
-            const expiredSaveIds = [];
-            const expiredSaveKeys = [];
-            let pendingSaves = 0;
-            for (const [key, save] of saves.entries()) {
-                if (Date.parse(save.expiresAt) < nowMs) {
-                    expiredSaveIds.push(save.saveId);
-                    expiredSaveKeys.push(key);
-                }
-                else {
-                    pendingSaves += 1;
-                }
-            }
-            if (expiredSaveKeys.length > 0)
-                await this.state.storage.delete(expiredSaveKeys);
-            if (pendingSaves >= MAX_PENDING_TEMPLATE_SAVES) {
-                return error("quota_exceeded", "Too many pending saves for this template", 429);
-            }
-            const save = {
-                saveId: randomId("tpl"),
-                token: randomId("tok"),
-                createdAt: timestamp,
-                expiresAt: new Date(Date.now() + TEMPLATE_SAVE_SESSION_MS).toISOString(),
-                files: body.files,
-                uploaded: [],
-            };
-            await this.state.storage.put(`template-save:${name}:${save.saveId}`, save);
-            return json({
-                saveId: save.saveId,
-                upload: save.files.map((file) => file.path),
-                token: save.token,
-                expiredSaveIds,
-            });
-        }
-        const templateSaveActionMatch = url.pathname.match(/^\/templates\/([^/]+)\/save\/([^/]+)\/(verify-upload|mark-uploaded|finish)$/);
-        if (request.method === "POST" && templateSaveActionMatch) {
-            const name = decodeURIComponent(templateSaveActionMatch[1]);
-            const saveId = decodeURIComponent(templateSaveActionMatch[2]);
-            const action = templateSaveActionMatch[3];
-            const body = (await readJson(request));
-            const save = await this.requireTemplateSave(name, saveId, body.token);
-            if (save instanceof Response)
-                return save;
-            if (action === "verify-upload") {
-                const file = save.files.find((entry) => entry.path === body.path);
-                if (!file)
-                    return error("invalid_path", "Path is not in template manifest", 400);
-                return json({ file });
-            }
-            if (action === "mark-uploaded") {
-                if (!body.path)
-                    return error("invalid_path", "Missing upload path", 400);
-                if (!save.uploaded.includes(body.path))
-                    save.uploaded.push(body.path);
-                await this.state.storage.put(`template-save:${name}:${saveId}`, save);
-                return json({ uploaded: true });
-            }
-            const uploaded = new Set(save.uploaded);
-            const missing = save.files.filter((file) => !uploaded.has(file.path));
-            if (missing.length > 0) {
-                return error("template_incomplete", "Template save has missing files", 409);
-            }
-            const existing = await this.state.storage.get(`template:${name}`);
-            const timestamp = now();
-            const summary = {
-                name,
-                revisionId: save.saveId,
-                createdAt: existing?.createdAt ?? save.createdAt,
-                updatedAt: timestamp,
-                fileCount: save.files.length,
-                byteCount: save.files.reduce((total, file) => total + file.sizeBytes, 0),
-            };
-            await this.state.storage.put(`template:${name}`, summary);
-            await this.state.storage.put(`template-files:${name}`, save.files);
-            await this.state.storage.delete(`template-save:${name}:${saveId}`);
-            return json({ ...summary, previousRevisionId: existing?.revisionId });
-        }
-        const templateDeleteMatch = url.pathname.match(/^\/templates\/([^/]+)$/);
-        if (request.method === "DELETE" && templateDeleteMatch) {
-            const name = decodeURIComponent(templateDeleteMatch[1]);
-            const saves = await this.state.storage.list({
-                prefix: `template-save:${name}:`,
-            });
-            await this.state.storage.delete([
-                `template:${name}`,
-                `template-files:${name}`,
-                ...saves.keys(),
-            ]);
-            return json({ deleted: true });
-        }
-        if (request.method === "GET" && url.pathname === "/sites") {
-            const domain = url.searchParams.get("domain") ?? "";
-            const records = await this.state.storage.list({ prefix: "site:" });
-            return json({
-                sites: [...records.values()].map((site) => ({
-                    ...site,
-                    url: siteUrl(domain, site.slug),
-                })),
-            });
-        }
-        if (request.method === "POST" && url.pathname === "/sites") {
-            const body = (await readJson(request));
-            const key = `site:${body.slug}`;
-            const existing = await this.state.storage.get(key);
-            if (existing)
-                return json(existing);
-            const timestamp = now();
-            const site = {
-                slug: body.slug,
-                url: siteUrl(body.domain, body.slug),
-                createdAt: timestamp,
-                updatedAt: timestamp,
-            };
-            await this.state.storage.put(key, site);
-            return json(site, 201);
-        }
-        const deployMatch = url.pathname.match(/^\/sites\/([^/]+)\/deploy$/);
-        if (request.method === "POST" && deployMatch) {
-            const slug = decodeURIComponent(deployMatch[1]);
-            const body = (await readJson(request));
-            const key = `site:${slug}`;
-            const existing = await this.state.storage.get(key);
-            if (!existing)
-                return error("site_not_found", "Site not found", 404);
-            const updated = {
-                ...existing,
-                updatedAt: now(),
-                latestDeploymentId: body.latestDeploymentId,
-                visibility: body.visibility,
-            };
-            await this.state.storage.put(key, updated);
-            return json(updated);
-        }
-        const deleteMatch = url.pathname.match(/^\/sites\/([^/]+)$/);
-        if (request.method === "DELETE" && deleteMatch) {
-            await this.state.storage.delete(`site:${decodeURIComponent(deleteMatch[1])}`);
-            return json({ deleted: true });
-        }
-        return error("not_found", "Unknown registry route", 404);
-    }
-    async requireTemplateSave(name, saveId, token) {
-        const save = await this.state.storage.get(`template-save:${name}:${saveId}`);
-        if (!save)
-            return error("save_not_found", "Template save not found", 404);
-        if (save.token !== token)
-            return error("unauthorized", "Invalid template save token", 401);
-        if (Date.parse(save.expiresAt) < Date.now()) {
-            return error("save_expired", "Template save session expired", 410);
-        }
-        return save;
-    }
-}
-export class SiteDO {
-    state;
-    constructor(state) {
-        this.state = state;
-    }
-    async fetch(request) {
-        const url = new URL(request.url);
-        if (request.method === "POST" && url.pathname === "/delete") {
-            await this.state.storage.deleteAll();
-            return json({ deleted: true });
-        }
-        if (request.method === "GET" && url.pathname === "/active") {
-            const site = await this.state.storage.get("site");
-            if (!site?.activeDeploymentId)
-                return error("deployment_not_found", "No active deployment", 404);
-            const deployment = await this.state.storage.get(`deployment:${site.activeDeploymentId}`);
-            if (!deployment)
-                return error("deployment_not_found", "Active deployment missing", 404);
-            return json({
-                deploymentId: deployment.deploymentId,
-                public: deployment.public,
-                files: deployment.files,
-            });
-        }
-        if (request.method === "POST" && url.pathname === "/deploy/start") {
-            const body = (await readJson(request));
-            const timestamp = now();
-            const nowMs = Date.now();
-            const deployments = await this.state.storage.list({
-                prefix: "deployment:",
-            });
-            let pendingDeployments = 0;
-            const expiredPendingKeys = [];
-            for (const [key, deployment] of deployments.entries()) {
-                if (deployment.status !== "pending")
-                    continue;
-                if (Date.parse(deployment.expiresAt) < nowMs) {
-                    expiredPendingKeys.push(key);
-                }
-                else {
-                    pendingDeployments += 1;
-                }
-            }
-            if (expiredPendingKeys.length > 0)
-                await this.state.storage.delete(expiredPendingKeys);
-            if (pendingDeployments >= MAX_PENDING_DEPLOYMENTS) {
-                return error("quota_exceeded", "Too many pending deployments for this site", 429);
-            }
-            const deployment = {
-                deploymentId: randomId("dep"),
-                status: "pending",
-                public: body.public,
-                createdAt: timestamp,
-                token: randomId("tok"),
-                expiresAt: new Date(Date.now() + DEPLOY_SESSION_MS).toISOString(),
-                files: body.files,
-                uploaded: [],
-            };
-            const existingSite = await this.state.storage.get("site");
-            await this.state.storage.put("site", {
-                createdAt: existingSite?.createdAt ?? timestamp,
-                updatedAt: timestamp,
-                activeDeploymentId: existingSite?.activeDeploymentId,
-                activePublic: existingSite?.activePublic,
-            });
-            await this.state.storage.put(`deployment:${deployment.deploymentId}`, deployment);
-            return json({
-                deploymentId: deployment.deploymentId,
-                upload: deployment.files.map((file) => file.path),
-                token: deployment.token,
-            });
-        }
-        if (request.method === "POST" && url.pathname === "/deploy/verify-upload") {
-            const body = (await readJson(request));
-            const deploymentResult = await this.requirePendingDeployment(body.deploymentId, body.token);
-            if (deploymentResult instanceof Response)
-                return deploymentResult;
-            const deployment = deploymentResult;
-            const file = deployment.files.find((entry) => entry.path === body.path);
-            if (!file)
-                return error("invalid_path", "Path is not in deployment manifest", 400);
-            return json({ file });
-        }
-        if (request.method === "POST" && url.pathname === "/deploy/mark-uploaded") {
-            const body = (await readJson(request));
-            const deploymentResult = await this.requirePendingDeployment(body.deploymentId, body.token);
-            if (deploymentResult instanceof Response)
-                return deploymentResult;
-            const deployment = deploymentResult;
-            if (!deployment.uploaded.includes(body.path))
-                deployment.uploaded.push(body.path);
-            await this.state.storage.put(`deployment:${deployment.deploymentId}`, deployment);
-            return json({ uploaded: true });
-        }
-        if (request.method === "POST" && url.pathname === "/deploy/finish") {
-            const body = (await readJson(request));
-            const deploymentResult = await this.requirePendingDeployment(body.deploymentId, body.token);
-            if (deploymentResult instanceof Response)
-                return deploymentResult;
-            const deployment = deploymentResult;
-            const uploaded = new Set(deployment.uploaded);
-            const missing = deployment.files.filter((file) => !uploaded.has(file.path));
-            if (missing.length > 0)
-                return error("deployment_incomplete", "Deployment has missing files", 409);
-            const previous = await this.state.storage.get("site");
-            const timestamp = now();
-            deployment.status = "active";
-            deployment.finishedAt = timestamp;
-            await this.state.storage.put(`deployment:${deployment.deploymentId}`, deployment);
-            await this.state.storage.put("site", {
-                createdAt: previous?.createdAt ?? deployment.createdAt,
-                updatedAt: timestamp,
-                activeDeploymentId: deployment.deploymentId,
-                activePublic: deployment.public,
-            });
-            return json({
-                visibility: deployment.public ? "public" : "private",
-                deploymentId: deployment.deploymentId,
-                fileCount: deployment.files.length,
-                byteCount: deployment.files.reduce((total, file) => total + file.sizeBytes, 0),
-                previousDeploymentId: previous?.activeDeploymentId,
-            });
-        }
-        if (url.pathname === "/kv" || url.pathname.startsWith("/kv/")) {
-            return await this.handleKv(request, url);
-        }
-        return error("not_found", "Unknown site route", 404);
-    }
-    async requirePendingDeployment(deploymentId, token) {
-        const deployment = await this.state.storage.get(`deployment:${deploymentId}`);
-        if (!deployment)
-            return error("deployment_not_found", "Deployment not found", 404);
-        if (deployment.status !== "pending") {
-            return error("deployment_not_found", "Deployment is not pending", 409);
-        }
-        if (deployment.token !== token)
-            return error("unauthorized", "Invalid deploy token", 401);
-        if (Date.parse(deployment.expiresAt) < Date.now()) {
-            return error("deployment_expired", "Deployment session expired", 410);
-        }
-        return deployment;
-    }
-    async handleKv(request, url) {
-        try {
-            const key = decodeURIComponent(url.pathname.slice("/kv/".length));
-            if (request.method === "GET" && url.pathname === "/kv") {
-                const prefix = url.searchParams.get("prefix") ?? "";
-                const records = await this.state.storage.list({ prefix: "kv:" });
-                const keys = [...records.entries()]
-                    .map(([storageKey, record]) => ({
-                    key: storageKey.slice("kv:".length),
-                    sizeBytes: record.sizeBytes,
-                    updatedAt: record.updatedAt,
-                }))
-                    .filter((entry) => entry.key.startsWith(prefix));
-                return json({ keys });
-            }
-            if (!key || key.length > MAX_KV_KEY_LENGTH)
-                return error("invalid_key", "Invalid KV key", 400);
-            const storageKey = `kv:${key}`;
-            if (request.method === "GET") {
-                const record = await this.state.storage.get(storageKey);
-                return json({ value: record?.value ?? null });
-            }
-            if (request.method === "DELETE") {
-                const deleted = await this.state.storage.delete(storageKey);
-                return json({ key, deleted });
-            }
-            if (request.method === "PUT") {
-                const value = await readJson(request);
-                const serialized = JSON.stringify(value);
-                const sizeBytes = new TextEncoder().encode(serialized).length;
-                if (sizeBytes > MAX_KV_VALUE_BYTES)
-                    return error("quota_exceeded", "KV value is too large", 413);
-                const existing = await this.state.storage.get(storageKey);
-                const usage = await this.kvUsage();
-                const nextKeys = existing ? usage.keyCount : usage.keyCount + 1;
-                const nextBytes = usage.bytesUsed - (existing?.sizeBytes ?? 0) + sizeBytes;
-                if (nextKeys > MAX_KV_KEYS || nextBytes > MAX_KV_TOTAL_BYTES) {
-                    return error("quota_exceeded", "KV quota exceeded", 413);
-                }
-                await this.state.storage.put(storageKey, {
-                    value,
-                    sizeBytes,
-                    updatedAt: now(),
-                    updatedBy: request.headers.get("x-nook-actor") ?? "unknown",
-                });
-                return json({ key });
-            }
-            return error("method_not_allowed", "Method not allowed", 405);
-        }
-        catch (err) {
-            if (err instanceof ErrorResponse)
-                return err.toResponse();
-            return error("internal_error", err instanceof Error ? err.message : String(err), 500);
-        }
-    }
-    async kvUsage() {
-        const records = await this.state.storage.list({ prefix: "kv:" });
-        let bytesUsed = 0;
-        for (const record of records.values())
-            bytesUsed += record.sizeBytes;
-        return { keyCount: records.size, bytesUsed };
-    }
-}
-class ErrorResponse extends Error {
-    code;
-    status;
-    constructor(code, message, status) {
-        super(message);
-        this.code = code;
-        this.status = status;
-    }
-    toResponse() {
-        return error(this.code, this.message, this.status);
-    }
-}
-//# sourceMappingURL=index.js.map