@tryvitris/website-harness 0.0.0-stage → 0.1.0-beta.5

package/docs/ENGINE.md

@@ -0,0 +1,28 @@
+# Engine API and local refinement
+
+Install an exact `@tryvitris/website-harness` dependency in each website. `@tryvitris/website-harness/contracts` is browser-safe validation; `@tryvitris/website-harness/engine` executes Node filesystem operations. Legacy `@tryvitris/website-harness/cli/api` exports remain available.
+
+```js
+import { inspectSite, prepareChange, applyOperations, buildSiteDraft, verifyChange } from "@tryvitris/website-harness/engine";
+const site = inspectSite(process.cwd());
+const request = { schemaVersion: 1, id: "headline-1", instruction: "Update the headline", origin: "operator",
+  baseRevision: site.revision.digest, requestedScopes: ["copy"], explicitPreferences: [], evidence: [] };
+const plan = { schemaVersion: 1, requestId: request.id, baseRevision: site.revision.digest,
+  targets: ["/#headline"], files: ["pages/index.html"], facets: ["copy"], preserve: [],
+  acceptanceCriteria: [{ id: "headline", kind: "exact_text", target: "/#headline", expected: "New headline" }],
+  requiredChecks: ["render-375", "render-1080"], assumptions: [], evidence: [], proposedBy: "active_agent" };
+prepareChange(process.cwd(), request, plan);
+applyOperations(process.cwd(), request.id, [{ kind: "set_text", file: "pages/index.html", elementId: "headline", text: "New headline" }]);
+await buildSiteDraft(process.cwd());
+const result = await verifyChange(process.cwd(), request.id);
+```
+
+Plans are validated at runtime and must name files, targets, all requested facets, acceptance assertions, and checks. The source revision hashes current authored bytes, including uncommitted edits. Preparation and source operations use the existing mutation lock. A stale plan or editor save conflicts; the caller must inspect again. Replaying the same request and operation payload is idempotent. Source operations currently support a single text, local image, declared theme-token, or adjacent declared section move per save. Image replacement requires one usable inventory identity with source evidence and a SHA-256 matching the local file. Mark editable HTML with `data-vitris-field`, and movable sections with `data-vitris-movable` and a stable `id`. Optional component `edit.schema.json` files declare shared fields. Custom markup remains editable by the agent.
+
+Structured preservation preferences are authoritative when supplied. A preservation target must name a unique authored `route#field` and is compared against its preparation snapshot; every plan preservation statement must match an explicit preserve preference. Exact copy plans allow only text changes at named fields within their planned files. Required checks are currently `build`, `render-375`, and `render-1080`; an unknown mandatory check is rejected during preparation. Verification records each required check, and accepts memory only after a final locked source and built-artifact comparison. A concurrent edit leaves the candidate unaccepted.
+
+`vitris refine prepare --request "..." --plan plan.json --site .` uses the structured path; `vitris refine verify --request-id ID --site .` returns separate technical, fulfillment, and design results. Legacy unplanned requests remain supported through a compatibility path, but its keyword fulfillment is not a reliable visual or semantic judgment. Visual and semantic plan criteria require revision-bound outcome findings. A passing technical build is not human approval. Failed verification leaves the draft and diagnostics in place and does not accept planned memory.
+
+For a failed or abandoned candidate, `discardChange(siteRoot, requestId, candidateRevision)` restores the planned source files captured at preparation. It requires the exact current candidate revision and rejects unplanned edits or a verified accepted result. A later edit must be inspected and replanned rather than overwritten.
+
+The local editor example is at `examples/local-editor/`. It presents a preview, selected field, save, rebuild, and verification status. It does not publish.

package/docs/PRESERVE.md

@@ -0,0 +1,59 @@
+# Preserve an existing Vitris website
+
+Use `--mode preserve` to create a custom copy of a legacy Vitris client-facing site, retaining its HTML, CSS, assets, copy, routes, and supported interactions. The default remains `--mode redesign`. Preserve mode does not apply a theme or run the creative workflow.
+
+```bash
+vitris site create --dir ../acme --slug acme-preserve \
+  --name "Acme Construction" \
+  --from https://old-site.example/ --mode preserve
+cd ../acme
+npm install
+npx playwright install chromium
+npm run go
+npm run preview
+npm run deploy
+```
+
+The legacy `vitris-create-site` entry point accepts the same mode. With a local harness checkout, supply `--harness file:../vitris-harness` when creating a sibling site. `vitris run --site DIR`, `vitris verify --site DIR`, and `vitris deploy --site DIR --environment preview` are also supported.
+
+Capture runs once. It follows same-origin links and legacy Vitris navigation data, including hidden navigation entries. The original renderer executes only during capture; its scripts, analytics, and services are removed from the copy. Assets are copied locally, including CSS imports, fonts, backgrounds, gallery images, and linked downloads. URL queries distinguish asset variants. A small local runtime supplies supported menu, gallery, mobile footer spacing, and form interactions.
+
+Authored output lives in `preserved/`, which builds directly without the usual site wrapper or design CSS. References and capture provenance live under `onboarding/`. The existing managed agent kit is retained; preservation dispatch does not modify or execute its creative graph. A later redesign should be scaffolded separately so the preserved site remains available.
+
+Verification compares every captured route at 1440px and 390px against hashed source screenshots. Dimensions must match; the pixel difference limit is 0.5%, with a 24-channel-value noise tolerance. These are measured visual checks, not a promise of exact equivalence across every browser and state. Verification also checks local links, anchors, images, menus, gallery opening/closing, and form feedback, with external resource requests blocked. Failed checks stop deployment. Inspect `agent/reviews/preserve.json` and screenshots in `artifacts/preserve-verification/`; repair `preserved/` and rerun. Never edit reference captures to make a check pass.
+
+Contact forms use the shared `/api/leads` service only after explicit server registration and public `launch.json.forms` bindings. `backendOrigin` alone does not enable submissions or notifications. The old `number` field maps to the compatible phone column while retaining its authored HTML name. Default previews validate locally and display a notice. The shared runtime adds a security challenge on submission and accessible feedback while preserving layouts and fields. Verification separates resting-page fidelity from mocked challenge/submission states and sends no customer inquiries. See [CONTACT-FORMS.md](CONTACT-FORMS.md) for sandbox setup, provisioning, server readiness, delivery semantics and the separately authorized rollout. Legacy analytics and employee portal services are not migrated. External navigation links, including employee-login links, remain links to their existing destinations.
+
+Deployment requires `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN` with Pages Edit permission. The harness inspects or creates the Pages project, verifies that the preview branch differs from its production branch, stages hashed verified bytes, uploads them, and repeats browser checks against the returned `pages.dev` URL. A newly created project uses `production` as its reserved production branch. No customer domains or DNS records are changed. Preview responses carry `noindex`; previews are public and do not expire automatically. The generated CI workflow is manual and preview-only.
+
+Initial availability checks retry transient hosting failures. If Cloudflare has accepted the upload but its preview is not reachable yet, keep the returned URL and recheck it with `vitris verify --site DIR --remote https://HASH.PROJECT.pages.dev`. This reruns the hosted browser checks without uploading another deployment. Local and remote reports are separate.
+
+The adapters target legacy Vitris v1 pages using navbar, header, photo gallery, cards, info, contact form, footer and static HTML components, and legacy Vitris React SSR pages using call-to-action, contact-form, HTML and branded-footer blocks. React navigation is discovered from its JSON state, including nested and hidden entries. The existing React mobile navbar and contact-form markup use the local preview runtime. Public route segments ending in a period use confined hashed files and explicit Cloudflare 200 rewrites so Windows storage does not change the public URL. Unsupported components, embedded applications, query-dependent pages, asset failures, and visual differences require an adapter or a repair; they are not silently accepted. Arbitrary external websites, authenticated content, checkout, booking, and backend migration are not supported. Pages absent from both navigation and discovered links cannot be inferred from a public URL.
+
+For an inventory audit, the source API `capturePreservedSite(root, { diagnostic: true })` can retain independent static capture work when a component or embed is unsupported. It records `onboarding/preserve.json.blockers`; verification and release preparation fail while any blocker remains, even when resting-page pixels match. The ordinary CLI capture still rejects unsupported content. Diagnostic mode does not authorize publication or imply functional parity. Keep the original capture, rendered HTML and hashed references; repair authored source and use new evidence for any later adapter review. Run the targeted preservation regressions with `node --experimental-strip-types --test src/preserve.test.ts src/preserve-batch.test.ts`.
+
+Existing public Google Maps `/maps/embed` and YouTube `/embed/VIDEO_ID` frames can be retained as read-only provider dependencies. These embedded applications are not downloaded or replaced. Their provider content, availability and privacy behavior remain external and must be listed in the preview exceptions. The top-level site's scripts, images, fonts and connections stay local; CSP `frame-src` adds only the exact required provider origins. Verification admits provider resources only within a descendant of an approved embed, while unrelated top-level requests and legacy Vitris service calls remain failures. Booking, checkout and embedded form applications remain unsupported. Historical diagnostic blockers for a now-supported static React HTML block or an approved read-only embed are resolved by the current adapter without editing the immutable capture manifest; other blockers still stop release.
+
+Diagnostic capture also records unavailable navigation targets and missing assets while continuing through other public pages. A missing authored asset is explicitly an empty placeholder with a release blocker; its original failed response is retained as evidence. This never counts as successful asset preservation. Every served asset and download is checked byte-for-byte against the authored build locally and remotely, and retained original asset responses are checked against their capture hashes. Hosted checks also require noindex and the preservation CSP.
+
+Static v1 blog feeds and iframe/map wrappers are supported only when their original rendered DOM has no active search, pagination or unknown callbacks. Accordions use the existing collapse markup and are exercised during verification. React galleries are the original static `portfolio-grid` image layout; the legacy Gallery renderer has no lightbox interaction. Navbar dropdowns retain the legacy click behavior. Windows case-distinct routes use separate hashed files when their ordinary folders would collide. Dotted page slugs are routes; recognized document/media suffixes identify downloadable files.
+
+Capture blocks legacy Matomo and Google Analytics requests, while leaving the original visual renderer and provider frames active. Original rendered HTML, screenshots and source asset bytes remain immutable. The browser verifier checks horizontal overflow against the original reference and reports existing source overflow without redesigning it. A narrowly identified YouTube compute-pressure permission denial is reported as a provider warning; other browser errors and failed resources remain failures. Run `npm run test:preserve` for the adapter and preview-release regressions.
+
+Button hover colors are measured on the original without clicking or submitting it. Authored `data-preserve-hover` metadata replays those observed color/background/border states through the local runtime and restores the original resting style. Hover evidence is stored beside new captures; older captures can be repaired using separate immutable interaction evidence without replacing their screenshots. Verification exercises these hover states at both viewport widths. The pointer is parked outside the viewport before resting screenshots. Application scripts such as accessibility widgets, financing calculators and property searches are explicit release blockers until adapted; removing a script cannot silently count as functional preservation. Opaque read-only Maps query values retain their original request data and still must pass the visual/browser gates.
+
+After explicit operator authorization, a temporary React preview can set `launch.json.previewDisabledTransactions: true`. This supports the known captured calendar and single-page custom intake form markup only after authored controls are adapted and the verifier proves their original block/field structure. Booking dates and month controls display a disabled notice; they do not fetch current availability or book appointments. Custom forms retain fields and local file selection, but never upload, route to the shared contact service, or claim delivery. Checkout and Add To Cart controls display a disabled notice rather than creating orders or payments. These are documented functional differences, not full transaction parity. Without this explicit preview mode, transaction capture blockers still fail release. Static React blog and collection blocks require proof that their original markup contains no active search, pagination, form or other unsupported controls.
+
+Adapted product carousels retain the original slide markup, transforms and selection state. Captured product variant states retain the original price/quantity controls and use the same disabled purchase notice. Verification exercises selections, images, keyboard navigation and disabled transaction feedback. Deferred React images use local bytes and the original renderer's 200px observer margin; references remain unchanged. Assets found during later inspection can be registered in immutable `onboarding/preserve-supplement-TIMESTAMP/assets.json` files, listed by `onboarding/preserve-supplements.json`. Supplements must match the original source URL/capture timestamp and cannot replace any original asset record. Their raw bytes and hashes join local and hosted asset checks.
+
+Authorized disabled previews also support the known v1 service-list markup. Additional service cards are captured through read-only pagination, stored with immutable interaction evidence, and paged locally. Booking opens the original modal shell with a disabled notice. Unknown controls still block publication. Single-page custom forms retain the exact original fields, including local attachment selection, without uploads or delivery.
+
+Original defects remain explicit exceptions. The verifier can distinguish an anchor already missing in both the original link and the original target from a newly broken authored anchor. Proven `/null` image placeholders and the unavailable legacy 404 illustration retain their original broken-image rendering; they are never described as preserved photographs or successful source assets. Malformed telephone and relative Google Maps links can be repaired only to their original intended external destinations. All visual and browser gates still apply.
+
+Newly discovered routes can join the immutable supplement index without replacing any captured route or reference. `capturePreservedSite` accepts an explicit `onlyPaths` list for supplemental capture. Diagnostic `includeSourceErrors` requires that list and retains original HTTP/soft-404 pages with hashed raw response evidence. The preview serves this static error content with HTTP 200, an explicitly reported HTTP-status difference; absent business content is not invented. A supplemental error page must pass the same desktop/mobile comparisons and interaction checks before the corresponding old diagnostic blocker can be resolved. Supplements retain their own blockers and warnings.
+
+The existing MassageBook `/therapists/SLUG/widget/reviews` endpoint can remain an external read-only reviews dependency. Booking widget paths, query variants and unrelated origins are excluded. This exception does not enable embedded booking or customer submissions; provider availability, scripts and privacy behavior remain external limitations.
+
+The browser verifier distinguishes only the known cancelled Google `/measurement/conversion` telemetry request originating inside the approved MassageBook reviews frame from a functional resource failure. It reports that cancellation as an external-provider privacy warning. Other endpoints, top-level tracking, connection failures, review assets and visual differences remain failures. Dynamically paged service cards rebind measured hover states and are exercised after pagination, including disabled booking feedback.
+
+Earlier screenshot-only captures remain verifiable without recapturing or altering their baselines. Missing original DOM evidence grants no source-defect or component exception: authored links, resources, visual comparisons and browser gates still apply. Supplemental source-error exceptions require the original rendered DOM and hashed raw response evidence.

package/docs/SECURITY.md

@@ -0,0 +1,23 @@
+# Release and credential safety
+
+## Optional backend authentication and previews
+
+Production sign-in requires HTTPS, a 32+ character SESSION_SECRET and configured Gmail service-account or Resend delivery. Missing or failed delivery never displays or logs authentication tokens. Known and unknown emails receive the same normal login response. D1 enforces per-email and per-source login limits. Demo seeding and direct development login require explicit DEV_LOGIN on a local request.
+
+Apply migrations through `0005_auth.sql` before upgrading a backend. Sessions and hashed magic links now live in primary D1 storage. Link redemption uses an atomic DELETE RETURNING; logout deletes the server session and requires a same-origin POST. Production uses host-only `__Host-` cookies with Secure, HttpOnly and SameSite=Lax. Old KV sessions and links are not migrated; sign in again after upgrading. The scheduled handler prunes expired authentication rows.
+
+Customer HTML never renders on an admin origin. Configure a dedicated PREVIEW_HOST_SUFFIX routed to the Worker. Each tenant receives its own hostname and host-only preview cookie. An authenticated owner or operator can create a signed, tenant/branch/host-scoped handoff lasting at most 15 minutes. Every request checks the backing D1 session, so logout also revokes previews. Preview hosts expose no admin routes or APIs; customer service workers and embedding are disabled. Handoff responses remove the bearer URL before rendering and send no-store/no-referrer headers. Keep the preview domain separate from admin hosts and do not route unrelated applications under it. Public R2 asset routes do not expose cached repository bundles or active documents.
+
+## Package auditing
+
+The npm beta uses an explicit file allowlist. Local credentials, operator configuration, customer captures, tests, historical archives, plans and runtime receipts are excluded. esbuild receives no secret-valued environment definitions. Integrations read the installing user's environment or Worker secret bindings.
+
+`npm pack` builds and runs audit:package. The audit opens the actual tarball, checks every filename, detects common provider tokens/private keys/credential URLs, rejects known operator infrastructure IDs, and compares bytes against credential values available in the process environment and local credential files, including encoded forms. Reports contain file locations and rule names, never matched values. Exact-value checking covers only credentials accessible to the process; it cannot establish the absence of unknown keys.
+
+Install a verified Gitleaks release binary and set GITLEAKS_BIN to its executable before `npm run audit:package`. This independent detection layer is required by release CI. Use full redaction and archive/decoding inspection. Re-audit after any source, build, dependency or content change. Keep the final tarball SHA-256 and audit report privately under artifacts/.
+
+The prepublishOnly guard verifies the public @tryvitris/website-harness identity, registry, visibility, prerelease tag, and packed-release audit. No workflow publishes packages. Releases require owner authorization and verification of the final source and tarball. Prefer npm trusted publishing for automated releases; interactive local releases use the maintainer's npm login and 2FA.
+
+Before making a repository public, separately scan all Git history and uncommitted public source. A clean npm package does not make existing history safe. Historical archives and customer experiments stay private. Never rewrite frozen baselines to remove findings. Revoke/rotate any real disclosed credential with its provider and address repository history separately.
+
+Report vulnerabilities privately to the repository owner using GitHub private vulnerability reporting when enabled. Do not include credentials, customer data or exploit details in public issues.

package/docs/STOCK-MEDIA.md

@@ -0,0 +1,66 @@
+# Stock and customer media
+
+The v2 catalog is `src/stock/catalog.json`. It contains immutable hashes, provider/source URLs, dimensions, credits, initial visual observations, and design facets. Existing IDs are preserved; legacy URLs remain recorded. New binary work lives under `artifacts/stock/`, and the local content-addressed cache is `artifacts/stock-library/`. Scratch history is unchanged and is not required by tests.
+
+The September 23 expansion targets trades/home services and professional services. It adds 23 accepted photographs and 3 accepted videos. The library has 69 accepted photos and 8 accepted videos. Two additional candidates are excluded: a named third-party company's group portrait and a desk clip focused on eating. Catalog acceptance is Codex curation, not a human preference label. Video observations are three timestamped samples, not claims about audio or seamless looping.
+
+## Find and use media
+
+```text
+npm run stock -- search --query "electrical repair" --industry trades --role detail
+npm run stock -- search --industry professional-services --kind video
+npm run stock -- import --site SITE --id ASSET_ID --reason "Illustrates the service; not the actual customer team" --route /
+```
+
+Import during the site's media stage. The importer validates original/poster hashes, writes local `media/stock/` files and adds inventory source mappings. For a recovered customer original already saved under `media/recovered/`, run `npm.cmd run media:register -- media/recovered/FILE --source CAPTURED_SOURCE --disposition use|retain` from the site on Windows (`npm run` elsewhere). The installed media tool computes its SHA-256 and rejects conflicting re-registration. A recovered video also needs `--poster media/recovered/POSTER`. Registration leaves visual inspection and identity evidence to the author. If the stock cache is absent, imports try the managed server (`--origin`, VITRIS_STOCK_ORIGIN, or the site launch backendOrigin), including the recorded legacy original URL, then provider URLs. Every response must match its pinned hash. Older provider URLs can return changed bytes; restore the managed cache instead of silently accepting a new image. This preserves local previews without relying on an available Worker. No third-party assets are silently published by import.
+
+The media agent first accounts for logos, founders, team, actual products/premises/projects and brand artwork. Identity roles need captured source-page evidence. A third-party stock photograph must not be relabeled as the customer founder, staff or portfolio. Omitted identity assets need a reason. Original media stays immutable; crops are separate derivatives.
+
+`onboarding/media-requests.json` contains a `slots` array:
+
+```json
+{"slots":[{"id":"home-service","route":"/","purpose":"Explain repair work","kind":"image","minWidth":1000},{"id":"about-founder","route":"/about","purpose":"Meet our founder","identity":"founder"}]}
+```
+
+During storyboard, write `onboarding/media-selection.json` with `version:1` and `placements` containing each slot, `assetId`, `reason` and optional `crop`. A row may instead have `noMatch:true` and a reason. The selection command validates a draft:
+
+```text
+npm run stock -- select --site SITE --file SELECTION_JSON
+```
+
+Final reviews check selected asset hashes, posters, identity dispositions and presence on the rendered route. Browser checks verify loaded images, video posters, missing/error sources, muted autoplay, and stopped playback under reduced motion. The agent still inspects responsive crops, logo treatment, video playback and reduced-motion fallback.
+
+## Jev assistance
+
+The explicit `--design-assist` preset now enables all four media capabilities unless individually set off. They remain off in the ordinary baseline. Enable independently in site `agent/jev.json`:
+
+```json
+{"mode":"assist","capabilities":{"mediaClassification":"assist","mediaSelection":"assist","mediaSetReview":"assist","mediaProvenance":"assist"},"pilotBudget":{"maxTransportAttempts":30,"maxInputTokens":100000}}
+```
+
+This example explicitly opts into live calls when credentials are configured. A live monetary budget has not been set for this upgrade; its verification uses mock transports. Request/token limits do not guarantee a dollar cap.
+
+- Media classification normalizes inspected text into role/industry suggestions during media.
+- Section ranking runs in direction/storyboard using explicit media requests and eligible site assets, with separate subject, composition and style scores.
+- Set review runs at representative/visual review.
+- Provenance review runs at representative/content review.
+
+All are advisory, uncalibrated, and based on supplied text observations. They do not identify people or inspect pixels. Deterministic identity/availability/size checks run before ranking. Requests are bounded to 8 slots and 8 candidates per slot; classification handles at most 12 inspected candidates. Partial scores preserve the deterministic shortlist; no-match is distinct from unavailable inference. Reports in `agent/runs/PREPARATION.media-assist.json` bind the result to preparation/subject hashes and link provider receipts. Cache identity includes observations, context, rubric/policy and model. Global off and shadow preserve their existing semantics.
+
+## Expand and publish
+
+```text
+npm run stock -- stage --out artifacts/stock/NEW_SESSION
+python scripts/inspect-stock.py --catalog artifacts/stock/NEW_SESSION/catalog.json --root artifacts/stock/NEW_SESSION --out artifacts/stock/NEW_INSPECTION
+```
+
+Staging uses the coverage queries in `src/stock/coverage.json` and requires PEXELS_API_KEY. It downloads multiple candidates and never publishes. Inspection tooling requires Pillow and imageio-ffmpeg; the runtime, package and test suite do not require Python. It measures files, samples video frames, and flags perceptual near-duplicates without deleting anything. Write inspection annotations with evidence and exclusions, then use `scripts/migrate-stock.ts --spec SPEC --cache CACHE --out NEW_CATALOG` to generate an accepted catalog. Validate before replacing the source catalog, and run `npm run catalog` to refresh the embedded picker/catalog.
+
+```text
+npm run stock -- verify
+npm run stock -- publish --out artifacts/stock/NEW_PUBLICATION
+```
+
+Publication is a separate explicit command using configured Cloudflare credentials. It uploads verified accepted objects before replacing the remote catalog pointer, preserves old keys, and records success/failure. The September 23 upgrade has not run this publication command. The Worker picker prefers the published catalog and uses its embedded version offline.
+
+Before a live comparison, freeze a new harness baseline and pin the same catalog/captures in both arms. Compare deterministic selection with Jev assistance, measuring identity retention, fit, overrides, no-match behavior, repetition, operator time and cost coverage. Human preference labels remain absent until supplied by humans.

package/licenses/blake3-wasm-LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 Connor Peet
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/licenses/entities-LICENSE

@@ -0,0 +1,11 @@
+Copyright (c) Felix Böhm
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS,
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/licenses/parse5-LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2013-2019 Ivan Nikulin (ifaaan@gmail.com, https://github.com/inikulin)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/migrations/0001_init.sql

@@ -0,0 +1,90 @@
+CREATE TABLE IF NOT EXISTS tenants (
+  id TEXT PRIMARY KEY,
+  slug TEXT NOT NULL UNIQUE,
+  name TEXT NOT NULL,
+  pages_project TEXT,
+  kernel_version TEXT,
+  content_version INTEGER NOT NULL DEFAULT 1,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS hostnames (
+  hostname TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL REFERENCES tenants(id),
+  kind TEXT NOT NULL DEFAULT 'pages',
+  pages_domain_status TEXT
+);
+
+CREATE TABLE IF NOT EXISTS users (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL UNIQUE,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS memberships (
+  user_id TEXT NOT NULL REFERENCES users(id),
+  tenant_id TEXT NOT NULL REFERENCES tenants(id),
+  role TEXT NOT NULL DEFAULT 'owner',
+  PRIMARY KEY (user_id, tenant_id)
+);
+
+CREATE TABLE IF NOT EXISTS content (
+  tenant_id TEXT PRIMARY KEY REFERENCES tenants(id),
+  json TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS theme (
+  tenant_id TEXT PRIMARY KEY REFERENCES tenants(id),
+  json TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS site_config (
+  tenant_id TEXT PRIMARY KEY REFERENCES tenants(id),
+  json TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS media (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL REFERENCES tenants(id),
+  r2_key TEXT NOT NULL,
+  alt TEXT,
+  content_type TEXT
+);
+
+CREATE TABLE IF NOT EXISTS leads (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL REFERENCES tenants(id),
+  name TEXT NOT NULL DEFAULT '',
+  email TEXT NOT NULL DEFAULT '',
+  phone TEXT NOT NULL DEFAULT '',
+  message TEXT NOT NULL DEFAULT '',
+  page_path TEXT,
+  status TEXT NOT NULL DEFAULT 'new',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS leads_tenant_created ON leads(tenant_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS analytics_events (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  path TEXT NOT NULL,
+  referrer TEXT,
+  vid TEXT,
+  day TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS analytics_events_tenant_day ON analytics_events(tenant_id, day);
+
+CREATE TABLE IF NOT EXISTS analytics_daily (
+  tenant_id TEXT NOT NULL,
+  day TEXT NOT NULL,
+  pageviews INTEGER NOT NULL DEFAULT 0,
+  uniques INTEGER NOT NULL DEFAULT 0,
+  leads INTEGER NOT NULL DEFAULT 0,
+  top_paths_json TEXT NOT NULL DEFAULT '[]',
+  top_refs_json TEXT NOT NULL DEFAULT '[]',
+  PRIMARY KEY (tenant_id, day)
+);

package/migrations/0002_analytics.sql

@@ -0,0 +1,50 @@
+-- First-party analytics: event dimensions, presence, richer daily rollups
+
+ALTER TABLE analytics_events ADD COLUMN kind TEXT NOT NULL DEFAULT 'pageview';
+ALTER TABLE analytics_events ADD COLUMN sid TEXT;
+ALTER TABLE analytics_events ADD COLUMN channel TEXT;
+ALTER TABLE analytics_events ADD COLUMN device TEXT;
+ALTER TABLE analytics_events ADD COLUMN hour INTEGER;
+ALTER TABLE analytics_events ADD COLUMN duration_ms INTEGER;
+ALTER TABLE analytics_events ADD COLUMN scroll_pct INTEGER;
+ALTER TABLE analytics_events ADD COLUMN goal TEXT;
+ALTER TABLE analytics_events ADD COLUMN action TEXT;
+ALTER TABLE analytics_events ADD COLUMN label TEXT;
+ALTER TABLE analytics_events ADD COLUMN src TEXT NOT NULL DEFAULT 'live';
+
+CREATE INDEX IF NOT EXISTS analytics_events_tenant_day_kind ON analytics_events(tenant_id, day, kind);
+CREATE INDEX IF NOT EXISTS analytics_events_tenant_sid ON analytics_events(tenant_id, sid);
+
+CREATE TABLE IF NOT EXISTS analytics_presence (
+  tenant_id TEXT NOT NULL,
+  vid TEXT NOT NULL,
+  path TEXT NOT NULL DEFAULT '/',
+  seen_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (tenant_id, vid)
+);
+
+CREATE INDEX IF NOT EXISTS analytics_presence_seen ON analytics_presence(seen_at);
+
+ALTER TABLE analytics_daily ADD COLUMN sessions INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN bounces INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN engaged INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN duration_ms INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN leave_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN scroll_25 INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN scroll_50 INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN scroll_75 INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN scroll_100 INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN converts_form INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN converts_tel INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN converts_mailto INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN converts_maps INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN engage_nav INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN engage_btn INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN engage_img INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN engage_carousel INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE analytics_daily ADD COLUMN channels_json TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE analytics_daily ADD COLUMN devices_json TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE analytics_daily ADD COLUMN hours_json TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE analytics_daily ADD COLUMN top_engage_json TEXT NOT NULL DEFAULT '[]';
+
+ALTER TABLE leads ADD COLUMN vid TEXT;

package/migrations/0003_site_updates.sql

@@ -0,0 +1,29 @@
+-- GitHub repo metadata for git-as-SoT site updates
+ALTER TABLE tenants ADD COLUMN github_owner TEXT;
+ALTER TABLE tenants ADD COLUMN github_repo TEXT;
+
+-- Optional extra senders who can request updates without a full membership login
+CREATE TABLE IF NOT EXISTS sender_allowlist (
+  tenant_id TEXT NOT NULL REFERENCES tenants(id),
+  email TEXT NOT NULL,
+  PRIMARY KEY (tenant_id, email)
+);
+
+CREATE TABLE IF NOT EXISTS update_jobs (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL REFERENCES tenants(id),
+  workflow_instance_id TEXT,
+  sender_email TEXT NOT NULL,
+  prompt TEXT NOT NULL,
+  branch TEXT,
+  preview_url TEXT,
+  summary TEXT,
+  status TEXT NOT NULL DEFAULT 'queued',
+  media_r2_prefix TEXT,
+  error TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS update_jobs_tenant_created ON update_jobs(tenant_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS update_jobs_status ON update_jobs(status);

package/migrations/0004_contact_forms.sql

@@ -0,0 +1,75 @@
+-- Additive: old leads remain untouched; no legacy form is implicitly enabled.
+CREATE TABLE contact_forms (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL REFERENCES tenants(id),
+  config_json TEXT NOT NULL CHECK(json_valid(config_json)),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE(tenant_id, id)
+);
+CREATE TABLE form_origins (
+  origin TEXT PRIMARY KEY,
+  hostname TEXT NOT NULL,
+  tenant_id TEXT NOT NULL REFERENCES tenants(id)
+);
+CREATE TABLE form_submissions (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  form_id TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  challenge_hash TEXT NOT NULL UNIQUE,
+  mode TEXT NOT NULL CHECK(mode IN ('test','live')),
+  fields_json TEXT NOT NULL,
+  schema_json TEXT NOT NULL,
+  name TEXT NOT NULL, email TEXT NOT NULL, phone TEXT NOT NULL, message TEXT NOT NULL,
+  page_path TEXT NOT NULL,
+  vid TEXT,
+  recipients_json TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE(tenant_id, form_id, idempotency_key),
+  FOREIGN KEY(tenant_id, form_id) REFERENCES contact_forms(tenant_id, id)
+);
+CREATE TABLE form_outbox (
+  id TEXT PRIMARY KEY REFERENCES form_submissions(id) ON DELETE CASCADE,
+  tenant_id TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending','processing','accepted','captured','failed')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_attempt INTEGER NOT NULL DEFAULT 0,
+  lease_until INTEGER NOT NULL DEFAULT 0,
+  claim TEXT,
+  provider_id TEXT,
+  last_error TEXT,
+  test_output TEXT,
+  accepted_at TEXT
+);
+CREATE INDEX form_outbox_due ON form_outbox(status, next_attempt, lease_until);
+CREATE TABLE form_rate_limits (key TEXT PRIMARY KEY, n INTEGER NOT NULL, expires INTEGER NOT NULL);
+CREATE TRIGGER form_origin_owner BEFORE UPDATE ON form_origins WHEN NEW.tenant_id != OLD.tenant_id BEGIN
+  SELECT RAISE(ABORT, 'Origin ownership conflict');
+END;
+CREATE TRIGGER contact_form_owner BEFORE UPDATE ON contact_forms WHEN NEW.tenant_id != OLD.tenant_id BEGIN
+  SELECT RAISE(ABORT, 'Form ownership conflict');
+END;
+CREATE TRIGGER contact_form_origins_insert BEFORE INSERT ON contact_forms
+  WHEN EXISTS(SELECT 1 FROM json_each(NEW.config_json, '$.origins') AS j
+    LEFT JOIN form_origins o ON o.origin=j.value
+    LEFT JOIN hostnames h ON h.hostname=o.hostname
+    WHERE o.tenant_id IS NULL OR o.tenant_id != NEW.tenant_id OR (h.tenant_id IS NOT NULL AND h.tenant_id != NEW.tenant_id))
+  BEGIN SELECT RAISE(ABORT, 'Origin ownership conflict');
+END;
+CREATE TRIGGER contact_form_origins_update BEFORE UPDATE ON contact_forms
+  WHEN EXISTS(SELECT 1 FROM json_each(NEW.config_json, '$.origins') AS j LEFT JOIN form_origins o ON o.origin=j.value LEFT JOIN hostnames h ON h.hostname=o.hostname
+    WHERE o.tenant_id IS NULL OR o.tenant_id != NEW.tenant_id OR (h.tenant_id IS NOT NULL AND h.tenant_id != NEW.tenant_id))
+  BEGIN SELECT RAISE(ABORT, 'Origin ownership conflict');
+END;
+CREATE TRIGGER form_accept AFTER INSERT ON form_submissions BEGIN
+  INSERT INTO form_outbox(id, tenant_id) VALUES(NEW.id, NEW.tenant_id);
+  INSERT INTO leads(id, tenant_id, name, email, phone, message, page_path, status, vid)
+    SELECT NEW.id, NEW.tenant_id, NEW.name, NEW.email, NEW.phone, NEW.message, NEW.page_path, 'new', NEW.vid WHERE NEW.mode = 'live';
+  INSERT INTO analytics_events(id, tenant_id, path, day, kind, goal, src, vid)
+    SELECT NEW.id, NEW.tenant_id, NEW.page_path, date('now'), 'convert', 'form', 'live', NEW.vid WHERE NEW.mode = 'live';
+END;
+-- Lead deletion also deletes its PII snapshot, idempotency receipt and notification.
+CREATE TRIGGER form_lead_delete AFTER DELETE ON leads BEGIN
+  DELETE FROM form_submissions WHERE id = OLD.id AND mode = 'live';
+END;

package/migrations/0005_auth.sql

@@ -0,0 +1,20 @@
+-- Authentication uses primary D1 statements, not eventually consistent KV.
+-- Old KV sessions and links are deliberately not accepted after this upgrade.
+CREATE TABLE IF NOT EXISTS auth_sessions (
+  id_hash TEXT PRIMARY KEY,
+  session_json TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS auth_sessions_expiry ON auth_sessions(expires_at);
+CREATE TABLE IF NOT EXISTS auth_magic_tokens (
+  token_hash TEXT PRIMARY KEY,
+  email TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS auth_magic_expiry ON auth_magic_tokens(expires_at);
+CREATE TABLE IF NOT EXISTS auth_rate_limits (
+  key TEXT PRIMARY KEY,
+  n INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS auth_rate_expiry ON auth_rate_limits(expires_at);