cascivo 1.4.0 → 1.6.0

package/dist/{create-D_3pilHu.mjs → create-DmBKREqv.mjs}

@@ -1,13 +1,13 @@
-import{a as e,r as t}from"./config-DT-Cs7bC.mjs";import{i as n}from"./fs-B7O-fNID.mjs";import{n as r,r as i,t as a}from"./args-CtmltI1S.mjs";import{stdin as o,stdout as s}from"node:process";import{existsSync as c,readdirSync as l}from"node:fs";import{join as u}from"node:path";import{createInterface as d}from"node:readline/promises";const f={"@cascivo/react":`1.4.0`,"@cascivo/themes":`1.0.0`,"@cascivo/charts":`1.4.0`,"@cascivo/icons":`1.1.0`,"@cascivo/eslint-config":`0.4.1`,"@cascivo/app":`1.4.0`,"@cascivo/render":`1.4.0`,"@cascivo/storage":`1.4.0`},p=`>=3.0.0`;function m(e){let t=e.startsWith(`/`)?e:`/${e}`;return t.length>1?t.replace(/\/+$/,``)||`/`:t}function h(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}function g(e){let t=m(e).split(`/`).filter(Boolean),n=[],r=[],i=``;return t.forEach((a,o)=>{if(a===`*`){if(o!==t.length-1)throw Error(`"*" must be the last segment of a path pattern: "${e}"`);n.push(`*`),r.push(1),i+=`(?:/(.*))?`}else if(a.startsWith(`:`)){let t=a.slice(1);if(!/^[A-Za-z_$][\w$]*$/.test(t))throw Error(`Invalid param name "${t}" in path pattern "${e}"`);n.push(t),r.push(2),i+=`/([^/]+)`}else r.push(3),i+=`/${h(a)}`}),{pattern:e,keys:n,regex:RegExp(`^${i||`/`}/?$`),score:r}}function _(e,t){let n=Math.max(e.score.length,t.score.length);for(let r=0;r<n;r++){let n=(t.score[r]??0)-(e.score[r]??0);if(n!==0)return n}return 0}var v=/\.(tsx|jsx)$/;function y(e){if(!v.test(e)||/\.(test|spec)\.[jt]sx$/.test(e))return;let t=e.replace(v,``).split(`/`);if(!t.some(e=>e.startsWith(`_`)))return t.length===1&&t[0]===`404`?null:(t.at(-1)===`index`&&t.pop(),`/${t.map((n,r)=>{if(/^\[\.\.\.[A-Za-z_$][\w$]*\]$/.test(n)){if(r!==t.length-1)throw Error(`routes/${e}: a [...rest] segment must be last`);return`*`}let i=/^\[([A-Za-z_$][\w$]*)\]$/.exec(n);if(i)return`:${i[1]}`;if(/[[\]]/.test(n))throw Error(`routes/${e}: malformed segment "${n}"`);return n}).join(`/`)}`)}function b(e,t){let n=[],r=new Map;for(let t of e){let e=y(t);if(e===void 0)continue;let i=r.get(e);if(i)throw Error(`routes/${i} and routes/${t} both define ${e??`the 404 route`}`);r.set(e,t),n.push({file:t,path:e})}let i=e=>`${t}/${e.replace(v,``)}`,a=n.filter(e=>e.path!==null).map(e=>({...e,compiled:g(e.path)})).sort((e,t)=>_(e.compiled,t.compiled)||e.path.localeCompare(t.path)),o=n.find(e=>e.path===null);return[`// Generated by @cascivo/app/vite from the routes directory — do not edit.`,`// Add, rename or delete a route file and this file is rewritten.`,`import { lazyRoute } from '@cascivo/app'`,`import type { Route } from '@cascivo/app'`,``,`export const routes: Route[] = [`,...a.map(e=>`  lazyRoute('${e.path}', () => import('${i(e.file)}')),`),`]`,``,o?`export const notFound: Route | undefined = lazyRoute('*', () => import('${i(o.file)}'))`:`export const notFound: Route | undefined = undefined`,``,"/** Every route pattern. Fill one with `buildPath` for a typed link. */",`export type AppPath = ${a.length>0?a.map(e=>`'${e.path}'`).join(` | `):`never`}`,``].join(`
-`)}const x=f;function S(e){return e===`yarn`?`yarn`:`${e} install`}function C(e,t){return e===`npm`?`npm run ${t}`:`${e} ${t}`}function w(e,t){return`${e} run ${t}`}const T=[`react-vite`,`astro`,`cloudflare`],E=[`preact`,`react`],D=[`board`,`agent`,`notes`,`import`,`files`,`export`,`usage`,`crud`,`live`,`voice`,`publish`,`webhooks`,`digest`,`search`];function O(e){return D.includes(e)}function k(e){return E.includes(e)}function A(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,`-`).replace(/^-+|-+$/g,``)||`section`}function j(e){let t=e.trim().split(/[^a-zA-Z0-9]+/).filter(Boolean).map(e=>e.charAt(0).toUpperCase()+e.slice(1)).join(``)||`Section`;return/^[0-9]/.test(t)?`Section${t}`:t}function M(e){let t=e.trim().split(/[^a-zA-Z0-9]+/).filter(e=>e!==``&&!/^\d+$/.test(e)&&!/^v\d+$/i.test(e)),n=[];for(let e of t){if(n.length>=3||n.length>0&&n.join(` `).length+1+e.length>24)break;n.push(e.charAt(0).toUpperCase()+e.slice(1))}return n.join(` `)||`App`}function N(e){return e.trim().toLowerCase().replace(/[^a-z0-9._-]+/g,`-`).replace(/^-+|-+$/g,``)||`cascivo-app`}function ee(e){let t=new Set,n=new Set,r=[];for(let i of e){let e=i.trim();if(!e)continue;let a=A(e),o=j(e),s=2;for(;t.has(a)||n.has(o);)a=`${A(e)}-${s}`,o=`${j(e)}${s}`,s++;t.add(a),n.add(o),r.push({key:a,label:e,component:o})}return r.length>0?r:[{key:`home`,label:`Home`,component:`Home`}]}function te(e){let t={name:N(e.name),private:!0,version:`0.0.0`,type:`module`,scripts:{dev:`vite`,build:`tsc && vite build`,preview:`vite preview`,typecheck:`tsc --noEmit`,lint:`eslint .`,format:`prettier --write .`,"format:check":`prettier --check .`},dependencies:{"@cascivo/react":x[`@cascivo/react`],"@cascivo/themes":x[`@cascivo/themes`],"@preact/signals-react":p,react:`^19.0.0`,"react-dom":`^19.0.0`},devDependencies:{"@cascivo/eslint-config":x[`@cascivo/eslint-config`],"@eslint/js":`^9.0.0`,"@types/react":`^19.0.0`,"@types/react-dom":`^19.0.0`,"@vitejs/plugin-react":`^5.0.0`,eslint:`^9.0.0`,"eslint-plugin-react-hooks":`^7.0.0`,prettier:`^3.0.0`,typescript:`^5.7.0`,"typescript-eslint":`^8.0.0`,vite:`^7.0.0`}};return JSON.stringify(t,null,2)+`
+import{a as e,r as t}from"./config-DT-Cs7bC.mjs";import{i as n}from"./fs-B7O-fNID.mjs";import{n as r,r as i,t as a}from"./args-CtmltI1S.mjs";import{stdin as o,stdout as s}from"node:process";import{existsSync as c,readdirSync as l}from"node:fs";import{join as u}from"node:path";import{createInterface as d}from"node:readline/promises";const f={"@cascivo/react":`1.6.0`,"@cascivo/themes":`1.0.1`,"@cascivo/charts":`1.6.0`,"@cascivo/icons":`1.1.0`,"@cascivo/eslint-config":`0.4.1`,"@cascivo/app":`1.6.0`,"@cascivo/render":`1.6.0`,"@cascivo/storage":`1.6.0`,"@cascivo/email":`0.5.0`},p=`>=3.0.0`;function m(e){let t=e.startsWith(`/`)?e:`/${e}`;return t.length>1?t.replace(/\/+$/,``)||`/`:t}function h(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}function g(e){let t=m(e).split(`/`).filter(Boolean),n=[],r=[],i=``;return t.forEach((a,o)=>{if(a===`*`){if(o!==t.length-1)throw Error(`"*" must be the last segment of a path pattern: "${e}"`);n.push(`*`),r.push(1),i+=`(?:/(.*))?`}else if(a.startsWith(`:`)){let t=a.slice(1);if(!/^[A-Za-z_$][\w$]*$/.test(t))throw Error(`Invalid param name "${t}" in path pattern "${e}"`);n.push(t),r.push(2),i+=`/([^/]+)`}else r.push(3),i+=`/${h(a)}`}),{pattern:e,keys:n,regex:RegExp(`^${i||`/`}/?$`),score:r}}function _(e,t){let n=Math.max(e.score.length,t.score.length);for(let r=0;r<n;r++){let n=(t.score[r]??0)-(e.score[r]??0);if(n!==0)return n}return 0}var v=/\.(tsx|jsx)$/;function y(e){if(!v.test(e)||/\.(test|spec)\.[jt]sx$/.test(e))return;let t=e.replace(v,``).split(`/`);if(!t.some(e=>e.startsWith(`_`)))return t.length===1&&t[0]===`404`?null:(t.at(-1)===`index`&&t.pop(),`/${t.map((n,r)=>{if(/^\[\.\.\.[A-Za-z_$][\w$]*\]$/.test(n)){if(r!==t.length-1)throw Error(`routes/${e}: a [...rest] segment must be last`);return`*`}let i=/^\[([A-Za-z_$][\w$]*)\]$/.exec(n);if(i)return`:${i[1]}`;if(/[[\]]/.test(n))throw Error(`routes/${e}: malformed segment "${n}"`);return n}).join(`/`)}`)}function b(e,t){let n=[],r=new Map;for(let t of e){let e=y(t);if(e===void 0)continue;let i=r.get(e);if(i)throw Error(`routes/${i} and routes/${t} both define ${e??`the 404 route`}`);r.set(e,t),n.push({file:t,path:e})}let i=e=>`${t}/${e.replace(v,``)}`,a=n.filter(e=>e.path!==null).map(e=>({...e,compiled:g(e.path)})).sort((e,t)=>_(e.compiled,t.compiled)||e.path.localeCompare(t.path)),o=n.find(e=>e.path===null);return[`// Generated by @cascivo/app/vite from the routes directory — do not edit.`,`// Add, rename or delete a route file and this file is rewritten.`,`import { lazyRoute } from '@cascivo/app'`,`import type { Route } from '@cascivo/app'`,``,`export const routes: Route[] = [`,...a.map(e=>`  lazyRoute('${e.path}', () => import('${i(e.file)}')),`),`]`,``,o?`export const notFound: Route | undefined = lazyRoute('*', () => import('${i(o.file)}'))`:`export const notFound: Route | undefined = undefined`,``,"/** Every route pattern. Fill one with `buildPath` for a typed link. */",`export type AppPath = ${a.length>0?a.map(e=>`'${e.path}'`).join(` | `):`never`}`,``].join(`
+`)}const x=f;function S(e){return e===`yarn`?`yarn`:`${e} install`}function C(e,t){return e===`npm`?`npm run ${t}`:`${e} ${t}`}function w(e,t){return`${e} run ${t}`}const T=[`react-vite`,`astro`,`cloudflare`],E=[`preact`,`react`],D=[`board`,`agent`,`notes`,`import`,`files`,`export`,`usage`,`crud`,`live`,`voice`,`publish`,`webhooks`,`digest`,`search`,`checkout`,`newsletter`];function O(e){return D.includes(e)}function k(e){return E.includes(e)}function A(e){return e.trim().toLowerCase().replace(/[^a-z0-9]+/g,`-`).replace(/^-+|-+$/g,``)||`section`}function j(e){let t=e.trim().split(/[^a-zA-Z0-9]+/).filter(Boolean).map(e=>e.charAt(0).toUpperCase()+e.slice(1)).join(``)||`Section`;return/^[0-9]/.test(t)?`Section${t}`:t}function M(e){let t=e.trim().split(/[^a-zA-Z0-9]+/).filter(e=>e!==``&&!/^\d+$/.test(e)&&!/^v\d+$/i.test(e)),n=[];for(let e of t){if(n.length>=3||n.length>0&&n.join(` `).length+1+e.length>24)break;n.push(e.charAt(0).toUpperCase()+e.slice(1))}return n.join(` `)||`App`}function N(e){return e.trim().toLowerCase().replace(/[^a-z0-9._-]+/g,`-`).replace(/^-+|-+$/g,``)||`cascivo-app`}function ee(e){let t=new Set,n=new Set,r=[];for(let i of e){let e=i.trim();if(!e)continue;let a=A(e),o=j(e),s=2;for(;t.has(a)||n.has(o);)a=`${A(e)}-${s}`,o=`${j(e)}${s}`,s++;t.add(a),n.add(o),r.push({key:a,label:e,component:o})}return r.length>0?r:[{key:`home`,label:`Home`,component:`Home`}]}function te(e){let t={name:N(e.name),private:!0,version:`0.0.0`,type:`module`,scripts:{dev:`vite`,build:`tsc && vite build`,preview:`vite preview`,typecheck:`tsc --noEmit`,lint:`eslint .`,format:`prettier --write .`,"format:check":`prettier --check .`},dependencies:{"@cascivo/react":x[`@cascivo/react`],"@cascivo/themes":x[`@cascivo/themes`],"@preact/signals-react":p,react:`^19.0.0`,"react-dom":`^19.0.0`},devDependencies:{"@cascivo/eslint-config":x[`@cascivo/eslint-config`],"@eslint/js":`^9.0.0`,"@types/react":`^19.0.0`,"@types/react-dom":`^19.0.0`,"@vitejs/plugin-react":`^5.0.0`,eslint:`^9.0.0`,"eslint-plugin-react-hooks":`^7.0.0`,prettier:`^3.0.0`,typescript:`^5.7.0`,"typescript-eslint":`^8.0.0`,vite:`^7.0.0`}};return JSON.stringify(t,null,2)+`
 `}function P(e){return JSON.stringify(e,null,2).replace(/\[\n\s+("[^"\n]*"(?:,\n\s+"[^"\n]*")*)\n\s*\]/g,(e,t)=>`[${t.split(/,\n\s+/).join(`, `)}]`)+`
-`}function ne(){return P({compilerOptions:{target:`ES2022`,useDefineForClassFields:!0,lib:[`ES2022`,`DOM`,`DOM.Iterable`],module:`ESNext`,skipLibCheck:!0,moduleResolution:`bundler`,allowImportingTsExtensions:!0,resolveJsonModule:!0,isolatedModules:!0,moduleDetection:`force`,noEmit:!0,jsx:`react-jsx`,strict:!0,noUnusedLocals:!0,noUnusedParameters:!0,noFallthroughCasesInSwitch:!0},include:[`src`]})}function re(){return`import react from '@vitejs/plugin-react'
+`}function F(){return P({compilerOptions:{target:`ES2022`,useDefineForClassFields:!0,lib:[`ES2022`,`DOM`,`DOM.Iterable`],module:`ESNext`,skipLibCheck:!0,moduleResolution:`bundler`,allowImportingTsExtensions:!0,resolveJsonModule:!0,isolatedModules:!0,moduleDetection:`force`,noEmit:!0,jsx:`react-jsx`,strict:!0,noUnusedLocals:!0,noUnusedParameters:!0,noFallthroughCasesInSwitch:!0},include:[`src`]})}function ne(){return`import react from '@vitejs/plugin-react'
 import { defineConfig } from 'vite'
 
 export default defineConfig({
   plugins: [react()],
 })
-`}function ie(e){return`<!doctype html>
+`}function I(e){return`<!doctype html>
 <html lang="en" data-theme="${e.theme}">
   <head>
     <meta charset="UTF-8" />
@@ -46,7 +46,7 @@ export default defineConfig({
     <script type="module" src="/src/main.tsx"><\/script>
   </body>
 </html>
-`}function ae(){return`import React from 'react'
+`}function re(){return`import React from 'react'
 import ReactDOM from 'react-dom/client'
 import App from './App'
 
@@ -58,8 +58,8 @@ if (root) {
     </React.StrictMode>,
   )
 }
-`}function F(){return`/// <reference types="vite/client" />
-`}function oe(e){let t=e.map(e=>`import { ${e.component} } from './sections/${e.component}'`).join(`
+`}function ie(){return`/// <reference types="vite/client" />
+`}function ae(e){let t=e.map(e=>`import { ${e.component} } from './sections/${e.component}'`).join(`
 `),n=e.map(e=>`'${e.key}'`).join(` | `),r=e.map(e=>`    {
       label: '${e.label.replace(/'/g,`\\'`)}',
       active: section.value === '${e.key}',
@@ -91,7 +91,7 @@ ${i}
     </Shell>
   )
 }
-`}function I(e){return`'use client'
+`}function oe(e){return`'use client'
 import { AppShell, ShellHeader, SideNav, type SideNavItem } from '@cascivo/react'
 import type { ReactNode } from 'react'
 
@@ -121,10 +121,7 @@ export interface ShellProps {
  */
 export function Shell({ navItems, children }: ShellProps) {
   return (
-    <AppShell
-      header={<ShellHeader brand={{ name: '${M(e.name).replace(/'/g,`\\'`)}' }} />}
-      nav={<SideNav items={navItems} />}
-    >
+${z(e,`navItems`)}
       {children}
     </AppShell>
   )
@@ -177,8 +174,8 @@ export default [
   // see https://cascivo.com/docs/using-with-strict-eslint.md
   ...cascivo,
 ]
-`}function z(){return JSON.stringify({semi:!1,singleQuote:!0,printWidth:100},null,2)+`
-`}function B(){return`dist
+`}function z(e,t){let n=`header={<ShellHeader brand={{ name: '${M(e.name).replace(/'/g,`\\'`)}' }} />}`,r=`nav={<SideNav items={${t}} />}`,i=`    <AppShell ${n} ${r}>`;return i.length<=100?i:`    <AppShell\n      ${n}\n      ${r}\n    >`}function B(){return JSON.stringify({semi:!1,singleQuote:!0,printWidth:100},null,2)+`
+`}function V(){return`dist
 node_modules
 # Vendored cascivo source is formatted upstream — reformatting it makes every
 # \`cascivo add\` update a merge conflict.
@@ -187,17 +184,17 @@ src/components/ui/
 dist
 *.local
 .DS_Store
-`}function ce(e){return`
+`}function H(e){return`
 ## Share a preview
 
 No Cloudflare account needed. Run \`${C(e.pm??`npm`,`build`)}\`, then either:
 
 - drag the \`dist/\` folder onto [Cloudflare Drop](https://www.cloudflare.com/drop/), or
-- from a terminal: \`npx wrangler deploy --temporary --assets dist --name ${N(e.name)} --compatibility-date ${W}\`
+- from a terminal: \`npx wrangler deploy --temporary --assets dist --name ${N(e.name)} --compatibility-date ${K}\`
 
 Either way you get a public URL that lasts 60 minutes. Sign in to Cloudflare within that hour
 to keep it.
-`}function le(e){let t=e.pm??`npm`;return`# ${e.name}
+`}function ce(e){let t=e.pm??`npm`;return`# ${e.name}
 
 A [cascivo](https://cascivo.com) app — Vite + React + TypeScript, pre-wired with
 the cascivo app shell, side navigation, and the \`${e.theme}\` theme.
@@ -239,7 +236,7 @@ setLinkComponent(({ href, ...rest }: LinkComponentProps) => <Link to={href ?? '#
 That one call makes \`SideNav\`, \`ShellHeader\` and \`Breadcrumb\` render real router links.
 Links you write in page content use \`<Link asChild>\` instead — two kinds of link, two
 mechanisms. Full recipe: https://cascivo.com/docs/using-with-a-router.md
-${ce(e)}`}function V(e){return`# Agent instructions — ${e.name}
+${H(e)}`}function U(e){return`# Agent instructions — ${e.name}
 
 This is a [cascivo](https://cascivo.com) app. When generating or editing CSS, follow
 the **layer contract** — cascivo styles live in cascade layers, and layer order beats
@@ -306,8 +303,8 @@ The vocabulary types are on a subpath: \`import type { Tone } from '@cascivo/rea
 add \`@cascivo/core\` to this app's dependencies — it is transitive here.
 
 More: cascivo's machine-readable guide is at https://cascivo.com/llms.txt.
-`}function H(e,t){return t===0?`/`:`/${e.key}`}function U(e,t){return t===0?`index.astro`:`${e.key}.astro`}function ue(e){let t={name:N(e.name),private:!0,version:`0.0.0`,type:`module`,scripts:{dev:`astro dev`,build:`astro build`,preview:`astro preview`,typecheck:`astro check`,lint:`eslint .`,format:`prettier --write .`,"format:check":`prettier --check .`},dependencies:{"@astrojs/react":`^5.0.0`,"@cascivo/react":x[`@cascivo/react`],"@cascivo/themes":x[`@cascivo/themes`],"@preact/signals-react":p,astro:`^7.0.0`,react:`^19.0.0`,"react-dom":`^19.0.0`},devDependencies:{"@astrojs/check":`^0.9.0`,"@cascivo/eslint-config":x[`@cascivo/eslint-config`],"@eslint/js":`^9.0.0`,"@types/react":`^19.0.0`,"@types/react-dom":`^19.0.0`,eslint:`^9.0.0`,"eslint-plugin-react-hooks":`^7.0.0`,prettier:`^3.0.0`,typescript:`^5.7.0`,"typescript-eslint":`^8.0.0`}};return JSON.stringify(t,null,2)+`
-`}function de(){return`// @ts-check
+`}function W(e,t){return t===0?`/`:`/${e.key}`}function G(e,t){return t===0?`index.astro`:`${e.key}.astro`}function le(e){let t={name:N(e.name),private:!0,version:`0.0.0`,type:`module`,scripts:{dev:`astro dev`,build:`astro build`,preview:`astro preview`,typecheck:`astro check`,lint:`eslint .`,format:`prettier --write .`,"format:check":`prettier --check .`},dependencies:{"@astrojs/react":`^5.0.0`,"@cascivo/react":x[`@cascivo/react`],"@cascivo/themes":x[`@cascivo/themes`],"@preact/signals-react":p,astro:`^7.0.0`,react:`^19.0.0`,"react-dom":`^19.0.0`},devDependencies:{"@astrojs/check":`^0.9.0`,"@cascivo/eslint-config":x[`@cascivo/eslint-config`],"@eslint/js":`^9.0.0`,"@types/react":`^19.0.0`,"@types/react-dom":`^19.0.0`,eslint:`^9.0.0`,"eslint-plugin-react-hooks":`^7.0.0`,prettier:`^3.0.0`,typescript:`^5.7.0`,"typescript-eslint":`^8.0.0`}};return JSON.stringify(t,null,2)+`
+`}function ue(){return`// @ts-check
 import { defineConfig } from 'astro/config'
 import react from '@astrojs/react'
 
@@ -330,8 +327,8 @@ export default defineConfig({
     },
   },
 })
-`}function fe(){return JSON.stringify({extends:`astro/tsconfigs/strict`,include:[`.astro/types.d.ts`,`**/*`],exclude:[`dist`],compilerOptions:{jsx:`react-jsx`}},null,2)+`
-`}function pe(){return`/* Cascade layer order. Must load before any cascivo CSS — see the note in
+`}function de(){return JSON.stringify({extends:`astro/tsconfigs/strict`,include:[`.astro/types.d.ts`,`**/*`],exclude:[`dist`],compilerOptions:{jsx:`react-jsx`}},null,2)+`
+`}function fe(){return`/* Cascade layer order. Must load before any cascivo CSS — see the note in
    src/layouts/Layout.astro. Later layers beat earlier ones regardless of specificity.
 
    cascivo.example is this app's own slot: above the component and blocks layers so your
@@ -358,7 +355,7 @@ export default defineConfig({
     block-size: 100%;
   }
 }
-`}function me(e){return`---
+`}function pe(e){return`---
 // Import order matters: the layer statement must be established before any cascivo CSS.
 import '../styles/layers.css'
 import '@cascivo/themes/${e.theme}.css'
@@ -385,11 +382,11 @@ const { title } = Astro.props
     <slot />
   </body>
 </html>
-`}function he(e,t){return`import { AppShell, ShellHeader, SideNav, type SideNavItem } from '@cascivo/react'
+`}function me(e,t){return`import { AppShell, ShellHeader, SideNav, type SideNavItem } from '@cascivo/react'
 import type { ReactNode } from 'react'
 
 const NAV: { label: string; href: string }[] = [
-${t.map((e,t)=>`  { label: '${e.label.replace(/'/g,`\\'`)}', href: '${H(e,t)}' },`).join(`
+${t.map((e,t)=>`  { label: '${e.label.replace(/'/g,`\\'`)}', href: '${W(e,t)}' },`).join(`
 `)}
 ]
 
@@ -412,15 +409,12 @@ export function Shell({ activePath, children }: ShellProps) {
   }))
 
   return (
-    <AppShell
-      header={<ShellHeader brand={{ name: '${M(e.name).replace(/'/g,`\\'`)}' }} />}
-      nav={<SideNav items={items} />}
-    >
+${z(e,`items`)}
       {children}
     </AppShell>
   )
 }
-`}function ge(e){return`import { Card, CardContent, CardHeader, CardTitle, Flex, Heading, Text } from '@cascivo/react'
+`}function he(e){return`import { Card, CardContent, CardHeader, CardTitle, Flex, Heading, Text } from '@cascivo/react'
 
 export function ${e.component}() {
   return (
@@ -446,7 +440,7 @@ export function ${e.component}() {
     </Flex>
   )
 }
-`}function _e(e,t){return`---
+`}function ge(e,t){return`---
 import Layout from '../layouts/Layout.astro'
 import { Shell } from '../components/Shell'
 import { ${e.component} } from '../components/${e.component}'
@@ -455,16 +449,16 @@ import { ${e.component} } from '../components/${e.component}'
 <Layout title="${e.label}">
   {/* client:load hydrates the shell for its mobile nav drawer. The section below stays
       server-rendered HTML — it is slotted in as children and ships no JS. */}
-  <Shell client:load activePath="${H(e,t)}">
+  <Shell client:load activePath="${W(e,t)}">
     <${e.component} />
   </Shell>
 </Layout>
-`}function ve(){return`node_modules
+`}function _e(){return`node_modules
 dist
 .astro
 *.local
 .DS_Store
-`}function ye(e,t){let n=e.pm??`npm`,r=t.map((e,t)=>`- \`${H(e,t)}\` — \`src/pages/${U(e,t)}\``).join(`
+`}function ve(e,t){let n=e.pm??`npm`,r=t.map((e,t)=>`- \`${W(e,t)}\` — \`src/pages/${G(e,t)}\``).join(`
 `);return`# ${e.name}
 
 A [cascivo](https://cascivo.com) app — Astro + React islands + TypeScript, pre-wired with
@@ -507,8 +501,8 @@ and that order matters: layers take their position from first appearance, so a s
 loaded after the theme cannot reorder anything.
 
 Add more components with \`npx cascivo add <component>\`.
-${ce(e)}`}const W=`2026-09-01`;function be(e){let t=e.pm??`npm`,n=K(e,`agent`),r=Q(e),i=$(e)===`preact`,a={name:N(e.name),private:!0,version:`0.0.0`,type:`module`,scripts:{dev:`vite`,build:r?`tsc && tsc -p tsconfig.worker.json && vite build`:`tsc && vite build`,preview:`vite preview`,deploy:`${C(t,`build`)} && wrangler deploy`,"deploy:preview":`${C(t,`build`)} && wrangler deploy --temporary`,typecheck:r?`tsc --noEmit && tsc --noEmit -p tsconfig.worker.json`:`tsc --noEmit`,lint:`eslint .`,format:`prettier --write .`,"format:check":`prettier --check .`},dependencies:{"@cascivo/app":x[`@cascivo/app`],"@cascivo/react":x[`@cascivo/react`],"@cascivo/themes":x[`@cascivo/themes`],"@preact/signals-react":p,...i?{preact:`^10.29.0`}:{react:`^19.0.0`,"react-dom":`^19.0.0`},...K(e,`usage`)||K(e,`live`)?{"@cascivo/charts":x[`@cascivo/charts`]}:{},...K(e,`export`)?{"@cloudflare/puppeteer":`^1.4.0`}:{},...K(e,`notes`)?{"@cascivo/storage":x[`@cascivo/storage`]}:{},...n?{"@ai-sdk/react":`^4.0.0`,"@cascivo/render":x[`@cascivo/render`],"@cloudflare/ai-chat":`^0.12.0`,agents:`^0.24.0`,ai:`^7.0.0`,"workers-ai-provider":`^4.0.0`,zod:`^4.0.0`}:{},...K(e,`voice`)&&!n?{agents:`^0.24.0`}:{},...K(e,`publish`)&&!n?{"@cascivo/render":x[`@cascivo/render`]}:{},...K(e,`publish`)&&i?{"preact-render-to-string":`^6.5.0`}:{}},devDependencies:{"@cascivo/eslint-config":x[`@cascivo/eslint-config`],"@cloudflare/vite-plugin":`^1.62.0`,...r?{"@cloudflare/workers-types":`^5.0.0`}:{},"@eslint/js":`^9.0.0`,"@types/react":`^19.0.0`,"@types/react-dom":`^19.0.0`,...i?{"@babel/core":`^7.0.0`,"@preact/preset-vite":`^2.10.0`,react:`^19.0.0`,"react-dom":`^19.0.0`}:{"@vitejs/plugin-react":`^6.0.0`},eslint:`^9.0.0`,"eslint-plugin-react-hooks":`^7.0.0`,prettier:`^3.0.0`,typescript:`^5.7.0`,"typescript-eslint":`^8.0.0`,vite:`^8.0.0`,wrangler:`^4.143.0`}};return JSON.stringify(a,null,2)+`
-`}function xe(e){let t=JSON.parse(ne());return t.include=Q(e)?[`src`]:[`src`,`worker`],P(t)}function Se(){return P({extends:`./tsconfig.json`,compilerOptions:{lib:[`ES2022`],types:[`@cloudflare/workers-types`,`vite/client`]},include:[`worker`]})}function Ce(e,t){let n=K(t,`agent`),r=X(t),i=e===`preact`?`import preact from '@preact/preset-vite'`:`import react from '@vitejs/plugin-react'`,a=e===`preact`?`preact()`:`react()`;return`${i}
+${H(e)}`}const K=`2026-09-01`;function ye(e){let t=e.pm??`npm`,n=X(e,`agent`),r=Q(e),i=$(e)===`preact`,a={name:N(e.name),private:!0,version:`0.0.0`,type:`module`,scripts:{dev:`vite`,build:r?`tsc && tsc -p tsconfig.worker.json && vite build`:`tsc && vite build`,preview:`vite preview`,deploy:`${C(t,`build`)} && wrangler deploy`,"deploy:preview":`${C(t,`build`)} && wrangler deploy --temporary`,typecheck:r?`tsc --noEmit && tsc --noEmit -p tsconfig.worker.json`:`tsc --noEmit`,lint:`eslint .`,format:`prettier --write .`,"format:check":`prettier --check .`},dependencies:{"@cascivo/app":x[`@cascivo/app`],"@cascivo/react":x[`@cascivo/react`],"@cascivo/themes":x[`@cascivo/themes`],"@preact/signals-react":p,...i?{preact:`^10.29.0`}:{react:`^19.0.0`,"react-dom":`^19.0.0`},...X(e,`usage`)||X(e,`live`)?{"@cascivo/charts":x[`@cascivo/charts`]}:{},...X(e,`export`)?{"@cloudflare/puppeteer":`^1.4.0`}:{},...X(e,`notes`)?{"@cascivo/storage":x[`@cascivo/storage`]}:{},...n?{"@ai-sdk/react":`^4.0.0`,"@cascivo/render":x[`@cascivo/render`],"@cloudflare/ai-chat":`^0.12.0`,agents:`^0.24.0`,ai:`^7.0.0`,"workers-ai-provider":`^4.0.0`,zod:`^4.0.0`}:{},...X(e,`voice`)&&!n?{agents:`^0.24.0`}:{},...X(e,`publish`)&&!n?{"@cascivo/render":x[`@cascivo/render`]}:{},...X(e,`checkout`)||X(e,`newsletter`)?{"@cascivo/email":x[`@cascivo/email`]}:{},...(X(e,`publish`)||X(e,`checkout`)||X(e,`newsletter`))&&i?{"preact-render-to-string":`^6.5.0`}:{}},devDependencies:{"@cascivo/eslint-config":x[`@cascivo/eslint-config`],"@cloudflare/vite-plugin":`^1.62.0`,...r?{"@cloudflare/workers-types":`^5.0.0`}:{},"@eslint/js":`^9.0.0`,"@types/react":`^19.0.0`,"@types/react-dom":`^19.0.0`,...i?{"@babel/core":`^7.0.0`,"@preact/preset-vite":`^2.10.0`,react:`^19.0.0`,"react-dom":`^19.0.0`}:{"@vitejs/plugin-react":`^6.0.0`},eslint:`^9.0.0`,"eslint-plugin-react-hooks":`^7.0.0`,prettier:`^3.0.0`,typescript:`^5.7.0`,"typescript-eslint":`^8.0.0`,vite:`^8.0.0`,wrangler:`^4.143.0`}},o=un(e);return JSON.stringify(Object.keys(o).length>0?{...a,cloudflare:{bindings:o}}:a,null,2)+`
+`}function be(e){let t=JSON.parse(F());return t.include=Q(e)?[`src`]:[`src`,`worker`],P(t)}function xe(){return P({extends:`./tsconfig.json`,compilerOptions:{lib:[`ES2022`],types:[`@cloudflare/workers-types`,`vite/client`]},include:[`worker`]})}function Se(e,t){let n=X(t,`agent`),r=ke(t),i=e===`preact`?`import preact from '@preact/preset-vite'`:`import react from '@vitejs/plugin-react'`,a=e===`preact`?`preact()`:`react()`;return`${i}
 import { cascivoRoutes } from '@cascivo/app/vite'
 import { cloudflare } from '@cloudflare/vite-plugin'
 import { defineConfig } from 'vite'
@@ -526,7 +520,7 @@ ${e===`preact`?`// The source is written against React's types; @preact/preset-v
 // client, so dev and production execute the same runtime. Request routing is in wrangler.jsonc.${r?`
 //
 // Workers AI has no local mode: with remote bindings on, \`vite dev\` needs a Cloudflare login.
-// So they are off, ${K(t,`search`)?`and:${[n?`the assistant answers from worker/scripted-model.ts`:``,K(t,`voice`)?`the voice page uses the stand-ins in worker/scripted-voice.ts`:``,`search runs by keyword, on SQLite full-text search (worker/search.ts)`].filter(Boolean).map(e=>`\n// - ${e}`).join(``)}`:n&&K(t,`voice`)?`the assistant answers from worker/scripted-model.ts, and the voice
+// So they are off, ${X(t,`search`)?`and:${[n?`the assistant answers from worker/scripted-model.ts`:``,X(t,`voice`)?`the voice page uses the stand-ins in worker/scripted-voice.ts`:``,`search runs by keyword, on SQLite full-text search (worker/search.ts)`].filter(Boolean).map(e=>`\n// - ${e}`).join(``)}`:n&&X(t,`voice`)?`the assistant answers from worker/scripted-model.ts, and the voice
 // page uses the stand-ins in worker/scripted-voice.ts`:n?`and the assistant answers from worker/scripted-model.ts`:`and the voice page uses the stand-ins in worker/scripted-voice.ts`}. Run
 // \`VITE_REAL_AI=1 vite dev\` (after \`wrangler login\`) to use Workers AI.`:``}
 export default defineConfig({
@@ -534,18 +528,18 @@ ${r?`  plugins: [
     ${a},
     cascivoRoutes(),
     cloudflare({ remoteBindings: process.env['VITE_REAL_AI'] === '1' }),
-  ],`:`  plugins: [${a}, cascivoRoutes(), cloudflare()],`}${K(t,`publish`)?`
+  ],`:`  plugins: [${a}, cascivoRoutes(), cloudflare()],`}${X(t,`publish`)?`
   // A published page's HTML links the stylesheets its route needs, found in this manifest
   // (worker/page-html.ts), so the page is styled for readers without JavaScript too.
   build: { manifest: 'asset-manifest.json' },`:``}
 })
-`}function G(e,t,n){let r=`${e}"${t}": [${n.join(`, `)}],`;return r.length<=100?r:`${e}"${t}": [\n${n.map(t=>`${e}  ${t},`).join(`
-`)}\n${e}],`}function we(e){let t=K(e,`publish`),n=Ee(e),r=K(e,`agent`),i=Z(e),a=[...n?[{name:`ROOMS`,className:`SyncRoom`}]:[],...r?[{name:`Assistant`,className:`Assistant`}]:[],...K(e,`live`)?[{name:`LIVE`,className:`LiveRoom`}]:[],...K(e,`voice`)?[{name:`Voice`,className:`Voice`}]:[]],o=[...n?[`// ROOMS: one SyncRoom per room (@cascivo/app/sync-server).`]:[],...r?[`// Assistant: one AIChatAgent per conversation; it stores the messages in SQLite.`]:[],...K(e,`live`)?[`// LIVE: the /ops dashboard's per-second totals (@cascivo/app/live-server).`]:[],...K(e,`voice`)?[`// Voice: one voice agent per conversation (agents/voice); it stores the transcript.`]:[]];return`// Cloudflare deploy config. \`${w(e.pm??`npm`,`deploy`)}\` builds and ships the SPA and
+`}function q(e,t,n){let r=`${e}"${t}": [${n.join(`, `)}],`;return r.length<=100?r:`${e}"${t}": [\n${n.map(t=>`${e}  ${t},`).join(`
+`)}\n${e}],`}function Ce(e){let t=X(e,`publish`),n=Ae(e),r=X(e,`agent`),i=Z(e),a=[...n?[{name:`ROOMS`,className:`SyncRoom`}]:[],...r?[{name:`Assistant`,className:`Assistant`}]:[],...X(e,`live`)?[{name:`LIVE`,className:`LiveRoom`}]:[],...X(e,`voice`)?[{name:`Voice`,className:`Voice`}]:[]],o=[...n?[`// ROOMS: one SyncRoom per room (@cascivo/app/sync-server).`]:[],...r?[`// Assistant: one AIChatAgent per conversation; it stores the messages in SQLite.`]:[],...X(e,`live`)?[`// LIVE: the /ops dashboard's per-second totals (@cascivo/app/live-server).`]:[],...X(e,`voice`)?[`// Voice: one voice agent per conversation (agents/voice); it stores the transcript.`]:[]];return`// Cloudflare deploy config. \`${w(e.pm??`npm`,`deploy`)}\` builds and ships the SPA and
 // the Worker together. https://developers.cloudflare.com/workers/wrangler/configuration/
 {
   "name": "${N(e.name)}",
   "main": "./worker/index.ts",
-  "compatibility_date": "${W}",
+  "compatibility_date": "${K}",
   "assets": {
     // Client-side app: an unknown path serves index.html, and the client renders it.
     "not_found_handling": "single-page-application",
@@ -559,55 +553,56 @@ ${r?`  plugins: [
   ${o.join(`
   `)}
   "durable_objects": {
-${G(`    `,`bindings`,a.map(e=>`{ "name": "${e.name}", "class_name": "${e.className}" }`))}
+${q(`    `,`bindings`,a.map(e=>`{ "name": "${e.name}", "class_name": "${e.className}" }`))}
   },
-${G(`  `,`migrations`,[`{ "tag": "v1", "new_sqlite_classes": [${a.map(e=>`"${e.className}"`).join(`, `)}] }`])}`:``}${K(e,`files`)?`
+${q(`  `,`migrations`,[`{ "tag": "v1", "new_sqlite_classes": [${a.map(e=>`"${e.className}"`).join(`, `)}] }`])}`:``}${X(e,`files`)?`
   // Uploaded files, and Cloudflare Images for their resized previews.
-${G(`  `,`r2_buckets`,[`{ "binding": "FILES", "bucket_name": "${N(e.name)}-files" }`])}
-  "images": { "binding": "IMAGES" },`:``}${J(e)?`
-  // ${[K(e,`files`)?`Uploads`:``,K(e,`export`)?`exports`:``,K(e,`publish`)?`published pages`:``,K(e,`digest`)?`digests sent now`:``,K(e,`search`)?`search indexing`:``,e.auth===`email`?`sign-in emails`:``].filter(Boolean).join(`, `).replace(/^./,e=>e.toUpperCase())} per caller: 20 a minute.
+${q(`  `,`r2_buckets`,[`{ "binding": "FILES", "bucket_name": "${N(e.name)}-files" }`])}
+  "images": { "binding": "IMAGES" },`:``}${De(e)?`
+  // ${[X(e,`files`)?`Uploads`:``,X(e,`export`)?`exports`:``,X(e,`publish`)?`published pages`:``,X(e,`digest`)?`digests sent now`:``,X(e,`search`)?`search indexing`:``,X(e,`checkout`)?`checkouts started`:``,X(e,`newsletter`)?`newsletter sign-ups and composer requests`:``,e.auth===`email`?`sign-in emails`:``].filter(Boolean).join(`, `).replace(/^./,e=>e.toUpperCase())} per caller: 20 a minute.
   // namespace_id is any number unique within your account:
   // https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/
-${G(`  `,`ratelimits`,[`{ "name": "LIMITER", "namespace_id": "1001", "simple": { "limit": 20, "period": 60 } }`])}`:``}${Te(e)}${K(e,`digest`)?`
+${q(`  `,`ratelimits`,[`{ "name": "LIMITER", "namespace_id": "1001", "simple": { "limit": 20, "period": 60 } }`])}`:``}${we(e)}${X(e,`digest`)?`
   // The weekly digest: Mondays at 08:00 UTC (worker/digest.ts).
-  "triggers": { "crons": ["0 8 * * 1"] },`:``}${Y(e)?`
-  // Tables for ${[K(e,`crud`)?`customers`:``,K(e,`publish`)?`published pages`:``,K(e,`webhooks`)?`webhook deliveries`:``,K(e,`digest`)?`digest runs`:``,K(e,`search`)?`help articles`:``,e.auth===`email`?`accounts`:``].filter(Boolean).join(`, `)}.
+  "triggers": { "crons": ["0 8 * * 1"] },`:``}${Oe(e)?`
+  // Tables for ${[X(e,`crud`)?`customers`:``,X(e,`publish`)?`published pages`:``,X(e,`webhooks`)?`webhook deliveries`:``,X(e,`digest`)?`digest runs`:``,X(e,`search`)?`help articles`:``,X(e,`checkout`)?`orders`:``,X(e,`newsletter`)?`newsletter subscribers and issues`:``,e.auth===`email`?`accounts`:``].filter(Boolean).join(`, `)}.
   // No database_id: wrangler creates the database on first deploy, and the Worker applies its
   // own schema on its first query (\`migrate\`).
-${G(`  `,`d1_databases`,[`{ "binding": "DB", "database_name": "${N(e.name)}-db" }`])}`:``}${K(e,`usage`)?`
+${q(`  `,`d1_databases`,[`{ "binding": "DB", "database_name": "${N(e.name)}-db" }`])}`:``}${X(e,`usage`)?`
   // Every API request is recorded here (worker/index.ts); /usage reads it back.
-  "analytics_engine_datasets": [{ "binding": "USAGE", "dataset": "${q(e)}" }],`:``}${K(e,`live`)?`
-  // Events for /ops: POST /api/events sends them, and the Worker's queue handler takes them in
-  // batches of up to 100, or whatever arrived within a second.
-  "queues": {
-${G(`    `,`producers`,[`{ "binding": "EVENTS", "queue": "${N(e.name)}-events" }`])}
-    "consumers": [
-      {
-        "queue": "${N(e.name)}-events",
-        "max_batch_size": 100,
-        "max_batch_timeout": 1,
-      },
-    ],
-  },`:``}${K(e,`import`)?`
+  "analytics_engine_datasets": [{ "binding": "USAGE", "dataset": "${Ee(e)}" }],`:``}${Te(e)}${X(e,`import`)?`
   // The CSV import runs as a Workflow (worker/import-job.ts); its progress is a room.
-  "workflows": [{ "name": "import-job", "binding": "IMPORT_JOB", "class_name": "ImportJob" }],`:``}${X(e)?`
-  // Workers AI, which the ${[r?`assistant`:``,K(e,`voice`)?`voice agent`:``,K(e,`search`)?`search page`:``].filter(Boolean).join(` and `)} call${[r,K(e,`voice`),K(e,`search`)].filter(Boolean).length>1?``:`s`}.
-  "ai": { "binding": "AI" },`:``}${K(e,`search`)?`
+  "workflows": [{ "name": "import-job", "binding": "IMPORT_JOB", "class_name": "ImportJob" }],`:``}${ke(e)?`
+  // Workers AI, which the ${[r?`assistant`:``,X(e,`voice`)?`voice agent`:``,X(e,`search`)?`search page`:``].filter(Boolean).join(` and `)} call${[r,X(e,`voice`),X(e,`search`)].filter(Boolean).length>1?``:`s`}.
+  "ai": { "binding": "AI" },`:``}${X(e,`search`)?`
   // The help articles' embeddings (worker/search.ts). Create it once before deploying (README).
-${G(`  `,`vectorize`,[`{ "binding": "ARTICLES_INDEX", "index_name": "${N(e.name)}-articles" }`])}`:``}${K(e,`export`)?`
+${q(`  `,`vectorize`,[`{ "binding": "ARTICLES_INDEX", "index_name": "${N(e.name)}-articles" }`])}`:``}${X(e,`export`)?`
   // Browser Run: renders pages to PDF/PNG for /api/export.
-  "browser": { "binding": "BROWSER" },`:``}${i||K(e,`export`)?`
-  // ${[i?`The Agents SDK`:``,K(e,`export`)?`Cloudflare's puppeteer`:``].filter(Boolean).join(` and `)} use${i&&K(e,`export`)?``:`s`} Node.js APIs.
+  "browser": { "binding": "BROWSER" },`:``}${i||X(e,`export`)?`
+  // ${[i?`The Agents SDK`:``,X(e,`export`)?`Cloudflare's puppeteer`:``].filter(Boolean).join(` and `)} use${i&&X(e,`export`)?``:`s`} Node.js APIs.
   "compatibility_flags": ["nodejs_compat"],`:``}
   // Add bindings here (KV, D1, R2, Durable Objects, Workers AI) and read them from the
   // \`env\` argument of the Worker's fetch handler.
 }
-`}function Te(e){let t=K(e,`digest`),n=e.auth===`email`,r=[...e.auth===`access`?[`Cloudflare Access (README). Until both are set, the Worker refuses every request.`]:[],...n?[`Sign-in links go out through Email Service (README). AUTH_FROM must be an address on a`,`domain you have onboarded; until it is set, sign-in fails with a clear error.`]:[],...t?[`The weekly digest (README): who gets it, who sends it, and the deployed app's URL,`,`which the browser opens. Until they are set, each run is recorded as skipped.`]:[]],i=[...e.auth===`access`?[`ACCESS_TEAM_DOMAIN`,`ACCESS_AUD`]:[],...n?[`AUTH_FROM`]:[],...t?[`DIGEST_TO`,`DIGEST_FROM`,`APP_URL`]:[]];if(i.length===0)return``;let a=i.map(e=>`"${e}": ""`),o=`  "vars": { ${a.join(`, `)} },`,s=o.length<=100?o:`  "vars": {\n${a.map(e=>`    ${e},`).join(`
+`}function we(e){let t=X(e,`digest`),n=X(e,`checkout`),r=X(e,`newsletter`),i=e.auth===`email`,a=[...e.auth===`access`?[`Cloudflare Access (README). Until both are set, the Worker refuses every request.`]:[],...i?[`Sign-in links go out through Email Service (README). AUTH_FROM must be an address on a`,`domain you have onboarded; until it is set, sign-in fails with a clear error.`]:[],...t?[`The weekly digest (README): who gets it, who sends it, and the deployed app's URL,`,`which the browser opens. Until they are set, each run is recorded as skipped.`]:[],...n?[`Receipts for paid orders go out through Email Service from RECEIPT_FROM, an address`,`on a domain you have onboarded (README). Until it is set, no receipt is sent.`]:[],...r?[`The newsletter sends through Amazon SES (README): the region your sending identity is`,`verified in, its From address, and the SNS topic SES reports bounces and complaints to.`]:[]],o=[...e.auth===`access`?[`ACCESS_TEAM_DOMAIN`,`ACCESS_AUD`]:[],...i?[`AUTH_FROM`]:[],...t?[`DIGEST_TO`,`DIGEST_FROM`,`APP_URL`]:[],...n?[`RECEIPT_FROM`]:[],...r?[`AWS_REGION`,`NEWSLETTER_FROM`,`SNS_TOPIC_ARN`]:[]];if(o.length===0)return``;let s=o.map(e=>`"${e}": ""`),c=`  "vars": { ${s.join(`, `)} },`,l=c.length<=100?c:`  "vars": {\n${s.map(e=>`    ${e},`).join(`
 `)}\n  },`;return`
-${r.map(e=>`  // ${e}`).join(`
-`)}${n||t?`
+${a.map(e=>`  // ${e}`).join(`
+`)}${i||t||n?`
   "send_email": [{ "name": "EMAIL" }],`:``}
-${s}`}function K(e,t){return e.examples?.includes(t)??!1}function q(e){return`${N(e.name).replace(/[^a-z0-9_]/g,`_`).replace(/^[^a-z_]/,`_$&`)}_usage`}function J(e){return K(e,`files`)||K(e,`export`)||K(e,`publish`)||K(e,`digest`)||K(e,`search`)||e.auth===`email`}function Y(e){return K(e,`crud`)||K(e,`publish`)||K(e,`webhooks`)||K(e,`digest`)||K(e,`search`)||e.auth===`email`}function X(e){return Z(e)||K(e,`search`)}function Z(e){return K(e,`agent`)||K(e,`voice`)}function Ee(e){return K(e,`board`)||K(e,`notes`)||K(e,`import`)||K(e,`webhooks`)}function Q(e){return Z(e)||K(e,`import`)}function $(e){return e.runtime??(K(e,`agent`)?`react`:`preact`)}function De(e){let t=K(e,`import`),n=K(e,`files`),r=K(e,`usage`),i=K(e,`crud`),a=K(e,`live`),o=K(e,`publish`),s=K(e,`webhooks`),c=K(e,`digest`),l=K(e,`search`);return`import { defineApi, ${t||n||r||i||a||o||s||c||l?`endpoint, `:``}stream } from '@cascivo/app/api'
+${l}`}function Te(e){let t=[...X(e,`live`)?[{comment:[`Events for /ops: POST /api/events sends them, and the Worker's queue handler takes them in`,`batches of up to 100, or whatever arrived within a second.`],binding:`EVENTS`,queue:`${N(e.name)}-events`,consumer:[`"max_batch_size": 100`,`"max_batch_timeout": 1`]}]:[],...X(e,`newsletter`)?[{comment:[`Newsletter sends (worker/newsletter.ts): one message of 25 readers at a time, so SES`,`is called at a steady pace. A throttled message is retried after 30 seconds.`],binding:`NEWSLETTER`,queue:Y(e),consumer:[`"max_batch_size": 1`,`"max_concurrency": 1`,`"max_retries": 10`,`"retry_delay": 30`]}]:[]];return t.length===0?``:`
+${t.flatMap(e=>e.comment.map(e=>`  // ${e}`)).join(`
+`)}
+  "queues": {
+${q(`    `,`producers`,t.map(e=>`{ "binding": "${e.binding}", "queue": "${e.queue}" }`))}
+    "consumers": [
+${t.map(e=>`      {
+        "queue": "${e.queue}",
+${e.consumer.map(e=>`        ${e},`).join(`
+`)}
+      },`).join(`
+`)}
+    ],
+  },`}function J(e){return X(e,`checkout`)&&e.auth===`email`}function Y(e){return`${N(e.name)}-newsletter`}function X(e,t){return e.examples?.includes(t)??!1}function Ee(e){return`${N(e.name).replace(/[^a-z0-9_]/g,`_`).replace(/^[^a-z_]/,`_$&`)}_usage`}function De(e){return X(e,`files`)||X(e,`export`)||X(e,`publish`)||X(e,`digest`)||X(e,`search`)||X(e,`checkout`)||X(e,`newsletter`)||e.auth===`email`}function Oe(e){return X(e,`crud`)||X(e,`publish`)||X(e,`webhooks`)||X(e,`digest`)||X(e,`search`)||X(e,`checkout`)||X(e,`newsletter`)||e.auth===`email`}function ke(e){return Z(e)||X(e,`search`)}function Z(e){return X(e,`agent`)||X(e,`voice`)}function Ae(e){return X(e,`board`)||X(e,`notes`)||X(e,`import`)||X(e,`webhooks`)||X(e,`checkout`)||X(e,`newsletter`)}function Q(e){return Z(e)||X(e,`import`)}function $(e){return e.runtime??(X(e,`agent`)?`react`:`preact`)}function je(e){let t=X(e,`import`),n=X(e,`files`),r=X(e,`usage`),i=X(e,`crud`),a=X(e,`live`),o=X(e,`publish`),s=X(e,`webhooks`),c=X(e,`digest`),l=X(e,`search`),u=X(e,`checkout`),d=X(e,`newsletter`),f=J(e);return`import { defineApi, ${t||n||r||i||a||o||s||c||l||u||d?`endpoint, `:``}stream } from '@cascivo/app/api'
 ${i?`import { parseTablePage, parseTableQuery } from '@cascivo/app/db'
 `:``}${n?`import { parseStoredFile } from '@cascivo/app/uploads'
 `:``}${t?`import { parseImportRequest, parseStarted } from './import-job'
@@ -618,6 +613,19 @@ ${i?`import { parseTablePage, parseTableQuery } from '@cascivo/app/db'
 `:``}${s?`import { parseDeliveries, parseTestResult } from './webhooks'
 `:``}${c?`import { parseDigestRun, parseDigestRuns } from './digest'
 `:``}${l?`import { parseIndexed, parseSearchQuery, parseSearchResult } from './search'
+`:``}${f?`import { parseBilling, parseRedirect, parseSyncInput } from './billing'
+`:``}${u?`import { parseCheckoutStarted, parseOrder } from './checkout'
+`:``}${d?`import {
+  parseConfirmed,
+  parseEmailInput,
+  parseIssue,
+  parseIssueInput,
+  parseKeyInput,
+  parseOverview,
+  parsePreview,
+  parseSubscribed,
+  parseTokenInput,
+} from './newsletter'
 `:``}
 /**
  * The contract between the browser and the Worker. Both import this file: the Worker serves
@@ -700,7 +708,61 @@ export const api = defineApi({
     output: parseSearchResult,
   }),
   // Embeds every article into the Vectorize index.
-  indexArticles: endpoint({ method: 'POST', path: '/api/search/index', output: parseIndexed }),`:``}${i?`
+  indexArticles: endpoint({ method: 'POST', path: '/api/search/index', output: parseIndexed }),`:``}${u?`
+  // Opens a Stripe Checkout page for the product; the browser goes to its url.
+  startCheckout: endpoint({ method: 'POST', path: '/api/checkout', output: parseCheckoutStarted }),
+  // An order, checked with Stripe while it is pending (Stripe's webhook settles it too).
+  getOrder: endpoint({ method: 'GET', path: '/api/orders/:id', output: parseOrder }),`:``}${f?`
+  // The signed-in user's subscription (worker/billing.ts), and the ways to change it.
+  getBilling: endpoint({ method: 'GET', path: '/api/billing', output: parseBilling }),
+  startSubscription: endpoint({
+    method: 'POST',
+    path: '/api/billing/subscribe',
+    output: parseRedirect,
+  }),
+  syncBilling: endpoint({
+    method: 'POST',
+    path: '/api/billing/sync',
+    input: parseSyncInput,
+    output: parseBilling,
+  }),
+  openBillingPortal: endpoint({
+    method: 'POST',
+    path: '/api/billing/portal',
+    output: parseRedirect,
+  }),`:``}${d?`
+  // Signing up sends a confirmation link; only confirmed readers get issues.
+  subscribe: endpoint({
+    method: 'POST',
+    path: '/api/newsletter/subscribe',
+    input: parseEmailInput,
+    output: parseSubscribed,
+  }),
+  confirmSubscription: endpoint({
+    method: 'POST',
+    path: '/api/newsletter/confirm',
+    input: parseTokenInput,
+    output: parseConfirmed,
+  }),
+  // The composer's calls, each carrying NEWSLETTER_KEY.
+  newsletterOverview: endpoint({
+    method: 'POST',
+    path: '/api/newsletter/overview',
+    input: parseKeyInput,
+    output: parseOverview,
+  }),
+  previewIssue: endpoint({
+    method: 'POST',
+    path: '/api/newsletter/preview',
+    input: parseIssueInput,
+    output: parsePreview,
+  }),
+  sendIssue: endpoint({
+    method: 'POST',
+    path: '/api/newsletter/issues',
+    input: parseIssueInput,
+    output: parseIssue,
+  }),`:``}${i?`
   // One page of customers for DataTable's query (sort, search, filters, page).
   customers: endpoint({
     method: 'POST',
@@ -722,12 +784,12 @@ export const api = defineApi({
   }),
   deleteCustomer: endpoint({ method: 'DELETE', path: '/api/customers/:id', output: parseDeleted }),`:``}
 })
-`}function Oe(e){let t=Ee(e),n=K(e,`agent`),r=K(e,`import`),i=K(e,`files`),a=K(e,`export`),o=K(e,`usage`),s=K(e,`crud`),c=K(e,`live`),l=K(e,`voice`),u=K(e,`publish`),d=K(e,`webhooks`),f=K(e,`digest`),p=K(e,`search`),m=Y(e),h=Z(e),g=J(e),_=e.auth===`access`,v=e.auth===`email`,y=[..._?[`requireAccess`]:[],...g?[`clientIp`,`rateLimit`]:[]],b=t||h||i||a||_||c||g||u,x=h||i||a||_||g||d||u,S=[...r?[`job-`]:[],...d?[`webhooks$`]:[]];return`${o?`import type { AnalyticsDataset } from '@cascivo/app/analytics'
-`:``}${m?`import type { Database } from '@cascivo/app/db'
+`}function Me(e){let t=Ae(e),n=X(e,`agent`),r=X(e,`import`),i=X(e,`files`),a=X(e,`export`),o=X(e,`usage`),s=X(e,`crud`),c=X(e,`live`),l=X(e,`voice`),u=X(e,`publish`),d=X(e,`webhooks`),f=X(e,`digest`),p=X(e,`search`),m=X(e,`checkout`),h=X(e,`newsletter`),g=J(e),_=Oe(e),v=Z(e),y=De(e),b=e.auth===`access`,x=e.auth===`email`,S=[...b?[`requireAccess`]:[],...y?[`clientIp`,`rateLimit`]:[]],C=t||v||i||a||b||c||y||u,w=v||i||a||b||y||d||u||m||h,T=[...r?[`job-`]:[],...d?[`webhooks$`]:[],...m?[`order-`]:[],...h?[`issue-`]:[]],E=[...d?[`/api/webhooks/`]:[],...m?[`/api/stripe/`]:[],...h?[`/api/sns/`]:[]],D=h?[`/api/newsletter/subscribe`,`/api/newsletter/confirm`,`/api/newsletter/unsubscribe`]:[],O=[...E,...D];return`${o?`import type { AnalyticsDataset } from '@cascivo/app/analytics'
+`:``}${_?`import type { Database } from '@cascivo/app/db'
 `:``}${a?`import { handleExport } from '@cascivo/app/export'
 `:``}import { createHandler${u?`, HttpError`:``} } from '@cascivo/app/api'
-${v?`import { handleAuth, requireUser } from '@cascivo/app/auth-server'
-`:``}${y.length>0||d?`import { ${[...y,`guardResponse`].sort().join(`, `)} } from '@cascivo/app/guard'\n${g?`import type { RateLimiter } from '@cascivo/app/guard'
+${x?`import { handleAuth, requireUser } from '@cascivo/app/auth-server'
+`:``}${S.length>0||d?`import { ${[...S,`guardResponse`].sort().join(`, `)} } from '@cascivo/app/guard'\n${y?`import type { RateLimiter } from '@cascivo/app/guard'
 `:``}`:``}${r?`import { jobReporter } from '@cascivo/app/jobs-server'
 `:``}${i?`import { handleUploads, listUploads } from '@cascivo/app/uploads-server'
 import type { ImageResizer, UploadBucket } from '@cascivo/app/uploads-server'
@@ -737,7 +799,7 @@ import type { LiveBatch, LiveQueue } from '@cascivo/app/live-server'
 import type { RoomNamespace } from '@cascivo/app/sync-server'
 `:``}${a?`import puppeteer from '@cloudflare/puppeteer'
 import type { BrowserWorker } from '@cloudflare/puppeteer'
-`:``}${h?`import { routeAgentRequest } from 'agents'
+`:``}${v?`import { routeAgentRequest } from 'agents'
 `:``}import { api, TICKS_PER_STREAM } from '../src/api'
 import type { Tick } from '../src/api'
 ${r?`import { importJob } from '../src/import-job'
@@ -745,7 +807,7 @@ ${r?`import { importJob } from '../src/import-job'
 `:``}${o?`import { usageMetrics } from '../src/usage'
 import { usageReport } from './usage'
 `:``}${c?`import { OPS_ROOM, ops } from '../src/ops'
-`:``}${v?`import { sendSignInLink } from './auth'
+`:``}${x?`import { sendSignInLink } from './auth'
 import type { SignInSender } from './auth'
 `:``}${s?`import * as customerStore from './customers'
 `:``}${u?`import * as pageStore from './pages'\nimport { renderPageHtml } from './page-html'\nimport type { Assets } from './page-html'\n${a?`import { pagePreview } from './page-preview'
@@ -753,7 +815,14 @@ import type { SignInSender } from './auth'
 import { DELIVERIES_ROOM } from '../src/webhooks'
 `:``}${f?`import * as digestJob from './digest'
 import type { DigestSender } from './digest'
-`:``}${p?`import * as articleSearch from './search'\nimport type { ${h?``:`Embedder, `}VectorIndex } from './search'\n`:``}${t?`
+`:``}${p?`import * as articleSearch from './search'\nimport type { ${v?``:`Embedder, `}VectorIndex } from './search'\n`:``}${g?`import * as billingStore from './billing'
+`:``}${m?`import * as orderStore from './checkout'
+import type { ReceiptSender } from './checkout'
+import { ORDER_ID, orderRoom } from '../src/checkout'
+`:``}${h?`import * as newsletterStore from './newsletter'
+import type { NewsletterBatch, NewsletterQueue } from './newsletter'
+import { ISSUE_ID, issueRoom } from '../src/newsletter'
+`:``}${t?`
 // The Durable Object class behind every room. wrangler.jsonc binds it as ROOMS, and it must be
 // exported from the Worker's main module.
 export { SyncRoom } from '@cascivo/app/sync-server'
@@ -774,7 +843,7 @@ export { ImportJob } from './import-job'
  * Add bindings (KV, D1, R2, Durable Objects, Workers AI) in wrangler.jsonc and type them
  * here; every handler receives them as \`env\`.
  */
-${t||h||i||a||o||m||_||c||v||d||f||p?`export interface Env {${h?`
+${t||v||i||a||o||_||b||c||x||d||f||p||m||h?`export interface Env {${v?`
   /** Workers AI, bound in wrangler.jsonc. */
   AI: Ai`:p?`
   /** Workers AI, bound in wrangler.jsonc. */
@@ -788,37 +857,58 @@ ${t||h||i||a||o||m||_||c||v||d||f||p?`export interface Env {${h?`
   USAGE: AnalyticsDataset
   /** Secrets for reading Analytics Engine back (see README). */
   CF_ACCOUNT_ID?: string
-  CF_API_TOKEN?: string`:``}${m?`
+  CF_API_TOKEN?: string`:``}${_?`
   DB: Database`:``}${u?`
   ASSETS: Assets`:``}${c?`
   LIVE: RoomNamespace<unknown>
-  EVENTS: LiveQueue`:``}${g?`
-  LIMITER: RateLimiter`:``}${_?`
+  EVENTS: LiveQueue`:``}${y?`
+  LIMITER: RateLimiter`:``}${b?`
   /** Set in wrangler.jsonc (see README). */
   ACCESS_TEAM_DOMAIN: string
   ACCESS_AUD: string`:``}${d?`
   /** The webhook signing secret: \`wrangler secret put WEBHOOK_SECRET\` (.dev.vars locally). */
-  WEBHOOK_SECRET: string`:``}${v||f?`\n  EMAIL: ${[v?`SignInSender`:``,f?`DigestSender`:``].filter(Boolean).join(` & `)}`:``}${v?`
+  WEBHOOK_SECRET: string`:``}${x||f||m?`\n  EMAIL: ${[x?`SignInSender`:``,f?`DigestSender`:``,m?`ReceiptSender`:``].filter(Boolean).join(` & `)}`:``}${x?`
   /** The From address of sign-in emails, set in wrangler.jsonc. */
   AUTH_FROM: string`:``}${f?`
   /** The weekly digest (worker/digest.ts), set in wrangler.jsonc. */
   DIGEST_TO: string
   DIGEST_FROM: string
-  APP_URL: string`:``}
+  APP_URL: string`:``}${m?`
+  /** The From address of receipts, set in wrangler.jsonc. */
+  RECEIPT_FROM: string
+  /** Stripe secrets: \`wrangler secret put\` (.dev.vars locally). Unset until you add them. */
+  STRIPE_SECRET_KEY?: string
+  STRIPE_WEBHOOK_SECRET?: string`:``}${h?`
+  NEWSLETTER: NewsletterQueue
+  /** The newsletter (worker/newsletter.ts), set in wrangler.jsonc. */
+  AWS_REGION: string
+  NEWSLETTER_FROM: string
+  SNS_TOPIC_ARN: string
+  /** Secrets: \`wrangler secret put\` (.dev.vars locally). Unset until you add them. */
+  AWS_ACCESS_KEY_ID?: string
+  AWS_SECRET_ACCESS_KEY?: string
+  NEWSLETTER_KEY?: string`:``}
 }`:`// eslint-disable-next-line @typescript-eslint/no-empty-object-type -- bindings are added as members
 export interface Env {}`}
 
 const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
-${g?`
+${y?`
 /**
  * Requests that each count against LIMITER:
-${[v?`a sign-in email`:``,f?`a digest sent now (it starts a browser)`:``,p?`indexing the articles (it embeds every one)`:``,i?`a new upload (not each part of one)`:``,a?`an export`:``,u?`a published page`:``].filter(Boolean).map(e=>` * - ${e}`).join(`
+${[x?`a sign-in email`:``,f?`a digest sent now (it starts a browser)`:``,p?`indexing the articles (it embeds every one)`:``,m?`a checkout started (it creates a Stripe session and an order)`:``,g?`a subscription checkout or billing portal opened`:``,h?`a newsletter sign-up (it sends an email), and each use of the newsletter key`:``,i?`a new upload (not each part of one)`:``,a?`an export`:``,u?`a published page`:``].filter(Boolean).map(e=>` * - ${e}`).join(`
 `)}
  */
 function countsAgainstLimit(request: Request): boolean {
   const url = new URL(request.url)${p?`
   if (url.pathname === '/api/search/index') return request.method === 'POST'`:``}${f?`
-  if (url.pathname === '/api/digest/run') return request.method === 'POST'`:``}${v?`
+  if (url.pathname === '/api/digest/run') return request.method === 'POST'`:``}${m?`
+  if (url.pathname === '/api/checkout') return request.method === 'POST'`:``}${g?`
+  if (url.pathname === '/api/billing/subscribe' || url.pathname === '/api/billing/portal') {
+    return request.method === 'POST'
+  }`:``}${h?`
+  if (/^\\/api\\/newsletter\\/(subscribe|overview|preview|issues)$/.test(url.pathname)) {
+    return request.method === 'POST'
+  }`:``}${x?`
   if (url.pathname === '/api/auth/start') return request.method === 'POST'`:``}${u?`
   if (url.pathname === '/api/pages') return request.method === 'POST'`:``}${i?`
   if (url.pathname === uploads.path) {
@@ -865,7 +955,24 @@ const handleApi = createHandler<typeof api, Env>(api, {
   listDeliveries: ({ env }) => webhookStore.listDeliveries(env.DB),
   sendTestDelivery: ({ request, env }) => webhookStore.sendTestDelivery(request.url, env),`:``}${p?`
   search: ({ body, env }) => articleSearch.search(env, body.q),
-  indexArticles: ({ env }) => articleSearch.indexArticles(env),`:``}${f?`
+  indexArticles: ({ env }) => articleSearch.indexArticles(env),`:``}${m?`
+  startCheckout: ({ request, env }) => orderStore.startCheckout(env, new URL(request.url).origin),
+  getOrder: ({ params, request, env }) =>
+    orderStore.getOrder(env, params.id, new URL(request.url).origin),`:``}${g?`
+  getBilling: ({ request, env }) => billingStore.getBilling(env, request),
+  startSubscription: ({ request, env }) =>
+    billingStore.startSubscription(env, request, new URL(request.url).origin),
+  syncBilling: ({ body, request, env }) => billingStore.syncBilling(env, request, body.sessionId),
+  openBillingPortal: ({ request, env }) =>
+    billingStore.openPortal(env, request, new URL(request.url).origin),`:``}${h?`
+  subscribe: ({ body, request, env }) =>
+    newsletterStore.subscribe(env, body.email, new URL(request.url).origin),
+  confirmSubscription: ({ body, env }) => newsletterStore.confirm(env, body.token),
+  newsletterOverview: ({ body, env }) => newsletterStore.overview(env, body.key),
+  previewIssue: ({ body, request, env }) =>
+    newsletterStore.preview(env, body, new URL(request.url).origin),
+  sendIssue: ({ body, request, env }) =>
+    newsletterStore.sendIssue(env, body, new URL(request.url).origin),`:``}${f?`
   digestRuns: ({ env }) => digestJob.listRuns(env.DB),
   runDigest: ({ request, env }) =>
     digestJob.runDigest(
@@ -897,9 +1004,9 @@ async function handleAndRecord(request: Request, env: Env): Promise<Response> {
   return response
 }
 `:``}
-// wrangler.jsonc routes only ${h?`/api/* and /agents/*`:`/api/*`} here; everything else is a static asset or index.html.
+// wrangler.jsonc routes only ${v?`/api/* and /agents/*`:`/api/*`} here; everything else is a static asset or index.html.
 export default {
-${b?`  ${x?`async `:``}fetch(request: Request, env: Env): Promise<Response>${x?``:` | Response`} {${_?`
+${C?`  ${w?`async `:``}fetch(request: Request, env: Env): Promise<Response>${w?``:` | Response`} {${b?`
     // Cloudflare Access is in front of the app (README); this refuses a request that came
     // around it (straight to *.workers.dev, say). \`vite dev\` has no Access, so not there.
     if (!import.meta.env.DEV) {
@@ -911,37 +1018,37 @@ ${b?`  ${x?`async `:``}fetch(request: Request, env: Env): Promise<Response>${x?`
       } catch (error) {
         return guardResponse(error)
       }
-    }`:``}${g?`
+    }`:``}${y?`
     if (countsAgainstLimit(request)) {
       try {
         await rateLimit(env.LIMITER, clientIp(request))
       } catch (error) {
         return guardResponse(error)
       }
-    }`:``}${v?`
+    }`:``}${x?`
     // Sign-in links and sessions: /api/auth/* is answered here (worker/auth.ts sends mail).
     const signIn = await handleAuth(env.DB, {
       sendLink: (email, url) => sendSignInLink(env.EMAIL, env.AUTH_FROM, email, url),
       exposeLink: import.meta.env.DEV,
     })(request)
     if (signIn) return signIn
-    // Every other API write needs a signed-in user; reads stay public.${d?`
-    // Webhooks carry a signature instead of a session, and are checked by it.`:``}
-    if (${d?`
+    // Every other API write needs a signed-in user; reads stay public.${E.length>0?`
+    // Webhooks carry a signature instead of a session, and are checked by it.`:``}${D.length>0?`
+    // Newsletter readers sign up, confirm and unsubscribe without an account.`:``}
+    if (${O.length>0?`
       request.method !== 'GET' &&
-      request.method !== 'HEAD' &&
-      !new URL(request.url).pathname.startsWith('/api/webhooks/')
+      request.method !== 'HEAD' &&${O.map(e=>`\n      !new URL(request.url).pathname.startsWith('${e}')`).join(` &&`)}
     `:`request.method !== 'GET' && request.method !== 'HEAD'`}) {
       try {
         await requireUser(env.DB, request)
       } catch (error) {
         return guardResponse(error)
       }
-    }`:``}${h?`
+    }`:``}${v?`
     // /agents/<agent>/<conversation>: the WebSocket ${[n?`useAgent()`:``,l?`VoiceClient`:``].filter(Boolean).join(` or `)} opens.
     const agent = await routeAgentRequest(request, env)
     if (agent) return agent`:``}${i?`
-    // Uploads into R2 and the files they stored.${_?``:` Anyone can upload: see README.`}
+    // Uploads into R2 and the files they stored.${b?``:` Anyone can upload: see README.`}
     const upload = await handleUploads(uploads, env.FILES, { images: env.IMAGES })(request)
     if (upload) return upload`:``}${a?`
     // /api/export?page=/report&format=pdf — each export starts a browser.
@@ -988,11 +1095,43 @@ ${b?`  ${x?`async `:``}fetch(request: Request, env: Env): Promise<Response>${x?`
     // New deliveries, pushed to the /webhooks page: it may watch, never write.
     if (path === '/api/webhooks/live') {
       return roomResponse(request, env.ROOMS, DELIVERIES_ROOM, { readOnly: true })
-    }`:``}${K(e,`board`)||K(e,`notes`)?`
-    const room = /^\\/api\\/rooms\\/([^/]+)$/.exec(new URL(request.url).pathname)${S.length>0?`
+    }`:``}${m?`
+    const checkoutPath = new URL(request.url).pathname
+    // Stripe's webhook (worker/checkout.ts); a bad signature is a 401.
+    if (checkoutPath === orderStore.STRIPE_WEBHOOK_PATH && request.method === 'POST') {
+      try {
+        return await orderStore.receiveStripe(request, env${g?`, billingStore.billingHooks(env)`:``})
+      } catch (error) {
+        return guardResponse(error)
+      }
+    }
+    // An order's page watches its room for what Stripe reports: it may watch, never write.
+    const orderLive = /^\\/api\\/orders\\/([^/]+)\\/live$/.exec(checkoutPath)
+    if (orderLive && ORDER_ID.test(orderLive[1]!)) {
+      return roomResponse(request, env.ROOMS, orderRoom(orderLive[1]!), { readOnly: true })
+    }`:``}${h?`
+    const newsletterPath = new URL(request.url).pathname
+    // One-click unsubscribe (RFC 8058) and the unsubscribe page's button.
+    if (newsletterPath === '/api/newsletter/unsubscribe' && request.method === 'POST') {
+      return newsletterStore.unsubscribe(request, env)
+    }
+    // SES bounces and complaints, delivered by SNS (worker/newsletter.ts); verified by signature.
+    if (newsletterPath === '/api/sns/ses' && request.method === 'POST') {
+      try {
+        return await newsletterStore.receiveFeedback(request, env)
+      } catch (error) {
+        return guardResponse(error)
+      }
+    }
+    // An issue's sending progress, for the composer: it may watch, never write.
+    const issueLive = /^\\/api\\/newsletter\\/issues\\/([^/]+)\\/live$/.exec(newsletterPath)
+    if (issueLive && ISSUE_ID.test(issueLive[1]!)) {
+      return roomResponse(request, env.ROOMS, issueRoom(issueLive[1]!), { readOnly: true })
+    }`:``}${X(e,`board`)||X(e,`notes`)?`
+    const room = /^\\/api\\/rooms\\/([^/]+)$/.exec(new URL(request.url).pathname)${T.length>0?`
     // Rooms only the server writes are watched read-only at their own routes, never opened
-    // here: ${[r?`a job's progress`:``,d?`webhook deliveries`:``].filter(Boolean).join(`, `)}.
-    if (room && !/^(${S.join(`|`)})/.test(room[1]!)) {
+    // here: ${[r?`a job's progress`:``,d?`webhook deliveries`:``,m?`orders`:``,h?`newsletter issues`:``].filter(Boolean).join(`, `)}.
+    if (room && !/^(${T.join(`|`)})/.test(room[1]!)) {
       return roomResponse(request, env.ROOMS, room[1]!)
     }`:`
     if (room) return roomResponse(request, env.ROOMS, room[1]!)`}`:``}${r?`
@@ -1006,7 +1145,19 @@ ${b?`  ${x?`async `:``}fetch(request: Request, env: Env): Promise<Response>${x?`
   // The Cron Trigger in wrangler.jsonc: the weekly digest, recorded whatever happens.
   async scheduled(_event: unknown, env: Env): Promise<void> {
     await digestJob.runDigest(env, () => puppeteer.launch(env.BROWSER), 'cron')
-  },`:``}${c?`
+  },`:``}${c&&h?`
+  // Two queues, one handler: each batch says which queue it came from. A throw retries it.
+  async queue(batch: LiveBatch & NewsletterBatch & { queue: string }, env: Env): Promise<void> {
+    // NEWSLETTER: one message of readers at a time, through SES (worker/newsletter.ts).
+    if (batch.queue === '${Y(e)}') return newsletterStore.deliver(env, batch)
+    // EVENTS: into the dashboard's room.
+    await recordLive(
+      ops,
+      env.LIVE,
+      OPS_ROOM,
+      batch.messages.map((message) => message.body),
+    )
+  },`:c?`
   // The EVENTS queue, a batch at a time, into the dashboard's room. A throw retries the batch.
   async queue(batch: LiveBatch, env: Env): Promise<void> {
     await recordLive(
@@ -1015,9 +1166,14 @@ ${b?`  ${x?`async `:``}fetch(request: Request, env: Env): Promise<Response>${x?`
       OPS_ROOM,
       batch.messages.map((message) => message.body),
     )
+  },`:h?`
+  // The NEWSLETTER queue: one message of readers at a time, through SES
+  // (worker/newsletter.ts). A throw retries the message; readers already sent are skipped.
+  async queue(batch: NewsletterBatch, env: Env): Promise<void> {
+    await newsletterStore.deliver(env, batch)
   },`:``}
 }
-`}function ke(){return`import { createClient } from '@cascivo/app/api'
+`}function Ne(){return`import { createClient } from '@cascivo/app/api'
 import { signal } from '@cascivo/react'
 import { api } from './api'
 import type { Tick } from './api'
@@ -1060,7 +1216,7 @@ export async function connect(): Promise<void> {
 export function disconnect(): void {
   controller?.abort()
 }
-`}function Ae(){return`import {
+`}function Pe(){return`import {
   Badge,
   Button,
   Card,
@@ -1115,18 +1271,18 @@ export function LiveCard() {
     </Card>
   )
 }
-`}function je(e,t){return t===0?`/`:`/${e.key}`}function Me(e,t){return t===0?`index.tsx`:`${e.key}.tsx`}function Ne(){return`import { createRouter } from '@cascivo/app'
+`}function Fe(e,t){return t===0?`/`:`/${e.key}`}function Ie(e,t){return t===0?`index.tsx`:`${e.key}.tsx`}function Le(){return`import { createRouter } from '@cascivo/app'
 import { notFound, routes } from './routes.gen'
 
 // \`routes.gen.ts\` is written by \`cascivoRoutes()\` (vite.config.ts) from \`src/routes/\`:
 // add, rename or delete a file there and the route table follows.
 export const router = createRouter({ routes, notFound })
-`}function Pe(e,t){let n=e.map((e,t)=>({label:e.label,href:je(e,t)}));K(t,`agent`)&&n.push({label:`Assistant`,href:`/assistant`}),K(t,`board`)&&n.push({label:`Board`,href:`/board`}),K(t,`notes`)&&n.push({label:`Notes`,href:`/notes`}),K(t,`import`)&&n.push({label:`Import`,href:`/import`}),K(t,`files`)&&n.push({label:`Files`,href:`/files`}),K(t,`export`)&&n.push({label:`Report`,href:`/report`}),K(t,`usage`)&&n.push({label:`Usage`,href:`/usage`}),K(t,`crud`)&&n.push({label:`Customers`,href:`/customers`}),K(t,`live`)&&n.push({label:`Ops`,href:`/ops`}),K(t,`voice`)&&n.push({label:`Voice`,href:`/voice`}),K(t,`publish`)&&n.push({label:`Publish`,href:`/publish`}),K(t,`webhooks`)&&n.push({label:`Webhooks`,href:`/webhooks`}),K(t,`digest`)&&n.push({label:`Digest`,href:`/digest`}),K(t,`search`)&&n.push({label:`Search`,href:`/search`}),t.auth===`email`&&n.push({label:`Account`,href:`/account`});let r=n.map(e=>`    {
+`}function Re(e,t){let n=e.map((e,t)=>({label:e.label,href:Fe(e,t)}));X(t,`agent`)&&n.push({label:`Assistant`,href:`/assistant`}),X(t,`board`)&&n.push({label:`Board`,href:`/board`}),X(t,`notes`)&&n.push({label:`Notes`,href:`/notes`}),X(t,`import`)&&n.push({label:`Import`,href:`/import`}),X(t,`files`)&&n.push({label:`Files`,href:`/files`}),X(t,`export`)&&n.push({label:`Report`,href:`/report`}),X(t,`usage`)&&n.push({label:`Usage`,href:`/usage`}),X(t,`crud`)&&n.push({label:`Customers`,href:`/customers`}),X(t,`live`)&&n.push({label:`Ops`,href:`/ops`}),X(t,`voice`)&&n.push({label:`Voice`,href:`/voice`}),X(t,`publish`)&&n.push({label:`Publish`,href:`/publish`}),X(t,`webhooks`)&&n.push({label:`Webhooks`,href:`/webhooks`}),X(t,`digest`)&&n.push({label:`Digest`,href:`/digest`}),X(t,`search`)&&n.push({label:`Search`,href:`/search`}),X(t,`checkout`)&&n.push({label:`Checkout`,href:`/checkout`}),J(t)&&n.push({label:`Billing`,href:`/billing`}),X(t,`newsletter`)&&(n.push({label:`Newsletter`,href:`/newsletter`}),n.push({label:`Send newsletter`,href:`/newsletter/send`})),t.auth===`email`&&n.push({label:`Account`,href:`/account`});let r=n.map(e=>`    {
       label: '${e.label.replace(/'/g,`\\'`)}',
       href: '${e.href}',
       active: path === '${e.href}',
     },`).join(`
-`),i=K(t,`export`);return`import { RouterView } from '@cascivo/app'
+`),i=X(t,`export`);return`import { RouterView } from '@cascivo/app'
 ${i?`import { isExporting } from '@cascivo/app/export'
 `:``}import { Spinner, useSignals, type SideNavItem } from '@cascivo/react'
 import { router } from './router'
@@ -1157,7 +1313,7 @@ ${i?`
     </Shell>
   )
 }
-`}function Fe(){return`import React from 'react'
+`}function ze(){return`import React from 'react'
 import ReactDOM from 'react-dom/client'
 import { setLinkComponent } from '@cascivo/react'
 import App from './App'
@@ -1174,7 +1330,7 @@ if (root) {
     </React.StrictMode>,
   )
 }
-`}function Ie(e){return`import { Flex, Heading, Text } from '@cascivo/react'
+`}function Be(e){return`import { Flex, Heading, Text } from '@cascivo/react'
 import { LiveCard } from '../LiveCard'
 
 export default function ${e.component}() {
@@ -1190,12 +1346,12 @@ export default function ${e.component}() {
     </Flex>
   )
 }
-`}function Le(e,t){return L(e).replace(`export function ${e.component}()`,`export default function ${e.component}()`).replace(`src/sections/${e.component}.tsx`,`src/routes/${Me(e,t)}`)}function Re(){return`import { EmptyState } from '@cascivo/react'
+`}function Ve(e,t){return L(e).replace(`export function ${e.component}()`,`export default function ${e.component}()`).replace(`src/sections/${e.component}.tsx`,`src/routes/${Ie(e,t)}`)}function He(){return`import { EmptyState } from '@cascivo/react'
 
 export default function NotFound() {
   return <EmptyState title="Page not found" description="There is nothing at this address." />
 }
-`}function ze(){return`import { connectRoom } from '@cascivo/app/sync'
+`}function Ue(){return`import { connectRoom } from '@cascivo/app/sync'
 
 export interface Note {
   text: string
@@ -1246,7 +1402,7 @@ export function addNote(): void {
   const offset = Object.keys(notes.value).length * 24
   notes.set(crypto.randomUUID(), { text: '', x: 24 + (offset % 240), y: 24 + (offset % 160) })
 }
-`}function Be(){return`import type { PointerEvent } from 'react'
+`}function We(){return`import type { PointerEvent } from 'react'
 import {
   Badge,
   Button,
@@ -1370,7 +1526,7 @@ export default function Board() {
     </Flex>
   )
 }
-`}function Ve(){return`/* Your app's own styles live in the cascivo.example layer (declared in index.html). */
+`}function Ge(){return`/* Your app's own styles live in the cascivo.example layer (declared in index.html). */
 @layer cascivo.example {
   .board {
     position: relative;
@@ -1410,7 +1566,7 @@ export default function Board() {
     pointer-events: none;
   }
 }
-`}function He(){return`import type { ViewConfig } from '@cascivo/render'
+`}function Ke(){return`import type { ViewConfig } from '@cascivo/render'
 import { validateView } from '@cascivo/render/validate'
 
 /**
@@ -1436,7 +1592,7 @@ export function checkView(title: unknown, view: unknown): CheckedView {
   // validateView has checked the whole shape, so the cast states a proven fact.
   return { title, view: view as ViewConfig }
 }
-`}function Ue(){return`import { AIChatAgent } from '@cloudflare/ai-chat'
+`}function qe(){return`import { AIChatAgent } from '@cloudflare/ai-chat'
 import { convertToModelMessages, stepCountIs, streamText, tool } from 'ai'
 import type { LanguageModel } from 'ai'
 import { createWorkersAI } from 'workers-ai-provider'
@@ -1491,7 +1647,7 @@ export class Assistant extends AIChatAgent<Env> {
     return result.toUIMessageStreamResponse()
   }
 }
-`}function We(){return`import { simulateReadableStream } from 'ai'
+`}function Je(){return`import { simulateReadableStream } from 'ai'
 import { MockLanguageModelV4 } from 'ai/test'
 
 /**
@@ -1593,7 +1749,7 @@ export function scriptedModel(): MockLanguageModelV4 {
     },
   })
 }
-`}function Ge(){return`import type { FormEvent } from 'react'
+`}function Ye(){return`import type { FormEvent } from 'react'
 import { CascivoView } from '@cascivo/render'
 import {
   Badge,
@@ -1723,7 +1879,7 @@ export default function Assistant() {
     </Flex>
   )
 }
-`}function Ke(){return`/* Your app's own styles live in the cascivo.example layer (declared in index.html). */
+`}function Xe(){return`/* Your app's own styles live in the cascivo.example layer (declared in index.html). */
 @layer cascivo.example {
   .messages {
     display: flex;
@@ -1756,7 +1912,7 @@ export default function Assistant() {
     flex: 1;
   }
 }
-`}function qe(){return`import { connectRoom } from '@cascivo/app/sync'
+`}function Ze(){return`import { connectRoom } from '@cascivo/app/sync'
 import { indexedDBDriver } from '@cascivo/storage'
 
 export interface Note {
@@ -1817,7 +1973,7 @@ export function addNote(): void {
 export function editNote(id: string, note: Note, change: Partial<Note>): void {
   notes.set(id, { ...note, ...change, updatedAt: Date.now() })
 }
-`}function Je(){return`import {
+`}function Qe(){return`import {
   Badge,
   Button,
   Card,
@@ -1893,7 +2049,7 @@ export default function Notes() {
     </Flex>
   )
 }
-`}function Ye(){return`import { defineJob } from '@cascivo/app/jobs'
+`}function $e(){return`import { defineJob } from '@cascivo/app/jobs'
 
 /**
  * The CSV import job, shared by the Worker (which runs it) and the page (which watches it).
@@ -1953,7 +2109,7 @@ export function parseStarted(raw: unknown): { id: string } {
   }
   throw new Error('Malformed job id')
 }
-`}function Xe(){return`import { createClient } from '@cascivo/app/api'
+`}function et(){return`import { createClient } from '@cascivo/app/api'
 import { watchJob } from '@cascivo/app/jobs'
 import type { WatchedJob } from '@cascivo/app/jobs'
 import { signal } from '@cascivo/react'
@@ -1989,7 +2145,7 @@ export async function startImport(csv: string): Promise<void> {
     starting.value = false
   }
 }
-`}function Ze(){return`import { jobReporter } from '@cascivo/app/jobs-server'
+`}function tt(){return`import { jobReporter } from '@cascivo/app/jobs-server'
 import { WorkflowEntrypoint } from 'cloudflare:workers'
 import type { WorkflowEvent, WorkflowStep } from 'cloudflare:workers'
 import { importJob } from '../src/import-job'
@@ -2075,7 +2231,7 @@ export class ImportJob extends WorkflowEntrypoint<Env, { csv: string }> {
     }
   }
 }
-`}function Qe(){return`import type { Step } from '@cascivo/react'
+`}function nt(){return`import type { Step } from '@cascivo/react'
 import {
   Alert,
   Button,
@@ -2187,7 +2343,7 @@ export default function Import() {
     </Flex>
   )
 }
-`}function $e(){return`import { defineUploads } from '@cascivo/app/uploads'
+`}function rt(){return`import { defineUploads } from '@cascivo/app/uploads'
 
 /**
  * What the app accepts, shared by the page (which checks first) and the Worker (which
@@ -2199,7 +2355,7 @@ export const uploads = defineUploads({
   maxBytes: 50 * 1024 * 1024,
   types: ['image/png', 'image/jpeg', 'image/webp', 'image/gif', 'application/pdf'],
 })
-`}function et(){return`import { createClient } from '@cascivo/app/api'
+`}function it(){return`import { createClient } from '@cascivo/app/api'
 import { startUpload } from '@cascivo/app/uploads'
 import type { StoredFile, Upload } from '@cascivo/app/uploads'
 import { signal } from '@cascivo/react'
@@ -2236,7 +2392,7 @@ export function removeUpload(id: string): void {
   upload?.abort()
   inFlight.value = inFlight.value.filter((u) => u.id !== id)
 }
-`}function tt(){return`import type { UploaderFile } from '@cascivo/react'
+`}function at(){return`import type { UploaderFile } from '@cascivo/react'
 import {
   Card,
   CardContent,
@@ -2317,7 +2473,7 @@ export default function Files() {
     </Flex>
   )
 }
-`}function nt(){return`/* Your app's own styles live in the cascivo.example layer (declared in index.html). */
+`}function ot(){return`/* Your app's own styles live in the cascivo.example layer (declared in index.html). */
 @layer cascivo.example {
   .grid {
     display: grid;
@@ -2333,7 +2489,7 @@ export default function Files() {
     background: var(--cascivo-color-bg-subtle);
   }
 }
-`}function rt(){return`import { exportUrl, isExporting } from '@cascivo/app/export'
+`}function st(){return`import { exportUrl, isExporting } from '@cascivo/app/export'
 import type { Column } from '@cascivo/react'
 import { Badge, Button, Card, CardContent, DataTable, Flex, Heading, Text } from '@cascivo/react'
 
@@ -2401,7 +2557,7 @@ export default function Report() {
     </Flex>
   )
 }
-`}function it(){return`import { defineMetrics } from '@cascivo/app/analytics'
+`}function ct(){return`import { defineMetrics } from '@cascivo/app/analytics'
 
 /**
  * What the Worker records for every API request, in Analytics Engine (worker/index.ts writes
@@ -2462,7 +2618,7 @@ export function parseUsageReport(raw: unknown): UsageReport {
     totals: { requests: num(t['requests']), errors: num(t['errors']), avgMs: num(t['avgMs']) },
   }
 }
-`}function at(){return`import { numberField, queryAnalytics, stringField } from '@cascivo/app/analytics'
+`}function lt(){return`import { numberField, queryAnalytics, stringField } from '@cascivo/app/analytics'
 import type { AnalyticsCredentials } from '@cascivo/app/analytics'
 import { usageMetrics } from '../src/usage'
 import type { UsageReport } from '../src/usage'
@@ -2537,7 +2693,7 @@ export async function usageReport(credentials: AnalyticsCredentials | null): Pro
     },
   }
 }
-`}function ot(){return`import { BarChart, Kpi, LineChart } from '@cascivo/charts'
+`}function ut(){return`import { BarChart, Kpi, LineChart } from '@cascivo/charts'
 import { createClient } from '@cascivo/app/api'
 import {
   Button,
@@ -2625,7 +2781,7 @@ export default function Usage() {
     </Flex>
   )
 }
-`}function st(){return`/**
+`}function dt(){return`/**
  * /search, shared by the Worker (which searches) and the page (which asks). \`semantic\` is
  * Vectorize over Workers AI embeddings; \`keyword\` is the \`vite dev\` stand-in, SQLite's
  * full-text search, because neither runs locally.
@@ -2689,7 +2845,7 @@ export function parseIndexed(raw: unknown): { indexed: number } {
   }
   throw new Error('Malformed reply')
 }
-`}function ct(){return`import { HttpError } from '@cascivo/app/api'
+`}function ft(){return`import { HttpError } from '@cascivo/app/api'
 import { migrate, queryRows } from '@cascivo/app/db'
 import type { Database } from '@cascivo/app/db'
 import type { SearchHit, SearchResult } from '../src/search'
@@ -2835,7 +2991,7 @@ export async function indexArticles(env: SearchEnv): Promise<{ indexed: number }
   }
   return { indexed: (await env.ARTICLES_INDEX.describe()).vectorCount }
 }
-`}function lt(){return`/**
+`}function pt(){return`/**
  * The help articles /search looks through, seeded into D1 on the first query. Replace them with
  * your own content: anything with an id, a title and a body can be indexed the same way.
  */
@@ -2961,7 +3117,7 @@ export const articles: { id: string; title: string; body: string }[] = [
     body: 'Upload a CSV under Settings, Data, Import. Map each column to a field, preview the first rows, then run the import; errors are listed per row.',
   },
 ]
-`}function ut(){return`import { createClient } from '@cascivo/app/api'
+`}function mt(){return`import { createClient } from '@cascivo/app/api'
 import {
   Alert,
   Badge,
@@ -3089,7 +3245,7 @@ export default function SearchPage() {
     </Flex>
   )
 }
-`}function dt(){return`/**
+`}function ht(){return`/**
  * The weekly digest's runs, shared by the Worker (which records each one) and the /digest page
  * (which lists them). A run happens on the Cron Trigger in wrangler.jsonc, or from "Send now".
  */
@@ -3136,7 +3292,7 @@ export function parseDigestRuns(raw: unknown): DigestRun[] {
   if (!Array.isArray(raw)) throw new Error('Expected a list of runs')
   return raw.map(parseDigestRun)
 }
-`}function ft(){return`import { migrate, queryRows } from '@cascivo/app/db'
+`}function gt(){return`import { migrate, queryRows } from '@cascivo/app/db'
 import type { Database } from '@cascivo/app/db'
 import { exportPage } from '@cascivo/app/export'
 import type { ExportBrowser } from '@cascivo/app/export'
@@ -3265,7 +3421,7 @@ export async function listRuns(db: Database): Promise<DigestRun[]> {
     parseDigestRun,
   )
 }
-`}function pt(){return`import { createClient } from '@cascivo/app/api'
+`}function _t(){return`import { createClient } from '@cascivo/app/api'
 import {
   Alert,
   Badge,
@@ -3347,7 +3503,7 @@ export default function Digest() {
     </Flex>
   )
 }
-`}function mt(){return`/**
+`}function vt(){return`/**
  * Webhook deliveries, shared by the Worker (which verifies and stores them) and the
  * /webhooks page (which lists them as they arrive).
  */
@@ -3390,7 +3546,7 @@ export function parseTestResult(raw: unknown): { status: number } {
   }
   throw new Error('Malformed reply')
 }
-`}function ht(){return`import { migrate, queryRows } from '@cascivo/app/db'
+`}function yt(){return`import { migrate, queryRows } from '@cascivo/app/db'
 import type { Database } from '@cascivo/app/db'
 import { verifyWebhook } from '@cascivo/app/guard'
 import { writeRoom } from '@cascivo/app/sync-server'
@@ -3508,7 +3664,7 @@ export async function sendTestDelivery(
   )
   return { status: response.status }
 }
-`}function gt(){return`import { createClient } from '@cascivo/app/api'
+`}function bt(){return`import { createClient } from '@cascivo/app/api'
 import { connectRoom } from '@cascivo/app/sync'
 import {
   Alert,
@@ -3614,8 +3770,148 @@ export default function Webhooks() {
     </Flex>
   )
 }
-`}function _t(){return"import { createAuth } from '@cascivo/app/auth'\n\n/**\n * Who is signed in, shared by every page: `auth.user.value` is `undefined` while the first\n * check runs, then the user or `null`. The Worker side is `handleAuth` in worker/index.ts.\n */\nexport const auth = createAuth()\n"}function vt(){return`/** What sending a sign-in link needs of the Email Service binding (\`send_email\`). */
-export interface SignInSender {
+`}function xt(e){return`/**
+ * What /checkout sells and the orders it makes, shared by the Worker (which creates them and
+ * hears from Stripe) and the pages (which show them).
+ */
+
+/** The seller, as the receipt names it. */
+export const SHOP_NAME = '${M(e.name).replace(/'/g,`\\'`)}'
+
+/**
+ * What you sell. The Worker sends this to Stripe, so a browser cannot change the price; the
+ * page only displays it.
+ */
+export const PRODUCT = {
+  name: 'Sticker pack',
+  description: 'Twelve vinyl stickers of your favourite components, shipped worldwide.',
+  /** In the currency's smallest unit: 900 is €9.00. */
+  amount: 900,
+  /** Three-letter ISO code, lowercase. */
+  currency: 'eur',
+}
+
+/**
+ * \`pending\` until Stripe confirms the payment. \`failed\` and \`expired\` are final. A paid
+ * order becomes \`refunded\` when all of it is refunded, and \`disputed\` while a chargeback is
+ * open (back to \`paid\` if it is won).
+ */
+export type OrderStatus = 'pending' | 'paid' | 'failed' | 'expired' | 'refunded' | 'disputed'
+
+export interface Order {
+  id: string
+  status: OrderStatus
+  /** What Stripe charged, in the currency's smallest unit. */
+  amount: number
+  currency: string
+  /** Refunded so far, in the same unit: part of a paid order, or all of a refunded one. */
+  refundedAmount: number
+  createdAt: string
+  paidAt: string | null
+}
+
+/** An order id: a UUID the Worker made. */
+export const ORDER_ID = /^[0-9a-f-]{36}$/
+
+/** The room the Worker pushes an order's changes to; its page watches it. */
+export const orderRoom = (id: string) => \`order-\${id}\`
+
+/** A price in the currency's smallest unit, for people: 900 eur is €9.00, 900 jpy is ¥900. */
+export function formatPrice(amount: number, currency: string): string {
+  const format = new Intl.NumberFormat(undefined, { style: 'currency', currency })
+  const digits = format.resolvedOptions().maximumFractionDigits ?? 2
+  return format.format(amount / 10 ** digits)
+}
+
+const STATUSES = ['pending', 'paid', 'failed', 'expired', 'refunded', 'disputed']
+
+export function parseOrder(raw: unknown): Order {
+  if (typeof raw === 'object' && raw !== null) {
+    const { id, status, amount, currency, refundedAmount, createdAt, paidAt } = raw as Record<
+      string,
+      unknown
+    >
+    if (
+      typeof id === 'string' &&
+      typeof status === 'string' &&
+      STATUSES.includes(status) &&
+      typeof amount === 'number' &&
+      typeof currency === 'string' &&
+      typeof refundedAmount === 'number' &&
+      typeof createdAt === 'string' &&
+      (paidAt === null || typeof paidAt === 'string')
+    ) {
+      return {
+        id,
+        // Checked against STATUSES just above.
+        status: status as OrderStatus,
+        amount,
+        currency,
+        refundedAmount,
+        createdAt,
+        paidAt,
+      }
+    }
+  }
+  throw new Error('Malformed order')
+}
+
+export function parseCheckoutStarted(raw: unknown): { url: string } {
+  if (typeof raw === 'object' && raw !== null) {
+    const { url } = raw as Record<string, unknown>
+    if (typeof url === 'string' && url.startsWith('https://')) return { url }
+  }
+  throw new Error('Malformed checkout')
+}
+`}function St(){return`import { HttpError } from '@cascivo/app/api'
+import { migrate, queryRows } from '@cascivo/app/db'
+import type { Database } from '@cascivo/app/db'
+import { verifyWebhook } from '@cascivo/app/guard'
+import { StripeError, createStripe, parseStripeEvent } from '@cascivo/app/stripe'
+import type {
+  Charge,
+  CheckoutEventType,
+  CheckoutSession,
+  Dispute,
+  DisputeEventType,
+  Invoice,
+  Stripe,
+} from '@cascivo/app/stripe'
+import { writeRoom } from '@cascivo/app/sync-server'
+import type { RoomNamespace } from '@cascivo/app/sync-server'
+import { Receipt, receiptSubject, renderEmail } from '@cascivo/email'
+import { createElement } from 'react'
+import { ORDER_ID, PRODUCT, SHOP_NAME, formatPrice, orderRoom, parseOrder } from '../src/checkout'
+import type { Order, OrderStatus } from '../src/checkout'
+
+const migrations = [
+  {
+    id: '0001_orders',
+    statements: [
+      \`CREATE TABLE orders (
+        id TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL UNIQUE,
+        status TEXT NOT NULL,
+        amount INTEGER NOT NULL,
+        currency TEXT NOT NULL,
+        email TEXT,
+        created_at TEXT NOT NULL,
+        paid_at TEXT,
+        payment_intent_id TEXT,
+        refunded_amount INTEGER NOT NULL DEFAULT 0,
+        dispute_status TEXT
+      )\`,
+      // Refund and dispute events name the payment, not the session.
+      'CREATE INDEX orders_payment_intent ON orders (payment_intent_id)',
+    ],
+  },
+]
+
+/** Where Stripe posts; add it as an endpoint in the Stripe dashboard (README). */
+export const STRIPE_WEBHOOK_PATH = '/api/stripe/webhook'
+
+/** What sending a receipt needs of the Email Service binding (\`send_email\`). */
+export interface ReceiptSender {
   send(message: {
     from: string
     to: string
@@ -3625,93 +3921,2234 @@ export interface SignInSender {
   }): Promise<unknown>
 }
 
-const escape = (value: string) =>
-  value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
+export interface CheckoutEnv {
+  DB: Database
+  ROOMS: RoomNamespace<unknown>
+  EMAIL: ReceiptSender
+  RECEIPT_FROM: string
+  STRIPE_SECRET_KEY?: string
+  STRIPE_WEBHOOK_SECRET?: string
+}
+
+const COLUMNS =
+  'id, status, amount, currency, refunded_amount AS refundedAmount, created_at AS createdAt, paid_at AS paidAt'
+
+export function stripeOf(env: { STRIPE_SECRET_KEY?: string }): Stripe {
+  if (!env.STRIPE_SECRET_KEY) {
+    throw new HttpError(
+      503,
+      'Set STRIPE_SECRET_KEY to a test key from the Stripe dashboard (README)',
+    )
+  }
+  return createStripe(env.STRIPE_SECRET_KEY)
+}
+
+/** Stripe's refusal, for the page: its message in vite dev, a pointer to the log deployed. */
+export function refused(error: unknown): never {
+  if (!(error instanceof StripeError)) throw error
+  console.error('[checkout] Stripe refused:', error.status, error.code, error.message)
+  throw new HttpError(
+    502,
+    import.meta.env.DEV
+      ? \`Stripe: \${error.message}\`
+      : 'The payment provider refused the request (see the Worker log)',
+  )
+}
 
 /**
- * Emails a sign-in link. \`vite dev\` sends nothing: the link is logged, and the Account page
- * shows it (\`exposeLink\` in worker/index.ts).
+ * Creates a Stripe Checkout Session for PRODUCT and records the order as pending. The order id
+ * is also the idempotency key, so a retried request cannot open a second session.
  */
-export async function sendSignInLink(
-  sender: SignInSender,
-  from: string,
-  email: string,
-  url: string,
+export async function startCheckout(env: CheckoutEnv, origin: string): Promise<{ url: string }> {
+  const stripe = stripeOf(env)
+  const id = crypto.randomUUID()
+  let session: CheckoutSession
+  try {
+    session = await stripe.createCheckoutSession(
+      {
+        mode: 'payment',
+        lineItems: [{ ...PRODUCT, quantity: 1 }],
+        successUrl: \`\${origin}/checkout/\${id}\`,
+        cancelUrl: \`\${origin}/checkout\`,
+        clientReferenceId: id,
+      },
+      { idempotencyKey: id },
+    )
+  } catch (error) {
+    refused(error)
+  }
+  if (!session.url) throw new HttpError(502, 'Stripe returned no checkout page')
+  await migrate(env.DB, migrations)
+  await queryRows(
+    env.DB,
+    \`INSERT INTO orders (id, session_id, status, amount, currency, created_at)
+     VALUES (?, ?, 'pending', ?, ?, ?)\`,
+    [id, session.id, PRODUCT.amount, PRODUCT.currency, new Date().toISOString()],
+    (row) => row,
+  )
+  return { url: session.url }
+}
+
+/** Where an event moves the order, or \`null\` when it does not move it. */
+function statusAfter(type: CheckoutEventType, session: CheckoutSession): OrderStatus | null {
+  switch (type) {
+    case 'checkout.session.completed':
+      // \`unpaid\` here is a bank debit that has not settled: the async events decide it.
+      return session.paymentStatus === 'unpaid' ? null : 'paid'
+    case 'checkout.session.async_payment_succeeded':
+      return 'paid'
+    case 'checkout.session.async_payment_failed':
+      return 'failed'
+    case 'checkout.session.expired':
+      return 'expired'
+  }
+}
+
+/** The same decision from a session read back from Stripe, with no event to go by. */
+function statusOf(session: CheckoutSession): OrderStatus | null {
+  if (session.status === 'complete' && session.paymentStatus !== 'unpaid') return 'paid'
+  return session.status === 'expired' ? 'expired' : null
+}
+
+/**
+ * Moves a pending order to its final status, once: a retried event, or the order page reading
+ * the session before the webhook arrived, finds it settled and changes nothing. The order is
+ * found by Stripe's session id, never by \`client_reference_id\`, which a buyer can set on a
+ * Payment Link. Then the order's page hears about it, and a paid order gets its receipt.
+ */
+async function settle(
+  env: CheckoutEnv,
+  session: CheckoutSession,
+  status: OrderStatus,
+  origin: string,
 ): Promise<void> {
+  await migrate(env.DB, migrations)
+  const [order] = await queryRows(
+    env.DB,
+    \`UPDATE orders SET status = ?, paid_at = ?, amount = COALESCE(?, amount),
+       currency = COALESCE(?, currency), email = ?, payment_intent_id = ?
+     WHERE session_id = ? AND status = 'pending' RETURNING \${COLUMNS}\`,
+    [
+      status,
+      status === 'paid' ? new Date().toISOString() : null,
+      session.amountTotal,
+      session.currency,
+      session.customerEmail,
+      session.paymentIntentId,
+      session.id,
+    ],
+    parseOrder,
+  )
+  if (!order) return
+  await writeRoom(env.ROOMS, orderRoom(order.id), 'order', { ...order })
+  if (order.status === 'paid' && session.customerEmail) {
+    await sendReceipt(env, order, session.customerEmail, origin)
+  }
+}
+
+/**
+ * Emails a receipt rendered with @cascivo/email. \`vite dev\` renders it and logs it instead.
+ * A receipt that cannot be sent is logged, not thrown: the payment is recorded either way, and
+ * Stripe retrying the event would not send it again.
+ */
+async function sendReceipt(env: CheckoutEnv, order: Order, to: string, origin: string) {
+  const total = formatPrice(order.amount, order.currency)
+  const props = {
+    productName: SHOP_NAME,
+    orderId: order.id.slice(0, 8).toUpperCase(),
+    items: [{ description: PRODUCT.name, amount: total }],
+    total,
+    invoiceHref: \`\${origin}/checkout/\${order.id}\`,
+  }
+  const message = renderEmail(createElement(Receipt, props), { subject: receiptSubject(props) })
   if (import.meta.env.DEV) {
-    console.log(\`[auth] sign-in link for \${email}: \${url}\`)
+    console.log(\`[checkout] receipt for \${to}: "\${message.subject}" (\${message.html.length} bytes)\`)
     return
   }
-  if (!from) throw new Error('Set AUTH_FROM in wrangler.jsonc to an address on your domain')
-  await sender.send({
-    from,
-    to: email,
-    subject: 'Your sign-in link',
-    text: \`Sign in: \${url}\\n\\nThe link works once, for 15 minutes. If you did not ask for it, ignore this email.\`,
-    html: \`<p><a href="\${escape(url)}">Sign in</a></p><p>The link works once, for 15 minutes. If you did not ask for it, ignore this email.</p>\`,
+  if (!env.RECEIPT_FROM) {
+    console.warn('[checkout] no receipt sent: set RECEIPT_FROM in wrangler.jsonc')
+    return
+  }
+  try {
+    await env.EMAIL.send({
+      from: env.RECEIPT_FROM,
+      to,
+      subject: message.subject,
+      text: message.text,
+      html: message.html,
+    })
+  } catch (error) {
+    console.error('[checkout] receipt not sent:', error)
+  }
+}
+
+/**
+ * A refund, made in the Stripe dashboard or with \`createRefund\`. \`charge.refunded\` carries the
+ * running total, so a retried or late event cannot count a refund twice. All of it refunded
+ * makes the order \`refunded\`; part of it leaves it \`paid\`, with the amount shown.
+ */
+async function refundOrder(env: CheckoutEnv, charge: Charge): Promise<void> {
+  if (!charge.paymentIntentId) return
+  await migrate(env.DB, migrations)
+  const [order] = await queryRows(
+    env.DB,
+    \`UPDATE orders SET refunded_amount = MAX(refunded_amount, ?),
+       status = CASE WHEN ? = 1 THEN 'refunded' ELSE status END
+     WHERE payment_intent_id = ? AND status IN ('paid', 'refunded') RETURNING \${COLUMNS}\`,
+    [charge.amountRefunded, charge.refunded ? 1 : 0, charge.paymentIntentId],
+    parseOrder,
+  )
+  if (order) await writeRoom(env.ROOMS, orderRoom(order.id), 'order', { ...order })
+}
+
+/**
+ * A chargeback. While it is open the order is \`disputed\`: hold back anything not yet
+ * delivered, and answer it with evidence in the Stripe dashboard before the deadline shown
+ * there. Won, the order is \`paid\` again; lost, it stays \`disputed\`. The dispute's status is
+ * stored, so a \`created\` event arriving after \`closed\` cannot reopen it.
+ */
+async function disputeOrder(
+  env: CheckoutEnv,
+  type: DisputeEventType,
+  dispute: Dispute,
+): Promise<void> {
+  if (!dispute.paymentIntentId) return
+  await migrate(env.DB, migrations)
+  const [order] =
+    type === 'charge.dispute.created'
+      ? await queryRows(
+          env.DB,
+          \`UPDATE orders SET status = 'disputed', dispute_status = ?
+           WHERE payment_intent_id = ? AND status = 'paid' AND dispute_status IS NULL
+           RETURNING \${COLUMNS}\`,
+          [dispute.status, dispute.paymentIntentId],
+          parseOrder,
+        )
+      : await queryRows(
+          env.DB,
+          \`UPDATE orders SET dispute_status = ?,
+             status = CASE WHEN ? = 'won' THEN 'paid' ELSE 'disputed' END
+           WHERE payment_intent_id = ? AND status IN ('paid', 'disputed') RETURNING \${COLUMNS}\`,
+          [dispute.status, dispute.status, dispute.paymentIntentId],
+          parseOrder,
+        )
+  if (!order) return
+  if (type === 'charge.dispute.created') {
+    console.warn(
+      \`[checkout] order \${order.id} is disputed (\${dispute.reason ?? 'no reason given'})\`,
+    )
+  }
+  await writeRoom(env.ROOMS, orderRoom(order.id), 'order', { ...order })
+}
+
+/** What the webhook hands to worker/billing.ts, when the app bills subscriptions. */
+export interface BillingHooks {
+  /** A subscription changed: store its current state. */
+  subscription(subscriptionId: string): Promise<void>
+  /** A renewal could not be charged: tell the customer. */
+  paymentFailed(invoice: Invoice, origin: string): Promise<void>
+}
+
+/**
+ * Stripe's webhook: verified against STRIPE_WEBHOOK_SECRET before anything in it is read,
+ * then each Checkout event settles its order, and refunds and disputes update it. Subscription
+ * and invoice events, and completed subscription checkouts, go to \`billing\` when the app bills
+ * subscriptions (worker/billing.ts). Other events are acknowledged, so Stripe stops sending them.
+ */
+export async function receiveStripe(
+  request: Request,
+  env: CheckoutEnv,
+  billing?: BillingHooks,
+): Promise<Response> {
+  if (!env.STRIPE_WEBHOOK_SECRET) throw new HttpError(503, 'Set STRIPE_WEBHOOK_SECRET (README)')
+  const { body } = await verifyWebhook(request, {
+    scheme: 'stripe',
+    secret: env.STRIPE_WEBHOOK_SECRET,
   })
+  const event = parseStripeEvent(body)
+  const origin = new URL(request.url).origin
+  if (event.kind === 'subscription') await billing?.subscription(event.subscription.id)
+  if (event.kind === 'invoice' && event.type === 'invoice.payment_failed') {
+    await billing?.paymentFailed(event.invoice, origin)
+  }
+  if (event.kind === 'refund') await refundOrder(env, event.charge)
+  if (event.kind === 'dispute') await disputeOrder(env, event.type, event.dispute)
+  if (event.kind === 'checkout' && event.session.mode === 'subscription') {
+    if (event.session.subscriptionId) await billing?.subscription(event.session.subscriptionId)
+  } else if (event.kind === 'checkout') {
+    const status = statusAfter(event.type, event.session)
+    if (status) await settle(env, event.session, status, origin)
+  }
+  return Response.json({ received: true })
+}
+
+function parseStored(raw: unknown): { order: Order; sessionId: string } {
+  const sessionId = typeof raw === 'object' && raw !== null ? Reflect.get(raw, 'sessionId') : null
+  if (typeof sessionId !== 'string') throw new Error('Malformed order row')
+  return { order: parseOrder(raw), sessionId }
+}
+
+async function readOrder(env: CheckoutEnv, id: string) {
+  await migrate(env.DB, migrations)
+  const [row] = await queryRows(
+    env.DB,
+    \`SELECT \${COLUMNS}, session_id AS sessionId FROM orders WHERE id = ?\`,
+    [id],
+    parseStored,
+  )
+  if (!row) throw new HttpError(404, 'No such order')
+  return row
+}
+
+/**
+ * An order, for its page. A pending one is checked with Stripe first, so the page is right
+ * even when the webhook is late or not set up yet (as in \`vite dev\` without \`stripe listen\`).
+ */
+export async function getOrder(env: CheckoutEnv, id: string, origin: string): Promise<Order> {
+  if (!ORDER_ID.test(id)) throw new HttpError(404, 'No such order')
+  const { order, sessionId } = await readOrder(env, id)
+  if (order.status !== 'pending' || !env.STRIPE_SECRET_KEY) return order
+  try {
+    const session = await stripeOf(env).retrieveCheckoutSession(sessionId)
+    const status = statusOf(session)
+    if (!status) return order
+    await settle(env, session, status, origin)
+  } catch (error) {
+    // Stripe unreachable: show what is known; the webhook settles the order later.
+    console.error('[checkout] could not read the session back:', error)
+    return order
+  }
+  return (await readOrder(env, id)).order
 }
-`}function yt(){return`import {
+`}function Ct(){return`import { createClient } from '@cascivo/app/api'
+import {
   Alert,
   Button,
   Card,
   CardContent,
   Flex,
   Heading,
-  Input,
-  Link,
-  Spinner,
   Text,
   signal,
   useSignals,
 } from '@cascivo/react'
-import type { FormEvent } from 'react'
-import { auth } from '../auth'
+import { api } from '../api'
+import { PRODUCT, formatPrice } from '../checkout'
 
-const sentTo = signal<string | null>(null)
-/** Set only in \`vite dev\`, where no email is sent: the link to open instead. */
-const devLink = signal<string | null>(null)
+const client = createClient(api)
+const starting = signal(false)
 const failure = signal<string | null>(null)
-const sending = signal(false)
 
-async function start(event: FormEvent<HTMLFormElement>): Promise<void> {
-  event.preventDefault()
-  const email = new FormData(event.currentTarget).get('email')
-  if (typeof email !== 'string') return
+/** Asks the Worker for a Stripe Checkout page and goes there: Stripe takes the card, not us. */
+async function buy(): Promise<void> {
+  starting.value = true
   failure.value = null
-  sending.value = true
   try {
-    const { link } = await auth.start(email)
-    sentTo.value = email
-    devLink.value = link
+    const { url } = await client.startCheckout()
+    location.assign(url)
   } catch (error) {
-    failure.value = error instanceof Error ? error.message : 'Could not send the link'
-  } finally {
-    sending.value = false
+    failure.value = error instanceof Error ? error.message : 'Could not start the checkout'
+    starting.value = false
   }
 }
 
-export default function Account() {
+export default function Checkout() {
   useSignals()
-  const user = auth.user.value
-
-  if (user === undefined) return <Spinner label="Loading" />
-  if (user) {
-    return (
-      <Flex gap={4}>
-        <Heading level={1}>Account</Heading>
-        <Card>
-          <CardContent>
-            <Flex gap={3}>
-              <Text>Signed in as {user.email}</Text>
-              <Flex direction="horizontal">
-                <Button variant="secondary" onClick={() => void auth.signOut()}>
-                  Sign out
-                </Button>
-              </Flex>
-            </Flex>
-          </CardContent>
-        </Card>
+  return (
+    <Flex gap={4}>
+      <Flex gap={1}>
+        <Heading level={1}>Checkout</Heading>
+        <Text muted>
+          Paid on Stripe's hosted page. Stripe tells the Worker when the payment succeeds; the
+          Worker records the order, updates its page and emails a receipt.
+        </Text>
+      </Flex>
+      <Card>
+        <CardContent>
+          <Flex gap={3}>
+            <Flex gap={1}>
+              <Heading level={2}>{PRODUCT.name}</Heading>
+              <Text muted>{PRODUCT.description}</Text>
+            </Flex>
+            <Text size="lg">{formatPrice(PRODUCT.amount, PRODUCT.currency)}</Text>
+            <Flex direction="horizontal">
+              <Button loading={starting.value} onClick={() => void buy()}>
+                Buy now
+              </Button>
+            </Flex>
+          </Flex>
+        </CardContent>
+      </Card>
+      {failure.value ? (
+        <Alert variant="destructive" title="The checkout did not start">
+          {failure.value}
+        </Alert>
+      ) : null}
+      <Text size="sm" muted>
+        In test mode, pay with the card 4242 4242 4242 4242, any future date and any CVC.
+      </Text>
+    </Flex>
+  )
+}
+`}function wt(){return`import type { RouteProps } from '@cascivo/app'
+import { createClient } from '@cascivo/app/api'
+import { connectRoom } from '@cascivo/app/sync'
+import {
+  Alert,
+  Badge,
+  EmptyState,
+  Flex,
+  Heading,
+  Link,
+  Spinner,
+  Text,
+  signal,
+  useEffectPropSignal,
+  useSignalEffect,
+  useSignals,
+} from '@cascivo/react'
+import { api } from '../../api'
+import { PRODUCT, formatPrice, parseOrder } from '../../checkout'
+import type { Order } from '../../checkout'
+
+const client = createClient(api)
+/** Orders seen, by id; \`null\` when the id has none. */
+const orders = signal<Readonly<Record<string, Order | null>>>({})
+
+/** Keeps the newest word on an order: a final status is never replaced by \`pending\`. */
+function remember(id: string, order: Order | null): void {
+  const known = orders.peek()[id]
+  if (known && known.status !== 'pending' && order?.status === 'pending') return
+  orders.value = { ...orders.peek(), [id]: order }
+}
+
+async function load(id: string): Promise<void> {
+  try {
+    remember(id, await client.getOrder({ params: { id } }))
+  } catch {
+    remember(id, null)
+  }
+}
+
+/** Watches the order's room, where the Worker pushes what Stripe reports. Returns the cleanup. */
+function watch(id: string): () => void {
+  const room = connectRoom(\`/api/orders/\${id}/live\`)
+  const pushed = room.signal<Order | null>('order', null, (raw) =>
+    raw === null ? null : parseOrder(raw),
+  )
+  const stop = pushed.signal.subscribe((order) => {
+    if (order) remember(id, order)
+  })
+  return () => {
+    stop()
+    room.close()
+  }
+}
+
+const STATUS = {
+  pending: { variant: 'warning', label: 'Waiting for Stripe' },
+  paid: { variant: 'success', label: 'Paid' },
+  failed: { variant: 'destructive', label: 'Payment failed' },
+  expired: { variant: 'secondary', label: 'Expired' },
+  refunded: { variant: 'secondary', label: 'Refunded' },
+  disputed: { variant: 'destructive', label: 'Disputed' },
+} as const
+
+/** \`/checkout/:order\` — where Stripe sends the buyer back. It updates when Stripe confirms. */
+export default function OrderPage({ params }: RouteProps<'/checkout/:order'>) {
+  useSignals()
+  const id = useEffectPropSignal(params.order)
+  useSignalEffect(() => {
+    void load(id.value)
+    return watch(id.value)
+  })
+  const order = orders.value[params.order]
+
+  if (order === undefined) return <Spinner label="Loading" />
+  if (order === null) {
+    return <EmptyState title="No such order" description="Check the link in your receipt." />
+  }
+  return (
+    <Flex gap={4}>
+      <Flex gap={1}>
+        <Heading level={1}>Your order</Heading>
+        <Text muted>
+          {PRODUCT.name} · {formatPrice(order.amount, order.currency)}
+        </Text>
+      </Flex>
+      <Flex direction="horizontal" align="center" gap={2} wrap>
+        <Badge variant={STATUS[order.status].variant}>{STATUS[order.status].label}</Badge>
+        <Text size="sm" muted>
+          Ordered {new Date(order.createdAt).toLocaleString()}
+        </Text>
+      </Flex>
+      {order.status === 'pending' ? (
+        <Alert variant="info" title="Confirming your payment">
+          This page updates by itself when Stripe confirms. A bank payment can take a few days.
+        </Alert>
+      ) : null}
+      {order.status === 'paid' && order.refundedAmount === 0 ? (
+        <Alert variant="success" title="Thank you">
+          Your payment went through. A receipt is on its way to your inbox.
+        </Alert>
+      ) : null}
+      {order.status === 'paid' && order.refundedAmount > 0 ? (
+        <Alert variant="info" title="Partly refunded">
+          {formatPrice(order.refundedAmount, order.currency)} of this order was refunded to the card
+          that paid it.
+        </Alert>
+      ) : null}
+      {order.status === 'refunded' ? (
+        <Alert variant="info" title="Refunded">
+          The full amount went back to the card that paid it. It can take a few days to show.
+        </Alert>
+      ) : null}
+      {order.status === 'disputed' ? (
+        <Alert variant="warning" title="This payment is disputed">
+          The card's bank is reviewing a chargeback. The order is on hold until it is decided.
+        </Alert>
+      ) : null}
+      {order.status === 'failed' ? (
+        <Alert variant="destructive" title="The payment failed">
+          Nothing was charged. <Link href="/checkout">Try again</Link>
+        </Alert>
+      ) : null}
+      {order.status === 'expired' ? (
+        <Alert variant="warning" title="This checkout expired">
+          It was not paid in time. <Link href="/checkout">Start again</Link>
+        </Alert>
+      ) : null}
+    </Flex>
+  )
+}
+`}function Tt(){return`/**
+ * The newsletter's wire types, shared by the Worker (worker/newsletter.ts) and its pages.
+ * Every payload is parsed on arrival: the network is not trusted because the types match.
+ */
+
+/** Longest subject and body the composer accepts. */
+export const MAX_SUBJECT = 200
+export const MAX_BODY = 50_000
+
+export interface SubscriberCounts {
+  /** Signed up, has not clicked the confirmation link yet. */
+  pending: number
+  subscribed: number
+  unsubscribed: number
+  /** Bounced for good or complained: never mailed again (worker/newsletter.ts). */
+  suppressed: number
+}
+
+/** One sent issue and how far its sending has got. */
+export interface Issue {
+  id: string
+  subject: string
+  createdAt: string
+  /** Subscribers it was queued for. */
+  total: number
+  sent: number
+  failed: number
+}
+
+export interface Overview {
+  subscribers: SubscriberCounts
+  issues: Issue[]
+}
+
+/** The room the Worker pushes an issue's progress to; the composer watches it. */
+export const issueRoom = (id: string) => \`issue-\${id}\`
+
+/** An issue id: a UUID the Worker made. */
+export const ISSUE_ID = /^[0-9a-f-]{36}$/
+
+const isRecord = (raw: unknown): raw is Record<string, unknown> =>
+  typeof raw === 'object' && raw !== null
+
+function text(raw: Record<string, unknown>, key: string, max: number): string {
+  const value = raw[key]
+  if (typeof value !== 'string' || value.trim() === '' || value.length > max) {
+    throw new Error(\`Expected \${key}: some text, at most \${max} characters\`)
+  }
+  return value
+}
+
+export function parseEmailInput(raw: unknown): { email: string } {
+  if (!isRecord(raw)) throw new Error('Expected { email }')
+  return { email: text(raw, 'email', 254) }
+}
+
+export function parseTokenInput(raw: unknown): { token: string } {
+  if (!isRecord(raw)) throw new Error('Expected { token }')
+  return { token: text(raw, 'token', 100) }
+}
+
+/** The composer's key: NEWSLETTER_KEY, which only the sender knows. */
+export function parseKeyInput(raw: unknown): { key: string } {
+  if (!isRecord(raw)) throw new Error('Expected { key }')
+  return { key: text(raw, 'key', 200) }
+}
+
+export interface IssueInput {
+  key: string
+  subject: string
+  /** The body in Markdown, rendered by @cascivo/email's Markdown. */
+  body: string
+}
+
+export function parseIssueInput(raw: unknown): IssueInput {
+  if (!isRecord(raw)) throw new Error('Expected { key, subject, body }')
+  return {
+    key: text(raw, 'key', 200),
+    subject: text(raw, 'subject', MAX_SUBJECT),
+    body: text(raw, 'body', MAX_BODY),
+  }
+}
+
+export function parseSubscribed(raw: unknown): { devLink: string | null } {
+  if (isRecord(raw) && (raw['devLink'] === null || typeof raw['devLink'] === 'string')) {
+    return { devLink: raw['devLink'] }
+  }
+  throw new Error('Malformed reply')
+}
+
+export function parseConfirmed(raw: unknown): { email: string } {
+  if (isRecord(raw) && typeof raw['email'] === 'string') return { email: raw['email'] }
+  throw new Error('Malformed reply')
+}
+
+export function parsePreview(raw: unknown): { html: string; bytes: number } {
+  if (isRecord(raw) && typeof raw['html'] === 'string' && typeof raw['bytes'] === 'number') {
+    return { html: raw['html'], bytes: raw['bytes'] }
+  }
+  throw new Error('Malformed preview')
+}
+
+const count = (raw: Record<string, unknown>, key: string): number => {
+  const value = raw[key]
+  if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+    throw new Error(\`Expected a count for \${key}\`)
+  }
+  return value
+}
+
+export function parseIssue(raw: unknown): Issue {
+  if (isRecord(raw) && typeof raw['id'] === 'string' && typeof raw['createdAt'] === 'string') {
+    return {
+      id: raw['id'],
+      subject: text(raw, 'subject', MAX_SUBJECT),
+      createdAt: raw['createdAt'],
+      total: count(raw, 'total'),
+      sent: count(raw, 'sent'),
+      failed: count(raw, 'failed'),
+    }
+  }
+  throw new Error('Malformed issue')
+}
+
+export function parseOverview(raw: unknown): Overview {
+  if (isRecord(raw) && isRecord(raw['subscribers']) && Array.isArray(raw['issues'])) {
+    const s = raw['subscribers']
+    return {
+      subscribers: {
+        pending: count(s, 'pending'),
+        subscribed: count(s, 'subscribed'),
+        unsubscribed: count(s, 'unsubscribed'),
+        suppressed: count(s, 'suppressed'),
+      },
+      issues: raw['issues'].map(parseIssue),
+    }
+  }
+  throw new Error('Malformed overview')
+}
+`}function Et(e){return`import {
+  Body,
+  Button,
+  Container,
+  Footer,
+  Head,
+  Heading,
+  Html,
+  Link,
+  Markdown,
+  Preview,
+  Section,
+  Text,
+  renderEmail,
+} from '@cascivo/email'
+import type { RenderResult } from '@cascivo/email'
+import { createElement as h } from 'react'
+
+/** Who the newsletter is from, as its emails say. */
+export const NEWSLETTER_NAME = '${M(e.name).replace(/'/g,`\\'`)}'
+
+/** Stands in for each reader's unsubscribe token; worker/newsletter.ts swaps it per message. */
+export const TOKEN_SLOT = '__UNSUBSCRIBE_TOKEN__'
+
+/**
+ * An issue, rendered once with @cascivo/email: the body is Markdown, drawn through the email
+ * primitives (raw HTML in it stays literal text). The footer carries the unsubscribe link,
+ * with TOKEN_SLOT where each reader's token goes.
+ */
+export function renderIssue(subject: string, body: string, origin: string): RenderResult {
+  const unsubscribe = \`\${origin}/newsletter/unsubscribe?token=\${TOKEN_SLOT}\`
+  return renderEmail(
+    h(
+      Html,
+      null,
+      h(Head, { title: subject }),
+      h(
+        Body,
+        null,
+        h(Preview, null, subject),
+        h(
+          Container,
+          null,
+          h(Section, { padding: 32 }, h(Heading, { level: 1 }, subject), h(Markdown, null, body)),
+          h(
+            Footer,
+            null,
+            \`You get this because you subscribed to \${NEWSLETTER_NAME}. \`,
+            h(Link, { href: unsubscribe }, 'Unsubscribe'),
+          ),
+        ),
+      ),
+    ),
+    { subject },
+  )
+}
+
+/** The double opt-in email: nobody is mailed an issue until they open this link. */
+export function renderConfirmation(confirmUrl: string): RenderResult {
+  const subject = \`Confirm your subscription to \${NEWSLETTER_NAME}\`
+  return renderEmail(
+    h(
+      Html,
+      null,
+      h(Head, { title: subject }),
+      h(
+        Body,
+        null,
+        h(Preview, null, 'One click and you are on the list.'),
+        h(
+          Container,
+          null,
+          h(
+            Section,
+            { padding: 32 },
+            h(Heading, { level: 1 }, 'Confirm your subscription'),
+            h(Text, null, \`Someone, hopefully you, asked to get \${NEWSLETTER_NAME} by email.\`),
+            h(Button, { href: confirmUrl }, 'Yes, subscribe me'),
+            h(
+              Text,
+              { variant: 'muted', size: '14px' },
+              'The link works for 24 hours. If you did not ask, ignore this email: you will not hear from us again.',
+            ),
+          ),
+        ),
+      ),
+    ),
+    { subject },
+  )
+}
+`}function Dt(){return`import { HttpError } from '@cascivo/app/api'
+import { normalizeEmail } from '@cascivo/app/auth-server'
+import { migrate, queryRows } from '@cascivo/app/db'
+import type { Database } from '@cascivo/app/db'
+import { SesError, createSes, handleSns, parseSesNotification } from '@cascivo/app/ses'
+import { writeRoom } from '@cascivo/app/sync-server'
+import type { RoomNamespace } from '@cascivo/app/sync-server'
+import { assertSendable, sendEmail } from '@cascivo/email'
+import type { RenderResult } from '@cascivo/email'
+import { ISSUE_ID, issueRoom, parseIssue } from '../src/newsletter'
+import type { Issue, IssueInput, Overview, SubscriberCounts } from '../src/newsletter'
+import { TOKEN_SLOT, renderConfirmation, renderIssue } from './newsletter-email'
+
+const migrations = [
+  {
+    id: '0001_newsletter',
+    statements: [
+      \`CREATE TABLE subscribers (
+        email TEXT PRIMARY KEY,
+        status TEXT NOT NULL,
+        confirm_hash TEXT,
+        confirm_expires INTEGER,
+        unsubscribe_token TEXT NOT NULL UNIQUE,
+        reason TEXT,
+        created_at TEXT NOT NULL,
+        confirmed_at TEXT
+      )\`,
+      \`CREATE TABLE issues (
+        id TEXT PRIMARY KEY,
+        subject TEXT NOT NULL,
+        body TEXT NOT NULL,
+        total INTEGER NOT NULL,
+        created_at TEXT NOT NULL
+      )\`,
+      // One row per reader per issue, written as each send finishes: a retried queue message
+      // skips whoever already has one, so nobody gets an issue twice.
+      \`CREATE TABLE deliveries (
+        issue_id TEXT NOT NULL,
+        email TEXT NOT NULL,
+        status TEXT NOT NULL,
+        detail TEXT,
+        at TEXT NOT NULL,
+        PRIMARY KEY (issue_id, email)
+      )\`,
+    ],
+  },
+]
+
+/** Readers per queue message. Each message is sent in one go, one reader after another. */
+const CHUNK = 25
+/** A confirmation link works for a day. */
+const CONFIRM_TTL_MS = 24 * 60 * 60 * 1000
+/** A pending address gets another link at most this often, so the form cannot flood an inbox. */
+const RESEND_AFTER_MS = 10 * 60 * 1000
+
+export interface NewsletterMessage {
+  issueId: string
+  emails: string[]
+  /** The app's origin, for the unsubscribe links: a queue consumer has no request. */
+  origin: string
+}
+
+/** What sending needs of the NEWSLETTER queue binding. */
+export interface NewsletterQueue {
+  sendBatch(messages: Iterable<{ body: NewsletterMessage }>): Promise<void>
+}
+
+/** The slice of a Queue consumer's batch \`deliver\` reads. */
+export interface NewsletterBatch {
+  readonly messages: readonly { readonly body: unknown }[]
+}
+
+export interface NewsletterEnv {
+  DB: Database
+  ROOMS: RoomNamespace<unknown>
+  NEWSLETTER: NewsletterQueue
+  /** Set in wrangler.jsonc: the SES region, the From address, the SNS topic for feedback. */
+  AWS_REGION: string
+  NEWSLETTER_FROM: string
+  SNS_TOPIC_ARN: string
+  /** Secrets: \`wrangler secret put\` (.dev.vars locally). Unset until you add them. */
+  AWS_ACCESS_KEY_ID?: string
+  AWS_SECRET_ACCESS_KEY?: string
+  NEWSLETTER_KEY?: string
+}
+
+const encoder = new TextEncoder()
+
+const cell = (raw: unknown, key: string): unknown =>
+  typeof raw === 'object' && raw !== null ? Reflect.get(raw, key) : undefined
+
+/** A string column of a D1 row. Rows are read like any payload: checked, not cast. */
+function column(raw: unknown, key: string): string {
+  const value = cell(raw, key)
+  if (typeof value !== 'string') throw new Error(\`Expected a string in column \${key}\`)
+  return value
+}
+
+async function sha256(value: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(value))
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+/** 32 random bytes, URL-safe: a confirmation or unsubscribe token. */
+function token(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(32))
+  return btoa(String.fromCharCode(...bytes))
+    .replace(/\\+/g, '-')
+    .replace(/\\//g, '_')
+    .replace(/=+$/, '')
+}
+
+/** Refuses a request without NEWSLETTER_KEY. Compares digests, so timing says nothing. */
+async function requireKey(env: NewsletterEnv, key: string): Promise<void> {
+  if (!env.NEWSLETTER_KEY) throw new HttpError(503, 'Set NEWSLETTER_KEY (README)')
+  if ((await sha256(key)) !== (await sha256(env.NEWSLETTER_KEY))) {
+    throw new HttpError(403, 'Wrong newsletter key')
+  }
+}
+
+type Send = (
+  to: string,
+  message: RenderResult,
+  headers?: Record<string, string>,
+) => Promise<'sent' | 'logged'>
+
+/**
+ * Sends one email through SES, or, in \`vite dev\` without AWS credentials, logs it instead.
+ * Deployed without them, it refuses with what to set. The SES client is an \`EmailSender\`, so
+ * \`sendEmail\` checks the message (subject, preheader, text part, size) and every header first.
+ */
+function mailer(env: NewsletterEnv): Send {
+  const configured =
+    env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY && env.AWS_REGION && env.NEWSLETTER_FROM
+  if (!configured) {
+    if (!import.meta.env.DEV) {
+      throw new HttpError(
+        503,
+        'Set AWS_REGION and NEWSLETTER_FROM in wrangler.jsonc, and the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY secrets (README)',
+      )
+    }
+    return async (to, message) => {
+      console.log(\`[newsletter] not sent (no SES credentials) to \${to}: "\${message.subject}"\`)
+      return 'logged'
+    }
+  }
+  const ses = createSes({
+    region: env.AWS_REGION,
+    accessKeyId: env.AWS_ACCESS_KEY_ID!,
+    secretAccessKey: env.AWS_SECRET_ACCESS_KEY!,
+  })
+  return async (to, message, headers) => {
+    await sendEmail(ses, message, {
+      from: env.NEWSLETTER_FROM,
+      to,
+      ...(headers ? { headers } : {}),
+    })
+    return 'sent'
+  }
+}
+
+/**
+ * Signs someone up: a pending subscriber and a confirmation email. The answer is the same
+ * whoever asks, so the form does not tell strangers who is on the list. \`vite dev\` without
+ * SES also returns the confirmation link, to open instead of an email.
+ */
+export async function subscribe(
+  env: NewsletterEnv,
+  rawEmail: string,
+  origin: string,
+): Promise<{ devLink: string | null }> {
+  const email = normalizeEmail(rawEmail)
+  const send = mailer(env)
+  await migrate(env.DB, migrations)
+  const confirm = token()
+  const now = new Date()
+  const expires = now.getTime() + CONFIRM_TTL_MS
+  // A new or unsubscribed address gets a link; a pending one gets a fresh link at most every
+  // ten minutes. A subscribed or suppressed one is left alone, and nothing is sent.
+  const [row] = await queryRows(
+    env.DB,
+    \`INSERT INTO subscribers
+       (email, status, confirm_hash, confirm_expires, unsubscribe_token, created_at)
+     VALUES (?, 'pending', ?, ?, ?, ?)
+     ON CONFLICT (email) DO UPDATE SET
+       status = 'pending', reason = NULL,
+       confirm_hash = excluded.confirm_hash, confirm_expires = excluded.confirm_expires
+     WHERE subscribers.status = 'unsubscribed'
+       OR (subscribers.status = 'pending' AND subscribers.confirm_expires < ?)
+     RETURNING email\`,
+    [email, await sha256(confirm), expires, token(), now.toISOString(), expires - RESEND_AFTER_MS],
+    (raw) => column(raw, 'email'),
+  )
+  if (!row) return { devLink: null }
+  const link = \`\${origin}/newsletter/confirm?token=\${confirm}\`
+  const message = renderConfirmation(link)
+  let outcome: 'sent' | 'logged'
+  try {
+    outcome = await send(email, message)
+  } catch (error) {
+    if (!(error instanceof SesError)) throw error
+    console.error('[newsletter] confirmation not sent:', error.code, error.message)
+    // Let the reader try again at once rather than wait out the resend interval.
+    await queryRows(
+      env.DB,
+      "UPDATE subscribers SET confirm_expires = 0 WHERE email = ? AND status = 'pending' RETURNING email",
+      [email],
+      (raw) => raw,
+    )
+    throw new HttpError(502, 'Could not send the confirmation email. Try again in a moment.')
+  }
+  return { devLink: outcome === 'logged' ? link : null }
+}
+
+/** Opens a confirmation link: the subscriber is on the list from now on. */
+export async function confirm(env: NewsletterEnv, rawToken: string): Promise<{ email: string }> {
+  await migrate(env.DB, migrations)
+  const [row] = await queryRows(
+    env.DB,
+    \`UPDATE subscribers SET status = 'subscribed', confirm_hash = NULL, confirmed_at = ?
+     WHERE confirm_hash = ? AND confirm_expires > ? AND status = 'pending' RETURNING email\`,
+    [new Date().toISOString(), await sha256(rawToken), Date.now()],
+    (raw) => ({ email: column(raw, 'email') }),
+  )
+  if (!row) throw new HttpError(400, 'This link has expired or was used already. Sign up again.')
+  return row
+}
+
+/**
+ * \`POST /api/newsletter/unsubscribe?token=…\`: the page's button, and the one-click
+ * unsubscribe mail clients send (RFC 8058) from the List-Unsubscribe header. Always 200, so a
+ * token says nothing about who it belongs to, and a second click is not an error.
+ */
+export async function unsubscribe(request: Request, env: NewsletterEnv): Promise<Response> {
+  const unsubscribeToken = new URL(request.url).searchParams.get('token') ?? ''
+  await migrate(env.DB, migrations)
+  await queryRows(
+    env.DB,
+    \`UPDATE subscribers SET status = 'unsubscribed', reason = 'unsubscribed'
+     WHERE unsubscribe_token = ? AND status IN ('pending', 'subscribed') RETURNING email\`,
+    [unsubscribeToken],
+    (raw) => raw,
+  )
+  return Response.json({ unsubscribed: true })
+}
+
+const ISSUE_COLUMNS = \`issues.id, issues.subject, issues.created_at AS createdAt, issues.total,
+  (SELECT COUNT(*) FROM deliveries d WHERE d.issue_id = issues.id AND d.status != 'failed') AS sent,
+  (SELECT COUNT(*) FROM deliveries d WHERE d.issue_id = issues.id AND d.status = 'failed') AS failed\`
+
+async function readIssue(db: Database, id: string): Promise<Issue> {
+  const [issue] = await queryRows(
+    db,
+    \`SELECT \${ISSUE_COLUMNS} FROM issues WHERE id = ?\`,
+    [id],
+    parseIssue,
+  )
+  if (!issue) throw new HttpError(404, 'No such issue')
+  return issue
+}
+
+/** Subscriber counts and the last 20 issues, for the composer. */
+export async function overview(env: NewsletterEnv, key: string): Promise<Overview> {
+  await requireKey(env, key)
+  await migrate(env.DB, migrations)
+  const subscribers: SubscriberCounts = {
+    pending: 0,
+    subscribed: 0,
+    unsubscribed: 0,
+    suppressed: 0,
+  }
+  const counts = await queryRows(
+    env.DB,
+    'SELECT status, COUNT(*) AS n FROM subscribers GROUP BY status',
+    [],
+    (raw) => ({ status: column(raw, 'status'), n: Number(cell(raw, 'n')) }),
+  )
+  for (const { status, n } of counts) {
+    if (status === 'pending' || status === 'subscribed') subscribers[status] = n
+    if (status === 'unsubscribed' || status === 'suppressed') subscribers[status] = n
+  }
+  const issues = await queryRows(
+    env.DB,
+    \`SELECT \${ISSUE_COLUMNS} FROM issues ORDER BY created_at DESC LIMIT 20\`,
+    [],
+    parseIssue,
+  )
+  return { subscribers, issues }
+}
+
+/** The issue as readers will get it, for the composer's preview. */
+export async function preview(
+  env: NewsletterEnv,
+  input: IssueInput,
+  origin: string,
+): Promise<{ html: string; bytes: number }> {
+  await requireKey(env, input.key)
+  const { html, stats } = renderIssue(input.subject, input.body, origin)
+  return { html, bytes: stats.bytes }
+}
+
+/**
+ * Sends an issue to every confirmed subscriber: the issue is stored, and its readers go onto
+ * the NEWSLETTER queue in chunks, which \`deliver\` sends at the queue's pace.
+ */
+export async function sendIssue(
+  env: NewsletterEnv,
+  input: IssueInput,
+  origin: string,
+): Promise<Issue> {
+  await requireKey(env, input.key)
+  mailer(env) // Deployed without SES, refuse now rather than fail in the queue.
+  try {
+    // An issue too large to send (Gmail clips it) is refused here, not retried in the queue.
+    assertSendable(renderIssue(input.subject, input.body, origin))
+  } catch (error) {
+    throw new HttpError(400, error instanceof Error ? error.message : String(error))
+  }
+  await migrate(env.DB, migrations)
+  const readers = await queryRows(
+    env.DB,
+    "SELECT email FROM subscribers WHERE status = 'subscribed' ORDER BY email",
+    [],
+    (raw) => column(raw, 'email'),
+  )
+  const id = crypto.randomUUID()
+  await queryRows(
+    env.DB,
+    'INSERT INTO issues (id, subject, body, total, created_at) VALUES (?, ?, ?, ?, ?) RETURNING id',
+    [id, input.subject, input.body, readers.length, new Date().toISOString()],
+    (raw) => raw,
+  )
+  const messages: { body: NewsletterMessage }[] = []
+  for (let i = 0; i < readers.length; i += CHUNK) {
+    messages.push({ body: { issueId: id, emails: readers.slice(i, i + CHUNK), origin } })
+  }
+  // sendBatch takes at most 100 messages a call.
+  for (let i = 0; i < messages.length; i += 100) {
+    await env.NEWSLETTER.sendBatch(messages.slice(i, i + 100))
+  }
+  const issue = await readIssue(env.DB, id)
+  await writeRoom(env.ROOMS, issueRoom(id), 'issue', { ...issue })
+  return issue
+}
+
+function parseMessage(raw: unknown): NewsletterMessage {
+  if (typeof raw === 'object' && raw !== null) {
+    const { issueId, emails, origin } = raw as Record<string, unknown>
+    if (
+      typeof issueId === 'string' &&
+      ISSUE_ID.test(issueId) &&
+      Array.isArray(emails) &&
+      emails.every((e) => typeof e === 'string') &&
+      typeof origin === 'string'
+    ) {
+      return { issueId, emails: emails as string[], origin }
+    }
+  }
+  throw new Error('Malformed newsletter message')
+}
+
+/**
+ * The NEWSLETTER queue's consumer: sends each reader in the message their copy, with their
+ * own unsubscribe link and the one-click headers bulk senders need. A reader who left or was
+ * suppressed since the issue was queued is skipped. SES throttling or a server error throws,
+ * and the queue retries the message: whoever was sent already has a delivery row and is not
+ * sent again. A refusal for one address (an invalid one, say) is recorded and the rest go on.
+ */
+export async function deliver(env: NewsletterEnv, batch: NewsletterBatch): Promise<void> {
+  await migrate(env.DB, migrations)
+  const send = mailer(env)
+  for (const { body } of batch.messages) {
+    const { issueId, emails, origin } = parseMessage(body)
+    const [issue] = await queryRows(
+      env.DB,
+      'SELECT subject, body FROM issues WHERE id = ?',
+      [issueId],
+      (raw) => ({ subject: column(raw, 'subject'), body: column(raw, 'body') }),
+    )
+    if (!issue) continue
+    const rendered = renderIssue(issue.subject, issue.body, origin)
+    const placeholders = emails.map(() => '?').join(', ')
+    const readers = await queryRows(
+      env.DB,
+      \`SELECT s.email, s.unsubscribe_token AS token FROM subscribers s
+       WHERE s.email IN (\${placeholders}) AND s.status = 'subscribed'
+         AND NOT EXISTS (SELECT 1 FROM deliveries d WHERE d.issue_id = ? AND d.email = s.email)\`,
+      [...emails, issueId],
+      (raw) => ({ email: column(raw, 'email'), token: column(raw, 'token') }),
+    )
+    for (const { email, token: readerToken } of readers) {
+      const unsubscribe = \`\${origin}/api/newsletter/unsubscribe?token=\${readerToken}\`
+      let status: string
+      let detail: string | null = null
+      try {
+        status = await send(
+          email,
+          {
+            ...rendered,
+            html: rendered.html.replaceAll(TOKEN_SLOT, readerToken),
+            text: rendered.text.replaceAll(TOKEN_SLOT, readerToken),
+          },
+          {
+            'List-Unsubscribe': \`<\${unsubscribe}>\`,
+            'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click',
+          },
+        )
+      } catch (error) {
+        if (!(error instanceof SesError) || error.retryable) throw error
+        status = 'failed'
+        detail = \`\${error.code ?? error.status}: \${error.message}\`.slice(0, 300)
+      }
+      await queryRows(
+        env.DB,
+        \`INSERT INTO deliveries (issue_id, email, status, detail, at) VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT DO NOTHING RETURNING email\`,
+        [issueId, email, status, detail, new Date().toISOString()],
+        (raw) => raw,
+      )
+    }
+    const progress = await readIssue(env.DB, issueId)
+    await writeRoom(env.ROOMS, issueRoom(issueId), 'issue', { ...progress })
+  }
+}
+
+/**
+ * SES's feedback, delivered by SNS: a permanent bounce or a complaint suppresses the address
+ * for good. Sending to them again is what gets an SES account put under review.
+ */
+export async function receiveFeedback(request: Request, env: NewsletterEnv): Promise<Response> {
+  if (!env.SNS_TOPIC_ARN) throw new HttpError(503, 'Set SNS_TOPIC_ARN in wrangler.jsonc (README)')
+  return handleSns(request, {
+    topicArn: env.SNS_TOPIC_ARN,
+    onNotification: async ({ message }) => {
+      const event = parseSesNotification(message)
+      const suppress =
+        event.kind === 'complaint' || (event.kind === 'bounce' && event.bounceType === 'Permanent')
+      if (!suppress || event.recipients.length === 0) return
+      await migrate(env.DB, migrations)
+      // D1 binds at most 100 parameters; one bounce rarely names more than a few addresses.
+      const recipients = event.recipients
+        .slice(0, 90)
+        .map((address) => address.trim().toLowerCase())
+      await queryRows(
+        env.DB,
+        \`UPDATE subscribers SET status = 'suppressed', reason = ?
+         WHERE email IN (\${recipients.map(() => '?').join(', ')}) RETURNING email\`,
+        [event.kind, ...recipients],
+        (raw) => raw,
+      )
+    },
+  })
+}
+`}function Ot(){return`import { createClient } from '@cascivo/app/api'
+import {
+  Alert,
+  Button,
+  Card,
+  CardContent,
+  Flex,
+  Heading,
+  Input,
+  Link,
+  Text,
+  signal,
+  useSignals,
+} from '@cascivo/react'
+import type { FormEvent } from 'react'
+import { api } from '../api'
+
+const client = createClient(api)
+const sentTo = signal<string | null>(null)
+/** Set only in \`vite dev\` without SES: the confirmation link, to open instead of an email. */
+const devLink = signal<string | null>(null)
+const failure = signal<string | null>(null)
+const sending = signal(false)
+
+async function signUp(event: FormEvent<HTMLFormElement>): Promise<void> {
+  event.preventDefault()
+  const email = new FormData(event.currentTarget).get('email')
+  if (typeof email !== 'string') return
+  failure.value = null
+  sending.value = true
+  try {
+    const { devLink: link } = await client.subscribe({ body: { email } })
+    sentTo.value = email
+    devLink.value = link
+  } catch (error) {
+    failure.value = error instanceof Error ? error.message : 'Could not sign you up'
+  } finally {
+    sending.value = false
+  }
+}
+
+export default function Newsletter() {
+  useSignals()
+  return (
+    <Flex gap={4}>
+      <Flex gap={1}>
+        <Heading level={1}>Newsletter</Heading>
+        <Text muted>
+          An email now and then. We send a link first: you are on the list only once you open it,
+          and every issue has a one-click unsubscribe.
+        </Text>
+      </Flex>
+      <Card>
+        <CardContent>
+          <form onSubmit={(event) => void signUp(event)}>
+            <Flex direction="horizontal" align="end" gap={2} wrap>
+              <Input name="email" type="email" label="Email" autoComplete="email" required />
+              <Button type="submit" loading={sending.value}>
+                Subscribe
+              </Button>
+            </Flex>
+          </form>
+        </CardContent>
+      </Card>
+      {sentTo.value ? (
+        <Alert variant="success" title="Check your inbox">
+          If {sentTo.value} is not on the list yet, a confirmation link is on its way.
+        </Alert>
+      ) : null}
+      {devLink.value ? (
+        <Alert variant="info" title="vite dev sends no email without SES">
+          <Link href={devLink.value}>Open the confirmation link</Link>
+        </Alert>
+      ) : null}
+      {failure.value ? (
+        <Alert variant="destructive" title="Not signed up">
+          {failure.value}
+        </Alert>
+      ) : null}
+    </Flex>
+  )
+}
+`}function kt(){return`import { createClient } from '@cascivo/app/api'
+import { Alert, Button, Flex, Heading, Text, signal, useSignals } from '@cascivo/react'
+import { api } from '../../api'
+import { router } from '../../router'
+
+const client = createClient(api)
+const confirmed = signal<string | null>(null)
+const failure = signal<string | null>(null)
+const busy = signal(false)
+
+/**
+ * The page a confirmation link opens. It confirms only when you press the button: mail
+ * scanners open every link in a message, and would otherwise subscribe whoever was typed in.
+ */
+async function confirm(): Promise<void> {
+  const token = new URLSearchParams(router.search.value).get('token')
+  if (!token) {
+    failure.value = 'This link has no token. Sign up again.'
+    return
+  }
+  busy.value = true
+  failure.value = null
+  try {
+    confirmed.value = (await client.confirmSubscription({ body: { token } })).email
+  } catch (error) {
+    failure.value = error instanceof Error ? error.message : 'Could not confirm'
+  } finally {
+    busy.value = false
+  }
+}
+
+export default function ConfirmSubscription() {
+  useSignals()
+  return (
+    <Flex gap={4}>
+      <Heading level={1}>Confirm your subscription</Heading>
+      {confirmed.value ? (
+        <Alert variant="success" title="You are on the list">
+          The next issue goes to {confirmed.value}.
+        </Alert>
+      ) : (
+        <Flex gap={2}>
+          <Text muted>One click and you get the newsletter.</Text>
+          <Flex direction="horizontal">
+            <Button loading={busy.value} onClick={() => void confirm()}>
+              Yes, subscribe me
+            </Button>
+          </Flex>
+        </Flex>
+      )}
+      {failure.value ? (
+        <Alert variant="destructive" title="Not confirmed">
+          {failure.value}
+        </Alert>
+      ) : null}
+    </Flex>
+  )
+}
+`}function At(){return`import { Alert, Button, Flex, Heading, Text, signal, useSignals } from '@cascivo/react'
+import { router } from '../../router'
+
+const done = signal(false)
+const failure = signal<string | null>(null)
+const busy = signal(false)
+
+/**
+ * The footer link of every issue. Like the confirmation, it acts on a button press, never on
+ * opening the page. Mail clients that support one-click unsubscribe skip this page and POST
+ * to the same endpoint from the List-Unsubscribe header.
+ */
+async function unsubscribe(): Promise<void> {
+  const token = new URLSearchParams(router.search.value).get('token') ?? ''
+  busy.value = true
+  failure.value = null
+  try {
+    const response = await fetch(\`/api/newsletter/unsubscribe?token=\${encodeURIComponent(token)}\`, {
+      method: 'POST',
+    })
+    if (!response.ok) throw new Error(\`Request failed with status \${response.status}\`)
+    done.value = true
+  } catch (error) {
+    failure.value = error instanceof Error ? error.message : 'Could not unsubscribe'
+  } finally {
+    busy.value = false
+  }
+}
+
+export default function Unsubscribe() {
+  useSignals()
+  return (
+    <Flex gap={4}>
+      <Heading level={1}>Unsubscribe</Heading>
+      {done.value ? (
+        <Alert variant="success" title="You are unsubscribed">
+          You will get no more issues. Sign up again any time.
+        </Alert>
+      ) : (
+        <Flex gap={2}>
+          <Text muted>Stop getting the newsletter at this address.</Text>
+          <Flex direction="horizontal">
+            <Button variant="destructive" loading={busy.value} onClick={() => void unsubscribe()}>
+              Unsubscribe
+            </Button>
+          </Flex>
+        </Flex>
+      )}
+      {failure.value ? (
+        <Alert variant="destructive" title="Not unsubscribed">
+          {failure.value}
+        </Alert>
+      ) : null}
+    </Flex>
+  )
+}
+`}function jt(){return`import { createClient } from '@cascivo/app/api'
+import { connectRoom } from '@cascivo/app/sync'
+import {
+  Alert,
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  EmptyState,
+  Flex,
+  Heading,
+  Input,
+  Text,
+  Textarea,
+  signal,
+  useSignals,
+} from '@cascivo/react'
+import type { MouseEvent } from 'react'
+import { api } from '../../api'
+import { MAX_BODY, MAX_SUBJECT, parseIssue } from '../../newsletter'
+import type { Issue, Overview } from '../../newsletter'
+
+const client = createClient(api)
+const overview = signal<Overview | null>(null)
+const previewHtml = signal<string | null>(null)
+const busy = signal<'load' | 'preview' | 'send' | null>(null)
+const failure = signal<string | null>(null)
+const notice = signal<string | null>(null)
+
+/** The composer's fields, read from the form the clicked button belongs to. */
+function fields(event: MouseEvent<HTMLButtonElement>) {
+  const form = event.currentTarget.form
+  const data = form ? new FormData(form) : new FormData()
+  const read = (name: string) => {
+    const value = data.get(name)
+    return typeof value === 'string' ? value : ''
+  }
+  return { key: read('key'), subject: read('subject'), body: read('body') }
+}
+
+async function run(kind: 'load' | 'preview' | 'send', task: () => Promise<void>): Promise<void> {
+  busy.value = kind
+  failure.value = null
+  notice.value = null
+  try {
+    await task()
+  } catch (error) {
+    failure.value = error instanceof Error ? error.message : 'Something went wrong'
+  } finally {
+    busy.value = null
+  }
+}
+
+/** Shows an issue's progress as the Worker pushes it, until every reader has had their copy. */
+function watch(issue: Issue): void {
+  const room = connectRoom(\`/api/newsletter/issues/\${issue.id}/live\`)
+  const pushed = room.signal<Issue | null>('issue', null, (raw) =>
+    raw === null ? null : parseIssue(raw),
+  )
+  const stop = pushed.signal.subscribe((latest) => {
+    const current = overview.peek()
+    if (!latest || !current) return
+    overview.value = {
+      ...current,
+      issues: current.issues.map((i) => (i.id === latest.id ? latest : i)),
+    }
+    if (latest.sent + latest.failed >= latest.total) {
+      stop()
+      room.close()
+    }
+  })
+}
+
+function load(event: MouseEvent<HTMLButtonElement>): void {
+  const { key } = fields(event)
+  void run('load', async () => {
+    overview.value = await client.newsletterOverview({ body: { key } })
+  })
+}
+
+function preview(event: MouseEvent<HTMLButtonElement>): void {
+  const input = fields(event)
+  void run('preview', async () => {
+    previewHtml.value = (await client.previewIssue({ body: input })).html
+  })
+}
+
+function send(event: MouseEvent<HTMLButtonElement>): void {
+  const input = fields(event)
+  const readers = overview.value?.subscribers.subscribed ?? 0
+  if (!window.confirm(\`Send "\${input.subject}" to \${readers} subscribers?\`)) return
+  void run('send', async () => {
+    const issue = await client.sendIssue({ body: input })
+    overview.value = await client.newsletterOverview({ body: { key: input.key } })
+    notice.value = \`Queued for \${issue.total} subscribers.\`
+    watch(issue)
+  })
+}
+
+export default function SendNewsletter() {
+  useSignals()
+  const counts = overview.value?.subscribers
+  return (
+    <Flex gap={4}>
+      <Flex gap={1}>
+        <Heading level={1}>Send the newsletter</Heading>
+        <Text muted>
+          Written in Markdown, rendered with @cascivo/email, sent through Amazon SES to every
+          confirmed subscriber. Only someone with NEWSLETTER_KEY can send.
+        </Text>
+      </Flex>
+      <form onSubmit={(event) => event.preventDefault()}>
+        <Flex gap={3}>
+          <Flex direction="horizontal" align="end" gap={2} wrap>
+            <Input name="key" type="password" label="Newsletter key" autoComplete="off" required />
+            <Button variant="secondary" loading={busy.value === 'load'} onClick={load}>
+              Show subscribers
+            </Button>
+          </Flex>
+          <Input name="subject" label="Subject" maxLength={MAX_SUBJECT} required />
+          <Textarea
+            name="body"
+            label="Body"
+            hint="Markdown: headings, **bold**, links, lists, quotes and images."
+            rows={12}
+            maxLength={MAX_BODY}
+            required
+          />
+          <Flex direction="horizontal" gap={2} wrap>
+            <Button variant="secondary" loading={busy.value === 'preview'} onClick={preview}>
+              Preview
+            </Button>
+            <Button loading={busy.value === 'send'} disabled={!counts} onClick={send}>
+              Send to {counts ? counts.subscribed : '…'} subscribers
+            </Button>
+          </Flex>
+        </Flex>
+      </form>
+      {failure.value ? (
+        <Alert variant="destructive" title="Not done">
+          {failure.value}
+        </Alert>
+      ) : null}
+      {notice.value ? (
+        <Alert variant="success" title="Sending">
+          {notice.value}
+        </Alert>
+      ) : null}
+      {previewHtml.value ? (
+        <Card>
+          <CardContent>
+            {/* sandbox: the preview runs no script and cannot reach this page. */}
+            <iframe
+              title="Preview"
+              sandbox=""
+              srcDoc={previewHtml.value}
+              width="100%"
+              height="640"
+            />
+          </CardContent>
+        </Card>
+      ) : null}
+      {counts ? (
+        <Flex direction="horizontal" gap={2} wrap>
+          <Badge variant="success">{counts.subscribed} subscribed</Badge>
+          <Badge variant="warning">{counts.pending} not confirmed</Badge>
+          <Badge variant="secondary">{counts.unsubscribed} unsubscribed</Badge>
+          <Badge variant="destructive">{counts.suppressed} suppressed</Badge>
+        </Flex>
+      ) : null}
+      {overview.value && overview.value.issues.length === 0 ? (
+        <EmptyState title="No issues yet" description="Write one above and send it." />
+      ) : null}
+      {overview.value && overview.value.issues.length > 0 ? (
+        <Flex gap={2} role="list" aria-label="Issues">
+          {overview.value.issues.map((issue) => (
+            <Flex key={issue.id} role="listitem" direction="horizontal" align="center" gap={2} wrap>
+              <Badge variant={issue.sent + issue.failed >= issue.total ? 'success' : 'warning'}>
+                {issue.sent}/{issue.total} sent
+              </Badge>
+              {issue.failed > 0 ? <Badge variant="destructive">{issue.failed} failed</Badge> : null}
+              <Text>{issue.subject}</Text>
+              <Text size="sm" muted>
+                {new Date(issue.createdAt).toLocaleString()}
+              </Text>
+            </Flex>
+          ))}
+        </Flex>
+      ) : null}
+    </Flex>
+  )
+}
+`}function Mt(){return`/**
+ * The subscription plan /billing sells, shared by the Worker (worker/billing.ts) and the page.
+ * A subscription belongs to a signed-in user, so this exists only with --auth email.
+ */
+
+/** The plan. The Worker sends this to Stripe; the page only displays it. */
+export const PLAN = {
+  name: 'Pro',
+  description: 'Everything in the app, billed monthly. Cancel any time from the billing portal.',
+  /** In the currency's smallest unit, per interval: 900 is €9.00. */
+  amount: 900,
+  currency: 'eur',
+  interval: 'month' as const,
+}
+
+/** \`none\` before the first subscription; otherwise Stripe's subscription status. */
+export type BillingStatus =
+  | 'none'
+  | 'incomplete'
+  | 'incomplete_expired'
+  | 'trialing'
+  | 'active'
+  | 'past_due'
+  | 'canceled'
+  | 'unpaid'
+  | 'paused'
+
+const STATUSES: readonly BillingStatus[] = [
+  'none',
+  'incomplete',
+  'incomplete_expired',
+  'trialing',
+  'active',
+  'past_due',
+  'canceled',
+  'unpaid',
+  'paused',
+]
+
+export interface Billing {
+  status: BillingStatus
+  /**
+   * Whether the plan's features are on: the subscription is active or trialing, or past due
+   * while Stripe retries the renewal (\`isEntitled\` from @cascivo/app/stripe, in the Worker).
+   */
+  active: boolean
+  /** When the current period ends: the next charge, or the end of a cancelled plan. */
+  currentPeriodEnd: string | null
+  /** Cancelled, but running until currentPeriodEnd. */
+  cancelAtPeriodEnd: boolean
+  /** Has a Stripe customer, so the billing portal can open. */
+  canManage: boolean
+}
+
+export function parseBilling(raw: unknown): Billing {
+  if (typeof raw === 'object' && raw !== null) {
+    const { status, active, currentPeriodEnd, cancelAtPeriodEnd, canManage } = raw as Record<
+      string,
+      unknown
+    >
+    const known = STATUSES.find((s) => s === status)
+    if (
+      known &&
+      typeof active === 'boolean' &&
+      (currentPeriodEnd === null || typeof currentPeriodEnd === 'string') &&
+      typeof cancelAtPeriodEnd === 'boolean' &&
+      typeof canManage === 'boolean'
+    ) {
+      return { status: known, active, currentPeriodEnd, cancelAtPeriodEnd, canManage }
+    }
+  }
+  throw new Error('Malformed billing')
+}
+
+/** Where to send the browser next: Stripe's checkout or its billing portal. */
+export function parseRedirect(raw: unknown): { url: string } {
+  if (typeof raw === 'object' && raw !== null) {
+    const { url } = raw as Record<string, unknown>
+    if (typeof url === 'string' && url.startsWith('https://')) return { url }
+  }
+  throw new Error('Malformed redirect')
+}
+
+export function parseSyncInput(raw: unknown): { sessionId: string } {
+  if (typeof raw === 'object' && raw !== null) {
+    const { sessionId } = raw as Record<string, unknown>
+    if (typeof sessionId === 'string' && /^cs_[\\w]{1,250}$/.test(sessionId)) return { sessionId }
+  }
+  throw new Error('Expected { sessionId }: a Checkout Session id')
+}
+`}function Nt(){return`import { HttpError } from '@cascivo/app/api'
+import { requireUser } from '@cascivo/app/auth-server'
+import { migrate, queryRows } from '@cascivo/app/db'
+import type { Database } from '@cascivo/app/db'
+import { isEntitled, requireEntitlement } from '@cascivo/app/stripe'
+import type { Invoice, Subscription } from '@cascivo/app/stripe'
+import {
+  Body,
+  Button,
+  Container,
+  Head,
+  Heading,
+  Html,
+  Preview,
+  Section,
+  Text,
+  renderEmail,
+} from '@cascivo/email'
+import { createElement as h } from 'react'
+import { PLAN, parseBilling } from '../src/billing'
+import type { Billing } from '../src/billing'
+import { SHOP_NAME, formatPrice } from '../src/checkout'
+import { refused, stripeOf } from './checkout'
+import type { BillingHooks, ReceiptSender } from './checkout'
+
+const migrations = [
+  {
+    id: '0001_billing',
+    statements: [
+      \`CREATE TABLE billing (
+        user_id TEXT PRIMARY KEY,
+        customer_id TEXT,
+        subscription_id TEXT,
+        status TEXT NOT NULL,
+        current_period_end INTEGER,
+        cancel_at_period_end INTEGER NOT NULL DEFAULT 0,
+        updated_at TEXT NOT NULL,
+        reminded TEXT
+      )\`,
+    ],
+  },
+]
+
+export interface BillingEnv {
+  DB: Database
+  EMAIL: ReceiptSender
+  RECEIPT_FROM: string
+  STRIPE_SECRET_KEY?: string
+}
+
+interface Row {
+  status: string
+  customerId: string | null
+  currentPeriodEnd: number | null
+  cancelAtPeriodEnd: number
+}
+
+const cell = (raw: unknown, key: string): unknown =>
+  typeof raw === 'object' && raw !== null ? Reflect.get(raw, key) : undefined
+
+function parseRow(raw: unknown): Row {
+  const status = cell(raw, 'status')
+  const customerId = cell(raw, 'customerId')
+  const end = cell(raw, 'currentPeriodEnd')
+  if (typeof status !== 'string') throw new Error('Malformed billing row')
+  return {
+    status,
+    customerId: typeof customerId === 'string' ? customerId : null,
+    currentPeriodEnd: typeof end === 'number' ? end : null,
+    cancelAtPeriodEnd: Number(cell(raw, 'cancelAtPeriodEnd')),
+  }
+}
+
+async function readRow(db: Database, userId: string): Promise<Row | null> {
+  await migrate(db, migrations)
+  const [row] = await queryRows(
+    db,
+    \`SELECT status, customer_id AS customerId, current_period_end AS currentPeriodEnd,
+       cancel_at_period_end AS cancelAtPeriodEnd FROM billing WHERE user_id = ?\`,
+    [userId],
+    parseRow,
+  )
+  return row ?? null
+}
+
+/** A stored row as the page sees it; the status is checked against the known ones. */
+function toBilling(row: Row | null): Billing {
+  const billing = parseBilling({
+    status: row?.status ?? 'none',
+    active: false,
+    currentPeriodEnd:
+      row?.currentPeriodEnd != null ? new Date(row.currentPeriodEnd * 1000).toISOString() : null,
+    cancelAtPeriodEnd: row?.cancelAtPeriodEnd === 1,
+    canManage: row?.customerId != null,
+  })
+  return { ...billing, active: isEntitled(billing.status) }
+}
+
+/**
+ * Stores a subscription's current state for the user its metadata names. The metadata is set
+ * by startSubscription, server side: a subscription made any other way (a Payment Link, the
+ * dashboard) names no user here and is ignored. A different subscription replaces the stored
+ * one only when that one is over, so a late event about an old plan cannot end a new one.
+ */
+async function store(db: Database, subscription: Subscription): Promise<void> {
+  const userId = subscription.metadata['user']
+  if (!userId) return
+  await migrate(db, migrations)
+  await queryRows(
+    db,
+    \`INSERT INTO billing
+       (user_id, customer_id, subscription_id, status, current_period_end, cancel_at_period_end, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT (user_id) DO UPDATE SET
+       customer_id = excluded.customer_id, subscription_id = excluded.subscription_id,
+       status = excluded.status, current_period_end = excluded.current_period_end,
+       cancel_at_period_end = excluded.cancel_at_period_end, updated_at = excluded.updated_at
+     WHERE billing.subscription_id IS excluded.subscription_id
+       OR billing.status NOT IN ('active', 'trialing', 'past_due')
+     RETURNING user_id\`,
+    [
+      userId,
+      subscription.customerId,
+      subscription.id,
+      subscription.status,
+      subscription.currentPeriodEnd,
+      subscription.cancelAtPeriodEnd ? 1 : 0,
+      new Date().toISOString(),
+    ],
+    (raw) => raw,
+  )
+}
+
+/**
+ * The webhook's part (worker/checkout.ts passes subscription events here). The event's copy
+ * may be stale, since events arrive out of order: the subscription is read back from Stripe.
+ */
+export async function syncSubscription(env: BillingEnv, subscriptionId: string): Promise<void> {
+  await store(env.DB, await stripeOf(env).retrieveSubscription(subscriptionId))
+}
+
+/** The signed-in user's plan. */
+export async function getBilling(env: BillingEnv, request: Request): Promise<Billing> {
+  const user = await requireUser(env.DB, request)
+  return toBilling(await readRow(env.DB, user.id))
+}
+
+/**
+ * Refuses a user whose plan is not on: 401 signed out, 402 without the plan. Call it in the
+ * Worker before serving a paid feature, never trusting what the page shows.
+ */
+export async function requirePlan(env: BillingEnv, request: Request): Promise<void> {
+  const user = await requireUser(env.DB, request)
+  requireEntitlement((await readRow(env.DB, user.id))?.status)
+}
+
+/** The email for a renewal that could not be charged, with where to pay it. */
+function renderPaymentFailed(invoice: Invoice, payHref: string) {
+  const subject = \`Your \${PLAN.name} payment did not go through\`
+  const amount = formatPrice(invoice.amountDue, invoice.currency)
+  return renderEmail(
+    h(
+      Html,
+      null,
+      h(Head, { title: subject }),
+      h(
+        Body,
+        null,
+        h(Preview, null, \`We could not charge \${amount}. Update your card to keep \${PLAN.name}.\`),
+        h(
+          Container,
+          null,
+          h(
+            Section,
+            { padding: 32 },
+            h(Heading, { level: 1 }, 'Your payment did not go through'),
+            h(
+              Text,
+              null,
+              \`We could not charge \${amount} for \${SHOP_NAME} \${PLAN.name}. Your plan stays on while we try again; pay with another card to keep it.\`,
+            ),
+            h(Button, { href: payHref }, 'Update payment'),
+          ),
+        ),
+      ),
+    ),
+    { subject },
+  )
+}
+
+/**
+ * A renewal Stripe could not charge (\`invoice.payment_failed\`). The customer hears about it
+ * once per attempt, with Stripe's page for paying the invoice with another card. The plan stays
+ * on while Stripe retries (\`past_due\`); the Stripe dashboard's failed-payment settings decide
+ * when it ends. Only customers this app bills are written to: a retried event, or an invoice
+ * for something else on the same Stripe account, sends nothing.
+ */
+export async function remindPayment(
+  env: BillingEnv,
+  invoice: Invoice,
+  origin: string,
+): Promise<void> {
+  if (!invoice.customerId || !invoice.customerEmail) return
+  await migrate(env.DB, migrations)
+  const attempt = \`\${invoice.id}:\${invoice.attemptCount}\`
+  const [row] = await queryRows(
+    env.DB,
+    'UPDATE billing SET reminded = ? WHERE customer_id = ? AND reminded IS NOT ? RETURNING user_id',
+    [attempt, invoice.customerId, attempt],
+    (raw) => raw,
+  )
+  if (!row) return
+  const message = renderPaymentFailed(invoice, invoice.hostedInvoiceUrl ?? \`\${origin}/billing\`)
+  if (import.meta.env.DEV) {
+    console.log(\`[billing] payment reminder for \${invoice.customerEmail}: "\${message.subject}"\`)
+    return
+  }
+  if (!env.RECEIPT_FROM) {
+    console.warn('[billing] no payment reminder sent: set RECEIPT_FROM in wrangler.jsonc')
+    return
+  }
+  try {
+    await env.EMAIL.send({
+      from: env.RECEIPT_FROM,
+      to: invoice.customerEmail,
+      subject: message.subject,
+      text: message.text,
+      html: message.html,
+    })
+  } catch (error) {
+    // Logged, not thrown: Stripe retrying the event would not send it again.
+    console.error('[billing] payment reminder not sent:', error)
+  }
+}
+
+/** What the Stripe webhook (worker/checkout.ts) hands over to billing. */
+export function billingHooks(env: BillingEnv): BillingHooks {
+  return {
+    subscription: (id) => syncSubscription(env, id),
+    paymentFailed: (invoice, origin) => remindPayment(env, invoice, origin),
+  }
+}
+
+/** Opens a subscription checkout for PLAN, naming the user in the subscription's metadata. */
+export async function startSubscription(
+  env: BillingEnv,
+  request: Request,
+  origin: string,
+): Promise<{ url: string }> {
+  const user = await requireUser(env.DB, request)
+  const row = await readRow(env.DB, user.id)
+  if (row && toBilling(row).active) {
+    throw new HttpError(409, 'You already have the plan. Manage it in the billing portal.')
+  }
+  const stripe = stripeOf(env)
+  try {
+    const session = await stripe.createCheckoutSession({
+      mode: 'subscription',
+      lineItems: [{ ...PLAN, quantity: 1 }],
+      // Stripe fills in {CHECKOUT_SESSION_ID}, so the page can sync before any webhook.
+      successUrl: \`\${origin}/billing?session={CHECKOUT_SESSION_ID}\`,
+      cancelUrl: \`\${origin}/billing\`,
+      ...(row?.customerId ? { customer: row.customerId } : { customerEmail: user.email }),
+      clientReferenceId: user.id,
+      subscriptionMetadata: { user: user.id },
+    })
+    if (!session.url) throw new HttpError(502, 'Stripe returned no checkout page')
+    return { url: session.url }
+  } catch (error) {
+    if (error instanceof HttpError) throw error
+    refused(error)
+  }
+}
+
+/**
+ * Back from Stripe's checkout: reads the session and its subscription, so the page is right
+ * before the webhook arrives (or in \`vite dev\` without \`stripe listen\`). Only the user the
+ * subscription names can sync it.
+ */
+export async function syncBilling(
+  env: BillingEnv,
+  request: Request,
+  sessionId: string,
+): Promise<Billing> {
+  const user = await requireUser(env.DB, request)
+  const stripe = stripeOf(env)
+  try {
+    const session = await stripe.retrieveCheckoutSession(sessionId)
+    if (session.mode === 'subscription' && session.subscriptionId) {
+      const subscription = await stripe.retrieveSubscription(session.subscriptionId)
+      if (subscription.metadata['user'] !== user.id) {
+        throw new HttpError(403, 'This checkout belongs to another account')
+      }
+      await store(env.DB, subscription)
+    }
+  } catch (error) {
+    if (error instanceof HttpError) throw error
+    refused(error)
+  }
+  return toBilling(await readRow(env.DB, user.id))
+}
+
+/** Opens Stripe's Customer Portal: plan, card, invoices and cancellation, all hosted. */
+export async function openPortal(
+  env: BillingEnv,
+  request: Request,
+  origin: string,
+): Promise<{ url: string }> {
+  const user = await requireUser(env.DB, request)
+  const row = await readRow(env.DB, user.id)
+  if (!row?.customerId) throw new HttpError(409, 'Subscribe first: there is nothing to manage yet')
+  try {
+    return await stripeOf(env).createPortalSession({
+      customer: row.customerId,
+      returnUrl: \`\${origin}/billing\`,
+    })
+  } catch (error) {
+    refused(error)
+  }
+}
+`}function Pt(){return`import { createClient } from '@cascivo/app/api'
+import {
+  Alert,
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  Flex,
+  Heading,
+  Link,
+  Spinner,
+  Text,
+  signal,
+  useSignalEffect,
+  useSignals,
+} from '@cascivo/react'
+import { api } from '../api'
+import { auth } from '../auth'
+import { PLAN } from '../billing'
+import type { Billing, BillingStatus } from '../billing'
+import { formatPrice } from '../checkout'
+import { router } from '../router'
+
+const client = createClient(api)
+const billing = signal<Billing | null>(null)
+const busy = signal<'subscribe' | 'portal' | null>(null)
+const failure = signal<string | null>(null)
+
+/**
+ * Loads the plan. Back from Stripe's checkout, the URL carries the session id: syncing it
+ * shows the new subscription at once, before the webhook. Then the id leaves the URL.
+ */
+async function load(): Promise<void> {
+  failure.value = null
+  try {
+    const sessionId = new URLSearchParams(router.search.peek()).get('session')
+    if (sessionId) {
+      billing.value = await client.syncBilling({ body: { sessionId } })
+      router.navigate('/billing', { replace: true })
+    } else {
+      billing.value = await client.getBilling()
+    }
+  } catch (error) {
+    failure.value = error instanceof Error ? error.message : 'Could not load billing'
+  }
+}
+
+/** Both buttons leave for a Stripe page: checkout, or the billing portal. */
+async function leaveFor(kind: 'subscribe' | 'portal'): Promise<void> {
+  busy.value = kind
+  failure.value = null
+  try {
+    const { url } =
+      kind === 'subscribe' ? await client.startSubscription() : await client.openBillingPortal()
+    location.assign(url)
+  } catch (error) {
+    failure.value = error instanceof Error ? error.message : 'Stripe did not open'
+    busy.value = null
+  }
+}
+
+const LABEL: Record<BillingStatus, string> = {
+  none: 'No plan',
+  incomplete: 'Payment pending',
+  incomplete_expired: 'Payment expired',
+  trialing: 'Trial',
+  active: 'Active',
+  past_due: 'Payment failed: retrying',
+  canceled: 'Cancelled',
+  unpaid: 'Unpaid',
+  paused: 'Paused',
+}
+
+export default function BillingPage() {
+  useSignals()
+  useSignalEffect(() => {
+    if (auth.user.value) void load()
+  })
+  const user = auth.user.value
+  const plan = billing.value
+
+  if (user === undefined) return <Spinner label="Loading" />
+  if (user === null) {
+    return (
+      <Flex gap={4}>
+        <Heading level={1}>Billing</Heading>
+        <Text>
+          <Link href="/account">Sign in</Link> to subscribe: a plan belongs to your account.
+        </Text>
+      </Flex>
+    )
+  }
+  return (
+    <Flex gap={4}>
+      <Flex gap={1}>
+        <Heading level={1}>Billing</Heading>
+        <Text muted>
+          Paid on Stripe's hosted checkout; changed, paused or cancelled in Stripe's billing portal.
+          The Worker keeps your plan in step through Stripe's webhook.
+        </Text>
+      </Flex>
+      <Card>
+        <CardContent>
+          <Flex gap={3}>
+            <Flex direction="horizontal" align="center" gap={2} wrap>
+              <Heading level={2}>{PLAN.name}</Heading>
+              {plan ? (
+                <Badge variant={plan.active ? 'success' : 'secondary'}>{LABEL[plan.status]}</Badge>
+              ) : null}
+            </Flex>
+            <Text muted>{PLAN.description}</Text>
+            <Text size="lg">
+              {formatPrice(PLAN.amount, PLAN.currency)} a {PLAN.interval}
+            </Text>
+            {plan?.currentPeriodEnd ? (
+              <Text size="sm" muted>
+                {plan.cancelAtPeriodEnd ? 'Ends' : 'Renews'} on{' '}
+                {new Date(plan.currentPeriodEnd).toLocaleDateString()}
+              </Text>
+            ) : null}
+            <Flex direction="horizontal" gap={2} wrap>
+              {plan && !plan.active ? (
+                <Button
+                  loading={busy.value === 'subscribe'}
+                  onClick={() => void leaveFor('subscribe')}
+                >
+                  Subscribe
+                </Button>
+              ) : null}
+              {plan?.canManage ? (
+                <Button
+                  variant="secondary"
+                  loading={busy.value === 'portal'}
+                  onClick={() => void leaveFor('portal')}
+                >
+                  Manage billing
+                </Button>
+              ) : null}
+            </Flex>
+          </Flex>
+        </CardContent>
+      </Card>
+      {failure.value ? (
+        <Alert variant="destructive" title="Not done">
+          {failure.value}
+        </Alert>
+      ) : null}
+    </Flex>
+  )
+}
+`}function Ft(){return"import { createAuth } from '@cascivo/app/auth'\n\n/**\n * Who is signed in, shared by every page: `auth.user.value` is `undefined` while the first\n * check runs, then the user or `null`. The Worker side is `handleAuth` in worker/index.ts.\n */\nexport const auth = createAuth()\n"}function It(){return`/** What sending a sign-in link needs of the Email Service binding (\`send_email\`). */
+export interface SignInSender {
+  send(message: {
+    from: string
+    to: string
+    subject: string
+    text: string
+    html: string
+  }): Promise<unknown>
+}
+
+const escape = (value: string) =>
+  value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
+
+/**
+ * Emails a sign-in link. \`vite dev\` sends nothing: the link is logged, and the Account page
+ * shows it (\`exposeLink\` in worker/index.ts).
+ */
+export async function sendSignInLink(
+  sender: SignInSender,
+  from: string,
+  email: string,
+  url: string,
+): Promise<void> {
+  if (import.meta.env.DEV) {
+    console.log(\`[auth] sign-in link for \${email}: \${url}\`)
+    return
+  }
+  if (!from) throw new Error('Set AUTH_FROM in wrangler.jsonc to an address on your domain')
+  await sender.send({
+    from,
+    to: email,
+    subject: 'Your sign-in link',
+    text: \`Sign in: \${url}\\n\\nThe link works once, for 15 minutes. If you did not ask for it, ignore this email.\`,
+    html: \`<p><a href="\${escape(url)}">Sign in</a></p><p>The link works once, for 15 minutes. If you did not ask for it, ignore this email.</p>\`,
+  })
+}
+`}function Lt(){return`import {
+  Alert,
+  Button,
+  Card,
+  CardContent,
+  Flex,
+  Heading,
+  Input,
+  Link,
+  Spinner,
+  Text,
+  signal,
+  useSignals,
+} from '@cascivo/react'
+import type { FormEvent } from 'react'
+import { auth } from '../auth'
+
+const sentTo = signal<string | null>(null)
+/** Set only in \`vite dev\`, where no email is sent: the link to open instead. */
+const devLink = signal<string | null>(null)
+const failure = signal<string | null>(null)
+const sending = signal(false)
+
+async function start(event: FormEvent<HTMLFormElement>): Promise<void> {
+  event.preventDefault()
+  const email = new FormData(event.currentTarget).get('email')
+  if (typeof email !== 'string') return
+  failure.value = null
+  sending.value = true
+  try {
+    const { link } = await auth.start(email)
+    sentTo.value = email
+    devLink.value = link
+  } catch (error) {
+    failure.value = error instanceof Error ? error.message : 'Could not send the link'
+  } finally {
+    sending.value = false
+  }
+}
+
+export default function Account() {
+  useSignals()
+  const user = auth.user.value
+
+  if (user === undefined) return <Spinner label="Loading" />
+  if (user) {
+    return (
+      <Flex gap={4}>
+        <Heading level={1}>Account</Heading>
+        <Card>
+          <CardContent>
+            <Flex gap={3}>
+              <Text>Signed in as {user.email}</Text>
+              <Flex direction="horizontal">
+                <Button variant="secondary" onClick={() => void auth.signOut()}>
+                  Sign out
+                </Button>
+              </Flex>
+            </Flex>
+          </CardContent>
+        </Card>
       </Flex>
     )
   }
@@ -3747,7 +6184,7 @@ export default function Account() {
     </Flex>
   )
 }
-`}function bt(){return`import { Alert, Button, Flex, Heading, Text, signal, useSignals } from '@cascivo/react'
+`}function Rt(){return`import { Alert, Button, Flex, Heading, Text, signal, useSignals } from '@cascivo/react'
 import { auth } from '../../auth'
 import { router } from '../../router'
 
@@ -3797,7 +6234,7 @@ export default function VerifySignIn() {
     </Flex>
   )
 }
-`}function xt(){return`import type { ViewConfig } from '@cascivo/render'
+`}function zt(){return`import type { ViewConfig } from '@cascivo/render'
 import { validateView } from '@cascivo/render/validate'
 
 /**
@@ -3869,7 +6306,7 @@ export function parsePage(raw: unknown): Page {
   const { view } = raw as Record<string, unknown>
   return { ...summary, ...parsePageInput({ title: summary.title, view }) }
 }
-`}function St(){return`import { HttpError } from '@cascivo/app/api'
+`}function Bt(){return`import { HttpError } from '@cascivo/app/api'
 import { migrate, queryRows } from '@cascivo/app/db'
 import type { Database } from '@cascivo/app/db'
 import { isSlug, parsePage } from '../src/pages'
@@ -3934,7 +6371,7 @@ export async function getPage(db: Database, slug: string): Promise<Page> {
   if (!page) throw new HttpError(404, 'No such page')
   return page
 }
-`}function Ct(){return`import { CascivoView } from '@cascivo/render'
+`}function Vt(){return`import { CascivoView } from '@cascivo/render'
 import { Flex, Heading } from '@cascivo/react'
 import { createElement } from 'react'
 import { renderToStaticMarkup } from 'react-dom/server'
@@ -4060,7 +6497,7 @@ export async function renderPageHtml(
     headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'public, max-age=60' },
   })
 }
-`}function wt(){return`import { migrate, queryRows } from '@cascivo/app/db'
+`}function Ht(){return`import { migrate, queryRows } from '@cascivo/app/db'
 import type { Database } from '@cascivo/app/db'
 import { exportPage } from '@cascivo/app/export'
 import type { ExportBrowser } from '@cascivo/app/export'
@@ -4117,7 +6554,7 @@ export async function pagePreview(
     headers: { 'content-type': 'image/png', 'cache-control': 'public, max-age=86400' },
   })
 }
-`}function Tt(){return`import { createClient } from '@cascivo/app/api'
+`}function Ut(){return`import { createClient } from '@cascivo/app/api'
 import { CascivoView } from '@cascivo/render'
 import type { ViewConfig } from '@cascivo/render'
 import { validateView } from '@cascivo/render/validate'
@@ -4277,7 +6714,7 @@ export default function Publish() {
     </Flex>
   )
 }
-`}function Et(){return`import type { RouteProps } from '@cascivo/app'
+`}function Wt(){return`import type { RouteProps } from '@cascivo/app'
 import { createClient } from '@cascivo/app/api'
 import { CascivoView } from '@cascivo/render'
 import {
@@ -4327,7 +6764,7 @@ export default function PublishedPage({ params }: RouteProps<'/p/:slug'>) {
     </Flex>
   )
 }
-`}function Dt(){return`import { signal } from '@cascivo/react'
+`}function Gt(){return`import { signal } from '@cascivo/react'
 import { VoiceClient } from 'agents/voice/client'
 import type { TranscriptMessage, VoiceStatus } from 'agents/voice/client'
 
@@ -4418,7 +6855,7 @@ export function voice(): VoiceClient {
   client = c
   return c
 }
-`}function Ot(){return`import { Agent } from 'agents'
+`}function Kt(){return`import { Agent } from 'agents'
 import type { Connection } from 'agents'
 import { withVoice, WorkersAIFluxSTT, WorkersAITTS } from 'agents/voice'
 import type { TextSource, VoiceTurnContext } from 'agents/voice'
@@ -4482,7 +6919,7 @@ export class Voice extends VoiceAgent {
     }
   }
 }
-`}function kt(){return`import type {
+`}function qt(){return`import type {
   TTSProvider,
   Transcriber,
   TranscriberSession,
@@ -4528,7 +6965,7 @@ const REPLIES: Record<string, string> = {
 export function scriptedReply(transcript: string): string {
   return REPLIES[transcript] ?? \`You said: \${transcript}\`
 }
-`}function At(){return`import {
+`}function Jt(){return`import {
   Badge,
   Button,
   Card,
@@ -4645,7 +7082,7 @@ export default function VoicePage() {
     </Flex>
   )
 }
-`}function jt(){return`import { defineLive } from '@cascivo/app/live'
+`}function Yt(){return`import { defineLive } from '@cascivo/app/live'
 
 /**
  * The live dashboard's metrics, shared by the Worker (which records them) and the page (which
@@ -4667,7 +7104,7 @@ export function parseAccepted(raw: unknown): Accepted {
   }
   throw new Error('Malformed reply')
 }
-`}function Mt(){return`import { Kpi, LineChart } from '@cascivo/charts'
+`}function Xt(){return`import { Kpi, LineChart } from '@cascivo/charts'
 import { createClient } from '@cascivo/app/api'
 import { watchLive } from '@cascivo/app/live'
 import type { LiveEvent, LivePoint } from '@cascivo/app/live'
@@ -4790,7 +7227,7 @@ export default function Ops() {
     </Flex>
   )
 }
-`}function Nt(){return`import { defineTable } from '@cascivo/app/db'
+`}function Zt(){return`import { defineTable } from '@cascivo/app/db'
 
 /**
  * The customers table, shared by the Worker (which queries it) and the page (which shows
@@ -4866,7 +7303,7 @@ export function parseDeleted(raw: unknown): { id: string } {
   }
   throw new Error('Malformed delete result')
 }
-`}function Pt(){return`import { createClient } from '@cascivo/app/api'
+`}function Qt(){return`import { createClient } from '@cascivo/app/api'
 import type { TableQuery } from '@cascivo/app/db'
 import { signal } from '@cascivo/react'
 import { api } from './api'
@@ -4921,7 +7358,7 @@ export async function remove(id: string): Promise<void> {
   await client.deleteCustomer({ params: { id } })
   await load()
 }
-`}function Ft(){return`import { HttpError } from '@cascivo/app/api'
+`}function $t(){return`import { HttpError } from '@cascivo/app/api'
 import { migrate, queryTable } from '@cascivo/app/db'
 import type { Database, TablePage, TableQuery } from '@cascivo/app/db'
 import { customersTable, parseCustomer } from '../src/customers'
@@ -4990,7 +7427,7 @@ export async function deleteCustomer(db: Database, id: string): Promise<{ id: st
   if (!row) throw new HttpError(404, 'No such customer')
   return { id }
 }
-`}function It(){return`import type { Migration } from '@cascivo/app/db'
+`}function en(){return`import type { Migration } from '@cascivo/app/db'
 
 const FIRST = [
   'Ada',
@@ -5040,7 +7477,7 @@ export const migrations: Migration[] = [
     ],
   },
 ]
-`}function Lt(){return`import type { Column } from '@cascivo/react'
+`}function tn(){return`import type { Column } from '@cascivo/react'
 import {
   Badge,
   Button,
@@ -5220,15 +7657,16 @@ export default function Customers() {
     </Flex>
   )
 }
-`}function Rt(){return`${B()}# Rewritten by @cascivo/app/vite whenever a route file changes.
+`}function nn(){return`${V()}# Rewritten by @cascivo/app/vite whenever a route file changes.
 src/routes.gen.ts
-`}function zt(){return`node_modules
+`}function rn(){return`node_modules
 dist
 .wrangler
 .dev.vars*
+!.dev.vars.example
 *.local
 .DS_Store
-`}function Bt(e){let t=e.pm??`npm`,n=$(e);return`# ${e.name}
+`}function an(e){let t=e.pm??`npm`,n=$(e);return`# ${e.name}
 
 A [cascivo](https://cascivo.com) app on Cloudflare: a client-rendered
 ${n===`preact`?`Preact`:`React`} app and its API, deployed as one Worker.
@@ -5265,7 +7703,7 @@ This builds the app, then deploys it to a temporary Cloudflare account with
 
 It works only while wrangler is logged out. If you are logged in, use \`deploy\` instead.
 A temporary account supports Workers, static assets, KV, D1 and Durable Objects. It does not
-support Workers AI, R2, Workflows or Browser Run.${Z(e)?` So a preview serves the app, but its ${K(e,`agent`)?`assistant`:`voice page`} cannot reach the model: deploy it\nto your own account for that.`:``}
+support Workers AI, R2, Workflows or Browser Run.${Z(e)?` So a preview serves the app, but its ${X(e,`agent`)?`assistant`:`voice page`} cannot reach the model: deploy it\nto your own account for that.`:``}
 
 ## Structure
 
@@ -5282,7 +7720,7 @@ support Workers AI, R2, Workflows or Browser Run.${Z(e)?` So a preview serves th
 - \`src/Shell.tsx\` — the app shell (header + side nav + content slot).
 
 Persist client state with \`persistedSignal\` from \`@cascivo/storage\` (localStorage or
-IndexedDB).${K(e,`board`)?"\n\n## Board (multiplayer)\n\n`/board` is a shared board. Open it in two windows: notes, edits and cursors sync live.\n\n- `src/board.ts` — `connectRoom('/api/rooms/<name>')` from `@cascivo/app/sync`; `room.map('notes', parseNote)`\n  is a signal every visitor shares, and `room.presence` carries cursors.\n- `worker/index.ts` — exports `SyncRoom`, one Durable Object per room, and routes\n  `/api/rooms/:name` to it (bound as `ROOMS` in `wrangler.jsonc`).\n- `/board?room=team` is a separate board.\n\nEach path (one note) is last-writer-wins in the order the room receives writes, so two people\nediting the same note at once settle on one value; editing different notes never collides.\nDurable Objects work on a temporary account, so `deploy:preview` shares a live board with\nno Cloudflare account.":``}${K(e,`notes`)?"\n\n## Notes (local-first)\n\n`/notes` keeps working when the connection drops. Edits are saved on this device and sync\nwhen the room is reachable again; a badge shows how many are still waiting.\n\n- `src/notes.ts` — `connectRoom(url, { storage: indexedDBDriver() })`: the room's last\n  state and every unconfirmed edit are kept in IndexedDB, so offline edits survive a reload\n  or a closed tab and go out on the next connection. `room.unsynced` counts them. (Opening\n  the app with no network at all also needs its files cached, by a service worker.)\n- The list is `/notes?list=<name>`. Without one, each browser makes its own and remembers\n  it; open the same `?list=` on another device to sync with it.\n- It uses the same `SyncRoom` Durable Object as any other room (`ROOMS` in\n  `wrangler.jsonc`). To query notes across lists, override `SyncRoom.onWrite` and mirror\n  each write into D1.\n\nA note is last-writer-wins: an edit made offline replaces whatever the note held when it\narrives. Edits to different notes never collide.":``}${K(e,`import`)?"\n\n## Import (background job)\n\n`/import` runs a CSV import as a Cloudflare Workflow and shows its progress live.\n\n- `worker/import-job.ts` — `ImportJob`, the Workflow. Each `step.do` is retried on its own\n  and its result kept, so a failure or a deploy resumes the job where it was. Put your writes\n  in `importContacts`.\n- `src/import-job.ts` — the job (`defineJob` from `@cascivo/app/jobs`): its steps and the\n  parser for its result, shared by both sides.\n- Progress is a read-only room: the Workflow reports with `jobReporter`\n  (`@cascivo/app/jobs-server`), and the page watches `/api/jobs/:id` with `watchJob`. The job\n  id is in the URL, so a reload or another tab picks the job back up.\n\nReport from inside a `step.do`: a Workflow replays `run()` from the top after each step, and\na report outside one would run again. Workflows run in `vite dev` locally, but not on a\ntemporary account, so `deploy:preview` serves the page without starting imports.":``}${K(e,`files`)?`
+IndexedDB).${X(e,`board`)?"\n\n## Board (multiplayer)\n\n`/board` is a shared board. Open it in two windows: notes, edits and cursors sync live.\n\n- `src/board.ts` — `connectRoom('/api/rooms/<name>')` from `@cascivo/app/sync`; `room.map('notes', parseNote)`\n  is a signal every visitor shares, and `room.presence` carries cursors.\n- `worker/index.ts` — exports `SyncRoom`, one Durable Object per room, and routes\n  `/api/rooms/:name` to it (bound as `ROOMS` in `wrangler.jsonc`).\n- `/board?room=team` is a separate board.\n\nEach path (one note) is last-writer-wins in the order the room receives writes, so two people\nediting the same note at once settle on one value; editing different notes never collides.\nDurable Objects work on a temporary account, so `deploy:preview` shares a live board with\nno Cloudflare account.":``}${X(e,`notes`)?"\n\n## Notes (local-first)\n\n`/notes` keeps working when the connection drops. Edits are saved on this device and sync\nwhen the room is reachable again; a badge shows how many are still waiting.\n\n- `src/notes.ts` — `connectRoom(url, { storage: indexedDBDriver() })`: the room's last\n  state and every unconfirmed edit are kept in IndexedDB, so offline edits survive a reload\n  or a closed tab and go out on the next connection. `room.unsynced` counts them. (Opening\n  the app with no network at all also needs its files cached, by a service worker.)\n- The list is `/notes?list=<name>`. Without one, each browser makes its own and remembers\n  it; open the same `?list=` on another device to sync with it.\n- It uses the same `SyncRoom` Durable Object as any other room (`ROOMS` in\n  `wrangler.jsonc`). To query notes across lists, override `SyncRoom.onWrite` and mirror\n  each write into D1.\n\nA note is last-writer-wins: an edit made offline replaces whatever the note held when it\narrives. Edits to different notes never collide.":``}${X(e,`import`)?"\n\n## Import (background job)\n\n`/import` runs a CSV import as a Cloudflare Workflow and shows its progress live.\n\n- `worker/import-job.ts` — `ImportJob`, the Workflow. Each `step.do` is retried on its own\n  and its result kept, so a failure or a deploy resumes the job where it was. Put your writes\n  in `importContacts`.\n- `src/import-job.ts` — the job (`defineJob` from `@cascivo/app/jobs`): its steps and the\n  parser for its result, shared by both sides.\n- Progress is a read-only room: the Workflow reports with `jobReporter`\n  (`@cascivo/app/jobs-server`), and the page watches `/api/jobs/:id` with `watchJob`. The job\n  id is in the URL, so a reload or another tab picks the job back up.\n\nReport from inside a `step.do`: a Workflow replays `run()` from the top after each step, and\na report outside one would run again. Workflows run in `vite dev` locally, but not on a\ntemporary account, so `deploy:preview` serves the page without starting imports.":``}${X(e,`files`)?`
 
 ## Files (uploads)
 
@@ -5298,7 +7736,7 @@ IndexedDB).${K(e,`board`)?"\n\n## Board (multiplayer)\n\n`/board` is a shared bo
 
 Each caller (by IP) may start 20 uploads a minute (\`ratelimits\` in \`wrangler.jsonc\`).${e.auth?``:"\n**It has no auth.** Anyone who can reach the app can upload: put Cloudflare Access in front of\nit (`--auth access`), add accounts (`--auth email`), or check who is asking in\n`worker/index.ts` before `handleUploads` runs."} Create the bucket once before deploying:
 \`npx wrangler r2 bucket create ${N(e.name)}-files\`. R2 and Images do not run on a
-temporary account.`:``}${K(e,`export`)?'\n\n## Report (PDF and PNG export)\n\n`/report` has "Download PDF" and "Download PNG" buttons. The Worker renders the page in\nCloudflare\'s Browser Run and returns the file.\n\n- `worker/index.ts` — `handleExport` (`@cascivo/app/export`) serves\n  `/api/export?page=/report&format=pdf`. It opens the page at this app\'s own origin with\n  `?export=1`, waits for the network to go quiet, and prints it. Only paths of this app\n  outside `/api/` can be exported.\n- `src/App.tsx` — `isExporting()` drops the shell, so the file holds the page alone.\n- For a scheduled report, call `exportPage` from a Cron Trigger and attach the PDF to an\n  email (`sendEmail` from `@cascivo/email` takes `attachments`).\n\nThe browser opens the page without the visitor\'s cookies, so a page that needs a session\nrenders signed out. Each export starts a browser session, which is billed, so each caller\n(by IP) may start 20 a minute (`ratelimits` in `wrangler.jsonc`). In `vite dev` Browser Run starts a local Chrome (downloaded on\nfirst use); it does not run on a temporary account.':``}${K(e,`live`)?`
+temporary account.`:``}${X(e,`export`)?'\n\n## Report (PDF and PNG export)\n\n`/report` has "Download PDF" and "Download PNG" buttons. The Worker renders the page in\nCloudflare\'s Browser Run and returns the file.\n\n- `worker/index.ts` — `handleExport` (`@cascivo/app/export`) serves\n  `/api/export?page=/report&format=pdf`. It opens the page at this app\'s own origin with\n  `?export=1`, waits for the network to go quiet, and prints it. Only paths of this app\n  outside `/api/` can be exported.\n- `src/App.tsx` — `isExporting()` drops the shell, so the file holds the page alone.\n- For a scheduled report, call `exportPage` from a Cron Trigger and attach the PDF to an\n  email (`sendEmail` from `@cascivo/email` takes `attachments`).\n\nThe browser opens the page without the visitor\'s cookies, so a page that needs a session\nrenders signed out. Each export starts a browser session, which is billed, so each caller\n(by IP) may start 20 a minute (`ratelimits` in `wrangler.jsonc`). In `vite dev` Browser Run starts a local Chrome (downloaded on\nfirst use); it does not run on a temporary account.':``}${X(e,`live`)?`
 
 ## Ops (live dashboard)
 
@@ -5318,7 +7756,7 @@ A new viewer, or one back from a dropped connection, starts with the whole windo
 at least once: a batch retried after a lost reply counts twice. \`/api/events\` has no auth, so
 anyone can move the numbers: check who is sending before real use (\`--auth access\` puts
 Cloudflare Access in front of the Worker). Create the queue once before deploying:
-\`npx wrangler queues create ${N(e.name)}-events\`.`:``}${K(e,`usage`)?"\n\n## Usage (analytics)\n\nEvery API request is recorded in Workers Analytics Engine, and `/usage` charts the last\n24 hours: requests per hour, the busiest routes, errors and latency.\n\n- `src/usage.ts` — `defineMetrics` (`@cascivo/app/analytics`) names the columns once\n  (`path`, `method`, `status`, `duration_ms`), so writes and queries never disagree about\n  which blob is which.\n- `worker/index.ts` — `handleAndRecord` writes one data point per API request.\n- `worker/usage.ts` — the queries, over Analytics Engine's SQL API.\n\nWriting needs only the binding. **Reading needs two secrets**, because the SQL API is HTTP\nwith an account token:\n\n```sh\nnpx wrangler secret put CF_ACCOUNT_ID\nnpx wrangler secret put CF_API_TOKEN   # a token with Account Analytics: Read\n```\n\nFor `vite dev`, put both in `.dev.vars`. Data written locally is not in your account's\ndataset, so in development the charts show what your deployed app recorded. Until the secrets\nexist, the page says what to set.":``}${K(e,`search`)?`
+\`npx wrangler queues create ${N(e.name)}-events\`.`:``}${X(e,`usage`)?"\n\n## Usage (analytics)\n\nEvery API request is recorded in Workers Analytics Engine, and `/usage` charts the last\n24 hours: requests per hour, the busiest routes, errors and latency.\n\n- `src/usage.ts` — `defineMetrics` (`@cascivo/app/analytics`) names the columns once\n  (`path`, `method`, `status`, `duration_ms`), so writes and queries never disagree about\n  which blob is which.\n- `worker/index.ts` — `handleAndRecord` writes one data point per API request.\n- `worker/usage.ts` — the queries, over Analytics Engine's SQL API.\n\nWriting needs only the binding. **Reading needs two secrets**, because the SQL API is HTTP\nwith an account token:\n\n```sh\nnpx wrangler secret put CF_ACCOUNT_ID\nnpx wrangler secret put CF_API_TOKEN   # a token with Account Analytics: Read\n```\n\nFor `vite dev`, put both in `.dev.vars`. Data written locally is not in your account's\ndataset, so in development the charts show what your deployed app recorded. Until the secrets\nexist, the page says what to set.":``}${X(e,`search`)?`
 
 ## Search (by meaning)
 
@@ -5336,7 +7774,119 @@ Create the index once before deploying, with the embedding model's dimensions:
 Neither Vectorize nor Workers AI runs locally, so \`vite dev\` searches by keyword with SQLite's
 full-text search instead, and the page says so. \`VITE_REAL_AI=1 ${C(t,`dev`)}\` uses the real ones
 (after \`npx wrangler login\`). Workers AI and Vectorize bill per use beyond their free
-allocations, and a temporary account has neither.`:``}${K(e,`digest`)?'\n\n## Weekly digest (Cron Trigger)\n\nEvery Monday at 08:00 UTC (`triggers.crons` in `wrangler.jsonc`), the Worker renders\n`/report` to a PDF with Browser Run and emails it. `/digest` lists each run — sent,\nskipped or failed, and why — and "Send now" runs one at once.\n\n- `worker/digest.ts` — `runDigest`: `exportPage` (`@cascivo/app/export`), then Email\n  Service with the PDF attached. Every run is recorded in D1, so a digest that did not arrive\n  says why.\n- `worker/index.ts` — the `scheduled` handler the Cron Trigger calls.\n\nSet `DIGEST_TO` (comma-separated), `DIGEST_FROM` (an address on a domain onboarded to Email\nService) and `APP_URL` (the deployed app\'s origin: a cron has no request to read it from) in\n`wrangler.jsonc`. Until they are set, runs are recorded as skipped. To fire the cron in\n`vite dev`, open `/cdn-cgi/handler/scheduled`; "Send now" uses the page\'s own origin, so it\nneeds no `APP_URL`. Browser Run starts a local Chrome in development.':``}${K(e,`webhooks`)?"\n\n## Webhooks\n\n`/webhooks` lists GitHub webhook deliveries as they arrive. Point a repository's webhook at\n`https://<your app>/api/webhooks/github` (content type `application/json`) with a secret, and\ngive the Worker the same secret:\n`npx wrangler secret put WEBHOOK_SECRET`. Locally it is in `.dev.vars`, and \"Send a test\ndelivery\" signs one with it.\n\n- `worker/webhooks.ts` — `verifyWebhook` (`@cascivo/app/guard`) checks the\n  `X-Hub-Signature-256` HMAC over the raw body before anything is parsed, and refuses a bad\n  signature with a 401. Each delivery is stored in D1 under GitHub's delivery id, so a retry is ignored, and a\n  new one is written to a read-only room the page watches.\n- `verifyWebhook` also checks Stripe (`scheme: 'stripe'`) and Standard Webhooks\n  (`'standard'`: Svix, Clerk, Resend…), both with a five-minute timestamp window against\n  replays.\n\nThe page answers within milliseconds, well inside GitHub's ten seconds. For slow work, send the\ndelivery to a Queue from `receiveGithub` and answer at once.":``}${e.auth===`email`?"\n\n## Accounts (email sign-in)\n\nAnyone can create an account with their email address: `/account` emails a one-time link,\nand opening it signs them in with a session cookie. **Every API write needs a signed-in\nuser; reads stay public.**\n\n- `worker/index.ts` — `handleAuth` (`@cascivo/app/auth-server`) answers `/api/auth/*`, and\n  `requireUser` refuses any other write without a session (401) or from another site (403).\n  Call `requireUser(env.DB, request)` in a handler to know who is asking.\n- `worker/auth.ts` — sends the link through Email Service. Set `AUTH_FROM` in\n  `wrangler.jsonc` to an address on a domain you have onboarded to Email Service.\n- `src/auth.ts` — `auth.user`, a signal every page can read.\n- `src/routes/signin/verify.tsx` — the page a link opens. It signs in on a button press,\n  because mail scanners open every link in a message.\n\nUsers, links and sessions live in D1, stored as hashes. Links expire after 15 minutes and\nwork once; sessions last 30 days. Each caller (by IP) may request 20 links a minute. In\n`vite dev` no email is sent: the Account page shows the link instead. WebSocket connections\n(rooms, agents) are not covered by the write rule; check `currentUser` before forwarding them\nif they need a user.":``}${e.auth===`access`?'\n\n## Access (who may use the app)\n\nThe Worker refuses every request Cloudflare Access did not let through: `requireAccess`\n(`@cascivo/app/guard`) at the top of `worker/index.ts` verifies the token Access signs.\n\n1. In Cloudflare One (Zero Trust), add a self-hosted Access application for this app\'s\n   hostname, with a policy saying who may sign in.\n2. Put your team domain (`<team>.cloudflareaccess.com`) and the application\'s Audience (AUD)\n   tag in `vars` in `wrangler.jsonc`, and deploy.\n\nUntil both are set, every API request answers 500 ("Access is not configured"). Access guards\nthe pages at the edge; the Worker\'s check also refuses API calls that reach it around Access,\nat `*.workers.dev` for example (set `"workers_dev": false` if the app should have no public\naddress at all). `vite dev` skips the check. A temporary account has no Access, so an app made\nwith `--auth access` cannot use `deploy:preview`.':``}${K(e,`crud`)?"\n\n## Customers (D1)\n\n`/customers` is a D1 table behind `DataTable`'s server mode: sorting, search, the name and\nseats filters, and paging all run as SQL in the Worker, and the page shows one page at a time.\n\n- `src/customers.ts` — `defineTable` (`@cascivo/app/db`) lists what may be sorted, searched and\n  filtered. `queryTable` builds SQL from that list only, with every value a bound parameter:\n  a query for any other column is refused with a 400.\n- `worker/migrations.ts` — the schema and 60 sample rows. The Worker applies them itself on its\n  first query (`migrate`), so a fresh deploy, the Deploy button and `deploy:preview` need no\n  migration step. Append migrations; never edit one that has shipped.\n- `worker/customers.ts` — create, update and delete, each checked by `parseCustomerInput`.\n\nD1 works on a temporary account, so `deploy:preview` shares the table with no sign-up. If you\nprefer wrangler's own migrations (`wrangler d1 migrations apply`), move the SQL into\n`migrations/` and drop the `migrate` call.":``}${K(e,`agent`)?`
+allocations, and a temporary account has neither.`:``}${X(e,`digest`)?'\n\n## Weekly digest (Cron Trigger)\n\nEvery Monday at 08:00 UTC (`triggers.crons` in `wrangler.jsonc`), the Worker renders\n`/report` to a PDF with Browser Run and emails it. `/digest` lists each run — sent,\nskipped or failed, and why — and "Send now" runs one at once.\n\n- `worker/digest.ts` — `runDigest`: `exportPage` (`@cascivo/app/export`), then Email\n  Service with the PDF attached. Every run is recorded in D1, so a digest that did not arrive\n  says why.\n- `worker/index.ts` — the `scheduled` handler the Cron Trigger calls.\n\nSet `DIGEST_TO` (comma-separated), `DIGEST_FROM` (an address on a domain onboarded to Email\nService) and `APP_URL` (the deployed app\'s origin: a cron has no request to read it from) in\n`wrangler.jsonc`. Until they are set, runs are recorded as skipped. To fire the cron in\n`vite dev`, open `/cdn-cgi/handler/scheduled`; "Send now" uses the page\'s own origin, so it\nneeds no `APP_URL`. Browser Run starts a local Chrome in development.':``}${X(e,`webhooks`)?"\n\n## Webhooks\n\n`/webhooks` lists GitHub webhook deliveries as they arrive. Point a repository's webhook at\n`https://<your app>/api/webhooks/github` (content type `application/json`) with a secret, and\ngive the Worker the same secret:\n`npx wrangler secret put WEBHOOK_SECRET`. Locally it is in `.dev.vars`, and \"Send a test\ndelivery\" signs one with it.\n\n- `worker/webhooks.ts` — `verifyWebhook` (`@cascivo/app/guard`) checks the\n  `X-Hub-Signature-256` HMAC over the raw body before anything is parsed, and refuses a bad\n  signature with a 401. Each delivery is stored in D1 under GitHub's delivery id, so a retry is ignored, and a\n  new one is written to a read-only room the page watches.\n- `verifyWebhook` also checks Stripe (`scheme: 'stripe'`) and Standard Webhooks\n  (`'standard'`: Svix, Clerk, Resend…), both with a five-minute timestamp window against\n  replays.\n\nThe page answers within milliseconds, well inside GitHub's ten seconds. For slow work, send the\ndelivery to a Queue from `receiveGithub` and answer at once.":``}${X(e,`checkout`)?`
+
+## Checkout (Stripe)
+
+\`/checkout\` sells one product on Stripe's hosted Checkout page: the card never touches this
+app. Stripe tells the Worker when the payment succeeds; the Worker marks the order paid, pushes
+it to the order page, and emails a receipt rendered with \`@cascivo/email\`.
+
+1. In the Stripe dashboard, in test mode, copy the secret key (\`sk_test_…\`) into \`.dev.vars\`
+   as \`STRIPE_SECRET_KEY\`, then run the app and buy with the card \`4242 4242 4242 4242\`.
+   The order page confirms the payment by reading the session back from Stripe, so this works
+   before any webhook is set up.
+2. To receive the webhook locally, run
+   \`stripe listen --forward-to localhost:5173/api/stripe/webhook\` (the Stripe CLI) and put the
+   \`whsec_…\` secret it prints in \`.dev.vars\` as \`STRIPE_WEBHOOK_SECRET\`.
+3. Deployed: \`npx wrangler secret put STRIPE_SECRET_KEY\` and
+   \`npx wrangler secret put STRIPE_WEBHOOK_SECRET\`. In the dashboard, add a webhook endpoint
+   at \`https://<your app>/api/stripe/webhook\` for \`checkout.session.completed\`,
+   \`checkout.session.async_payment_succeeded\`, \`checkout.session.async_payment_failed\`,
+   \`checkout.session.expired\`, \`charge.refunded\`, \`charge.dispute.created\` and
+   \`charge.dispute.closed\`; its signing secret is \`STRIPE_WEBHOOK_SECRET\`.
+4. Receipts: set \`RECEIPT_FROM\` in \`wrangler.jsonc\` to an address on a domain you have
+   onboarded to Email Service. \`vite dev\` renders each receipt and logs it instead.
+
+What you sell is \`PRODUCT\` in \`src/checkout.ts\`. The Worker sends that price to Stripe, so a
+browser cannot change it.
+
+- \`worker/checkout.ts\` — \`createStripe\` (\`@cascivo/app/stripe\`) creates the session, with
+  the order id as its idempotency key. The webhook is checked by \`verifyWebhook\` (scheme
+  \`stripe\`: signature and a five-minute window) before \`parseStripeEvent\` reads it.
+- An order moves from \`pending\` to \`paid\`, \`failed\` or \`expired\` once. A retried event, or
+  the page getting there before the webhook, changes nothing, so the receipt goes out once.
+  Orders are found by Stripe's session id, never by \`client_reference_id\`, which a buyer can
+  set on a Payment Link.
+- A bank debit completes the session as \`unpaid\`: the order stays pending until
+  \`async_payment_succeeded\` or \`async_payment_failed\` arrives, possibly days later.
+- Refunds are made in the Stripe dashboard (or with \`createRefund\`); \`charge.refunded\` records
+  the amount, and an order refunded in full becomes \`refunded\`. A chargeback makes it
+  \`disputed\` until it is decided: answer it with evidence in the dashboard. Both find the
+  order by the payment it stored when it was paid.
+- \`src/routes/checkout/[order].tsx\` — where Stripe sends the buyer back. It watches the
+  order's read-only room, so it updates when the webhook arrives.
+
+Each caller (by IP) may start 20 checkouts a minute.${J(e)?`
+
+### Subscriptions (\`/billing\`)
+
+Signed-in users subscribe to \`PLAN\` (\`src/billing.ts\`) on Stripe's checkout and change,
+pause or cancel it in Stripe's hosted billing portal, so the app has no billing screens to build.
+
+1. Add \`customer.subscription.created\`, \`customer.subscription.updated\`,
+   \`customer.subscription.deleted\` and \`invoice.payment_failed\` to the webhook endpoint's
+   events.
+2. In the Stripe dashboard, save the Customer Portal's settings once (test mode too): until
+   then, Stripe refuses to open it.
+3. Gate a paid feature in the Worker with \`await billingStore.requirePlan(env, request)\` (402
+   without the plan), never on what the page shows.
+
+- \`worker/billing.ts\` — the subscription names its user in its metadata, which only the
+  Worker sets (\`client_reference_id\` can be set by a buyer on a Payment Link). Every
+  subscription event is read back from Stripe before it is stored, because events arrive out of
+  order, and a late event about an older subscription cannot end a live one.
+- Back from checkout, \`/billing\` reads the session and its subscription at once, so it is right
+  before the webhook arrives, and only for the user the subscription names.
+- A renewal that cannot be charged leaves the plan on (\`past_due\`) while Stripe retries, and
+  emails the customer once per attempt with Stripe's page to pay with another card. How long
+  Stripe retries, and whether it then cancels, is set in the dashboard (Billing → Subscriptions
+  and emails); turn off Stripe's own failed-payment emails there, or customers get two.`:`
+
+Subscriptions need an account to belong to: \`cascivo create --framework cloudflare
+--example checkout --auth email\` adds a \`/billing\` page with a monthly plan and Stripe's
+billing portal.`}`:``}${X(e,`newsletter`)?`
+
+## Newsletter (Amazon SES)
+
+\`/newsletter\` signs readers up; \`/newsletter/send\` writes an issue in Markdown, previews it
+as the email it will be (rendered with \`@cascivo/email\`), and sends it to every confirmed
+reader through Amazon SES. It runs in \`vite dev\` with nothing set up: emails are logged instead
+of sent, and the sign-up page shows the confirmation link. The composer's key is in
+\`.dev.vars\` (\`NEWSLETTER_KEY\`).
+
+To send for real:
+
+1. In SES, verify the domain you send from (SES gives DNS records for DKIM; add them in
+   Cloudflare DNS, with an SPF and a DMARC record), and ask AWS to move the account out of the
+   sandbox, where it can mail only verified addresses.
+2. Create an IAM user allowed \`ses:SendEmail\` and nothing else, and give its keys to the
+   Worker: \`npx wrangler secret put AWS_ACCESS_KEY_ID\` and \`AWS_SECRET_ACCESS_KEY\` (in
+   \`.dev.vars\` locally). Set \`AWS_REGION\` and \`NEWSLETTER_FROM\` in \`wrangler.jsonc\`, and
+   \`npx wrangler secret put NEWSLETTER_KEY\` to a long random value.
+3. Bounces and complaints: create an SNS topic, set it as the SES identity's bounce and
+   complaint notification topic, and subscribe \`https://<your app>/api/sns/ses\` to it (HTTPS).
+   Put the topic's ARN in \`SNS_TOPIC_ARN\`. The Worker confirms the subscription itself.
+4. Create the queue once: \`npx wrangler queues create ${Y(e)}\`.
+
+- \`worker/newsletter.ts\` — double opt-in: a sign-up gets a confirmation link (valid a day,
+  resent at most every ten minutes) and gets no issue until it is opened. Sending stores the
+  issue and puts its readers on the \`NEWSLETTER\` queue, 25 per message; the consumer sends
+  them one by one through \`createSes\` (\`@cascivo/app/ses\`), handed to \`sendEmail\` from
+  \`@cascivo/email\`, which checks each message before it leaves, one message at a time. Each
+  send is recorded, so a message retried after SES throttling skips whoever already has it.
+- Every issue carries \`List-Unsubscribe\` and \`List-Unsubscribe-Post\` (one-click
+  unsubscribe, RFC 8058, which Gmail and Yahoo require of bulk senders) and a footer link to
+  \`/newsletter/unsubscribe\`.
+- \`handleSns\` checks each SNS message's signature against SNS's certificate before
+  \`parseSesNotification\` reads it. A permanent bounce or a complaint suppresses the address
+  for good: mailing it again is what gets an SES account reviewed.
+- \`worker/newsletter-email.ts\` — the issue and confirmation emails. The body is Markdown drawn
+  through the email primitives; raw HTML in it stays literal text.
+
+Sign-ups and every use of the newsletter key count against the rate limit (20 a minute per
+IP). Sending reads every confirmed address into memory; past a few hundred thousand readers,
+page through them instead.`:``}${e.auth===`email`?"\n\n## Accounts (email sign-in)\n\nAnyone can create an account with their email address: `/account` emails a one-time link,\nand opening it signs them in with a session cookie. **Every API write needs a signed-in\nuser; reads stay public.**\n\n- `worker/index.ts` — `handleAuth` (`@cascivo/app/auth-server`) answers `/api/auth/*`, and\n  `requireUser` refuses any other write without a session (401) or from another site (403).\n  Call `requireUser(env.DB, request)` in a handler to know who is asking.\n- `worker/auth.ts` — sends the link through Email Service. Set `AUTH_FROM` in\n  `wrangler.jsonc` to an address on a domain you have onboarded to Email Service.\n- `src/auth.ts` — `auth.user`, a signal every page can read.\n- `src/routes/signin/verify.tsx` — the page a link opens. It signs in on a button press,\n  because mail scanners open every link in a message.\n\nUsers, links and sessions live in D1, stored as hashes. Links expire after 15 minutes and\nwork once; sessions last 30 days. Each caller (by IP) may request 20 links a minute. In\n`vite dev` no email is sent: the Account page shows the link instead. WebSocket connections\n(rooms, agents) are not covered by the write rule; check `currentUser` before forwarding them\nif they need a user.":``}${e.auth===`access`?'\n\n## Access (who may use the app)\n\nThe Worker refuses every request Cloudflare Access did not let through: `requireAccess`\n(`@cascivo/app/guard`) at the top of `worker/index.ts` verifies the token Access signs.\n\n1. In Cloudflare One (Zero Trust), add a self-hosted Access application for this app\'s\n   hostname, with a policy saying who may sign in.\n2. Put your team domain (`<team>.cloudflareaccess.com`) and the application\'s Audience (AUD)\n   tag in `vars` in `wrangler.jsonc`, and deploy.\n\nUntil both are set, every API request answers 500 ("Access is not configured"). Access guards\nthe pages at the edge; the Worker\'s check also refuses API calls that reach it around Access,\nat `*.workers.dev` for example (set `"workers_dev": false` if the app should have no public\naddress at all). `vite dev` skips the check. A temporary account has no Access, so an app made\nwith `--auth access` cannot use `deploy:preview`.':``}${X(e,`crud`)?"\n\n## Customers (D1)\n\n`/customers` is a D1 table behind `DataTable`'s server mode: sorting, search, the name and\nseats filters, and paging all run as SQL in the Worker, and the page shows one page at a time.\n\n- `src/customers.ts` — `defineTable` (`@cascivo/app/db`) lists what may be sorted, searched and\n  filtered. `queryTable` builds SQL from that list only, with every value a bound parameter:\n  a query for any other column is refused with a 400.\n- `worker/migrations.ts` — the schema and 60 sample rows. The Worker applies them itself on its\n  first query (`migrate`), so a fresh deploy, the Deploy button and `deploy:preview` need no\n  migration step. Append migrations; never edit one that has shipped.\n- `worker/customers.ts` — create, update and delete, each checked by `parseCustomerInput`.\n\nD1 works on a temporary account, so `deploy:preview` shares the table with no sign-up. If you\nprefer wrangler's own migrations (`wrangler d1 migrations apply`), move the SQL into\n`migrations/` and drop the `migrate` call.":``}${X(e,`agent`)?`
 
 ## Assistant (generative UI)
 
@@ -5355,7 +7905,7 @@ again. The page renders the result with \`<CascivoView>\`: real components, no g
   offline and without an account. \`VITE_REAL_AI=1 ${C(t,`dev`)}\` uses Workers AI instead
   (after \`npx wrangler login\`); a deployed Worker always does.
 
-Workers AI bills per use beyond its free daily allocation.`:``}${K(e,`publish`)?`
+Workers AI bills per use beyond its free daily allocation.`:``}${X(e,`publish`)?`
 
 ## Publish (views as pages)
 
@@ -5373,10 +7923,10 @@ code of its author's and needs no sandbox.
 - \`src/routes/p/[slug].tsx\` — a published page.
 - \`worker/page-html.ts\` — the Worker answers \`/p/<slug>\` with index.html carrying the
   page's title, description and Open Graph tags, so a shared link previews properly, and the
-  rendered page in a \`<noscript>\` for readers without JavaScript.${K(e,`export`)?"\n- `worker/page-preview.ts` — the preview image (`og:image`, 1200 × 630): Browser Run\n  renders the page once, and D1 keeps the PNG.":``}
+  rendered page in a \`<noscript>\` for readers without JavaScript.${X(e,`export`)?"\n- `worker/page-preview.ts` — the preview image (`og:image`, 1200 × 630): Browser Run\n  renders the page once, and D1 keeps the PNG.":``}
 
 ${e.auth?``:"**Anyone who can reach the app can publish**, and a page is served from your domain: put\nCloudflare Access in front (`--auth access`), add accounts (`--auth email`), or check who\nis publishing in `worker/index.ts`. "}Each caller (by IP) may publish 20 pages a minute (\`ratelimits\` in
-\`wrangler.jsonc\`). D1 works on a temporary account.`:``}${K(e,`voice`)?`
+\`wrangler.jsonc\`). D1 works on a temporary account.`:``}${X(e,`voice`)?`
 
 ## Voice
 
@@ -5401,10 +7951,10 @@ Add more components with \`npx cascivo add <component>\`.
 
 ## ${n===`preact`?`Preact or React`:`React or Preact`}
 
-${K(e,`agent`)?`This app runs on React. The Agents SDK's hooks call React 19's \`use()\`, which
+${X(e,`agent`)?`This app runs on React. The Agents SDK's hooks call React 19's \`use()\`, which
 Preact's compat layer does not implement, so the assistant page needs React. (The other pages
 would run on Preact unchanged: the source is typed against React either way.)`:"The source is typed against React. The runtime is one plugin in `vite.config.ts`:\n`@preact/preset-vite` runs it on Preact, `@vitejs/plugin-react` on React. Switching\nneeds no source changes; swap the plugin and the matching dependencies. For this starter,\nPreact ships about a third of the client JS (~27 KB gzip against ~85 KB)."}
-`}function Vt(e){return`${V(e)}
+`}function on(e){return`${U(e)}
 ## Server
 
 The API contract is \`src/api.ts\` (\`defineApi\` from \`@cascivo/app/api\`); its handlers are
@@ -5426,14 +7976,15 @@ To show the user a running version, run \`${w(e.pm??`npm`,`deploy:preview`)}\`.
 It needs no Cloudflare account. Give the user both URLs it prints: the live one, and the
 claim URL. The deployment is public, and it is deleted after 60 minutes unless the user
 opens the claim URL and signs in.
-`}function Ht(e){let t=I(e),n=t.indexOf(` * Adding a router?`),r=t.indexOf(` */
+`}function sn(e){let t=oe(e),n=t.indexOf(` * Adding a router?`),r=t.indexOf(` */
 export function Shell`);return t.slice(0,n)+` * Routing lives in src/router.ts; nav items carry \`href\`s, and main.tsx registers the
  * router's Link so they navigate client-side.
-`+t.slice(r)}function Ut(e,t){let n=$(e),r=[...t.map((e,t)=>({file:Me(e,t),contents:t===0?Ie(e):Le(e,t)})),{file:`404.tsx`,contents:Re()},...K(e,`agent`)?[{file:`assistant.tsx`,contents:Ge()}]:[],...K(e,`board`)?[{file:`board.tsx`,contents:Be()}]:[],...K(e,`notes`)?[{file:`notes.tsx`,contents:Je()}]:[],...K(e,`import`)?[{file:`import.tsx`,contents:Qe()}]:[],...K(e,`files`)?[{file:`files.tsx`,contents:tt()}]:[],...K(e,`export`)?[{file:`report.tsx`,contents:rt()}]:[],...K(e,`usage`)?[{file:`usage.tsx`,contents:ot()}]:[],...K(e,`crud`)?[{file:`customers.tsx`,contents:Lt()}]:[],...K(e,`live`)?[{file:`ops.tsx`,contents:Mt()}]:[],...K(e,`voice`)?[{file:`voice.tsx`,contents:At()}]:[],...K(e,`publish`)?[{file:`publish.tsx`,contents:Tt()},{file:`p/[slug].tsx`,contents:Et()}]:[],...K(e,`webhooks`)?[{file:`webhooks.tsx`,contents:gt()}]:[],...K(e,`digest`)?[{file:`digest.tsx`,contents:pt()}]:[],...K(e,`search`)?[{file:`search.tsx`,contents:ut()}]:[],...e.auth===`email`?[{file:`account.tsx`,contents:yt()},{file:`signin/verify.tsx`,contents:bt()}]:[]];return[{path:`package.json`,contents:be(e)},{path:`tsconfig.json`,contents:xe(e)},...Q(e)?[{path:`tsconfig.worker.json`,contents:Se()}]:[],{path:`vite.config.ts`,contents:Ce(n,e)},{path:`wrangler.jsonc`,contents:we(e)},{path:`index.html`,contents:ie(e)},{path:`eslint.config.js`,contents:R()},{path:`.prettierrc`,contents:z()},{path:`.prettierignore`,contents:Rt()},{path:`.gitignore`,contents:zt()},{path:`README.md`,contents:Bt(e)},{path:`AGENTS.md`,contents:Vt(e)},{path:`worker/index.ts`,contents:Oe(e)},{path:`src/api.ts`,contents:De(e)},{path:`src/live.ts`,contents:ke()},{path:`src/LiveCard.tsx`,contents:Ae()},{path:`src/main.tsx`,contents:Fe()},{path:`src/vite-env.d.ts`,contents:F()},{path:`src/router.ts`,contents:Ne()},{path:`src/App.tsx`,contents:Pe(t,e)},{path:`src/Shell.tsx`,contents:Ht(e)},...K(e,`agent`)?[{path:`worker/assistant.ts`,contents:Ue()},{path:`worker/scripted-model.ts`,contents:We()},{path:`src/assistant.ts`,contents:He()},{path:`src/assistant.module.css`,contents:Ke()}]:[],...K(e,`notes`)?[{path:`src/notes.ts`,contents:qe()}]:[],...K(e,`import`)?[{path:`src/import-job.ts`,contents:Ye()},{path:`src/import-page.ts`,contents:Xe()},{path:`worker/import-job.ts`,contents:Ze()}]:[],...K(e,`crud`)?[{path:`src/customers.ts`,contents:Nt()},{path:`src/customers-page.ts`,contents:Pt()},{path:`worker/customers.ts`,contents:Ft()},{path:`worker/migrations.ts`,contents:It()}]:[],...K(e,`live`)?[{path:`src/ops.ts`,contents:jt()}]:[],...K(e,`search`)?[{path:`src/search.ts`,contents:st()},{path:`worker/search.ts`,contents:ct()},{path:`worker/articles.ts`,contents:lt()}]:[],...K(e,`digest`)?[{path:`src/digest.ts`,contents:dt()},{path:`worker/digest.ts`,contents:ft()}]:[],...K(e,`webhooks`)?[{path:`src/webhooks.ts`,contents:mt()},{path:`worker/webhooks.ts`,contents:ht()},{path:`.dev.vars`,contents:`WEBHOOK_SECRET=dev-only-webhook-secret
-`}]:[],...e.auth===`email`?[{path:`src/auth.ts`,contents:_t()},{path:`worker/auth.ts`,contents:vt()}]:[],...K(e,`publish`)?[{path:`src/pages.ts`,contents:xt()},{path:`worker/pages.ts`,contents:St()},{path:`worker/page-html.ts`,contents:Ct()},...K(e,`export`)?[{path:`worker/page-preview.ts`,contents:wt()}]:[]]:[],...K(e,`voice`)?[{path:`src/voice.ts`,contents:Dt()},{path:`worker/voice.ts`,contents:Ot()},{path:`worker/scripted-voice.ts`,contents:kt()}]:[],...K(e,`usage`)?[{path:`src/usage.ts`,contents:it().replace(`dataset: 'app_usage'`,`dataset: '${q(e)}'`)},{path:`worker/usage.ts`,contents:at()}]:[],...K(e,`files`)?[{path:`src/upload-policy.ts`,contents:$e()},{path:`src/files.ts`,contents:et()},{path:`src/files.module.css`,contents:nt()}]:[],...K(e,`board`)?[{path:`src/board.ts`,contents:ze()},{path:`src/board.module.css`,contents:Ve()}]:[],...r.map(({file:e,contents:t})=>({path:`src/routes/${e}`,contents:t})),{path:`src/routes.gen.ts`,contents:b(r.map(e=>e.file),`./routes`)}]}function Wt(e){let t=ee(e.sections);if(e.framework===`astro`)return Gt(e,t);if(e.framework===`cloudflare`){let n=e.examples?.includes(`digest`)&&!e.examples.includes(`export`)?[...e.examples,`export`]:e.examples;return Ut({...e,...n?{examples:n}:{}},t)}return[{path:`package.json`,contents:te(e)},{path:`tsconfig.json`,contents:ne()},{path:`vite.config.ts`,contents:re()},{path:`index.html`,contents:ie(e)},{path:`eslint.config.js`,contents:R()},{path:`.prettierrc`,contents:z()},{path:`.prettierignore`,contents:B()},{path:`.gitignore`,contents:se()},{path:`README.md`,contents:le(e)},{path:`AGENTS.md`,contents:V(e)},{path:`src/main.tsx`,contents:ae()},{path:`src/vite-env.d.ts`,contents:F()},{path:`src/App.tsx`,contents:oe(t)},{path:`src/Shell.tsx`,contents:I(e)},...t.map(e=>({path:`src/sections/${e.component}.tsx`,contents:L(e)}))]}function Gt(e,t){return[{path:`package.json`,contents:ue(e)},{path:`tsconfig.json`,contents:fe()},{path:`astro.config.mjs`,contents:de()},{path:`eslint.config.js`,contents:R()},{path:`.prettierrc`,contents:z()},{path:`.prettierignore`,contents:B()},{path:`.gitignore`,contents:ve()},{path:`README.md`,contents:ye(e,t)},{path:`AGENTS.md`,contents:V(e)},{path:`src/styles/layers.css`,contents:pe()},{path:`src/layouts/Layout.astro`,contents:me(e)},{path:`src/components/Shell.tsx`,contents:he(e,t)},...t.map((e,t)=>({path:`src/pages/${U(e,t)}`,contents:_e(e,t)})),...t.map(e=>({path:`src/components/${e.component}.tsx`,contents:ge(e)}))]}const Kt=[`Dashboard`,`Reports`,`Settings`];async function qt(f,p=process.cwd()){let m=f.includes(`--yes`)||f.includes(`-y`),h=r(f,[`pm`,`package-manager`,`theme`,`sections`,`template`,`framework`,`runtime`,`example`,`auth`])[0],g=a(f,`theme`),_=a(f,`sections`),v=(a(f,`framework`)??``).toLowerCase();if(v&&!T.includes(v)){console.error(`Unknown framework "${v}". Expected one of: ${T.join(`, `)}.`),process.exitCode=1;return}let y=(a(f,`runtime`)??``).toLowerCase();if(y&&!k(y)){console.error(`Unknown runtime "${y}". Expected one of: ${E.join(`, `)}.`),process.exitCode=1;return}let b=(a(f,`example`)??``).split(`,`).map(e=>e.trim().toLowerCase()).filter(Boolean),x=b.find(e=>!O(e));if(x){console.error(`Unknown example "${x}". Expected one of: ${D.join(`, `)}.`),process.exitCode=1;return}let A=(a(f,`auth`)??``).toLowerCase();if(A&&A!==`access`&&A!==`email`){console.error(`Unknown auth "${A}". Expected: access or email.`),process.exitCode=1;return}let j=i(f);if(`error`in j){console.error(j.error),process.exitCode=1;return}let M=e(p,{preferLockfileOverUserAgent:!0,...j.pm?{override:j.pm}:{}}),N=!m&&o.isTTY?d({input:o,output:s}):null;try{let e=h;!e&&N&&(e=(await N.question(`Project name? [my-cascivo-app]: `)).trim()),e||=`my-cascivo-app`;let r=(g??``).toLowerCase();!t.includes(r)&&N&&(r=(await N.question(`Theme? (${t.join(`/`)}) [light]: `)).trim().toLowerCase());let i=t.includes(r)?r:`light`,o=_;!o&&N&&(o=(await N.question(`Nav sections? (comma-separated) [${Kt.join(`, `)}]: `)).trim());let s=(o??``).split(`,`).map(e=>e.trim()).filter(Boolean),d=v;!d&&N&&(d=(await N.question(`Framework? (${T.join(`/`)}) [react-vite]: `)).trim().toLowerCase());let m=T.includes(d)?d:`react-vite`;if(b.length>0&&m!==`cloudflare`){console.error(`--example needs --framework cloudflare (it adds a Worker-backed page).`),process.exitCode=1;return}if(A&&m!==`cloudflare`){console.error(`--auth needs --framework cloudflare (it guards the Worker).`),process.exitCode=1;return}if(b.includes(`agent`)&&y===`preact`){console.error(`--example agent needs --runtime react: the Agents SDK's hooks call React 19's use(), which Preact does not implement.`),process.exitCode=1;return}let x={name:e,framework:m,theme:i,sections:s.length>0?s:Kt,pm:M,...k(y)?{runtime:y}:{},...b.length>0?{examples:b.filter(O)}:{},...A===`access`||A===`email`?{auth:A}:{}},E=u(p,e);if(c(E)&&l(E).length>0){console.error(`Target directory "${e}" already exists and is not empty.`),process.exitCode=1;return}let D=Wt(x);for(let e of D)await n(u(E,e.path),e.contents);console.log(`\nCreated ${e} (${m}) with the ${i} theme (${D.length} files).`);let j=a(f,`template`);if(j){let{add:e}=await import(`./index.mjs`).then(e=>e.t),{loadConfig:t}=await import(`./config-DT-Cs7bC.mjs`).then(e=>e.i);console.log(`\nInstalling template "${j}"…`),await e([j],await t(),{cwd:E,pm:M})}console.log(`
+`+t.slice(r)}function cn(e){return[...X(e,`webhooks`)?[`# The secret vite dev signs and checks test webhook deliveries with.`,`WEBHOOK_SECRET=dev-only-webhook-secret`]:[],...X(e,`checkout`)?[`# Stripe, in test mode (README): the secret key from the dashboard, and the signing`,"# secret `stripe listen` prints.",`STRIPE_SECRET_KEY=`,`STRIPE_WEBHOOK_SECRET=`]:[],...X(e,`newsletter`)?[`# The key /newsletter/send asks for. Deployed, choose a long random one.`,`NEWSLETTER_KEY=dev-only-newsletter-key`,`# An IAM user allowed ses:SendEmail (README). Without them, vite dev logs each email.`,`AWS_ACCESS_KEY_ID=`,`AWS_SECRET_ACCESS_KEY=`]:[]].map(e=>`${e}\n`).join(``)}function ln(e){return cn(e).split(`
+`).map(e=>e.startsWith(`#`)?e:e.replace(/=.*$/,`=`)).join(`
+`)}function un(e){let t=e=>Object.fromEntries(e.map(([e,t])=>[e,{description:t}]));return{...X(e,`webhooks`)?t([[`WEBHOOK_SECRET`,"The secret of the GitHub webhook that posts to `/api/webhooks/github`."]]):{},...X(e,`checkout`)?t([[`STRIPE_SECRET_KEY`,"Your Stripe secret key, from the [API keys page](https://dashboard.stripe.com/test/apikeys). A test key (`sk_test_…`) takes test cards only."],[`STRIPE_WEBHOOK_SECRET`,"The signing secret (`whsec_…`) of a Stripe webhook endpoint at `https://<this app>/api/stripe/webhook`. No endpoint yet? Enter `later`: orders are confirmed on their own page without it. Set the real one with `npx wrangler secret put STRIPE_WEBHOOK_SECRET`."],[`RECEIPT_FROM`,`The From address of receipts, on a domain onboarded to Cloudflare Email Service. Leave it empty to send none.`]]):{},...X(e,`newsletter`)?t([[`NEWSLETTER_KEY`,"The key `/newsletter/send` asks for. Make a long random one: `openssl rand -hex 32`."],[`AWS_ACCESS_KEY_ID`,"An IAM user allowed `ses:SendEmail` and nothing else (README)."],[`AWS_SECRET_ACCESS_KEY`,`That IAM user's secret access key.`],[`AWS_REGION`,"The SES region your sending domain is verified in, e.g. `eu-west-1`."],[`NEWSLETTER_FROM`,`The From address of issues, on your SES-verified domain.`],[`SNS_TOPIC_ARN`,"The SNS topic SES reports bounces and complaints to, subscribed to `https://<this app>/api/sns/ses`."]]):{}}}function dn(e,t){let n=$(e),r=[...t.map((e,t)=>({file:Ie(e,t),contents:t===0?Be(e):Ve(e,t)})),{file:`404.tsx`,contents:He()},...X(e,`agent`)?[{file:`assistant.tsx`,contents:Ye()}]:[],...X(e,`board`)?[{file:`board.tsx`,contents:We()}]:[],...X(e,`notes`)?[{file:`notes.tsx`,contents:Qe()}]:[],...X(e,`import`)?[{file:`import.tsx`,contents:nt()}]:[],...X(e,`files`)?[{file:`files.tsx`,contents:at()}]:[],...X(e,`export`)?[{file:`report.tsx`,contents:st()}]:[],...X(e,`usage`)?[{file:`usage.tsx`,contents:ut()}]:[],...X(e,`crud`)?[{file:`customers.tsx`,contents:tn()}]:[],...X(e,`live`)?[{file:`ops.tsx`,contents:Xt()}]:[],...X(e,`voice`)?[{file:`voice.tsx`,contents:Jt()}]:[],...X(e,`publish`)?[{file:`publish.tsx`,contents:Ut()},{file:`p/[slug].tsx`,contents:Wt()}]:[],...X(e,`webhooks`)?[{file:`webhooks.tsx`,contents:bt()}]:[],...X(e,`digest`)?[{file:`digest.tsx`,contents:_t()}]:[],...X(e,`search`)?[{file:`search.tsx`,contents:mt()}]:[],...X(e,`checkout`)?[{file:`checkout.tsx`,contents:Ct()},{file:`checkout/[order].tsx`,contents:wt()}]:[],...J(e)?[{file:`billing.tsx`,contents:Pt()}]:[],...X(e,`newsletter`)?[{file:`newsletter.tsx`,contents:Ot()},{file:`newsletter/confirm.tsx`,contents:kt()},{file:`newsletter/unsubscribe.tsx`,contents:At()},{file:`newsletter/send.tsx`,contents:jt()}]:[],...e.auth===`email`?[{file:`account.tsx`,contents:Lt()},{file:`signin/verify.tsx`,contents:Rt()}]:[]];return[{path:`package.json`,contents:ye(e)},{path:`tsconfig.json`,contents:be(e)},...Q(e)?[{path:`tsconfig.worker.json`,contents:xe()}]:[],{path:`vite.config.ts`,contents:Se(n,e)},{path:`wrangler.jsonc`,contents:Ce(e)},{path:`index.html`,contents:I(e)},{path:`eslint.config.js`,contents:R()},{path:`.prettierrc`,contents:B()},{path:`.prettierignore`,contents:nn()},{path:`.gitignore`,contents:rn()},{path:`README.md`,contents:an(e)},{path:`AGENTS.md`,contents:on(e)},{path:`worker/index.ts`,contents:Me(e)},{path:`src/api.ts`,contents:je(e)},{path:`src/live.ts`,contents:Ne()},{path:`src/LiveCard.tsx`,contents:Pe()},{path:`src/main.tsx`,contents:ze()},{path:`src/vite-env.d.ts`,contents:ie()},{path:`src/router.ts`,contents:Le()},{path:`src/App.tsx`,contents:Re(t,e)},{path:`src/Shell.tsx`,contents:sn(e)},...X(e,`agent`)?[{path:`worker/assistant.ts`,contents:qe()},{path:`worker/scripted-model.ts`,contents:Je()},{path:`src/assistant.ts`,contents:Ke()},{path:`src/assistant.module.css`,contents:Xe()}]:[],...X(e,`notes`)?[{path:`src/notes.ts`,contents:Ze()}]:[],...X(e,`import`)?[{path:`src/import-job.ts`,contents:$e()},{path:`src/import-page.ts`,contents:et()},{path:`worker/import-job.ts`,contents:tt()}]:[],...X(e,`crud`)?[{path:`src/customers.ts`,contents:Zt()},{path:`src/customers-page.ts`,contents:Qt()},{path:`worker/customers.ts`,contents:$t()},{path:`worker/migrations.ts`,contents:en()}]:[],...X(e,`live`)?[{path:`src/ops.ts`,contents:Yt()}]:[],...X(e,`search`)?[{path:`src/search.ts`,contents:dt()},{path:`worker/search.ts`,contents:ft()},{path:`worker/articles.ts`,contents:pt()}]:[],...X(e,`digest`)?[{path:`src/digest.ts`,contents:ht()},{path:`worker/digest.ts`,contents:gt()}]:[],...X(e,`webhooks`)?[{path:`src/webhooks.ts`,contents:vt()},{path:`worker/webhooks.ts`,contents:yt()}]:[],...X(e,`checkout`)?[{path:`src/checkout.ts`,contents:xt(e)},{path:`worker/checkout.ts`,contents:St()}]:[],...J(e)?[{path:`src/billing.ts`,contents:Mt()},{path:`worker/billing.ts`,contents:Nt()}]:[],...X(e,`newsletter`)?[{path:`src/newsletter.ts`,contents:Tt()},{path:`worker/newsletter.ts`,contents:Dt()},{path:`worker/newsletter-email.ts`,contents:Et(e)}]:[],...X(e,`webhooks`)||X(e,`checkout`)||X(e,`newsletter`)?[{path:`.dev.vars`,contents:cn(e)},{path:`.dev.vars.example`,contents:ln(e)}]:[],...e.auth===`email`?[{path:`src/auth.ts`,contents:Ft()},{path:`worker/auth.ts`,contents:It()}]:[],...X(e,`publish`)?[{path:`src/pages.ts`,contents:zt()},{path:`worker/pages.ts`,contents:Bt()},{path:`worker/page-html.ts`,contents:Vt()},...X(e,`export`)?[{path:`worker/page-preview.ts`,contents:Ht()}]:[]]:[],...X(e,`voice`)?[{path:`src/voice.ts`,contents:Gt()},{path:`worker/voice.ts`,contents:Kt()},{path:`worker/scripted-voice.ts`,contents:qt()}]:[],...X(e,`usage`)?[{path:`src/usage.ts`,contents:ct().replace(`dataset: 'app_usage'`,`dataset: '${Ee(e)}'`)},{path:`worker/usage.ts`,contents:lt()}]:[],...X(e,`files`)?[{path:`src/upload-policy.ts`,contents:rt()},{path:`src/files.ts`,contents:it()},{path:`src/files.module.css`,contents:ot()}]:[],...X(e,`board`)?[{path:`src/board.ts`,contents:Ue()},{path:`src/board.module.css`,contents:Ge()}]:[],...r.map(({file:e,contents:t})=>({path:`src/routes/${e}`,contents:t})),{path:`src/routes.gen.ts`,contents:b(r.map(e=>e.file),`./routes`)}]}function fn(e){let t=ee(e.sections);if(e.framework===`astro`)return pn(e,t);if(e.framework===`cloudflare`){let n=e.examples?.includes(`digest`)&&!e.examples.includes(`export`)?[...e.examples,`export`]:e.examples;return dn({...e,...n?{examples:n}:{}},t)}return[{path:`package.json`,contents:te(e)},{path:`tsconfig.json`,contents:F()},{path:`vite.config.ts`,contents:ne()},{path:`index.html`,contents:I(e)},{path:`eslint.config.js`,contents:R()},{path:`.prettierrc`,contents:B()},{path:`.prettierignore`,contents:V()},{path:`.gitignore`,contents:se()},{path:`README.md`,contents:ce(e)},{path:`AGENTS.md`,contents:U(e)},{path:`src/main.tsx`,contents:re()},{path:`src/vite-env.d.ts`,contents:ie()},{path:`src/App.tsx`,contents:ae(t)},{path:`src/Shell.tsx`,contents:oe(e)},...t.map(e=>({path:`src/sections/${e.component}.tsx`,contents:L(e)}))]}function pn(e,t){return[{path:`package.json`,contents:le(e)},{path:`tsconfig.json`,contents:de()},{path:`astro.config.mjs`,contents:ue()},{path:`eslint.config.js`,contents:R()},{path:`.prettierrc`,contents:B()},{path:`.prettierignore`,contents:V()},{path:`.gitignore`,contents:_e()},{path:`README.md`,contents:ve(e,t)},{path:`AGENTS.md`,contents:U(e)},{path:`src/styles/layers.css`,contents:fe()},{path:`src/layouts/Layout.astro`,contents:pe(e)},{path:`src/components/Shell.tsx`,contents:me(e,t)},...t.map((e,t)=>({path:`src/pages/${G(e,t)}`,contents:ge(e,t)})),...t.map(e=>({path:`src/components/${e.component}.tsx`,contents:he(e)}))]}const mn=[`Dashboard`,`Reports`,`Settings`];async function hn(f,p=process.cwd()){let m=f.includes(`--yes`)||f.includes(`-y`),h=r(f,[`pm`,`package-manager`,`theme`,`sections`,`template`,`framework`,`runtime`,`example`,`auth`])[0],g=a(f,`theme`),_=a(f,`sections`),v=(a(f,`framework`)??``).toLowerCase();if(v&&!T.includes(v)){console.error(`Unknown framework "${v}". Expected one of: ${T.join(`, `)}.`),process.exitCode=1;return}let y=(a(f,`runtime`)??``).toLowerCase();if(y&&!k(y)){console.error(`Unknown runtime "${y}". Expected one of: ${E.join(`, `)}.`),process.exitCode=1;return}let b=(a(f,`example`)??``).split(`,`).map(e=>e.trim().toLowerCase()).filter(Boolean),x=b.find(e=>!O(e));if(x){console.error(`Unknown example "${x}". Expected one of: ${D.join(`, `)}.`),process.exitCode=1;return}let A=(a(f,`auth`)??``).toLowerCase();if(A&&A!==`access`&&A!==`email`){console.error(`Unknown auth "${A}". Expected: access or email.`),process.exitCode=1;return}let j=i(f);if(`error`in j){console.error(j.error),process.exitCode=1;return}let M=e(p,{preferLockfileOverUserAgent:!0,...j.pm?{override:j.pm}:{}}),N=!m&&o.isTTY?d({input:o,output:s}):null;try{let e=h;!e&&N&&(e=(await N.question(`Project name? [my-cascivo-app]: `)).trim()),e||=`my-cascivo-app`;let r=(g??``).toLowerCase();!t.includes(r)&&N&&(r=(await N.question(`Theme? (${t.join(`/`)}) [light]: `)).trim().toLowerCase());let i=t.includes(r)?r:`light`,o=_;!o&&N&&(o=(await N.question(`Nav sections? (comma-separated) [${mn.join(`, `)}]: `)).trim());let s=(o??``).split(`,`).map(e=>e.trim()).filter(Boolean),d=v;!d&&N&&(d=(await N.question(`Framework? (${T.join(`/`)}) [react-vite]: `)).trim().toLowerCase());let m=T.includes(d)?d:`react-vite`;if(b.length>0&&m!==`cloudflare`){console.error(`--example needs --framework cloudflare (it adds a Worker-backed page).`),process.exitCode=1;return}if(A&&m!==`cloudflare`){console.error(`--auth needs --framework cloudflare (it guards the Worker).`),process.exitCode=1;return}if(b.includes(`agent`)&&y===`preact`){console.error(`--example agent needs --runtime react: the Agents SDK's hooks call React 19's use(), which Preact does not implement.`),process.exitCode=1;return}let x={name:e,framework:m,theme:i,sections:s.length>0?s:mn,pm:M,...k(y)?{runtime:y}:{},...b.length>0?{examples:b.filter(O)}:{},...A===`access`||A===`email`?{auth:A}:{}},E=u(p,e);if(c(E)&&l(E).length>0){console.error(`Target directory "${e}" already exists and is not empty.`),process.exitCode=1;return}let D=fn(x);for(let e of D)await n(u(E,e.path),e.contents);console.log(`\nCreated ${e} (${m}) with the ${i} theme (${D.length} files).`);let j=a(f,`template`);if(j){let{add:e}=await import(`./index.mjs`).then(e=>e.t),{loadConfig:t}=await import(`./config-DT-Cs7bC.mjs`).then(e=>e.i);console.log(`\nInstalling template "${j}"…`),await e([j],await t(),{cwd:E,pm:M})}console.log(`
 Next steps:`),console.log(`  cd ${e}`),console.log(`  ${S(M)}`),console.log(`  ${C(M,`dev`)}`),console.log(`
 Good to know:`),console.log(`  No cascivo.config.ts is written — this app uses the prebuilt @cascivo/react`),console.log("  packages and never copies source. `cascivo add <component>` writes the"),console.log(`  config itself the first time you vendor a component.`),m===`cloudflare`?(console.log("\n  worker/index.ts is the API (wrangler.jsonc routes /api/* to it); `dev`"),console.log("  runs it in workerd. Deploy with `npx wrangler login` once, then the"),console.log(`  deploy script: ${w(M,`deploy`)}`),console.log(`
   No account yet? Share a 60-minute preview, claimable into a free account:`),console.log(`  ${w(M,`deploy:preview`)}`)):m===`astro`?(console.log(`
   Pages are real Astro routes — no client router to add. Only src/`),console.log(`  components/Shell.tsx hydrates (client:load, for the mobile nav drawer);`),console.log(`  page content is server-rendered and ships no JS. See`),console.log(`  https://cascivo.com/docs/using-with-astro.md`)):(console.log(`
-  Adding a router? Keep src/Shell.tsx, delete src/App.tsx + src/sections/,`),console.log(`  and register your Link once with setLinkComponent — see`),console.log(`  https://cascivo.com/docs/using-with-a-router.md`))}finally{N?.close()}}export{qt as create};
-//# sourceMappingURL=create-D_3pilHu.mjs.map
+  Adding a router? Keep src/Shell.tsx, delete src/App.tsx + src/sections/,`),console.log(`  and register your Link once with setLinkComponent — see`),console.log(`  https://cascivo.com/docs/using-with-a-router.md`))}finally{N?.close()}}export{hn as create};
+//# sourceMappingURL=create-DmBKREqv.mjs.map