v0.2.0 — Customizable power-strip placement

Highlights

Customizable power-strip placement (#99)

Page authors can now place their own <power-strip> element anywhere in their HTML to control where the strip appears (e.g. inside a nav instead of overlapping it in the top-right). When the worker sees an author-supplied element it injects only power-strip.js and leaves the element in place.

• providers is auto-filled when omitted, so a bare <power-strip> works out of the box.
• <power-strip hidden> loads the script with no visible widget (script-only opt-out).
• <power-strip>, <power-strip></power-strip>, and <power-strip/> are all detected.
• Fully backward compatible — pages with no element still get the default top-right strip.

Admin access (#98)

Admin users now bypass the access-policy gate.

CI / tooling

• npm Trusted Publishing via OIDC, replacing NPM_TOKEN (#95)
• GitHub Actions upgraded to latest checkout/setup-node v6 (#96)

Full changelog: v0.1.0...v0.2.0

v0.1.0 — Access policy + provider entitlements

First minor release: a provider-agnostic, path-based access policy with optional provider entitlements (Patreon perks), plus a new createStartupAPI configuration factory.

⚠️ Breaking: introduces the createStartupAPI factory API and moves several settings out of env vars into factory config (see "Configuration split"). The plain export { default, UserDO, ... } re-export still works with defaults.

Highlights

• Path-based access policy (first-match-wins): bypass (raw pass-through), public, authenticated, and entitlement (a provider condition). When unconfigured, every path is public (backward compatible).
• Standalone entitlements (separate from plans/billing): Patreon active_patron / specific benefit (perk) / tier. The engine is provider-agnostic; Google/Twitch participate at the login levels only.
• Three opt-in freshness mechanisms (login-only by default): lazy TTL refresh (adds OAuth token refresh), cron re-sync (scheduled() attached only when enabled), and Patreon webhooks (HMAC-MD5 verified).
• Forwarded headers to the origin: X-StartupAPI-Authenticated, X-StartupAPI-Login-Provider, X-StartupAPI-Entitlements (+ Patreon convenience headers).
• createStartupAPI(config) factory returns the Worker handler + Durable Object classes.

Configuration split

Env vars now hold only credentials/secrets (OAuth *_CLIENT_IDs, *_SECRETs) plus per-deployment values (ORIGIN_URL, AUTH_ORIGIN, USERS_PATH, ADMIN_IDS, ENVIRONMENT). Provider scopes, Patreon campaign id, the access policy, and entitlement freshness move to the factory config.

See #94 for full details.