@we8/cms 0.1.0

package/dist/auth/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/auth/schema.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYf,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWlB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBlB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOvB,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA2C,CAAC"}

package/dist/auth/schema.js

@@ -0,0 +1,76 @@
+import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
+/**
+ * The Better Auth table shape, expressed as Drizzle SQLite tables.
+ *
+ * This is NOT a second source of truth for the schema: the physical tables are
+ * created by migrations/0007_auth.sql, and these objects only describe those
+ * exact columns so the Better Auth Drizzle adapter can build typed queries
+ * against them. The two are kept in lockstep by hand.
+ *
+ * Column types follow from how the adapter behaves: it passes native Date and
+ * boolean values through to Drizzle rather than pre-serializing them, so date
+ * fields are `integer({ mode: 'timestamp' })` (epoch seconds in, Date out) and
+ * boolean fields are `integer({ mode: 'boolean' })` (0/1 in, boolean out).
+ * Everything else is text, including ids, which are Better Auth's own
+ * generated strings.
+ *
+ * The object KEYS are Better Auth model names (singular), because the adapter
+ * resolves a column as `schema[model][field]`; the string passed to each column
+ * helper is the physical SQL column name, kept identical to the field name.
+ */
+export const user = sqliteTable('user', {
+    id: text('id').primaryKey(),
+    name: text('name').notNull(),
+    email: text('email').notNull().unique(),
+    emailVerified: integer('emailVerified', { mode: 'boolean' }).notNull().default(false),
+    image: text('image'),
+    createdAt: integer('createdAt', { mode: 'timestamp' }).notNull(),
+    updatedAt: integer('updatedAt', { mode: 'timestamp' }).notNull(),
+    // This package's own additional field: 'owner' or 'member'. Declared with
+    // input: false in the auth config, so it is assigned server-side on creation
+    // and unreachable from the account-update endpoint.
+    role: text('role'),
+});
+export const session = sqliteTable('session', {
+    id: text('id').primaryKey(),
+    expiresAt: integer('expiresAt', { mode: 'timestamp' }).notNull(),
+    token: text('token').notNull().unique(),
+    createdAt: integer('createdAt', { mode: 'timestamp' }).notNull(),
+    updatedAt: integer('updatedAt', { mode: 'timestamp' }).notNull(),
+    ipAddress: text('ipAddress'),
+    userAgent: text('userAgent'),
+    userId: text('userId')
+        .notNull()
+        .references(() => user.id, { onDelete: 'cascade' }),
+});
+export const account = sqliteTable('account', {
+    id: text('id').primaryKey(),
+    // Who vouches for this identity: the local credential issuer for an email
+    // and password login. (issuer, accountId) is the identity's unique key.
+    issuer: text('issuer').notNull(),
+    accountId: text('accountId').notNull(),
+    providerId: text('providerId').notNull(),
+    userId: text('userId')
+        .notNull()
+        .references(() => user.id, { onDelete: 'cascade' }),
+    accessToken: text('accessToken'),
+    refreshToken: text('refreshToken'),
+    idToken: text('idToken'),
+    accessTokenExpiresAt: integer('accessTokenExpiresAt', { mode: 'timestamp' }),
+    refreshTokenExpiresAt: integer('refreshTokenExpiresAt', { mode: 'timestamp' }),
+    scope: text('scope'),
+    password: text('password'),
+    createdAt: integer('createdAt', { mode: 'timestamp' }).notNull(),
+    updatedAt: integer('updatedAt', { mode: 'timestamp' }).notNull(),
+});
+export const verification = sqliteTable('verification', {
+    id: text('id').primaryKey(),
+    identifier: text('identifier').notNull(),
+    value: text('value').notNull(),
+    expiresAt: integer('expiresAt', { mode: 'timestamp' }).notNull(),
+    createdAt: integer('createdAt', { mode: 'timestamp' }).notNull(),
+    updatedAt: integer('updatedAt', { mode: 'timestamp' }).notNull(),
+});
+/** The single object handed to `drizzleAdapter(db, { schema })`. */
+export const authSchema = { user, session, account, verification };
+//# sourceMappingURL=schema.js.map

package/dist/auth/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/auth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE;IACtC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,aAAa,EAAE,OAAO,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,0EAA0E;IAC1E,6EAA6E;IAC7E,oDAAoD;IACpD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE;IAC5C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;IAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;SACnB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE;IAC5C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACtC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;SACnB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;IAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;IACxB,oBAAoB,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC5E,qBAAqB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9E,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACjE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,cAAc,EAAE;IACtD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IAChE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACjE,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/env.d.ts

@@ -0,0 +1,64 @@
+import { type SiteSettings, type SiteSettingsUpdateInput } from './shared/index.js';
+/**
+ * Everything this worker consumes from its environment. One site, one
+ * database, one bucket: there is no tenant id, no dispatch namespace, and no
+ * control plane, because there is nothing above this worker to belong to.
+ */
+export interface Bindings {
+    /** The site's D1 database. Content, forms, analytics, auth, and keys all live here. */
+    DB: D1Database;
+    /** The site's R2 bucket, holding uploaded media bytes. */
+    MEDIA: R2Bucket;
+    /**
+     * The built admin portal, served from this same worker. Optional: a headless
+     * install deploys with an empty assets directory and runs API-only, and the
+     * SPA fallback in src/spa.ts stands down when there is nothing behind this.
+     */
+    ASSETS?: Fetcher;
+    /** The public origin of the site this CMS backs, e.g. `https://example.com`. */
+    SITE_URL: string;
+    /** The version string reported by /v1/health. Set from the package version at deploy time. */
+    CMS_VERSION: string;
+    /**
+     * The secret Better Auth signs sessions with. A deployment MUST set this;
+     * `wrangler secret put BETTER_AUTH_SECRET` in production, `.dev.vars`
+     * locally. Sign-in is refused when it is missing rather than falling back to
+     * a default, because a predictable session secret is a forged session.
+     */
+    BETTER_AUTH_SECRET?: string;
+    /**
+     * The origin Better Auth builds its own URLs from and trusts as an origin.
+     * Defaults to SITE_URL, which is correct when the CMS and the site share an
+     * origin; set it when the admin lives somewhere else.
+     */
+    AUTH_URL?: string;
+    /** Optional. Only enforced for forms with settings.turnstileEnabled. */
+    TURNSTILE_SECRET?: string;
+    /**
+     * Which EmailSender to resolve: `console` logs the message, anything else
+     * (including unset) drops it. The Cloudflare pack supplies a real sender.
+     */
+    EMAIL_MODE?: string;
+    /** The from-address a real sender uses. Carried here so the seam is configured in one place. */
+    EMAIL_FROM?: string;
+}
+/**
+ * Loads site settings from the site_settings key/value table, validated and
+ * defaulted through siteSettingsSchema, cached in memory for 60s per isolate.
+ * Every module reads its configuration through this one function, so a fresh
+ * database with no settings rows still yields a fully-formed settings object.
+ */
+export declare function getSettings(db: D1Database, now?: number): Promise<SiteSettings>;
+/**
+ * Persists a partial settings update. Shallow-merges onto the current settings
+ * (each top-level key is one site_settings row, so a changed `modules` or
+ * `webhooks` value replaces that whole row; this matches the read side, which
+ * reassembles the full object one row per key), re-validates the merged result
+ * through the same schema `getSettings` uses, then writes every key back and
+ * refreshes the in-isolate cache immediately so a follow-up read in the same
+ * request never sees stale data for the rest of the 60s TTL.
+ */
+export declare function setSettings(db: D1Database, patch: SiteSettingsUpdateInput, now?: number): Promise<SiteSettings>;
+/** Test-only: clears the module-scope cache between test cases. */
+export declare function clearSettingsCacheForTests(): void;
+//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAExG;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,uFAAuF;IACvF,EAAE,EAAE,UAAU,CAAC;IACf,0DAA0D;IAC1D,KAAK,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAiBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBjG;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,uBAAuB,EAC9B,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED,mEAAmE;AACnE,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/env.js

@@ -0,0 +1,48 @@
+import { siteSettingsSchema } from './shared/index.js';
+const SETTINGS_CACHE_TTL_MS = 60_000;
+/** Per-isolate cache; module-scope state is the standard Workers pattern for this. */
+let cache = null;
+/**
+ * Loads site settings from the site_settings key/value table, validated and
+ * defaulted through siteSettingsSchema, cached in memory for 60s per isolate.
+ * Every module reads its configuration through this one function, so a fresh
+ * database with no settings rows still yields a fully-formed settings object.
+ */
+export async function getSettings(db, now = Date.now()) {
+    if (cache && cache.expiresAt > now) {
+        return cache.value;
+    }
+    const { results } = await db
+        .prepare('SELECT key, value FROM site_settings')
+        .all();
+    const raw = {};
+    for (const row of results) {
+        raw[row.key] = JSON.parse(row.value);
+    }
+    const value = siteSettingsSchema.parse(raw);
+    cache = { value, expiresAt: now + SETTINGS_CACHE_TTL_MS };
+    return value;
+}
+/**
+ * Persists a partial settings update. Shallow-merges onto the current settings
+ * (each top-level key is one site_settings row, so a changed `modules` or
+ * `webhooks` value replaces that whole row; this matches the read side, which
+ * reassembles the full object one row per key), re-validates the merged result
+ * through the same schema `getSettings` uses, then writes every key back and
+ * refreshes the in-isolate cache immediately so a follow-up read in the same
+ * request never sees stale data for the rest of the 60s TTL.
+ */
+export async function setSettings(db, patch, now = Date.now()) {
+    const current = await getSettings(db, now);
+    const merged = siteSettingsSchema.parse({ ...current, ...patch });
+    await db.batch(Object.entries(merged).map(([key, value]) => db
+        .prepare('INSERT OR REPLACE INTO site_settings (key, value) VALUES (?1, ?2)')
+        .bind(key, JSON.stringify(value))));
+    cache = { value: merged, expiresAt: now + SETTINGS_CACHE_TTL_MS };
+    return merged;
+}
+/** Test-only: clears the module-scope cache between test cases. */
+export function clearSettingsCacheForTests() {
+    cache = null;
+}
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAmD,MAAM,mBAAmB,CAAC;AAmDxG,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,sFAAsF;AACtF,IAAI,KAAK,GAA8B,IAAI,CAAC;AAO5C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACxE,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACzB,OAAO,CAAC,sCAAsC,CAAC;SAC/C,GAAG,EAAkB,CAAC;IAEzB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAc,EACd,KAA8B,EAC9B,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAElE,MAAM,EAAE,CAAC,KAAK,CACZ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC1C,EAAE;SACC,OAAO,CAAC,mEAAmE,CAAC;SAC5E,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACpC,CACF,CAAC;IAEF,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,0BAA0B;IACxC,KAAK,GAAG,IAAI,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+import { Hono } from 'hono';
+import { type Bindings } from './env.js';
+import { type KeyVariables } from './keys/middleware.js';
+import { type AuthVariables } from './middleware/auth.js';
+import { type RequestIdVariables } from './middleware/request-id.js';
+/**
+ * The email seam, re-exported so a composed worker can plug a pack's sender in
+ * without reaching into the package's internals. A scaffolded project calls
+ * `registerEmailSender(cloudflareEmailSender)` at module scope and is done.
+ */
+export { registerEmailSender, type EmailMessage, type EmailSender, type EmailSenderFactory, } from './lib/email.js';
+type Variables = RequestIdVariables & AuthVariables & KeyVariables;
+export declare const app: Hono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, import("hono/types").BlankSchema, "/">;
+declare const _default: {
+    fetch: (request: Request, env?: {} | Bindings | undefined, executionCtx?: import("hono").ExecutionContext) => Response | Promise<Response>;
+    scheduled(_controller: ScheduledController, env: Bindings, _ctx: ExecutionContext<unknown>): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAItD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAqBhF;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAExB,KAAK,SAAS,GAAG,kBAAkB,GAAG,aAAa,GAAG,YAAY,CAAC;AAKnE,eAAO,MAAM,GAAG;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;;;;;AA+I5E,wBASsC"}

package/dist/index.js

@@ -0,0 +1,170 @@
+import { Hono } from 'hono';
+import { createMiddleware } from 'hono/factory';
+import { ok } from './shared/index.js';
+import { AUTH_BASE_PATH, createAuth, isBootstrapOpen } from './auth/auth.js';
+import { usersAdminRoutes } from './auth/routes.admin.js';
+import { getSettings } from './env.js';
+import { HttpError, errorBoundary, notFoundHandler } from './lib/errors.js';
+import { runRetentionCleanup } from './lib/retention.js';
+import { keysAdminRoutes } from './keys/routes.admin.js';
+import { publicApiAuth } from './keys/middleware.js';
+import { sessionAuth } from './middleware/auth.js';
+import { corsMiddleware } from './middleware/cors.js';
+import { moduleGate } from './middleware/module-gate.js';
+import { requestId } from './middleware/request-id.js';
+import { aeoAdminRoutes } from './modules/aeo/routes.admin.js';
+import { resolveLlmsTxt } from './modules/aeo/llms.js';
+import { analyticsAdminRoutes } from './modules/analytics/routes.admin.js';
+import { analyticsPublicRoutes } from './modules/analytics/routes.public.js';
+import { authorsAdminRoutes } from './modules/authors/routes.admin.js';
+import { authorsPublicRoutes } from './modules/authors/routes.public.js';
+import { contentAdminRoutes } from './modules/content/routes.admin.js';
+import { contentPublicRoutes } from './modules/content/routes.public.js';
+import { formsAdminRoutes } from './modules/forms/forms-routes.admin.js';
+import { formsPublicRoutes } from './modules/forms/routes.public.js';
+import { submissionsAdminRoutes } from './modules/forms/submissions-routes.admin.js';
+import { mediaAdminRoutes } from './modules/media/routes.admin.js';
+import { mediaPublicRoutes } from './modules/media/routes.public.js';
+import { buildOpenApiSpec } from './modules/openapi/spec.js';
+import { seoPublicRoutes } from './modules/seo/routes.public.js';
+import { serveSpaShell } from './spa.js';
+import { settingsAdminRoutes } from './modules/settings/routes.admin.js';
+import { siteDocumentsAdminRoutes } from './modules/site-documents/routes.admin.js';
+import { siteDocumentsPublicRoutes } from './modules/site-documents/routes.public.js';
+/**
+ * The email seam, re-exported so a composed worker can plug a pack's sender in
+ * without reaching into the package's internals. A scaffolded project calls
+ * `registerEmailSender(cloudflareEmailSender)` at module scope and is done.
+ */
+export { registerEmailSender, } from './lib/email.js';
+// Named export as well as default, so tests can call app.request(...) directly:
+// the default export is the plain {fetch, scheduled} object Cloudflare's module
+// Worker format expects, which has no .request() of its own.
+export const app = new Hono();
+app.onError(errorBoundary);
+/**
+ * Nothing matched a route. When an admin bundle is bound as static assets,
+ * a document request for one of its client-side routes gets the SPA shell;
+ * everything else, including every API path, keeps the envelope 404 it has
+ * always had. See src/spa.ts for why the fallback is this narrow.
+ */
+app.notFound(async (c) => (await serveSpaShell(c.req.raw, c.env)) ?? notFoundHandler(c));
+app.use('*', requestId);
+// ---------------------------------------------------------------------------
+// Embedded auth
+// ---------------------------------------------------------------------------
+/**
+ * Public sign-up is open exactly once, to create the first user, who becomes
+ * the owner. After that this closes and further accounts are created by the
+ * owner through /v1/admin/users.
+ *
+ * Gating at the HTTP layer rather than through the library's own disableSignUp
+ * is deliberate: the flag is static, the condition is not, and the owner's
+ * account-creation route needs the same underlying sign-up path to stay open
+ * server-side. One rule, applied where the request arrives.
+ */
+const bootstrapGate = createMiddleware(async (c, next) => {
+    if (!(await isBootstrapOpen(c.env.DB))) {
+        throw new HttpError('forbidden', 'sign-up is closed; ask an owner for an account');
+    }
+    await next();
+});
+app.use(`${AUTH_BASE_PATH}/*`, corsMiddleware('admin'));
+app.use(`${AUTH_BASE_PATH}/sign-up/*`, bootstrapGate);
+app.all(`${AUTH_BASE_PATH}/*`, async (c) => {
+    if (!c.env.BETTER_AUTH_SECRET) {
+        throw new HttpError('internal', 'BETTER_AUTH_SECRET is not configured');
+    }
+    return createAuth(c.env).handler(c.req.raw);
+});
+// ---------------------------------------------------------------------------
+// Gates
+// ---------------------------------------------------------------------------
+app.use('/v1/*', publicApiAuth);
+app.use('/v1/admin/*', corsMiddleware('admin'), sessionAuth);
+// ---------------------------------------------------------------------------
+// Meta
+// ---------------------------------------------------------------------------
+app.use('/v1/health', corsMiddleware('publicRead'));
+app.get('/v1/health', async (c) => {
+    const settings = await getSettings(c.env.DB);
+    return c.json(ok({ cmsVersion: c.env.CMS_VERSION, modules: settings.modules }));
+});
+// Self-describing API: keyless, so any developer can read the contract before
+// they have a key. Not module-gated either; it documents whatever is enabled
+// and is cheap and static.
+app.use('/v1/openapi.json', corsMiddleware('publicRead'));
+app.get('/v1/openapi.json', (c) => c.json(buildOpenApiSpec(c.env.SITE_URL)));
+/**
+ * The AEO document, at the root path answer engines actually look for. Served
+ * from the authored site document when there is one, otherwise generated from
+ * settings and published content; 404 when a site has turned it off, because
+ * an empty file would claim the site has nothing to say.
+ */
+app.use('/llms.txt', corsMiddleware('publicRead'));
+app.get('/llms.txt', async (c) => {
+    const body = await resolveLlmsTxt(c.env.DB, c.env.SITE_URL);
+    if (body === null)
+        throw new HttpError('not_found', 'not found');
+    return c.body(body, 200, {
+        'Content-Type': 'text/plain; charset=UTF-8',
+        'Cache-Control': 'public, max-age=900',
+    });
+});
+// ---------------------------------------------------------------------------
+// Module gates
+// ---------------------------------------------------------------------------
+// Authors gate on the content flag: a byline is part of content, and there is
+// no separate authors module. Admin routes get the same gate as their public
+// counterpart, since a module turned off entirely has no reason to leave its
+// management API reachable.
+app.use('/v1/posts/*', moduleGate('content'));
+app.use('/v1/authors/*', moduleGate('content'));
+app.use('/v1/admin/posts/*', moduleGate('content'));
+app.use('/v1/admin/authors/*', moduleGate('content'));
+app.use('/v1/sitemap.xml', moduleGate('seo'));
+app.use('/v1/forms/*', moduleGate('forms'));
+app.use('/v1/admin/forms/*', moduleGate('forms'));
+app.use('/v1/admin/submissions/*', moduleGate('forms'));
+app.use('/v1/events/*', moduleGate('analytics'));
+app.use('/v1/admin/visits', moduleGate('analytics'));
+app.use('/v1/admin/visits/stats', moduleGate('analytics'));
+app.use('/v1/admin/consent/stats', moduleGate('analytics'));
+app.use('/v1/media/*', moduleGate('media'));
+app.use('/v1/admin/media/*', moduleGate('media'));
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+app.route('/v1/posts', contentPublicRoutes);
+app.route('/v1/authors', authorsPublicRoutes);
+app.route('/v1/admin/posts', contentAdminRoutes);
+app.route('/v1/admin/authors', authorsAdminRoutes);
+app.route('/v1', seoPublicRoutes);
+app.route('/v1/forms', formsPublicRoutes);
+app.route('/v1/admin/forms', formsAdminRoutes);
+app.route('/v1/admin/submissions', submissionsAdminRoutes);
+app.route('/v1/events', analyticsPublicRoutes);
+// Bare /v1/admin, not /v1/admin/analytics: these endpoints are /visits,
+// /visits/stats, and /consent/stats with no module-name segment. app.route only
+// prepends this prefix to the router's own sub-paths, so it cannot swallow the
+// other /v1/admin mounts around it.
+app.route('/v1/admin', analyticsAdminRoutes);
+app.route('/v1/media', mediaPublicRoutes);
+app.route('/v1/admin/media', mediaAdminRoutes);
+app.route('/v1/admin/settings', settingsAdminRoutes);
+app.route('/v1/documents', siteDocumentsPublicRoutes);
+app.route('/v1/admin/documents', siteDocumentsAdminRoutes);
+app.route('/v1/admin/aeo', aeoAdminRoutes);
+app.route('/v1/admin/keys', keysAdminRoutes);
+app.route('/v1/admin/users', usersAdminRoutes);
+export default {
+    fetch: app.fetch,
+    // The daily retention sweep. The schedule is configured in wrangler.jsonc's
+    // triggers.crons.
+    async scheduled(_controller, env, _ctx) {
+        const settings = await getSettings(env.DB);
+        const result = await runRetentionCleanup(env.DB, settings.retentionDays);
+        console.log(`[retention] cleanup complete: ${JSON.stringify(result)}`);
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAiB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAsB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,SAAS,EAA2B,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF;;;;GAIG;AACH,OAAO,EACL,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AAIxB,gFAAgF;AAChF,gFAAgF;AAChF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgD,CAAC;AAE5E,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAE3B;;;;;GAKG;AACH,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAExB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,gBAAgB,CAAyB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC/E,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gDAAgD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACxD,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,YAAY,EAAE,aAAa,CAAC,CAAC;AAEtD,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAChC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;AAE7D,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AACpD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,2BAA2B;AAC3B,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AACnD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,cAAc,EAAE,2BAA2B;QAC3C,eAAe,EAAE,qBAAqB;KACvC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,4BAA4B;AAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACpD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACtD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAE9C,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAClD,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACjD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACrD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3D,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AAE5D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAElD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC5C,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;AAC9C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AACjD,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AACnD,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AAElC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAC/C,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;AAE3D,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;AAC/C,wEAAwE;AACxE,gFAAgF;AAChF,+EAA+E;AAC/E,oCAAoC;AACpC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AAE7C,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/C,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAErD,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;AACtD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;AAE3D,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AAC3C,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;AAC7C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/C,eAAe;IACb,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,4EAA4E;IAC5E,kBAAkB;IAClB,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI;QACpC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;CACkC,CAAC"}

package/dist/keys/middleware.d.ts

@@ -0,0 +1,54 @@
+import { type ApiKeyKind } from '../shared/index.js';
+import type { Bindings } from '../env.js';
+export type KeyVariables = {
+    /** The kind of key this public request presented, once one has been validated. */
+    keyKind: ApiKeyKind;
+};
+/**
+ * Key validation for the public API, done inside this worker.
+ *
+ * In managed we8 the dispatch router validates the key before a request ever
+ * reaches a tenant, and the engine simply trusts what arrives. Standalone,
+ * this worker IS the front door, so the same pk/sk dialect is resolved here:
+ * the presented secret is hashed and looked up, an unknown or revoked key is
+ * a 401, and the resolved kind is put on the context for anything that cares.
+ *
+ * A handful of routes are deliberately keyless (see KEYLESS_PUBLIC_ROUTES in
+ * src/index.ts) and never mount this.
+ */
+export declare const publicKeyAuth: import("hono").MiddlewareHandler<{
+    Bindings: Bindings;
+    Variables: KeyVariables;
+}, string, {}, Response>;
+/**
+ * The public routes that need no key.
+ *
+ * Each one is keyless because its reader cannot hold a key. A crawler fetching
+ * the sitemap has no credential to present; an image in published HTML cannot
+ * carry a rotating secret without every historical page breaking on the next
+ * rotation; health and the OpenAPI document exist to be discovered before
+ * anyone has a key at all.
+ *
+ * Treat the media exemption as irreversible: once keyless media URLs are in
+ * published content, re-gating them breaks that content permanently.
+ */
+export declare function isKeylessPublicRoute(method: string, pathname: string): boolean;
+/**
+ * The gate mounted across /v1/*. Admin routes fall through untouched: they are
+ * gated by session instead, and an API key presented on one is refused
+ * outright (see middleware/auth.ts).
+ */
+export declare const publicApiAuth: import("hono").MiddlewareHandler<{
+    Bindings: Bindings;
+    Variables: KeyVariables;
+}, string, {}, Response>;
+/**
+ * Narrows an already-validated public request to a secret key. A publishable
+ * key travels in browser code by design, so anything a `pk_` holder must not
+ * be able to do mounts this behind publicKeyAuth.
+ */
+export declare const requireSecretKey: import("hono").MiddlewareHandler<{
+    Bindings: Bindings;
+    Variables: KeyVariables;
+}, string, {}, Response>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/keys/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/keys/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1C,MAAM,MAAM,YAAY,GAAG;IACzB,kFAAkF;IAClF,OAAO,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa;cAAgC,QAAQ;eAAa,YAAY;wBAe1F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO9E;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa;cAAgC,QAAQ;eAAa,YAAY;wBAa1F,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;cAAgC,QAAQ;eAAa,YAAY;wBAO7F,CAAC"}

package/dist/keys/middleware.js

@@ -0,0 +1,84 @@
+import { createMiddleware } from 'hono/factory';
+import { sha256Hex } from '../shared/index.js';
+import { HttpError } from '../lib/errors.js';
+import { extractApiKey, lookupApiKeyByHash } from './service.js';
+/**
+ * Key validation for the public API, done inside this worker.
+ *
+ * In managed we8 the dispatch router validates the key before a request ever
+ * reaches a tenant, and the engine simply trusts what arrives. Standalone,
+ * this worker IS the front door, so the same pk/sk dialect is resolved here:
+ * the presented secret is hashed and looked up, an unknown or revoked key is
+ * a 401, and the resolved kind is put on the context for anything that cares.
+ *
+ * A handful of routes are deliberately keyless (see KEYLESS_PUBLIC_ROUTES in
+ * src/index.ts) and never mount this.
+ */
+export const publicKeyAuth = createMiddleware(async (c, next) => {
+    const presented = extractApiKey(c);
+    if (!presented) {
+        throw new HttpError('unauthorized', 'missing API key');
+    }
+    const resolved = await lookupApiKeyByHash(c.env.DB, await sha256Hex(presented));
+    if (!resolved || resolved.revoked) {
+        throw new HttpError('unauthorized', 'unknown or revoked API key');
+    }
+    c.set('keyKind', resolved.kind);
+    await next();
+});
+/**
+ * The public routes that need no key.
+ *
+ * Each one is keyless because its reader cannot hold a key. A crawler fetching
+ * the sitemap has no credential to present; an image in published HTML cannot
+ * carry a rotating secret without every historical page breaking on the next
+ * rotation; health and the OpenAPI document exist to be discovered before
+ * anyone has a key at all.
+ *
+ * Treat the media exemption as irreversible: once keyless media URLs are in
+ * published content, re-gating them breaks that content permanently.
+ */
+export function isKeylessPublicRoute(method, pathname) {
+    const isRead = method === 'GET' || method === 'HEAD';
+    if (!isRead)
+        return false;
+    if (pathname === '/v1/health')
+        return true;
+    if (pathname === '/v1/openapi.json')
+        return true;
+    if (pathname === '/v1/sitemap.xml')
+        return true;
+    return pathname.startsWith('/v1/media/');
+}
+/**
+ * The gate mounted across /v1/*. Admin routes fall through untouched: they are
+ * gated by session instead, and an API key presented on one is refused
+ * outright (see middleware/auth.ts).
+ */
+export const publicApiAuth = createMiddleware(async (c, next) => {
+    // A CORS preflight can never present the key it is asking permission to
+    // send: the browser strips custom headers and credentials from OPTIONS.
+    // Demanding one here would 401 every cross-origin browser call before
+    // route-level CORS could answer, so the preflight passes through and the
+    // key check runs on the real request that follows it.
+    if (c.req.method === 'OPTIONS')
+        return next();
+    const pathname = new URL(c.req.url).pathname;
+    if (pathname.startsWith('/v1/admin'))
+        return next();
+    if (isKeylessPublicRoute(c.req.method, pathname))
+        return next();
+    return publicKeyAuth(c, next);
+});
+/**
+ * Narrows an already-validated public request to a secret key. A publishable
+ * key travels in browser code by design, so anything a `pk_` holder must not
+ * be able to do mounts this behind publicKeyAuth.
+ */
+export const requireSecretKey = createMiddleware(async (c, next) => {
+    if (c.get('keyKind') !== 'sk') {
+        throw new HttpError('forbidden', 'this endpoint requires a secret key');
+    }
+    await next();
+});
+//# sourceMappingURL=middleware.js.map

package/dist/keys/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/keys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAC3C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,QAAQ,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAC3C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACpD,IAAI,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAChE,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAC9C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC"}

package/dist/keys/routes.admin.d.ts

@@ -0,0 +1,16 @@
+import { Hono } from 'hono';
+import type { Bindings } from '../env.js';
+import { type AuthVariables } from '../middleware/auth.js';
+/**
+ * API key management, owner-only.
+ *
+ * A key is site-wide credentials, and a secret key is a standing grant to
+ * whoever holds it, so minting and revoking sit with the owner rather than
+ * with every editor. The list is safe to read but stays behind the same gate:
+ * splitting the two would only mean two rules to remember.
+ */
+export declare const keysAdminRoutes: Hono<{
+    Bindings: Bindings;
+    Variables: AuthVariables;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/keys/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/keys/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGzE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;cAAwB,QAAQ;eAAa,aAAa;yCAAK,CAAC"}

package/dist/keys/routes.admin.js

@@ -0,0 +1,34 @@
+import { Hono } from 'hono';
+import { apiKeyCreateInputSchema, ok } from '../shared/index.js';
+import { parseOrThrow } from '../lib/validate.js';
+import { requireOwner } from '../middleware/auth.js';
+import { createApiKey, listApiKeys, revokeApiKey } from './service.js';
+/**
+ * API key management, owner-only.
+ *
+ * A key is site-wide credentials, and a secret key is a standing grant to
+ * whoever holds it, so minting and revoking sit with the owner rather than
+ * with every editor. The list is safe to read but stays behind the same gate:
+ * splitting the two would only mean two rules to remember.
+ */
+export const keysAdminRoutes = new Hono();
+keysAdminRoutes.use('*', requireOwner);
+keysAdminRoutes.get('/', async (c) => {
+    const items = await listApiKeys(c.env.DB);
+    return c.json(ok({ items }));
+});
+/**
+ * The one response in this API that carries a secret. The plaintext exists
+ * here and nowhere else, ever again, so the admin must show it once and say
+ * so; every later read returns the prefix only.
+ */
+keysAdminRoutes.post('/', async (c) => {
+    const input = parseOrThrow(apiKeyCreateInputSchema, await c.req.json());
+    const key = await createApiKey(c.env.DB, input.kind, input.label);
+    return c.json(ok({ key }), 201);
+});
+keysAdminRoutes.delete('/:id', async (c) => {
+    const key = await revokeApiKey(c.env.DB, c.req.param('id'));
+    return c.json(ok({ key }));
+});
+//# sourceMappingURL=routes.admin.js.map

package/dist/keys/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/keys/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAsB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAoD,CAAC;AAE5F,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAEvC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC"}