@we8/cms 0.1.0

package/dist/modules/seo/sitemap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sitemap.d.ts","sourceRoot":"","sources":["../../../src/modules/seo/sitemap.ts"],"names":[],"mappings":"AA2BA,+FAA+F;AAC/F,wBAAsB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BnF"}

package/dist/modules/seo/sitemap.js

@@ -0,0 +1,39 @@
+import { resolveContentPath } from '../../shared/index.js';
+import { getSettings } from '../../env.js';
+function escapeXml(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+function urlEntry(loc, lastmod, changefreq, priority) {
+    let entry = `<url><loc>${escapeXml(loc)}</loc>`;
+    if (lastmod)
+        entry += `<lastmod>${escapeXml(lastmod)}</lastmod>`;
+    if (changefreq)
+        entry += `<changefreq>${escapeXml(changefreq)}</changefreq>`;
+    if (priority !== undefined)
+        entry += `<priority>${priority}</priority>`;
+    entry += `</url>`;
+    return entry;
+}
+/** Published posts (cap 1000, lastmod from published_at) plus the configured static routes. */
+export async function buildSitemap(db, siteUrl) {
+    const settings = await getSettings(db);
+    const { results } = await db
+        .prepare(`SELECT posts.slug, posts.type, pv.published_at
+       FROM posts JOIN post_versions pv ON pv.id = posts.current_version_id
+       WHERE posts.status = 'published'
+       ORDER BY pv.published_at DESC
+       LIMIT 1000`)
+        .all();
+    const staticEntries = settings.sitemapStatic.map((entry) => urlEntry(`${siteUrl}${entry.path}`, undefined, entry.changefreq, entry.priority));
+    // Per-type sections: each post's <loc> uses its type's resolved path, and an
+    // empty contentPaths map reproduces single-prefix output byte for byte.
+    const postEntries = results.map((row) => urlEntry(`${siteUrl}${resolveContentPath(row.type, settings)}/${row.slug}`, row.published_at.slice(0, 10)));
+    const body = [...staticEntries, ...postEntries].join('');
+    return `<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">${body}</urlset>`;
+}
+//# sourceMappingURL=sitemap.js.map

package/dist/modules/seo/sitemap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sitemap.js","sourceRoot":"","sources":["../../../src/modules/seo/sitemap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAiB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAQ3C,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAgB,EAAE,UAAmB,EAAE,QAAiB;IACrF,IAAI,KAAK,GAAG,aAAa,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChD,IAAI,OAAO;QAAE,KAAK,IAAI,YAAY,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;IACjE,IAAI,UAAU;QAAE,KAAK,IAAI,eAAe,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7E,IAAI,QAAQ,KAAK,SAAS;QAAE,KAAK,IAAI,aAAa,QAAQ,aAAa,CAAC;IACxE,KAAK,IAAI,QAAQ,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAc,EAAE,OAAe;IAChE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACzB,OAAO,CACN;;;;kBAIY,CACb;SACA,GAAG,EAAkB,CAAC;IAEzB,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,QAAQ,CAAC,GAAG,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CACjF,CAAC;IAEF,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtC,QAAQ,CACN,GAAG,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,EACjE,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAC9B,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,qGAAqG,IAAI,WAAW,CAAC;AAC9H,CAAC"}

package/dist/modules/settings/routes.admin.d.ts

@@ -0,0 +1,12 @@
+import { Hono } from 'hono';
+import { type Bindings } from '../../env.js';
+/**
+ * Not gated by moduleGate: settings is the mechanism that controls the five
+ * toggleable modules (content/forms/analytics/media/seo), not a module
+ * itself, so it has no flag of its own to gate on (same reasoning as
+ * /v1/health).
+ */
+export declare const settingsAdminRoutes: Hono<{
+    Bindings: Bindings;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/modules/settings/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../../src/modules/settings/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAA4B,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIvE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;cAAwB,QAAQ;yCAAK,CAAC"}

package/dist/modules/settings/routes.admin.js

@@ -0,0 +1,27 @@
+import { ok, siteSettingsUpdateInputSchema } from '../../shared/index.js';
+import { Hono } from 'hono';
+import { getSettings, setSettings } from '../../env.js';
+import { requireOwner } from '../../middleware/auth.js';
+import { parseOrThrow } from '../../lib/validate.js';
+/**
+ * Not gated by moduleGate: settings is the mechanism that controls the five
+ * toggleable modules (content/forms/analytics/media/seo), not a module
+ * itself, so it has no flag of its own to gate on (same reasoning as
+ * /v1/health).
+ */
+export const settingsAdminRoutes = new Hono();
+// GET stays editor+: reading module config / notify list is not a mutation.
+settingsAdminRoutes.get('/', async (c) => {
+    const settings = await getSettings(c.env.DB);
+    return c.json(ok({ settings }));
+});
+// The settings MUTATION is OWNER-ONLY. It changes notifyEmails, webhooks,
+// allowedOrigins, module flags, and retention: security-relevant configuration
+// (redirecting form notifications, for one), so a member may read it but not
+// change it.
+settingsAdminRoutes.patch('/', requireOwner, async (c) => {
+    const patch = parseOrThrow(siteSettingsUpdateInputSchema, await c.req.json());
+    const settings = await setSettings(c.env.DB, patch);
+    return c.json(ok({ settings }));
+});
+//# sourceMappingURL=routes.admin.js.map

package/dist/modules/settings/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../../src/modules/settings/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAiB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAA0B,CAAC;AAEtE,4EAA4E;AAC5E,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,aAAa;AACb,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC"}

package/dist/modules/site-documents/routes.admin.d.ts

@@ -0,0 +1,10 @@
+import { Hono } from 'hono';
+import type { Bindings } from '../../env.js';
+/**
+ * Not gated by moduleGate: site documents are a site-level concern (like
+ * settings), not one of the five toggleable modules.
+ */
+export declare const siteDocumentsAdminRoutes: Hono<{
+    Bindings: Bindings;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/modules/site-documents/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../../src/modules/site-documents/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C;;;GAGG;AACH,eAAO,MAAM,wBAAwB;cAAwB,QAAQ;yCAAK,CAAC"}

package/dist/modules/site-documents/routes.admin.js

@@ -0,0 +1,29 @@
+import { ok, siteDocumentKindSchema, siteDocumentUpdateInputSchema } from '../../shared/index.js';
+import { Hono } from 'hono';
+import { HttpError } from '../../lib/errors.js';
+import { parseOrThrow } from '../../lib/validate.js';
+import { getDocument, upsertDocument } from './service.js';
+/**
+ * Not gated by moduleGate: site documents are a site-level concern (like
+ * settings), not one of the five toggleable modules.
+ */
+export const siteDocumentsAdminRoutes = new Hono();
+function parseKind(raw) {
+    const result = siteDocumentKindSchema.safeParse(raw);
+    if (!result.success) {
+        throw new HttpError('not_found', 'unknown document kind');
+    }
+    return result.data;
+}
+siteDocumentsAdminRoutes.get('/:kind', async (c) => {
+    const kind = parseKind(c.req.param('kind'));
+    const document = await getDocument(c.env.DB, kind);
+    return c.json(ok({ document }));
+});
+siteDocumentsAdminRoutes.put('/:kind', async (c) => {
+    const kind = parseKind(c.req.param('kind'));
+    const input = parseOrThrow(siteDocumentUpdateInputSchema, await c.req.json());
+    const document = await upsertDocument(c.env.DB, kind, input.content, input.answerSummary);
+    return c.json(ok({ document }));
+});
+//# sourceMappingURL=routes.admin.js.map

package/dist/modules/site-documents/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../../src/modules/site-documents/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,IAAI,EAA0B,CAAC;AAE3E,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,wBAAwB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,wBAAwB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC"}

package/dist/modules/site-documents/routes.public.d.ts

@@ -0,0 +1,6 @@
+import { Hono } from 'hono';
+import type { Bindings } from '../../env.js';
+export declare const siteDocumentsPublicRoutes: Hono<{
+    Bindings: Bindings;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=routes.public.d.ts.map

package/dist/modules/site-documents/routes.public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.d.ts","sourceRoot":"","sources":["../../../src/modules/site-documents/routes.public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,eAAO,MAAM,yBAAyB;cAAwB,QAAQ;yCAAK,CAAC"}

package/dist/modules/site-documents/routes.public.js

@@ -0,0 +1,16 @@
+import { ok, siteDocumentKindSchema } from '../../shared/index.js';
+import { Hono } from 'hono';
+import { HttpError } from '../../lib/errors.js';
+import { corsMiddleware } from '../../middleware/cors.js';
+import { getDocument } from './service.js';
+export const siteDocumentsPublicRoutes = new Hono();
+siteDocumentsPublicRoutes.use('/:kind', corsMiddleware('publicRead'));
+siteDocumentsPublicRoutes.get('/:kind', async (c) => {
+    const result = siteDocumentKindSchema.safeParse(c.req.param('kind'));
+    if (!result.success) {
+        throw new HttpError('not_found', 'unknown document kind');
+    }
+    const document = await getDocument(c.env.DB, result.data);
+    return c.json(ok({ document }));
+});
+//# sourceMappingURL=routes.public.js.map

package/dist/modules/site-documents/routes.public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.js","sourceRoot":"","sources":["../../../src/modules/site-documents/routes.public.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,IAAI,EAA0B,CAAC;AAE5E,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AAEtE,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC"}

package/dist/modules/site-documents/service.d.ts

@@ -0,0 +1,11 @@
+import type { SiteDocumentKind, SiteDocumentRecord } from '../../shared/index.js';
+/**
+ * A missing row means "never written", which is the same meaning as empty
+ * content, not a not-found error: a site whose owner has never opened the
+ * Documents screen has written nothing, and that is a normal state.
+ */
+export declare function getDocument(db: D1Database, kind: SiteDocumentKind): Promise<SiteDocumentRecord>;
+/** Every document at once, for the AEO check and the generated llms.txt. */
+export declare function listDocuments(db: D1Database): Promise<SiteDocumentRecord[]>;
+export declare function upsertDocument(db: D1Database, kind: SiteDocumentKind, content: string, answerSummary: string | undefined): Promise<SiteDocumentRecord>;
+//# sourceMappingURL=service.d.ts.map

package/dist/modules/site-documents/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/site-documents/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAkBlF;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAM7B;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAKjF;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAe7B"}

package/dist/modules/site-documents/service.js

@@ -0,0 +1,42 @@
+function toRecord(row, kind) {
+    return {
+        kind,
+        content: row?.content ?? '',
+        answerSummary: row?.answer_summary ?? null,
+        updatedAt: row?.updated_at ?? null,
+    };
+}
+/**
+ * A missing row means "never written", which is the same meaning as empty
+ * content, not a not-found error: a site whose owner has never opened the
+ * Documents screen has written nothing, and that is a normal state.
+ */
+export async function getDocument(db, kind) {
+    const row = await db
+        .prepare('SELECT kind, content, answer_summary, updated_at FROM site_documents WHERE kind = ?1')
+        .bind(kind)
+        .first();
+    return toRecord(row, kind);
+}
+/** Every document at once, for the AEO check and the generated llms.txt. */
+export async function listDocuments(db) {
+    const { results } = await db
+        .prepare('SELECT kind, content, answer_summary, updated_at FROM site_documents')
+        .all();
+    return results.map((row) => toRecord(row, row.kind));
+}
+export async function upsertDocument(db, kind, content, answerSummary) {
+    await db
+        .prepare(`INSERT INTO site_documents (kind, content, answer_summary, updated_at)
+       VALUES (?1, ?2, ?3, datetime('now'))
+       ON CONFLICT (kind) DO UPDATE SET
+         content = excluded.content,
+         answer_summary = excluded.answer_summary,
+         updated_at = excluded.updated_at`)
+        // "" clears, the same wire protocol every other optional string uses, so a
+        // row never stores an empty string where null is what is meant.
+        .bind(kind, content, answerSummary || null)
+        .run();
+    return getDocument(db, kind);
+}
+//# sourceMappingURL=service.js.map

package/dist/modules/site-documents/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/modules/site-documents/service.ts"],"names":[],"mappings":"AASA,SAAS,QAAQ,CAAC,GAA2B,EAAE,IAAsB;IACnE,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,EAAE;QAC3B,aAAa,EAAE,GAAG,EAAE,cAAc,IAAI,IAAI;QAC1C,SAAS,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAc,EACd,IAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CAAC,sFAAsF,CAAC;SAC/F,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,EAAmB,CAAC;IAC5B,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAc;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACzB,OAAO,CAAC,sEAAsE,CAAC;SAC/E,GAAG,EAAmB,CAAC;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,IAAwB,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAc,EACd,IAAsB,EACtB,OAAe,EACf,aAAiC;IAEjC,MAAM,EAAE;SACL,OAAO,CACN;;;;;0CAKoC,CACrC;QACD,2EAA2E;QAC3E,gEAAgE;SAC/D,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;SAC1C,GAAG,EAAE,CAAC;IACT,OAAO,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/modules/webhooks/dispatch.d.ts

@@ -0,0 +1,14 @@
+import type { WebhookEvent } from '../../shared/index.js';
+import type { ExecutionContext } from 'hono';
+/**
+ * Fires an event to every configured webhook subscribed to it. Each delivery,
+ * with its own retry schedule, runs inside ctx.waitUntil so the triggering
+ * request (an admin publish, a form submission) returns immediately instead of
+ * waiting on somebody else's endpoint.
+ */
+export declare function dispatchWebhook(db: D1Database, ctx: ExecutionContext, siteUrl: string, event: WebhookEvent, data: Record<string, unknown>, 
+/** Test-only: override the real 0s/30s schedule so retry-exhaustion tests don't take 30+ real seconds. */
+retryDelaysMs?: number[], 
+/** Test-only: override the real 10s per-attempt timeout for hang-simulation tests. */
+attemptTimeoutMs?: number): Promise<void>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/modules/webhooks/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAC;AA6H7C;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;AAC7B,0GAA0G;AAC1G,aAAa,GAAE,MAAM,EAAoB;AACzC,sFAAsF;AACtF,gBAAgB,GAAE,MAA2B,GAC5C,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/modules/webhooks/dispatch.js

@@ -0,0 +1,84 @@
+import { getSettings } from '../../env.js';
+/** Delays BETWEEN attempts. Three attempts total, so two gaps: 0s then 30s. */
+const RETRY_DELAYS_MS = [0, 30_000];
+/**
+ * Bounds a single delivery attempt. Load-bearing, and proven so against a real
+ * deploy: a receiver URL that never responds left `fetch()` hanging with no
+ * timeout, so the delivery never reached its retry schedule at all and the row
+ * stayed "pending" forever. Unit tests mock fetch as an immediate resolve or
+ * reject, so it takes a genuinely non-resolving host to surface.
+ */
+const ATTEMPT_TIMEOUT_MS = 10_000;
+async function fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function signWebhookBody(secret, body) {
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(body));
+    return Array.from(new Uint8Array(signature))
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('');
+}
+async function deliverWithRetries(url, body, secret, retryDelaysMs, attemptTimeoutMs) {
+    const signature = await signWebhookBody(secret, body);
+    let lastStatus = null;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        if (attempt > 0) {
+            const delay = retryDelaysMs[attempt - 1] ?? 0;
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+        try {
+            const res = await fetchWithTimeout(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'X-We8-Signature': signature },
+                body,
+            }, attemptTimeoutMs);
+            lastStatus = res.status;
+            if (res.ok)
+                return { success: true, lastStatus, attempts: attempt + 1 };
+        }
+        catch {
+            lastStatus = null;
+        }
+    }
+    return { success: false, lastStatus, attempts: 3 };
+}
+async function deliverAndLog(db, webhook, event, data, siteUrl, retryDelaysMs, attemptTimeoutMs) {
+    const envelope = { event, site: siteUrl, data, timestamp: new Date().toISOString() };
+    const body = JSON.stringify(envelope);
+    const inserted = await db
+        .prepare(`INSERT INTO webhook_deliveries (event, url, status, attempts) VALUES (?1, ?2, 'pending', 0)`)
+        .bind(event, webhook.url)
+        .run();
+    const deliveryId = inserted.meta.last_row_id;
+    const outcome = await deliverWithRetries(webhook.url, body, webhook.secret, retryDelaysMs, attemptTimeoutMs);
+    await db
+        .prepare(`UPDATE webhook_deliveries SET status=?2, response_code=?3, attempts=?4, delivered_at=?5 WHERE id=?1`)
+        .bind(deliveryId, outcome.success ? 'delivered' : 'failed', outcome.lastStatus, outcome.attempts, outcome.success ? new Date().toISOString() : null)
+        .run();
+}
+/**
+ * Fires an event to every configured webhook subscribed to it. Each delivery,
+ * with its own retry schedule, runs inside ctx.waitUntil so the triggering
+ * request (an admin publish, a form submission) returns immediately instead of
+ * waiting on somebody else's endpoint.
+ */
+export async function dispatchWebhook(db, ctx, siteUrl, event, data, 
+/** Test-only: override the real 0s/30s schedule so retry-exhaustion tests don't take 30+ real seconds. */
+retryDelaysMs = RETRY_DELAYS_MS, 
+/** Test-only: override the real 10s per-attempt timeout for hang-simulation tests. */
+attemptTimeoutMs = ATTEMPT_TIMEOUT_MS) {
+    const settings = await getSettings(db);
+    const matching = settings.webhooks.filter((webhook) => webhook.events.includes(event));
+    for (const webhook of matching) {
+        ctx.waitUntil(deliverAndLog(db, webhook, event, data, siteUrl, retryDelaysMs, attemptTimeoutMs));
+    }
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/modules/webhooks/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/modules/webhooks/dispatch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,+EAA+E;AAC/E,MAAM,eAAe,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAiB,EACjB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAQD,KAAK,UAAU,kBAAkB,CAC/B,GAAW,EACX,IAAY,EACZ,MAAc,EACd,aAAuB,EACvB,gBAAwB;IAExB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,UAAU,GAAkB,IAAI,CAAC;IAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE;gBAC7E,IAAI;aACL,EACD,gBAAgB,CACjB,CAAC;YACF,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;YACxB,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,EAAc,EACd,OAAsB,EACtB,KAAmB,EACnB,IAA6B,EAC7B,OAAe,EACf,aAAuB,EACvB,gBAAwB;IAExB,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,OAAO,CACN,6FAA6F,CAC9F;SACA,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;SACxB,GAAG,EAAE,CAAC;IACT,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;IAE7C,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,OAAO,CAAC,GAAG,EACX,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,aAAa,EACb,gBAAgB,CACjB,CAAC;IAEF,MAAM,EAAE;SACL,OAAO,CACN,qGAAqG,CACtG;SACA,IAAI,CACH,UAAU,EACV,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EACxC,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAClD;SACA,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAc,EACd,GAAqB,EACrB,OAAe,EACf,KAAmB,EACnB,IAA6B;AAC7B,0GAA0G;AAC1G,gBAA0B,eAAe;AACzC,sFAAsF;AACtF,mBAA2B,kBAAkB;IAE7C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEvF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CACX,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAClF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/shared/constants.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The cross-cutting vocabularies of the we8 API dialect. Every list here is
+ * fixed on purpose: types drive routing, sitemap sections, JSON-LD, and
+ * template switching, and an open vocabulary breaks all four.
+ */
+export declare const RATE_LIMIT_BUCKETS: {
+    readonly formsBurst: {
+        readonly windowSeconds: 60;
+        readonly max: 1;
+    };
+    readonly formsHourly: {
+        readonly windowSeconds: 3600;
+        readonly max: 5;
+    };
+    readonly engagement: {
+        readonly windowSeconds: 60;
+        readonly max: 30;
+    };
+};
+export type RateLimitBucket = keyof typeof RATE_LIMIT_BUCKETS;
+export declare const DEFAULT_RETENTION_DAYS: {
+    readonly visits: 90;
+    readonly consent: 365;
+    readonly rateEvents: 2;
+    readonly webhookDeliveries: 30;
+};
+export declare const POST_STATUSES: readonly ["draft", "published", "archived"];
+export type PostStatus = (typeof POST_STATUSES)[number];
+export declare const POST_TYPES: readonly ["blog", "article", "news", "research", "whitepaper", "case-study"];
+export type PostType = (typeof POST_TYPES)[number];
+export declare const SUBMISSION_STATUSES: readonly ["new", "reviewing", "resolved", "spam", "archived"];
+export type SubmissionStatus = (typeof SUBMISSION_STATUSES)[number];
+export declare const FORM_TYPES: readonly ["contact", "newsletter", "custom"];
+export type FormType = (typeof FORM_TYPES)[number];
+export declare const AUTHOR_TYPES: readonly ["team", "guest", "advisor", "partner"];
+export type AuthorType = (typeof AUTHOR_TYPES)[number];
+export declare const CONSENT_DECISIONS: readonly ["accepted", "partial", "declined"];
+export type ConsentDecision = (typeof CONSENT_DECISIONS)[number];
+export declare const WEBHOOK_EVENTS: readonly ["post.published", "post.unpublished", "form.submission.created"];
+export type WebhookEvent = (typeof WEBHOOK_EVENTS)[number];
+/**
+ * Public API key kinds, the same dialect managed we8 speaks: `pk_` is the
+ * publishable key a browser may carry, `sk_` the secret key a server holds.
+ * In this package both are minted, stored as SHA-256 hashes, and validated
+ * INSIDE this worker rather than in a control plane.
+ */
+export declare const API_KEY_KINDS: readonly ["pk", "sk"];
+export type ApiKeyKind = (typeof API_KEY_KINDS)[number];
+/**
+ * The two roles of the embedded auth model. `owner` is the first user created
+ * and holds the settings mutation and the form-submission inbox; `member` is
+ * everyone else and holds the rest of the admin API.
+ */
+export declare const USER_ROLES: readonly ["owner", "member"];
+export type UserRole = (typeof USER_ROLES)[number];
+/**
+ * Site documents: small author-written texts served at the site root, kept out
+ * of `site_settings` (multi-KB docs would tax every hot-path settings read) and
+ * out of R2 (small transactional text, not a binary asset). One row per kind.
+ * `llms-txt` doubles as the manual override for the generated /llms.txt.
+ */
+export declare const SITE_DOCUMENT_KINDS: readonly ["design-md", "llms-txt"];
+export type SiteDocumentKind = (typeof SITE_DOCUMENT_KINDS)[number];
+/**
+ * How a visit's user agent is classified when the beacon records it (0.1 AEO).
+ * Crawler attribution is the point: an answer engine reading the site is the
+ * signal AEO work is judged on, and lumping every non-human into one "bot"
+ * bucket throws that signal away. `human` is anything no pattern matched.
+ */
+export declare const USER_AGENT_CLASSES: readonly ["human", "ai-crawler", "search-crawler", "social-crawler", "seo-crawler", "other-bot"];
+export type UserAgentClass = (typeof USER_AGENT_CLASSES)[number];
+/**
+ * The AEO findings the admin check endpoints report per piece of content. Each
+ * is a concrete, locally verifiable absence, never a score or a guess: no
+ * external service is called and nothing is inferred from ranking data.
+ */
+export declare const AEO_FINDINGS: readonly ["missing_description", "missing_answer_summary", "missing_question_heading", "missing_json_ld", "not_in_sitemap"];
+export type AeoFinding = (typeof AEO_FINDINGS)[number];
+//# sourceMappingURL=constants.d.ts.map

package/dist/shared/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;CAIrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAE9D,eAAO,MAAM,sBAAsB;;;;;CAKzB,CAAC;AAEX,eAAO,MAAM,aAAa,6CAA8C,CAAC;AACzE,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAMxD,eAAO,MAAM,UAAU,8EAOb,CAAC;AACX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,eAAO,MAAM,mBAAmB,+DAAgE,CAAC;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMpE,eAAO,MAAM,UAAU,8CAA+C,CAAC;AACvE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,eAAO,MAAM,YAAY,kDAAmD,CAAC;AAC7E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,iBAAiB,8CAA+C,CAAC;AAC9E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,cAAc,4EAIjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,aAAa,uBAAwB,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,UAAU,8BAA+B,CAAC;AACvD,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,oCAAqC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,kGAOrB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,YAAY,6HAMf,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/shared/constants.js

@@ -0,0 +1,89 @@
+/**
+ * The cross-cutting vocabularies of the we8 API dialect. Every list here is
+ * fixed on purpose: types drive routing, sitemap sections, JSON-LD, and
+ * template switching, and an open vocabulary breaks all four.
+ */
+export const RATE_LIMIT_BUCKETS = {
+    formsBurst: { windowSeconds: 60, max: 1 },
+    formsHourly: { windowSeconds: 3600, max: 5 },
+    engagement: { windowSeconds: 60, max: 30 },
+};
+export const DEFAULT_RETENTION_DAYS = {
+    visits: 90,
+    consent: 365,
+    rateEvents: 2,
+    webhookDeliveries: 30,
+};
+export const POST_STATUSES = ['draft', 'published', 'archived'];
+// Content types: a FIXED vocabulary, deliberately not site-extensible, because
+// type drives routing (contentPaths), the sitemap, the JSON-LD @type, template
+// switching, and filters; open values break all five. Adding a member later is
+// a cheap additive migration.
+export const POST_TYPES = [
+    'blog',
+    'article',
+    'news',
+    'research',
+    'whitepaper',
+    'case-study',
+];
+export const SUBMISSION_STATUSES = ['new', 'reviewing', 'resolved', 'spam', 'archived'];
+// A form's declared purpose. Not a hard schema on the submission (every form
+// accepts arbitrary fields); it labels the form and tailors the embed example
+// the admin shows. "contact" is the classic name/email/message form,
+// "newsletter" an email-only signup, "custom" anything else.
+export const FORM_TYPES = ['contact', 'newsletter', 'custom'];
+export const AUTHOR_TYPES = ['team', 'guest', 'advisor', 'partner'];
+export const CONSENT_DECISIONS = ['accepted', 'partial', 'declined'];
+export const WEBHOOK_EVENTS = [
+    'post.published',
+    'post.unpublished',
+    'form.submission.created',
+];
+/**
+ * Public API key kinds, the same dialect managed we8 speaks: `pk_` is the
+ * publishable key a browser may carry, `sk_` the secret key a server holds.
+ * In this package both are minted, stored as SHA-256 hashes, and validated
+ * INSIDE this worker rather than in a control plane.
+ */
+export const API_KEY_KINDS = ['pk', 'sk'];
+/**
+ * The two roles of the embedded auth model. `owner` is the first user created
+ * and holds the settings mutation and the form-submission inbox; `member` is
+ * everyone else and holds the rest of the admin API.
+ */
+export const USER_ROLES = ['owner', 'member'];
+/**
+ * Site documents: small author-written texts served at the site root, kept out
+ * of `site_settings` (multi-KB docs would tax every hot-path settings read) and
+ * out of R2 (small transactional text, not a binary asset). One row per kind.
+ * `llms-txt` doubles as the manual override for the generated /llms.txt.
+ */
+export const SITE_DOCUMENT_KINDS = ['design-md', 'llms-txt'];
+/**
+ * How a visit's user agent is classified when the beacon records it (0.1 AEO).
+ * Crawler attribution is the point: an answer engine reading the site is the
+ * signal AEO work is judged on, and lumping every non-human into one "bot"
+ * bucket throws that signal away. `human` is anything no pattern matched.
+ */
+export const USER_AGENT_CLASSES = [
+    'human',
+    'ai-crawler',
+    'search-crawler',
+    'social-crawler',
+    'seo-crawler',
+    'other-bot',
+];
+/**
+ * The AEO findings the admin check endpoints report per piece of content. Each
+ * is a concrete, locally verifiable absence, never a score or a guess: no
+ * external service is called and nothing is inferred from ranking data.
+ */
+export const AEO_FINDINGS = [
+    'missing_description',
+    'missing_answer_summary',
+    'missing_question_heading',
+    'missing_json_ld',
+    'not_in_sitemap',
+];
+//# sourceMappingURL=constants.js.map

package/dist/shared/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,UAAU,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;IACzC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE;IAC5C,UAAU,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;CAClC,CAAC;AAIX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,GAAG;IACZ,UAAU,EAAE,CAAC;IACb,iBAAiB,EAAE,EAAE;CACb,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAU,CAAC;AAGzE,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,MAAM;IACN,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY;CACJ,CAAC;AAGX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAGjG,6EAA6E;AAC7E,8EAA8E;AAC9E,qEAAqE;AACrE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAU,CAAC;AAGvE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAG9E,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gBAAgB;IAChB,kBAAkB;IAClB,yBAAyB;CACjB,CAAC;AAGX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;AAGnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAW,EAAE,UAAU,CAAU,CAAC;AAGtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,WAAW;CACH,CAAC;AAGX;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,qBAAqB;IACrB,wBAAwB;IACxB,0BAA0B;IAC1B,iBAAiB;IACjB,gBAAgB;CACR,CAAC"}

package/dist/shared/envelope.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The response envelope every we8 API speaks: a discriminated union on `ok`,
+ * with a fixed error vocabulary mapped to HTTP status codes.
+ */
+export declare const ERROR_CODES: readonly ["validation_error", "unauthorized", "forbidden", "not_found", "conflict", "rate_limited", "payload_too_large", "internal"];
+export type ErrorCode = (typeof ERROR_CODES)[number];
+/**
+ * `as const satisfies` (rather than `: Record<ErrorCode, number>`) keeps the
+ * literal number types instead of widening to `number`, so statusForCode()
+ * below returns a literal union assignable directly to frameworks' typed
+ * status-code parameters (e.g. Hono's ContentfulStatusCode) with no cast.
+ */
+export declare const ERROR_STATUS: {
+    readonly validation_error: 400;
+    readonly unauthorized: 401;
+    readonly forbidden: 403;
+    readonly not_found: 404;
+    readonly conflict: 409;
+    readonly rate_limited: 429;
+    readonly payload_too_large: 413;
+    readonly internal: 500;
+};
+export type Ok<T extends object = object> = {
+    ok: true;
+} & T;
+export type Err = {
+    ok: false;
+    error: string;
+    code: ErrorCode;
+};
+export type Envelope<T extends object = object> = Ok<T> | Err;
+export declare function ok<T extends object>(data: T): Ok<T>;
+export declare function err(code: ErrorCode, error: string): Err;
+export declare function isOk<T extends object>(envelope: Envelope<T>): envelope is Ok<T>;
+export declare function isErr<T extends object>(envelope: Envelope<T>): envelope is Err;
+export declare function statusForCode(code: ErrorCode): (typeof ERROR_STATUS)[ErrorCode];
+//# sourceMappingURL=envelope.d.ts.map

package/dist/shared/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/shared/envelope.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,WAAW,sIASd,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;;;;;;CASqB,CAAC;AAE/C,MAAM,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC;AAE7D,MAAM,MAAM,GAAG,GAAG;IAChB,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AAE9D,wBAAgB,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAEnD;AAED,wBAAgB,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAEvD;AAED,wBAAgB,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAE/E;AAED,wBAAgB,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,GAAG,CAE9E;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,SAAS,CAAC,CAE/E"}

package/dist/shared/envelope.js

@@ -0,0 +1,46 @@
+/**
+ * The response envelope every we8 API speaks: a discriminated union on `ok`,
+ * with a fixed error vocabulary mapped to HTTP status codes.
+ */
+export const ERROR_CODES = [
+    'validation_error',
+    'unauthorized',
+    'forbidden',
+    'not_found',
+    'conflict',
+    'rate_limited',
+    'payload_too_large',
+    'internal',
+];
+/**
+ * `as const satisfies` (rather than `: Record<ErrorCode, number>`) keeps the
+ * literal number types instead of widening to `number`, so statusForCode()
+ * below returns a literal union assignable directly to frameworks' typed
+ * status-code parameters (e.g. Hono's ContentfulStatusCode) with no cast.
+ */
+export const ERROR_STATUS = {
+    validation_error: 400,
+    unauthorized: 401,
+    forbidden: 403,
+    not_found: 404,
+    conflict: 409,
+    rate_limited: 429,
+    payload_too_large: 413,
+    internal: 500,
+};
+export function ok(data) {
+    return { ok: true, ...data };
+}
+export function err(code, error) {
+    return { ok: false, error, code };
+}
+export function isOk(envelope) {
+    return envelope.ok === true;
+}
+export function isErr(envelope) {
+    return envelope.ok === false;
+}
+export function statusForCode(code) {
+    return ERROR_STATUS[code];
+}
+//# sourceMappingURL=envelope.js.map