create-snapify-app 0.0.0-stage → 1.1.1

package/template/server/security/totp.ts

@@ -0,0 +1,101 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/** Codes à usage unique RFC 6238 (SHA-1, 6 chiffres, 30 s) compatibles Google Authenticator, Authy, 1Password… */
+import crypto from 'crypto';
+import { sha256 } from './secrets';
+
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const STEP = 30;
+
+function base32Encode(buf: Buffer): string {
+  let bits = 0;
+  let value = 0;
+  let out = '';
+  for (const byte of buf) {
+    value = (value << 8) | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += ALPHABET[(value >>> (bits - 5)) & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += ALPHABET[(value << (5 - bits)) & 31];
+  return out;
+}
+
+function base32Decode(input: string): Buffer {
+  const clean = input.replace(/[\s=-]/g, '').toUpperCase();
+  let bits = 0;
+  let value = 0;
+  const out: number[] = [];
+  for (const ch of clean) {
+    const idx = ALPHABET.indexOf(ch);
+    if (idx === -1) continue;
+    value = (value << 5) | idx;
+    bits += 5;
+    if (bits >= 8) {
+      out.push((value >>> (bits - 8)) & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+}
+
+export const generateTotpSecret = () => base32Encode(crypto.randomBytes(20));
+
+function hotp(secret: string, counter: number): string {
+  const buf = Buffer.alloc(8);
+  buf.writeBigUInt64BE(BigInt(counter));
+  const mac = crypto.createHmac('sha1', base32Decode(secret)).update(buf).digest();
+  const offset = mac[mac.length - 1] & 15;
+  const code = (mac.readUInt32BE(offset) & 0x7fffffff) % 1_000_000;
+  return code.toString().padStart(6, '0');
+}
+
+/** Pas de 30 s accepté pour `code` (tolérance ±1 pas), ou `null`. */
+export function verifyTotp(secret: string, code: string, now = Date.now()): number | null {
+  const clean = code.replace(/\s/g, '');
+  if (!/^\d{6}$/.test(clean)) return null;
+  const step = Math.floor(now / 1000 / STEP);
+  for (const d of [0, -1, 1]) {
+    const expected = hotp(secret, step + d);
+    if (crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(clean))) return step + d;
+  }
+  return null;
+}
+
+/** Un même code ne peut servir qu'une fois par compte. */
+const lastStepByUser = new Map<string, number>();
+
+export function consumeTotp(userId: string, secret: string, code: string): boolean {
+  const step = verifyTotp(secret, code);
+  if (step === null) return false;
+  if ((lastStepByUser.get(userId) ?? -1) >= step) return false;
+  lastStepByUser.set(userId, step);
+  return true;
+}
+
+export function otpauthUrl(secret: string, account: string, issuer: string): string {
+  const label = encodeURIComponent(`${issuer}:${account}`);
+  return `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=${STEP}`;
+}
+
+const normalizeRecovery = (code: string) => code.replace(/[\s-]/g, '').toLowerCase();
+
+export function generateRecoveryCodes(count = 10): { plain: string[]; hashes: string[] } {
+  const plain = Array.from({ length: count }, () => {
+    const raw = crypto.randomBytes(5).toString('hex');
+    return `${raw.slice(0, 5)}-${raw.slice(5)}`;
+  });
+  return { plain, hashes: plain.map((c) => sha256(normalizeRecovery(c))) };
+}
+
+/** Index du code de secours correspondant dans `hashes`, ou -1. */
+export function matchRecoveryCode(hashes: string[], code: string): number {
+  const h = sha256(normalizeRecovery(code));
+  return hashes.indexOf(h);
+}

package/template/server/superadmin/analytics.ts

@@ -0,0 +1,109 @@
+/**
+ * Snapify — analytics landing / plateforme
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ */
+import fs from 'fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { resolveGeoFromIp } from '../geoip';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const FILE = path.resolve(__dirname, '../../data/landing-analytics.jsonl');
+
+/** IPs exclues du tracking superadmin (équipe / tests / bureaux). */
+export const VISIT_IP_BLOCKLIST = new Set(['197.17.86.133']);
+
+export type VisitHit = {
+  ts: string;
+  path: string;
+  ip: string;
+  country?: string;
+  city?: string;
+  ua?: string;
+  ref?: string;
+};
+
+function normalizeIp(ip: string): string {
+  const s = (ip || '').trim();
+  // IPv4-mapped IPv6 ::ffff:x.x.x.x
+  if (s.toLowerCase().startsWith('::ffff:')) return s.slice(7);
+  return s;
+}
+
+export function isVisitIpBlocked(ip: string): boolean {
+  return VISIT_IP_BLOCKLIST.has(normalizeIp(ip));
+}
+
+async function append(hit: VisitHit) {
+  await fs.mkdir(path.dirname(FILE), { recursive: true });
+  await fs.appendFile(FILE, `${JSON.stringify(hit)}\n`);
+}
+
+export async function trackVisit(input: {
+  path: string;
+  ip: string;
+  ua?: string;
+  ref?: string;
+}) {
+  if (isVisitIpBlocked(input.ip)) return;
+  const geo = resolveGeoFromIp(input.ip);
+  await append({
+    ts: new Date().toISOString(),
+    path: input.path.slice(0, 200),
+    ip: input.ip.slice(0, 64),
+    country: geo.country,
+    city: geo.city,
+    ua: (input.ua || '').slice(0, 200),
+    ref: (input.ref || '').slice(0, 300),
+  });
+}
+
+/** Remet les compteurs à zéro (nouveau départ). */
+export async function resetVisits(): Promise<void> {
+  await fs.mkdir(path.dirname(FILE), { recursive: true });
+  await fs.writeFile(FILE, '');
+}
+
+export async function readVisits(limit = 5000): Promise<VisitHit[]> {
+  try {
+    const raw = await fs.readFile(FILE, 'utf8');
+    const lines = raw.trim().split('\n').filter(Boolean);
+    return lines
+      .slice(-limit)
+      .map((l) => {
+        try {
+          return JSON.parse(l) as VisitHit;
+        } catch {
+          return null;
+        }
+      })
+      .filter(Boolean) as VisitHit[];
+  } catch {
+    return [];
+  }
+}
+
+export async function visitStats() {
+  const hits = (await readVisits(20_000)).filter((h) => !isVisitIpBlocked(h.ip));
+  const now = Date.now();
+  const day = 24 * 3600 * 1000;
+  const last24 = hits.filter((h) => now - Date.parse(h.ts) < day);
+  const last7 = hits.filter((h) => now - Date.parse(h.ts) < 7 * day);
+  const byPath = new Map<string, number>();
+  const byCountry = new Map<string, number>();
+  for (const h of last7) {
+    byPath.set(h.path, (byPath.get(h.path) || 0) + 1);
+    const c = h.country || '??';
+    byCountry.set(c, (byCountry.get(c) || 0) + 1);
+  }
+  const topPaths = [...byPath.entries()].sort((a, b) => b[1] - a[1]).slice(0, 12);
+  const topCountries = [...byCountry.entries()].sort((a, b) => b[1] - a[1]).slice(0, 12);
+  return {
+    total: hits.length,
+    last24h: last24.length,
+    last7d: last7.length,
+    topPaths: topPaths.map(([path, n]) => ({ path, n })),
+    topCountries: topCountries.map(([country, n]) => ({ country, n })),
+    recent: hits.slice(-30).reverse(),
+  };
+}

package/template/server/superadmin/auth.ts

@@ -0,0 +1,92 @@
+/**
+ * Snapify — auth superadmin (/hamdisup90)
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ */
+import crypto from 'crypto';
+import type { Request, Response, NextFunction } from 'express';
+import { HttpError } from '../http';
+import { safeEqualStr } from '../security/secrets';
+
+const COOKIE = 'snapify_sa';
+const sessions = new Map<string, { exp: number }>();
+
+function secret() {
+  return process.env.SUPERADMIN_SECRET || process.env.ADMIN_JWT_SECRET || 'snapify-sa-dev';
+}
+
+export function superadminCreds() {
+  return {
+    username: (process.env.SUPERADMIN_USERNAME || 'hamdisup90').toLowerCase(),
+    /** Vide si non défini — pas de mot de passe par défaut (login impossible). */
+    password: process.env.SUPERADMIN_PASSWORD || '',
+  };
+}
+
+function sign(sid: string, exp: number) {
+  const payload = Buffer.from(JSON.stringify({ sid, exp })).toString('base64url');
+  const sig = crypto.createHmac('sha256', secret()).update(payload).digest('base64url');
+  return `${payload}.${sig}`;
+}
+
+function verify(token: string): { sid: string; exp: number } | null {
+  const [payload, sig] = token.split('.');
+  if (!payload || !sig) return null;
+  const expected = crypto.createHmac('sha256', secret()).update(payload).digest('base64url');
+  if (!safeEqualStr(sig, expected)) return null;
+  try {
+    const data = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as { sid: string; exp: number };
+    if (!data.sid || !data.exp || data.exp < Date.now()) return null;
+    if (!sessions.has(data.sid)) return null;
+    return data;
+  } catch {
+    return null;
+  }
+}
+
+export function createSuperadminSession(res: Response) {
+  const sid = crypto.randomBytes(24).toString('hex');
+  const exp = Date.now() + 12 * 3600 * 1000;
+  sessions.set(sid, { exp });
+  const token = sign(sid, exp);
+  res.cookie(COOKIE, token, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    maxAge: 12 * 3600 * 1000,
+    path: '/',
+  });
+}
+
+function readCookie(req: Request): string | null {
+  const header = req.headers.cookie || '';
+  const match = header.match(new RegExp(`(?:^|;\\s*)${COOKIE}=([^;]+)`));
+  return match ? decodeURIComponent(match[1]) : null;
+}
+
+export function destroySuperadminSession(req: Request, res: Response) {
+  const token = readCookie(req) || '';
+  const data = verify(token);
+  if (data) sessions.delete(data.sid);
+  res.clearCookie(COOKIE, { path: '/' });
+}
+
+export function requireSuperadmin(req: Request, _res: Response, next: NextFunction) {
+  const token = readCookie(req) || '';
+  const data = verify(token);
+  if (!data) return next(new HttpError(401, 'Non authentifié'));
+  (req as Request & { superadmin?: boolean }).superadmin = true;
+  next();
+}
+
+export function isSuperadminAuthed(req: Request): boolean {
+  return !!verify(readCookie(req) || '');
+}
+
+export function loginSuperadmin(username: string, password: string): boolean {
+  const c = superadminCreds();
+  if (!c.password) return false;
+  return (
+    safeEqualStr(username.trim().toLowerCase(), c.username) &&
+    safeEqualStr(password, c.password)
+  );
+}

package/template/server/superadmin/backlinksCatalog.ts

@@ -0,0 +1,210 @@
+/**
+ * Catalogue de cibles backlinks légitimes (annuaires, startups, logiciels, médias).
+ * À soumettre manuellement ou via outreach — pas de spam automatisé.
+ */
+export type BacklinkCategory =
+  | 'directory'
+  | 'startup'
+  | 'software'
+  | 'chamber'
+  | 'media'
+  | 'community'
+  | 'partner'
+  | 'social'
+  | 'devtools'
+  | 'marketplace'
+  | 'education';
+
+export type BacklinkLead = {
+  id: string;
+  name: string;
+  url: string;
+  market: 'tn' | 'fr' | 'intl';
+  category: BacklinkCategory;
+  submitHint: string;
+  priority: 1 | 2 | 3;
+};
+
+export type BacklinkStatus = 'todo' | 'in_progress' | 'submitted' | 'live' | 'rejected' | 'skipped';
+
+export type BacklinkTrack = {
+  id: string;
+  status: BacklinkStatus;
+  liveUrl?: string;
+  note?: string;
+  updatedAt?: string;
+};
+
+function L(
+  id: string,
+  name: string,
+  url: string,
+  market: BacklinkLead['market'],
+  category: BacklinkCategory,
+  submitHint: string,
+  priority: 1 | 2 | 3 = 2
+): BacklinkLead {
+  return { id, name, url, market, category, submitHint, priority };
+}
+
+/** ~120 cibles réelles / semi-réelles pour outreach TN + FR + intl */
+export const BACKLINK_CATALOG: BacklinkLead[] = [
+  // —— Tunisie
+  L('tn-novalabs', 'NOVALABS (éditeur)', 'https://novalabs.tn', 'tn', 'partner', 'Lien footer / page produits vers snapify.tn', 1),
+  L('tn-community', 'Community Snapify', 'https://community.snapify.tn', 'tn', 'community', 'Maillage interne fort', 1),
+  L('tn-marketplace', 'Marketplace Snapify', 'https://marketplace.snapify.tn', 'tn', 'marketplace', 'Maillage interne', 1),
+  L('tn-pagesjaunes', 'Pages Jaunes Tunisie', 'https://www.pagesjaunes.tn', 'tn', 'directory', 'Créer fiche entreprise NOVALABS / Snapify', 1),
+  L('tn-tunisie-annuaire', 'Annuaire Tunisie', 'https://www.tunisie-annuaire.com', 'tn', 'directory', 'Soumettre site web / CMS', 2),
+  L('tn-tuniscope', 'Tuniscope', 'https://www.tuniscope.com', 'tn', 'media', 'Pitch article « CMS tunisien »', 1),
+  L('tn-webmanager', 'Webmanagercenter', 'https://www.webmanagercenter.com', 'tn', 'media', 'Communiqué lancement Snapify', 1),
+  L('tn-businessnews', 'Business News', 'https://www.businessnews.com.tn', 'tn', 'media', 'Angle startup tech TN', 1),
+  L('tn-tekiano', 'Tekiano', 'https://www.tekiano.com', 'tn', 'media', 'Article produit tech', 2),
+  L('tn-kapitalis', 'Kapitalis', 'https://kapitalis.com', 'tn', 'media', 'Édito digital Tunisie', 2),
+  L('tn-ilboursa', 'Ilboursa', 'https://www.ilboursa.com', 'tn', 'media', 'Fiche entreprise / actu', 2),
+  L('tn-leaders', 'Leaders', 'https://www.leaders.com.tn', 'tn', 'media', 'Portrait fondateur / produit', 2),
+  L('tn-africanmanager', 'African Manager', 'https://africanmanager.com', 'tn', 'media', 'Startup Maghreb', 2),
+  L('tn-startup', 'Startup Tunisia', 'https://www.startuptunisia.com', 'tn', 'startup', 'Profil startup + lien site', 1),
+  L('tn-impact', 'Impact Partner / écosystème', 'https://www.impactpartner.co', 'tn', 'startup', 'Annuaire startups TN', 2),
+  L('tn-wis', 'Wiki Startups TN', 'https://www.wikistartup.tn', 'tn', 'startup', 'Fiche startup', 2),
+  L('tn-ccit', 'CCIT Tunis', 'https://www.ccit.org.tn', 'tn', 'chamber', 'Annuaire adhérents si membre', 2),
+  L('tn-conect', 'CONECT', 'https://www.conect.org.tn', 'tn', 'chamber', 'Réseau entreprises', 2),
+  L('tn-utica', 'UTICA', 'https://www.utica.org.tn', 'tn', 'chamber', 'Annuaire / actualités', 3),
+  L('tn-facebook', 'Facebook Page', 'https://www.facebook.com', 'tn', 'social', 'Page Snapify + lien site dans À propos', 1),
+  L('tn-instagram', 'Instagram', 'https://www.instagram.com', 'tn', 'social', 'Bio lien snapify.tn', 1),
+  L('tn-linkedin-co', 'LinkedIn Company', 'https://www.linkedin.com/company', 'tn', 'social', 'Page entreprise + site web', 1),
+  L('tn-linkedin-posts', 'LinkedIn Posts', 'https://www.linkedin.com', 'tn', 'social', 'Posts avec URL utm', 1),
+  L('tn-youtube', 'YouTube', 'https://www.youtube.com', 'tn', 'social', 'Chaîne + lien description', 2),
+  L('tn-tiktok', 'TikTok Business', 'https://www.tiktok.com', 'tn', 'social', 'Lien bio', 3),
+  L('tn-github-org', 'GitHub Org', 'https://github.com', 'tn', 'devtools', 'Org NOVALABS + README lien site', 1),
+  L('tn-flouci', 'Flouci partenaires', 'https://flouci.com', 'tn', 'partner', 'Demander listing partenaires paiement', 2),
+  L('tn-hostinger-aff', 'Avis hébergeurs TN', 'https://www.hostinger.fr', 'tn', 'directory', 'Profil / blog guest si possible', 3),
+  L('tn-ovh-community', 'Communauté OVH', 'https://community.ovh.com', 'tn', 'community', 'Tutoriel install Snapify', 2),
+  L('tn-reddit-tunisia', 'Reddit r/Tunisia', 'https://www.reddit.com/r/Tunisia', 'tn', 'community', 'Post soft (pas spam)', 3),
+  L('tn-meetup', 'Meetup Tunis Tech', 'https://www.meetup.com', 'tn', 'community', 'Événement + lien', 3),
+  L('tn-producthunt-alt', 'BetaList', 'https://betalist.com', 'tn', 'startup', 'Soumettre Snapify', 2),
+  L('tn-crunchbase', 'Crunchbase', 'https://www.crunchbase.com', 'tn', 'startup', 'Fiche organisation', 1),
+  L('tn-pitchbook', 'Dealroom / similar', 'https://dealroom.co', 'tn', 'startup', 'Profil startup', 3),
+  L('tn-angellist', 'Wellfound', 'https://wellfound.com', 'tn', 'startup', 'Profil startup', 2),
+  L('tn-softonic-fr', 'AlternativeTo', 'https://alternativeto.net', 'tn', 'software', 'Ajouter Snapify vs WordPress', 1),
+  L('tn-slant', 'Slant.co', 'https://www.slant.co', 'tn', 'software', 'Alternative WordPress', 2),
+  L('tn-stackshare', 'StackShare', 'https://stackshare.io', 'tn', 'devtools', 'Stack Snapify', 2),
+  L('tn-devto', 'DEV.to', 'https://dev.to', 'tn', 'community', 'Article technique + lien', 1),
+  L('tn-hashnode', 'Hashnode', 'https://hashnode.com', 'tn', 'community', 'Blog eng + lien', 2),
+  L('tn-medium', 'Medium', 'https://medium.com', 'tn', 'media', 'Publication « CMS Tunisie »', 2),
+  L('tn-quora', 'Quora FR', 'https://fr.quora.com', 'tn', 'community', 'Réponses CMS / WordPress', 2),
+  L('tn-wikipedia-talk', 'Wikidata', 'https://www.wikidata.org', 'tn', 'directory', 'Entité Soft si notoriété', 3),
+
+  // —— France
+  L('fr-snapify', 'Snapify.fr (self)', 'https://snapify.fr', 'fr', 'partner', 'Maillage TN↔FR', 1),
+  L('fr-pagesjaunes', 'PagesJaunes.fr', 'https://www.pagesjaunes.fr', 'fr', 'directory', 'Fiche entreprise (SIRET si FR)', 1),
+  L('fr-societe', 'Societe.com', 'https://www.societe.com', 'fr', 'directory', 'Fiche si société FR', 2),
+  L('fr-kompass', 'Kompass', 'https://fr.kompass.com', 'fr', 'directory', 'Annuaire B2B', 2),
+  L('fr-europages', 'Europages', 'https://www.europages.fr', 'fr', 'directory', 'Fiche fournisseur digital', 2),
+  L('fr-annuaire-entreprises', 'Annuaire entreprises gouv', 'https://annuaire-entreprises.data.gouv.fr', 'fr', 'directory', 'Si SIREN FR', 2),
+  L('fr-producthunt', 'Product Hunt', 'https://www.producthunt.com', 'fr', 'startup', 'Launch Snapify', 1),
+  L('fr-betalist', 'BetaList', 'https://betalist.com', 'fr', 'startup', 'Listing startup', 1),
+  L('fr-indiehackers', 'Indie Hackers', 'https://www.indiehackers.com', 'fr', 'community', 'Produit + lien', 1),
+  L('fr-hackernews', 'Hacker News', 'https://news.ycombinator.com', 'fr', 'community', 'Show HN (qualité)', 2),
+  L('fr-alternative', 'AlternativeTo', 'https://alternativeto.net', 'fr', 'software', 'WordPress / Wix / Shopify alt', 1),
+  L('fr-g2', 'G2', 'https://www.g2.com', 'fr', 'software', 'Fiche CMS / créer profil', 1),
+  L('fr-capterra', 'Capterra', 'https://www.capterra.fr', 'fr', 'software', 'Logiciel CMS', 1),
+  L('fr-getapp', 'GetApp', 'https://www.getapp.fr', 'fr', 'software', 'Listing SaaS', 2),
+  L('fr-softwareadvice', 'Software Advice', 'https://www.softwareadvice.fr', 'fr', 'software', 'Profil CMS', 2),
+  L('fr-saasworthy', 'SaaSworthy', 'https://www.saasworthy.com', 'fr', 'software', 'Claim listing', 2),
+  L('fr-sourceforge', 'SourceForge', 'https://sourceforge.net', 'fr', 'software', 'Page projet', 2),
+  L('fr-softpedia', 'Softpedia', 'https://www.softpedia.com', 'fr', 'software', 'Soumission logiciel web', 3),
+  L('fr-toolify', 'Toolify.ai', 'https://www.toolify.ai', 'fr', 'software', 'Outil IA / CMS IA', 2),
+  L('fr-theresanaiforthat', "There's An AI", 'https://theresanaiforthat.com', 'fr', 'software', 'Catégorie website builder', 2),
+  L('fr-futurepedia', 'Futurepedia', 'https://www.futurepedia.io', 'fr', 'software', 'AI tools directory', 2),
+  L('fr-aitoolsdirectory', 'AI Tools Directory', 'https://aitoolsdirectory.com', 'fr', 'software', 'Soumettre Snapify', 3),
+  L('fr-saasaitools', 'SaaS AI Tools', 'https://saasaitools.com', 'fr', 'software', 'Listing', 3),
+  L('fr-lafrenchtech', 'La French Tech', 'https://lafrenchtech.com', 'fr', 'startup', 'Écosystème / map si éligible', 2),
+  L('fr-bpifrance', 'Bpifrance / Excellence', 'https://www.bpifrance.fr', 'fr', 'startup', 'Visibilité si programme', 3),
+  L('fr-maddyness', 'Maddyness', 'https://www.maddyness.com', 'fr', 'media', 'Pitch startup', 1),
+  L('fr-frenchweb', 'FrenchWeb', 'https://www.frenchweb.fr', 'fr', 'media', 'Actu tech', 2),
+  L('fr-siecledigital', 'Siècle Digital', 'https://siecledigital.fr', 'fr', 'media', 'Article produit', 2),
+  L('fr-journaldunet', 'Journal du Net', 'https://www.journaldunet.com', 'fr', 'media', 'Dossier CMS', 1),
+  L('fr-01net', '01net Pro', 'https://www.01net.com', 'fr', 'media', 'Test / actu', 2),
+  L('fr-lesechos', 'Les Echos Start', 'https://start.lesechos.fr', 'fr', 'media', 'Startup pitch', 2),
+  L('fr-blogdumoderateur', 'Blog du Modérateur', 'https://www.blogdumoderateur.com', 'fr', 'media', 'Outil web / CMS', 1),
+  L('fr-presse-citron', 'Presse-citron', 'https://www.presse-citron.net', 'fr', 'media', 'Actu tech grand public', 2),
+  L('fr-numerama', 'Numerama', 'https://www.numerama.com', 'fr', 'media', 'Pitch sélectif', 3),
+  L('fr-appvizer', 'Appvizer', 'https://www.appvizer.fr', 'fr', 'software', 'Fiche logiciel CMS', 1),
+  L('fr-toolnavigator', 'Tool Navigator', 'https://www.toolnavigator.com', 'fr', 'software', 'Directory outils', 3),
+  L('fr-saashub', 'SaaSHub', 'https://www.saashub.com', 'fr', 'software', 'Alternatives WP', 2),
+  L('fr-openstartup', 'Open Startup', 'https://openstartuplist.com', 'fr', 'startup', 'Liste startups transparentes', 3),
+  L('fr-betapage', 'BetaPage', 'https://betapage.co', 'fr', 'startup', 'Launch listing', 2),
+  L('fr-startupbuffer', 'Startup Buffer', 'https://startupbuffer.com', 'fr', 'startup', 'Soumission', 3),
+  L('fr-launchingnext', 'Launching Next', 'https://www.launchingnext.com', 'fr', 'startup', 'Feature produit', 3),
+  L('fr-sideprojectors', 'SideProjectors', 'https://www.sideprojectors.com', 'fr', 'community', 'Projet + lien', 3),
+  L('fr-reddit-saas', 'Reddit r/SaaS', 'https://www.reddit.com/r/SaaS', 'fr', 'community', 'Feedback post (no spam)', 2),
+  L('fr-reddit-webdev', 'Reddit r/webdev', 'https://www.reddit.com/r/webdev', 'fr', 'community', 'Showoff / Ask', 2),
+  L('fr-reddit-entrepreneur', 'Reddit r/Entrepreneur', 'https://www.reddit.com/r/Entrepreneur', 'fr', 'community', 'Story lancement', 3),
+  L('fr-facebook-groups', 'Groupes FB freelances FR', 'https://www.facebook.com/groups', 'fr', 'community', 'Partage utile (règles groupe)', 2),
+  L('fr-linkedin', 'LinkedIn FR', 'https://www.linkedin.com', 'fr', 'social', 'Page + articles', 1),
+  L('fr-twitter', 'X / Twitter', 'https://x.com', 'fr', 'social', 'Bio + threads', 1),
+  L('fr-dribbble', 'Dribbble', 'https://dribbble.com', 'fr', 'community', 'Shots UI thèmes Snapify', 2),
+  L('fr-behance', 'Behance', 'https://www.behance.net', 'fr', 'community', 'Projet design thèmes', 2),
+  L('fr-github', 'GitHub Awesome lists', 'https://github.com/sindresorhus/awesome', 'fr', 'devtools', 'PR awesome-cms / awesome-selfhosted si éligible', 2),
+  L('fr-npm', 'npm (si package)', 'https://www.npmjs.com', 'fr', 'devtools', 'Package SDK + README', 2),
+  L('fr-dockerhub', 'Docker Hub', 'https://hub.docker.com', 'fr', 'devtools', 'Image install si publiée', 2),
+  L('fr-stackoverflow', 'Stack Overflow', 'https://stackoverflow.com', 'fr', 'community', 'Tag / réponses + profil lien', 2),
+  L('fr-cma', 'CCI France', 'https://www.cci.fr', 'fr', 'chamber', 'Annuaire si adhérent', 3),
+  L('fr-apecita', 'Annuaires métiers digitaux', 'https://www.apec.fr', 'fr', 'directory', 'Visibilité employeur', 3),
+
+  // —— International software directories (volume)
+  L('intl-producthunt', 'Product Hunt (intl)', 'https://www.producthunt.com', 'intl', 'startup', 'Launch day', 1),
+  L('intl-alternativeto', 'AlternativeTo', 'https://alternativeto.net', 'intl', 'software', 'Multi-alternatives', 1),
+  L('intl-g2', 'G2 Crowd', 'https://www.g2.com', 'intl', 'software', 'CMS category', 1),
+  L('intl-capterra', 'Capterra EN', 'https://www.capterra.com', 'intl', 'software', 'Listing EN', 1),
+  L('intl-getapp', 'GetApp EN', 'https://www.getapp.com', 'intl', 'software', 'Listing', 2),
+  L('intl-trustpilot', 'Trustpilot', 'https://www.trustpilot.com', 'intl', 'directory', 'Page avis entreprise', 2),
+  L('intl-sitejabber', 'Sitejabber', 'https://www.sitejabber.com', 'intl', 'directory', 'Profil', 3),
+  L('intl-saashub', 'SaaSHub', 'https://www.saashub.com', 'intl', 'software', 'Alternatives', 2),
+  L('intl-stackshare', 'StackShare', 'https://stackshare.io', 'intl', 'devtools', 'Tool page', 2),
+  L('intl-slashdot', 'Slashdot Software', 'https://slashdot.org/software', 'intl', 'software', 'Claim listing', 2),
+  L('intl-cbs', 'CBS Interactive / ZDNET pitch', 'https://www.zdnet.com', 'intl', 'media', 'Pitch rare', 3),
+  L('intl-devhunt', 'DevHunt', 'https://devhunt.org', 'intl', 'startup', 'Launch tools', 2),
+  L('intl-microlaunch', 'MicroLaunch', 'https://microlaunch.net', 'intl', 'startup', 'Launch', 2),
+  L('intl-uneed', 'Uneed', 'https://www.uneed.best', 'intl', 'startup', 'Daily tools', 2),
+  L('intl-open-launch', 'Open-Launch', 'https://open-launch.com', 'intl', 'startup', 'Listing', 3),
+  L('intl-fazier', 'Fazier', 'https://fazier.com', 'intl', 'startup', 'Directory', 3),
+  L('intl-twelve', 'Twelve.tools', 'https://twelve.tools', 'intl', 'software', 'Submit tool', 3),
+  L('intl-toolfolio', 'Toolfolio', 'https://toolfolio.io', 'intl', 'software', 'Submit', 3),
+  L('intl-dang', 'Dang.ai', 'https://dang.ai', 'intl', 'software', 'AI tools', 3),
+  L('intl-topai', 'TopAI.tools', 'https://topai.tools', 'intl', 'software', 'Submit', 3),
+  L('intl-aitools', 'AITools.fyi', 'https://aitools.fyi', 'intl', 'software', 'Submit', 3),
+  L('intl-startupstash', 'Startup Stash', 'https://startupstash.com', 'intl', 'startup', 'Resources list', 2),
+  L('intl-angel', 'Wellfound EN', 'https://wellfound.com', 'intl', 'startup', 'Company profile', 2),
+  L('intl-crunchbase', 'Crunchbase EN', 'https://www.crunchbase.com', 'intl', 'startup', 'Organization', 1),
+  L('intl-owler', 'Owler', 'https://www.owler.com', 'intl', 'directory', 'Company page', 3),
+  L('intl-clutch', 'Clutch.co', 'https://clutch.co', 'intl', 'directory', 'Si agence services', 2),
+  L('intl-goodfirms', 'GoodFirms', 'https://www.goodfirms.co', 'intl', 'directory', 'Software listing', 2),
+  L('intl-manifest', 'The Manifest', 'https://themanifest.com', 'intl', 'directory', 'Listing', 3),
+  L('intl-designrush', 'DesignRush', 'https://www.designrush.com', 'intl', 'directory', 'CMS / web agencies', 2),
+  L('intl-sortlist', 'Sortlist', 'https://www.sortlist.com', 'intl', 'directory', 'Agence digital', 2),
+  L('intl-youtube', 'YouTube Intl', 'https://www.youtube.com', 'intl', 'social', 'Demo EN/FR', 1),
+  L('intl-github', 'GitHub', 'https://github.com', 'intl', 'devtools', 'Public repo / discussions', 1),
+  L('intl-gitlab', 'GitLab', 'https://gitlab.com', 'intl', 'devtools', 'Mirror + README', 3),
+  L('intl-docker', 'Docker Hub', 'https://hub.docker.com', 'intl', 'devtools', 'Official image', 2),
+  L('intl-npm', 'npm', 'https://www.npmjs.com', 'intl', 'devtools', 'cursor-sdk / snapify sdk', 2),
+  L('intl-pypi', 'PyPI (si sdk py)', 'https://pypi.org', 'intl', 'devtools', 'Package + home page', 3),
+  L('intl-chrome', 'Chrome Web Store', 'https://chrome.google.com/webstore', 'intl', 'devtools', 'Si extension future', 3),
+  L('intl-vscode', 'VS Code Marketplace', 'https://marketplace.visualstudio.com', 'intl', 'devtools', 'Si extension', 3),
+  L('intl-wordpress-alt-blogs', 'Blogs « best WordPress alternatives 2026 »', 'https://www.google.com/search?q=best+wordpress+alternatives+2026', 'intl', 'media', 'Outreach guest / inclusion listicles', 1),
+  L('intl-cms-comparison', 'CMS comparison sites', 'https://www.google.com/search?q=best+headless+cms+OR+wordpress+alternative', 'intl', 'media', 'Pitch inclusion', 1),
+];
+
+export function catalogById(): Map<string, BacklinkLead> {
+  return new Map(BACKLINK_CATALOG.map((l) => [l.id, l]));
+}
+
+export function catalogStats() {
+  const byMarket = { tn: 0, fr: 0, intl: 0 };
+  const byCat: Record<string, number> = {};
+  for (const l of BACKLINK_CATALOG) {
+    byMarket[l.market]++;
+    byCat[l.category] = (byCat[l.category] || 0) + 1;
+  }
+  return { total: BACKLINK_CATALOG.length, byMarket, byCat };
+}