@we8/cms 0.1.0

package/dist/keys/service.d.ts

@@ -0,0 +1,36 @@
+import { type ApiKeyKind, type ApiKeySummary, type IssuedApiKey } from '../shared/index.js';
+import type { Context } from 'hono';
+/** What the public-route middleware needs from a presented key. */
+export interface ApiKeyLookup {
+    keyId: string;
+    kind: ApiKeyKind;
+    revoked: boolean;
+}
+/**
+ * Issues a key. The plaintext secret is returned exactly once, here; only its
+ * SHA-256 hash is written, so nothing later can recover it, including this
+ * code. The caller is responsible for showing it to the admin once.
+ */
+export declare function createApiKey(db: D1Database, kind: ApiKeyKind, label: string | undefined): Promise<IssuedApiKey>;
+export declare function listApiKeys(db: D1Database): Promise<ApiKeySummary[]>;
+/**
+ * Revokes a key. Idempotent: revoking an already-revoked key is a success,
+ * because the key IS revoked; only an unknown id is an error. The row stays so
+ * the admin can see that a key existed and when it stopped working.
+ */
+export declare function revokeApiKey(db: D1Database, keyId: string): Promise<ApiKeySummary>;
+/**
+ * Resolves a presented key by its hash. There is no cache: managed we8 caches
+ * this because a control plane fronts thousands of tenants, whereas here the
+ * lookup is one indexed read against the site's own database, and a cache
+ * would only buy a revoked key extra minutes of life.
+ */
+export declare function lookupApiKeyByHash(db: D1Database, keyHash: string): Promise<ApiKeyLookup | null>;
+/**
+ * The presented key, in any of the conventions the we8 dialect accepts: an
+ * `sk_` as `Authorization: Bearer`, a `pk_` in the `X-We8-Key` header, or a
+ * `?key=` query parameter for the cases where a header cannot be set. First
+ * one present wins, in that order.
+ */
+export declare function extractApiKey(c: Context): string | undefined;
+//# sourceMappingURL=service.d.ts.map

package/dist/keys/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/keys/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AA8CD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,YAAY,CAAC,CAavB;AAcD,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAU1E;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAOxF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmB9B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM5D"}

package/dist/keys/service.js

@@ -0,0 +1,120 @@
+import { sha256Hex } from '../shared/index.js';
+import { HttpError } from '../lib/errors.js';
+function toSummary(row) {
+    return {
+        id: row.id,
+        kind: row.kind,
+        prefix: row.prefix,
+        label: row.label,
+        createdAt: row.created_at,
+        lastUsedAt: row.last_used_at,
+        revokedAt: row.revoked_at,
+    };
+}
+function randomHex(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Mints a bearer secret in the managed we8 dialect (`pk_live_...` /
+ * `sk_live_...`) plus its non-secret display prefix, and hashes it for
+ * storage. 24 random bytes, so guessing is not a strategy.
+ */
+async function mintKey(kind) {
+    const secret = `${kind}_live_${randomHex(24)}`;
+    const prefix = secret.slice(0, `${kind}_live_`.length + 8);
+    const keyHash = await sha256Hex(secret);
+    return { secret, prefix, keyHash };
+}
+/**
+ * Issues a key. The plaintext secret is returned exactly once, here; only its
+ * SHA-256 hash is written, so nothing later can recover it, including this
+ * code. The caller is responsible for showing it to the admin once.
+ */
+export async function createApiKey(db, kind, label) {
+    const { secret, prefix, keyHash } = await mintKey(kind);
+    const id = crypto.randomUUID();
+    await db
+        .prepare(`INSERT INTO api_keys (id, kind, prefix, key_hash, label) VALUES (?1, ?2, ?3, ?4, ?5)`)
+        .bind(id, kind, prefix, keyHash, label ?? null)
+        .run();
+    const row = await fetchApiKeyRow(db, id);
+    return { ...toSummary(row), secret };
+}
+async function fetchApiKeyRow(db, id) {
+    const row = await db
+        .prepare(`SELECT id, kind, prefix, label, created_at, last_used_at, revoked_at
+         FROM api_keys WHERE id = ?1`)
+        .bind(id)
+        .first();
+    if (!row)
+        throw new HttpError('not_found', 'api key not found');
+    return row;
+}
+export async function listApiKeys(db) {
+    // created_at has second resolution and two keys are often minted in the same
+    // second, so rowid (SQLite's implicit insertion order) breaks the tie.
+    const { results } = await db
+        .prepare(`SELECT id, kind, prefix, label, created_at, last_used_at, revoked_at
+         FROM api_keys ORDER BY created_at DESC, rowid DESC`)
+        .all();
+    return results.map(toSummary);
+}
+/**
+ * Revokes a key. Idempotent: revoking an already-revoked key is a success,
+ * because the key IS revoked; only an unknown id is an error. The row stays so
+ * the admin can see that a key existed and when it stopped working.
+ */
+export async function revokeApiKey(db, keyId) {
+    await fetchApiKeyRow(db, keyId);
+    await db
+        .prepare(`UPDATE api_keys SET revoked_at = datetime('now') WHERE id = ?1 AND revoked_at IS NULL`)
+        .bind(keyId)
+        .run();
+    return toSummary(await fetchApiKeyRow(db, keyId));
+}
+/**
+ * Resolves a presented key by its hash. There is no cache: managed we8 caches
+ * this because a control plane fronts thousands of tenants, whereas here the
+ * lookup is one indexed read against the site's own database, and a cache
+ * would only buy a revoked key extra minutes of life.
+ */
+export async function lookupApiKeyByHash(db, keyHash) {
+    const row = await db
+        .prepare(`SELECT id, kind, revoked_at FROM api_keys WHERE key_hash = ?1`)
+        .bind(keyHash)
+        .first();
+    if (!row)
+        return null;
+    // Advisory only, and on the hot path for every public request: a failure
+    // writing it must never turn a valid call into a 500.
+    try {
+        await db
+            .prepare(`UPDATE api_keys SET last_used_at = datetime('now') WHERE id = ?1`)
+            .bind(row.id)
+            .run();
+    }
+    catch {
+        // ignore: the resolved key is what matters
+    }
+    return { keyId: row.id, kind: row.kind, revoked: row.revoked_at !== null };
+}
+/**
+ * The presented key, in any of the conventions the we8 dialect accepts: an
+ * `sk_` as `Authorization: Bearer`, a `pk_` in the `X-We8-Key` header, or a
+ * `?key=` query parameter for the cases where a header cannot be set. First
+ * one present wins, in that order.
+ */
+export function extractApiKey(c) {
+    const auth = c.req.header('Authorization');
+    if (auth?.startsWith('Bearer '))
+        return auth.slice('Bearer '.length);
+    const headerKey = c.req.header('X-We8-Key');
+    if (headerKey)
+        return headerKey;
+    return c.req.query('key') ?? undefined;
+}
+//# sourceMappingURL=service.js.map

package/dist/keys/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/keys/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA0D,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAoB7C,SAAS,SAAS,CAAC,GAAc;IAC/B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,IAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,IAAI,SAAS,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAc,EACd,IAAgB,EAChB,KAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAE/B,MAAM,EAAE;SACL,OAAO,CACN,sFAAsF,CACvF;SACA,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;SAC9C,GAAG,EAAE,CAAC;IAET,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAc,EAAE,EAAU;IACtD,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CACN;qCAC+B,CAChC;SACA,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,EAAa,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc;IAC9C,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACzB,OAAO,CACN;4DACsD,CACvD;SACA,GAAG,EAAa,CAAC;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAc,EAAE,KAAa;IAC9D,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAChC,MAAM,EAAE;SACL,OAAO,CAAC,uFAAuF,CAAC;SAChG,IAAI,CAAC,KAAK,CAAC;SACX,GAAG,EAAE,CAAC;IACT,OAAO,SAAS,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAc,EACd,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CAAC,+DAA+D,CAAC;SACxE,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,EAA+D,CAAC;IACxE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,EAAE;aACL,OAAO,CAAC,kEAAkE,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;aACZ,GAAG,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AACzC,CAAC"}

package/dist/lib/bots.d.ts

@@ -0,0 +1,24 @@
+/**
+ * User-agent classification for the visit beacon.
+ *
+ * The pattern list is the merged one managed we8 uses, with one addition that
+ * matters for 0.1: every entry also declares a CLASS. A single is-bot boolean
+ * answers "was this a human", which is the wrong question for AEO work, where
+ * the thing worth watching is specifically an answer engine reading the site.
+ * Keeping GPTBot apart from Googlebot apart from an SEO auditor is what makes
+ * the Engagement crawler view a signal rather than a lump.
+ *
+ * Cloudflare's Bot Management score and verifiedBot flag are consulted when
+ * present (score <= 30 counts as a bot). That field is an add-on, so it is
+ * genuinely absent at runtime on most zones despite the ambient type claiming
+ * it unconditionally; hence the defensive optional chaining.
+ */
+import type { UserAgentClass } from '../shared/index.js';
+export interface BotDetectionResult {
+    isBot: boolean;
+    botName: string | null;
+    botScore: number | null;
+    userAgentClass: UserAgentClass;
+}
+export declare function detectBot(userAgent: string | null, cf: IncomingRequestCfProperties | undefined): BotDetectionResult;
+//# sourceMappingURL=bots.d.ts.map

package/dist/lib/bots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bots.d.ts","sourceRoot":"","sources":["../../src/lib/bots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,cAAc,CAAC;CAChC;AA8CD,wBAAgB,SAAS,CACvB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,EAAE,EAAE,2BAA2B,GAAG,SAAS,GAC1C,kBAAkB,CAyBpB"}

package/dist/lib/bots.js

@@ -0,0 +1,79 @@
+/**
+ * User-agent classification for the visit beacon.
+ *
+ * The pattern list is the merged one managed we8 uses, with one addition that
+ * matters for 0.1: every entry also declares a CLASS. A single is-bot boolean
+ * answers "was this a human", which is the wrong question for AEO work, where
+ * the thing worth watching is specifically an answer engine reading the site.
+ * Keeping GPTBot apart from Googlebot apart from an SEO auditor is what makes
+ * the Engagement crawler view a signal rather than a lump.
+ *
+ * Cloudflare's Bot Management score and verifiedBot flag are consulted when
+ * present (score <= 30 counts as a bot). That field is an add-on, so it is
+ * genuinely absent at runtime on most zones despite the ambient type claiming
+ * it unconditionally; hence the defensive optional chaining.
+ */
+const BOT_PATTERNS = [
+    // Answer engines and model crawlers: the class 0.1 exists to surface.
+    { name: 'GPTBot', pattern: /GPTBot/i, class: 'ai-crawler' },
+    { name: 'ChatGPT-User', pattern: /ChatGPT-User/i, class: 'ai-crawler' },
+    { name: 'OAI-SearchBot', pattern: /OAI-SearchBot/i, class: 'ai-crawler' },
+    { name: 'ClaudeBot', pattern: /ClaudeBot|Claude-Web|Claude-User|anthropic-ai/i, class: 'ai-crawler' },
+    { name: 'PerplexityBot', pattern: /PerplexityBot|Perplexity-User/i, class: 'ai-crawler' },
+    { name: 'Google-Extended', pattern: /Google-Extended/i, class: 'ai-crawler' },
+    { name: 'Applebot-Extended', pattern: /Applebot-Extended/i, class: 'ai-crawler' },
+    { name: 'Bytespider', pattern: /Bytespider/i, class: 'ai-crawler' },
+    { name: 'CCBot', pattern: /CCBot/i, class: 'ai-crawler' },
+    { name: 'Meta-ExternalAgent', pattern: /Meta-ExternalAgent|FacebookBot/i, class: 'ai-crawler' },
+    { name: 'Amazonbot', pattern: /Amazonbot/i, class: 'ai-crawler' },
+    { name: 'Cohere', pattern: /cohere-ai|cohere-training-data-crawler/i, class: 'ai-crawler' },
+    { name: 'Diffbot', pattern: /Diffbot/i, class: 'ai-crawler' },
+    { name: 'Timpibot', pattern: /Timpibot/i, class: 'ai-crawler' },
+    // Classic search indexers.
+    { name: 'Googlebot', pattern: /Googlebot/i, class: 'search-crawler' },
+    { name: 'Bingbot', pattern: /bingbot/i, class: 'search-crawler' },
+    { name: 'YandexBot', pattern: /YandexBot/i, class: 'search-crawler' },
+    { name: 'DuckDuckBot', pattern: /DuckDuckBot/i, class: 'search-crawler' },
+    { name: 'Applebot', pattern: /Applebot/i, class: 'search-crawler' },
+    // Link unfurlers.
+    { name: 'FacebookExternalHit', pattern: /facebookexternalhit/i, class: 'social-crawler' },
+    { name: 'Twitterbot', pattern: /Twitterbot/i, class: 'social-crawler' },
+    { name: 'LinkedInBot', pattern: /LinkedInBot/i, class: 'social-crawler' },
+    { name: 'Slackbot', pattern: /Slackbot/i, class: 'social-crawler' },
+    { name: 'Discordbot', pattern: /Discordbot/i, class: 'social-crawler' },
+    // Commercial SEO auditors: traffic, not audience.
+    { name: 'SemrushBot', pattern: /SemrushBot/i, class: 'seo-crawler' },
+    { name: 'AhrefsBot', pattern: /AhrefsBot/i, class: 'seo-crawler' },
+    { name: 'DotBot', pattern: /DotBot/i, class: 'seo-crawler' },
+    { name: 'MJ12bot', pattern: /MJ12bot/i, class: 'seo-crawler' },
+    { name: 'DataForSeoBot', pattern: /DataForSeoBot/i, class: 'seo-crawler' },
+    // The catch-all, kept last so a named pattern always wins. It trades a small
+    // false-positive risk (a user agent that merely contains "bot") for
+    // materially higher recall.
+    { name: 'Generic crawler', pattern: /bot|crawler|spider|crawling/i, class: 'other-bot' },
+];
+export function detectBot(userAgent, cf) {
+    const score = typeof cf?.botManagement?.score === 'number' ? cf.botManagement.score : null;
+    const verified = cf?.botManagement?.verifiedBot === true;
+    if (userAgent) {
+        for (const entry of BOT_PATTERNS) {
+            if (entry.pattern.test(userAgent)) {
+                return {
+                    isBot: true,
+                    botName: entry.name,
+                    botScore: score,
+                    userAgentClass: entry.class,
+                };
+            }
+        }
+    }
+    // Cloudflare says bot but no pattern named it: real, but unattributable.
+    if (verified) {
+        return { isBot: true, botName: 'Verified bot', botScore: score, userAgentClass: 'other-bot' };
+    }
+    if (score !== null && score <= 30) {
+        return { isBot: true, botName: 'Low bot score', botScore: score, userAgentClass: 'other-bot' };
+    }
+    return { isBot: false, botName: null, botScore: score, userAgentClass: 'human' };
+}
+//# sourceMappingURL=bots.js.map

package/dist/lib/bots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bots.js","sourceRoot":"","sources":["../../src/lib/bots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,MAAM,YAAY,GAA4E;IAC5F,sEAAsE;IACtE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE;IAC3D,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE;IACvE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE;IACzE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gDAAgD,EAAE,KAAK,EAAE,YAAY,EAAE;IACrG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,YAAY,EAAE;IACzF,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE;IAC7E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,YAAY,EAAE;IACjF,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE;IACnE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;IACzD,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iCAAiC,EAAE,KAAK,EAAE,YAAY,EAAE;IAC/F,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;IACjE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,yCAAyC,EAAE,KAAK,EAAE,YAAY,EAAE;IAC3F,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE;IAC7D,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE;IAE/D,2BAA2B;IAC3B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACrE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACjE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACrE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACzE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAEnE,kBAAkB;IAClB,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACzF,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACvE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACzE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACnE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAEvE,kDAAkD;IAClD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;IACpE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE;IAClE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE;IAC5D,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE;IAC9D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE;IAE1E,6EAA6E;IAC7E,oEAAoE;IACpE,4BAA4B;IAC5B,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,EAAE,KAAK,EAAE,WAAW,EAAE;CACzF,CAAC;AAEF,MAAM,UAAU,SAAS,CACvB,SAAwB,EACxB,EAA2C;IAE3C,MAAM,KAAK,GAAG,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,MAAM,QAAQ,GAAG,EAAE,EAAE,aAAa,EAAE,WAAW,KAAK,IAAI,CAAC;IAEzD,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,QAAQ,EAAE,KAAK;oBACf,cAAc,EAAE,KAAK,CAAC,KAAK;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC"}

package/dist/lib/email.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The email seam. Managed we8 relays mail from the tenant engine to a control
+ * plane that owns the transport; a standalone CMS has no such plane, so
+ * everything that wants to send mail goes through this one interface and a
+ * deployment plugs a real implementation in behind it.
+ *
+ * Two implementations ship here. `NoopEmailSender` is the default and drops
+ * the message, so a fresh install works with no mail configuration at all;
+ * `ConsoleEmailSender` logs it, which is what local development wants. A pack
+ * supplies a real one through `registerEmailSender`; `@we8/cloudflare` sends
+ * over Cloudflare Email Service.
+ */
+export interface EmailMessage {
+    to: string[];
+    subject: string;
+    html: string;
+    text: string;
+}
+export interface EmailSender {
+    send(message: EmailMessage): Promise<void>;
+}
+/** The default: accepts and drops. A site with no mail configured is a valid site. */
+export declare class NoopEmailSender implements EmailSender {
+    send(_message: EmailMessage): Promise<void>;
+}
+/** Logs the message instead of sending it, so local development can see it. */
+export declare class ConsoleEmailSender implements EmailSender {
+    send(message: EmailMessage): Promise<void>;
+}
+/** What resolveEmailSender needs from the environment. */
+export interface EmailEnv {
+    EMAIL_MODE?: string | undefined;
+}
+/**
+ * How a deployment pack supplies a real sender. The factory receives the
+ * worker's whole environment as `unknown`, because the core cannot name a
+ * pack's bindings and must not pretend to: the pack narrows it itself.
+ * Returning `null` declines, which hands the decision back to the built-in
+ * resolution below, so a pack that is installed but not configured leaves a
+ * site exactly as it was.
+ */
+export type EmailSenderFactory = (env: unknown) => EmailSender | null;
+/**
+ * Registers the pack's sender. A composed worker calls this once at module
+ * scope, before any request is served; passing `null` unregisters, which is
+ * what tests want between cases.
+ */
+export declare function registerEmailSender(factory: EmailSenderFactory | null): void;
+/**
+ * Picks the sender for this environment. A registered pack factory gets first
+ * refusal; after that, `console` logs and anything else, including an unset
+ * value, drops.
+ */
+export declare function resolveEmailSender(env: EmailEnv): EmailSender;
+/**
+ * Sends without ever throwing at the caller. Form submission is the path this
+ * exists for: a submission that was stored must return success to the visitor
+ * whether or not the notification went out, so a sender error is logged and
+ * swallowed here rather than becoming a 500 on a lead that was captured fine.
+ */
+export declare function sendBestEffort(sender: EmailSender, message: EmailMessage): Promise<void>;
+//# sourceMappingURL=email.d.ts.map

package/dist/lib/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/lib/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,sFAAsF;AACtF,qBAAa,eAAgB,YAAW,WAAW;IACjD,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5C;AAED,+EAA+E;AAC/E,qBAAa,kBAAmB,YAAW,WAAW;IACpD,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAM3C;AAED,0DAA0D;AAC1D,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,WAAW,GAAG,IAAI,CAAC;AAItE;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,WAAW,CAM7D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAS9F"}

package/dist/lib/email.js

@@ -0,0 +1,64 @@
+/**
+ * The email seam. Managed we8 relays mail from the tenant engine to a control
+ * plane that owns the transport; a standalone CMS has no such plane, so
+ * everything that wants to send mail goes through this one interface and a
+ * deployment plugs a real implementation in behind it.
+ *
+ * Two implementations ship here. `NoopEmailSender` is the default and drops
+ * the message, so a fresh install works with no mail configuration at all;
+ * `ConsoleEmailSender` logs it, which is what local development wants. A pack
+ * supplies a real one through `registerEmailSender`; `@we8/cloudflare` sends
+ * over Cloudflare Email Service.
+ */
+/** The default: accepts and drops. A site with no mail configured is a valid site. */
+export class NoopEmailSender {
+    send(_message) {
+        return Promise.resolve();
+    }
+}
+/** Logs the message instead of sending it, so local development can see it. */
+export class ConsoleEmailSender {
+    send(message) {
+        console.log(`[email] to=${message.to.join(', ')} subject=${JSON.stringify(message.subject)}\n${message.text}`);
+        return Promise.resolve();
+    }
+}
+let registeredFactory = null;
+/**
+ * Registers the pack's sender. A composed worker calls this once at module
+ * scope, before any request is served; passing `null` unregisters, which is
+ * what tests want between cases.
+ */
+export function registerEmailSender(factory) {
+    registeredFactory = factory;
+}
+/**
+ * Picks the sender for this environment. A registered pack factory gets first
+ * refusal; after that, `console` logs and anything else, including an unset
+ * value, drops.
+ */
+export function resolveEmailSender(env) {
+    if (registeredFactory) {
+        const sender = registeredFactory(env);
+        if (sender)
+            return sender;
+    }
+    return env.EMAIL_MODE === 'console' ? new ConsoleEmailSender() : new NoopEmailSender();
+}
+/**
+ * Sends without ever throwing at the caller. Form submission is the path this
+ * exists for: a submission that was stored must return success to the visitor
+ * whether or not the notification went out, so a sender error is logged and
+ * swallowed here rather than becoming a 500 on a lead that was captured fine.
+ */
+export async function sendBestEffort(sender, message) {
+    if (message.to.length === 0)
+        return;
+    try {
+        await sender.send(message);
+    }
+    catch (error) {
+        console.error(`[email] send failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=email.js.map

package/dist/lib/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/lib/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,sFAAsF;AACtF,MAAM,OAAO,eAAe;IAC1B,IAAI,CAAC,QAAsB;QACzB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,kBAAkB;IAC7B,IAAI,CAAC,OAAqB;QACxB,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAClG,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAiBD,IAAI,iBAAiB,GAA8B,IAAI,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAkC;IACpE,iBAAiB,GAAG,OAAO,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAa;IAC9C,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAmB,EAAE,OAAqB;IAC7E,IAAI,OAAO,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CACX,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/errors.d.ts

@@ -0,0 +1,12 @@
+import { type ErrorCode } from '../shared/index.js';
+import type { Context } from 'hono';
+/** Thrown by route handlers/middleware to produce a specific envelope error. */
+export declare class HttpError extends Error {
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode, message: string);
+}
+/** Registered via app.onError(); catches everything, including thrown non-HttpErrors. */
+export declare function errorBoundary(error: Error, c: Context): Response;
+/** Registered via app.notFound(); keeps 404s in the same envelope shape as thrown errors. */
+export declare function notFoundHandler(c: Context): Response;
+//# sourceMappingURL=errors.d.ts.map

package/dist/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,gFAAgF;AAChF,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;gBAEb,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;CAK7C;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMhE;AAED,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAEpD"}

package/dist/lib/errors.js

@@ -0,0 +1,23 @@
+import { err, statusForCode } from '../shared/index.js';
+/** Thrown by route handlers/middleware to produce a specific envelope error. */
+export class HttpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'HttpError';
+        this.code = code;
+    }
+}
+/** Registered via app.onError(); catches everything, including thrown non-HttpErrors. */
+export function errorBoundary(error, c) {
+    if (error instanceof HttpError) {
+        return c.json(err(error.code, error.message), statusForCode(error.code));
+    }
+    console.error(error);
+    return c.json(err('internal', 'internal server error'), statusForCode('internal'));
+}
+/** Registered via app.notFound(); keeps 404s in the same envelope shape as thrown errors. */
+export function notFoundHandler(c) {
+    return c.json(err('not_found', 'not found'), statusForCode('not_found'));
+}
+//# sourceMappingURL=errors.js.map

package/dist/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,aAAa,EAAkB,MAAM,oBAAoB,CAAC;AAGxE,gFAAgF;AAChF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAY;IAEzB,YAAY,IAAe,EAAE,OAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,CAAU;IACpD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,uBAAuB,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/lib/notify.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The messages this CMS composes. Rendering lives here, away from the sending
+ * seam in email.ts, so the templates can be read and tested without touching a
+ * transport.
+ */
+import type { EmailMessage } from './email.js';
+export interface NotificationSubmission {
+    email: string | null;
+    name: string | null;
+    message: string | null;
+    sourcePage: string | null;
+}
+/** The "you have mail" ping sent to the site's notify addresses after a submission. */
+export declare function buildSubmissionNotification(to: string[], siteUrl: string, submission: NotificationSubmission): EmailMessage;
+/**
+ * The password reset mail. Better Auth builds the link (it carries the
+ * one-time token); this only wraps it, so the URL is used verbatim.
+ */
+export declare function buildPasswordResetEmail(to: string, url: string): EmailMessage;
+//# sourceMappingURL=notify.d.ts.map

package/dist/lib/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/lib/notify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAWD,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,EAAE,EAAE,MAAM,EAAE,EACZ,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,sBAAsB,GACjC,YAAY,CAyBd;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAmB7E"}

package/dist/lib/notify.js

@@ -0,0 +1,60 @@
+/**
+ * The messages this CMS composes. Rendering lives here, away from the sending
+ * seam in email.ts, so the templates can be read and tested without touching a
+ * transport.
+ */
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/** The "you have mail" ping sent to the site's notify addresses after a submission. */
+export function buildSubmissionNotification(to, siteUrl, submission) {
+    const rows = [
+        ['Site', siteUrl],
+        ['Name', submission.name ?? ''],
+        ['Email', submission.email ?? ''],
+        ['Source page', submission.sourcePage ?? ''],
+    ];
+    const html = [
+        '<h2>New form submission</h2>',
+        ...rows.map(([label, value]) => `<p><strong>${label}:</strong> ${escapeHtml(value)}</p>`),
+        '<p><strong>Message:</strong></p>',
+        `<p>${escapeHtml(submission.message ?? '').replace(/\n/g, '<br>')}</p>`,
+    ].join('\n');
+    const text = [
+        'New form submission',
+        '',
+        ...rows.map(([label, value]) => `${label}: ${value}`),
+        '',
+        'Message:',
+        submission.message ?? '',
+    ].join('\n');
+    return { to, subject: `New form submission on ${siteUrl}`, html, text };
+}
+/**
+ * The password reset mail. Better Auth builds the link (it carries the
+ * one-time token); this only wraps it, so the URL is used verbatim.
+ */
+export function buildPasswordResetEmail(to, url) {
+    const text = [
+        'Reset your password',
+        '',
+        'Open this link to choose a new password. It expires shortly and can be used once.',
+        '',
+        url,
+        '',
+        'If you did not ask for this, you can ignore this message.',
+    ].join('\n');
+    const html = [
+        '<h2>Reset your password</h2>',
+        '<p>Open this link to choose a new password. It expires shortly and can be used once.</p>',
+        `<p><a href="${escapeHtml(url)}">${escapeHtml(url)}</a></p>`,
+        '<p>If you did not ask for this, you can ignore this message.</p>',
+    ].join('\n');
+    return { to: [to], subject: 'Reset your password', html, text };
+}
+//# sourceMappingURL=notify.js.map

package/dist/lib/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/lib/notify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,EAAY,EACZ,OAAe,EACf,UAAkC;IAElC,MAAM,IAAI,GAA4B;QACpC,CAAC,MAAM,EAAE,OAAO,CAAC;QACjB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,CAAC,aAAa,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;KAC7C,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,8BAA8B;QAC9B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,KAAK,cAAc,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;QACzF,kCAAkC;QAClC,MAAM,UAAU,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG;QACX,qBAAqB;QACrB,EAAE;QACF,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC;QACrD,EAAE;QACF,UAAU;QACV,UAAU,CAAC,OAAO,IAAI,EAAE;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,0BAA0B,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU,EAAE,GAAW;IAC7D,MAAM,IAAI,GAAG;QACX,qBAAqB;QACrB,EAAE;QACF,mFAAmF;QACnF,EAAE;QACF,GAAG;QACH,EAAE;QACF,2DAA2D;KAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG;QACX,8BAA8B;QAC9B,0FAA0F;QAC1F,eAAe,UAAU,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,UAAU;QAC5D,kEAAkE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC"}

package/dist/lib/retention.d.ts

@@ -0,0 +1,15 @@
+import type { RetentionSettings } from '../shared/index.js';
+export interface RetentionResult {
+    pageVisitsDeleted: number;
+    consentRecordsDeleted: number;
+    rateEventsDeleted: number;
+    webhookDeliveriesDeleted: number;
+}
+/**
+ * The daily retention sweep, invoked from the scheduled handler in index.ts.
+ * Runs unconditionally against whatever retentionDays the site has configured;
+ * there is no dry-run mode, because this is a fixed maintenance job rather
+ * than a user-triggered action.
+ */
+export declare function runRetentionCleanup(db: D1Database, retentionDays: RetentionSettings): Promise<RetentionResult>;
+//# sourceMappingURL=retention.d.ts.map

package/dist/lib/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/lib/retention.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAU5D,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAsBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAoB1B"}

package/dist/lib/retention.js

@@ -0,0 +1,40 @@
+/**
+ * These two are flat constants: they are internal bookkeeping with no reason to
+ * be configurable. Only visits and consent are site-configurable, through
+ * site_settings.retentionDays.
+ */
+const RATE_EVENTS_RETENTION_DAYS = 2;
+const WEBHOOK_DELIVERIES_RETENTION_DAYS = 30;
+/**
+ * Table name is interpolated, not bound: D1/SQLite has no parameter
+ * placeholder for identifiers. Safe here because `table` is restricted to
+ * the literal union above, never caller/user input.
+ */
+async function deleteOlderThanDays(db, table, column, days) {
+    const result = await db
+        .prepare(`DELETE FROM ${table} WHERE ${column} < datetime('now', ?1)`)
+        .bind(`-${days} days`)
+        .run();
+    return result.meta.changes;
+}
+/**
+ * The daily retention sweep, invoked from the scheduled handler in index.ts.
+ * Runs unconditionally against whatever retentionDays the site has configured;
+ * there is no dry-run mode, because this is a fixed maintenance job rather
+ * than a user-triggered action.
+ */
+export async function runRetentionCleanup(db, retentionDays) {
+    const [pageVisitsDeleted, consentRecordsDeleted, rateEventsDeleted, webhookDeliveriesDeleted] = await Promise.all([
+        deleteOlderThanDays(db, 'page_visits', 'visited_at', retentionDays.visits),
+        deleteOlderThanDays(db, 'consent_records', 'recorded_at', retentionDays.consent),
+        deleteOlderThanDays(db, 'rate_events', 'created_at', RATE_EVENTS_RETENTION_DAYS),
+        deleteOlderThanDays(db, 'webhook_deliveries', 'created_at', WEBHOOK_DELIVERIES_RETENTION_DAYS),
+    ]);
+    return {
+        pageVisitsDeleted,
+        consentRecordsDeleted,
+        rateEventsDeleted,
+        webhookDeliveriesDeleted,
+    };
+}
+//# sourceMappingURL=retention.js.map

package/dist/lib/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/lib/retention.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAW7C;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,EAAc,EACd,KAAqB,EACrB,MAAc,EACd,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,OAAO,CAAC,eAAe,KAAK,UAAU,MAAM,wBAAwB,CAAC;SACrE,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;SACrB,GAAG,EAAE,CAAC;IACT,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAc,EACd,aAAgC;IAEhC,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,GAC3F,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,mBAAmB,CAAC,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC;QAC1E,mBAAmB,CAAC,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC;QAChF,mBAAmB,CAAC,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,0BAA0B,CAAC;QAChF,mBAAmB,CACjB,EAAE,EACF,oBAAoB,EACpB,YAAY,EACZ,iCAAiC,CAClC;KACF,CAAC,CAAC;IAEL,OAAO;QACL,iBAAiB;QACjB,qBAAqB;QACrB,iBAAiB;QACjB,wBAAwB;KACzB,CAAC;AACJ,CAAC"}