@twango/twiki 0.0.0-stage → 0.1.1

package/site/worker/content-runtime.ts

@@ -0,0 +1,226 @@
+export interface AssetBinding {
+	fetch(request: Request): Promise<Response>;
+}
+
+export interface ContentContext {
+	edition: 'public' | 'full';
+	snapshot: string;
+	applicationVersion: string;
+}
+
+export interface ContentDescriptor {
+	schemaVersion: 1;
+	applicationVersion: string;
+	snapshots: Record<ContentContext['edition'], string>;
+}
+
+export interface ContentRouting {
+	schemaVersion: 1;
+	routes: string[];
+	assets: Record<string, string>;
+	/** Producer hashes all HTML inputs for an exact route; omission uses the whole snapshot. */
+	htmlKeys?: Record<string, string>;
+}
+
+const digest = /^[a-f0-9]{64}$/;
+const routingCaches = new WeakMap<AssetBinding, Map<string, Promise<ContentRouting>>>();
+
+/** Internal content is accessible only through the trusted ASSETS binding. */
+export function isInternalContentPath(pathname: string) {
+	for (let attempt = 0; attempt < 4; attempt++) {
+		pathname = pathname.replace(/\/+/g, '/');
+		if (/^\/(?:_content|_published)(?:\/|$)/i.test(pathname)) return true;
+		const normalized = new URL(pathname, 'https://content.invalid').pathname;
+		if (/^\/(?:_content|_published)(?:\/|$)/i.test(normalized)) return true;
+		try {
+			const decoded = decodeURIComponent(pathname);
+			if (decoded === pathname) return false;
+			pathname = decoded;
+		} catch {
+			return true;
+		}
+	}
+	return true;
+}
+
+async function internalJson(binding: AssetBinding, origin: string, pathname: string) {
+	const response = await binding.fetch(new Request(new URL(pathname, origin)));
+	if (response.status !== 200) throw new Error('Content snapshot unavailable');
+	return response.json() as Promise<unknown>;
+}
+
+/** Re-read the small pointer: a new deployment cannot inherit an old isolate's pointer. */
+export async function contentDescriptor(
+	binding: AssetBinding,
+	origin: string
+): Promise<ContentDescriptor> {
+	const value = (await internalJson(
+		binding,
+		origin,
+		'/_content/current.json'
+	)) as Partial<ContentDescriptor> | null;
+	if (
+		!value ||
+		value.schemaVersion !== 1 ||
+		typeof value.applicationVersion !== 'string' ||
+		!digest.test(value.applicationVersion) ||
+		typeof value.snapshots?.public !== 'string' ||
+		!digest.test(value.snapshots.public) ||
+		typeof value.snapshots?.full !== 'string' ||
+		!digest.test(value.snapshots.full)
+	)
+		throw new Error('Invalid content snapshot descriptor');
+	return value as ContentDescriptor;
+}
+
+export function contentContext(
+	descriptor: ContentDescriptor,
+	edition: ContentContext['edition']
+): ContentContext {
+	return {
+		edition,
+		snapshot: descriptor.snapshots[edition],
+		applicationVersion: descriptor.applicationVersion
+	};
+}
+
+function safePath(value: unknown): value is string {
+	if (
+		typeof value !== 'string' ||
+		!value.startsWith('/') ||
+		value.startsWith('//') ||
+		value.includes('\\') ||
+		/[\u0000-\u0020?#]/.test(value)
+	)
+		return false;
+	const normalized = new URL(value, 'https://content.invalid');
+	return normalized.pathname === value;
+}
+
+export async function contentRouting(
+	binding: AssetBinding,
+	origin: string,
+	context: ContentContext
+): Promise<ContentRouting> {
+	let cache = routingCaches.get(binding);
+	if (!cache) routingCaches.set(binding, (cache = new Map()));
+	const key = `${context.edition}/${context.snapshot}`;
+	let result = cache.get(key);
+	if (!result) {
+		result = (async () => {
+			const value = (await internalJson(
+				binding,
+				origin,
+				`/_content/${key}/routing.json`
+			)) as Partial<ContentRouting> | null;
+			if (
+				!value ||
+				value.schemaVersion !== 1 ||
+				!Array.isArray(value.routes) ||
+				!value.routes.every((route) => safePath(route) && !isInternalContentPath(route)) ||
+				!value.assets ||
+				typeof value.assets !== 'object' ||
+				Array.isArray(value.assets) ||
+				!Object.entries(value.assets).every(
+					([route, target]) => safePath(route) && !isInternalContentPath(route) && safePath(target)
+				) ||
+				(value.htmlKeys !== undefined &&
+					(!value.htmlKeys ||
+						typeof value.htmlKeys !== 'object' ||
+						Array.isArray(value.htmlKeys) ||
+						!Object.entries(value.htmlKeys).every(
+							([route, hash]) =>
+								value.routes!.includes(route) && typeof hash === 'string' && digest.test(hash)
+						)))
+			)
+				throw new Error('Invalid content routing inventory');
+			return value as ContentRouting;
+		})();
+		cache.set(key, result);
+		// Immutable snapshots can be memoized, but keep old deployments bounded.
+		if (cache.size > 4) cache.delete(cache.keys().next().value!);
+		result.catch(() => {
+			if (cache!.get(key) === result) cache!.delete(key);
+		});
+	}
+	return result;
+}
+
+export interface HtmlCache {
+	match(request: Request): Promise<Response | undefined>;
+	put(request: Request, response: Response): Promise<void>;
+}
+
+export interface BackgroundContext {
+	waitUntil(promise: Promise<unknown>): void;
+}
+
+export function versionedResponse(response: Response, context: ContentContext) {
+	const result = new Response(response.body, response);
+	result.headers.set('X-Wisconsin-Content-Version', context.snapshot);
+	result.headers.set('X-Wisconsin-Application-Version', context.applicationVersion);
+	return result;
+}
+
+function htmlRequest(request: Request, routing: ContentRouting) {
+	const url = new URL(request.url);
+	let pathname: string;
+	try {
+		pathname = decodeURIComponent(url.pathname);
+	} catch {
+		return false;
+	}
+	return (
+		request.method === 'GET' &&
+		url.search === '' &&
+		!request.headers.has('range') &&
+		!/(?:no-cache|no-store)/i.test(request.headers.get('cache-control') ?? '') &&
+		!/^\/(?:api|admin|login|logout)(?:\/|$)/.test(pathname) &&
+		!url.pathname.endsWith('/__data.json') &&
+		routing.routes.includes(url.pathname)
+	);
+}
+
+/** Called after authentication for full requests, before security headers/cookies are added. */
+export async function cachedHtml(
+	request: Request,
+	context: ContentContext,
+	routing: ContentRouting,
+	cache: HtmlCache | undefined,
+	background: BackgroundContext,
+	render: () => Promise<Response>
+) {
+	if (!cache || !htmlRequest(request, routing)) return render();
+	const url = new URL(request.url);
+	const routeKey = routing.htmlKeys?.[url.pathname];
+	const dependency = routeKey ? `dependency/${routeKey}` : `snapshot/${context.snapshot}`;
+	url.pathname = `/_content/ssr/${context.applicationVersion}/${context.edition}/${dependency}/${encodeURIComponent(url.pathname)}`;
+	const key = new Request(url, { method: 'GET' });
+	try {
+		const cached = await cache.match(key);
+		if (cached) return cached;
+	} catch {
+		/* Cache availability must not become content availability. */
+	}
+	const response = await render();
+	if (
+		response.status === 200 &&
+		response.headers.get('content-type')?.toLowerCase().includes('text/html') &&
+		!/(?:private|no-cache|no-store)/i.test(response.headers.get('cache-control') ?? '') &&
+		!response.headers.has('set-cookie') &&
+		!response.headers.has('vary')
+	) {
+		const stored = response.clone();
+		stored.headers.set('Cache-Control', 'public, max-age=3600');
+		try {
+			background.waitUntil(
+				Promise.resolve()
+					.then(() => cache.put(key, stored))
+					.catch(() => undefined)
+			);
+		} catch {
+			/* A closed background context cannot turn a rendered page into an error. */
+		}
+	}
+	return response;
+}

package/site/worker/framing.ts

@@ -0,0 +1,4 @@
+export function frameOptions(response: Response) {
+	const contentType = response.headers.get('Content-Type')?.split(';')[0].trim().toLowerCase();
+	return response.ok && contentType === 'application/pdf' ? 'SAMEORIGIN' : 'DENY';
+}

package/site/worker/gate.ts

@@ -0,0 +1,147 @@
+import { createAuth, type AuthEnv } from './auth';
+import { accessForUser } from './access';
+import { copyCookies, handleAuthEndpoint, redirect, signIn, signOut } from './auth-routes';
+import { loginPage, returnPath } from './login';
+import { publicResponse } from './publication';
+import { frameOptions } from './framing';
+import { proxyAnalytics } from './analytics';
+import { isInternalContentPath } from './content-runtime';
+
+function privateResponse(response: Response, cookies: Headers, request: Request) {
+	const result = new Response(response.body, response);
+	const pathname = new URL(request.url).pathname;
+	result.headers.set('Cache-Control', 'private, no-store');
+	result.headers.set('X-Content-Type-Options', 'nosniff');
+	result.headers.set('X-Frame-Options', frameOptions(response));
+	if (/^\/_files\/blobs\/[a-f0-9]{64}\.bin$/.test(pathname)) {
+		result.headers.set('Content-Type', 'application/octet-stream');
+		result.headers.set('Content-Disposition', 'attachment');
+	}
+	result.headers.set('Referrer-Policy', 'same-origin');
+	result.headers.set('X-Robots-Tag', 'noindex, nofollow');
+	copyCookies(cookies, result.headers);
+	return result;
+}
+
+function requireLogin(request: Request, url: URL) {
+	const navigation =
+		request.method === 'GET' &&
+		(request.headers.get('sec-fetch-mode') === 'navigate' ||
+			request.headers.get('accept')?.includes('text/html'));
+	if (navigation) return redirect('/login?next=' + encodeURIComponent(url.pathname + url.search));
+	return new Response('Unauthorized', { status: 401 });
+}
+
+async function routeRequest(
+	request: Request,
+	env: AuthEnv,
+	cookies: Headers,
+	servePublic?: () => Promise<Response | null>
+): Promise<Response | null> {
+	const url = new URL(request.url);
+	if (url.origin !== env.ORIGIN) return new Response('Misdirected request', { status: 421 });
+	if (isInternalContentPath(url.pathname)) return new Response('Not found', { status: 404 });
+	// Analytics also serves anonymous public readers, before session/database access.
+	if (url.pathname.startsWith('/api/analytics/')) {
+		if (env.DISABLE_ANALYTICS === 'true')
+			return Response.json({}, { headers: { 'Cache-Control': 'no-store' } });
+		return proxyAnalytics(
+			request,
+			fetch,
+			env.TWIKI_ANALYTICS_SITE_ID && env.TWIKI_ANALYTICS_ENDPOINT
+				? { siteId: env.TWIKI_ANALYTICS_SITE_ID, endpoint: env.TWIKI_ANALYTICS_ENDPOINT }
+				: undefined
+		);
+	}
+	const reading = request.method === 'GET' || request.method === 'HEAD';
+	if (reading && url.pathname === '/fonts/OverusedGrotesk-VF.woff2') return null;
+	if (env.TWIKI_AUTH_MODE === 'none') {
+		if (reading && servePublic)
+			return (await servePublic()) ?? new Response('Not found', { status: 404 });
+		return new Response('Not found', { status: 404 });
+	}
+	if (
+		reading &&
+		servePublic &&
+		(!request.headers.has('cookie') ||
+			['/sitemap.xml', '/index.xml', '/robots.txt'].includes(url.pathname))
+	) {
+		const published = await servePublic();
+		if (published) return published;
+	}
+	const auth = createAuth(env);
+	if (url.pathname.startsWith('/api/auth/')) return handleAuthEndpoint(request, auth);
+	if (request.method === 'POST') {
+		if (url.pathname === '/login') return signIn(request, auth);
+		if (url.pathname === '/logout') return signOut(request, auth);
+	}
+
+	const { headers, response: session } = await auth.api.getSession({
+		headers: request.headers,
+		returnHeaders: true
+	});
+	copyCookies(headers, cookies);
+	const access = session && (await accessForUser(env, session.user.id));
+	if (reading && url.pathname === '/login') {
+		const next = returnPath(url.searchParams.get('next'));
+		if (access) return redirect(next);
+		const page = loginPage(
+			next,
+			url.searchParams.has('error'),
+			env.TWIKI_SITE_NAME,
+			env.TWIKI_SITE_DESCRIPTION
+		);
+		return request.method === 'HEAD' ? new Response(null, page) : page;
+	}
+	if (!access)
+		return reading && servePublic
+			? ((await servePublic()) ?? requireLogin(request, url))
+			: requireLogin(request, url);
+	if (url.pathname === '/api/access') {
+		if (!reading) return new Response('Method not allowed', { status: 405 });
+		return new Response(
+			request.method === 'HEAD'
+				? null
+				: JSON.stringify({ role: access, githubUsername: session?.user.githubUsername ?? null }),
+			{
+				headers: { 'Content-Type': 'application/json' }
+			}
+		);
+	}
+	return null;
+}
+
+export async function authenticateRequest(
+	request: Request,
+	env: AuthEnv,
+	serve: () => Promise<Response>,
+	servePublic?: () => Promise<Response | null>
+) {
+	const cookies = new Headers();
+	let published = false;
+	const publication =
+		servePublic &&
+		(async () => {
+			const response = await servePublic();
+			if (response) published = true;
+			return response;
+		});
+	let response: Response | null;
+	try {
+		response = await routeRequest(request, env, cookies, publication);
+	} catch {
+		console.error('Authentication request failed');
+		response = new Response('Authentication temporarily unavailable', { status: 503 });
+	}
+	if (response === null) {
+		try {
+			response = await serve();
+		} catch {
+			console.error('Content request failed');
+			response = new Response('Content temporarily unavailable', { status: 500 });
+		}
+	}
+	return published
+		? publicResponse(response, request)
+		: privateResponse(response, cookies, request);
+}

package/site/worker/index.ts

@@ -0,0 +1,9 @@
+// @ts-expect-error The adapter generates this untyped module during build.
+import app from '../build/.svelte-kit/svelte-worker.js';
+import { createContentWorker } from './runtime';
+import type { HtmlCache } from './content-runtime';
+
+// Cache lookups are inside the gate; full-edition HTML never bypasses authorization.
+const edgeCache = (globalThis as typeof globalThis & { caches?: { default?: HtmlCache } }).caches
+	?.default;
+export default createContentWorker(app, edgeCache);

package/site/worker/login.ts

@@ -0,0 +1,62 @@
+import { siGithub } from 'simple-icons';
+
+export function returnPath(value: unknown): string {
+	if (
+		typeof value !== 'string' ||
+		!value.startsWith('/') ||
+		value.startsWith('//') ||
+		/[\\\x00-\x20]/.test(value) ||
+		/%2f|%5c|%0[ad]/i.test(value)
+	)
+		return '/';
+	const path = new URL(value, 'https://local.invalid');
+	if (
+		path.pathname.startsWith('//') ||
+		path.pathname === '/login' ||
+		path.pathname.startsWith('/api/auth/') ||
+		path.pathname === '/logout'
+	)
+		return '/';
+	return path.pathname + path.search + path.hash;
+}
+
+function escape(value: string) {
+	return value.replace(
+		/[&<>"']/g,
+		(character) =>
+			({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[character]!
+	);
+}
+
+export function loginPage(
+	next: string,
+	failed: boolean,
+	name = 'twiki',
+	description = 'A private space for your notes.'
+) {
+	const nonce = crypto.randomUUID();
+	return new Response(
+		`<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in · ${escape(name)}</title>
+<script nonce="${nonce}">try{const mode=localStorage.getItem('mode-watcher-mode');if(mode==='light'||mode==='dark')document.documentElement.style.colorScheme=mode}catch{}</script>
+<style>
+@font-face{font-family:'Overused Grotesk';src:url('/fonts/OverusedGrotesk-VF.woff2') format('woff2');font-weight:300 900;font-style:normal;font-display:swap}
+:root{color-scheme:light dark;--bg:light-dark(#f8f6f1,#1a1916);--text:light-dark(#1a1916,#e8e5df);--muted:light-dark(#8a8578,#7a7568);--accent:light-dark(#d35545,#e68578);font-family:'Overused Grotesk',system-ui,sans-serif;background:var(--bg);color:var(--text);-webkit-font-smoothing:antialiased}
+body{margin:0;min-height:100svh;display:grid;place-items:center}main{width:min(21rem,calc(100% - 3rem))}
+h1{font-size:2rem;font-weight:650;letter-spacing:-.04em;line-height:1.1;margin:0 0 .65rem}p{font-size:1rem;line-height:1.6;color:color-mix(in srgb,var(--muted),var(--text) 25%);margin:0}
+button{display:flex;align-items:center;justify-content:center;gap:.65rem;width:100%;border:1px solid transparent;border-radius:.5rem;background:var(--text);color:var(--bg);padding:.8rem 1rem;font:inherit;font-weight:600;cursor:pointer;margin-top:1.5rem;transition:background-color 120ms}
+button:hover{background:color-mix(in srgb,var(--text),var(--accent) 20%)}button:focus-visible{outline:2px solid var(--accent);outline-offset:4px}button svg{flex-shrink:0}.error{color:var(--accent);margin-top:1rem}
+@media(prefers-reduced-motion:reduce){button{transition:none}}
+</style></head><body><main><h1>${escape(name)}</h1><p>${escape(description)}</p>
+${failed ? '<p class="error" role="alert">Sign-in was unsuccessful. Please use your authorized GitHub account and try again.</p>' : ''}
+<form method="post" action="/login"><input type="hidden" name="next" value="${escape(returnPath(next))}"><button><svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" focusable="false"><path d="${siGithub.path}"/></svg>Continue with GitHub</button></form>
+</main></body></html>`,
+		{
+			headers: {
+				'Content-Type': 'text/html; charset=utf-8',
+				'Content-Security-Policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; font-src 'self'; form-action 'self' https://github.com; frame-ancestors 'none'; base-uri 'none'`
+			}
+		}
+	);
+}

package/site/worker/publication.ts

@@ -0,0 +1,44 @@
+import { frameOptions } from './framing';
+
+export type PublicAssets = Record<string, string>;
+
+export const fileBrowserShell = '/_file-browser';
+export const publicFileBrowserShell = `/_published${fileBrowserShell}`;
+
+export function isFileBrowserPath(pathname: string) {
+	return /^\/[^/]+\/files(?:\/|$)/.test(pathname);
+}
+
+/** Catalog routes are exact allowlisted aliases to a shared shell, not a catch-all. */
+export function fileBrowserTarget(request: Request, assets: PublicAssets) {
+	if (!['GET', 'HEAD'].includes(request.method)) return;
+	const pathname = new URL(request.url).pathname;
+	if (!isFileBrowserPath(pathname)) return;
+	return assets[pathname] === publicFileBrowserShell ? fileBrowserShell : null;
+}
+
+export function publicTarget(request: Request, assets: PublicAssets) {
+	if (!['GET', 'HEAD'].includes(request.method)) return;
+	const pathname = new URL(request.url).pathname;
+	if (pathname.startsWith('/_published')) return;
+	return Object.hasOwn(assets, pathname) ? assets[pathname] : undefined;
+}
+
+export function publicResponse(response: Response, request: Request) {
+	const result = new Response(request.method === 'HEAD' ? null : response.body, response);
+	result.headers.set('Cache-Control', 'no-store');
+	result.headers.set('Vary', 'Cookie');
+	result.headers.set('X-Content-Type-Options', 'nosniff');
+	result.headers.set('Referrer-Policy', 'same-origin');
+	result.headers.delete('Set-Cookie');
+	result.headers.delete('X-Robots-Tag');
+	const pathname = new URL(request.url).pathname;
+	result.headers.set('X-Frame-Options', frameOptions(response));
+	if (pathname.startsWith('/_files/') || pathname.includes('/files') || response.status >= 400)
+		result.headers.set('X-Robots-Tag', 'noindex');
+	if (/^\/_files\/blobs\/[a-f0-9]{64}\.bin$/.test(pathname)) {
+		result.headers.set('Content-Type', 'application/octet-stream');
+		result.headers.set('Content-Disposition', 'attachment');
+	}
+	return result;
+}

package/site/worker/runtime.ts

@@ -0,0 +1,104 @@
+import { authenticateRequest } from './gate';
+import type { AuthEnv } from './auth';
+import { isFileBrowserPath } from './publication';
+import {
+	cachedHtml,
+	contentContext,
+	contentDescriptor,
+	contentRouting,
+	versionedResponse,
+	type AssetBinding,
+	type BackgroundContext,
+	type ContentContext,
+	type HtmlCache
+} from './content-runtime';
+
+export interface RuntimeEnv extends AuthEnv {
+	ASSETS: AssetBinding;
+	WISCONSIN_CONTENT_CONTEXT?: ContentContext;
+}
+
+export interface RuntimeApp {
+	fetch(request: Request, env: RuntimeEnv, context: BackgroundContext): Promise<Response>;
+}
+
+/** Preserve file transfer semantics without forwarding session or authorization headers. */
+export function assetAliasRequest(request: Request, target?: string) {
+	const url = new URL(request.url);
+	url.pathname = target ?? url.pathname;
+	url.search = '';
+	const headers = new Headers();
+	for (const name of [
+		'range',
+		'if-range',
+		'if-none-match',
+		'if-modified-since',
+		'if-match',
+		'if-unmodified-since'
+	]) {
+		const value = request.headers.get(name);
+		if (value !== null) headers.set(name, value);
+	}
+	return new Request(url, { method: request.method, headers });
+}
+
+export function createContentWorker(app: RuntimeApp, cache?: HtmlCache) {
+	return {
+		fetch(request: Request, env: RuntimeEnv, background: BackgroundContext) {
+			const url = new URL(request.url);
+			let pointer: ReturnType<typeof contentDescriptor> | undefined;
+			const descriptor = () => (pointer ??= contentDescriptor(env.ASSETS, url.origin));
+			async function serve(edition: ContentContext['edition'], published: boolean) {
+				const context = contentContext(await descriptor(), edition);
+				const routing = await contentRouting(env.ASSETS, url.origin, context);
+				const reading = request.method === 'GET' || request.method === 'HEAD';
+				const routePath = url.pathname.endsWith('/__data.json')
+					? url.pathname.slice(0, -'/__data.json'.length) || '/'
+					: url.pathname.replace(/\/$/, '') || '/';
+				const route = routing.routes.includes(routePath);
+				const target = Object.hasOwn(routing.assets, url.pathname)
+					? routing.assets[url.pathname]
+					: undefined;
+				if (published && (!reading || (!route && !target)))
+					return isFileBrowserPath(url.pathname)
+						? new Response('Not found', { status: 404 })
+						: null;
+				if (reading && !route) {
+					if (isFileBrowserPath(url.pathname) && !target)
+						return new Response('Not found', { status: 404 });
+					const response = await env.ASSETS.fetch(assetAliasRequest(request, target));
+					if (
+						published &&
+						response.status >= 300 &&
+						response.status < 400 &&
+						response.status !== 304
+					)
+						return new Response('Publication unavailable', { status: 503 });
+					if (response.status !== 404 || published) return versionedResponse(response, context);
+				}
+				// Trust is carried in an object supplied by this Worker, never a request field.
+				const trustedEnv = { ...env, WISCONSIN_CONTENT_CONTEXT: context };
+				return versionedResponse(
+					await cachedHtml(request, context, routing, cache, background, () =>
+						app.fetch(request, trustedEnv, background)
+					),
+					context
+				);
+			}
+			return authenticateRequest(
+				request,
+				env,
+				async () => {
+					// The login page's maintained font is independent of course snapshots.
+					if (
+						['GET', 'HEAD'].includes(request.method) &&
+						url.pathname === '/fonts/OverusedGrotesk-VF.woff2'
+					)
+						return env.ASSETS.fetch(request);
+					return (await serve('full', false))!;
+				},
+				() => serve('public', true)
+			);
+		}
+	};
+}

package/site/worker/tsconfig.json

@@ -0,0 +1,13 @@
+{
+	"compilerOptions": {
+		"target": "ES2022",
+		"module": "ESNext",
+		"moduleResolution": "bundler",
+		"resolveJsonModule": true,
+		"lib": ["ES2022", "DOM", "DOM.Iterable"],
+		"strict": true,
+		"skipLibCheck": true,
+		"noEmit": true
+	},
+	"include": ["./*.ts"]
+}

package/site/wrangler.jsonc

@@ -0,0 +1,37 @@
+{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+  "name": "twiki",
+  "compatibility_date": "2026-06-07",
+  "compatibility_flags": [
+    "nodejs_compat"
+  ],
+  "main": "build/.svelte-kit/worker.js",
+  "vars": {
+    "ORIGIN": "https://notes.example.test",
+    "OWNER_GITHUB_ID": "0",
+    "GITHUB_CLIENT_ID": "development-only"
+  },
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "twiki",
+      "database_id": "00000000-0000-0000-0000-000000000000",
+      "migrations_dir": "migrations"
+    }
+  ],
+  "assets": {
+    "binding": "ASSETS",
+    "directory": "build/.svelte-kit/cloudflare",
+    "html_handling": "drop-trailing-slash",
+    "not_found_handling": "404-page",
+    "run_worker_first": true
+  },
+  "workers_dev": false,
+  "preview_urls": false,
+  "routes": [
+    {
+      "pattern": "notes.example.test",
+      "custom_domain": true
+    }
+  ]
+}