@notionx/core 0.1.0

package/dist/auth/turnstile.js

@@ -0,0 +1,301 @@
+// src/util/env.ts
+import { env } from "cloudflare:workers";
+var workerEnv = env;
+
+// src/internal/admin/settings.ts
+import { cache } from "react";
+
+// src/platform/runtime.ts
+function cacheRequestForKey(key) {
+  return new Request(key, { method: "GET" });
+}
+function createCloudflarePublicCacheAdapter(cache2) {
+  return {
+    kind: "cloudflare-cache",
+    async match(key) {
+      return await cache2.match(cacheRequestForKey(key)) ?? null;
+    },
+    put(key, response) {
+      return cache2.put(cacheRequestForKey(key), response);
+    },
+    delete(key) {
+      return cache2.delete(cacheRequestForKey(key));
+    }
+  };
+}
+function createCloudflareKeyValueCacheAdapter(namespace) {
+  return {
+    kind: "workers-kv",
+    async get(key, options) {
+      return await namespace.get(key, {
+        type: "json",
+        cacheTtl: options?.cacheTtl
+      });
+    },
+    async put(key, value, options) {
+      await namespace.put(key, JSON.stringify(value), {
+        expirationTtl: options?.expirationTtl,
+        metadata: options?.metadata
+      });
+    },
+    delete(key) {
+      return namespace.delete(key);
+    },
+    async list(options) {
+      const result = await namespace.list({
+        prefix: options?.prefix,
+        limit: options?.limit,
+        cursor: options?.cursor
+      });
+      return {
+        keys: result.keys.map((key) => ({ name: key.name })),
+        cursor: result.list_complete ? void 0 : result.cursor,
+        listComplete: result.list_complete
+      };
+    }
+  };
+}
+function r2ObjectToStoredObject(object) {
+  return {
+    body: object.body,
+    size: object.size,
+    etag: object.etag,
+    contentType: object.httpMetadata?.contentType
+  };
+}
+function createCloudflareRuntimePlatform(env2, options) {
+  const database = env2.DB ? {
+    kind: "d1",
+    prepare(query) {
+      return env2.DB.prepare(query);
+    },
+    async batch(statements) {
+      return await env2.DB.batch(
+        statements
+      );
+    }
+  } : null;
+  const objectStorage = env2.ASSETS_BUCKET ? {
+    kind: "r2",
+    async get(key) {
+      const object = await env2.ASSETS_BUCKET?.get(key);
+      return object ? r2ObjectToStoredObject(object) : null;
+    },
+    async put(key, value, options2) {
+      await env2.ASSETS_BUCKET?.put(key, value, {
+        httpMetadata: {
+          contentType: options2?.contentType,
+          cacheControl: options2?.cacheControl
+        },
+        customMetadata: options2?.metadata
+      });
+    },
+    async delete(key) {
+      await env2.ASSETS_BUCKET?.delete(key);
+    },
+    async list(options2) {
+      const listed = await env2.ASSETS_BUCKET?.list({
+        prefix: options2?.prefix,
+        limit: options2?.limit
+      });
+      return listed?.objects.map((object) => ({
+        key: object.key,
+        size: object.size,
+        uploaded: object.uploaded
+      })) ?? [];
+    }
+  } : null;
+  const imageTransformer = env2.IMAGES ? {
+    kind: "cloudflare-images",
+    async transform(body, options2) {
+      const result = await env2.IMAGES.input(body).transform(options2.width ? { width: options2.width } : {}).output({
+        format: options2.format,
+        quality: options2.quality
+      });
+      return {
+        body: result.image(),
+        contentType: result.contentType(),
+        response: () => result.response()
+      };
+    }
+  } : null;
+  const keyValueCache = env2.CONTENT_CACHE ? createCloudflareKeyValueCacheAdapter(env2.CONTENT_CACHE) : null;
+  return {
+    id: "cloudflare-workers",
+    database,
+    objectStorage,
+    imageTransformer,
+    keyValueCache,
+    publicCache: options?.publicCache ? createCloudflarePublicCacheAdapter(options.publicCache) : null
+  };
+}
+
+// src/platform/cloudflare-runtime.ts
+function getDefaultCloudflareCache() {
+  const globalWithCaches = globalThis;
+  return globalWithCaches.caches?.default ?? null;
+}
+function getRuntimePlatform() {
+  return createCloudflareRuntimePlatform(workerEnv, {
+    publicCache: getDefaultCloudflareCache()
+  });
+}
+
+// src/platform/current.ts
+function getRuntimePlatform2() {
+  return getRuntimePlatform();
+}
+function getDatabase() {
+  const platform = getRuntimePlatform2();
+  const database = platform.database;
+  if (!database) {
+    throw new Error(`SQL database adapter not configured for ${platform.id}`);
+  }
+  return database;
+}
+
+// src/internal/admin/schema-guard.ts
+var DEFAULT_TURNSTILE_PUBLIC_CONFIG = {
+  enabled: false,
+  siteKey: null,
+  secretConfigured: false
+};
+function isSchemaDriftError(error) {
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  return message.includes("no such column") || message.includes("no such table");
+}
+function buildTurnstilePublicConfig(settings, envLike) {
+  const envSiteKey = envLike.TURNSTILE_SITE_KEY?.trim() || null;
+  const siteKey = settings.turnstile_site_key?.trim() || envSiteKey || null;
+  const secretConfigured = Boolean(envLike.TURNSTILE_SECRET_KEY?.trim());
+  const enabled = (settings.turnstile_enabled === 1 || Boolean(envSiteKey)) && Boolean(siteKey) && secretConfigured;
+  return {
+    enabled,
+    siteKey,
+    secretConfigured
+  };
+}
+
+// src/internal/admin/settings.ts
+var DEFAULT_ADMIN_EMAIL = "zhaofilms@gmail.com";
+function rowToSettings(r) {
+  return {
+    site_title: r.site_title,
+    google_enabled: r.google_enabled === 1 ? 1 : 0,
+    google_client_id: r.google_client_id,
+    google_client_secret: r.google_client_secret,
+    google_updated_at: r.google_updated_at,
+    turnstile_enabled: r.turnstile_enabled === 1 ? 1 : 0,
+    turnstile_site_key: r.turnstile_site_key,
+    turnstile_updated_at: r.turnstile_updated_at,
+    admin_email: r.admin_email,
+    updated_at: r.updated_at
+  };
+}
+var getAppSettingsCached = cache(async () => {
+  const row = await getDatabase().prepare(
+    `SELECT site_title, google_enabled, google_client_id, google_client_secret,
+            google_updated_at, turnstile_enabled, turnstile_site_key,
+            turnstile_updated_at, admin_email, updated_at
+       FROM app_settings WHERE id = 1`
+  ).first();
+  if (!row) {
+    return {
+      site_title: "vinext Blog",
+      google_enabled: 0,
+      google_client_id: null,
+      google_client_secret: null,
+      google_updated_at: null,
+      turnstile_enabled: 0,
+      turnstile_site_key: null,
+      turnstile_updated_at: null,
+      admin_email: DEFAULT_ADMIN_EMAIL,
+      updated_at: ""
+    };
+  }
+  return rowToSettings(row);
+});
+async function getAppSettings() {
+  return getAppSettingsCached();
+}
+async function getTurnstilePublicConfig() {
+  try {
+    const s = await getAppSettings();
+    return buildTurnstilePublicConfig(s, workerEnv);
+  } catch (error) {
+    if (isSchemaDriftError(error)) {
+      console.error(
+        "[settings] turnstile config unavailable due to schema drift; falling back to disabled state",
+        error
+      );
+      return { ...DEFAULT_TURNSTILE_PUBLIC_CONFIG };
+    }
+    throw error;
+  }
+}
+
+// src/auth/turnstile.ts
+var SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+async function getTurnstileRuntimeConfig() {
+  const pub = await getTurnstilePublicConfig();
+  const secretKey = workerEnv.TURNSTILE_SECRET_KEY?.trim();
+  if (!pub.enabled || !pub.siteKey || !secretKey) return null;
+  return { enabled: true, siteKey: pub.siteKey, secretKey };
+}
+async function verifyTurnstileToken(token, remoteIp) {
+  const config = await getTurnstileRuntimeConfig();
+  if (!config) {
+    console.error("[DEBUG-TURNSTILE] runtime config missing", {
+      tokenLength: token.length,
+      remoteIpPresent: Boolean(remoteIp)
+    });
+    return { ok: true };
+  }
+  if (!token) {
+    console.error("[DEBUG-TURNSTILE] missing token", {
+      siteKeySuffix: config.siteKey.slice(-6),
+      remoteIpPresent: Boolean(remoteIp)
+    });
+    return { ok: false, codes: ["missing-input-response"] };
+  }
+  const body = new URLSearchParams();
+  body.set("secret", config.secretKey);
+  body.set("response", token);
+  if (remoteIp) body.set("remoteip", remoteIp);
+  const res = await fetch(SITEVERIFY_URL, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!res.ok) {
+    console.error("[DEBUG-TURNSTILE] siteverify http error", {
+      siteKeySuffix: config.siteKey.slice(-6),
+      tokenLength: token.length,
+      status: res.status
+    });
+    return { ok: false, codes: [`http-${res.status}`] };
+  }
+  const data = await res.json();
+  if (data.success) return { ok: true };
+  console.error("[DEBUG-TURNSTILE] siteverify failed", {
+    siteKeySuffix: config.siteKey.slice(-6),
+    tokenLength: token.length,
+    codes: data["error-codes"] ?? ["verification-failed"]
+  });
+  return { ok: false, codes: data["error-codes"] ?? ["verification-failed"] };
+}
+async function verifyTurnstileFromForm(formData, remoteIp) {
+  const token = String(formData.get("cf-turnstile-response") ?? "").trim();
+  console.error("[DEBUG-TURNSTILE] form token read", {
+    tokenLength: token.length,
+    remoteIpPresent: Boolean(remoteIp)
+  });
+  const result = await verifyTurnstileToken(token, remoteIp);
+  return result.ok ? { ok: true } : { ok: false };
+}
+export {
+  getTurnstileRuntimeConfig,
+  verifyTurnstileFromForm,
+  verifyTurnstileToken
+};
+//# sourceMappingURL=turnstile.js.map

package/dist/auth/turnstile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/util/env.ts","../../src/internal/admin/settings.ts","../../src/platform/runtime.ts","../../src/platform/cloudflare-runtime.ts","../../src/platform/current.ts","../../src/internal/admin/schema-guard.ts","../../src/auth/turnstile.ts"],"sourcesContent":["// lib/env.ts - 集中获取 Cloudflare bindings\n// 用 cloudflare:workers 模块（workerd 内置），作为平台 adapter 的绑定入口\n\n/// <reference types=\"@cloudflare/workers-types\" />\nimport { env } from \"cloudflare:workers\";\n\nexport type AppEnv = {\n  DB: D1Database;\n  ASSETS: Fetcher;\n  IMAGES: ImagesBinding;\n  ASSETS_BUCKET?: R2Bucket;\n  CONTENT_CACHE?: KVNamespace;\n  ADMIN_PASSWORD: string;\n  ADMIN_EMAIL?: string;\n  SITE_URL?: string;\n  RESEND_API_KEY?: string;\n  RESEND_FROM?: string;\n  // Google OAuth 仍然兼容 Cloudflare Secret 作为兜底。\n  // 实际生效值以 app_settings.google_client_id / google_client_secret 为准。\n  GOOGLE_CLIENT_ID?: string;\n  GOOGLE_CLIENT_SECRET?: string;\n  /** Turnstile site key fallback when not stored in app_settings */\n  TURNSTILE_SITE_KEY?: string;\n  /** Turnstile secret — set via `wrangler secret put TURNSTILE_SECRET_KEY` */\n  TURNSTILE_SECRET_KEY?: string;\n  /** Notion integration token for the blog data source */\n  NOTION_TOKEN?: string;\n  /** Notion data source ID used by dataSources.query */\n  NOTION_DATA_SOURCE_ID?: string;\n  /** Notion data source ID for the public movie catalog */\n  NOTION_MOVIES_DATA_SOURCE_ID?: string;\n  /** Notion data source ID for localized movie copy */\n  NOTION_MOVIE_TRANSLATIONS_DATA_SOURCE_ID?: string;\n  /** Optional Notion API base URL for tests or proxies */\n  NOTION_API_BASE_URL?: string;\n  /** Optional Notion edit URL for admin handoff screens */\n  NOTION_EDIT_BASE_URL?: string;\n  /** Optional webhook verification token for Notion invalidation */\n  NOTION_WEBHOOK_VERIFICATION_TOKEN?: string;\n};\n\n// 强制类型：vinext 把 env 类型放在 env.d.ts（interface VinextEnv extends Env），\n// 但 TS server 经常解析不到。运行时一定有 DB，类型断言保证编译通过。\nexport const workerEnv = env as unknown as AppEnv;\n","// lib/settings.ts - 读取和更新后台系统设置（单管理员模型）\n// 数据保存在 SQL 表 app_settings，目前固定为 1 行。\n//\n// Internal to the package — not exposed via package.json exports. The\n// auth helpers (turnstile.ts, users.ts) call into the read functions;\n// admin pages in the starter import the update functions through a\n// re-export shim at `apps/moviebluebook/lib/settings.ts`.\n\nimport { cache } from \"react\";\nimport { workerEnv } from \"../../util/env\";\nimport { getDatabase } from \"../../platform/current\";\nimport {\n  buildTurnstilePublicConfig,\n  DEFAULT_TURNSTILE_PUBLIC_CONFIG,\n  isSchemaDriftError,\n} from \"./schema-guard\";\n\nexport type AppSettings = {\n  site_title: string;\n  google_enabled: 0 | 1;\n  google_client_id: string | null;\n  google_client_secret: string | null;\n  google_updated_at: string | null;\n  turnstile_enabled: 0 | 1;\n  turnstile_site_key: string | null;\n  turnstile_updated_at: string | null;\n  admin_email: string;\n  updated_at: string;\n};\n\ntype Row = {\n  site_title: string;\n  google_enabled: number;\n  google_client_id: string | null;\n  google_client_secret: string | null;\n  google_updated_at: string | null;\n  turnstile_enabled: number;\n  turnstile_site_key: string | null;\n  turnstile_updated_at: string | null;\n  admin_email: string;\n  updated_at: string;\n};\n\nconst DEFAULT_ADMIN_EMAIL = \"zhaofilms@gmail.com\";\n\nfunction rowToSettings(r: Row): AppSettings {\n  return {\n    site_title: r.site_title,\n    google_enabled: r.google_enabled === 1 ? 1 : 0,\n    google_client_id: r.google_client_id,\n    google_client_secret: r.google_client_secret,\n    google_updated_at: r.google_updated_at,\n    turnstile_enabled: r.turnstile_enabled === 1 ? 1 : 0,\n    turnstile_site_key: r.turnstile_site_key,\n    turnstile_updated_at: r.turnstile_updated_at,\n    admin_email: r.admin_email,\n    updated_at: r.updated_at,\n  };\n}\n\nconst getAppSettingsCached = cache(async (): Promise<AppSettings> => {\n  const row = await getDatabase().prepare(\n    `SELECT site_title, google_enabled, google_client_id, google_client_secret,\n            google_updated_at, turnstile_enabled, turnstile_site_key,\n            turnstile_updated_at, admin_email, updated_at\n       FROM app_settings WHERE id = 1`\n  ).first<Row>();\n  if (!row) {\n    // 极端情况：迁移未执行\n    return {\n      site_title: \"vinext Blog\",\n      google_enabled: 0,\n      google_client_id: null,\n      google_client_secret: null,\n      google_updated_at: null,\n      turnstile_enabled: 0,\n      turnstile_site_key: null,\n      turnstile_updated_at: null,\n      admin_email: DEFAULT_ADMIN_EMAIL,\n      updated_at: \"\",\n    };\n  }\n  return rowToSettings(row);\n});\n\nexport async function getAppSettings(): Promise<AppSettings> {\n  return getAppSettingsCached();\n}\n\n/** Turnstile 前端可见配置（site key 公开；secret 在 env）。 */\nexport async function getTurnstilePublicConfig(): Promise<{\n  enabled: boolean;\n  siteKey: string | null;\n  secretConfigured: boolean;\n}> {\n  try {\n    const s = await getAppSettings();\n    return buildTurnstilePublicConfig(s, workerEnv);\n  } catch (error) {\n    if (isSchemaDriftError(error)) {\n      console.error(\n        \"[settings] turnstile config unavailable due to schema drift; falling back to disabled state\",\n        error\n      );\n      return { ...DEFAULT_TURNSTILE_PUBLIC_CONFIG };\n    }\n    throw error;\n  }\n}\n\nexport async function updateTurnstileConfig(input: {\n  enabled: boolean;\n  siteKey: string;\n}): Promise<void> {\n  const enabled = input.enabled ? 1 : 0;\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET turnstile_enabled = ?,\n            turnstile_site_key = ?,\n            turnstile_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  )\n    .bind(enabled, input.siteKey || null)\n    .run();\n}\n\nexport async function disableTurnstileConfig(): Promise<void> {\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET turnstile_enabled = 0,\n            turnstile_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  ).run();\n}\n\n/** Google 登录实际配置：只有 enabled 且 id+secret 都存在才认为可用 */\nexport async function getGoogleOAuthConfig(): Promise<{\n  enabled: boolean;\n  clientId: string;\n  clientSecret: string;\n} | null> {\n  const s = await getAppSettings();\n  if (!s.google_enabled) return null;\n  if (!s.google_client_id || !s.google_client_secret) return null;\n  return {\n    enabled: true,\n    clientId: s.google_client_id,\n    clientSecret: s.google_client_secret,\n  };\n}\n\nexport async function updateGoogleOAuthConfig(input: {\n  enabled: boolean;\n  clientId: string;\n  clientSecret: string;\n}): Promise<void> {\n  const enabled = input.enabled ? 1 : 0;\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET google_enabled = ?,\n            google_client_id = ?,\n            google_client_secret = ?,\n            google_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  )\n    .bind(enabled, input.clientId, input.clientSecret)\n    .run();\n}\n\nexport async function clearGoogleOAuthConfig(): Promise<void> {\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET google_enabled = 0,\n            google_client_id = NULL,\n            google_client_secret = NULL,\n            google_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  ).run();\n}\n\nexport async function updateSiteTitle(title: string): Promise<void> {\n  await getDatabase().prepare(\n    `UPDATE app_settings SET site_title = ?, updated_at = datetime('now') WHERE id = 1`\n  )\n    .bind(title)\n    .run();\n}\n","import type { AppEnv } from \"../util/env\";\n\nexport type PlatformBindingEnv = Pick<\n  AppEnv,\n  \"ASSETS_BUCKET\" | \"CONTENT_CACHE\" | \"DB\" | \"IMAGES\"\n>;\n\nexport type StoredObject = {\n  body: ReadableStream;\n  size: number;\n  etag?: string;\n  contentType?: string;\n};\n\nexport type ObjectStoragePutOptions = {\n  contentType?: string;\n  cacheControl?: string;\n  metadata?: Record<string, string>;\n};\n\nexport type ObjectStorageListItem = {\n  key: string;\n  size: number;\n  uploaded: Date;\n};\n\nexport type ObjectStorageAdapter = {\n  kind: \"r2\";\n  get(key: string): Promise<StoredObject | null>;\n  put(\n    key: string,\n    value: ReadableStream | ArrayBuffer | ArrayBufferView | string | Blob,\n    options?: ObjectStoragePutOptions\n  ): Promise<void>;\n  delete(key: string): Promise<void>;\n  list(\n    options?: { prefix?: string; limit?: number }\n  ): Promise<ObjectStorageListItem[]>;\n};\n\nexport type ImageTransformOptions = {\n  width?: number;\n  format: \"image/avif\" | \"image/webp\";\n  quality: number;\n};\n\nexport type ImageTransformResult = {\n  body: ReadableStream;\n  contentType: string;\n  response(): Response;\n};\n\nexport type ImageTransformerAdapter = {\n  kind: \"cloudflare-images\" | \"external\";\n  transform(\n    body: ReadableStream,\n    options: ImageTransformOptions\n  ): Promise<ImageTransformResult>;\n};\n\nexport type PublicCacheAdapter = {\n  kind: \"cloudflare-cache\" | \"noop\" | \"external\";\n  match(key: string): Promise<Response | null>;\n  put(key: string, response: Response): Promise<void>;\n  delete(key: string): Promise<boolean>;\n};\n\nexport type KeyValueCacheGetOptions = {\n  cacheTtl?: number;\n};\n\nexport type KeyValueCachePutOptions = {\n  expirationTtl?: number;\n  metadata?: Record<string, string | number | boolean | null>;\n};\n\nexport type KeyValueCacheListOptions = {\n  prefix?: string;\n  limit?: number;\n  cursor?: string;\n};\n\nexport type KeyValueCacheListResult = {\n  keys: Array<{ name: string }>;\n  cursor?: string;\n  listComplete: boolean;\n};\n\nexport type KeyValueCacheAdapter = {\n  kind: \"workers-kv\" | \"noop\" | \"external\";\n  get<T = unknown>(\n    key: string,\n    options?: KeyValueCacheGetOptions\n  ): Promise<T | null>;\n  put<T = unknown>(\n    key: string,\n    value: T,\n    options?: KeyValueCachePutOptions\n  ): Promise<void>;\n  delete(key: string): Promise<void>;\n  list(options?: KeyValueCacheListOptions): Promise<KeyValueCacheListResult>;\n};\n\nexport type SqlValue = string | number | boolean | null;\n\nexport type SqlResult<T = Record<string, unknown>> = {\n  results?: T[];\n  success?: boolean;\n  meta?: {\n    changes?: number;\n    duration?: number;\n    last_row_id?: number;\n    rows_read?: number;\n    rows_written?: number;\n    [key: string]: unknown;\n  };\n};\n\nexport type SqlPreparedStatement = {\n  bind(...values: SqlValue[]): SqlPreparedStatement;\n  all<T = Record<string, unknown>>(): Promise<SqlResult<T>>;\n  first<T = Record<string, unknown>>(columnName?: string): Promise<T | null>;\n  run<T = Record<string, unknown>>(): Promise<SqlResult<T>>;\n};\n\nexport type SqlDatabaseAdapter = {\n  kind: \"d1\";\n  prepare(query: string): SqlPreparedStatement;\n  batch<T = Record<string, unknown>>(\n    statements: SqlPreparedStatement[]\n  ): Promise<SqlResult<T>[]>;\n};\n\nexport type RuntimePlatform = {\n  id: \"cloudflare-workers\";\n  database: SqlDatabaseAdapter | null;\n  objectStorage: ObjectStorageAdapter | null;\n  imageTransformer: ImageTransformerAdapter | null;\n  publicCache: PublicCacheAdapter | null;\n  keyValueCache: KeyValueCacheAdapter | null;\n};\n\ntype CloudflareCacheLike = Pick<Cache, \"match\" | \"put\" | \"delete\">;\ntype CloudflareKvLike = Pick<KVNamespace, \"get\" | \"put\" | \"delete\" | \"list\">;\n\nfunction cacheRequestForKey(key: string) {\n  return new Request(key, { method: \"GET\" });\n}\n\nexport function createCloudflarePublicCacheAdapter(\n  cache: CloudflareCacheLike\n): PublicCacheAdapter {\n  return {\n    kind: \"cloudflare-cache\",\n    async match(key) {\n      return (await cache.match(cacheRequestForKey(key))) ?? null;\n    },\n    put(key, response) {\n      return cache.put(cacheRequestForKey(key), response);\n    },\n    delete(key) {\n      return cache.delete(cacheRequestForKey(key));\n    },\n  };\n}\n\nexport function createNoopPublicCacheAdapter(kind: \"noop\" = \"noop\"): PublicCacheAdapter {\n  return {\n    kind,\n    async match() {\n      return null;\n    },\n    async put() {},\n    async delete() {\n      return false;\n    },\n  };\n}\n\nexport function createCloudflareKeyValueCacheAdapter(\n  namespace: CloudflareKvLike\n): KeyValueCacheAdapter {\n  return {\n    kind: \"workers-kv\",\n    async get<T = unknown>(\n      key: string,\n      options?: KeyValueCacheGetOptions\n    ): Promise<T | null> {\n      return (await namespace.get(key, {\n        type: \"json\",\n        cacheTtl: options?.cacheTtl,\n      })) as T | null;\n    },\n    async put(key, value, options) {\n      await namespace.put(key, JSON.stringify(value), {\n        expirationTtl: options?.expirationTtl,\n        metadata: options?.metadata,\n      });\n    },\n    delete(key) {\n      return namespace.delete(key);\n    },\n    async list(options) {\n      const result = await namespace.list({\n        prefix: options?.prefix,\n        limit: options?.limit,\n        cursor: options?.cursor,\n      });\n      return {\n        keys: result.keys.map((key) => ({ name: key.name })),\n        cursor: result.list_complete ? undefined : result.cursor,\n        listComplete: result.list_complete,\n      };\n    },\n  };\n}\n\nexport function createNoopKeyValueCacheAdapter(\n  kind: \"noop\" = \"noop\"\n): KeyValueCacheAdapter {\n  return {\n    kind,\n    async get() {\n      return null;\n    },\n    async put() {},\n    async delete() {},\n    async list() {\n      return { keys: [], listComplete: true };\n    },\n  };\n}\n\nfunction r2ObjectToStoredObject(object: R2ObjectBody): StoredObject {\n  return {\n    body: object.body,\n    size: object.size,\n    etag: object.etag,\n    contentType: object.httpMetadata?.contentType,\n  };\n}\n\nexport function createCloudflareRuntimePlatform(\n  env: PlatformBindingEnv,\n  options?: { publicCache?: CloudflareCacheLike | null }\n): RuntimePlatform {\n  const database: SqlDatabaseAdapter | null = env.DB\n    ? ({\n        kind: \"d1\",\n        prepare(query: string) {\n          return env.DB.prepare(query) as unknown as SqlPreparedStatement;\n        },\n        async batch(statements: SqlPreparedStatement[]) {\n          return (await env.DB.batch(\n            statements as unknown as D1PreparedStatement[]\n          )) as unknown as SqlResult<Record<string, unknown>>[];\n        },\n      } as unknown as SqlDatabaseAdapter)\n    : null;\n\n  const objectStorage: ObjectStorageAdapter | null = env.ASSETS_BUCKET\n    ? {\n        kind: \"r2\",\n        async get(key) {\n          const object = await env.ASSETS_BUCKET?.get(key);\n          return object ? r2ObjectToStoredObject(object) : null;\n        },\n        async put(key, value, options) {\n          await env.ASSETS_BUCKET?.put(key, value, {\n            httpMetadata: {\n              contentType: options?.contentType,\n              cacheControl: options?.cacheControl,\n            },\n            customMetadata: options?.metadata,\n          });\n        },\n        async delete(key) {\n          await env.ASSETS_BUCKET?.delete(key);\n        },\n        async list(options) {\n          const listed = await env.ASSETS_BUCKET?.list({\n            prefix: options?.prefix,\n            limit: options?.limit,\n          });\n          return (\n            listed?.objects.map((object) => ({\n              key: object.key,\n              size: object.size,\n              uploaded: object.uploaded,\n            })) ?? []\n          );\n        },\n      }\n    : null;\n\n  const imageTransformer: ImageTransformerAdapter | null = env.IMAGES\n    ? {\n        kind: \"cloudflare-images\",\n        async transform(body, options) {\n          const result = await env.IMAGES.input(body)\n            .transform(options.width ? { width: options.width } : {})\n            .output({\n              format: options.format,\n              quality: options.quality,\n            });\n          return {\n            body: result.image(),\n            contentType: result.contentType(),\n            response: () => result.response(),\n          };\n        },\n      }\n    : null;\n\n  const keyValueCache: KeyValueCacheAdapter | null = env.CONTENT_CACHE\n    ? createCloudflareKeyValueCacheAdapter(env.CONTENT_CACHE)\n    : null;\n\n  return {\n    id: \"cloudflare-workers\",\n    database,\n    objectStorage,\n    imageTransformer,\n    keyValueCache,\n    publicCache: options?.publicCache\n      ? createCloudflarePublicCacheAdapter(options.publicCache)\n      : null,\n  };\n}\n","import { workerEnv } from \"../util/env\";\nimport {\n  createCloudflarePublicCacheAdapter,\n  createCloudflareRuntimePlatform,\n} from \"./runtime\";\n\nfunction getDefaultCloudflareCache() {\n  const globalWithCaches = globalThis as typeof globalThis & {\n    caches?: CacheStorage & { default?: Cache };\n  };\n  return globalWithCaches.caches?.default ?? null;\n}\n\nexport function getRuntimePlatform() {\n  return createCloudflareRuntimePlatform(workerEnv, {\n    publicCache: getDefaultCloudflareCache(),\n  });\n}\n\nexport function getDatabase() {\n  const database = getRuntimePlatform().database;\n  if (!database) {\n    throw new Error(\"SQL database binding not configured\");\n  }\n  return database;\n}\n\nexport function getPublicCache() {\n  const cache = getDefaultCloudflareCache();\n  if (!cache) {\n    throw new Error(\"Cloudflare cache binding not configured\");\n  }\n  return createCloudflarePublicCacheAdapter(cache);\n}\n","import {\n  getPublicCache as getCloudflarePublicCache,\n  getRuntimePlatform as getCloudflareRuntimePlatform,\n} from \"./cloudflare-runtime\";\nimport { currentRuntimeId } from \"./selection\";\n\nexport function getRuntimePlatform() {\n  return getCloudflareRuntimePlatform();\n}\n\nexport function getDatabase() {\n  const platform = getRuntimePlatform();\n  const database = platform.database;\n  if (!database) {\n    throw new Error(`SQL database adapter not configured for ${platform.id}`);\n  }\n  return database;\n}\n\nexport function getPublicCache() {\n  return getCloudflarePublicCache();\n}\n\nexport function getKeyValueCache() {\n  return getRuntimePlatform().keyValueCache;\n}\n\nexport const runtimeSelection = {\n  currentRuntimeId,\n};\n","export const REQUIRED_SCHEMA_CHECKS = [\n  {\n    key: \"app_settings.turnstile_enabled\",\n    sql: \"SELECT turnstile_enabled FROM app_settings LIMIT 1\",\n  },\n  {\n    key: \"users.session_rev\",\n    sql: \"SELECT session_rev FROM users LIMIT 1\",\n  },\n  {\n    key: \"auth_rate_limits\",\n    sql: \"SELECT 1 FROM auth_rate_limits LIMIT 1\",\n  },\n];\n\nexport const DEFAULT_TURNSTILE_PUBLIC_CONFIG = {\n  enabled: false,\n  siteKey: null,\n  secretConfigured: false,\n};\n\nexport function isSchemaDriftError(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error ?? \"\");\n  return (\n    message.includes(\"no such column\") || message.includes(\"no such table\")\n  );\n}\n\nexport function buildTurnstilePublicConfig(\n  settings: { turnstile_enabled: number; turnstile_site_key: string | null },\n  envLike: { TURNSTILE_SITE_KEY?: string; TURNSTILE_SECRET_KEY?: string }\n): { enabled: boolean; siteKey: string | null; secretConfigured: boolean } {\n  const envSiteKey = envLike.TURNSTILE_SITE_KEY?.trim() || null;\n  const siteKey = settings.turnstile_site_key?.trim() || envSiteKey || null;\n  const secretConfigured = Boolean(envLike.TURNSTILE_SECRET_KEY?.trim());\n  const enabled =\n    (settings.turnstile_enabled === 1 || Boolean(envSiteKey)) &&\n    Boolean(siteKey) &&\n    secretConfigured;\n\n  return {\n    enabled,\n    siteKey,\n    secretConfigured,\n  };\n}\n\nexport async function runSchemaHealthChecks(db: {\n  prepare: (sql: string) => { first: () => Promise<unknown> };\n}): Promise<{ ok: boolean; missing: string[]; errors: string[] }> {\n  const missing: string[] = [];\n  const errors: string[] = [];\n\n  for (const check of REQUIRED_SCHEMA_CHECKS) {\n    try {\n      await db.prepare(check.sql).first();\n    } catch (error) {\n      if (isSchemaDriftError(error)) {\n        missing.push(check.key);\n      } else {\n        const message = error instanceof Error ? error.message : String(error);\n        errors.push(`${check.key}: ${message}`);\n      }\n    }\n  }\n\n  return {\n    ok: missing.length === 0 && errors.length === 0,\n    missing,\n    errors,\n  };\n}\n","// auth/turnstile.ts - Cloudflare Turnstile server-side token verification.\n// Widget: https://dash.cloudflare.com/?to=/:account/turnstile\n// Same Cloudflare account as Workers, but created as a separate Turnstile product.\n\nimport { workerEnv } from \"../util/env\";\nimport { getTurnstilePublicConfig } from \"../internal/admin/settings\";\n\nconst SITEVERIFY_URL =\n  \"https://challenges.cloudflare.com/turnstile/v0/siteverify\";\n\nexport type TurnstileRuntimeConfig = {\n  enabled: boolean;\n  siteKey: string;\n  secretKey: string;\n};\n\n/** 是否应对当前请求执行 Turnstile 校验（开关 + site key + secret 齐全）。 */\nexport async function getTurnstileRuntimeConfig(): Promise<TurnstileRuntimeConfig | null> {\n  const pub = await getTurnstilePublicConfig();\n  const secretKey = workerEnv.TURNSTILE_SECRET_KEY?.trim();\n  if (!pub.enabled || !pub.siteKey || !secretKey) return null;\n  return { enabled: true, siteKey: pub.siteKey, secretKey };\n}\n\ntype SiteverifyResponse = {\n  success: boolean;\n  \"error-codes\"?: string[];\n};\n\nexport async function verifyTurnstileToken(\n  token: string,\n  remoteIp: string | null\n): Promise<{ ok: true } | { ok: false; codes: string[] }> {\n  const config = await getTurnstileRuntimeConfig();\n  if (!config) {\n    // #region debug-point C:runtime-config-missing\n    console.error(\"[DEBUG-TURNSTILE] runtime config missing\", {\n      tokenLength: token.length,\n      remoteIpPresent: Boolean(remoteIp),\n    });\n    // #endregion\n    return { ok: true };\n  }\n\n  if (!token) {\n    // #region debug-point B:missing-token\n    console.error(\"[DEBUG-TURNSTILE] missing token\", {\n      siteKeySuffix: config.siteKey.slice(-6),\n      remoteIpPresent: Boolean(remoteIp),\n    });\n    // #endregion\n    return { ok: false, codes: [\"missing-input-response\"] };\n  }\n\n  const body = new URLSearchParams();\n  body.set(\"secret\", config.secretKey);\n  body.set(\"response\", token);\n  if (remoteIp) body.set(\"remoteip\", remoteIp);\n\n  const res = await fetch(SITEVERIFY_URL, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body,\n  });\n\n  if (!res.ok) {\n    // #region debug-point C:siteverify-http-error\n    console.error(\"[DEBUG-TURNSTILE] siteverify http error\", {\n      siteKeySuffix: config.siteKey.slice(-6),\n      tokenLength: token.length,\n      status: res.status,\n    });\n    // #endregion\n    return { ok: false, codes: [`http-${res.status}`] };\n  }\n\n  const data = (await res.json()) as SiteverifyResponse;\n  if (data.success) return { ok: true };\n  // #region debug-point C:siteverify-failed\n  console.error(\"[DEBUG-TURNSTILE] siteverify failed\", {\n    siteKeySuffix: config.siteKey.slice(-6),\n    tokenLength: token.length,\n    codes: data[\"error-codes\"] ?? [\"verification-failed\"],\n  });\n  // #endregion\n  return { ok: false, codes: data[\"error-codes\"] ?? [\"verification-failed\"] };\n}\n\nexport async function verifyTurnstileFromForm(\n  formData: FormData,\n  remoteIp: string | null\n): Promise<{ ok: true } | { ok: false }> {\n  const token = String(formData.get(\"cf-turnstile-response\") ?? \"\").trim();\n  // #region debug-point B:form-token-read\n  console.error(\"[DEBUG-TURNSTILE] form token read\", {\n    tokenLength: token.length,\n    remoteIpPresent: Boolean(remoteIp),\n  });\n  // #endregion\n  const result = await verifyTurnstileToken(token, remoteIp);\n  return result.ok ? { ok: true } : { ok: false };\n}\n"],"mappings":";AAIA,SAAS,WAAW;AAuCb,IAAM,YAAY;;;ACnCzB,SAAS,aAAa;;;ACyItB,SAAS,mBAAmB,KAAa;AACvC,SAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,mCACdA,QACoB;AACpB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,MAAM,KAAK;AACf,aAAQ,MAAMA,OAAM,MAAM,mBAAmB,GAAG,CAAC,KAAM;AAAA,IACzD;AAAA,IACA,IAAI,KAAK,UAAU;AACjB,aAAOA,OAAM,IAAI,mBAAmB,GAAG,GAAG,QAAQ;AAAA,IACpD;AAAA,IACA,OAAO,KAAK;AACV,aAAOA,OAAM,OAAO,mBAAmB,GAAG,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;AAeO,SAAS,qCACd,WACsB;AACtB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,IACJ,KACA,SACmB;AACnB,aAAQ,MAAM,UAAU,IAAI,KAAK;AAAA,QAC/B,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,IAAI,KAAK,OAAO,SAAS;AAC7B,YAAM,UAAU,IAAI,KAAK,KAAK,UAAU,KAAK,GAAG;AAAA,QAC9C,eAAe,SAAS;AAAA,QACxB,UAAU,SAAS;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,IACA,OAAO,KAAK;AACV,aAAO,UAAU,OAAO,GAAG;AAAA,IAC7B;AAAA,IACA,MAAM,KAAK,SAAS;AAClB,YAAM,SAAS,MAAM,UAAU,KAAK;AAAA,QAClC,QAAQ,SAAS;AAAA,QACjB,OAAO,SAAS;AAAA,QAChB,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,aAAO;AAAA,QACL,MAAM,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,KAAK,EAAE;AAAA,QACnD,QAAQ,OAAO,gBAAgB,SAAY,OAAO;AAAA,QAClD,cAAc,OAAO;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAkBA,SAAS,uBAAuB,QAAoC;AAClE,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,aAAa,OAAO,cAAc;AAAA,EACpC;AACF;AAEO,SAAS,gCACdC,MACA,SACiB;AACjB,QAAM,WAAsCA,KAAI,KAC3C;AAAA,IACC,MAAM;AAAA,IACN,QAAQ,OAAe;AACrB,aAAOA,KAAI,GAAG,QAAQ,KAAK;AAAA,IAC7B;AAAA,IACA,MAAM,MAAM,YAAoC;AAC9C,aAAQ,MAAMA,KAAI,GAAG;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF,IACA;AAEJ,QAAM,gBAA6CA,KAAI,gBACnD;AAAA,IACE,MAAM;AAAA,IACN,MAAM,IAAI,KAAK;AACb,YAAM,SAAS,MAAMA,KAAI,eAAe,IAAI,GAAG;AAC/C,aAAO,SAAS,uBAAuB,MAAM,IAAI;AAAA,IACnD;AAAA,IACA,MAAM,IAAI,KAAK,OAAOC,UAAS;AAC7B,YAAMD,KAAI,eAAe,IAAI,KAAK,OAAO;AAAA,QACvC,cAAc;AAAA,UACZ,aAAaC,UAAS;AAAA,UACtB,cAAcA,UAAS;AAAA,QACzB;AAAA,QACA,gBAAgBA,UAAS;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,OAAO,KAAK;AAChB,YAAMD,KAAI,eAAe,OAAO,GAAG;AAAA,IACrC;AAAA,IACA,MAAM,KAAKC,UAAS;AAClB,YAAM,SAAS,MAAMD,KAAI,eAAe,KAAK;AAAA,QAC3C,QAAQC,UAAS;AAAA,QACjB,OAAOA,UAAS;AAAA,MAClB,CAAC;AACD,aACE,QAAQ,QAAQ,IAAI,CAAC,YAAY;AAAA,QAC/B,KAAK,OAAO;AAAA,QACZ,MAAM,OAAO;AAAA,QACb,UAAU,OAAO;AAAA,MACnB,EAAE,KAAK,CAAC;AAAA,IAEZ;AAAA,EACF,IACA;AAEJ,QAAM,mBAAmDD,KAAI,SACzD;AAAA,IACE,MAAM;AAAA,IACN,MAAM,UAAU,MAAMC,UAAS;AAC7B,YAAM,SAAS,MAAMD,KAAI,OAAO,MAAM,IAAI,EACvC,UAAUC,SAAQ,QAAQ,EAAE,OAAOA,SAAQ,MAAM,IAAI,CAAC,CAAC,EACvD,OAAO;AAAA,QACN,QAAQA,SAAQ;AAAA,QAChB,SAASA,SAAQ;AAAA,MACnB,CAAC;AACH,aAAO;AAAA,QACL,MAAM,OAAO,MAAM;AAAA,QACnB,aAAa,OAAO,YAAY;AAAA,QAChC,UAAU,MAAM,OAAO,SAAS;AAAA,MAClC;AAAA,IACF;AAAA,EACF,IACA;AAEJ,QAAM,gBAA6CD,KAAI,gBACnD,qCAAqCA,KAAI,aAAa,IACtD;AAEJ,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,SAAS,cAClB,mCAAmC,QAAQ,WAAW,IACtD;AAAA,EACN;AACF;;;AClUA,SAAS,4BAA4B;AACnC,QAAM,mBAAmB;AAGzB,SAAO,iBAAiB,QAAQ,WAAW;AAC7C;AAEO,SAAS,qBAAqB;AACnC,SAAO,gCAAgC,WAAW;AAAA,IAChD,aAAa,0BAA0B;AAAA,EACzC,CAAC;AACH;;;ACXO,SAASE,sBAAqB;AACnC,SAAO,mBAA6B;AACtC;AAEO,SAAS,cAAc;AAC5B,QAAM,WAAWA,oBAAmB;AACpC,QAAM,WAAW,SAAS;AAC1B,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,2CAA2C,SAAS,EAAE,EAAE;AAAA,EAC1E;AACA,SAAO;AACT;;;ACFO,IAAM,kCAAkC;AAAA,EAC7C,SAAS;AAAA,EACT,SAAS;AAAA,EACT,kBAAkB;AACpB;AAEO,SAAS,mBAAmB,OAAyB;AAC1D,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,EAAE;AAC3E,SACE,QAAQ,SAAS,gBAAgB,KAAK,QAAQ,SAAS,eAAe;AAE1E;AAEO,SAAS,2BACd,UACA,SACyE;AACzE,QAAM,aAAa,QAAQ,oBAAoB,KAAK,KAAK;AACzD,QAAM,UAAU,SAAS,oBAAoB,KAAK,KAAK,cAAc;AACrE,QAAM,mBAAmB,QAAQ,QAAQ,sBAAsB,KAAK,CAAC;AACrE,QAAM,WACH,SAAS,sBAAsB,KAAK,QAAQ,UAAU,MACvD,QAAQ,OAAO,KACf;AAEF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AJFA,IAAM,sBAAsB;AAE5B,SAAS,cAAc,GAAqB;AAC1C,SAAO;AAAA,IACL,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE,mBAAmB,IAAI,IAAI;AAAA,IAC7C,kBAAkB,EAAE;AAAA,IACpB,sBAAsB,EAAE;AAAA,IACxB,mBAAmB,EAAE;AAAA,IACrB,mBAAmB,EAAE,sBAAsB,IAAI,IAAI;AAAA,IACnD,oBAAoB,EAAE;AAAA,IACtB,sBAAsB,EAAE;AAAA,IACxB,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,EAChB;AACF;AAEA,IAAM,uBAAuB,MAAM,YAAkC;AACnE,QAAM,MAAM,MAAM,YAAY,EAAE;AAAA,IAC9B;AAAA;AAAA;AAAA;AAAA,EAIF,EAAE,MAAW;AACb,MAAI,CAAC,KAAK;AAER,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,gBAAgB;AAAA,MAChB,kBAAkB;AAAA,MAClB,sBAAsB;AAAA,MACtB,mBAAmB;AAAA,MACnB,mBAAmB;AAAA,MACnB,oBAAoB;AAAA,MACpB,sBAAsB;AAAA,MACtB,aAAa;AAAA,MACb,YAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,cAAc,GAAG;AAC1B,CAAC;AAED,eAAsB,iBAAuC;AAC3D,SAAO,qBAAqB;AAC9B;AAGA,eAAsB,2BAInB;AACD,MAAI;AACF,UAAM,IAAI,MAAM,eAAe;AAC/B,WAAO,2BAA2B,GAAG,SAAS;AAAA,EAChD,SAAS,OAAO;AACd,QAAI,mBAAmB,KAAK,GAAG;AAC7B,cAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AACA,aAAO,EAAE,GAAG,gCAAgC;AAAA,IAC9C;AACA,UAAM;AAAA,EACR;AACF;;;AKrGA,IAAM,iBACJ;AASF,eAAsB,4BAAoE;AACxF,QAAM,MAAM,MAAM,yBAAyB;AAC3C,QAAM,YAAY,UAAU,sBAAsB,KAAK;AACvD,MAAI,CAAC,IAAI,WAAW,CAAC,IAAI,WAAW,CAAC,UAAW,QAAO;AACvD,SAAO,EAAE,SAAS,MAAM,SAAS,IAAI,SAAS,UAAU;AAC1D;AAOA,eAAsB,qBACpB,OACA,UACwD;AACxD,QAAM,SAAS,MAAM,0BAA0B;AAC/C,MAAI,CAAC,QAAQ;AAEX,YAAQ,MAAM,4CAA4C;AAAA,MACxD,aAAa,MAAM;AAAA,MACnB,iBAAiB,QAAQ,QAAQ;AAAA,IACnC,CAAC;AAED,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AAEA,MAAI,CAAC,OAAO;AAEV,YAAQ,MAAM,mCAAmC;AAAA,MAC/C,eAAe,OAAO,QAAQ,MAAM,EAAE;AAAA,MACtC,iBAAiB,QAAQ,QAAQ;AAAA,IACnC,CAAC;AAED,WAAO,EAAE,IAAI,OAAO,OAAO,CAAC,wBAAwB,EAAE;AAAA,EACxD;AAEA,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,UAAU,OAAO,SAAS;AACnC,OAAK,IAAI,YAAY,KAAK;AAC1B,MAAI,SAAU,MAAK,IAAI,YAAY,QAAQ;AAE3C,QAAM,MAAM,MAAM,MAAM,gBAAgB;AAAA,IACtC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AAEX,YAAQ,MAAM,2CAA2C;AAAA,MACvD,eAAe,OAAO,QAAQ,MAAM,EAAE;AAAA,MACtC,aAAa,MAAM;AAAA,MACnB,QAAQ,IAAI;AAAA,IACd,CAAC;AAED,WAAO,EAAE,IAAI,OAAO,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,EAAE;AAAA,EACpD;AAEA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,KAAK,QAAS,QAAO,EAAE,IAAI,KAAK;AAEpC,UAAQ,MAAM,uCAAuC;AAAA,IACnD,eAAe,OAAO,QAAQ,MAAM,EAAE;AAAA,IACtC,aAAa,MAAM;AAAA,IACnB,OAAO,KAAK,aAAa,KAAK,CAAC,qBAAqB;AAAA,EACtD,CAAC;AAED,SAAO,EAAE,IAAI,OAAO,OAAO,KAAK,aAAa,KAAK,CAAC,qBAAqB,EAAE;AAC5E;AAEA,eAAsB,wBACpB,UACA,UACuC;AACvC,QAAM,QAAQ,OAAO,SAAS,IAAI,uBAAuB,KAAK,EAAE,EAAE,KAAK;AAEvE,UAAQ,MAAM,qCAAqC;AAAA,IACjD,aAAa,MAAM;AAAA,IACnB,iBAAiB,QAAQ,QAAQ;AAAA,EACnC,CAAC;AAED,QAAM,SAAS,MAAM,qBAAqB,OAAO,QAAQ;AACzD,SAAO,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,MAAM;AAChD;","names":["cache","env","options","getRuntimePlatform"]}

package/dist/auth/user-session.d.ts

@@ -0,0 +1,42 @@
+export { getDatabase } from '../platform/current.js';
+import { SessionUser } from './session.js';
+import '../platform/runtime.js';
+import '../env-C5qu-0R-.js';
+import '../platform/selection.js';
+
+/** Cookie name holding the OAuth (Google) user session. */
+declare const USER_COOKIE = "vinext_user_session";
+/** Cookie name holding the admin-password session. */
+declare const ADMIN_COOKIE = "vinext_admin_session";
+/** 给 OAuth 用户发 token：HMAC 签名 + base64-encoded JSON payload */
+declare function signUserToken(user: SessionUser): Promise<string>;
+declare function setUserSessionCookie(user: SessionUser): Promise<void>;
+/** 校验用户 session token：签名、过期、session_rev 是否与数据库一致 */
+declare function verifyUserToken(token: string | undefined): Promise<SessionUser | null>;
+/** 当前 OAuth 用户（如果登录了），admin 密码登录时返 null */
+declare function getCurrentUser(): Promise<SessionUser | null>;
+declare function clearUserSessionCookie(): Promise<void>;
+declare function checkPassword(input: string): Promise<boolean>;
+declare function setSessionCookie(): Promise<void>;
+declare function clearSessionCookie(): Promise<void>;
+type AuthViewer = {
+    email: string;
+    user: SessionUser | null;
+    role: "user" | "vip" | "admin";
+    isAdmin: boolean;
+    isVip: boolean;
+    canViewVipContent: boolean;
+};
+/**
+ * Combined viewer: returns an `AuthViewer` for the current request
+ * regardless of which login method (admin password vs OAuth) the
+ * user used. `null` means the request is unauthenticated.
+ */
+declare function getAuthViewer(): Promise<AuthViewer | null>;
+/**
+ * Extended isAuthenticated: admin password login or OAuth login both
+ * count as authenticated.
+ */
+declare function isAuthenticated(): Promise<boolean>;
+
+export { ADMIN_COOKIE, type AuthViewer, USER_COOKIE, checkPassword, clearSessionCookie, clearUserSessionCookie, getAuthViewer, getCurrentUser, isAuthenticated, setSessionCookie, setUserSessionCookie, signUserToken, verifyUserToken };