@agntcms/next 0.2.0

package/dist/handlers.mjs

@@ -0,0 +1,2473 @@
+// src/storage/fs/assets.ts
+import { createHash } from "crypto";
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
+
+// src/storage/fs/_helpers.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+var isEnoent = (err) => typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+var defaultRandomSuffix = () => Math.random().toString(36).slice(2);
+var writeAtomic = async (target, data, randomSuffix = defaultRandomSuffix) => {
+  const dir = path.dirname(target);
+  await fs.mkdir(dir, { recursive: true });
+  const tmp = path.join(
+    dir,
+    `.${path.basename(target)}.${process.pid}.${randomSuffix()}.tmp`
+  );
+  try {
+    await fs.writeFile(tmp, data);
+    await fs.rename(tmp, target);
+  } catch (err) {
+    await fs.unlink(tmp).catch(() => {
+    });
+    throw err;
+  }
+};
+var resolveUnderBucket = (bucket, key, errorLabel, errorKey = key) => {
+  const resolved = path.resolve(bucket, key);
+  const bucketWithSep = bucket.endsWith(path.sep) ? bucket : bucket + path.sep;
+  if (!resolved.startsWith(bucketWithSep)) {
+    throw new Error(`${errorLabel}: ${JSON.stringify(errorKey)}`);
+  }
+  return resolved;
+};
+
+// src/storage/fs/assets.ts
+var EXT_PATTERN = /^\.[a-z0-9_-]{1,16}$/;
+var JSON_SUFFIX = ".json";
+var extensionFrom = (filename) => {
+  const dot = filename.lastIndexOf(".");
+  if (dot < 0 || dot === filename.length - 1) return "";
+  const raw = filename.slice(dot).toLowerCase();
+  return EXT_PATTERN.test(raw) ? raw : "";
+};
+var CONTENT_TYPE_BY_EXT = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".avif": "image/avif"
+};
+var contentTypeFor = (filename) => {
+  const dot = filename.lastIndexOf(".");
+  if (dot < 0) return void 0;
+  const ext = filename.slice(dot).toLowerCase();
+  return CONTENT_TYPE_BY_EXT[ext];
+};
+var createFsAssetAdapter = (options) => {
+  const { assetsRoot, publicUrlBase } = options;
+  if (!path2.isAbsolute(assetsRoot)) {
+    throw new Error(
+      `assetsRoot must be an absolute path, got: ${JSON.stringify(assetsRoot)}`
+    );
+  }
+  if (publicUrlBase.endsWith("/")) {
+    throw new Error(
+      `publicUrlBase must not end with '/', got: ${JSON.stringify(publicUrlBase)}`
+    );
+  }
+  const rootResolved = path2.resolve(assetsRoot);
+  const rootWithSep = rootResolved.endsWith(path2.sep) ? rootResolved : rootResolved + path2.sep;
+  const upload = async (input) => {
+    const hash = createHash("sha256").update(input.bytes).digest("hex");
+    const ext = extensionFrom(input.filename);
+    const storedName = `${hash}${ext}`;
+    const target = path2.resolve(rootResolved, storedName);
+    if (!target.startsWith(rootWithSep)) {
+      throw new Error(`asset path escapes assetsRoot: ${JSON.stringify(target)}`);
+    }
+    let bytesExist = false;
+    try {
+      await fs2.stat(target);
+      bytesExist = true;
+    } catch (err) {
+      if (!isEnoent(err)) throw err;
+    }
+    if (!bytesExist) {
+      await writeAtomic(target, input.bytes);
+    }
+    return {
+      url: `${publicUrlBase}/${storedName}`,
+      filename: storedName
+    };
+  };
+  const list = async () => {
+    let names;
+    try {
+      names = await fs2.readdir(rootResolved);
+    } catch (err) {
+      if (isEnoent(err)) return [];
+      throw err;
+    }
+    const candidates = names.filter(
+      (n) => !n.startsWith(".") && !n.endsWith(JSON_SUFFIX)
+    );
+    const entries = [];
+    for (const filename of candidates) {
+      const full = path2.join(rootResolved, filename);
+      let stat3;
+      try {
+        stat3 = await fs2.stat(full);
+      } catch (err) {
+        if (isEnoent(err)) continue;
+        throw err;
+      }
+      if (!stat3.isFile()) continue;
+      entries.push({
+        filename,
+        url: `${publicUrlBase}/${filename}`,
+        contentType: contentTypeFor(filename),
+        modifiedAt: stat3.mtime
+      });
+    }
+    entries.sort((a, b) => {
+      const delta = b.modifiedAt.getTime() - a.modifiedAt.getTime();
+      if (delta !== 0) return delta;
+      return a.filename.localeCompare(b.filename);
+    });
+    return entries;
+  };
+  return { upload, list };
+};
+
+// src/storage/fs/content.ts
+import { constants as fsConstants } from "fs";
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+
+// src/domain/page.ts
+function assertValidPageMeta(obj) {
+  if (typeof obj["slug"] !== "string" || obj["slug"] === "") {
+    throw new Error("invalid page: missing or empty slug");
+  }
+  const slug = obj["slug"];
+  const rawSeo = obj["seo"];
+  if (rawSeo === null || typeof rawSeo !== "object") {
+    throw new Error(`invalid page "${slug}": seo must be an object`);
+  }
+  const seo = rawSeo;
+  if (typeof seo["title"] !== "string" || seo["title"].trim() === "") {
+    throw new Error(
+      `invalid page "${slug}": seo.title must be a non-empty string`
+    );
+  }
+  if (typeof seo["description"] !== "string" || seo["description"].trim() === "") {
+    throw new Error(
+      `invalid page "${slug}": seo.description must be a non-empty string`
+    );
+  }
+  if (seo["canonical"] !== void 0) {
+    if (typeof seo["canonical"] !== "string" || seo["canonical"].trim() === "") {
+      throw new Error(
+        `invalid page "${slug}": seo.canonical, when present, must be a non-empty string`
+      );
+    }
+  }
+}
+function assertValidPage(page) {
+  if (page === null || typeof page !== "object") {
+    throw new Error("invalid page: expected an object");
+  }
+  const obj = page;
+  if (typeof obj["slug"] !== "string" || obj["slug"] === "") {
+    throw new Error("invalid page: missing or empty slug");
+  }
+  const slug = obj["slug"];
+  if (!Array.isArray(obj["sections"])) {
+    throw new Error(`invalid page "${slug}": sections must be an array`);
+  }
+  assertValidPageMeta(obj);
+}
+
+// src/domain/form.ts
+var SubmissionsNotReadableError = class extends Error {
+  constructor(message = "submission adapter does not support reading") {
+    super(message);
+    this.name = "SubmissionsNotReadableError";
+  }
+};
+
+// src/storage/fs/content.ts
+var SLUG_PATTERN = /^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*$/;
+var assertValidSlug = (slug) => {
+  if (!SLUG_PATTERN.test(slug)) {
+    throw new Error(`invalid slug: ${JSON.stringify(slug)}`);
+  }
+};
+var deepEqual = (a, b) => {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return false;
+  if (typeof a !== "object") return false;
+  const aIsArr = Array.isArray(a);
+  const bIsArr = Array.isArray(b);
+  if (aIsArr !== bIsArr) return false;
+  if (aIsArr) {
+    const arrA = a;
+    const arrB = b;
+    if (arrA.length !== arrB.length) return false;
+    for (let i = 0; i < arrA.length; i += 1) {
+      if (!deepEqual(arrA[i], arrB[i])) return false;
+    }
+    return true;
+  }
+  const objA = a;
+  const objB = b;
+  const keysA = Object.keys(objA);
+  const keysB = Object.keys(objB);
+  if (keysA.length !== keysB.length) return false;
+  for (const key of keysA) {
+    if (!Object.prototype.hasOwnProperty.call(objB, key)) return false;
+    if (!deepEqual(objA[key], objB[key])) return false;
+  }
+  return true;
+};
+var createFsContentAdapter = (options) => {
+  const { contentRoot } = options;
+  if (!path3.isAbsolute(contentRoot)) {
+    throw new Error(
+      `contentRoot must be an absolute path, got: ${JSON.stringify(contentRoot)}`
+    );
+  }
+  const pagesDir = path3.resolve(contentRoot, "pages");
+  const draftsDir = path3.resolve(contentRoot, "drafts");
+  const historyDir = path3.resolve(contentRoot, "history");
+  const globalsDir = path3.resolve(contentRoot, "globals");
+  const globalsHistoryDir = path3.resolve(contentRoot, "history-globals");
+  const resolveSlugPath = (bucket, slug, ext) => {
+    assertValidSlug(slug);
+    return resolveUnderBucket(bucket, `${slug}${ext}`, "slug escapes storage bucket", slug);
+  };
+  const readJsonOrNull = async (filePath) => {
+    try {
+      const raw = await fs3.readFile(filePath, { encoding: "utf8" });
+      return JSON.parse(raw);
+    } catch (err) {
+      if (isEnoent(err)) return null;
+      throw err;
+    }
+  };
+  const listJsonFiles2 = async (dir) => {
+    let entries;
+    try {
+      entries = await fs3.readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      if (isEnoent(err)) return [];
+      throw err;
+    }
+    const results = [];
+    for (const entry of entries) {
+      if (entry.isFile() && entry.name.endsWith(".json")) {
+        results.push(entry.name);
+      } else if (entry.isDirectory()) {
+        const subDir = path3.join(dir, entry.name);
+        const subFiles = await listJsonFiles2(subDir);
+        for (const sub of subFiles) {
+          results.push(`${entry.name}/${sub}`);
+        }
+      }
+    }
+    return results;
+  };
+  const bucketFor = (mode) => mode === "published" ? pagesDir : draftsDir;
+  const uniqueTimestampedPath = async (baseDir, key, errorLabel) => {
+    const keyDir = resolveUnderBucket(baseDir, key, errorLabel);
+    await fs3.mkdir(keyDir, { recursive: true });
+    const base = (/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-");
+    let candidate = path3.join(keyDir, `${base}.json`);
+    let suffix = 0;
+    while (true) {
+      try {
+        await fs3.access(candidate, fsConstants.F_OK);
+        suffix += 1;
+        candidate = path3.join(keyDir, `${base}-${suffix}.json`);
+      } catch (err) {
+        if (isEnoent(err)) return candidate;
+        throw err;
+      }
+    }
+  };
+  const uniqueHistoryPath = async (slug) => {
+    assertValidSlug(slug);
+    return uniqueTimestampedPath(historyDir, slug, "slug escapes history bucket");
+  };
+  const readPage = async (slug, mode) => {
+    const filePath = resolveSlugPath(bucketFor(mode), slug, ".json");
+    return readJsonOrNull(filePath);
+  };
+  const saveDraft = async (page) => {
+    const filePath = resolveSlugPath(draftsDir, page.slug, ".json");
+    await writeAtomic(filePath, JSON.stringify(page, null, 2));
+  };
+  const listDrafts = async () => {
+    const files = await listJsonFiles2(draftsDir);
+    const results = [];
+    for (const relPath of files) {
+      const slug = relPath.slice(0, -".json".length);
+      const stat3 = await fs3.stat(path3.join(draftsDir, relPath));
+      results.push({ slug, updatedAt: stat3.mtime });
+    }
+    return results;
+  };
+  const listPages = async () => {
+    const files = await listJsonFiles2(pagesDir);
+    const results = [];
+    for (const relPath of files) {
+      const slug = relPath.slice(0, -".json".length);
+      const stat3 = await fs3.stat(path3.join(pagesDir, relPath));
+      results.push({ slug, updatedAt: stat3.mtime });
+    }
+    return results;
+  };
+  const listPageSummaries = async () => {
+    const files = await listJsonFiles2(pagesDir);
+    const results = [];
+    for (const relPath of files) {
+      const slug = relPath.slice(0, -".json".length);
+      const filePath = path3.join(pagesDir, relPath);
+      const page = await readJsonOrNull(filePath);
+      if (page === null) continue;
+      const stat3 = await fs3.stat(filePath).catch(() => null);
+      if (stat3 === null) continue;
+      const { sections: _sections, ...meta } = page;
+      void _sections;
+      results.push({ ...meta, slug, updatedAt: stat3.mtime });
+    }
+    return results;
+  };
+  const readLatestSnapshotIn = async (baseDir, key, errorLabel) => {
+    const keyDir = resolveUnderBucket(baseDir, key, errorLabel);
+    let entries;
+    try {
+      entries = await fs3.readdir(keyDir, { withFileTypes: true });
+    } catch (err) {
+      if (isEnoent(err)) return null;
+      throw err;
+    }
+    let latest = null;
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      if (!entry.name.endsWith(".json")) continue;
+      if (latest === null || entry.name > latest) latest = entry.name;
+    }
+    if (latest === null) return null;
+    return readJsonOrNull(path3.join(keyDir, latest));
+  };
+  const readLatestHistorySnapshot = async (slug) => {
+    assertValidSlug(slug);
+    return readLatestSnapshotIn(historyDir, slug, "slug escapes history bucket");
+  };
+  const publishDraft = async (slug) => {
+    const draftPath = resolveSlugPath(draftsDir, slug, ".json");
+    const pagePath = resolveSlugPath(pagesDir, slug, ".json");
+    const page = await readJsonOrNull(draftPath);
+    if (page === null) {
+      throw new Error(`no draft to publish for slug: ${JSON.stringify(slug)}`);
+    }
+    assertValidPage(page);
+    const serialised = JSON.stringify(page, null, 2);
+    const latestSnapshot = await readLatestHistorySnapshot(slug);
+    const skipHistory = latestSnapshot !== null && deepEqual(latestSnapshot, page);
+    if (!skipHistory) {
+      const historyPath = await uniqueHistoryPath(slug);
+      await writeAtomic(historyPath, serialised);
+    }
+    await writeAtomic(pagePath, serialised);
+    try {
+      await fs3.unlink(draftPath);
+    } catch (err) {
+      if (!isEnoent(err)) throw err;
+    }
+    return page;
+  };
+  const deleteDraft = async (slug) => {
+    const draftPath = resolveSlugPath(draftsDir, slug, ".json");
+    try {
+      await fs3.unlink(draftPath);
+    } catch (err) {
+      if (isEnoent(err)) {
+        throw new Error(`no draft to discard for slug: ${JSON.stringify(slug)}`);
+      }
+      throw err;
+    }
+  };
+  const deletePage = async (slug) => {
+    const publishedPath = resolveSlugPath(pagesDir, slug, ".json");
+    try {
+      await fs3.access(publishedPath);
+    } catch {
+      throw new Error(`page not found: ${slug}`);
+    }
+    await fs3.unlink(publishedPath);
+    const draftPath = resolveSlugPath(draftsDir, slug, ".json");
+    try {
+      await fs3.unlink(draftPath);
+    } catch {
+    }
+  };
+  const unpublishPage = async (slug) => {
+    const publishedPath = resolveSlugPath(pagesDir, slug, ".json");
+    const draftPath = resolveSlugPath(draftsDir, slug, ".json");
+    const published = await readJsonOrNull(publishedPath);
+    if (published === null) {
+      throw new Error(`page not found: ${slug}`);
+    }
+    const existingDraft = await readJsonOrNull(draftPath);
+    if (existingDraft === null) {
+      await writeAtomic(draftPath, JSON.stringify(published, null, 2));
+    }
+    await fs3.unlink(publishedPath);
+  };
+  const listHistory = async (slug) => {
+    assertValidSlug(slug);
+    const slugDir = resolveUnderBucket(historyDir, slug, "slug escapes history bucket");
+    let entries;
+    try {
+      entries = await fs3.readdir(slugDir, { withFileTypes: true });
+    } catch (err) {
+      if (isEnoent(err)) return [];
+      throw err;
+    }
+    const results = [];
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      if (!entry.name.endsWith(".json")) continue;
+      const timestamp = entry.name.slice(0, -".json".length);
+      const stat3 = await fs3.stat(path3.join(slugDir, entry.name));
+      results.push({ slug, timestamp, size: stat3.size });
+    }
+    results.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+    return results;
+  };
+  const readHistorySnapshot = async (slug, timestamp) => {
+    assertValidSlug(slug);
+    const slugDir = resolveUnderBucket(historyDir, slug, "slug escapes history bucket");
+    const filePath = resolveUnderBucket(
+      slugDir,
+      `${timestamp}.json`,
+      "timestamp escapes history directory",
+      timestamp
+    );
+    return readJsonOrNull(filePath);
+  };
+  const renamePage = async (fromSlug, toSlug) => {
+    assertValidSlug(fromSlug);
+    assertValidSlug(toSlug);
+    const fromPublished = resolveSlugPath(pagesDir, fromSlug, ".json");
+    const toPublished = resolveSlugPath(pagesDir, toSlug, ".json");
+    try {
+      await fs3.access(fromPublished);
+    } catch {
+      throw new Error(`page not found: ${fromSlug}`);
+    }
+    try {
+      await fs3.access(toPublished);
+      throw new Error(`target slug already exists: ${toSlug}`);
+    } catch (err) {
+      if (isEnoent(err)) {
+      } else {
+        throw err;
+      }
+    }
+    await fs3.rename(fromPublished, toPublished);
+    const fromDraft = resolveSlugPath(draftsDir, fromSlug, ".json");
+    const toDraft = resolveSlugPath(draftsDir, toSlug, ".json");
+    try {
+      await fs3.rename(fromDraft, toDraft);
+    } catch (err) {
+      if (!isEnoent(err)) throw err;
+    }
+    const fromHistory = path3.resolve(historyDir, fromSlug);
+    const toHistory = path3.resolve(historyDir, toSlug);
+    try {
+      await fs3.rename(fromHistory, toHistory);
+    } catch (err) {
+      if (!isEnoent(err)) throw err;
+    }
+  };
+  const readGlobal = async (name) => {
+    const filePath = resolveSlugPath(globalsDir, name, ".json");
+    return readJsonOrNull(filePath);
+  };
+  const uniqueGlobalHistoryPath = async (name) => {
+    assertValidSlug(name);
+    return uniqueTimestampedPath(
+      globalsHistoryDir,
+      name,
+      "name escapes globals history bucket"
+    );
+  };
+  const readLatestGlobalHistorySnapshot = async (name) => {
+    assertValidSlug(name);
+    return readLatestSnapshotIn(
+      globalsHistoryDir,
+      name,
+      "name escapes globals history bucket"
+    );
+  };
+  const saveGlobal = async (global) => {
+    const filePath = resolveSlugPath(globalsDir, global.name, ".json");
+    const serialised = JSON.stringify(global, null, 2);
+    const latestSnapshot = await readLatestGlobalHistorySnapshot(global.name);
+    const skipHistory = latestSnapshot !== null && deepEqual(latestSnapshot, global);
+    if (!skipHistory) {
+      const historyPath = await uniqueGlobalHistoryPath(global.name);
+      await writeAtomic(historyPath, serialised);
+    }
+    await writeAtomic(filePath, serialised);
+  };
+  const listGlobals = async () => {
+    let entries;
+    try {
+      entries = await fs3.readdir(globalsDir, { withFileTypes: true });
+    } catch (err) {
+      if (isEnoent(err)) return [];
+      throw err;
+    }
+    const results = [];
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      if (!entry.name.endsWith(".json")) continue;
+      const filePath = path3.join(globalsDir, entry.name);
+      const json = await readJsonOrNull(filePath);
+      if (json === null) continue;
+      const stat3 = await fs3.stat(filePath).catch(() => null);
+      if (stat3 === null) continue;
+      results.push({ name: json.name, type: json.type, updatedAt: stat3.mtime });
+    }
+    return results;
+  };
+  const deleteGlobal = async (name) => {
+    const filePath = resolveSlugPath(globalsDir, name, ".json");
+    try {
+      await fs3.unlink(filePath);
+    } catch (err) {
+      if (isEnoent(err)) {
+        throw new Error(`global not found: ${name}`);
+      }
+      throw err;
+    }
+  };
+  const listGlobalHistory = async (name) => {
+    assertValidSlug(name);
+    const nameDir = resolveUnderBucket(
+      globalsHistoryDir,
+      name,
+      "name escapes globals history bucket"
+    );
+    let entries;
+    try {
+      entries = await fs3.readdir(nameDir, { withFileTypes: true });
+    } catch (err) {
+      if (isEnoent(err)) return [];
+      throw err;
+    }
+    const results = [];
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      if (!entry.name.endsWith(".json")) continue;
+      const timestamp = entry.name.slice(0, -".json".length);
+      const stat3 = await fs3.stat(path3.join(nameDir, entry.name));
+      results.push({ name, timestamp, size: stat3.size });
+    }
+    results.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+    return results;
+  };
+  const readGlobalHistorySnapshot = async (name, timestamp) => {
+    assertValidSlug(name);
+    const nameDir = resolveUnderBucket(
+      globalsHistoryDir,
+      name,
+      "name escapes globals history bucket"
+    );
+    const filePath = resolveUnderBucket(
+      nameDir,
+      `${timestamp}.json`,
+      "timestamp escapes history directory",
+      timestamp
+    );
+    return readJsonOrNull(filePath);
+  };
+  const rollbackGlobal = async (name, timestamp) => {
+    const snapshot = await readGlobalHistorySnapshot(name, timestamp);
+    if (snapshot === null) {
+      throw new Error(`global history snapshot not found: ${name} @ ${timestamp}`);
+    }
+    await saveGlobal(snapshot);
+  };
+  return {
+    readPage,
+    saveDraft,
+    listDrafts,
+    listPages,
+    listPageSummaries,
+    publishDraft,
+    deleteDraft,
+    deletePage,
+    unpublishPage,
+    listHistory,
+    readHistorySnapshot,
+    renamePage,
+    readGlobal,
+    saveGlobal,
+    listGlobals,
+    deleteGlobal,
+    listGlobalHistory,
+    readGlobalHistorySnapshot,
+    rollbackGlobal
+  };
+};
+
+// src/storage/fs/submissions.ts
+import { randomUUID } from "crypto";
+import * as fs4 from "fs/promises";
+import * as path4 from "path";
+var DEFAULT_MAX_LIST = 500;
+var FORM_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+var parseSubmission = (raw) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  const obj = parsed;
+  if (typeof obj["formName"] !== "string") return null;
+  if (typeof obj["id"] !== "string") return null;
+  if (typeof obj["submittedAt"] !== "string") return null;
+  if (obj["payload"] === null || typeof obj["payload"] !== "object" || Array.isArray(obj["payload"])) {
+    return null;
+  }
+  return {
+    formName: obj["formName"],
+    id: obj["id"],
+    submittedAt: obj["submittedAt"],
+    payload: obj["payload"]
+  };
+};
+var assertValidFormName = (name) => {
+  if (typeof name !== "string" || !FORM_NAME_PATTERN.test(name)) {
+    throw new Error(`invalid form name: ${JSON.stringify(name)}`);
+  }
+};
+var submissionFilename = (submittedAt, id) => {
+  const ts = submittedAt.replace(/:/g, "-");
+  return `${ts}-${id}.json`;
+};
+var listJsonFiles = async (dir) => {
+  let entries;
+  try {
+    entries = await fs4.readdir(dir, { withFileTypes: true });
+  } catch (err) {
+    if (isEnoent(err)) return [];
+    throw err;
+  }
+  const results = [];
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name.endsWith(".json")) {
+      results.push(entry.name);
+    }
+  }
+  return results;
+};
+var createFsSubmissionAdapter = (options) => {
+  const { submissionsRoot } = options;
+  if (!path4.isAbsolute(submissionsRoot)) {
+    throw new Error(
+      `submissionsRoot must be an absolute path, got: ${JSON.stringify(submissionsRoot)}`
+    );
+  }
+  const maxList = options.maxList ?? DEFAULT_MAX_LIST;
+  if (!Number.isFinite(maxList) || maxList <= 0 || !Number.isInteger(maxList)) {
+    throw new Error(
+      `maxList must be a positive integer, got: ${maxList}`
+    );
+  }
+  const rootResolved = path4.resolve(submissionsRoot);
+  const rootWithSep = rootResolved.endsWith(path4.sep) ? rootResolved : rootResolved + path4.sep;
+  const formDir = (formName) => {
+    assertValidFormName(formName);
+    const dir = path4.resolve(rootResolved, formName);
+    if (!dir.startsWith(rootWithSep)) {
+      throw new Error(`form name escapes submissions root: ${JSON.stringify(formName)}`);
+    }
+    return dir;
+  };
+  const cryptoSuffix = () => randomUUID();
+  const store = async (submission) => {
+    const dir = formDir(submission.formName);
+    const filename = submissionFilename(submission.submittedAt, submission.id);
+    if (filename.includes("/") || filename.includes("\\")) {
+      throw new Error(`submission id contains path separator: ${JSON.stringify(submission.id)}`);
+    }
+    const target = path4.join(dir, filename);
+    await writeAtomic(target, JSON.stringify(submission, null, 2), cryptoSuffix);
+  };
+  const list = async (formName) => {
+    const dir = formDir(formName);
+    const files = await listJsonFiles(dir);
+    const summaries = [];
+    for (const filename of files) {
+      const stem = filename.slice(0, -".json".length);
+      const lastDash = stem.lastIndexOf("-");
+      if (lastDash < 0) continue;
+      const tsRaw = stem.slice(0, lastDash);
+      const id = stem.slice(lastDash + 1);
+      if (id === "") continue;
+      const tIndex = tsRaw.indexOf("T");
+      if (tIndex < 0) continue;
+      const datePart = tsRaw.slice(0, tIndex);
+      const timePart = tsRaw.slice(tIndex + 1).replace(/-/g, ":");
+      const submittedAt = `${datePart}T${timePart}`;
+      summaries.push({ id, submittedAt });
+    }
+    summaries.sort((a, b) => {
+      if (a.submittedAt !== b.submittedAt) {
+        return a.submittedAt < b.submittedAt ? 1 : -1;
+      }
+      if (a.id !== b.id) {
+        return a.id < b.id ? 1 : -1;
+      }
+      return 0;
+    });
+    return summaries.length > maxList ? summaries.slice(0, maxList) : summaries;
+  };
+  const read = async (formName, id) => {
+    if (id.includes("/") || id.includes("\\") || id.includes("..")) {
+      return null;
+    }
+    const dir = formDir(formName);
+    let entries;
+    try {
+      entries = (await fs4.readdir(dir)).filter((n) => n.endsWith(".json"));
+    } catch (err) {
+      if (isEnoent(err)) return null;
+      throw err;
+    }
+    const suffix = `-${id}.json`;
+    const found = entries.find((n) => n.endsWith(suffix));
+    if (!found) return null;
+    const target = path4.join(dir, found);
+    let raw;
+    try {
+      raw = await fs4.readFile(target, { encoding: "utf8" });
+    } catch (err) {
+      if (isEnoent(err)) return null;
+      throw err;
+    }
+    return parseSubmission(raw);
+  };
+  return { info: { kind: "fs" }, store, list, read };
+};
+
+// src/config/defaults-registry.ts
+var SLOT = /* @__PURE__ */ Symbol.for("@agntcms/next/default-adapter-factories");
+function holder() {
+  return globalThis;
+}
+function registerDefaultAdapterFactories(factories) {
+  holder()[SLOT] = factories;
+}
+
+// src/config/defaults.ts
+import * as path5 from "path";
+function createDefaultContentAdapter(options) {
+  const root = options?.projectRoot ?? process.cwd();
+  return createFsContentAdapter({
+    contentRoot: path5.resolve(root, "content")
+  });
+}
+function createDefaultAssetAdapter(options) {
+  const root = options?.projectRoot ?? process.cwd();
+  return createFsAssetAdapter({
+    assetsRoot: path5.resolve(root, "public/assets"),
+    publicUrlBase: "/assets"
+  });
+}
+function createDefaultSubmissionAdapter(options) {
+  const root = options?.projectRoot ?? process.cwd();
+  return createFsSubmissionAdapter({
+    submissionsRoot: path5.resolve(root, "content/submissions")
+  });
+}
+function installDefaultAdapterFactories() {
+  const factories = {
+    content: createDefaultContentAdapter,
+    asset: createDefaultAssetAdapter,
+    submission: createDefaultSubmissionAdapter
+  };
+  registerDefaultAdapterFactories(factories);
+}
+
+// src/mcp/bridge.ts
+var AgentUnreachableError = class extends Error {
+  name = "AgentUnreachableError";
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
+var TASK_ACK_TIMEOUT_MESSAGE = "Agent received the task but did not respond. Open an interactive Claude Code session in the project directory and launch it with channel notifications enabled: `claude --dangerously-load-development-channels server:agntcms`. Requirements: Claude Code v2.1.80+, signed in with claude.ai (not API key / Console), and an interactive session \u2014 `claude -p` does not deliver channel events. The flag is undocumented in `--help` because channels are still in research preview; it is still the supported mechanism (see code.claude.com/docs/en/channels-reference).";
+var createAgentBridge = (options) => {
+  const {
+    taskStore,
+    channelPort = 4819,
+    channelHost = "127.0.0.1",
+    callbackUrl = "http://localhost:3000/api/agntcms/mcp",
+    taskAckTimeoutMs = 15e3
+  } = options;
+  const fetchFn = options.fetch ?? globalThis.fetch;
+  const setTimeoutFn = options.setTimeoutFn ?? ((cb, ms) => setTimeout(cb, ms));
+  const clearTimeoutFn = options.clearTimeoutFn ?? ((handle) => {
+    clearTimeout(handle);
+  });
+  const baseUrl = `http://${channelHost}:${channelPort}`;
+  let status = "stopped";
+  const inflightTaskIds = /* @__PURE__ */ new Set();
+  let startPromise = null;
+  const failAllInflight = (reason) => {
+    const ids = Array.from(inflightTaskIds);
+    inflightTaskIds.clear();
+    for (const id of ids) {
+      try {
+        taskStore.fail(id, reason);
+      } catch {
+      }
+    }
+  };
+  const markFailed = (reason) => {
+    status = "failed";
+    startPromise = null;
+    failAllInflight(reason);
+  };
+  const doStart = async () => {
+    status = "starting";
+    try {
+      const res = await fetchFn(`${baseUrl}/health`, { method: "GET" });
+      if (!res.ok) {
+        throw new Error(`health check returned ${String(res.status)}`);
+      }
+      status = "running";
+    } catch (err) {
+      const reason = err instanceof Error ? `failed to connect to channel server: ${err.message}` : `failed to connect to channel server: ${String(err)}`;
+      markFailed(reason);
+      throw new AgentUnreachableError(reason, "failed");
+    }
+  };
+  const start = () => {
+    if (status === "running") return Promise.resolve();
+    if (status === "starting" && startPromise !== null) return startPromise;
+    const p = doStart();
+    startPromise = p;
+    return p;
+  };
+  const pushTask = (task) => {
+    if (status !== "running") {
+      return Promise.reject(
+        new AgentUnreachableError(
+          `cannot push task: agent bridge is ${status}`,
+          status
+        )
+      );
+    }
+    let resultPromise;
+    try {
+      resultPromise = taskStore.create(task);
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+    inflightTaskIds.add(task.id);
+    let ackTimer = null;
+    let unsubscribe = null;
+    const clearWatchdog = () => {
+      if (ackTimer !== null) {
+        clearTimeoutFn(ackTimer);
+        ackTimer = null;
+      }
+      if (unsubscribe !== null) {
+        unsubscribe();
+        unsubscribe = null;
+      }
+    };
+    const cleanup = () => {
+      inflightTaskIds.delete(task.id);
+      clearWatchdog();
+    };
+    resultPromise.then(cleanup, cleanup);
+    if (taskAckTimeoutMs > 0) {
+      unsubscribe = taskStore.subscribe(task.id, () => {
+        clearWatchdog();
+      });
+    }
+    fetchFn(`${baseUrl}/task`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        task_id: task.id,
+        type: task.type,
+        payload: task.payload,
+        callback_url: callbackUrl
+      })
+    }).then((res) => {
+      if (!res.ok) {
+        throw new Error(`channel /task returned ${String(res.status)}`);
+      }
+      if (taskAckTimeoutMs > 0 && ackTimer === null && unsubscribe !== null) {
+        ackTimer = setTimeoutFn(() => {
+          try {
+            taskStore.fail(task.id, TASK_ACK_TIMEOUT_MESSAGE);
+          } catch {
+          }
+        }, taskAckTimeoutMs);
+      }
+    }).catch((err) => {
+      const reason = err instanceof Error ? `channel POST failed: ${err.message}` : `channel POST failed: ${String(err)}`;
+      try {
+        taskStore.fail(task.id, reason);
+      } catch {
+      }
+    });
+    return resultPromise;
+  };
+  const stop = async () => {
+    if (status === "stopped") return;
+    const previousStatus = status;
+    status = "stopped";
+    startPromise = null;
+    if (previousStatus === "running" || previousStatus === "starting") {
+      failAllInflight("agent bridge stopped");
+    }
+  };
+  const statusGetter = () => status;
+  return { start, pushTask, stop, status: statusGetter };
+};
+
+// src/handlers/utils.ts
+var jsonResponse = (body, status, extraHeaders) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "Content-Type": "application/json", ...extraHeaders }
+});
+var safeErrorMessage = (err) => {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return "unknown error";
+};
+
+// src/handlers/mcp/mcp-handler.ts
+var parseAction = (body) => {
+  if (body === null || typeof body !== "object") {
+    return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+  }
+  const obj = body;
+  if (typeof obj["action"] !== "string") {
+    return jsonResponse({ error: "missing_field", message: "Missing required field: action" }, 400);
+  }
+  const action = obj["action"];
+  switch (action) {
+    case "start":
+    case "stop":
+    case "status":
+      return { action };
+    case "push_task": {
+      if (typeof obj["type"] !== "string" || obj["type"] === "") {
+        return jsonResponse(
+          { error: "missing_field", message: 'push_task requires a non-empty "type" string' },
+          400
+        );
+      }
+      if (obj["payload"] === void 0 || obj["payload"] === null || typeof obj["payload"] !== "object" || Array.isArray(obj["payload"])) {
+        return jsonResponse(
+          { error: "missing_field", message: 'push_task requires a "payload" object' },
+          400
+        );
+      }
+      return {
+        action: "push_task",
+        type: obj["type"],
+        payload: obj["payload"]
+      };
+    }
+    case "task_callback": {
+      const event = obj["event"];
+      if (event !== "completed" && event !== "progress" && event !== "failed") {
+        return jsonResponse(
+          { error: "missing_field", message: 'task_callback requires "event" to be "completed", "progress", or "failed"' },
+          400
+        );
+      }
+      if (typeof obj["task_id"] !== "string" || obj["task_id"] === "") {
+        return jsonResponse(
+          { error: "missing_field", message: 'task_callback requires a non-empty "task_id" string' },
+          400
+        );
+      }
+      if (event === "completed" && typeof obj["result"] !== "string") {
+        return jsonResponse(
+          { error: "missing_field", message: 'task_callback with event "completed" requires a "result" string' },
+          400
+        );
+      }
+      if (event === "progress" && typeof obj["message"] !== "string") {
+        return jsonResponse(
+          { error: "missing_field", message: 'task_callback with event "progress" requires a "message" string' },
+          400
+        );
+      }
+      if (event === "failed" && typeof obj["error"] !== "string") {
+        return jsonResponse(
+          { error: "missing_field", message: 'task_callback with event "failed" requires an "error" string' },
+          400
+        );
+      }
+      const taskId = obj["task_id"];
+      switch (event) {
+        case "completed":
+          return { action: "task_callback", event, task_id: taskId, result: obj["result"] };
+        case "progress":
+          return { action: "task_callback", event, task_id: taskId, message: obj["message"] };
+        case "failed":
+          return { action: "task_callback", event, task_id: taskId, error: obj["error"] };
+      }
+    }
+    default:
+      return jsonResponse({ error: "unknown_action", message: `Unknown action: ${action}` }, 400);
+  }
+};
+var createMcpHandler = (deps) => {
+  const { bridge, taskStore } = deps;
+  const POST = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_body", message: "Invalid JSON" }, 400);
+    }
+    const actionOrError = parseAction(body);
+    if (actionOrError instanceof Response) return actionOrError;
+    const action = actionOrError;
+    try {
+      switch (action.action) {
+        case "start": {
+          await bridge.start();
+          return jsonResponse({ status: bridge.status() }, 200);
+        }
+        case "stop": {
+          await bridge.stop();
+          return jsonResponse({ status: bridge.status() }, 200);
+        }
+        case "status": {
+          return jsonResponse({ status: bridge.status() }, 200);
+        }
+        case "push_task": {
+          if (bridge.status() !== "running") {
+            return jsonResponse(
+              {
+                error: "bridge_not_running",
+                message: `Agent bridge is ${bridge.status()}. Start it before pushing tasks.`
+              },
+              409
+            );
+          }
+          const taskId = crypto.randomUUID();
+          const task = { id: taskId, type: action.type, payload: action.payload };
+          bridge.pushTask(task).catch(() => {
+          });
+          return jsonResponse({ taskId }, 200);
+        }
+        case "task_callback": {
+          try {
+            switch (action.event) {
+              case "completed":
+                taskStore.complete(action.task_id, action.result);
+                break;
+              case "progress":
+                taskStore.progress(action.task_id, action.message);
+                break;
+              case "failed":
+                taskStore.fail(action.task_id, action.error);
+                break;
+            }
+            return jsonResponse({ ok: true }, 200);
+          } catch (err) {
+            return jsonResponse(
+              { error: "task_store_error", message: safeErrorMessage(err) },
+              400
+            );
+          }
+        }
+      }
+    } catch (err) {
+      if (err instanceof AgentUnreachableError) {
+        return jsonResponse({ error: "agent_unreachable", message: err.message }, 503);
+      }
+      return jsonResponse({ error: "internal" }, 500);
+    }
+  };
+  return { POST };
+};
+
+// src/handlers/events/events-handler.ts
+var formatSseFrame = (taskId, event) => {
+  let data;
+  switch (event.kind) {
+    case "progress":
+      data = { taskId, message: event.message };
+      break;
+    case "completed":
+      data = { taskId, result: event.result };
+      break;
+    case "failed":
+      data = { taskId, error: event.error };
+      break;
+  }
+  return `event: ${event.kind}
+data: ${JSON.stringify(data)}
+
+`;
+};
+var isTerminal = (event) => event.kind === "completed" || event.kind === "failed";
+var createEventsHandler = (deps) => {
+  const { taskStore } = deps;
+  const GET = (req) => {
+    const url = new URL(req.url);
+    const taskId = url.searchParams.get("taskId");
+    if (taskId === null || taskId === "") {
+      return new Response("Missing required query parameter: taskId", { status: 400 });
+    }
+    const snapshot = taskStore.get(taskId);
+    if (snapshot === void 0) {
+      return new Response(`Task not found: ${taskId}`, { status: 404 });
+    }
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({
+      start(controller) {
+        let closed = false;
+        const close = () => {
+          if (closed) return;
+          closed = true;
+          try {
+            controller.close();
+          } catch {
+          }
+        };
+        const unsubscribe = taskStore.subscribe(taskId, (event) => {
+          if (closed) return;
+          try {
+            controller.enqueue(encoder.encode(formatSseFrame(taskId, event)));
+          } catch {
+            return;
+          }
+          if (isTerminal(event)) {
+            close();
+          }
+        });
+        if (req.signal) {
+          const onAbort = () => {
+            unsubscribe();
+            close();
+          };
+          if (req.signal.aborted) {
+            onAbort();
+          } else {
+            req.signal.addEventListener("abort", onAbort, { once: true });
+          }
+        }
+      }
+    });
+    return new Response(stream, {
+      status: 200,
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive"
+      }
+    });
+  };
+  return { GET };
+};
+
+// src/handlers/preview/preview-handler.ts
+var DEFAULT_COOKIE_NAME = "__agntcms_preview";
+function createPreviewHandler(deps) {
+  const cookieName = deps?.cookieName ?? DEFAULT_COOKIE_NAME;
+  const tokenStore = deps?.tokenStore;
+  const enter = (_req) => {
+    const cookie = `${cookieName}=1; Path=/; HttpOnly; SameSite=Lax`;
+    return jsonResponse({ ok: true }, 200, { "Set-Cookie": cookie });
+  };
+  const exit = (_req) => {
+    const cookie = `${cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+    return jsonResponse({ ok: true }, 200, { "Set-Cookie": cookie });
+  };
+  const enterWithToken = (req) => {
+    const url = new URL(req.url);
+    const token = url.searchParams.get("token");
+    if (!tokenStore) {
+      return jsonResponse({ error: "token_store_not_configured" }, 501);
+    }
+    if (!token) {
+      return jsonResponse({ error: "missing_token" }, 400);
+    }
+    const slug = tokenStore.consume(token);
+    if (slug === null) {
+      return jsonResponse({ error: "invalid_or_expired_token" }, 403);
+    }
+    const cookie = `${cookieName}=1; Path=/; HttpOnly; SameSite=Lax`;
+    const redirectUrl = `/${slug}`;
+    return new Response(null, {
+      status: 302,
+      headers: {
+        "Location": redirectUrl,
+        "Set-Cookie": cookie
+      }
+    });
+  };
+  const issueToken = async (req) => {
+    if (!tokenStore) {
+      return jsonResponse({ error: "token_store_not_configured" }, 501);
+    }
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (!body || typeof body !== "object" || !("slug" in body) || typeof body.slug !== "string") {
+      return jsonResponse({ error: "missing_slug" }, 400);
+    }
+    const slug = body.slug;
+    const previewToken = tokenStore.issue(slug);
+    return jsonResponse({
+      token: previewToken.token,
+      previewUrl: `/api/agntcms/preview/enter?token=${previewToken.token}`
+    }, 200);
+  };
+  return { enter, exit, enterWithToken, issueToken };
+}
+
+// src/runtime/systemPages.ts
+var NOT_FOUND_PAGE_SLUG = "404";
+var SERVER_ERROR_PAGE_SLUG = "500";
+var SYSTEM_PAGE_ALIAS_TO_CANONICAL = /* @__PURE__ */ new Map([
+  ["not-found", NOT_FOUND_PAGE_SLUG],
+  ["_not-found", NOT_FOUND_PAGE_SLUG],
+  ["error-404", NOT_FOUND_PAGE_SLUG],
+  ["404-page", NOT_FOUND_PAGE_SLUG],
+  ["page-not-found", NOT_FOUND_PAGE_SLUG],
+  ["error-500", SERVER_ERROR_PAGE_SLUG],
+  ["500-page", SERVER_ERROR_PAGE_SLUG],
+  ["server-error", SERVER_ERROR_PAGE_SLUG]
+]);
+var getReservedPageSlugViolation = (slug) => {
+  const canonicalSlug = SYSTEM_PAGE_ALIAS_TO_CANONICAL.get(slug);
+  if (!canonicalSlug) return null;
+  const pageLabel = canonicalSlug === NOT_FOUND_PAGE_SLUG ? "404 page" : "500 page";
+  return {
+    slug,
+    canonicalSlug,
+    message: `Slug "${slug}" is reserved as an alias for the ${pageLabel}. Edit the canonical "${canonicalSlug}" page instead.`
+  };
+};
+
+// src/handlers/draft/draft-handler.ts
+var parseSaveBody = (body) => {
+  if (body === null || typeof body !== "object") {
+    return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+  }
+  try {
+    assertValidPage(body);
+  } catch (err) {
+    return jsonResponse(
+      { error: "missing_field", message: safeErrorMessage(err) },
+      400
+    );
+  }
+  const reservedSlug = getReservedPageSlugViolation(body.slug);
+  if (reservedSlug) {
+    return jsonResponse(
+      { error: "reserved_slug_alias", message: reservedSlug.message },
+      400
+    );
+  }
+  const page = {
+    slug: body.slug,
+    seo: body.seo,
+    sections: body.sections,
+    ...body.tags !== void 0 ? { tags: body.tags } : {},
+    ...body.excerpt !== void 0 ? { excerpt: body.excerpt } : {},
+    ...body.coverImage !== void 0 ? { coverImage: body.coverImage } : {},
+    ...body.publishedAt !== void 0 ? { publishedAt: body.publishedAt } : {}
+  };
+  return page;
+};
+var parsePublishBody = (body) => {
+  if (body === null || typeof body !== "object") {
+    return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+  }
+  const obj = body;
+  if (typeof obj["slug"] !== "string" || obj["slug"] === "") {
+    return jsonResponse(
+      { error: "missing_field", message: "Missing or empty required field: slug" },
+      400
+    );
+  }
+  return obj["slug"];
+};
+function createDraftHandler(deps) {
+  const { contentAdapter, runtime } = deps;
+  const save = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_body", message: "Invalid JSON" }, 400);
+    }
+    const pageOrError = parseSaveBody(body);
+    if (pageOrError instanceof Response) return pageOrError;
+    const page = pageOrError;
+    try {
+      await contentAdapter.saveDraft(page);
+    } catch (err) {
+      return jsonResponse(
+        { error: "save_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  const list = async (_req) => {
+    let drafts;
+    try {
+      drafts = await contentAdapter.listDrafts();
+    } catch (err) {
+      return jsonResponse(
+        { error: "list_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    const serialized = drafts.map((d) => ({
+      slug: d.slug,
+      updatedAt: d.updatedAt.toISOString()
+    }));
+    return jsonResponse({ drafts: serialized }, 200);
+  };
+  const publish = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_body", message: "Invalid JSON" }, 400);
+    }
+    const slugOrError = parsePublishBody(body);
+    if (slugOrError instanceof Response) return slugOrError;
+    const slug = slugOrError;
+    let page;
+    try {
+      page = await runtime.publishDraft(slug);
+    } catch (err) {
+      return jsonResponse(
+        { error: "not_found", message: safeErrorMessage(err) },
+        404
+      );
+    }
+    return jsonResponse({ ok: true, page }, 200);
+  };
+  const reorder = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_body", message: "Invalid JSON" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["slug"] !== "string" || obj["slug"] === "") {
+      return jsonResponse(
+        { error: "missing_field", message: "Missing or empty required field: slug" },
+        400
+      );
+    }
+    if (!Array.isArray(obj["order"])) {
+      return jsonResponse(
+        { error: "missing_field", message: "Missing or non-array required field: order" },
+        400
+      );
+    }
+    const slug = obj["slug"];
+    const order = obj["order"];
+    if (!order.every((id) => typeof id === "string")) {
+      return jsonResponse(
+        { error: "invalid_field", message: "order must be an array of string section IDs" },
+        400
+      );
+    }
+    let page = await contentAdapter.readPage(slug, "draft");
+    if (page === null) {
+      page = await contentAdapter.readPage(slug, "published");
+    }
+    if (page === null) {
+      return jsonResponse({ error: "not_found", message: `No page found for slug: ${slug}` }, 404);
+    }
+    const currentIds = page.sections.map((s) => s.id);
+    const sortedCurrent = [...currentIds].sort();
+    const sortedOrder = [...order].sort();
+    if (sortedCurrent.length !== sortedOrder.length) {
+      return jsonResponse(
+        { error: "invalid_order", message: "order must contain exactly the same section IDs as the page" },
+        400
+      );
+    }
+    for (let i = 0; i < sortedCurrent.length; i++) {
+      if (sortedCurrent[i] !== sortedOrder[i]) {
+        return jsonResponse(
+          { error: "invalid_order", message: "order must contain exactly the same section IDs as the page" },
+          400
+        );
+      }
+    }
+    const sectionById = new Map(page.sections.map((s) => [s.id, s]));
+    const reordered = order.map((id) => sectionById.get(id));
+    const reorderedPage = { ...page, sections: reordered };
+    try {
+      await contentAdapter.saveDraft(reorderedPage);
+    } catch (err) {
+      return jsonResponse(
+        { error: "save_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  const discard = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_body", message: "Invalid JSON" }, 400);
+    }
+    const slugOrError = parsePublishBody(body);
+    if (slugOrError instanceof Response) return slugOrError;
+    const slug = slugOrError;
+    const published = await contentAdapter.readPage(slug, "published");
+    if (published === null) {
+      return jsonResponse(
+        { error: "no_published_version", message: `No published version exists for slug: ${slug}. Discarding the draft would lose all data.` },
+        400
+      );
+    }
+    try {
+      await contentAdapter.deleteDraft(slug);
+    } catch (err) {
+      const message = safeErrorMessage(err);
+      if (message.includes("no draft to discard")) {
+        return jsonResponse({ error: "not_found", message }, 404);
+      }
+      return jsonResponse({ error: "discard_failed", message }, 500);
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  return { save, list, publish, reorder, discard };
+}
+
+// src/handlers/assets/assets-handler.ts
+var serialiseEntry = (e) => ({
+  filename: e.filename,
+  url: e.url,
+  contentType: e.contentType ?? null,
+  modifiedAt: e.modifiedAt.toISOString()
+});
+function createAssetsHandler(deps) {
+  const { assetAdapter } = deps;
+  const list = async (req) => {
+    if (req.method !== "GET") {
+      return jsonResponse(
+        { error: "method_not_allowed", message: `Expected GET, got ${req.method}` },
+        405
+      );
+    }
+    let entries;
+    try {
+      entries = await assetAdapter.list();
+    } catch (err) {
+      return jsonResponse(
+        { error: "list_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    return jsonResponse(
+      { assets: entries.map(serialiseEntry) },
+      200
+    );
+  };
+  const upload = async (req) => {
+    let form;
+    try {
+      form = await req.formData();
+    } catch (err) {
+      return jsonResponse(
+        { error: "invalid_body", message: safeErrorMessage(err) },
+        400
+      );
+    }
+    const fileField = form.get("file");
+    if (!(fileField instanceof Blob)) {
+      return jsonResponse(
+        { error: "missing_file", message: "Missing required field: file" },
+        400
+      );
+    }
+    const contentType = fileField.type;
+    if (!contentType.startsWith("image/")) {
+      return jsonResponse(
+        {
+          error: "invalid_content_type",
+          message: `Expected image/*, got ${contentType || "unknown"}`
+        },
+        400
+      );
+    }
+    const filename = "name" in fileField && typeof fileField.name === "string" ? fileField.name : "";
+    const arrayBuffer = await fileField.arrayBuffer();
+    const bytes = new Uint8Array(arrayBuffer);
+    let result;
+    try {
+      result = await assetAdapter.upload({
+        bytes,
+        filename,
+        contentType
+      });
+    } catch (err) {
+      return jsonResponse(
+        { error: "upload_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    const asset = {
+      filename: result.filename,
+      url: result.url,
+      contentType,
+      modifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return jsonResponse({ asset }, 200);
+  };
+  return { list, upload };
+}
+
+// src/tasks/store.ts
+var isTerminal2 = (entry) => entry.state === "completed" || entry.state === "failed";
+var toSnapshot = (entry) => {
+  const base = { id: entry.task.id, type: entry.task.type, state: entry.state };
+  switch (entry.state) {
+    case "pending":
+    case "in_progress":
+      return base;
+    case "completed":
+      return { ...base, result: entry.result };
+    case "failed":
+      return { ...base, error: entry.error };
+  }
+};
+var require_ = (entries, id) => {
+  const entry = entries.get(id);
+  if (entry === void 0) {
+    throw new Error(`unknown task id: ${id}`);
+  }
+  return entry;
+};
+var requirePending = (entries, id) => {
+  const entry = require_(entries, id);
+  if (isTerminal2(entry)) {
+    throw new Error(`task ${id} is already ${entry.state}`);
+  }
+  return entry;
+};
+var createTaskStore = () => {
+  const entries = /* @__PURE__ */ new Map();
+  const emit = (listeners, event) => {
+    for (const listener of Array.from(listeners)) {
+      listener(event);
+    }
+  };
+  const create = (task) => {
+    if (entries.has(task.id)) {
+      throw new Error(`duplicate task id: ${task.id}`);
+    }
+    return new Promise((resolve6, reject) => {
+      const entry = {
+        state: "pending",
+        task,
+        resolve: resolve6,
+        reject,
+        listeners: /* @__PURE__ */ new Set()
+      };
+      entries.set(task.id, entry);
+    });
+  };
+  const get = (id) => {
+    const entry = entries.get(id);
+    return entry === void 0 ? void 0 : toSnapshot(entry);
+  };
+  const progress = (id, message) => {
+    const pending = requirePending(entries, id);
+    if (pending.state === "pending") {
+      const next = {
+        ...pending,
+        state: "in_progress"
+      };
+      entries.set(id, next);
+      emit(next.listeners, { kind: "progress", message });
+      return;
+    }
+    emit(pending.listeners, { kind: "progress", message });
+  };
+  const complete = (id, result) => {
+    const pending = requirePending(entries, id);
+    const terminal = {
+      state: "completed",
+      task: pending.task,
+      result
+    };
+    entries.set(id, terminal);
+    pending.resolve(result);
+    emit(pending.listeners, { kind: "completed", result });
+  };
+  const fail = (id, error) => {
+    const pending = requirePending(entries, id);
+    const terminal = {
+      state: "failed",
+      task: pending.task,
+      error
+    };
+    entries.set(id, terminal);
+    pending.reject(new Error(error));
+    emit(pending.listeners, { kind: "failed", error });
+  };
+  const subscribe = (id, listener) => {
+    const entry = require_(entries, id);
+    if (isTerminal2(entry)) {
+      const replayEvent = entry.state === "completed" ? { kind: "completed", result: entry.result } : { kind: "failed", error: entry.error };
+      listener(replayEvent);
+      const noop = () => {
+      };
+      return noop;
+    }
+    entry.listeners.add(listener);
+    return () => {
+      entry.listeners.delete(listener);
+    };
+  };
+  return { create, get, progress, complete, fail, subscribe };
+};
+
+// src/preview-tokens/store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+var DEFAULT_TTL_MS = 6e5;
+var createPreviewTokenStore = (options) => {
+  const ttlMs = options?.ttlMs ?? DEFAULT_TTL_MS;
+  const entries = /* @__PURE__ */ new Map();
+  const sweep = (now) => {
+    for (const [token, entry] of entries) {
+      if (entry.createdAt + ttlMs <= now) {
+        entries.delete(token);
+      }
+    }
+  };
+  const issue = (slug) => {
+    const now = Date.now();
+    sweep(now);
+    const token = randomUUID2();
+    const entry = { slug, createdAt: now };
+    entries.set(token, entry);
+    return { token, slug, createdAt: now };
+  };
+  const consume = (token) => {
+    const entry = entries.get(token);
+    if (entry === void 0) {
+      return null;
+    }
+    entries.delete(token);
+    const now = Date.now();
+    if (entry.createdAt + ttlMs <= now) {
+      return null;
+    }
+    return entry.slug;
+  };
+  return { issue, consume };
+};
+
+// src/handlers/page/page-handler.ts
+import { randomUUID as randomUUID3 } from "crypto";
+var SLUG_PATTERN2 = /^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*$/;
+var reservedSlugResponse = (slug, error) => {
+  const violation = getReservedPageSlugViolation(slug);
+  if (!violation) return null;
+  return jsonResponse({ error, message: violation.message }, 400);
+};
+var cloneSection = (section) => {
+  const fresh = {
+    id: `sec_${randomUUID3()}`,
+    type: section.type,
+    data: section.data,
+    ...section.globalRef !== void 0 ? { globalRef: section.globalRef } : {}
+  };
+  return fresh;
+};
+function createPageHandler(deps) {
+  const { contentAdapter, runtime } = deps;
+  const parseLimitParam = (raw) => {
+    if (raw === null || raw === "") return { ok: true, value: void 0 };
+    const n = Number(raw);
+    if (!Number.isFinite(n)) return { ok: false };
+    if (!Number.isInteger(n)) return { ok: false };
+    if (n < 0) return { ok: false };
+    return { ok: true, value: n };
+  };
+  const parseSortParam = (raw) => {
+    if (raw === null || raw === "") return { ok: true, value: void 0 };
+    if (raw === "newest" || raw === "oldest") return { ok: true, value: raw };
+    return { ok: false };
+  };
+  const listSummaries = async (req) => {
+    const url = new URL(req.url);
+    const tagRaw = url.searchParams.get("tag");
+    const limitParsed = parseLimitParam(url.searchParams.get("limit"));
+    const sortParsed = parseSortParam(url.searchParams.get("sort"));
+    if (!limitParsed.ok) {
+      return jsonResponse(
+        { error: "invalid_limit", message: "limit must be a non-negative integer" },
+        400
+      );
+    }
+    if (!sortParsed.ok) {
+      return jsonResponse(
+        { error: "invalid_sort", message: "sort must be 'newest' or 'oldest'" },
+        400
+      );
+    }
+    const tag = tagRaw === null || tagRaw === "" ? void 0 : tagRaw;
+    const mutableInput = {};
+    if (tag !== void 0) mutableInput.tag = tag;
+    if (limitParsed.value !== void 0) mutableInput.limit = limitParsed.value;
+    if (sortParsed.value !== void 0) mutableInput.sort = sortParsed.value;
+    const input = mutableInput;
+    try {
+      const pages = await runtime.listPages(input);
+      return jsonResponse({ pages }, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "list_pages_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const list = async (req) => {
+    const url = new URL(req.url);
+    const hasListPagesParams = url.searchParams.has("tag") || url.searchParams.has("limit") || url.searchParams.has("sort");
+    if (hasListPagesParams) {
+      return listSummaries(req);
+    }
+    try {
+      const [pages, drafts] = await Promise.all([
+        contentAdapter.listPages(),
+        contentAdapter.listDrafts()
+      ]);
+      const map = /* @__PURE__ */ new Map();
+      for (const p of pages) {
+        map.set(p.slug, {
+          slug: p.slug,
+          hasPublished: true,
+          hasDraft: false,
+          updatedAt: p.updatedAt.toISOString()
+        });
+      }
+      for (const d of drafts) {
+        const existing = map.get(d.slug);
+        if (existing) {
+          existing.hasDraft = true;
+          const existingDate = new Date(existing.updatedAt);
+          if (d.updatedAt > existingDate) {
+            existing.updatedAt = d.updatedAt.toISOString();
+          }
+        } else {
+          map.set(d.slug, {
+            slug: d.slug,
+            hasPublished: false,
+            hasDraft: true,
+            updatedAt: d.updatedAt.toISOString()
+          });
+        }
+      }
+      const combined = Array.from(map.values()).sort(
+        (a, b) => a.slug.localeCompare(b.slug)
+      );
+      return jsonResponse({ pages: combined }, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "list_pages_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const read = async (req) => {
+    const url = new URL(req.url);
+    const slug = url.searchParams.get("slug");
+    if (!slug || slug === "") {
+      return jsonResponse({ error: "missing_slug" }, 400);
+    }
+    try {
+      const page = await contentAdapter.readPage(slug, "draft") ?? await contentAdapter.readPage(slug, "published");
+      if (!page) {
+        return jsonResponse({ error: "page_not_found" }, 404);
+      }
+      return jsonResponse({ page }, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "read_page_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const deletePage = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (!body || typeof body !== "object" || !("slug" in body) || typeof body.slug !== "string") {
+      return jsonResponse({ error: "missing_slug" }, 400);
+    }
+    const slug = body.slug;
+    try {
+      await contentAdapter.deletePage(slug);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes("page not found")) {
+        return jsonResponse({ error: message }, 404);
+      }
+      return jsonResponse({ error: message }, 500);
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  const unpublish = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (!body || typeof body !== "object" || !("slug" in body) || typeof body.slug !== "string") {
+      return jsonResponse({ error: "missing_slug" }, 400);
+    }
+    const slug = body.slug;
+    try {
+      await contentAdapter.unpublishPage(slug);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes("page not found")) {
+        return jsonResponse({ error: message }, 404);
+      }
+      return jsonResponse({ error: message }, 500);
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  const listHistory = async (req) => {
+    const url = new URL(req.url);
+    const slug = url.searchParams.get("slug");
+    const timestamp = url.searchParams.get("ts");
+    if (!slug || slug === "") {
+      return jsonResponse({ error: "missing_slug" }, 400);
+    }
+    if (timestamp !== null) {
+      if (timestamp === "") {
+        return jsonResponse({ error: "missing_timestamp" }, 400);
+      }
+      try {
+        const snapshot = await contentAdapter.readHistorySnapshot(slug, timestamp);
+        if (snapshot === null) {
+          return jsonResponse({ error: "snapshot_not_found" }, 404);
+        }
+        return jsonResponse({ page: snapshot }, 200);
+      } catch (err) {
+        return jsonResponse(
+          { error: "read_history_snapshot_failed", message: safeErrorMessage(err) },
+          500
+        );
+      }
+    }
+    try {
+      const entries = await contentAdapter.listHistory(slug);
+      return jsonResponse({ entries }, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "list_history_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const rollback = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["slug"] !== "string" || obj["slug"] === "") {
+      return jsonResponse({ error: "missing_slug" }, 400);
+    }
+    if (typeof obj["timestamp"] !== "string" || obj["timestamp"] === "") {
+      return jsonResponse({ error: "missing_timestamp" }, 400);
+    }
+    const slug = obj["slug"];
+    const timestamp = obj["timestamp"];
+    let snapshot;
+    try {
+      snapshot = await contentAdapter.readHistorySnapshot(slug, timestamp);
+    } catch (err) {
+      return jsonResponse(
+        { error: "read_history_snapshot_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    if (snapshot === null) {
+      return jsonResponse({ error: "snapshot_not_found" }, 404);
+    }
+    try {
+      await contentAdapter.saveDraft(snapshot);
+      await runtime.publishDraft(slug);
+    } catch (err) {
+      return jsonResponse(
+        { error: "rollback_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  const rename3 = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["fromSlug"] !== "string" || obj["fromSlug"] === "") {
+      return jsonResponse({ error: "missing_from_slug" }, 400);
+    }
+    if (typeof obj["toSlug"] !== "string" || obj["toSlug"] === "") {
+      return jsonResponse({ error: "missing_to_slug" }, 400);
+    }
+    const fromSlug = obj["fromSlug"];
+    const toSlug = obj["toSlug"];
+    const reservedToSlug = reservedSlugResponse(toSlug, "reserved_to_slug");
+    if (reservedToSlug) return reservedToSlug;
+    try {
+      await contentAdapter.renamePage(fromSlug, toSlug);
+    } catch (err) {
+      const message = safeErrorMessage(err);
+      if (message.includes("page not found")) {
+        return jsonResponse({ error: message }, 404);
+      }
+      if (message.includes("target slug already exists")) {
+        return jsonResponse({ error: message }, 409);
+      }
+      return jsonResponse({ error: message }, 500);
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  const duplicate = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["slug"] !== "string" || obj["slug"] === "") {
+      return jsonResponse({ error: "missing_slug" }, 400);
+    }
+    if (typeof obj["newSlug"] !== "string" || obj["newSlug"] === "") {
+      return jsonResponse({ error: "missing_new_slug" }, 400);
+    }
+    const slug = obj["slug"];
+    const newSlug = obj["newSlug"];
+    if (!SLUG_PATTERN2.test(newSlug)) {
+      return jsonResponse({ error: "invalid_new_slug", message: "Slug must contain only letters, numbers, hyphens, underscores, and forward slashes." }, 400);
+    }
+    const reservedNewSlug = reservedSlugResponse(newSlug, "reserved_new_slug");
+    if (reservedNewSlug) return reservedNewSlug;
+    if (newSlug === slug) {
+      return jsonResponse({ error: "same_slug", message: "newSlug must differ from slug" }, 400);
+    }
+    const existingPublished = await contentAdapter.readPage(newSlug, "published");
+    const existingDraft = await contentAdapter.readPage(newSlug, "draft");
+    if (existingPublished !== null || existingDraft !== null) {
+      return jsonResponse({ error: "slug_exists", message: `Slug "${newSlug}" is already in use.` }, 409);
+    }
+    const source = await contentAdapter.readPage(slug, "published") ?? await contentAdapter.readPage(slug, "draft");
+    if (source === null) {
+      return jsonResponse({ error: "source_not_found", message: `No page found for slug: ${slug}` }, 404);
+    }
+    const clonedSections = source.sections.map(cloneSection);
+    const { sections: _srcSections, slug: _srcSlug, ...metaFromSource } = source;
+    void _srcSections;
+    void _srcSlug;
+    const clone = {
+      ...metaFromSource,
+      slug: newSlug,
+      sections: clonedSections
+    };
+    try {
+      await contentAdapter.saveDraft(clone);
+    } catch (err) {
+      return jsonResponse(
+        { error: "duplicate_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+    return jsonResponse({ ok: true, slug: newSlug }, 200);
+  };
+  return { list, read, deletePage, unpublish, listHistory, rollback, rename: rename3, duplicate };
+}
+
+// src/handlers/globals/global-handler.ts
+var GLOBAL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+function createGlobalHandler(deps) {
+  const { contentAdapter } = deps;
+  const list = async (_req) => {
+    try {
+      const globals = await contentAdapter.listGlobals();
+      const serialized = globals.map((g) => ({
+        name: g.name,
+        type: g.type,
+        updatedAt: g.updatedAt.toISOString()
+      }));
+      const body = { globals: serialized };
+      if (deps.allowedTypes) {
+        body["types"] = Array.from(deps.allowedTypes).sort();
+      }
+      return jsonResponse(body, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "list_globals_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const read = async (req) => {
+    const url = new URL(req.url);
+    const name = url.searchParams.get("name");
+    if (!name) {
+      return jsonResponse({ error: "missing_name" }, 400);
+    }
+    if (!GLOBAL_NAME_PATTERN.test(name)) {
+      return jsonResponse(
+        { error: "invalid_name", message: "Global name must contain only letters, numbers, hyphens, and underscores" },
+        400
+      );
+    }
+    try {
+      const global = await contentAdapter.readGlobal(name);
+      if (!global) {
+        return jsonResponse({ error: "not_found", message: `Global "${name}" not found` }, 404);
+      }
+      return jsonResponse({ global: { name: global.name, type: global.type, data: global.data } }, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "read_global_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const save = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["name"] !== "string" || obj["name"] === "") {
+      return jsonResponse({ error: "missing_name" }, 400);
+    }
+    if (!GLOBAL_NAME_PATTERN.test(obj["name"])) {
+      return jsonResponse({ error: "invalid_name", message: "Global name must contain only letters, numbers, hyphens, and underscores" }, 400);
+    }
+    if (typeof obj["type"] !== "string" || obj["type"] === "") {
+      return jsonResponse({ error: "missing_type" }, 400);
+    }
+    if (deps.allowedTypes && !deps.allowedTypes.has(obj["type"])) {
+      return jsonResponse(
+        { error: "unknown_type", message: `Type "${obj["type"]}" is not registered` },
+        400
+      );
+    }
+    if (obj["data"] === void 0 || obj["data"] === null || typeof obj["data"] !== "object" || Array.isArray(obj["data"])) {
+      return jsonResponse({ error: "missing_data" }, 400);
+    }
+    let mergedData = obj["data"];
+    if (deps.sectionDefaults) {
+      const defaults = deps.sectionDefaults.get(obj["type"]);
+      if (defaults) {
+        const result = { ...defaults };
+        for (const key of Object.keys(mergedData)) {
+          result[key] = mergedData[key];
+        }
+        mergedData = result;
+      }
+    }
+    try {
+      await contentAdapter.saveGlobal({
+        name: obj["name"],
+        type: obj["type"],
+        data: mergedData
+      });
+      return jsonResponse({ ok: true }, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "save_global_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const deleteHandler = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["name"] !== "string" || obj["name"] === "") {
+      return jsonResponse({ error: "missing_name" }, 400);
+    }
+    if (!GLOBAL_NAME_PATTERN.test(obj["name"])) {
+      return jsonResponse({ error: "invalid_name", message: "Global name must contain only letters, numbers, hyphens, and underscores" }, 400);
+    }
+    try {
+      await contentAdapter.deleteGlobal(obj["name"]);
+      return jsonResponse({ ok: true }, 200);
+    } catch (err) {
+      const message = safeErrorMessage(err);
+      if (message.includes("global not found")) {
+        return jsonResponse({ error: message }, 404);
+      }
+      return jsonResponse(
+        { error: "delete_global_failed", message },
+        500
+      );
+    }
+  };
+  const listHistory = async (req) => {
+    const url = new URL(req.url);
+    const name = url.searchParams.get("name");
+    const timestamp = url.searchParams.get("ts");
+    if (!name || name === "") {
+      return jsonResponse({ error: "missing_name" }, 400);
+    }
+    if (!GLOBAL_NAME_PATTERN.test(name)) {
+      return jsonResponse(
+        { error: "invalid_name", message: "Global name must contain only letters, numbers, hyphens, and underscores" },
+        400
+      );
+    }
+    if (timestamp !== null) {
+      if (timestamp === "") {
+        return jsonResponse({ error: "missing_timestamp" }, 400);
+      }
+      try {
+        const snapshot = await contentAdapter.readGlobalHistorySnapshot(name, timestamp);
+        if (snapshot === null) {
+          return jsonResponse({ error: "not_found" }, 404);
+        }
+        return jsonResponse({ global: snapshot }, 200);
+      } catch (err) {
+        return jsonResponse(
+          { error: "read_history_snapshot_failed", message: safeErrorMessage(err) },
+          500
+        );
+      }
+    }
+    try {
+      const entries = await contentAdapter.listGlobalHistory(name);
+      const projected = entries.map((e) => ({ timestamp: e.timestamp }));
+      return jsonResponse({ entries: projected }, 200);
+    } catch (err) {
+      return jsonResponse(
+        { error: "list_history_failed", message: safeErrorMessage(err) },
+        500
+      );
+    }
+  };
+  const rollback = async (req) => {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ error: "invalid_json" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ error: "invalid_body", message: "Expected a JSON object" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["name"] !== "string" || obj["name"] === "") {
+      return jsonResponse({ error: "missing_name" }, 400);
+    }
+    if (!GLOBAL_NAME_PATTERN.test(obj["name"])) {
+      return jsonResponse(
+        { error: "invalid_name", message: "Global name must contain only letters, numbers, hyphens, and underscores" },
+        400
+      );
+    }
+    if (typeof obj["timestamp"] !== "string" || obj["timestamp"] === "") {
+      return jsonResponse({ error: "missing_timestamp" }, 400);
+    }
+    const name = obj["name"];
+    const timestamp = obj["timestamp"];
+    try {
+      await contentAdapter.rollbackGlobal(name, timestamp);
+    } catch (err) {
+      const message = safeErrorMessage(err);
+      if (message.includes("global history snapshot not found")) {
+        return jsonResponse({ error: "not_found" }, 404);
+      }
+      return jsonResponse(
+        { error: "rollback_failed", message },
+        500
+      );
+    }
+    return jsonResponse({ ok: true }, 200);
+  };
+  return { list, read, save, delete: deleteHandler, listHistory, rollback };
+}
+
+// src/handlers/template/template-handler.ts
+function createTemplateHandler(deps) {
+  const { sectionDefaults, templates } = deps;
+  const list = async (_req) => {
+    const resolved = [];
+    for (const template of templates) {
+      const sections = [];
+      for (const typeName of template.sectionTypes) {
+        const defaults = sectionDefaults.get(typeName);
+        if (!defaults) {
+          console.warn(
+            `[agntcms] Template "${template.name}": section type "${typeName}" not found in registered sections, skipping.`
+          );
+          continue;
+        }
+        sections.push({ type: typeName, data: defaults });
+      }
+      resolved.push({
+        name: template.name,
+        ...template.description !== void 0 ? { description: template.description } : {},
+        sections
+      });
+    }
+    return jsonResponse({ templates: resolved }, 200);
+  };
+  return { list };
+}
+
+// src/handlers/forms/submit-handler.ts
+var extractIp = (req) => {
+  const xff = req.headers.get("x-forwarded-for");
+  if (xff) {
+    const first = xff.split(",")[0]?.trim();
+    if (first && first.length > 0) return first;
+  }
+  const xri = req.headers.get("x-real-ip");
+  if (xri && xri.trim().length > 0) return xri.trim();
+  return "unknown";
+};
+function createSubmitFormHandler(deps) {
+  const { runtime, rateLimit } = deps;
+  return async function handle(req) {
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return jsonResponse({ ok: false, error: "invalid_json" }, 400);
+    }
+    if (body === null || typeof body !== "object") {
+      return jsonResponse({ ok: false, error: "invalid_body" }, 400);
+    }
+    const obj = body;
+    if (typeof obj["formName"] !== "string" || obj["formName"] === "") {
+      return jsonResponse({ ok: false, error: "missing_form_name" }, 400);
+    }
+    const payload = obj["payload"];
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+      return jsonResponse({ ok: false, error: "invalid_payload" }, 400);
+    }
+    const formName = obj["formName"];
+    const ip = extractIp(req);
+    const rl = rateLimit.check(ip, formName);
+    if (!rl.allowed) {
+      return jsonResponse({ ok: false, error: "rate_limit" }, 429, {
+        // Inform polite clients when they may retry. Spec-compliant for 429.
+        "Retry-After": Math.max(1, Math.ceil((rl.resetAt - Date.now()) / 1e3)).toString()
+      });
+    }
+    let result;
+    try {
+      result = await runtime.submitForm({
+        formName,
+        payload
+      });
+    } catch (err) {
+      void safeErrorMessage(err);
+      return jsonResponse({ ok: false, error: "storage_unavailable" }, 502);
+    }
+    if (!result.ok) {
+      switch (result.error) {
+        case "unknown_form":
+          return jsonResponse({ ok: false, error: "unknown_form" }, 404);
+        case "validation_failed":
+          return jsonResponse(
+            { ok: false, error: "validation_failed", errors: result.errors },
+            400
+          );
+        default: {
+          const _exhaustive = result;
+          void _exhaustive;
+          return jsonResponse({ ok: false, error: "internal_error" }, 500);
+        }
+      }
+    }
+    if (!result.stored) {
+      return jsonResponse({ ok: true, stored: false }, 200);
+    }
+    return jsonResponse({ ok: true, stored: true, id: result.id }, 200);
+  };
+}
+
+// src/handlers/forms/list-handler.ts
+function createFormsListHandler(deps) {
+  const adapter = deps.adapter ?? { kind: "fs" };
+  return async function handle(_req) {
+    try {
+      const forms = deps.forms.map((f) => {
+        const schema = {};
+        for (const [name, descriptor] of Object.entries(f.schema)) {
+          schema[name] = descriptor;
+        }
+        return { name: f.name, schema };
+      });
+      return jsonResponse({ forms, adapter }, 200);
+    } catch (err) {
+      console.error("[agntcms] list_forms_failed:", err);
+      return jsonResponse({ error: "list_forms_failed", message: "internal error" }, 500);
+    }
+  };
+}
+
+// src/handlers/forms/read-handler.ts
+var FORM_NAME_PATTERN2 = /^[a-zA-Z0-9_-]+$/;
+var ID_PATTERN = /^[0-9A-HJKMNPQRSTVWXYZ]{16}$/;
+function createFormsReadHandler(deps) {
+  return async function handle(req) {
+    const url = new URL(req.url);
+    const form = url.searchParams.get("form");
+    const id = url.searchParams.get("id");
+    if (!form) return jsonResponse({ error: "missing_form" }, 400);
+    if (!FORM_NAME_PATTERN2.test(form)) {
+      return jsonResponse({ error: "invalid_form" }, 400);
+    }
+    if (!deps.knownForms.has(form)) {
+      return jsonResponse({ error: "unknown_form" }, 404);
+    }
+    if (id !== null) {
+      if (!ID_PATTERN.test(id)) {
+        return jsonResponse({ error: "invalid_id" }, 400);
+      }
+      try {
+        const sub = await deps.submissionAdapter.read(form, id);
+        if (!sub) return jsonResponse({ error: "not_found" }, 404);
+        return jsonResponse({ submission: sub }, 200);
+      } catch (err) {
+        if (err instanceof SubmissionsNotReadableError) {
+          return jsonResponse(
+            { error: "not_supported", message: err.message },
+            501
+          );
+        }
+        console.error("[agntcms] read_failed:", err);
+        return jsonResponse({ error: "read_failed", message: "internal error" }, 500);
+      }
+    }
+    try {
+      const summaries = await deps.submissionAdapter.list(form);
+      return jsonResponse({ submissions: summaries }, 200);
+    } catch (err) {
+      if (err instanceof SubmissionsNotReadableError) {
+        return jsonResponse(
+          { error: "not_supported", message: err.message },
+          501
+        );
+      }
+      console.error("[agntcms] list_failed:", err);
+      return jsonResponse({ error: "list_failed", message: "internal error" }, 500);
+    }
+  };
+}
+
+// src/handlers/forms/delete-handler.ts
+function createFormsDeleteHandler() {
+  return async function handle(_req) {
+    return jsonResponse(
+      {
+        ok: false,
+        error: "not_implemented",
+        message: "Submission delete is reserved but not implemented in v1. See ARCHITECTURE.md \xA76.5 / \xA712."
+      },
+      501
+    );
+  };
+}
+
+// src/handlers.ts
+installDefaultAdapterFactories();
+export {
+  AgentUnreachableError,
+  createAgentBridge,
+  createAssetsHandler,
+  createDraftHandler,
+  createEventsHandler,
+  createFormsDeleteHandler,
+  createFormsListHandler,
+  createFormsReadHandler,
+  createGlobalHandler,
+  createMcpHandler,
+  createPageHandler,
+  createPreviewHandler,
+  createPreviewTokenStore,
+  createSubmitFormHandler,
+  createTaskStore,
+  createTemplateHandler
+};