alpha-gate 0.1.0

package/src/routes/app/appcast.ts

@@ -0,0 +1,68 @@
+import { gateToken } from "../../auth/token-gate";
+import { renderAppcast, renderInformationalItem, renderUpdateItem } from "../../core/appcast";
+import { insertEvent } from "../../db/access-log";
+import { loadAccessNotice, loadBranding } from "../../services/branding";
+import type { AppContext } from "./app-context";
+import { resolveServed } from "./resolve";
+
+// §8/§15 — the per-user appcast. Gate → resolve → one of three feeds: a target item (a servable
+// build), an EMPTY feed (active but no-build, §11 — Sparkle stays "up to date"), or the reactivation
+// notice (revoked/unknown only). Active checks log a `check` with the installed build the app reports.
+// Never a 403: an unknown token still gets the notice so background checks surface it (decision 0010).
+export async function appcastRoute(c: AppContext): Promise<Response> {
+  const deps = c.get("deps");
+  const origin = new URL(c.req.url).origin;
+  const accessUrl = `${origin}/access`;
+  const title = (await loadBranding(deps)).appName;
+
+  const gate = await gateToken(deps, c.req.query("token"));
+
+  let items: readonly string[];
+  if (gate.kind !== "active") {
+    // Revoked AND unknown take the identical path — same notice, same (no) resolve/log work — so the
+    // response can't reveal whether a token exists (§6/§16): no DB write is gated on token existence.
+    // (loadAccessNotice reads only instance-wide meta, never anything token-specific.)
+    const notice = await loadAccessNotice(deps);
+    items = [renderInformationalItem({ accessUrl, title: notice.title, message: notice.message })];
+  } else {
+    const client = gate.client;
+    const result = await resolveServed(deps, client);
+    // Active client: the resolved build, or an EMPTY feed when nothing is servable (the §11 no-build
+    // state) so Sparkle reports "up to date" rather than prompting. The reactivation notice is for
+    // revoked/unknown tokens only (§8/§15, decision 0010) — a valid user is never told to reactivate.
+    items =
+      result.kind === "target"
+        ? [
+            renderUpdateItem(
+              result.build,
+              `${origin}/download?token=${encodeURIComponent(client.token)}&via=update`,
+            ),
+          ]
+        : [];
+
+    await insertEvent(deps.db, {
+      clientId: client.id,
+      email: client.email,
+      event: "check",
+      buildNumber: parseInstalled(c.req.query("installed"), c.req.query("appVersion")),
+      ip: c.req.header("cf-connecting-ip") ?? null,
+      userAgent: c.req.header("user-agent") ?? null,
+      createdAt: deps.clock(),
+    });
+  }
+
+  return c.body(renderAppcast({ title, items }), 200, {
+    "Content-Type": "application/rss+xml; charset=utf-8",
+  });
+}
+
+// decision 0004: the app sends &installed=<build_number>; Sparkle's appVersion is an opportunistic
+// fallback. Parse defensively — only an all-digit value counts, else NULL (never throws).
+function parseInstalled(...candidates: (string | undefined)[]): number | null {
+  for (const raw of candidates) {
+    if (raw !== undefined && /^\d+$/.test(raw.trim())) {
+      return Number.parseInt(raw.trim(), 10);
+    }
+  }
+  return null;
+}

package/src/routes/app/assets.ts

@@ -0,0 +1,25 @@
+import { getObject } from "../../r2/builds-bucket";
+import { BRANDING_HEADER_KEY, BRANDING_ICON_KEY } from "../../r2/keys";
+import type { AppContext } from "./app-context";
+
+// §6/§13 — public branding assets. Only the known names map to keys (no arbitrary R2 access), and
+// responses set an explicit Content-Type plus X-Content-Type-Options:nosniff so user-uploaded bytes
+// are never sniffed as HTML (branding attack-surface mitigation).
+const ASSET_KEYS: Record<string, string> = {
+  icon: BRANDING_ICON_KEY,
+  header: BRANDING_HEADER_KEY,
+};
+
+export async function assetsRoute(c: AppContext): Promise<Response> {
+  const deps = c.get("deps");
+  const name = c.req.param("name");
+  const key = name === undefined ? undefined : ASSET_KEYS[name];
+  if (key === undefined) return c.text("Not found", 404);
+
+  const object = await getObject(deps.r2, key);
+  if (object === null) return c.text("Not found", 404);
+
+  c.header("Content-Type", object.httpMetadata?.contentType ?? "application/octet-stream");
+  c.header("X-Content-Type-Options", "nosniff");
+  return c.body(object.body);
+}

package/src/routes/app/download.ts

@@ -0,0 +1,45 @@
+import { gateToken } from "../../auth/token-gate";
+import { insertEvent } from "../../db/access-log";
+import { getObject } from "../../r2/builds-bucket";
+import type { AppContext } from "./app-context";
+import { resolveServed } from "./resolve";
+
+// §8/§16 — streams the archive from R2 behind the token gate (never a presigned URL). via=install
+// serves the first-install DMG when present (else the zip); via=update serves the EdDSA-signed zip
+// Sparkle installs. Logs a download (install) or update (update) event. An invalid token is denied
+// with no R2 read.
+export async function downloadRoute(c: AppContext): Promise<Response> {
+  const deps = c.get("deps");
+  const gate = await gateToken(deps, c.req.query("token"));
+  if (gate.kind !== "active") return c.text("Not found", 404);
+  const client = gate.client;
+
+  const result = await resolveServed(deps, client);
+  if (result.kind !== "target") return c.text("Not found", 404);
+  const build = result.build;
+
+  const via = c.req.query("via") === "update" ? "update" : "install";
+  const key =
+    via === "install" && build.dmgObjectKey !== null ? build.dmgObjectKey : build.objectKey;
+  const object = await getObject(deps.r2, key);
+  if (object === null) return c.text("Not found", 404);
+
+  await insertEvent(deps.db, {
+    clientId: client.id,
+    email: client.email,
+    event: via === "update" ? "update" : "download",
+    shortVersion: build.shortVersion,
+    buildNumber: build.buildNumber,
+    ip: c.req.header("cf-connecting-ip") ?? null,
+    userAgent: c.req.header("user-agent") ?? null,
+    createdAt: deps.clock(),
+  });
+
+  const filename = key.slice(key.lastIndexOf("/") + 1);
+  return new Response(object.body, {
+    headers: {
+      "Content-Type": "application/octet-stream",
+      "Content-Disposition": `attachment; filename="${filename}"`,
+    },
+  });
+}

package/src/routes/app/get.tsx

@@ -0,0 +1,35 @@
+import { gateToken } from "../../auth/token-gate";
+import { loadActivateScheme, loadBranding } from "../../services/branding";
+import { NotFoundPage } from "../../views/access-page";
+import { GetPage } from "../../views/get-page";
+import { renderPage } from "../../views/layout";
+import type { AppContext } from "./app-context";
+
+// §6 — the token-gated landing page. Invalid/revoked tokens get the generic 404 (never the get page),
+// so existence isn't confirmed. Referrer-Policy:no-referrer keeps the token out of Referer (§16).
+
+export async function getRoute(c: AppContext): Promise<Response> {
+  const deps = c.get("deps");
+  const gate = await gateToken(deps, c.req.query("token"));
+  if (gate.kind !== "active") {
+    return c.html(renderPage(<NotFoundPage />), 404);
+  }
+
+  const { token } = gate.client;
+  const branding = await loadBranding(deps);
+  const scheme = await loadActivateScheme(deps); // §7 deep-link scheme (admin-configurable in Settings)
+  const downloadUrl = `/download?token=${encodeURIComponent(token)}&via=install`;
+  const activateUrl = `${scheme}://activate?token=${encodeURIComponent(token)}`;
+
+  c.header("Referrer-Policy", "no-referrer");
+  return c.html(
+    renderPage(
+      <GetPage
+        branding={branding}
+        token={token}
+        downloadUrl={downloadUrl}
+        activateUrl={activateUrl}
+      />,
+    ),
+  );
+}

package/src/routes/app/index.ts

@@ -0,0 +1,31 @@
+import { Hono } from "hono";
+import { buildDeps, type Deps } from "../../deps";
+import type { Env } from "../../env";
+import { accessRoute, postAccessRoute } from "./access";
+import type { AppEnv } from "./app-context";
+import { appcastRoute } from "./appcast";
+import { assetsRoute } from "./assets";
+import { downloadRoute } from "./download";
+import { getRoute } from "./get";
+
+// The public App Worker surface (ROLE=app). /appcast is added in M10. There are no admin routes here,
+// so any /admin/* path falls through to the generic 404 — there is no ungated admin surface.
+// depsFor is injectable so tests swap seams (clock, and later access/email).
+export function createAppApp(depsFor: (env: Env) => Deps = buildDeps) {
+  const app = new Hono<AppEnv>();
+
+  app.use("*", async (c, next) => {
+    c.set("deps", depsFor(c.env));
+    await next();
+  });
+
+  app.get("/get", getRoute);
+  app.get("/appcast", appcastRoute);
+  app.get("/download", downloadRoute);
+  app.get("/assets/:name", assetsRoute);
+  app.get("/access", accessRoute);
+  app.post("/access", postAccessRoute);
+
+  app.notFound((c) => c.text("Not found", 404));
+  return app;
+}

package/src/routes/app/resolve.ts

@@ -0,0 +1,16 @@
+import { type ResolverResult, resolve } from "../../core/resolver";
+import type { Client } from "../../core/types";
+import { listAvailable, listBuildStreams } from "../../db/builds";
+import { streamIdsForClient } from "../../db/streams";
+import type { Deps } from "../../deps";
+
+// Loads the slice the §8 resolver needs for one client and runs it. Shared by /appcast and /download
+// so both serve exactly the same target. Passing only available builds is sufficient: a pin to a
+// withdrawn build is then absent → resolver yields none (the no-build state), which is correct.
+// Queries run sequentially — D1 dislikes concurrent statements on one session.
+export async function resolveServed(deps: Deps, client: Client): Promise<ResolverResult> {
+  const builds = await listAvailable(deps.db);
+  const buildStreams = await listBuildStreams(deps.db);
+  const clientStreamIds = await streamIdsForClient(deps.db, client.id);
+  return resolve({ client, builds, buildStreams, clientStreamIds });
+}

package/src/services/anchor.ts

@@ -0,0 +1,54 @@
+import { assessChain, buildHead } from "../core/audit-chain";
+import { listInOrder } from "../db/admin-audit";
+import * as meta from "../db/meta";
+import type { Deps } from "../deps";
+import { putAuditAnchor } from "../r2/builds-bucket";
+import { auditAnchorKey } from "../r2/keys";
+
+// §16 — the daily audit anchor. Records the current chain head where the running admin can't silently
+// rewrite it (an append-only R2 object + an owner email), and detects tampering since the last anchor:
+// a chain that no longer verifies, is shorter (truncation), or whose old head hash no longer matches
+// the row at that position (divergence/rebuild) is flagged. The judgment itself (assessChain) is
+// shared with the admin Audit page, so the cron and the UI can never disagree.
+
+export interface AnchorResult {
+  hash: string;
+  count: number;
+  intact: boolean;
+}
+
+export async function anchorAudit(
+  deps: Deps,
+  opts: { now: string; ownerEmail: string | null },
+): Promise<AnchorResult> {
+  const rows = await listInOrder(deps.db);
+  const head = buildHead(rows);
+  const priorRaw = await meta.get(deps.db, "audit_anchor_head");
+  const { intact, anchored: prior } = await assessChain(rows, priorRaw);
+
+  const anchor = { hash: head.hash, count: head.count, at: opts.now, intact };
+  await putAuditAnchor(deps.r2, auditAnchorKey(opts.now), JSON.stringify(anchor));
+
+  // Ratchet: only advance the trusted head when the chain is intact and no shorter than the last
+  // anchor. On any mismatch the prior head stays sticky, so a truncate-then-regrow can't launder
+  // itself back to "intact" on a later run.
+  if (intact && (prior === null || head.count >= prior.count)) {
+    await meta.set(
+      deps.db,
+      "audit_anchor_head",
+      JSON.stringify({ hash: head.hash, count: head.count }),
+    );
+  }
+
+  if (opts.ownerEmail !== null) {
+    await deps.email.send({
+      to: opts.ownerEmail,
+      subject: intact
+        ? `Alpha Gate audit anchor (${head.count} rows)`
+        : "Alpha Gate audit ANCHOR MISMATCH",
+      body: JSON.stringify(anchor),
+    });
+  }
+
+  return { hash: head.hash, count: head.count, intact };
+}

package/src/services/audit.ts

@@ -0,0 +1,19 @@
+import { type AuditFields, linkRow } from "../core/audit-chain";
+import { appendIfHead, getHead } from "../db/admin-audit";
+import type { Deps } from "../deps";
+
+// §16 — the single entry point admin mutations call to record a tamper-evident audit row. Reads the
+// head, links + hashes the new row (core/audit-chain), and appends it guarded on the head being
+// unchanged; on contention it retries, so concurrent mutations can never fork the chain.
+
+const MAX_ATTEMPTS = 5;
+
+export async function recordAudit(deps: Deps, fields: AuditFields): Promise<void> {
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    const head = await getHead(deps.db);
+    const prevHash = head?.hash ?? null;
+    const row = await linkRow(prevHash, fields);
+    if (await appendIfHead(deps.db, row, prevHash)) return;
+  }
+  throw new Error("audit chain write contention");
+}

package/src/services/branding.ts

@@ -0,0 +1,51 @@
+import {
+  type AccessNotice,
+  type Branding,
+  DEFAULT_ACCESS_NOTICE,
+  DEFAULT_BRANDING,
+  DEFAULT_INVITE_TEMPLATE,
+  fillAppName,
+  type InviteTemplate,
+  resolveActivateScheme,
+  safeAccent,
+} from "../core/invite-template";
+import { getAll, get as getMeta } from "../db/meta";
+import type { Deps } from "../deps";
+
+// §6/§13 — resolves the branded /get page model and the invite template from the `meta` table,
+// falling back to the clean defaults. The icon/header are served at /assets/icon and /assets/header
+// when one has been uploaded (tracked by meta.icon / meta.header = "1").
+
+export async function loadBranding(deps: Deps): Promise<Branding> {
+  const all = await getAll(deps.db);
+  return {
+    appName: all.app_name ?? DEFAULT_BRANDING.appName,
+    blurb: all.blurb ?? DEFAULT_BRANDING.blurb,
+    accent: safeAccent(all.accent), // coerce to a safe hex value — this is interpolated raw into CSS
+    iconUrl: all.icon === "1" ? "/assets/icon" : DEFAULT_BRANDING.iconUrl,
+    headerUrl: all.header === "1" ? "/assets/header" : DEFAULT_BRANDING.headerUrl,
+  };
+}
+
+/** The §7 activation deep-link scheme (meta.activate_scheme), validated, falling back to the default. */
+export async function loadActivateScheme(deps: Deps): Promise<string> {
+  return resolveActivateScheme(await getMeta(deps.db, "activate_scheme"));
+}
+
+export async function loadInviteTemplate(deps: Deps): Promise<InviteTemplate> {
+  const all = await getAll(deps.db);
+  return {
+    subject: all.invite_subject ?? DEFAULT_INVITE_TEMPLATE.subject,
+    body: all.invite_body ?? DEFAULT_INVITE_TEMPLATE.body,
+  };
+}
+
+/** §15 — the reactivation notice text (meta.notice_title / notice_message), {app_name}-filled. */
+export async function loadAccessNotice(deps: Deps): Promise<AccessNotice> {
+  const all = await getAll(deps.db);
+  const appName = all.app_name ?? DEFAULT_BRANDING.appName;
+  return {
+    title: fillAppName(all.notice_title ?? DEFAULT_ACCESS_NOTICE.title, appName),
+    message: fillAppName(all.notice_message ?? DEFAULT_ACCESS_NOTICE.message, appName),
+  };
+}

package/src/services/email-cloudflare.ts

@@ -0,0 +1,80 @@
+import type { ComposedEmail, EmailSender } from "./email";
+
+// §24 — the Cloudflare Email Service adapter (EMAIL_PROVIDER="cloudflare"). It composes an RFC 5322
+// message from the purely-composed invite (core/invite-template) and hands it to the `send_email`
+// binding via cloudflare:email's EmailMessage. ACTUAL DELIVERY is real-infra-only — it needs Workers
+// Paid + an onboarded sending domain, so it is exercised against live Cloudflare, never in the offline
+// test runtime (§23). The MIME composition below is pure and unit-tested; cloudflare:email is imported
+// lazily inside send() so the test module graph never loads a binding it can't satisfy.
+
+export interface CloudflareEmailDeps {
+  /** The `EMAIL` send_email binding (admin Worker only). */
+  binding: SendEmail;
+  /** The verified From address on the onboarded sending domain (EMAIL_FROM). */
+  from: string;
+  /** RFC 5322 date for the `Date:` header — the clock seam (lib/clock emailDate). */
+  emailDate: () => string;
+}
+
+export function createCloudflareEmailSender(deps: CloudflareEmailDeps): EmailSender {
+  return {
+    async send(email: ComposedEmail): Promise<void> {
+      // Lazy: only the real send path touches cloudflare:email (unavailable/irrelevant in tests).
+      const { EmailMessage } = await import("cloudflare:email");
+      const date = deps.emailDate();
+      const raw = composeMimeMessage({
+        from: deps.from,
+        to: email.to,
+        subject: email.subject,
+        body: email.body,
+        date,
+        messageId: makeMessageId(deps.from, email.to, date),
+      });
+      await deps.binding.send(new EmailMessage(deps.from, email.to, raw));
+    },
+  };
+}
+
+export interface MimeParts {
+  from: string;
+  to: string;
+  subject: string;
+  body: string;
+  date: string;
+  messageId: string;
+}
+
+/**
+ * Pure RFC 5322 plain-text message builder. Header values are stripped of CR/LF to prevent header
+ * injection (a hostile app name in the subject must not be able to forge headers); the body is
+ * normalised to CRLF line endings and separated from the headers by a blank line.
+ */
+export function composeMimeMessage(parts: MimeParts): string {
+  const headers = [
+    `From: ${sanitizeHeader(parts.from)}`,
+    `To: ${sanitizeHeader(parts.to)}`,
+    `Subject: ${sanitizeHeader(parts.subject)}`,
+    `Message-ID: ${sanitizeHeader(parts.messageId)}`,
+    `Date: ${sanitizeHeader(parts.date)}`,
+    "MIME-Version: 1.0",
+    "Content-Type: text/plain; charset=utf-8",
+  ];
+  const body = parts.body.replace(/\r\n/g, "\n").replace(/\n/g, "\r\n");
+  return `${headers.join("\r\n")}\r\n\r\n${body}`;
+}
+
+/** A deterministic, header-safe Message-ID derived from the date + recipient + sender domain. */
+export function makeMessageId(from: string, to: string, date: string): string {
+  const at = from.lastIndexOf("@");
+  const domain = at >= 0 ? from.slice(at + 1) : "alpha-gate.local";
+  const local = idSafe(`${date}.${to}`);
+  return `<${local}@${idSafe(domain)}>`;
+}
+
+function sanitizeHeader(value: string): string {
+  return value.replace(/[\r\n]+/g, " ").trim();
+}
+
+function idSafe(value: string): string {
+  return value.replace(/[^A-Za-z0-9.-]/g, "-");
+}

package/src/services/email.ts

@@ -0,0 +1,68 @@
+import type { Env } from "../env";
+import { createCloudflareEmailSender } from "./email-cloudflare";
+
+// §13/§24 — the email seam. Invites are composed purely (core/invite-template); this only delivers.
+// The free-tier default is copy-paste: nothing is sent and the admin UI surfaces the /get link. The
+// Cloudflare Email Service adapter (EMAIL_PROVIDER="cloudflare", Workers Paid + an onboarded sending
+// domain + the `EMAIL` send_email binding) delivers for real; its actual send is real-infra-only (§23).
+// Anything misconfigured falls back to copy-paste so a missing binding never throws at request time.
+
+export interface ComposedEmail {
+  to: string;
+  subject: string;
+  body: string;
+}
+
+export interface EmailSender {
+  send(email: ComposedEmail): Promise<void>;
+}
+
+/** Copy-paste mode: nothing leaves the Worker; the invite link is shown in the back office. */
+export const noopEmailSender: EmailSender = {
+  async send() {
+    // intentionally no-op
+  },
+};
+
+export type EmailMode =
+  | "active" // provider=cloudflare, fully wired — invites are actually emailed
+  | "incomplete" // provider=cloudflare but a prerequisite is missing — silently falls back to copy-paste
+  | "copy-paste"; // provider=none — intentional free-tier default; the back office shows the link
+
+export interface EmailStatus {
+  mode: EmailMode;
+  /** EMAIL_FROM as configured (may be empty). */
+  from: string;
+  /** For "incomplete": the human-readable prerequisites the cloudflare provider is still missing. */
+  missing: string[];
+}
+
+/**
+ * The true email-delivery state for this Worker — the single source of truth shared by delivery
+ * (selectEmailSender) and the admin UI, so what the Settings page reports can't drift from what actually
+ * sends. Cloudflare delivery needs ALL of: provider="cloudflare", the `EMAIL` binding (admin Worker only,
+ * added by deploy when email is on), and a non-empty From. Any gap with provider="cloudflare" is
+ * "incomplete" — delivery quietly falls back to copy-paste, which the UI must call out rather than hide.
+ */
+export function emailStatus(env: Env): EmailStatus {
+  const from = env.EMAIL_FROM;
+  if (env.EMAIL_PROVIDER !== "cloudflare") return { mode: "copy-paste", from, missing: [] };
+  const missing: string[] = [];
+  if (env.EMAIL === undefined) missing.push("the EMAIL send_email binding");
+  if (from.length === 0) missing.push("a From address (EMAIL_FROM)");
+  return missing.length > 0
+    ? { mode: "incomplete", from, missing }
+    : { mode: "active", from, missing };
+}
+
+/**
+ * Picks the delivery adapter from the runtime env, off the same {@link emailStatus} the UI reports. Only
+ * "active" delivers for real; everything else falls back to copy-paste rather than fail. `emailDate` is
+ * the clock seam for the Date header.
+ */
+export function selectEmailSender(env: Env, emailDate: () => string): EmailSender {
+  if (emailStatus(env).mode === "active" && env.EMAIL !== undefined) {
+    return createCloudflareEmailSender({ binding: env.EMAIL, from: env.EMAIL_FROM, emailDate });
+  }
+  return noopEmailSender;
+}

package/src/services/self-update.ts

@@ -0,0 +1,62 @@
+import { isUpdateAvailable, type UpdateManifest } from "../core/version";
+import * as meta from "../db/meta";
+import type { Deps } from "../deps";
+
+// §22 — checks the upstream manifest for a newer version of the TOOL ITSELF, stores the result in
+// meta (the dashboard banner reads it), and emails the operator once per new version. Defensive: a
+// failed/garbage fetch is swallowed (the cron just retries next time); never throws.
+
+export interface SelfUpdateOptions {
+  toolVersion: string;
+  manifestUrl: string;
+  ownerEmail: string | null;
+}
+
+export async function checkSelfUpdate(deps: Deps, opts: SelfUpdateOptions): Promise<void> {
+  // Record the attempt time up front (before the fetch that may fail), so Settings can honestly show
+  // "last checked" — and distinguish "checked, up to date" from "never checked / cron not firing".
+  await meta.set(deps.db, "selfupdate_checked_at", deps.clock());
+
+  let manifest: UpdateManifest;
+  try {
+    const res = await deps.fetch(opts.manifestUrl);
+    if (!res.ok) return;
+    manifest = (await res.json()) as UpdateManifest;
+  } catch {
+    return;
+  }
+
+  const status = isUpdateAvailable(opts.toolVersion, manifest);
+  await meta.set(deps.db, "selfupdate_latest", status.latest ?? "");
+  await meta.set(deps.db, "selfupdate_available", status.available ? "1" : "0");
+  await meta.set(deps.db, "selfupdate_breaking", status.breaking ? "1" : "0");
+  await meta.set(deps.db, "selfupdate_below_min", status.belowMinSupported ? "1" : "0");
+  // notes_url is untrusted upstream input — only persist a safe http(s) link (the dashboard renders it).
+  await meta.set(deps.db, "selfupdate_notes_url", safeHttpUrl(status.notesUrl) ?? "");
+
+  if (status.available && status.latest !== null && opts.ownerEmail !== null) {
+    const lastNotified = await meta.get(deps.db, "last_notified_version");
+    if (lastNotified !== status.latest) {
+      const notes = safeHttpUrl(status.notesUrl);
+      await deps.email.send({
+        to: opts.ownerEmail,
+        subject: `Alpha Gate ${status.latest} is available`,
+        body: `A newer Alpha Gate (${status.latest}) is available${
+          status.breaking ? " — note: breaking changes" : ""
+        }.${notes !== null ? ` Release notes: ${notes}.` : ""} Update Alpha Gate (git pull or npx alpha-gate@latest) and re-run deploy.`,
+      });
+      await meta.set(deps.db, "last_notified_version", status.latest);
+    }
+  }
+}
+
+/** Accept only absolute http(s) URLs; reject javascript:/data: and anything unparseable (defense). */
+function safeHttpUrl(url: string | null): string | null {
+  if (url === null) return null;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "https:" || parsed.protocol === "http:" ? url : null;
+  } catch {
+    return null;
+  }
+}

package/src/views/access-page.tsx

@@ -0,0 +1,39 @@
+import type { FC } from "hono/jsx";
+import { DEFAULT_BRANDING } from "../core/invite-template";
+import { Layout } from "./layout";
+
+// §13 — the public "request access" page (target of the revoked-user notice link) and the generic
+// 404 surface returned for an invalid/revoked token on /get, which must NOT confirm token existence.
+
+export const AccessPage: FC<{ appName: string; accent: string }> = ({ appName, accent }) => (
+  <Layout title={appName} accent={accent}>
+    <h1>Request access</h1>
+    <p class="blurb">Enter your email to request access to the {appName} alpha.</p>
+    <form method="post" action="/access">
+      <input class="input" type="email" name="email" placeholder="you@example.com" required />
+      <button class="btn primary" type="submit">
+        Request access
+      </button>
+    </form>
+  </Layout>
+);
+
+export const RequestReceivedPage: FC<{ appName: string; accent: string }> = ({
+  appName,
+  accent,
+}) => (
+  <Layout title={appName} accent={accent}>
+    <h1>Request received</h1>
+    <p class="blurb">
+      Thanks — your request for {appName} access has been recorded. The admin will follow up by
+      email.
+    </p>
+  </Layout>
+);
+
+export const NotFoundPage: FC<{ accent?: string }> = ({ accent = DEFAULT_BRANDING.accent }) => (
+  <Layout title="Not found" accent={accent}>
+    <h1>Not found</h1>
+    <p class="muted">This page isn’t available.</p>
+  </Layout>
+);