@we8/cms 0.1.0

package/dist/lib/sanitize.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Whitelist HTML sanitizer, applied to admin-authored post content on every
+ * write. There is no DOM in a Worker, so this uses HTMLRewriter, the streaming
+ * HTML parser built into the runtime, rather than string matching.
+ *
+ * Policy: an explicit tag+attribute whitelist. Anything not on the
+ * whitelist is either removed entirely (tags whose content is not
+ * displayable text: script/style/iframe/...) or unwrapped, keeping its text
+ * content (structurally unknown but harmless wrapper tags). All `on*` event
+ * handler attributes and `style` attributes are stripped from every element
+ * regardless of tag. `href`/`src` are further restricted to safe schemes.
+ */
+export declare function sanitizeHtml(html: string): Promise<string>;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/lib/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/lib/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiJH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhE"}

package/dist/lib/sanitize.js

@@ -0,0 +1,145 @@
+/**
+ * Whitelist HTML sanitizer, applied to admin-authored post content on every
+ * write. There is no DOM in a Worker, so this uses HTMLRewriter, the streaming
+ * HTML parser built into the runtime, rather than string matching.
+ *
+ * Policy: an explicit tag+attribute whitelist. Anything not on the
+ * whitelist is either removed entirely (tags whose content is not
+ * displayable text: script/style/iframe/...) or unwrapped, keeping its text
+ * content (structurally unknown but harmless wrapper tags). All `on*` event
+ * handler attributes and `style` attributes are stripped from every element
+ * regardless of tag. `href`/`src` are further restricted to safe schemes.
+ */
+const ALLOWED_TAGS = {
+    p: { attributes: [] },
+    br: { attributes: [] },
+    hr: { attributes: [] },
+    strong: { attributes: [] },
+    b: { attributes: [] },
+    em: { attributes: [] },
+    i: { attributes: [] },
+    u: { attributes: [] },
+    s: { attributes: [] },
+    span: { attributes: [] },
+    blockquote: { attributes: [] },
+    h1: { attributes: [] },
+    h2: { attributes: [] },
+    h3: { attributes: [] },
+    h4: { attributes: [] },
+    h5: { attributes: [] },
+    h6: { attributes: [] },
+    ul: { attributes: [] },
+    ol: { attributes: [] },
+    li: { attributes: [] },
+    pre: { attributes: ['class'] },
+    code: { attributes: ['class'] },
+    figure: { attributes: [] },
+    figcaption: { attributes: [] },
+    table: { attributes: [] },
+    thead: { attributes: [] },
+    tbody: { attributes: [] },
+    tr: { attributes: [] },
+    // colspan/rowspan carry merged cells; colwidth is ProseMirror's column-width
+    // attribute. Stripping any of them would make the editor's next save a
+    // silent table mutation.
+    th: { attributes: ['colspan', 'rowspan', 'colwidth'] },
+    td: { attributes: ['colspan', 'rowspan', 'colwidth'] },
+    a: { attributes: ['href', 'title', 'target'] },
+    img: { attributes: ['src', 'alt', 'width', 'height'] },
+    // iframes exist ONLY as YouTube embeds (src verified against
+    // SAFE_YOUTUBE_SRC_PATTERN below; anything else is removed whole). The
+    // attribute list is what Tiptap's Youtube extension needs to round-trip;
+    // its other serialized attributes (autoplay, modestbranding, ...) are
+    // stripped, which is stable: parseHTML only needs the wrapper + src.
+    iframe: { attributes: ['src', 'width', 'height', 'allowfullscreen', 'title', 'start'] },
+    // The div rule is reached only for Tiptap's YouTube wrapper
+    // (div[data-youtube-video]); all other divs are unwrapped in the handler
+    // before the rule lookup. Without the wrapper the editor cannot re-parse
+    // the embed and would silently drop it on the next save.
+    div: { attributes: ['data-youtube-video'] },
+};
+/** Tags whose content is not display text: drop the tag AND everything inside it. */
+const REMOVE_WITH_CONTENT = new Set([
+    'script',
+    'style',
+    'object',
+    'embed',
+    'link',
+    'meta',
+    'base',
+    'form',
+    'noscript',
+]);
+// Absolute http(s)/mailto, site-relative ("/path", but NOT protocol-relative
+// "//host"), and in-page anchors ("#section"). Authors legitimately write
+// relative links in post bodies, and stripping them silently breaks pages.
+const SAFE_HREF_PATTERN = /^(https?:|mailto:|#|\/(?!\/))/i;
+const SAFE_IMG_SRC_PATTERN = /^(https?:|data:image\/(?:png|jpe?g|gif|webp|svg\+xml);base64,)/i;
+const LANGUAGE_CLASS_PATTERN = /^language-[a-z0-9]+$/;
+// The ONLY sanctioned iframe origin: YouTube's embed player (plain or
+// privacy-enhanced host). Everything else, including youtu.be watch links,
+// is not an embed URL and the element is removed whole.
+const SAFE_YOUTUBE_SRC_PATTERN = /^https:\/\/(?:www\.)?youtube(?:-nocookie)?\.com\/embed\/[\w-]+/i;
+class SanitizeHandler {
+    element(element) {
+        const tag = element.tagName.toLowerCase();
+        if (REMOVE_WITH_CONTENT.has(tag)) {
+            element.remove();
+            return;
+        }
+        // Divs stay unwrapped (pasted-content wrapper soup) EXCEPT Tiptap's
+        // YouTube wrapper, which must survive for the embed to re-parse. The
+        // attribute is serialized empty (data-youtube-video=""), so test against
+        // null, not truthiness.
+        if (tag === 'div' && element.getAttribute('data-youtube-video') === null) {
+            element.removeAndKeepContent();
+            return;
+        }
+        const rule = ALLOWED_TAGS[tag];
+        if (!rule) {
+            element.removeAndKeepContent();
+            return;
+        }
+        // Snapshot first: mutating attributes while iterating a live handle is
+        // asking for trouble, and this is cheap either way.
+        const attrs = [...element.attributes];
+        for (const [name] of attrs) {
+            if (!name)
+                continue;
+            const lower = name.toLowerCase();
+            if (lower.startsWith('on') || lower === 'style' || !rule.attributes.includes(lower)) {
+                element.removeAttribute(name);
+            }
+        }
+        if (tag === 'a') {
+            const href = element.getAttribute('href');
+            if (href && !SAFE_HREF_PATTERN.test(href.trim())) {
+                element.removeAttribute('href');
+            }
+            element.setAttribute('rel', 'noopener noreferrer nofollow');
+        }
+        if (tag === 'img') {
+            const src = element.getAttribute('src');
+            if (!src || !SAFE_IMG_SRC_PATTERN.test(src.trim())) {
+                element.remove();
+            }
+        }
+        if (tag === 'iframe') {
+            const src = element.getAttribute('src');
+            if (!src || !SAFE_YOUTUBE_SRC_PATTERN.test(src.trim())) {
+                element.remove();
+            }
+        }
+        if (tag === 'pre' || tag === 'code') {
+            const cls = element.getAttribute('class');
+            if (cls && !LANGUAGE_CLASS_PATTERN.test(cls)) {
+                element.removeAttribute('class');
+            }
+        }
+    }
+}
+export async function sanitizeHtml(html) {
+    const rewritten = new HTMLRewriter().on('*', new SanitizeHandler()).transform(new Response(html));
+    return rewritten.text();
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/lib/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/lib/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,YAAY,GAA4B;IAC5C,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACrB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IAC1B,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACrB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACrB,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACrB,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACrB,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACxB,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IAC9B,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE;IAC9B,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE;IAC/B,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IAC1B,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IAC9B,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACzB,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACzB,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACzB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACtB,6EAA6E;IAC7E,uEAAuE;IACvE,yBAAyB;IACzB,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE;IACtD,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE;IACtD,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC9C,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IACtD,6DAA6D;IAC7D,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;IACvF,4DAA4D;IAC5D,yEAAyE;IACzE,yEAAyE;IACzE,yDAAyD;IACzD,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE;CAC5C,CAAC;AAEF,qFAAqF;AACrF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AAEH,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAC3D,MAAM,oBAAoB,GAAG,iEAAiE,CAAC;AAC/F,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AACtD,sEAAsE;AACtE,2EAA2E;AAC3E,wDAAwD;AACxD,MAAM,wBAAwB,GAAG,iEAAiE,CAAC;AAEnG,MAAM,eAAe;IACnB,OAAO,CAAC,OAAgB;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAE1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,yEAAyE;QACzE,wBAAwB;QACxB,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC,oBAAoB,CAAC,KAAK,IAAI,EAAE,CAAC;YACzE,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpF,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvD,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,SAAS,GAAG,IAAI,YAAY,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/lib/turnstile.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Cloudflare Turnstile verification. No secret configured means allow, since
+ * Turnstile is opt-in; a missing token is a reject; and a network or API
+ * failure is also a reject, because this fails closed rather than open.
+ */
+export declare function verifyTurnstile(secret: string | undefined, token: string | undefined, remoteIp?: string): Promise<boolean>;
+//# sourceMappingURL=turnstile.d.ts.map

package/dist/lib/turnstile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.d.ts","sourceRoot":"","sources":["../../src/lib/turnstile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAuBlB"}

package/dist/lib/turnstile.js

@@ -0,0 +1,32 @@
+/**
+ * Cloudflare Turnstile verification. No secret configured means allow, since
+ * Turnstile is opt-in; a missing token is a reject; and a network or API
+ * failure is also a reject, because this fails closed rather than open.
+ */
+export async function verifyTurnstile(secret, token, remoteIp) {
+    if (!secret)
+        return true;
+    if (!token)
+        return false;
+    const form = new FormData();
+    form.append('secret', secret);
+    form.append('response', token);
+    if (remoteIp)
+        form.append('remoteip', remoteIp);
+    try {
+        const res = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+            method: 'POST',
+            body: form,
+        });
+        // Two-step unknown-then-assert: a single-step `(await res.json()) as T`
+        // trips no-unnecessary-type-assertion under the type-aware lint pass,
+        // which resolves Response.json() as `any` rather than `unknown`.
+        const data = await res.json();
+        const result = data;
+        return result.success === true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=turnstile.js.map

package/dist/lib/turnstile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.js","sourceRoot":"","sources":["../../src/lib/turnstile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA0B,EAC1B,KAAyB,EACzB,QAAiB;IAEjB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,QAAQ;QAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,2DAA2D,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,wEAAwE;QACxE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAA6B,CAAC;QAC7C,OAAO,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/validate.d.ts

@@ -0,0 +1,11 @@
+import type { z } from 'zod';
+/**
+ * Parses with a zod schema or throws the standard validation_error envelope.
+ * Generic is inferred from the schema itself (`S extends z.ZodTypeAny`) and
+ * the return type computed via `z.infer<S>`, not `z.ZodType<T>` with T
+ * inferred directly: for schemas with `.default(...)`, the latter can
+ * resolve T to the pre-default input shape (fields optional) rather than
+ * the post-parse output shape (defaults applied, fields required).
+ */
+export declare function parseOrThrow<S extends z.ZodTypeAny>(schema: S, data: unknown): z.infer<S>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/lib/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/lib/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAWzF"}

package/dist/lib/validate.js

@@ -0,0 +1,22 @@
+import { HttpError } from './errors.js';
+/**
+ * Parses with a zod schema or throws the standard validation_error envelope.
+ * Generic is inferred from the schema itself (`S extends z.ZodTypeAny`) and
+ * the return type computed via `z.infer<S>`, not `z.ZodType<T>` with T
+ * inferred directly: for schemas with `.default(...)`, the latter can
+ * resolve T to the pre-default input shape (fields optional) rather than
+ * the post-parse output shape (defaults applied, fields required).
+ */
+export function parseOrThrow(schema, data) {
+    const result = schema.safeParse(data);
+    if (!result.success) {
+        const message = result.error.issues.map((issue) => issue.message).join('; ');
+        throw new HttpError('validation_error', message || 'invalid request');
+    }
+    // z.ZodTypeAny (by zod's own design, for accepting "any schema" generically)
+    // makes result.data resolve to `any`; an explicit assertion at the return
+    // site is the correct way to leave `any` here (a plain annotated
+    // assignment just moves the same "any" flow to no-unsafe-assignment).
+    return result.data;
+}
+//# sourceMappingURL=validate.js.map

package/dist/lib/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/lib/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAyB,MAAS,EAAE,IAAa;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IACxE,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,iEAAiE;IACjE,sEAAsE;IACtE,OAAO,MAAM,CAAC,IAAkB,CAAC;AACnC,CAAC"}

package/dist/lib/word-count.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Word count, computed on every content save from already-sanitized HTML. Not
+ * a security boundary, just a display stat ("N min read"), so a plain tag strip
+ * is sufficient.
+ */
+export declare function countWords(html: string): number;
+//# sourceMappingURL=word-count.d.ts.map

package/dist/lib/word-count.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"word-count.d.ts","sourceRoot":"","sources":["../../src/lib/word-count.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C"}

package/dist/lib/word-count.js

@@ -0,0 +1,14 @@
+/**
+ * Word count, computed on every content save from already-sanitized HTML. Not
+ * a security boundary, just a display stat ("N min read"), so a plain tag strip
+ * is sufficient.
+ */
+export function countWords(html) {
+    const text = html.replace(/<[^>]*>/g, ' ');
+    const words = text
+        .trim()
+        .split(/\s+/)
+        .filter((word) => word.length > 0);
+    return words.length;
+}
+//# sourceMappingURL=word-count.js.map

package/dist/lib/word-count.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"word-count.js","sourceRoot":"","sources":["../../src/lib/word-count.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI;SACf,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,46 @@
+import type { Context } from 'hono';
+import type { Bindings } from '../env.js';
+import type { UserRole } from '../shared/index.js';
+export type AuthContext = {
+    /** The signed-in user's id, or null when no session is required on this route. */
+    userId: string | null;
+    /** The signed-in user's email; this is what publish history is attributed to. */
+    user: string | null;
+    role: UserRole;
+};
+export type AuthVariables = {
+    auth: AuthContext;
+};
+/**
+ * Session gating for /v1/admin/*.
+ *
+ * This is the seam where managed we8 and this package genuinely differ. There,
+ * a control-plane proxy signs an internal HMAC and the engine trusts the
+ * identity headers riding along with it. Here there is no proxy: the Better
+ * Auth session cookie on the request IS the identity, resolved against this
+ * worker's own database, and the user and role it yields are injected into
+ * exactly the place the engine's header trust used to fill.
+ *
+ * A public API key never reaches the admin surface. A publishable key travels
+ * in browser code, so if presenting one could reach /v1/admin/*, every visitor
+ * to the site could read the submission inbox and rewrite content. Any request
+ * carrying a key on an admin route is rejected outright rather than merely
+ * failing the session check, so the boundary is explicit rather than
+ * incidental.
+ */
+export declare const sessionAuth: import("hono").MiddlewareHandler<{
+    Bindings: Bindings;
+    Variables: AuthVariables;
+}, string, {}, Response>;
+/**
+ * Owner-only gate, mounted on the routes where the two roles part ways: the
+ * settings mutation (module flags, allowed origins, webhooks, notify
+ * addresses, retention) and the whole form-submission inbox, which is other
+ * people's personal data. Everything else in the admin API is open to a
+ * member, because a member is an editor.
+ *
+ * Only mounted behind sessionAuth, so the request is already authenticated;
+ * this narrows which authenticated user.
+ */
+export declare function requireOwner(c: Context, next: () => Promise<void>): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iFAAiF;IACjF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,WAAW;cAAgC,QAAQ;eAAa,aAAa;wBA0BzF,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjF"}

package/dist/middleware/auth.js

@@ -0,0 +1,60 @@
+import { createMiddleware } from 'hono/factory';
+import { HttpError } from '../lib/errors.js';
+import { createAuth, normalizeRole } from '../auth/auth.js';
+import { extractApiKey } from '../keys/service.js';
+/**
+ * Session gating for /v1/admin/*.
+ *
+ * This is the seam where managed we8 and this package genuinely differ. There,
+ * a control-plane proxy signs an internal HMAC and the engine trusts the
+ * identity headers riding along with it. Here there is no proxy: the Better
+ * Auth session cookie on the request IS the identity, resolved against this
+ * worker's own database, and the user and role it yields are injected into
+ * exactly the place the engine's header trust used to fill.
+ *
+ * A public API key never reaches the admin surface. A publishable key travels
+ * in browser code, so if presenting one could reach /v1/admin/*, every visitor
+ * to the site could read the submission inbox and rewrite content. Any request
+ * carrying a key on an admin route is rejected outright rather than merely
+ * failing the session check, so the boundary is explicit rather than
+ * incidental.
+ */
+export const sessionAuth = createMiddleware(async (c, next) => {
+    if (extractApiKey(c) !== undefined) {
+        throw new HttpError('forbidden', 'API keys cannot access admin routes');
+    }
+    if (!c.env.BETTER_AUTH_SECRET) {
+        // Refusing beats guessing: with no secret configured, any session this
+        // worker validated would be one it could not have signed.
+        throw new HttpError('unauthorized', 'authentication is not configured');
+    }
+    const auth = createAuth(c.env);
+    const session = await auth.api.getSession({ headers: c.req.raw.headers });
+    if (!session) {
+        throw new HttpError('unauthorized', 'sign in required');
+    }
+    c.set('auth', {
+        userId: session.user.id,
+        user: session.user.email,
+        role: normalizeRole(session.user.role),
+    });
+    await next();
+});
+/**
+ * Owner-only gate, mounted on the routes where the two roles part ways: the
+ * settings mutation (module flags, allowed origins, webhooks, notify
+ * addresses, retention) and the whole form-submission inbox, which is other
+ * people's personal data. Everything else in the admin API is open to a
+ * member, because a member is an editor.
+ *
+ * Only mounted behind sessionAuth, so the request is already authenticated;
+ * this narrows which authenticated user.
+ */
+export function requireOwner(c, next) {
+    const auth = c.get('auth');
+    if (auth?.role !== 'owner') {
+        throw new HttpError('forbidden', 'owner role required');
+    }
+    return next();
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAenD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CACzC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC9B,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;QACZ,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;QACxB,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,IAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA4B,CAAC;IACtD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/middleware/cors.d.ts

@@ -0,0 +1,33 @@
+import type { MiddlewareHandler } from 'hono';
+import { type Bindings } from '../env.js';
+export type CorsKind = 'publicRead' | 'publicWrite' | 'admin';
+/**
+ * Per-route CORS. Public reads allow any origin (they are public by
+ * definition), public writes are restricted to the site's configured allowed
+ * origins, and admin routes allow those same origins WITH credentials.
+ *
+ * That last part differs from managed we8, where admin traffic arrives only
+ * from a control-plane proxy and no browser origin is ever allowed. Here the
+ * admin portal is a browser application talking to this worker directly, and
+ * it authenticates with a session cookie, so the admin surface has to answer
+ * preflights and echo credentials. It stays bounded by the same allowlist the
+ * site owner already maintains: an origin that is not on it gets nothing.
+ */
+export declare function corsMiddleware(kind: CorsKind): MiddlewareHandler;
+/**
+ * Server-side origin REJECTION for public write routes. corsMiddleware only
+ * controls response headers: it never blocks the request, and browsers do not
+ * preflight simple requests (a plain form post, for instance), so a cross-site
+ * write would still execute server-side. This middleware 403s when an Origin
+ * header is present and not on the allowlist.
+ *
+ * Two deliberate pass-throughs: requests with NO Origin header (non-browser
+ * clients, for which API keys, Turnstile, and rate limits are the controls,
+ * and where Origin is trivially spoofable anyway), and sites with an EMPTY
+ * allowlist, since rejecting everything by default would break a fresh install
+ * before its owner has configured anything.
+ */
+export declare const enforceOrigin: MiddlewareHandler<{
+    Bindings: Bindings;
+}, string, {}, Response>;
+//# sourceMappingURL=cors.d.ts.map

package/dist/middleware/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,MAAM,MAAM,QAAQ,GAAG,YAAY,GAAG,aAAa,GAAG,OAAO,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAchE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;cAAgC,QAAQ;wBAShE,CAAC"}

package/dist/middleware/cors.js

@@ -0,0 +1,55 @@
+import { cors } from 'hono/cors';
+import { createMiddleware } from 'hono/factory';
+import { getSettings } from '../env.js';
+import { HttpError } from '../lib/errors.js';
+/**
+ * Per-route CORS. Public reads allow any origin (they are public by
+ * definition), public writes are restricted to the site's configured allowed
+ * origins, and admin routes allow those same origins WITH credentials.
+ *
+ * That last part differs from managed we8, where admin traffic arrives only
+ * from a control-plane proxy and no browser origin is ever allowed. Here the
+ * admin portal is a browser application talking to this worker directly, and
+ * it authenticates with a session cookie, so the admin surface has to answer
+ * preflights and echo credentials. It stays bounded by the same allowlist the
+ * site owner already maintains: an origin that is not on it gets nothing.
+ */
+export function corsMiddleware(kind) {
+    return cors({
+        origin: async (origin, c) => {
+            if (kind === 'publicRead')
+                return '*';
+            // Hono's cors() origin callback is not parameterized per-app, so c.env
+            // is not narrowed to our Bindings here; this is the one contained cast.
+            const settings = await getSettings(c.env.DB);
+            return settings.allowedOrigins.includes(origin) ? origin : null;
+        },
+        credentials: kind === 'admin',
+        allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+        allowHeaders: ['Content-Type', 'X-We8-Key', 'Authorization'],
+    });
+}
+/**
+ * Server-side origin REJECTION for public write routes. corsMiddleware only
+ * controls response headers: it never blocks the request, and browsers do not
+ * preflight simple requests (a plain form post, for instance), so a cross-site
+ * write would still execute server-side. This middleware 403s when an Origin
+ * header is present and not on the allowlist.
+ *
+ * Two deliberate pass-throughs: requests with NO Origin header (non-browser
+ * clients, for which API keys, Turnstile, and rate limits are the controls,
+ * and where Origin is trivially spoofable anyway), and sites with an EMPTY
+ * allowlist, since rejecting everything by default would break a fresh install
+ * before its owner has configured anything.
+ */
+export const enforceOrigin = createMiddleware(async (c, next) => {
+    const origin = c.req.header('Origin');
+    if (origin) {
+        const settings = await getSettings(c.env.DB);
+        if (settings.allowedOrigins.length > 0 && !settings.allowedOrigins.includes(origin)) {
+            throw new HttpError('forbidden', 'origin not allowed');
+        }
+    }
+    await next();
+});
+//# sourceMappingURL=cors.js.map

package/dist/middleware/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,OAAO,IAAI,CAAC;QACV,MAAM,EAAE,KAAK,EAAE,MAAc,EAAE,CAAU,EAAE,EAAE;YAC3C,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,GAAG,CAAC;YAEtC,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAE,CAAC,CAAC,GAAgB,CAAC,EAAE,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,CAAC;QACD,WAAW,EAAE,IAAI,KAAK,OAAO;QAC7B,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QAClE,YAAY,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,eAAe,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAyB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACtF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/middleware/module-gate.d.ts

@@ -0,0 +1,11 @@
+import type { ModuleFlags } from '../shared/index.js';
+import { type Bindings } from '../env.js';
+/**
+ * 404s a disabled module's routes, indistinguishable from a route that never
+ * existed (don't leak "this module exists but is off"). Mounted by each
+ * module's router at its mount point.
+ */
+export declare function moduleGate(moduleName: keyof ModuleFlags): import("hono").MiddlewareHandler<{
+    Bindings: Bindings;
+}, string, {}, Response>;
+//# sourceMappingURL=module-gate.d.ts.map

package/dist/middleware/module-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/module-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,WAAW;cAClB,QAAQ;yBAO7C"}

package/dist/middleware/module-gate.js

@@ -0,0 +1,18 @@
+import { createMiddleware } from 'hono/factory';
+import { getSettings } from '../env.js';
+import { HttpError } from '../lib/errors.js';
+/**
+ * 404s a disabled module's routes, indistinguishable from a route that never
+ * existed (don't leak "this module exists but is off"). Mounted by each
+ * module's router at its mount point.
+ */
+export function moduleGate(moduleName) {
+    return createMiddleware(async (c, next) => {
+        const settings = await getSettings(c.env.DB);
+        if (!settings.modules[moduleName]) {
+            throw new HttpError('not_found', 'not found');
+        }
+        await next();
+    });
+}
+//# sourceMappingURL=module-gate.js.map

package/dist/middleware/module-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-gate.js","sourceRoot":"","sources":["../../src/middleware/module-gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,UAA6B;IACtD,OAAO,gBAAgB,CAAyB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/rate-limit.d.ts

@@ -0,0 +1,13 @@
+import { type RateLimitBucket } from '../shared/index.js';
+import type { Bindings } from '../env.js';
+/**
+ * D1 sliding-window rate limit, keyed on a hash of the caller's IP.
+ * A factory, not a single global middleware: mounted per bucket on whichever
+ * routes need it (forms mount formsBurst and formsHourly
+ * together; engagement endpoints mount just `engagement`). Admin routes are
+ * exempt simply by never mounting this on them.
+ */
+export declare function rateLimit(bucket: RateLimitBucket): import("hono").MiddlewareHandler<{
+    Bindings: Bindings;
+}, string, {}, Response>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAO1C;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe;cAGX,QAAQ;yBAsB7C"}

package/dist/middleware/rate-limit.js

@@ -0,0 +1,30 @@
+import { RATE_LIMIT_BUCKETS, sha256Hex } from '../shared/index.js';
+import { createMiddleware } from 'hono/factory';
+import { HttpError } from '../lib/errors.js';
+/**
+ * D1 sliding-window rate limit, keyed on a hash of the caller's IP.
+ * A factory, not a single global middleware: mounted per bucket on whichever
+ * routes need it (forms mount formsBurst and formsHourly
+ * together; engagement endpoints mount just `engagement`). Admin routes are
+ * exempt simply by never mounting this on them.
+ */
+export function rateLimit(bucket) {
+    const config = RATE_LIMIT_BUCKETS[bucket];
+    return createMiddleware(async (c, next) => {
+        const ip = c.req.header('CF-Connecting-IP') ?? 'unknown';
+        const ipHash = await sha256Hex(ip);
+        const { results } = await c.env.DB.prepare(`SELECT COUNT(*) as count FROM rate_events
+       WHERE bucket = ?1 AND ip_hash = ?2 AND created_at > datetime('now', ?3)`)
+            .bind(bucket, ipHash, `-${config.windowSeconds} seconds`)
+            .all();
+        const count = results[0]?.count ?? 0;
+        if (count >= config.max) {
+            throw new HttpError('rate_limited', 'too many requests');
+        }
+        await c.env.DB.prepare(`INSERT INTO rate_events (bucket, ip_hash) VALUES (?1, ?2)`)
+            .bind(bucket, ipHash)
+            .run();
+        await next();
+    });
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAM7C;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO,gBAAgB,CAAyB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CACxC;+EACyE,CAC1E;aACE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,UAAU,CAAC;aACxD,GAAG,EAAY,CAAC;QAEnB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC;aAChF,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;aACpB,GAAG,EAAE,CAAC;QAET,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/request-id.d.ts

@@ -0,0 +1,8 @@
+export type RequestIdVariables = {
+    requestId: string;
+};
+/** Assigns a request id and adds X-Request-Id / X-Response-Time to every response. */
+export declare const requestId: import("hono").MiddlewareHandler<{
+    Variables: RequestIdVariables;
+}, string, {}, Response>;
+//# sourceMappingURL=request-id.d.ts.map

package/dist/middleware/request-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.d.ts","sourceRoot":"","sources":["../../src/middleware/request-id.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,SAAS;eAAiC,kBAAkB;wBASvE,CAAC"}