@we8/cms 0.1.0

package/migrations/0004_analytics.sql

@@ -0,0 +1,42 @@
+-- 0004: the visit and consent logs. High volume and read only in aggregate,
+-- so INTEGER AUTOINCREMENT ids like the other operational tables.
+--
+-- user_agent_class is the 0.1 AEO addition: `is_bot` alone answers "was this a
+-- human", which throws away the distinction AEO is judged on. The class column
+-- keeps an answer engine's crawler separate from a search crawler, a social
+-- unfurler, and an SEO tool, so crawler activity can be read as a signal.
+
+CREATE TABLE page_visits (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  visited_at TEXT NOT NULL DEFAULT (datetime('now')),
+  pathname TEXT NOT NULL,
+  referrer TEXT,
+  country TEXT,
+  ip_hash TEXT,
+  user_agent TEXT,
+  is_bot INTEGER NOT NULL DEFAULT 0,
+  bot_name TEXT,
+  bot_score INTEGER,
+  user_agent_class TEXT NOT NULL DEFAULT 'human',
+  session_id TEXT
+);
+
+CREATE INDEX idx_page_visits_visited_at ON page_visits (visited_at DESC);
+CREATE INDEX idx_page_visits_pathname ON page_visits (pathname);
+CREATE INDEX idx_page_visits_is_bot ON page_visits (is_bot);
+CREATE INDEX idx_page_visits_country ON page_visits (country);
+CREATE INDEX idx_page_visits_ua_class ON page_visits (user_agent_class);
+
+CREATE TABLE consent_records (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  recorded_at TEXT NOT NULL DEFAULT (datetime('now')),
+  session_id TEXT NOT NULL,
+  ip_hash TEXT,
+  decision TEXT NOT NULL CHECK (decision IN ('accepted', 'partial', 'declined')),
+  analytics INTEGER NOT NULL DEFAULT 0,
+  performance INTEGER NOT NULL DEFAULT 0,
+  user_agent TEXT
+);
+
+CREATE INDEX idx_consent_records_recorded_at ON consent_records (recorded_at DESC);
+CREATE INDEX idx_consent_records_decision ON consent_records (decision);

package/migrations/0005_media.sql

@@ -0,0 +1,17 @@
+-- 0005: media metadata. The bytes live in the R2 bucket bound as MEDIA; this
+-- table is the admin-visible record of what is in it. r2_key is unique because
+-- it is the object's address and doubles as the public serve path.
+
+CREATE TABLE media_assets (
+  id TEXT PRIMARY KEY,
+  r2_key TEXT NOT NULL UNIQUE,
+  filename TEXT NOT NULL,
+  content_type TEXT NOT NULL,
+  size INTEGER NOT NULL,
+  width INTEGER,
+  height INTEGER,
+  alt TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX idx_media_assets_created_at ON media_assets (created_at DESC);

package/migrations/0006_site_documents.sql

@@ -0,0 +1,18 @@
+-- 0006: site documents, the small author-written texts served at the site
+-- root. `kind` is the primary key: a fixed vocabulary, one row per kind,
+-- upserted on write. An absent row means "never written", which is the same
+-- meaning as empty content, so no rows are seeded here.
+--
+-- The llms-txt row is also the manual override for the generated /llms.txt:
+-- when it has content, that content is served verbatim instead of the
+-- generated document.
+--
+-- answer_summary is the 0.1 AEO field, the document-level counterpart of a
+-- post's answer summary.
+
+CREATE TABLE site_documents (
+  kind TEXT PRIMARY KEY,
+  content TEXT NOT NULL DEFAULT '',
+  answer_summary TEXT,
+  updated_at TEXT
+);

package/migrations/0007_auth.sql

@@ -0,0 +1,81 @@
+-- 0007: the embedded Better Auth schema, as a plain migration under this
+-- package's own numbering rather than ORM migration tooling. Additive only.
+--
+-- Canonical source of the field list: Better Auth's own model definitions for
+-- the four core tables. No auth plugin is enabled, so there are no plugin
+-- columns here and nothing unused: `role` is this package's own additional
+-- field, carrying 'owner' or 'member'. A Drizzle mirror of these exact columns
+-- lives at src/auth/schema.ts so the Drizzle adapter can build typed queries;
+-- the two are kept in lockstep by hand. To regenerate a reference schema after
+-- a Better Auth version bump, run the CLI against the auth config:
+--   npx @better-auth/cli@latest generate --config src/auth/auth.ts
+--
+-- Column-type decisions: the Drizzle adapter passes native Date and boolean
+-- values straight through, so date fields are INTEGER unix-second timestamps
+-- (Drizzle `mode: 'timestamp'`) and boolean fields are INTEGER 0/1 (Drizzle
+-- `mode: 'boolean'`). Ids are Better Auth's own generated TEXT strings. Column
+-- names are Better Auth's default camelCase, so they intentionally differ from
+-- the snake_case convention of this package's own tables: these four are owned
+-- end to end by the library.
+
+CREATE TABLE user (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  email TEXT NOT NULL UNIQUE,
+  emailVerified INTEGER NOT NULL DEFAULT 0,
+  image TEXT,
+  createdAt INTEGER NOT NULL,
+  updatedAt INTEGER NOT NULL,
+  -- The site role: 'owner' for the first user created, 'member' for everyone
+  -- after. Assigned server-side on user creation and never writable through
+  -- the auth API, so a member cannot promote themselves.
+  role TEXT
+);
+
+CREATE TABLE session (
+  id TEXT PRIMARY KEY,
+  expiresAt INTEGER NOT NULL,
+  token TEXT NOT NULL UNIQUE,
+  createdAt INTEGER NOT NULL,
+  updatedAt INTEGER NOT NULL,
+  ipAddress TEXT,
+  userAgent TEXT,
+  userId TEXT NOT NULL REFERENCES user (id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_session_user ON session (userId);
+
+CREATE TABLE account (
+  id TEXT PRIMARY KEY,
+  -- Who vouches for this identity. For an email and password login it is the
+  -- local credential issuer; for a future social login it is that provider.
+  -- (issuer, accountId) is the identity's unique key.
+  issuer TEXT NOT NULL,
+  accountId TEXT NOT NULL,
+  providerId TEXT NOT NULL,
+  userId TEXT NOT NULL REFERENCES user (id) ON DELETE CASCADE,
+  accessToken TEXT,
+  refreshToken TEXT,
+  idToken TEXT,
+  accessTokenExpiresAt INTEGER,
+  refreshTokenExpiresAt INTEGER,
+  scope TEXT,
+  -- The password hash for the email and password credential account.
+  password TEXT,
+  createdAt INTEGER NOT NULL,
+  updatedAt INTEGER NOT NULL
+);
+
+CREATE INDEX idx_account_user ON account (userId);
+CREATE UNIQUE INDEX idx_account_issuer_account ON account (issuer, accountId);
+
+CREATE TABLE verification (
+  id TEXT PRIMARY KEY,
+  identifier TEXT NOT NULL,
+  value TEXT NOT NULL,
+  expiresAt INTEGER NOT NULL,
+  createdAt INTEGER NOT NULL,
+  updatedAt INTEGER NOT NULL
+);
+
+CREATE INDEX idx_verification_identifier ON verification (identifier);

package/migrations/0008_api_keys.sql

@@ -0,0 +1,20 @@
+-- 0008: public API keys, validated inside this worker.
+--
+-- Only the SHA-256 hash of a key is stored, so the table is not a credential
+-- store: a database dump does not yield usable keys. `prefix` is the
+-- non-secret leading fragment (e.g. `pk_live_a1b2c3d4`) kept purely so a key
+-- list is readable. key_hash is unique because a presented key is resolved by
+-- hash on the public request path, and last_used_at is advisory only.
+
+CREATE TABLE api_keys (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('pk', 'sk')),
+  prefix TEXT NOT NULL,
+  key_hash TEXT NOT NULL UNIQUE,
+  label TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  last_used_at TEXT,
+  revoked_at TEXT
+);
+
+CREATE INDEX idx_api_keys_created ON api_keys (created_at DESC);

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@we8/cms",
+  "version": "0.1.0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/reveriext/we8-package.git",
+    "directory": "packages/cms"
+  },
+  "homepage": "https://github.com/reveriext/we8-package/tree/main/packages/cms#readme",
+  "bugs": "https://github.com/reveriext/we8-package/issues",
+  "type": "module",
+  "description": "The core we8 headless CMS: content, forms, analytics, media, and SEO modules behind a single-site /v1 API with embedded auth.",
+  "keywords": [
+    "we8",
+    "cms",
+    "headless-cms",
+    "cloudflare-workers",
+    "hono",
+    "self-hosted",
+    "aeo",
+    "seo"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "migrations",
+    "scripts",
+    "seed",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "dev": "wrangler dev",
+    "db:migrate": "wrangler d1 migrations apply DB --local",
+    "db:seed": "wrangler d1 execute DB --local --file=./seed/local.sql",
+    "admin:bundle": "node scripts/bundle-admin.mjs",
+    "prepack": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "better-auth": "^1.7.1",
+    "drizzle-orm": "^0.45.2",
+    "hono": "^4.12.27",
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.18.0",
+    "@cloudflare/workers-types": "^5.20260705.1",
+    "vitest": "^4.1.9",
+    "wrangler": "^4.107.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/scripts/bundle-admin.mjs

@@ -0,0 +1,54 @@
+// Copies the built admin portal into this worker's static-asset directory.
+//
+// A tiny node script rather than a shell one-liner, so it behaves the same on
+// every platform a self-hoster might run it from, and so the failure when the
+// portal has not been built yet says what to do about it.
+
+import { cp, mkdir, readdir, rm, stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+// In this workspace the defaults point at the sibling admin package. A
+// scaffolded project passes its own paths instead:
+//   node node_modules/@we8/cms/scripts/bundle-admin.mjs \
+//     --source node_modules/@we8/admin-app/dist --target public
+/** @param {string} flag */
+function argValue(flag) {
+  const at = process.argv.indexOf(flag);
+  return at !== -1 && process.argv[at + 1] ? process.argv[at + 1] : null;
+}
+const source = argValue('--source') ?? join(here, '..', '..', 'admin', 'dist');
+const target = argValue('--target') ?? join(here, '..', 'public');
+const keepName = '.gitkeep';
+
+async function main() {
+  try {
+    const info = await stat(source);
+    if (!info.isDirectory()) throw new Error('not a directory');
+  } catch {
+    console.error(
+      `No admin build at ${source}.\nRun "npm run build --workspace @we8/admin-app" first, or deploy without this step to run API-only.`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  await mkdir(target, { recursive: true });
+
+  // Clear everything but the placeholder, so a stale bundle's hashed files do
+  // not accumulate in the deployed asset set release after release.
+  for (const entry of await readdir(target)) {
+    if (entry === keepName) continue;
+    await rm(join(target, entry), { recursive: true, force: true });
+  }
+
+  // The placeholder is skipped by the clear above and absent from the source,
+  // so it survives every bundle and the directory stays tracked in git.
+  await cp(source, target, { recursive: true });
+
+  console.log(`Bundled the admin portal from ${source} into ${target}.`);
+}
+
+await main();

package/seed/local.sql

@@ -0,0 +1,63 @@
+-- Local development seed. Never run this against a real deployment: the two
+-- API keys below are published in this file, so they are public knowledge.
+--
+-- Settings keys are camelCase, matching the field names in
+-- src/shared/schemas/settings.ts directly.
+
+INSERT INTO site_settings (key, value) VALUES
+  ('allowedOrigins', '["http://localhost:4321","http://localhost:8787"]'),
+  ('modules', '{"content":true,"forms":true,"analytics":true,"media":true,"seo":true}'),
+  ('webhooks', '[]'),
+  ('notifyEmails', '[]'),
+  ('retentionDays', '{"visits":90,"consent":365}'),
+  ('turnstile', '{"enabled":false}'),
+  ('postsPathPrefix', '"/insights"'),
+  ('publisher', '{"name":"Example Site"}'),
+  ('seo', '{"defaultTitle":"Example Site","titleTemplate":"%s | Example Site","metaDescription":"A we8 package development site.","discourageSearchEngines":false}'),
+  ('aeo', '{"siteSummary":"Example Site is a development site for the we8 package, used to exercise the CMS API locally.","llmsTxtEnabled":true,"llmsTxtMaxPosts":100}');
+
+-- One author, credited on the seeded posts.
+INSERT INTO authors (id, slug, name, type, role_title, bio, links) VALUES
+  ('author-sample', 'sam-rivers', 'Sam Rivers', 'team', 'Editor', 'Writes the sample content that ships with the we8 package development seed.', '[]');
+
+-- A published post, complete with the AEO fields, so /v1/posts, the sitemap,
+-- and /llms.txt all have something real to return on a fresh database.
+INSERT INTO posts (id, slug, type, title, excerpt, content, category, tags, status, answer_summary, question_heading, current_version_id, current_version_number, word_count, published_at) VALUES
+  ('post-hello', 'hello-we8', 'blog', 'Hello from the we8 package',
+   'A first post so a fresh local install has something to serve.',
+   '<p>This post ships with the development seed. Edit or delete it once your own content lands.</p>',
+   'Guides', '["welcome","getting-started"]', 'published',
+   'The we8 package is a self-hostable website backend: a headless CMS, an admin portal, an API client, and an Astro integration, deployed on your own account.',
+   'What is the we8 package?',
+   'version-hello-1', 1, 18, datetime('now'));
+
+INSERT INTO post_versions (id, post_id, version, title, excerpt, content, category, tags, answer_summary, question_heading, author_ids, word_count, note) VALUES
+  ('version-hello-1', 'post-hello', 1, 'Hello from the we8 package',
+   'A first post so a fresh local install has something to serve.',
+   '<p>This post ships with the development seed. Edit or delete it once your own content lands.</p>',
+   'Guides', '["welcome","getting-started"]',
+   'The we8 package is a self-hostable website backend: a headless CMS, an admin portal, an API client, and an Astro integration, deployed on your own account.',
+   'What is the we8 package?',
+   '["author-sample"]', 18, 'seeded');
+
+INSERT INTO post_authors (post_id, author_id, position) VALUES ('post-hello', 'author-sample', 0);
+
+-- A never-published draft, so the admin has both states to look at and the AEO
+-- check has a piece of content with real findings on it.
+INSERT INTO posts (id, slug, type, title, content, tags, status) VALUES
+  ('post-draft', 'a-draft-in-progress', 'article', 'A draft in progress',
+   '<p>Unpublished. The AEO check reports this one as missing a description, an answer summary, and a place in the sitemap.</p>',
+   '[]', 'draft');
+
+-- The contact form every starter template posts to.
+INSERT INTO forms (id, form_key, name, type, settings, updated_at) VALUES
+  ('form-contact', 'contact', 'Contact', 'contact', '{"turnstileEnabled":false,"honeypotField":"website"}', datetime('now'));
+
+-- Development API keys. The stored value is the SHA-256 of the secret, exactly
+-- as a minted key is stored; the plaintext is in the comment because this seed
+-- exists to make local curl calls possible.
+--   publishable: pk_live_000000000000000000000000000000000000000000000000
+--   secret:      sk_live_111111111111111111111111111111111111111111111111
+INSERT INTO api_keys (id, kind, prefix, key_hash, label) VALUES
+  ('key-dev-pk', 'pk', 'pk_live_00000000', '53ffa4f3d7ef56f30213fc0c933a79477df3ea269c384fb6676ec21ce93fe867', 'local development (publishable)'),
+  ('key-dev-sk', 'sk', 'sk_live_11111111', '5c11f32033bc37c58021740fd2a50a305d8dc52c5c52b4237962cfca20aa21b0', 'local development (secret)');