// @requirements REQ-PRODUCT-CF-HOST
// Host website disclosure, separate from fictional compiled document examples.
const escape=value=>String(value).replace(/[&<>"']/gu,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
export function websiteNoticeFacts(env={}, {production=false}={}){
 const read=name=>{const value=env[name];if(value===undefined)return '';if(typeof value!=='string')throw Error('Website notice fields must be text.');return value.trim();};
 const operator=read('NOTABENDA_WEBSITE_OPERATOR'),contact=read('NOTABENDA_WEBSITE_PRIVACY_CONTACT');
 if(typeof operator!=='string'||operator.length>200||/[\u0000-\u001f\u007f]/u.test(operator))throw Error('Website operator must be bounded public text.');
 let href='';
 if(contact){
  if(contact.length>2048||/[\s\u0000-\u001f\u007f]/u.test(contact))throw Error('Website privacy contact must be an email address or HTTPS URL.');
  if(/^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?\.[A-Za-z]{2,}$/u.test(contact)){const [local,domain]=contact.split('@');href='mailto:'+encodeURIComponent(local)+'@'+domain;}
  else{let url;try{url=new URL(contact);}catch{}if(!url||url.protocol!=='https:'||url.username||url.password)throw Error('Website privacy contact must be an email address or HTTPS URL.');href=url.href;}
 }
 const ready=!!operator&&!!href;
 if((operator||contact)&&!ready)throw Error('Supply both public website operator and privacy contact.');
 if(production&&!ready)throw Error('Public website build requires NOTABENDA_WEBSITE_OPERATOR and NOTABENDA_WEBSITE_PRIVACY_CONTACT. Supply reviewed public contact facts.');
 return {operator,contact,href,ready};
}
export function websiteNoticeBody(facts){return `<article class="website-notice prose"><header><p class="eyebrow">THE PROJECT WEBSITE</p><h1>Website privacy</h1><p class="lede">How this website handles requests, demo entries and browser storage.</p><p>Updated 19 October 2026.</p></header>
${facts.ready?`<section aria-labelledby="website-operator"><h2 id="website-operator">Who to contact</h2><p>This website is operated by ${escape(facts.operator)}. For questions about information handled through this website, or to ask about access, correction or deletion, contact <a href="${escape(facts.href)}">${escape(facts.contact)}</a>. Describe the example and approximate time involved; do not send session cookies or admin credentials.</p></section>`:'<p class="website-notice-draft" role="note"><strong>Local preview.</strong> The website operator and public privacy contact must be supplied before the public website build. No contact details have been invented.</p>'}
<section><h2>Reading the website</h2><p>The project homepage and guides add no analytics, advertising tags or optional cookie prompt. Fonts, images, styles and demo scripts are served from this website. The example privacy, cookie and terms documents describe their sample products; they are not this website’s privacy notice.</p><p>Cloudflare hosts the website and processes request information, including your IP address, requested URL and browser headers, to deliver and protect it. Demo creation also uses your IP address for rate limiting. The application does not put raw IP addresses or raw request headers into its demo evidence ledgers. Cloudflare’s network processing is separate from the demo database cleanup described below. See <a href="https://www.cloudflare.com/privacypolicy/">Cloudflare’s privacy policy</a>.</p></section>
<section><h2>A demo workspace for your browser</h2><p>Opening a recorded example or the demo admin creates an isolated database on Cloudflare. A first-party session cookie named <code>__Host-notabenda_demo</code> allows this browser to return to it without a password. The cookie is sent only over HTTPS, is inaccessible to page scripts and has no persistent expiry. It is used for the demo you opened, not advertising. The two website domains do not share this cookie.</p><p>The database contains seeded sample records and the actions or entries you submit in recorded examples, including choices, agreement assertions, form permissions, contract declarations and sample order requests with their exact quotes and product facts. These can include the name, email address or other fields you type. <strong>Use sample details; do not enter sensitive information.</strong> Demo actions do not create real contracts, change external services, send email, take payment or perform refunds.</p><p>The session expires after one day without use. Activity refreshes that deadline. Cleanup is scheduled at expiry and can be delayed by background execution or retries. Closing the browser or clearing the cookie removes your way back but does not immediately delete the database. Some browsers restore session cookies. Exports you download and provider-managed copies have their own lifetime; the demo cleanup does not delete those copies.</p></section>
<section><h2>Storage in interactive examples</h2><p>Some examples demonstrate saved cookie preferences, pending retries or recovery through local storage, session storage and browser databases. Their pages explain the behavior they demonstrate. Cookie-consent samples wait for permission. The storage-settings example starts two local features under declared draft exception profiles and gives you direct on/off controls. Its feature settings and objections stay in the browser database <code>notabenda-storage-exceptions-v1</code> until you clear browser storage. The reading-layout preference uses local storage and is removed when you switch it off; sample interaction counters are temporary. These sample services upload no events. You can clear this website’s browser storage through your browser settings; doing so may remove a saved choice or retry. Browser-local cleanup does not itself erase server records. The order example keeps its exact review and pending request in session storage so this tab can check the same attempt after navigation; clearing it can remove that recovery copy.</p><p>Guided setup runs in your tab. Its answers and imported files are not uploaded or saved by the setup interface. Download the private report if you want to keep those notes. Keep that report outside public assets and repositories.</p></section>
<section><h2>Using the toolkit on another website</h2><p>Notabenda does not receive records from websites that install its packages. Their operators choose their configuration, providers, hosting, retention and contact routes. This notice covers the project website only. <a href="/guide/package">Read the integration guide</a> or <a href="/examples">return to the examples</a>.</p></section></article>`;}
export const demoStorageNote='<aside lang="en" class="demo-data-notice" aria-label="About demo storage">This demo stores your entries. Use sample details. <a href="/website-privacy">Website privacy</a></aside>';