restaurant-kit 0.1.0

package/dist/types/worker/menuStorage.d.ts

@@ -0,0 +1,94 @@
+export type R2Object = {
+    readonly body: ReadableStream | null;
+    readonly httpEtag: string;
+    readonly writeHttpMetadata: (headers: Headers) => void;
+};
+export type R2PutOptions = {
+    readonly httpMetadata?: Record<string, string>;
+    /** R2 conditional write: the put is skipped (returns null) unless the stored etag matches. */
+    readonly onlyIf?: {
+        readonly etagMatches?: string;
+    };
+};
+export type R2PutResult = {
+    readonly httpEtag: string;
+};
+export type R2ListedObject = {
+    readonly key: string;
+    readonly size: number;
+    readonly uploaded: Date;
+};
+export type R2Bucket = {
+    readonly get: (key: string) => Promise<R2Object | null>;
+    readonly put: (key: string, value: string | ArrayBuffer | ReadableStream, options?: R2PutOptions) => Promise<R2PutResult | null | undefined | unknown>;
+    readonly delete: (key: string) => Promise<void>;
+    readonly list?: (options: {
+        readonly prefix: string;
+        readonly limit?: number;
+    }) => Promise<{
+        readonly objects: readonly R2ListedObject[];
+    }>;
+};
+export type MenuBackup = {
+    readonly key: string;
+    /** ISO timestamp of the publish that this backup preceded. */
+    readonly publishedAt: string;
+    readonly size: number;
+};
+export type RestoreSource = {
+    readonly kind: "published";
+} | {
+    readonly kind: "backup";
+    readonly key: string;
+};
+export type RestoreDraftResult = {
+    readonly status: "restored";
+    readonly etag: string | null;
+} | {
+    readonly status: "not-found";
+} | {
+    readonly status: "invalid-key";
+};
+/** Browser-reported MIME types accepted for menu images; anything else is rejected with 415. */
+export declare const allowedImageTypes: ReadonlySet<string>;
+export declare const maxImageUploadBytes: number;
+export type PublishResult = {
+    readonly status: "no-draft";
+} | {
+    readonly status: "published";
+    readonly backupKey: string | null;
+};
+export type DraftRecord = {
+    readonly menu: unknown;
+    /** Quoted HTTP etag of the stored draft object, for If-Match round trips. */
+    readonly etag: string | null;
+};
+export type SaveDraftResult = {
+    readonly status: "saved";
+    readonly etag: string | null;
+} | {
+    readonly status: "conflict";
+};
+export type MenuStorage = {
+    readonly getPublished: () => Promise<unknown | null>;
+    readonly getDraft: () => Promise<DraftRecord | null>;
+    readonly getAsset: (key: string) => Promise<R2Object | null>;
+    /** With `ifMatch`, the write only lands when the stored draft still carries that etag. */
+    readonly saveDraft: (menu: object, options?: {
+        readonly ifMatch?: string | null;
+    }) => Promise<SaveDraftResult>;
+    readonly publishDraft: () => Promise<PublishResult>;
+    readonly uploadImage: (file: File) => Promise<{
+        key: string;
+    }>;
+    readonly deleteImage: (key: string) => Promise<boolean>;
+    /** Backups written by publishDraft, newest first. */
+    readonly listBackups: () => Promise<readonly MenuBackup[]>;
+    /** Overwrites the draft with the published menu or one of its backups. */
+    readonly restoreDraft: (source: RestoreSource) => Promise<RestoreDraftResult>;
+};
+/** `published-2026-07-02T12-30-00-000Z.json` → `2026-07-02T12:30:00.000Z`; null when the key is not ours. */
+export declare function backupTimestampFromKey(key: string): string | null;
+/** HTTP etags arrive quoted (and possibly weak); R2's `etagMatches` wants the bare value. */
+export declare function normalizeEtag(etag: string): string;
+export declare function createMenuStorage(bucket: R2Bucket, restaurantId: string): MenuStorage;

package/dist/utils.js

@@ -0,0 +1,6 @@
+function o(...n) {
+  return n.filter(Boolean).join(" ");
+}
+export {
+  o as cx
+};

package/dist/worker/auth.js

@@ -0,0 +1,183 @@
+import { getAllowedOrigins as N } from "./http.js";
+const f = "rk_admin_session", A = "pbkdf2-sha256", b = 1e5, O = 1e6, D = 336, y = "owner", d = "v1", c = new TextEncoder(), T = new TextDecoder();
+function g(e) {
+  const t = e.ADMIN_AUTH?.trim().toLowerCase();
+  return t === "password" || t === "access" || t === "none" ? t : e.ADMIN_PASSWORD_HASH?.trim() ? "password" : p(e).length ? "access" : "none";
+}
+function p(e) {
+  return (e.ADMIN_EMAILS ?? "").split(",").map((t) => t.trim().toLowerCase()).filter(Boolean);
+}
+function M(e) {
+  const t = Number(e.ADMIN_SESSION_TTL_HOURS), n = Number.isFinite(t) && t > 0 ? t : D;
+  return Math.round(n * 3600);
+}
+function u(e) {
+  let t = "";
+  for (const n of e) t += String.fromCharCode(n);
+  return btoa(t).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function S(e) {
+  const t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t + "=".repeat((4 - t.length % 4) % 4), r = atob(n), s = new Uint8Array(r.length);
+  for (let o = 0; o < r.length; o += 1) s[o] = r.charCodeAt(o);
+  return s;
+}
+function h(e, t) {
+  const n = Math.max(e.length, t.length);
+  let r = e.length ^ t.length;
+  for (let s = 0; s < n; s += 1)
+    r |= (e[s] ?? 0) ^ (t[s] ?? 0);
+  return r === 0;
+}
+async function w(e, t, n) {
+  const r = await crypto.subtle.importKey("raw", c.encode(e), "PBKDF2", !1, ["deriveBits"]), s = await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt: t, iterations: n }, r, 256);
+  return new Uint8Array(s);
+}
+async function W(e, t = b) {
+  if (!e) throw new Error("Password must not be empty.");
+  const n = crypto.getRandomValues(new Uint8Array(16)), r = await w(e, n, t);
+  return [A, String(t), u(n), u(r)].join("$");
+}
+function m(e) {
+  const [t, n, r, s, ...o] = e.trim().split("$");
+  if (t !== A || o.length || !r || !s) return null;
+  const i = Number(n);
+  if (!Number.isInteger(i) || i < 1 || i > O) return null;
+  try {
+    return { iterations: i, salt: S(r), hash: S(s) };
+  } catch {
+    return null;
+  }
+}
+async function R(e, t) {
+  const n = m(t);
+  if (!n || !e) return !1;
+  const r = await w(e, n.salt, n.iterations);
+  return h(r, n.hash);
+}
+async function H(e) {
+  return crypto.subtle.importKey("raw", c.encode(e), { name: "HMAC", hash: "SHA-256" }, !1, ["sign", "verify"]);
+}
+async function _(e, t) {
+  const n = await H(e), r = await crypto.subtle.sign("HMAC", n, c.encode(t));
+  return u(new Uint8Array(r));
+}
+async function P(e, t, n, r = Date.now()) {
+  const s = Math.floor(r / 1e3), o = { sub: t, iat: s, exp: s + n }, i = u(c.encode(JSON.stringify(o))), l = await _(e, `${d}.${i}`);
+  return `${d}.${i}.${l}`;
+}
+async function C(e, t, n = Date.now()) {
+  const [r, s, o, ...i] = t.split(".");
+  if (r !== d || !s || !o || i.length) return null;
+  const l = await _(e, `${r}.${s}`);
+  if (!h(c.encode(o), c.encode(l))) return null;
+  try {
+    const a = JSON.parse(T.decode(S(s)));
+    return typeof a.sub != "string" || typeof a.exp != "number" || typeof a.iat != "number" || a.exp * 1e3 <= n ? null : { sub: a.sub, iat: a.iat, exp: a.exp };
+  } catch {
+    return null;
+  }
+}
+function x(e, t) {
+  const n = e.headers.get("cookie");
+  if (!n) return null;
+  for (const r of n.split(";")) {
+    const [s, ...o] = r.trim().split("=");
+    if (s === t) return o.join("=");
+  }
+  return null;
+}
+function I(e) {
+  return new URL(e.url).protocol === "https:";
+}
+function L(e, t, n) {
+  const r = [`${f}=${t}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${n}`];
+  return I(e) && r.push("Secure"), r.join("; ");
+}
+function F(e) {
+  const t = [`${f}=`, "Path=/", "HttpOnly", "SameSite=Lax", "Max-Age=0"];
+  return I(e) && t.push("Secure"), t.join("; ");
+}
+function j(e, t) {
+  const n = e.headers.get("origin");
+  return !n || n === new URL(e.url).origin ? !0 : N(t).includes(n);
+}
+function $(e, t) {
+  const n = p(t);
+  if (!n.length) return null;
+  const r = e.headers.get("cf-access-authenticated-user-email")?.toLowerCase();
+  return !r || !n.includes(r) ? null : { user: r, strategy: "access" };
+}
+function E(e) {
+  return e.ADMIN_SESSION_SECRET ? `${e.ADMIN_SESSION_SECRET}\0${e.ADMIN_PASSWORD_HASH ?? ""}` : null;
+}
+async function k(e, t) {
+  const n = E(t), r = x(e, f);
+  if (!n || !r) return null;
+  const s = await C(n, r);
+  return s ? { user: s.sub, strategy: "password" } : null;
+}
+async function U(e, t) {
+  switch (g(t)) {
+    case "password":
+      return k(e, t);
+    case "access":
+      return $(e, t);
+    default:
+      return null;
+  }
+}
+async function J(e, t) {
+  const n = g(t), r = await U(e, t);
+  return { authenticated: !!r, strategy: n, user: r?.user ?? null };
+}
+function K(e) {
+  return e.headers.get("cf-connecting-ip") ?? "unknown";
+}
+async function G(e, t) {
+  if (g(t) !== "password")
+    return { status: "misconfigured", message: "Password sign-in is not enabled for this API." };
+  if (!t.ADMIN_PASSWORD_HASH || !m(t.ADMIN_PASSWORD_HASH))
+    return { status: "misconfigured", message: "ADMIN_PASSWORD_HASH is missing or malformed." };
+  if (!t.ADMIN_SESSION_SECRET || t.ADMIN_SESSION_SECRET.length < 16)
+    return { status: "misconfigured", message: "ADMIN_SESSION_SECRET is missing or too short (min 16 chars)." };
+  let n = "";
+  try {
+    const o = await e.json();
+    n = typeof o.password == "string" ? o.password : "";
+  } catch {
+    return { status: "bad-request", message: "Expected a JSON body with a password field." };
+  }
+  if (!n) return { status: "bad-request", message: "Password is required." };
+  if (t.LOGIN_RATE_LIMITER) {
+    const { success: o } = await t.LOGIN_RATE_LIMITER.limit({ key: `login:${K(e)}` });
+    if (!o) return { status: "rate-limited" };
+  }
+  if (!await R(n, t.ADMIN_PASSWORD_HASH)) return { status: "wrong-password" };
+  const r = M(t), s = await P(E(t) ?? t.ADMIN_SESSION_SECRET, y, r);
+  return { status: "ok", user: y, setCookie: L(e, s, r) };
+}
+export {
+  b as DEFAULT_PBKDF2_ITERATIONS,
+  A as PASSWORD_HASH_ALGORITHM,
+  f as SESSION_COOKIE_NAME,
+  S as base64UrlDecode,
+  u as base64UrlEncode,
+  F as buildClearedSessionCookie,
+  L as buildSessionCookie,
+  P as createSessionToken,
+  $ as getAccessIdentity,
+  U as getAdminIdentity,
+  J as getAdminSessionInfo,
+  p as getAllowedAdminEmails,
+  k as getPasswordSessionIdentity,
+  E as getSessionSigningKey,
+  W as hashPassword,
+  j as isTrustedOrigin,
+  G as loginWithPassword,
+  m as parsePasswordHash,
+  x as readCookie,
+  g as resolveAdminAuthStrategy,
+  h as timingSafeEqual,
+  R as verifyPassword,
+  C as verifySessionToken
+};

package/dist/worker/http.js

@@ -0,0 +1,65 @@
+class a extends Error {
+  status;
+  constructor(t, e) {
+    super(t), this.name = "RequestError", this.status = e;
+  }
+}
+const c = {
+  "content-type": "application/json; charset=utf-8"
+};
+function i(r) {
+  return (r.ALLOWED_ORIGINS ?? "").split(",").map((t) => t.trim()).filter(Boolean);
+}
+function o(r) {
+  const t = i(r), n = t.find((s) => s.startsWith("https://") && !s.includes("staging")) ?? t.find((s) => s.startsWith("https://")) ?? t[0];
+  return n ? `${n}/admin` : "/admin";
+}
+function l(r, t) {
+  const e = r.headers.get("origin"), n = i(t);
+  return !e || !n.includes(e) ? { vary: "Origin" } : {
+    "access-control-allow-origin": e,
+    "access-control-allow-credentials": "true",
+    "access-control-allow-methods": "GET, PUT, POST, DELETE, OPTIONS",
+    "access-control-allow-headers": "content-type, if-match",
+    "access-control-expose-headers": "etag",
+    vary: "Origin"
+  };
+}
+function u(r, t) {
+  const e = new URL(r.url).searchParams.get("returnTo");
+  if (!e) return o(t);
+  try {
+    const n = new URL(e);
+    if (i(t).includes(n.origin)) return n.toString();
+  } catch {
+    return o(t);
+  }
+  return o(t);
+}
+function d(r, t) {
+  return new Response(null, {
+    status: 302,
+    headers: {
+      location: r,
+      ...t
+    }
+  });
+}
+function g(r, t, e = {}) {
+  return new Response(JSON.stringify(r, null, 2), {
+    ...t,
+    headers: {
+      ...c,
+      ...e,
+      ...t?.headers
+    }
+  });
+}
+export {
+  a as RequestError,
+  i as getAllowedOrigins,
+  l as getCorsHeaders,
+  u as getSafeReturnTo,
+  g as jsonResponse,
+  d as redirectResponse
+};

package/dist/worker/menuStorage.js

@@ -0,0 +1,95 @@
+import { RequestError as p } from "./http.js";
+const d = 30, g = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/webp", "image/avif", "image/gif"]), c = 5 * 1024 * 1024;
+function r(e) {
+  const a = `restaurants/${e}`;
+  return {
+    published: `${a}/published/menu.json`,
+    draft: `${a}/draft/menu.json`,
+    backup: `${a}/backups/published-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.json`,
+    backupPrefix: `${a}/backups/`,
+    imagePrefix: `${a}/images/menu`
+  };
+}
+function m(e) {
+  const a = e.match(/published-(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z\.json$/);
+  if (!a) return null;
+  const [, t, i, n, s, l] = a;
+  return `${t}T${i}:${n}:${s}.${l}Z`;
+}
+function h(e) {
+  return e.trim().replace(/^W\//i, "").replace(/^"(.*)"$/, "$1");
+}
+function w(e) {
+  return e.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9.]+/g, "-").replace(/^-+|-+$/g, "") || "menu-image";
+}
+async function f(e, a) {
+  const t = await e.get(a);
+  return t ? { menu: await new Response(t.body).json(), etag: t.httpEtag ?? null } : null;
+}
+async function u(e, a) {
+  return (await f(e, a))?.menu ?? null;
+}
+function y(e) {
+  return !!(e && typeof e == "object" && "httpEtag" in e);
+}
+async function o(e, a, t, i) {
+  const n = await e.put(a, JSON.stringify(t, null, 2), {
+    httpMetadata: {
+      contentType: "application/json; charset=utf-8"
+    },
+    ...i ? { onlyIf: i } : {}
+  });
+  return n === null ? null : { etag: y(n) ? n.httpEtag : null };
+}
+function b(e, a) {
+  return {
+    getPublished: () => u(e, r(a).published),
+    getDraft: () => f(e, r(a).draft),
+    // Only objects under this restaurant's image prefix are servable; the draft menu, backups,
+    // and other tenants' keys must stay unreachable through /api/assets/*.
+    getAsset: async (t) => t.startsWith(`${r(a).imagePrefix}/`) ? e.get(t) : null,
+    saveDraft: async (t, i = {}) => {
+      const n = i.ifMatch ? { etagMatches: h(i.ifMatch) } : void 0, s = await o(e, r(a).draft, { ...t, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, n);
+      return s ? { status: "saved", etag: s.etag } : { status: "conflict" };
+    },
+    publishDraft: async () => {
+      const t = r(a), i = await u(e, t.draft);
+      if (!i) return { status: "no-draft" };
+      const n = await u(e, t.published);
+      return n && await o(e, t.backup, n), await o(e, t.published, { ...i, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }), { status: "published", backupKey: n ? t.backup : null };
+    },
+    uploadImage: async (t) => {
+      if (!g.has(t.type)) throw new p("Unsupported image type. Use JPEG, PNG, WebP, AVIF, or GIF.", 415);
+      if (t.size > c) throw new p(`Image is too large. Maximum size is ${c / (1024 * 1024)} MB.`, 413);
+      const i = `${r(a).imagePrefix}/${Date.now()}-${w(t.name)}`;
+      return await e.put(i, await t.arrayBuffer(), {
+        httpMetadata: {
+          contentType: t.type
+        }
+      }), { key: i };
+    },
+    deleteImage: async (t) => t.startsWith(`${r(a).imagePrefix}/`) ? (await e.delete(t), !0) : !1,
+    listBackups: async () => {
+      if (!e.list) return [];
+      const { backupPrefix: t } = r(a), { objects: i } = await e.list({ prefix: t, limit: 1e3 });
+      return i.map((n) => ({ key: n.key, publishedAt: m(n.key) ?? n.uploaded.toISOString(), size: n.size })).sort((n, s) => s.publishedAt.localeCompare(n.publishedAt)).slice(0, d);
+    },
+    restoreDraft: async (t) => {
+      const i = r(a);
+      let n = i.published;
+      if (t.kind === "backup") {
+        if (!t.key.startsWith(i.backupPrefix) || t.key.includes("..")) return { status: "invalid-key" };
+        n = t.key;
+      }
+      const s = await u(e, n);
+      return s ? { status: "restored", etag: (await o(e, i.draft, { ...s, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }))?.etag ?? null } : { status: "not-found" };
+    }
+  };
+}
+export {
+  g as allowedImageTypes,
+  m as backupTimestampFromKey,
+  b as createMenuStorage,
+  c as maxImageUploadBytes,
+  h as normalizeEtag
+};

package/dist/worker.js

@@ -0,0 +1,131 @@
+import { isTrustedOrigin as p, getAdminIdentity as l, resolveAdminAuthStrategy as w, getAdminSessionInfo as g, loginWithPassword as y, buildClearedSessionCookie as b } from "./worker/auth.js";
+import { hashPassword as $, verifyPassword as z } from "./worker/auth.js";
+import { getCorsHeaders as k, redirectResponse as T, getSafeReturnTo as S, jsonResponse as r, RequestError as d } from "./worker/http.js";
+import { createMenuStorage as E, allowedImageTypes as R } from "./worker/menuStorage.js";
+const i = { "cache-control": "no-store" };
+function A(t) {
+  if (!t || typeof t != "object") throw new d("Menu must be an object.", 400);
+  const n = t;
+  if (n.schemaVersion !== 1) throw new d("Unsupported menu schema version.", 400);
+  if (!Array.isArray(n.groups)) throw new d("Menu groups must be an array.", 400);
+  if (!Array.isArray(n.categories)) throw new d("Menu categories must be an array.", 400);
+  if (!Array.isArray(n.items)) throw new d("Menu items must be an array.", 400);
+}
+async function c(t) {
+  try {
+    return await t.json();
+  } catch {
+    throw new d("Request body must be valid JSON.", 400);
+  }
+}
+async function P(t) {
+  try {
+    return await t.formData();
+  } catch {
+    throw new d("Request body must be multipart form data.", 400);
+  }
+}
+async function M(t, n) {
+  const e = await t.getPublished();
+  return e ? r(e, {
+    headers: {
+      "cache-control": "no-store"
+    }
+  }, n) : r({ error: "Published menu not found." }, { status: 404 }, n);
+}
+async function U(t, n, e) {
+  const a = new URL(t.url), s = decodeURIComponent(a.pathname.replace(/^\/api\/assets\//, "")), o = await n.getAsset(s);
+  if (!o) return new Response("Not found", { status: 404 });
+  const u = new Headers();
+  o.writeHttpMetadata(u);
+  const h = u.get("content-type") ?? "";
+  return R.has(h) ? u.set("content-disposition", "inline") : (u.set("content-type", "application/octet-stream"), u.set("content-disposition", "attachment")), u.set("x-content-type-options", "nosniff"), u.set("etag", o.httpEtag), u.set("cache-control", "public, max-age=31536000, immutable"), Object.entries(e).forEach(([m, f]) => u.set(m, f)), new Response(o.body, { headers: u });
+}
+async function D(t, n, e) {
+  if (t.method === "GET") {
+    const a = await n.getDraft();
+    if (a)
+      return r(a.menu, { headers: { ...i, ...a.etag ? { etag: a.etag } : {} } }, e);
+    const s = await n.getPublished();
+    return s ? r(s, { headers: i }, e) : r({ error: "No draft or published menu found." }, { status: 404 }, e);
+  }
+  if (t.method === "PUT") {
+    const a = await c(t);
+    A(a);
+    const s = t.headers.get("if-match"), o = await n.saveDraft(a, { ifMatch: s && s !== "*" ? s : null });
+    return o.status === "conflict" ? r({ error: "The draft was changed elsewhere. Reload the editor to get the latest version, then redo your edits." }, { status: 412, headers: i }, e) : r({ ok: !0, etag: o.etag }, { headers: { ...i, ...o.etag ? { etag: o.etag } : {} } }, e);
+  }
+  return r({ error: "Method not allowed." }, { status: 405 }, e);
+}
+async function I(t, n) {
+  const e = await t.listBackups();
+  return r({ backups: e }, { headers: i }, n);
+}
+async function O(t, n, e) {
+  const a = await c(t);
+  let s;
+  if (a.source === "published") s = { kind: "published" };
+  else if (a.source === "backup" && typeof a.key == "string" && a.key) s = { kind: "backup", key: a.key };
+  else throw new d('Expected { source: "published" } or { source: "backup", key }.', 400);
+  const o = await n.restoreDraft(s);
+  if (o.status === "invalid-key") throw new d("Backup key is outside this restaurant's backups.", 400);
+  return o.status === "not-found" ? r({ error: s.kind === "published" ? "Nothing has been published yet." : "Backup not found." }, { status: 404 }, e) : r({ ok: !0, etag: o.etag }, { headers: { ...i, ...o.etag ? { etag: o.etag } : {} } }, e);
+}
+async function x(t, n) {
+  const e = await t.publishDraft();
+  return e.status === "no-draft" ? r({ error: "Draft menu not found." }, { status: 404 }, n) : r({ ok: !0, backupKey: e.backupKey }, void 0, n);
+}
+async function C(t, n, e) {
+  const s = (await P(t)).get("file");
+  if (!(s instanceof File)) return r({ error: "Missing file field." }, { status: 400 }, e);
+  const { key: o } = await n.uploadImage(s);
+  return r({ key: o, url: `${new URL(t.url).origin}/api/assets/${encodeURIComponent(o)}` }, void 0, e);
+}
+async function N(t, n, e) {
+  const s = new URL(t.url).searchParams.get("key");
+  return s ? await n.deleteImage(s) ? r({ ok: !0 }, void 0, e) : r({ error: "Image key is outside menu image prefix." }, { status: 400 }, e) : r({ error: "Missing key." }, { status: 400 }, e);
+}
+async function G(t, n, e) {
+  const a = await g(t, n);
+  return r(a, { headers: i }, e);
+}
+async function L(t, n, e) {
+  const a = await y(t, n);
+  switch (a.status) {
+    case "ok":
+      return r(
+        { ok: !0, user: a.user, strategy: "password" },
+        { headers: { ...i, "set-cookie": a.setCookie } },
+        e
+      );
+    case "wrong-password":
+      return r({ error: "Wrong password." }, { status: 401, headers: i }, e);
+    case "rate-limited":
+      return r({ error: "Too many sign-in attempts. Wait a minute and try again." }, { status: 429, headers: i }, e);
+    case "bad-request":
+      return r({ error: a.message }, { status: 400 }, e);
+    case "misconfigured":
+      return r({ error: a.message }, { status: 500 }, e);
+  }
+}
+function W(t, n) {
+  return r({ ok: !0 }, { headers: { ...i, "set-cookie": b(t) } }, n);
+}
+const F = {
+  async fetch(t, n) {
+    const e = new URL(t.url);
+    if (!e.pathname.startsWith("/api/") && n.ASSETS) return n.ASSETS.fetch(t);
+    const a = k(t, n), s = E(n.MENU_BUCKET, n.RESTAURANT_ID);
+    try {
+      return t.method === "OPTIONS" ? new Response(null, { status: 204, headers: a }) : t.method === "GET" && e.pathname === "/api/menu" ? await M(s, a) : t.method === "GET" && e.pathname.startsWith("/api/assets/") ? await U(t, s, a) : t.method === "GET" && e.pathname === "/api/admin/sign-in" ? T(S(t, n), a) : t.method === "GET" && e.pathname === "/api/admin/session" ? await G(t, n, a) : e.pathname.startsWith("/api/admin/") && t.method !== "GET" && !p(t, n) ? r({ error: "Cross-origin request blocked." }, { status: 403 }, a) : t.method === "POST" && e.pathname === "/api/admin/login" ? await L(t, n, a) : t.method === "POST" && e.pathname === "/api/admin/logout" ? await W(t, a) : e.pathname.startsWith("/api/admin/") && !await l(t, n) ? r({ error: "Unauthorized.", strategy: w(n) }, { status: 401, headers: i }, a) : e.pathname === "/api/admin/menu/draft" ? await D(t, s, a) : t.method === "POST" && e.pathname === "/api/admin/menu/publish" ? await x(s, a) : t.method === "GET" && e.pathname === "/api/admin/menu/backups" ? await I(s, a) : t.method === "POST" && e.pathname === "/api/admin/menu/restore" ? await O(t, s, a) : t.method === "POST" && e.pathname === "/api/admin/images" ? await C(t, s, a) : t.method === "DELETE" && e.pathname === "/api/admin/images" ? await N(t, s, a) : r({ error: "Not found." }, { status: 404 }, a);
+    } catch (o) {
+      return o instanceof d ? r({ error: o.message }, { status: o.status }, a) : (console.error("menu api error", o), r({ error: "Unexpected error." }, { status: 500 }, a));
+    }
+  }
+};
+export {
+  F as default,
+  $ as hashPassword,
+  w as resolveAdminAuthStrategy,
+  z as verifyPassword
+};

package/package.json

@@ -0,0 +1,105 @@
+{
+  "name": "restaurant-kit",
+  "version": "0.1.0",
+  "description": "Restaurant website kit for React + Cloudflare: public menu, WhatsApp or delivery-app ordering, owner-editable menu CMS, and a Worker API backed by R2.",
+  "keywords": [
+    "restaurant",
+    "menu",
+    "cms",
+    "react",
+    "cloudflare",
+    "cloudflare-workers",
+    "r2",
+    "whatsapp",
+    "admin"
+  ],
+  "author": "Hadi Al Hassan (https://hadialhassan.dev)",
+  "homepage": "https://github.com/HadiAlHassan/restaurant-kit#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/HadiAlHassan/restaurant-kit.git"
+  },
+  "bugs": {
+    "url": "https://github.com/HadiAlHassan/restaurant-kit/issues"
+  },
+  "type": "module",
+  "license": "MIT",
+  "files": [
+    "dist",
+    "scripts"
+  ],
+  "bin": {
+    "restaurant-kit-hash-password": "./scripts/hash-admin-password.mjs",
+    "restaurant-kit-bootstrap": "./scripts/bootstrap-site.mjs"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./worker": {
+      "types": "./dist/types/worker/index.d.ts",
+      "import": "./dist/worker.js"
+    },
+    "./styles.css": "./dist/restaurant-kit.css"
+  },
+  "sideEffects": [
+    "*.css"
+  ],
+  "scripts": {
+    "build": "npm run typecheck && vite build && tsc -p tsconfig.build.json --emitDeclarationOnly --noEmit false --outDir dist/types --tsBuildInfoFile node_modules/.tmp/tsconfig.types.tsbuildinfo",
+    "dev": "vite build --watch",
+    "lint": "eslint .",
+    "test": "vitest run",
+    "typecheck": "tsc -b tsconfig.build.json",
+    "prepublishOnly": "npm run lint && npm test && npm run build"
+  },
+  "dependencies": {
+    "@dnd-kit/abstract": "^0.5.0",
+    "@dnd-kit/helpers": "^0.5.0",
+    "@dnd-kit/react": "^0.5.0",
+    "@radix-ui/react-dropdown-menu": "^2.1.19",
+    "@radix-ui/react-popover": "^1.1.18",
+    "lucide-react": "^1.48.0",
+    "react-image-crop": "^11.1.2",
+    "sonner": "^2.0.7"
+  },
+  "peerDependencies": {
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "react-router-dom": "^7.18.1"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20250109.0",
+    "@eslint/js": "^9.30.0",
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/react": "^16.3.2",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "@vitejs/plugin-react": "^5.0.0",
+    "autoprefixer": "^10.6.1",
+    "eslint": "^9.30.0",
+    "eslint-plugin-react-hooks": "^5.2.0",
+    "eslint-plugin-react-refresh": "^0.4.20",
+    "globals": "^16.2.0",
+    "jsdom": "^29.1.1",
+    "postcss": "^8.5.28",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "react-router-dom": "^7.18.1",
+    "tailwindcss": "^3.4.19",
+    "typescript": "^5.8.0",
+    "typescript-eslint": "^8.35.0",
+    "vite": "^7.0.0",
+    "vitest": "4.1.9"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}