create-nevela 0.8.0 → 0.9.2

package/template/laravel/src/Access/ClosedAccounts.php

@@ -7,6 +7,7 @@ use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Str;
 use Nevela\Laravel\Auth\Account;
+use Nevela\Laravel\Support\Key;
 
 /**
  * Accounts that were closed, and the emails that may not have a new one.
@@ -207,7 +208,7 @@ final class ClosedAccounts
     /** Let an email whose account was removed for good be used again. False when there is no such entry. */
     public static function allow(string $id): bool
     {
-        return DB::table(self::BLOCKED)->where('id', $id)->whereNull('user_id')->delete() > 0;
+        return Key::isUuid($id) && DB::table(self::BLOCKED)->where('id', $id)->whereNull('user_id')->delete() > 0;
     }
 
     /** Remember an email by its fingerprint: for a closed account, or with no account left. */

package/template/laravel/src/Concerns/Confirmable.php

@@ -0,0 +1,81 @@
+<?php
+
+namespace Nevela\Laravel\Concerns;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A model whose records hold an address that has to be proved: a list people join.
+ *
+ * A record made through the public form starts unconfirmed (`confirmed_at` is null) and
+ * is confirmed when the link emailed to its address is followed. Until then it is left
+ * out of counts and exports, and after two days it is removed. Whatever goes to
+ * "everyone on the list" goes to the confirmed:
+ *
+ *     Subscriber::confirmed()->each(fn ($subscriber) => …);
+ *
+ * A record made any other way (in the dashboard, by a seeder, by an import) is confirmed
+ * as it is made: someone signed in put it there, and there is nobody to ask.
+ *
+ * Generated models use it when their descriptor's public create has "confirm".
+ *
+ * @mixin \Illuminate\Database\Eloquent\Model
+ */
+trait Confirmable
+{
+    /** Whether this model's table has the column. Only "yes" is remembered: it can arrive later in a process. */
+    private static bool $hasConfirmation = false;
+
+    public static function confirms(): bool
+    {
+        if (static::$hasConfirmation) {
+            return true;
+        }
+        $model = new static;
+
+        return static::$hasConfirmation = Schema::connection($model->getConnectionName())->hasColumn($model->getTable(), 'confirmed_at');
+    }
+
+    /** Ask the database again next time. For a test that adds the column within one process. */
+    public static function forgetConfirmation(): void
+    {
+        static::$hasConfirmation = false;
+    }
+
+    public static function bootConfirmable(): void
+    {
+        static::creating(function (self $model) {
+            // The public form says "not yet" by setting the column to null itself. Anything
+            // else that makes a record says nothing, and is taken at its word.
+            if (! array_key_exists('confirmed_at', $model->getAttributes()) && static::confirms()) {
+                $model->setAttribute('confirmed_at', $model->freshTimestamp());
+            }
+        });
+    }
+
+    public function initializeConfirmable(): void
+    {
+        $this->mergeCasts(['confirmed_at' => 'datetime']);
+    }
+
+    /** Whether this record's address has been proved. */
+    public function isConfirmed(): bool
+    {
+        return $this->getAttribute('confirmed_at') !== null;
+    }
+
+    /** The records whose address has been proved: the ones to count, export and write to. */
+    public function scopeConfirmed(Builder $query): void
+    {
+        if (static::confirms()) {
+            $query->whereNotNull($this->qualifyColumn('confirmed_at'));
+        }
+    }
+
+    /** The ones still waiting for their link to be followed. */
+    public function scopeUnconfirmed(Builder $query): void
+    {
+        static::confirms() ? $query->whereNull($this->qualifyColumn('confirmed_at')) : $query->whereRaw('1 = 0');
+    }
+}

package/template/laravel/src/Console/BlogCommand.php

@@ -0,0 +1,254 @@
+<?php
+
+namespace Nevela\Laravel\Console;
+
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Schema;
+use InvalidArgumentException;
+use Nevela\Laravel\Generator\BlogPages;
+use Nevela\Laravel\Generator\GeneratedFile;
+use Nevela\Laravel\Generator\Writer;
+use Nevela\Laravel\Media\Uploads;
+use Nevela\Laravel\Nevela;
+use Nevela\Laravel\Support\Descriptor;
+use Nevela\Laravel\Support\Naming;
+
+/**
+ * A blog for the site: posts written in the dashboard, and /blog to read them at.
+ *
+ *   php artisan nevela:blog                          a Post resource, and the pages
+ *   php artisan nevela:blog --resource=Article …     the pages only, reading a resource the app has
+ *
+ * Everything a blog is made of is already a resource's to have: rich text, an image, a
+ * slug, a date it is published on, and public reading. This puts them together, and
+ * writes the pages that show the result.
+ */
+final class BlogCommand extends Command
+{
+    /** The resource this makes when the app has none to read. */
+    public const RESOURCE = 'Post';
+
+    public const PATH = '/blog';
+
+    protected $signature = 'nevela:blog
+        {--resource= : Read the posts from a resource you already have, and write only the pages}
+        {--title= : That resource\'s field for a post\'s title. Default: title}
+        {--body= : Its field for the post itself. Default: body}
+        {--excerpt= : Its field for a sentence or two about the post, if it has one}
+        {--image= : Its field for a picture, if it has one}
+        {--published= : Its field for when a post was published. Default: the one the resource is published by}
+        {--sample : Add three posts to start with. For development: refused in production}
+        {--no-migrate : Don\'t create the posts table yet}';
+
+    protected $description = 'Give the site a blog: a Post resource to write in, and /blog to read it at';
+
+    public function handle(): int
+    {
+        Nevela::forget();
+        try {
+            $all = Nevela::all();
+            $given = $this->option('resource');
+            [$descriptor, $fields, $created] = $given === null
+                ? $this->ours($all)
+                : [...$this->theirs((string) $given, $all), false];
+        } catch (InvalidArgumentException $e) {
+            $this->components->error($e->getMessage());
+
+            return self::FAILURE;
+        }
+
+        $dir = rtrim(config('nevela.descriptors_path'), '/\\');
+        if (! is_dir($dir)) {
+            mkdir($dir, 0775, true);
+        }
+        // The descriptor says where the blog is, so the site's header can link to it.
+        file_put_contents($dir.DIRECTORY_SEPARATOR.Naming::kebab($descriptor->name).'.json', $descriptor->toJson());
+        Nevela::forget();
+        if (GenerateCommand::generate($this, [$descriptor], Nevela::all(), false) !== self::SUCCESS) {
+            return self::FAILURE;
+        }
+
+        $web = config('nevela.web_path');
+        if (! $web || ! is_dir($web)) {
+            $this->components->warn('There is no web app at nevela.web_path, so the pages were not written. Run this again when there is.');
+        } else {
+            foreach ((new Writer([GeneratedFile::TARGET_WEB => $web]))->write(BlogPages::files($descriptor, $fields)) as $row) {
+                $path = str_replace('\\', '/', substr($row['path'], strlen(rtrim($web, '/\\')) + 1));
+                $this->components->twoColumnDetail("../web/{$path}", $row['status'] === 'created' ? '<fg=green>created</>' : '<fg=gray>exists (yours)</>');
+            }
+        }
+
+        $status = self::SUCCESS;
+        if ($created && ! $this->option('no-migrate')) {
+            $status = $this->call('migrate', ['--force' => true]);
+        }
+        if ($status === self::SUCCESS && $this->option('sample')) {
+            $status = $this->sample($descriptor);
+        }
+
+        $this->newLine();
+        $this->line('  The blog is at <fg=cyan>'.self::PATH.'</>, and '.$descriptor->pluralLabel.' is in the dashboard. A post is on the site once it has been published.');
+        if (! $created) {
+            $this->line('  Which records are public is the scope on <fg=cyan>app/Models/'.$descriptor->name.'.php</> (scopePublicQuery). The pages and <fg=cyan>lib/blog.ts</> are yours to change.');
+        }
+
+        return $status;
+    }
+
+    /**
+     * The Post resource, made here: what a post is, that it is published by a date, and
+     * that anyone may read a published one by its slug.
+     *
+     * @param  list<Descriptor>  $all
+     * @return array{Descriptor, array<string, string|null>, bool}
+     */
+    private function ours(array $all): array
+    {
+        $fields = ['title' => 'title', 'body' => 'body', 'excerpt' => 'excerpt', 'image' => 'image', 'published' => 'publishedAt'];
+        foreach ($all as $existing) {
+            if ($existing->name === self::RESOURCE || $existing->table === 'posts') {
+                // Run again on an app that has it: the pages are written if they aren't there, and nothing else changes.
+                if ($existing->blog !== null) {
+                    return [$existing, array_map(fn (?string $field) => $field !== null && isset($existing->fields[$field]) ? $field : null, $fields), false];
+                }
+                throw new InvalidArgumentException("There is a {$existing->name} resource already. To have the blog read it: php artisan nevela:blog --resource={$existing->name}");
+            }
+        }
+        if ($this->tableExists('posts')) {
+            throw new InvalidArgumentException('There is a posts table already, which is not a resource. Adopt it (php artisan nevela:adopt posts), then: php artisan nevela:blog --resource=Post');
+        }
+
+        $descriptor = Descriptor::fromArray([
+            'name' => self::RESOURCE,
+            'icon' => 'book',
+            'publish' => 'publishedAt',
+            'blog' => self::PATH,
+            'fields' => [
+                'title' => ['kind' => 'string'],
+                'slug' => ['kind' => 'string', 'format' => 'slug', 'unique' => true, 'from' => 'title'],
+                'excerpt' => ['kind' => 'string', 'maxLength' => 500, 'required' => false],
+                'body' => ['kind' => 'text', 'format' => 'rich'],
+                'image' => ['kind' => 'file', 'accept' => ['image'], 'profile' => 'cover', 'required' => false],
+                'publishedAt' => ['kind' => 'datetime', 'required' => false],
+            ],
+            'public' => ['read' => ['by' => 'slug', 'fields' => ['title', 'slug', 'excerpt', 'body', 'image', 'publishedAt']]],
+        ]);
+
+        return [$descriptor, $fields, true];
+    }
+
+    /**
+     * A resource the app already has, read as posts. Nothing about it is changed but the
+     * note of where its blog is; what it lacks for a blog is said, and nothing is written.
+     *
+     * @param  list<Descriptor>  $all
+     * @return array{Descriptor, array<string, string|null>}
+     *
+     * @throws InvalidArgumentException
+     */
+    private function theirs(string $name, array $all): array
+    {
+        $descriptor = null;
+        foreach ($all as $candidate) {
+            if (strcasecmp($candidate->name, $name) === 0) {
+                $descriptor = $candidate;
+            }
+        }
+        if ($descriptor === null) {
+            throw new InvalidArgumentException("There is no resource called {$name}.");
+        }
+        $public = $descriptor->public;
+        if ($public?->read === null) {
+            throw new InvalidArgumentException("{$descriptor->name} can't be read publicly, and a blog is public. Add to its descriptor: \"public\": { \"read\": { \"by\": \"slug\", \"fields\": [ … ] } }");
+        }
+        if ($public->by === null) {
+            throw new InvalidArgumentException("{$descriptor->name}'s public section doesn't say which unique field a record is fetched by, and a post's address is made from one. Add \"by\": \"slug\" to its \"read\".");
+        }
+
+        $fields = [];
+        foreach (['title' => 'title', 'body' => 'body', 'excerpt' => null, 'image' => null, 'published' => $descriptor->publish] as $part => $default) {
+            $asked = $this->option($part);
+            // A column's name is understood as well as the field's: published_at, publishedAt.
+            $field = $asked === null ? $default : Naming::camel((string) $asked);
+            if ($field === null) {
+                $fields[$part] = null;
+
+                continue;
+            }
+            if (! isset($descriptor->fields[$field])) {
+                throw new InvalidArgumentException("{$descriptor->name} has no field called {$field}. Name the one that is a post's {$part}: --{$part}=…");
+            }
+            if (! in_array($field, $public->read, true)) {
+                throw new InvalidArgumentException("\"{$field}\" is not among the fields anyone may read of {$descriptor->name}, so the blog couldn't show it. Add it to \"public.read.fields\" in its descriptor.");
+            }
+            $fields[$part] = $field;
+        }
+
+        $data = $descriptor->toArray();
+        $data['blog'] = self::PATH;
+
+        return [Descriptor::fromArray($data), $fields];
+    }
+
+    /**
+     * Three posts, so /blog has something on it the first time it is opened. Like the
+     * sample users: for looking around a new app, and never for a live one.
+     */
+    private function sample(Descriptor $descriptor): int
+    {
+        if (app()->environment('production')) {
+            $this->components->error('Sample posts are for development. This app is in production, so none were made.');
+
+            return self::FAILURE;
+        }
+        $model = "App\\Models\\{$descriptor->name}";
+        if ($descriptor->name !== self::RESOURCE || ! class_exists($model) || ! $this->tableExists($descriptor->table)) {
+            $this->components->warn('Sample posts are for the Post resource this command makes, once its table is there.');
+
+            return self::SUCCESS;
+        }
+        if ($model::query()->exists()) {
+            return self::SUCCESS; // it has posts already; these would only be in the way
+        }
+
+        // A picture each, where pictures can be made here.
+        $pictures = Uploads::placeholders($descriptor, $descriptor->fields['image'], 3);
+        foreach (self::POSTS as $index => $post) {
+            $model::create($post + ['image' => $pictures[$index] ?? null, 'published_at' => now()->subDays(1 + $index * 3)]);
+        }
+        $this->components->info('Added three sample posts. Edit or delete them under Posts in the dashboard.');
+
+        return self::SUCCESS;
+    }
+
+    private function tableExists(string $table): bool
+    {
+        try {
+            return Schema::hasTable($table);
+        } catch (\Throwable) {
+            return false; // no database to ask yet
+        }
+    }
+
+    /** @var list<array{title: string, slug: string, excerpt: string, body: string}> */
+    private const POSTS = [
+        [
+            'title' => 'Welcome to your blog',
+            'slug' => 'welcome-to-your-blog',
+            'excerpt' => 'This post came with the app. It is here so the blog has something on it the first time you open it.',
+            'body' => '<p>This post came with the app. It is here so the blog has something on it the first time you open it, and you can delete it whenever you like.</p><h2>Where posts are written</h2><p>Sign in and open <strong>Posts</strong> in the dashboard. A post has a title, an excerpt for the list, a picture and a body with headings, lists, links and quotes.</p><h2>Where they are read</h2><p>At <a href="/blog">/blog</a>, newest first, and each at an address of its own made from its title.</p>',
+        ],
+        [
+            'title' => 'Drafts, publishing and scheduling',
+            'slug' => 'drafts-publishing-and-scheduling',
+            'excerpt' => 'A post is not on the site until it is published. Until then it is a draft, and only people who sign in can see it.',
+            'body' => '<p>A post is not on the site until it is published. Until then it is a draft, and only people who sign in can see it.</p><ul><li><strong>Publish</strong> puts it on the site at once.</li><li><strong>Unpublish</strong> takes it off again and keeps it as a draft.</li><li>Give it a date and time still to come and it is <strong>scheduled</strong>: it appears by itself when that time arrives.</li></ul><p>The list in the dashboard says which of the three each post is, and can be filtered by it.</p>',
+        ],
+        [
+            'title' => 'Making the blog yours',
+            'slug' => 'making-the-blog-yours',
+            'excerpt' => 'The pages that show the blog were written once, into your own app, and are yours to change.',
+            'body' => '<p>The pages that show the blog were written once, into your own app, and are yours to change.</p><h3>What to open</h3><ol><li><strong>lib/blog.ts</strong> for the blog\'s title, its description and how many posts are on a page.</li><li><strong>app/blog</strong> for the list and for a post\'s own page.</li></ol><blockquote><p>There is an RSS feed at /blog/feed.xml, and every published post is in the sitemap.</p></blockquote>',
+        ],
+    ];
+}

package/template/laravel/src/Console/DevCommand.php

@@ -40,6 +40,13 @@ final class DevCommand extends Command
             $web = Process::fromShellCommandline(self::packageManager($webPath).' run dev', $webPath, ['NEVELA_API_URL' => "{$url}/api"], null, null);
         }
 
+        // Mail a public form causes is queued, and a queue with nobody working it sends
+        // nothing: a confirmation link would never arrive. So the queue is worked here too,
+        // unless the app runs jobs as they are made.
+        $queue = in_array(config('queue.default'), ['sync', 'null', null], true)
+            ? null
+            : new Process([$php, 'artisan', 'queue:listen', '--tries=1', '--sleep=2'], base_path(), null, null, null);
+
         $this->components->info('Starting '.($web ? 'the API and the dashboard' : 'the API').'. Press Ctrl+C to stop.');
         $this->components->twoColumnDetail('API', $url);
         if ($web) {
@@ -49,6 +56,7 @@ final class DevCommand extends Command
 
         $api->start($this->printer('api', 35));
         $web?->start($this->printer('web', 36));
+        $queue?->start($this->printer('queue', 33));
 
         try {
             while ($api->isRunning() && ($web === null || $web->isRunning())) {
@@ -56,6 +64,7 @@ final class DevCommand extends Command
             }
         } finally {
             // Whichever stopped, or Ctrl+C: don't leave the other one running behind.
+            $queue?->stop(3);
             $web?->stop(3);
             $api->stop(3);
         }

package/template/laravel/src/Console/DigestCommand.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Nevela\Laravel\Console;
+
+use Illuminate\Console\Command;
+use Nevela\Laravel\Forms\PublicMail;
+
+final class DigestCommand extends Command
+{
+    protected $signature = 'nevela:digest';
+
+    protected $description = 'Send the owner one email for the form notices that were held back in a busy hour';
+
+    public function handle(): int
+    {
+        if (PublicMail::owner() === null) {
+            $this->components->warn('There is nobody to send it to. Set NEVELA_NOTIFY_TO, or the address the app sends mail from.');
+
+            return self::SUCCESS;
+        }
+        $count = PublicMail::digest();
+        $this->components->info($count === 0
+            ? 'No notices are waiting.'
+            : 'Sent one email naming '.number_format($count).' notice(s) to '.PublicMail::owner().'.');
+
+        return self::SUCCESS;
+    }
+}

package/template/laravel/src/Console/DisposableCommand.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace Nevela\Laravel\Console;
+
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Http;
+use Nevela\Laravel\Forms\Disposable;
+use Throwable;
+
+final class DisposableCommand extends Command
+{
+    protected $signature = 'nevela:disposable {--url= : Fetch the list from somewhere else}';
+
+    protected $description = 'Fetch the current list of throwaway email domains a protected form refuses';
+
+    public function handle(): int
+    {
+        $url = (string) ($this->option('url') ?: Disposable::SOURCE);
+        try {
+            $response = Http::timeout(30)->get($url);
+        } catch (Throwable $e) {
+            $this->components->error("Couldn't fetch the list: ".$e->getMessage());
+
+            return self::FAILURE;
+        }
+        $domains = [];
+        foreach (preg_split('/\R/', $response->successful() ? $response->body() : '') ?: [] as $line) {
+            $line = strtolower(trim($line));
+            // One domain a line. Anything else is not the list: an error page, a redirect to a sign-in.
+            if ($line !== '' && $line[0] !== '#' && preg_match('/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/', $line)) {
+                $domains[$line] = true;
+            }
+        }
+        // The list has thousands. A few lines is something else, and would let every throwaway address through.
+        if (count($domains) < 1000) {
+            $this->components->error("What came back from {$url} isn't the list (".count($domains).' domains). The one in use is unchanged.');
+
+            return self::FAILURE;
+        }
+        ksort($domains);
+        $path = Disposable::refreshedPath();
+        is_dir(dirname($path)) || mkdir(dirname($path), 0775, true);
+        file_put_contents($path, implode("\n", array_keys($domains))."\n", LOCK_EX);
+        Disposable::forget();
+        $this->components->info(number_format(count($domains)).' throwaway domains, kept in '.str_replace(base_path().DIRECTORY_SEPARATOR, '', $path).'.');
+
+        return self::SUCCESS;
+    }
+}

package/template/laravel/src/Console/GenerateCommand.php

@@ -44,6 +44,27 @@ final class GenerateCommand extends Command
         return $written || ! $columnExists;
     }
 
+    /**
+     * Whether a resource whose form proves an address needs the migration that adds the
+     * column for it: when its table was made without one. A new resource's own migration
+     * has it.
+     *
+     * @param  list<string>  $createMigrations  The contents of the table's own migration(s); none for a resource that is new
+     */
+    public static function needsConfirmMigration(array $createMigrations, bool $adopted = false): bool
+    {
+        if ($createMigrations === []) {
+            return $adopted;
+        }
+        foreach ($createMigrations as $contents) {
+            if (str_contains($contents, 'confirmed_at')) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     /** Whether the table has the column now. No, where there is no database to ask. */
     private static function hasTrashColumn(string $table): bool
     {
@@ -131,6 +152,10 @@ final class GenerateCommand extends Command
             if (self::needsTrashMigration($made, $written, self::hasTrashColumn($descriptor->table), $descriptor->adopted)) {
                 $files[] = $generator->trashMigrationFile($descriptor);
             }
+            // The same for "confirm" added to a resource whose table is already made.
+            if ($descriptor->public?->confirm !== null && self::needsConfirmMigration($made, $descriptor->adopted)) {
+                $files[] = $generator->confirmMigrationFile($descriptor);
+            }
         }
         $files[] = $generator->routes($all);
         $files[] = $generator->publicRoutes($all);

package/template/laravel/src/Console/SetupCommand.php

@@ -16,9 +16,10 @@ final class SetupCommand extends Command
         {--name= : Name for the starter account}
         {--email= : Email for the starter account. Leave out to create no account}
         {--password= : Password for the starter account}
-        {--no-sample-users : Create the starter account only, without the ten sample users}';
+        {--no-sample-users : Create the starter account only, without the ten sample users}
+        {--no-blog : Leave out the blog: the Post resource, its three sample posts and the /blog pages}';
 
-    protected $description = 'Finish setting up a new app: key, Sanctum\'s migration, generated files, migrations, a starter account and sample users';
+    protected $description = 'Finish setting up a new app: key, Sanctum\'s migration, generated files, migrations, the blog, a starter account and sample users';
 
     protected $hidden = true;
 
@@ -39,6 +40,18 @@ final class SetupCommand extends Command
             return self::FAILURE;
         }
 
+        // A blog, as a first resource and a first public page: a Post to write in the
+        // dashboard, /blog to read it at, and three posts so neither is empty. Not having
+        // one is no reason to call the setup failed.
+        if (! $this->option('no-blog')) {
+            // The sample posts are for development: asked for in production they are refused,
+            // which would read as the blog having failed.
+            $blog = $this->call('nevela:blog', app()->environment('production') ? [] : ['--sample' => true]);
+            if ($blog !== self::SUCCESS) {
+                $this->components->warn('The blog could not be set up, so this app has none yet. Everything else is in place. Add it later: php nevela blog');
+            }
+        }
+
         if ($this->option('email')) {
             // The first account in an app is its administrator.
             $status = $this->call('nevela:user', [

package/template/laravel/src/Console/StatusCommand.php

@@ -7,6 +7,7 @@ use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Schema;
 use Nevela\Laravel\Access\ClosedAccounts;
+use Nevela\Laravel\Forms\FormGuard;
 use Nevela\Laravel\Nevela;
 use Nevela\Laravel\Support\DashboardState;
 use Nevela\Laravel\Support\Releases;
@@ -95,6 +96,19 @@ final class StatusCommand extends Command
             }
         }
 
+        // --- public forms ---
+        // A form that asks for the robot check can only make it with the secret key.
+        $checked = array_map(fn ($r) => $r->name, array_values(array_filter($resources, fn ($r) => $r->public?->protect['turnstile'] ?? false)));
+        if ($checked !== []) {
+            $forms = implode(', ', $checked);
+            $row('Robot check (Turnstile)', match (true) {
+                FormGuard::robotCheck() === 'on' => "on for {$forms}, solved on ".implode(', ', FormGuard::hostnames()),
+                FormGuard::secret() === '' && app()->environment('production') => $bad("TURNSTILE_SECRET_KEY is not set, so the form for {$forms} answers 503 to everyone"),
+                FormGuard::secret() === '' => "<fg=yellow>skipped: TURNSTILE_SECRET_KEY is not set, so nothing checks {$forms}. Set it before going live.</>",
+                default => $bad("no site to accept a check from, so the form for {$forms} answers 503 to everyone: set NEVELA_WEB_URL to the site's address, or TURNSTILE_HOSTNAMES"),
+            });
+        }
+
         // --- dashboard ---
         $web = config('nevela.web_path');
         if (! $web || ! is_dir($web)) {

package/template/laravel/src/Console/TrashCommand.php

@@ -3,6 +3,8 @@
 namespace Nevela\Laravel\Console;
 
 use Illuminate\Console\Command;
+use Nevela\Laravel\Forms\Confirmation;
+use Nevela\Laravel\Forms\PublicMail;
 use Nevela\Laravel\Media\Uploads;
 use Nevela\Laravel\Trash\Trash;
 
@@ -21,6 +23,13 @@ final class TrashCommand extends Command
             $this->components->info('Removed '.number_format($unclaimed).' file(s) uploaded through a public form and never used.');
         }
 
+        // People who joined a list and never followed the link that proves their address.
+        $hours = Confirmation::hours();
+        foreach (Confirmation::purge() as $resource => $count) {
+            $this->components->info('Removed '.number_format($count)." {$resource} record(s) whose address wasn't confirmed within {$hours} hours.");
+        }
+        PublicMail::prune();
+
         $days = Trash::days();
         if ($days === null) {
             $this->components->info('Deleted records are kept until someone removes them (nevela.trash.days is off), so there is nothing to do.');

package/template/laravel/src/Forms/ConfirmAddress.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Nevela\Laravel\Forms;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Mail\Mailable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * The email with the link that proves an address: see Confirmation.
+ *
+ * Written like the emails signing in sends, so the two look alike. To say it in your own
+ * words, send your own Mailable with Confirmation::link() in it, through
+ * PublicMail::toVisitor().
+ */
+final class ConfirmAddress extends Mailable
+{
+    use Queueable, SerializesModels;
+
+    public function __construct(public string $app, public string $url, public int $hours) {}
+
+    public function build(): self
+    {
+        $message = (new MailMessage)
+            ->subject("Confirm your email address for {$this->app}")
+            ->line("Someone, we hope you, gave this address to {$this->app}. Confirm it and you're on the list.")
+            ->action('Confirm my address', $this->url)
+            ->line("The link works for {$this->hours} hours. If this wasn't you, do nothing: the address is removed and you won't hear from us again.");
+
+        return $this->subject("Confirm your email address for {$this->app}")->html((string) $message->render());
+    }
+}