@cancia/astro 0.6.0 → 0.8.0

package/dist/{chunk-UR5WC3RA.js → chunk-3B3CXOMK.js}

@@ -1,15 +1,21 @@
 import {
   createJsonFileAdapterV2
 } from "./chunk-L2VKQJPY.js";
+import {
+  isDraft
+} from "./chunk-WVHTCFE6.js";
 
 // src/loader/index.ts
 import { join } from "path";
 function makeId(locale, entryId) {
   return `${locale}/${entryId}`;
 }
-async function syncOnce(ctx, lists, list, site) {
+async function syncOnce(ctx, lists, list, site, schema, includeDrafts) {
   ctx.store.clear();
-  const entries = await lists.list(site, list);
+  const all = await lists.list(site, list);
+  const drafts = schema?.draftField && !includeDrafts ? all.filter((e) => isDraft(schema, e.data)) : [];
+  const draftIds = new Set(drafts.map((e) => `${e.locale}/${e.id}`));
+  const entries = draftIds.size ? all.filter((e) => !draftIds.has(`${e.locale}/${e.id}`)) : all;
   for (const entry of entries) {
     const id = makeId(entry.locale, entry.id);
     const data = {
@@ -24,8 +30,9 @@ async function syncOnce(ctx, lists, list, site) {
       digest: entry._rev
     });
   }
+  const skipped = drafts.length ? ` (${drafts.length} draft${drafts.length === 1 ? "" : "s"} skipped)` : "";
   ctx.logger.info(
-    `cancia: loaded ${entries.length} entr${entries.length === 1 ? "y" : "ies"} from list "${list}"`
+    `cancia: loaded ${entries.length} entr${entries.length === 1 ? "y" : "ies"} from list "${list}"${skipped}`
   );
 }
 function canciaLoader(opts) {
@@ -41,7 +48,7 @@ function canciaLoader(opts) {
         projectRoot: opts.projectRoot ?? process.cwd()
       });
       const { lists } = storage;
-      await syncOnce(ctx, lists, opts.list, opts.site);
+      await syncOnce(ctx, lists, opts.list, opts.site, opts.schema, opts.includeDrafts);
       if (ctx.watcher && !watcherAttached) {
         watcherAttached = true;
         const root = opts.projectRoot ?? process.cwd();
@@ -53,7 +60,14 @@ function canciaLoader(opts) {
             pendingTimer = null;
             inflight = inflight.catch(() => {
             }).then(
-              () => syncOnce(latestCtx, lists, opts.list, opts.site).catch((err) => {
+              () => syncOnce(
+                latestCtx,
+                lists,
+                opts.list,
+                opts.site,
+                opts.schema,
+                opts.includeDrafts
+              ).catch((err) => {
                 latestCtx.logger.error(`cancia: resync failed \u2014 ${err.message}`);
               })
             );

package/dist/{chunk-22DJVJBR.js → chunk-DIV2FFYX.js}

@@ -1,6 +1,6 @@
 import {
   loadListSchema
-} from "./chunk-NG5GJME5.js";
+} from "./chunk-VL6FO446.js";
 import {
   RevConflictError
 } from "./chunk-7IA5B5CF.js";

package/dist/{chunk-IIGDU5SV.js → chunk-HQIGNRIU.js}

@@ -1,9 +1,9 @@
 import {
   loadSchemas
-} from "./chunk-NG5GJME5.js";
+} from "./chunk-VL6FO446.js";
 import {
   describeList
-} from "./chunk-MCHQV6Y7.js";
+} from "./chunk-WVHTCFE6.js";
 
 // src/routes/schemas.ts
 function json(body, status = 200) {

package/dist/{chunk-BOIQNZAO.js → chunk-KHCFVVYV.js}

@@ -53,6 +53,56 @@ var ptBlockSchema = z.object({
   }
 });
 var portableTextSubsetSchema = z.array(ptBlockSchema);
+function parseRichValue(raw) {
+  if (raw == null) return [];
+  let candidate = raw;
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed === "") return [];
+    if (trimmed.startsWith("[")) {
+      try {
+        candidate = JSON.parse(trimmed);
+      } catch {
+        return [];
+      }
+    } else {
+      return [textBlock(raw)];
+    }
+  }
+  if (!Array.isArray(candidate)) return [];
+  const sanitised = candidate.map(stripUnsafeHrefs);
+  const parsed = portableTextSubsetSchema.safeParse(sanitised);
+  return parsed.success ? parsed.data : [];
+}
+function serializeRichValue(value) {
+  return value.length === 0 ? "" : JSON.stringify(value);
+}
+function textBlock(text) {
+  return {
+    _type: "block",
+    _key: "legacy",
+    style: "normal",
+    markDefs: [],
+    children: [{ _type: "span", _key: "legacy0", text, marks: [] }]
+  };
+}
+function stripUnsafeHrefs(block) {
+  if (!block || typeof block !== "object") return block;
+  const b = block;
+  if (!Array.isArray(b.markDefs)) return block;
+  const dropped = /* @__PURE__ */ new Set();
+  const markDefs = b.markDefs.filter((def) => {
+    const href = def?.href;
+    if (typeof href === "string" && isSafeHref(href)) return true;
+    if (typeof def?._key === "string") dropped.add(def._key);
+    return false;
+  });
+  if (dropped.size === 0) return block;
+  const children = Array.isArray(b.children) ? b.children.map(
+    (span) => Array.isArray(span?.marks) ? { ...span, marks: span.marks.filter((m) => !dropped.has(m)) } : span
+  ) : b.children;
+  return { ...b, markDefs, children };
+}
 
 export {
   PT_STYLES,
@@ -60,5 +110,7 @@ export {
   PT_DECORATORS,
   isSafeHref,
   ptBlockSchema,
-  portableTextSubsetSchema
+  portableTextSubsetSchema,
+  parseRichValue,
+  serializeRichValue
 };

package/dist/{chunk-NG5GJME5.js → chunk-VL6FO446.js}

@@ -32,8 +32,15 @@ async function loadListSchema(projectRoot, listName, overridePath) {
   const schemas = await loadSchemas(projectRoot, overridePath);
   return schemas[listName] ?? null;
 }
+function clearSchemaCache() {
+  _cache = null;
+  _cachedPath = null;
+  _cachedMtime = 0;
+}
 
 export {
+  resolveSchemasPath,
   loadSchemas,
-  loadListSchema
+  loadListSchema,
+  clearSchemaCache
 };

package/dist/{chunk-MCHQV6Y7.js → chunk-WVHTCFE6.js}

@@ -1,9 +1,14 @@
 import {
+  isSafeHref,
   portableTextSubsetSchema
-} from "./chunk-BOIQNZAO.js";
+} from "./chunk-KHCFVVYV.js";
 
 // src/schema/index.ts
 import { z } from "zod";
+function isDraft(schema, data) {
+  if (!schema.draftField) return false;
+  return data[schema.draftField] === true;
+}
 function defineList(opts) {
   return {
     label: opts.label,
@@ -11,6 +16,7 @@ function defineList(opts) {
     titleField: opts.titleField,
     bodyField: opts.bodyField,
     slugField: opts.slugField,
+    draftField: opts.draftField,
     fields: opts.fields,
     validator: z.object(opts.fields)
   };
@@ -22,6 +28,15 @@ var defineField = {
   email: (o) => z.string().email().meta({ widget: "email", ...o }),
   datetime: (o) => z.string().datetime().meta({ widget: "datetime", ...o }),
   checkbox: (o) => z.boolean().meta({ widget: "checkbox", ...o }),
+  /**
+   * The draft flag for a list's `draftField`. A checkbox that DEFAULTS to
+   * false, which is what makes it safe to add to an existing list: every
+   * stored entry that predates the field validates and reads as published
+   * rather than vanishing from the built site.
+   *
+   * Label defaults to "Draft" so the affordance reads the same on every list.
+   */
+  draft: (o) => z.boolean().default(false).meta({ widget: "checkbox", label: "Draft", ...o }),
   number: (o) => {
     let n = z.number();
     if (o?.min != null) n = n.min(o.min);
@@ -56,6 +71,30 @@ var defineField = {
    *   related: f.array(f.reference({ list: "posts" }), { label: "Related" }),
    */
   reference: (o) => z.string().meta({ widget: "reference", ...o }),
+  /**
+   * A link: label + href as ONE unit.
+   *
+   * A button/CTA is two values that must stay together — saving a new label
+   * against a stale href produces a broken call-to-action, so they are stored
+   * as a single object rather than two flat keys that could drift.
+   *
+   *   cta: f.link({ label: "Primary CTA" }),
+   *
+   * `href` is NOT z.url(): a relative href ("/start", "#programmes") and a
+   * mailto:/tel: are all legitimate and z.url() rejects the relative forms.
+   * It IS constrained by `isSafeHref` — the SAME guard richtext link marks
+   * use — so a stored value can never carry a javascript:/data: XSS payload.
+   * Without this, the link widget would be a hole around a protection
+   * richtext already enforces.
+   *
+   * Whether to open in a new tab is derived from the href at render time
+   * (see `isExternalHref`) instead of being stored — one less thing that can
+   * fall out of sync with the URL it describes.
+   */
+  link: (o) => z.object({
+    label: z.string(),
+    href: z.string().refine(isSafeHref, "unsafe or unsupported URL scheme")
+  }).meta({ widget: "link", ...o }),
   /**
    * A constrained rich-text body. Stored as a Portable-Text SUBSET array (D4):
    * block styles normal/h2/h3/blockquote, bullet/number lists, strong/em marks,
@@ -142,14 +181,48 @@ function describeList(name, schema) {
     titleField: schema.titleField,
     bodyField: schema.bodyField,
     slugField: schema.slugField,
+    draftField: schema.draftField,
     fields
   };
 }
+function parseLinkValue(raw) {
+  const safe = (href) => isSafeHref(href) ? href : "";
+  if (raw && typeof raw === "object") {
+    const o = raw;
+    return { label: String(o.label ?? ""), href: safe(String(o.href ?? "")) };
+  }
+  if (typeof raw !== "string" || raw === "") return { label: "", href: "" };
+  const trimmed = raw.trim();
+  if (trimmed.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed && typeof parsed === "object") {
+        return {
+          label: String(parsed.label ?? ""),
+          href: safe(String(parsed.href ?? ""))
+        };
+      }
+    } catch {
+    }
+  }
+  return { label: raw, href: "" };
+}
+function serializeLinkValue(value) {
+  return JSON.stringify({ label: value.label ?? "", href: value.href ?? "" });
+}
+function isExternalHref(href) {
+  if (!href) return false;
+  return /^https?:\/\//i.test(href);
+}
 
 export {
   z,
+  isDraft,
   defineList,
   defineField,
   slugify,
-  describeList
+  describeList,
+  parseLinkValue,
+  serializeLinkValue,
+  isExternalHref
 };

package/dist/content.d.ts

@@ -2,6 +2,27 @@
 type ContentMap = Record<string, string>;
 /** A translator: `(key, fallback) => cms[`${key}.${lang}`] ?? fallback`. */
 type Translate = (key: string, fallback: string) => string;
+/** The value behind a `link` field: a label and where it points. */
+interface LinkValue {
+    label: string;
+    href: string;
+}
+/** Resolve a link field, falling back to the values authored in the page. */
+type TranslateLink = (key: string, fallback: LinkValue) => LinkValue;
+/**
+ * Resolve a rich-text region (plan 051).
+ *
+ * Returns `null` when there is NO stored override — which the region renders as
+ * "show the markup authored in the page". That is deliberate and load-bearing:
+ * a rich fallback cannot be a JS string, so the authored markup IS the fallback,
+ * which is what keeps an empty DB rendering byte-identically.
+ *
+ * `[]` is a different answer from `null`: it means a stored, deliberately empty
+ * value — the client removed the prose on purpose — and renders nothing.
+ */
+type TranslateRich = (key: string) => RichValue | null;
+/** A Portable-Text subset document. Structurally typed to keep this subpath Vite-free. */
+type RichValue = Record<string, unknown>[];
 interface ContentReaderOptions {
     /** Site id (the `?site=` query param and the storage `site` column). */
     site: string;
@@ -44,9 +65,24 @@ interface ContentReader {
     getCMS(): Promise<ContentMap>;
     /** Build a translator over a content map for the reader's `lang`. */
     makeT(cms: ContentMap): Translate;
-    /** Sugar: `const { t, cms } = await reader.get()` in a page's frontmatter. */
+    /**
+     * Build a link resolver over a content map. A link field stores
+     * `{label, href}` as JSON; this parses it and falls back to the values
+     * authored in the page. Never throws; drops an unsafe href.
+     */
+    makeTLink(cms: ContentMap): TranslateLink;
+    /**
+     * Build a rich-text resolver over a content map. Returns `null` when no
+     * override is stored, which a rich region renders as "show the markup
+     * authored in the page" — the reason an empty DB still renders identically.
+     * `[]` means a stored, deliberately empty value and renders nothing.
+     */
+    makeRich(cms: ContentMap): TranslateRich;
+    /** Sugar: `const { t, tLink, tRich, cms } = await reader.get()` in frontmatter. */
     get(): Promise<{
         t: Translate;
+        tLink: TranslateLink;
+        tRich: TranslateRich;
         cms: ContentMap;
     }>;
 }
@@ -57,4 +93,4 @@ interface ContentReader {
  */
 declare function createContentReader(opts: ContentReaderOptions): ContentReader;
 
-export { type ContentMap, type ContentReader, type ContentReaderOptions, type Translate, createContentReader };
+export { type ContentMap, type ContentReader, type ContentReaderOptions, type LinkValue, type RichValue, type Translate, type TranslateLink, type TranslateRich, createContentReader };

package/dist/content.js

@@ -8,6 +8,75 @@ import "./chunk-L2VKQJPY.js";
 import "./chunk-7IA5B5CF.js";
 
 // src/content.ts
+function isSafeHref(href) {
+  const trimmed = href.trim();
+  if (trimmed === "") return false;
+  if (/^(https?:|mailto:|tel:)/i.test(trimmed)) return true;
+  const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(trimmed);
+  if (schemeMatch) {
+    const firstSep = trimmed.search(/[/?#]/);
+    if (firstSep === -1 || schemeMatch[1].length < firstSep) return false;
+  }
+  return true;
+}
+function parseLink(raw, fallback) {
+  if (!raw) return fallback;
+  const trimmed = raw.trim();
+  if (trimmed.startsWith("{")) {
+    try {
+      const p = JSON.parse(trimmed);
+      if (p && typeof p === "object") {
+        const href = String(p.href ?? "");
+        return {
+          label: String(p.label ?? "") || fallback.label,
+          href: href && isSafeHref(href) ? href : fallback.href
+        };
+      }
+    } catch {
+    }
+  }
+  return { label: raw, href: fallback.href };
+}
+function parseRich(raw) {
+  if (raw === void 0) return null;
+  const trimmed = raw.trim();
+  if (trimmed === "") return [];
+  if (!trimmed.startsWith("[")) {
+    return [
+      {
+        _type: "block",
+        _key: "legacy",
+        style: "normal",
+        markDefs: [],
+        children: [{ _type: "span", _key: "legacy0", text: raw, marks: [] }]
+      }
+    ];
+  }
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.map(stripUnsafeMarkDefs);
+  } catch {
+    return [];
+  }
+}
+function stripUnsafeMarkDefs(block) {
+  if (!block || typeof block !== "object") return block;
+  const b = block;
+  if (!Array.isArray(b.markDefs)) return block;
+  const dropped = /* @__PURE__ */ new Set();
+  const markDefs = b.markDefs.filter((def) => {
+    const href = def?.href;
+    if (typeof href === "string" && isSafeHref(href)) return true;
+    if (typeof def?._key === "string") dropped.add(def._key);
+    return false;
+  });
+  if (dropped.size === 0) return block;
+  const children = Array.isArray(b.children) ? b.children.map(
+    (span) => Array.isArray(span?.marks) ? { ...span, marks: span.marks.filter((m) => !dropped.has(m)) } : span
+  ) : b.children;
+  return { ...b, markDefs, children };
+}
 function createContentReader(opts) {
   const site = opts.site;
   const lang = opts.lang ?? "en";
@@ -41,11 +110,17 @@ function createContentReader(opts) {
   function makeT(cms) {
     return (key, fallback) => cms[`${key}.${lang}`] ?? fallback;
   }
+  function makeTLink(cms) {
+    return (key, fallback) => parseLink(cms[`${key}.${lang}`], fallback);
+  }
+  function makeRich(cms) {
+    return (key) => parseRich(cms[`${key}.${lang}`]);
+  }
   async function get() {
     const cms = await getCMS();
-    return { t: makeT(cms), cms };
+    return { t: makeT(cms), tLink: makeTLink(cms), tRich: makeRich(cms), cms };
   }
-  return { getCMS, makeT, get };
+  return { getCMS, makeT, makeTLink, makeRich, get };
 }
 export {
   createContentReader

package/dist/endpoints/lists.js

@@ -4,9 +4,9 @@ import {
 } from "../chunk-VGRG5DN7.js";
 import {
   makeListsRoutes
-} from "../chunk-22DJVJBR.js";
-import "../chunk-NG5GJME5.js";
+} from "../chunk-DIV2FFYX.js";
 import "../chunk-X6ZFFGIA.js";
+import "../chunk-VL6FO446.js";
 import "../chunk-7IA5B5CF.js";
 
 // src/endpoints/lists.ts

package/dist/endpoints/schemas.js

@@ -1,9 +1,9 @@
 import {
   makeSchemasRoute
-} from "../chunk-IIGDU5SV.js";
-import "../chunk-NG5GJME5.js";
-import "../chunk-MCHQV6Y7.js";
-import "../chunk-BOIQNZAO.js";
+} from "../chunk-HQIGNRIU.js";
+import "../chunk-VL6FO446.js";
+import "../chunk-WVHTCFE6.js";
+import "../chunk-KHCFVVYV.js";
 
 // src/endpoints/schemas.ts
 import { getCanciaRuntime } from "virtual:cancia/runtime";

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { FieldDescription, FieldMeta, FieldMetaBase, FieldWidget, ListDescriptio
 export { G as GitBackedContentPaths, a as GitBackedControls, b as GitBackedOptions, c as GitBackedStorage, S as SqliteV2Options, d as closeSqliteAdapterV2, e as createGitBackedAdapter, f as createJsonFileAdapter, g as createJsonFileAdapterV2, h as createSQLiteAdapter, i as createSqliteAdapterV2 } from './git-backed-DtiH52EI.js';
 export { z } from 'zod';
 import 'astro/loaders';
-import './portable-text-BikSqS9T.js';
+import './portable-text-D74aIuHn.js';
 
 interface R2UploadHandlerOptions {
     /** Cloudflare account ID (from R2 dashboard) */