create-hollware 0.9.1 → 0.11.0

package/dist/index.mjs

@@ -17,6 +17,10 @@ const USAGE = [
 	"  --site <key>     The key of your site, such as my-site; it never changes (default: my-site)",
 	"  --preset <name>  What the site starts with: blog, docs or empty (default: blog)",
 	"  --locales <list> Its locales, comma-separated, the first the default (default: en)",
+	"  --ip-addresses <off|hashed>",
+	"                   Whether the activity log keeps a keyed hash of each address (default: off)",
+	"  --audit-retention-days <n>",
+	"                   Days each line of the activity log is kept, 30 to 3650 (default: forever)",
 	"  --pm <npm|pnpm>  The package manager that installs (default: npm)",
 	"  --yes            Take the defaults: <dir> is my-hollware when it is not given",
 	"  --no-install     Do not install, migrate or make the site",
@@ -51,6 +55,8 @@ function readChoices(argv) {
 					site: { type: "string" },
 					preset: { type: "string" },
 					locales: { type: "string" },
+					"ip-addresses": { type: "string" },
+					"audit-retention-days": { type: "string" },
 					pm: { type: "string" },
 					yes: { type: "boolean" },
 					"no-install": { type: "boolean" },
@@ -78,7 +84,12 @@ function readChoices(argv) {
 		pm,
 		install: values["no-install"] !== true,
 		git: values["no-git"] !== true,
-		initFlags: [...values.preset === void 0 ? [] : ["--preset", values.preset], ...values.locales === void 0 ? [] : ["--locales", values.locales]]
+		initFlags: [
+			...values.preset === void 0 ? [] : ["--preset", values.preset],
+			...values.locales === void 0 ? [] : ["--locales", values.locales],
+			...values["ip-addresses"] === void 0 ? [] : ["--ip-addresses", values["ip-addresses"]],
+			...values["audit-retention-days"] === void 0 ? [] : ["--audit-retention-days", values["audit-retention-days"]]
+		]
 	};
 }
 function replaceIn(path, replacements) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-hollware",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Create a new Hollware project.",
   "homepage": "https://hollware.com",
   "bugs": {
@@ -35,7 +35,7 @@
     "@types/node": "24.19.2",
     "publint": "0.3.25",
     "typescript": "7.0.2",
-    "vite-plus": "1.1.0"
+    "vite-plus": "1.2.0"
   },
   "engines": {
     "node": ">=24.11.0"

package/template/package.json

@@ -15,18 +15,18 @@
   "dependencies": {
     "@hollware/core": "HOLLWARE_VERSION",
     "@hollware/server": "HOLLWARE_VERSION",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
-    "@cloudflare/vite-plugin": "1.63.2",
-    "@cloudflare/vitest-plugin": "1.4.1",
+    "@cloudflare/vite-plugin": "1.64.0",
+    "@cloudflare/vitest-plugin": "1.4.3",
     "@hollware/admin": "HOLLWARE_VERSION",
     "hollware": "HOLLWARE_VERSION",
     "typescript": "7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",
-    "vite-plus": "1.1.0",
-    "vitest": "5.0.3",
-    "wrangler": "4.150.0"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.2.0",
+    "vite-plus": "1.2.0",
+    "vitest": "5.0.4",
+    "wrangler": "4.151.0"
   },
   "overrides": {
     "vite": "$vite"

package/template/test/worker.workerd.test.ts

@@ -79,6 +79,7 @@ describe('the database', () => {
 
     expect(results.map((row) => row.name)).toEqual([
       '_hollware_meta',
+      'audit_log',
       'auth_challenges',
       'deliveries',
       'entries',

package/template/vitest.config.ts

@@ -31,8 +31,8 @@ export default defineConfig({
     name: 'starter:workerd',
     include: ['test/**/*.workerd.test.ts'],
     setupFiles: ['test/apply-migrations.ts'],
-    // The default, kept explicit: @cloudflare/vitest-plugin cannot read Vitest 5's module cache from
-    // workerd ("no such file or directory, readAll .vitest-cache/..."), cloudflare/workers-sdk#15618.
+    // Off: @cloudflare/vitest-plugin reads Vitest's module cache from workerd since 1.4.3
+    // (cloudflare/workers-sdk#15618), but it saved no time here (server:workerd, 13 s either way).
     fsModuleCache: false,
   },
 })

package/template/worker-configuration.d.ts

@@ -1,10 +1,11 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 9df54bbb9b67e268beea963d16f621d4)
-// Runtime types generated with workerd@1.20261006.1 2026-10-06 global_fetch_strictly_public,no_nodejs_compat,no_nodejs_compat_v2
+// Generated by Wrangler by running `wrangler types` (hash: 8cce72e181db11068cbc639f31cd25a2)
+// Runtime types generated with workerd@1.20261012.1 2026-10-06 global_fetch_strictly_public,no_nodejs_compat,no_nodejs_compat_v2
 interface __BaseEnv_Env {
 	OAUTH_KV: KVNamespace;
 	DB: D1Database;
 	EVENTS: Queue;
+	HOLLWARE_RATE_LIMIT: RateLimit;
 	ASSETS: Fetcher;
 	HOLLWARE_PUBLIC_URL: "http://localhost:5199";
 }
@@ -3323,13 +3324,7 @@ declare abstract class SqlStorageStatement {
 }
 type SqlStorageValue = ArrayBuffer | string | number | null;
 declare abstract class SqlStorageCursor<T extends Record<string, SqlStorageValue>> {
-    next(): {
-        done?: false;
-        value: T;
-    } | {
-        done: true;
-        value?: never;
-    };
+    next(): IteratorResult<T, undefined>;
     toArray(): T[];
     one(): T;
     raw<U extends SqlStorageValue[]>(): IterableIterator<U>;
@@ -3655,6 +3650,7 @@ interface Tracing {
 }
 declare abstract class Span {
     get isTraced(): boolean;
+    spanContext(): TracingSpanContext;
     setAttribute(key: string, value: boolean | number | string): this;
     setAttributes(attributes: Record<string, boolean | number | string | undefined>): this;
     recordException(exception: string | {
@@ -3682,6 +3678,11 @@ interface TracingSpanStatus {
     code: TracingSpanStatusCode;
     message?: string;
 }
+interface TracingSpanContext {
+    traceId: string;
+    spanId: string;
+    traceFlags: number;
+}
 /**
  * Represents the identity of a user authenticated via Cloudflare Access.
  * This matches the result of calling /cdn-cgi/access/get-identity.
@@ -13238,20 +13239,30 @@ interface Disposable {
 }
 declare module 'cloudflare:durable-objects' {
     /**
-     * Marks a Durable Object method as safe to run more than once. The runtime may then retry calls
-     * to it after a disconnect that might have happened after the method started. It does not
+     * Marks Durable Object methods as safe to run more than once. The runtime may then retry calls
+     * to them after a disconnect that might have happened after the method started. It does not
      * enable retries or change how many are made.
      *
+     * Mark methods on the class prototype, for example from a static block:
+     *
+     * ```ts
+     * class Counter extends DurableObject {
+     *   static {
+     *     retryable(this.prototype.reset);
+     *   }
+     *   async reset() {}
+     * }
+     * ```
+     *
+     * The mark is on the function itself. A subclass inherits it, but an override, a bound copy, or
+     * a wrapper is not marked unless it is also passed to `retryable()`.
+     *
      * Each attempt creates its own return value, so if the method returns an `RpcTarget`, its
      * `[Symbol.dispose]()` may run once per attempt.
      *
-     * Only public instance methods can be decorated. When composing decorators, apply `@retryable`
-     * outermost (first in source order) so it marks the method that is finally installed.
-     * Otherwise `@retryable` has no effect, and constructing the object logs a warning.
-     * Requires standard (not `experimentalDecorators`) decorators and a bundler that transforms
-     * them, such as Wrangler.
+     * @throws TypeError if an argument is not a function.
      */
-    export function retryable<This, Args extends unknown[], Return>(value: (this: This, ...args: Args) => Return, context: ClassMethodDecoratorContext<This, (this: This, ...args: Args) => Return>): (this: This, ...args: Args) => Return;
+    export function retryable(...methods: ((...args: never[]) => unknown)[]): void;
 }
 /**
  * The returned data after sending an email
@@ -13393,7 +13404,10 @@ declare module "cloudflare:email" {
  * Evaluation context for targeting rules.
  * Keys are attribute names (e.g. "userId", "country"), values are the attribute values.
  */
-type FlagshipEvaluationContext = Record<string, string | number | boolean>;
+type FlagshipEvaluationContextValue = string | number | boolean | null | FlagshipEvaluationContextValue[] | {
+    [key: string]: FlagshipEvaluationContextValue;
+};
+type FlagshipEvaluationContext = Record<string, FlagshipEvaluationContextValue>;
 interface FlagshipEvaluationDetails<T> {
     flagKey: string;
     value: T;
@@ -13402,6 +13416,7 @@ interface FlagshipEvaluationDetails<T> {
     errorCode?: string | undefined;
     errorMessage?: string | undefined;
 }
+type FlagshipWidenedValue<T> = T extends boolean ? boolean : T extends string ? string : T extends number ? number : T;
 interface FlagshipEvaluationError extends Error {
 }
 /**
@@ -13429,8 +13444,23 @@ declare abstract class Flagship {
      * @param flagKey The key of the flag to evaluate.
      * @param defaultValue Optional default value returned when evaluation fails.
      * @param context Optional evaluation context for targeting rules.
+     * @deprecated Use getValue() instead.
      */
     get(flagKey: string, defaultValue?: unknown, context?: FlagshipEvaluationContext): Promise<unknown>;
+    /**
+     * Get a flag value, inferring its expected type from the default value.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getValue<T extends boolean | string | number | Record<string, unknown> | unknown[]>(flagKey: string, defaultValue: T, context?: FlagshipEvaluationContext): Promise<FlagshipWidenedValue<T>>;
+    /**
+     * Get a flag value with full evaluation details, inferring its expected type from the default value.
+     * @param flagKey The key of the flag to evaluate.
+     * @param defaultValue Default value returned when evaluation fails or the flag type does not match.
+     * @param context Optional evaluation context for targeting rules.
+     */
+    getDetails<T extends boolean | string | number | Record<string, unknown> | unknown[]>(flagKey: string, defaultValue: T, context?: FlagshipEvaluationContext): Promise<FlagshipEvaluationDetails<FlagshipWidenedValue<T>>>;
     /**
      * Get a boolean flag value.
      * @param flagKey The key of the flag to evaluate.
@@ -14231,7 +14261,7 @@ declare namespace Rpc {
     // Structured cloneables
     BaseType
     // Structured cloneable composites
-     | Map<T extends Map<infer U, unknown> ? Serializable<U> : never, T extends Map<unknown, infer U> ? Serializable<U> : never> | Set<T extends Set<infer U> ? Serializable<U> : never> | ReadonlyArray<T extends ReadonlyArray<infer U> ? Serializable<U> : never> | {
+     | Map<T extends Map<infer U, unknown> ? Serializable<U> : never, T extends Map<unknown, infer U> ? Serializable<U> : never> | Set<T extends Set<infer U> ? Serializable<U> : never> | ReadonlyMap<T extends ReadonlyMap<infer U, unknown> ? Serializable<U> : never, T extends ReadonlyMap<unknown, infer U> ? Serializable<U> : never> | ReadonlySet<T extends ReadonlySet<infer U> ? Serializable<U> : never> | ReadonlyArray<T extends ReadonlyArray<infer U> ? Serializable<U> : never> | {
         [K in keyof T]: K extends number | string ? Serializable<T[K]> : never;
     }
     // Special types
@@ -14249,7 +14279,7 @@ declare namespace Rpc {
     type BaseType = void | undefined | null | boolean | number | bigint | string | TypedArray | ArrayBuffer | DataView | Date | Error | RegExp | ReadableStream<Uint8Array> | WritableStream<Uint8Array> | Request | Response | Headers;
     // Recursively rewrite all `Stubable` types with `Stub`s
     // prettier-ignore
-    type Stubify<T> = T extends Stubable ? Stub<T> : T extends Map<infer K, infer V> ? Map<Stubify<K>, Stubify<V>> : T extends Set<infer V> ? Set<Stubify<V>> : T extends Array<infer V> ? Array<Stubify<V>> : T extends ReadonlyArray<infer V> ? ReadonlyArray<Stubify<V>> : T extends BaseType ? T : T extends {
+    type Stubify<T> = T extends Stubable ? Stub<T> : T extends Map<infer K, infer V> ? Map<Stubify<K>, Stubify<V>> : T extends Set<infer V> ? Set<Stubify<V>> : T extends ReadonlyMap<infer K, infer V> ? ReadonlyMap<Stubify<K>, Stubify<V>> : T extends ReadonlySet<infer V> ? ReadonlySet<Stubify<V>> : T extends Array<infer V> ? Array<Stubify<V>> : T extends ReadonlyArray<infer V> ? ReadonlyArray<Stubify<V>> : T extends BaseType ? T : T extends {
         [key: string | number]: any;
     } ? {
         [K in keyof T]: Stubify<T[K]>;
@@ -14258,7 +14288,7 @@ declare namespace Rpc {
     // Note we use `StubBase` instead of `Stub` here to avoid circular dependencies:
     // `Stub` depends on `Provider`, which depends on `Unstubify`, which would depend on `Stub`.
     // prettier-ignore
-    type Unstubify<T> = T extends StubBase<infer V> ? V : T extends Map<infer K, infer V> ? Map<Unstubify<K>, Unstubify<V>> : T extends Set<infer V> ? Set<Unstubify<V>> : T extends Array<infer V> ? Array<Unstubify<V>> : T extends ReadonlyArray<infer V> ? ReadonlyArray<Unstubify<V>> : T extends BaseType ? T : T extends {
+    type Unstubify<T> = T extends StubBase<infer V> ? V : T extends Map<infer K, infer V> ? Map<Unstubify<K>, Unstubify<V>> : T extends Set<infer V> ? Set<Unstubify<V>> : T extends ReadonlyMap<infer K, infer V> ? ReadonlyMap<Unstubify<K>, Unstubify<V>> : T extends ReadonlySet<infer V> ? ReadonlySet<Unstubify<V>> : T extends Array<infer V> ? Array<Unstubify<V>> : T extends ReadonlyArray<infer V> ? ReadonlyArray<Unstubify<V>> : T extends BaseType ? T : T extends {
         [key: string | number]: unknown;
     } ? {
         [K in keyof T]: Unstubify<T[K]>;

package/template/wrangler.jsonc

@@ -40,6 +40,15 @@
   // The OAuth server's clients, grants and tokens (ADR-026). No id: the first `hollware deploy`
   // creates the namespace and writes its id here.
   "kv_namespaces": [{ "binding": "OAUTH_KV" }],
+  // Sign-in, OAuth's token endpoint and the beacon take at most 60 requests a minute from one
+  // address each: what a person or a site sends never comes near it.
+  "ratelimits": [
+    {
+      "name": "HOLLWARE_RATE_LIMIT",
+      "namespace_id": "1001",
+      "simple": { "limit": 60, "period": 60 },
+    },
+  ],
   "d1_databases": [
     {
       "binding": "DB",