@caretcms/core 0.1.0

package/dist/runtime/auth/demo-session.js

@@ -0,0 +1,42 @@
+import { shouldUseSecureCookies } from "./cookie-utils.js";
+const COOKIE_NAME = "caret_demo_session";
+const TTL_SECONDS = 60 * 60 * 2; // 2h sliding window
+const ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+function serialize(value, maxAge, request) {
+    const parts = [
+        `${COOKIE_NAME}=${value}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${maxAge}`,
+    ];
+    if (shouldUseSecureCookies(request))
+        parts.push("Secure");
+    return parts.join("; ");
+}
+/**
+ * Detect demo mode from any available env source. Workers populate env via
+ * `context.locals.runtime.env` (Astro Cloudflare adapter); Node hosts use
+ * `process.env`. Pass `runtimeEnv` when available — falls back to process.env.
+ */
+export function isDemoModeEnabled(runtimeEnv) {
+    if (runtimeEnv && runtimeEnv.CARET_DEMO_MODE === "true")
+        return true;
+    if (typeof process !== "undefined" && process.env?.CARET_DEMO_MODE === "true") {
+        return true;
+    }
+    return false;
+}
+/**
+ * Read the demo session cookie or mint a new one. Always refreshes the TTL,
+ * giving us a sliding 2h window per active visitor.
+ */
+export function resolveDemoSession(context, request) {
+    const existing = context.cookies?.get(COOKIE_NAME)?.value;
+    const sessionId = existing && ID_PATTERN.test(existing) ? existing : crypto.randomUUID();
+    return {
+        sessionId,
+        setCookieHeader: serialize(sessionId, TTL_SECONDS, request),
+    };
+}
+//# sourceMappingURL=demo-session.js.map

package/dist/runtime/auth/demo-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-session.js","sourceRoot":"","sources":["../../../src/runtime/auth/demo-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,oBAAoB;AACrD,MAAM,UAAU,GAAG,iEAAiE,CAAC;AAMrF,SAAS,SAAS,CAAC,KAAa,EAAE,MAAc,EAAE,OAAiB;IACjE,MAAM,KAAK,GAAG;QACZ,GAAG,WAAW,IAAI,KAAK,EAAE;QACzB,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW,MAAM,EAAE;KACpB,CAAC;IACF,IAAI,sBAAsB,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA2C;IAE3C,IAAI,UAAU,IAAI,UAAU,CAAC,eAAe,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAkB,EAClB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC1D,MAAM,SAAS,GAAG,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACzF,OAAO;QACL,SAAS;QACT,eAAe,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/runtime/auth/rate-limiter.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Sliding-window failure counter for login attempts. Holds state in-process,
+ * so single-Node deployments get a meaningful brute-force defense out of the
+ * box. Multi-instance or Workers deployments should layer Durable Objects or
+ * a WAF rate-limit rule on top — there's no shared state here.
+ */
+export type RateLimitResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    retryAfterSeconds: number;
+};
+export declare function checkLoginRateLimit(key: string, options?: {
+    maxFailures?: number;
+    windowMs?: number;
+    now?: number;
+}): RateLimitResult;
+export declare function recordLoginFailure(key: string, options?: {
+    windowMs?: number;
+    now?: number;
+}): void;
+export declare function clearLoginAttempts(key: string): void;
+/** Test-only. Resets all counters. */
+export declare function __resetLoginRateLimiter(): void;
+export declare function extractRateLimitKey(request: Request): string;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/runtime/auth/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkBH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,eAAe,CAcjB;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,IAAI,CAWN;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,sCAAsC;AACtC,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAe5D"}

package/dist/runtime/auth/rate-limiter.js

@@ -0,0 +1,65 @@
+/**
+ * Sliding-window failure counter for login attempts. Holds state in-process,
+ * so single-Node deployments get a meaningful brute-force defense out of the
+ * box. Multi-instance or Workers deployments should layer Durable Objects or
+ * a WAF rate-limit rule on top — there's no shared state here.
+ */
+const DEFAULT_MAX_FAILURES = 5;
+const DEFAULT_WINDOW_MS = 15 * 60 * 1000;
+const windows = new Map();
+function prune(window, now, windowMs) {
+    const cutoff = now - windowMs;
+    while (window.attempts.length > 0 && window.attempts[0] <= cutoff) {
+        window.attempts.shift();
+    }
+}
+export function checkLoginRateLimit(key, options = {}) {
+    const maxFailures = options.maxFailures ?? DEFAULT_MAX_FAILURES;
+    const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    const now = options.now ?? Date.now();
+    const window = windows.get(key);
+    if (!window)
+        return { allowed: true };
+    prune(window, now, windowMs);
+    if (window.attempts.length < maxFailures)
+        return { allowed: true };
+    const earliest = window.attempts[0];
+    const retryAfterMs = Math.max(0, earliest + windowMs - now);
+    return { allowed: false, retryAfterSeconds: Math.ceil(retryAfterMs / 1000) };
+}
+export function recordLoginFailure(key, options = {}) {
+    const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    const now = options.now ?? Date.now();
+    let window = windows.get(key);
+    if (!window) {
+        window = { attempts: [] };
+        windows.set(key, window);
+    }
+    prune(window, now, windowMs);
+    window.attempts.push(now);
+}
+export function clearLoginAttempts(key) {
+    windows.delete(key);
+}
+/** Test-only. Resets all counters. */
+export function __resetLoginRateLimiter() {
+    windows.clear();
+}
+export function extractRateLimitKey(request) {
+    // Best-effort client identifier. Astro doesn't expose remote IP directly
+    // in all adapters, so we fall back to a forwarded-for header. The key
+    // doesn't need to be cryptographically distinct — it just has to make
+    // brute-force costly for a typical attacker.
+    const headers = request.headers;
+    const candidates = [
+        headers.get("cf-connecting-ip"),
+        headers.get("x-real-ip"),
+        headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? null,
+    ];
+    for (const candidate of candidates) {
+        if (candidate && candidate.length > 0)
+            return candidate;
+    }
+    return "unknown";
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/runtime/auth/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/runtime/auth/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAMzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE1C,SAAS,KAAK,CAAC,MAAc,EAAE,GAAW,EAAE,QAAgB;IAC1D,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,UAAqE,EAAE;IAEvE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;IAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,UAA+C,EAAE;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,uBAAuB;IACrC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI;KAC9D,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/auth/session.d.ts

@@ -0,0 +1,14 @@
+export declare function isEditorPasswordValid(candidate: string): boolean;
+export declare function issueEditorSessionCookie(path?: string, request?: Request): string;
+export declare function clearEditorSessionCookie(path?: string, request?: Request): string;
+export declare function hasConfiguredEditorPassword(): boolean;
+type CookieBagLike = {
+    cookies?: {
+        get: (name: string) => {
+            value: string;
+        } | undefined;
+    };
+};
+export declare function isEditorAuthenticated(context: CookieBagLike): boolean;
+export {};
+//# sourceMappingURL=session.d.ts.map

package/dist/runtime/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/session.ts"],"names":[],"mappings":"AAiHA,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAWhE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,SAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAS9E;AAED,wBAAgB,wBAAwB,CAAC,IAAI,SAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAE9E;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAED,KAAK,aAAa,GAAG;IACnB,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KACtD,CAAC;CACH,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAUrE"}

package/dist/runtime/auth/session.js

@@ -0,0 +1,128 @@
+import { createHmac, timingSafeEqual } from "crypto";
+import { shouldUseSecureCookies } from "./cookie-utils.js";
+import { getRequestContext } from "../request-context.js";
+const SESSION_COOKIE_NAME = "caret_session";
+const SESSION_TTL_SECONDS = 60 * 60 * 12;
+const DEV_SECRET_FALLBACK = "caretcms-dev-secret";
+let devSecretWarned = false;
+function getEditorPassword() {
+    const value = process.env.CARET_EDIT_PASSWORD ?? process.env.EDIT_PASSWORD ?? "";
+    return value.trim().length > 0 ? value : null;
+}
+function getSessionSecret() {
+    const configured = process.env.CARET_SESSION_SECRET;
+    if (configured && configured.trim().length > 0)
+        return configured;
+    // No secret configured. Safe to fall back only when the CMS is effectively
+    // disabled (no editor password). Once a password is set, the dev fallback
+    // is a known string that lets anyone forge a session — refuse it in
+    // production and warn loudly in dev.
+    if (getEditorPassword() === null)
+        return DEV_SECRET_FALLBACK;
+    if (process.env.NODE_ENV === "production") {
+        throw new Error("[caretcms] CARET_SESSION_SECRET is required in production when CARET_EDIT_PASSWORD is set. " +
+            "Generate one with `openssl rand -base64 32` and set it in your environment.");
+    }
+    if (!devSecretWarned) {
+        devSecretWarned = true;
+        console.warn("[caretcms] CARET_SESSION_SECRET is unset; using a public dev fallback. " +
+            "Set CARET_SESSION_SECRET before exposing this site to the network.");
+    }
+    return DEV_SECRET_FALLBACK;
+}
+function signPayload(payloadB64) {
+    return createHmac("sha256", getSessionSecret()).update(payloadB64).digest("base64url");
+}
+function serializeEditorSessionCookie(value, path, maxAge, request) {
+    const parts = [
+        `${SESSION_COOKIE_NAME}=${value}`,
+        `Path=${path}`,
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${maxAge}`,
+    ];
+    if (shouldUseSecureCookies(request)) {
+        parts.push("Secure");
+    }
+    return parts.join("; ");
+}
+function buildToken(payload) {
+    const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+    const sig = signPayload(payloadB64);
+    return `${payloadB64}.${sig}`;
+}
+function parseToken(token) {
+    const parts = token.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [payloadB64, signature] = parts;
+    if (!payloadB64 || !signature)
+        return null;
+    const expected = signPayload(payloadB64);
+    let sigBuf;
+    let expectedBuf;
+    try {
+        sigBuf = Buffer.from(signature, "base64url");
+        expectedBuf = Buffer.from(expected, "base64url");
+    }
+    catch {
+        return null;
+    }
+    if (sigBuf.length === 0 || sigBuf.length !== expectedBuf.length)
+        return null;
+    if (!timingSafeEqual(sigBuf, expectedBuf))
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const payload = parsed;
+        if (payload.editor !== true)
+            return null;
+        if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp))
+            return null;
+        if (payload.exp <= Date.now())
+            return null;
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+export function isEditorPasswordValid(candidate) {
+    const expected = getEditorPassword();
+    if (!expected)
+        return false;
+    if (!candidate)
+        return false;
+    // Hash both sides to fixed-length digests so the comparison cannot leak
+    // the configured password's length through a length-mismatch shortcut.
+    const secret = getSessionSecret();
+    const candidateDigest = createHmac("sha256", secret).update(candidate).digest();
+    const expectedDigest = createHmac("sha256", secret).update(expected).digest();
+    return timingSafeEqual(candidateDigest, expectedDigest);
+}
+export function issueEditorSessionCookie(path = "/", request) {
+    const exp = Date.now() + SESSION_TTL_SECONDS * 1000;
+    const token = buildToken({ editor: true, exp });
+    return serializeEditorSessionCookie(encodeURIComponent(token), path, SESSION_TTL_SECONDS, request);
+}
+export function clearEditorSessionCookie(path = "/", request) {
+    return serializeEditorSessionCookie("", path, 0, request);
+}
+export function hasConfiguredEditorPassword() {
+    return getEditorPassword() !== null;
+}
+export function isEditorAuthenticated(context) {
+    // Demo mode: any visitor with a resolved sandbox session is an editor of
+    // their own private overlay. Middleware sets `demoMode` + `sessionId` in
+    // the request-scoped ALS context before this check runs.
+    const ctx = getRequestContext();
+    if (ctx?.demoMode && ctx.sessionId)
+        return true;
+    const token = context.cookies?.get(SESSION_COOKIE_NAME)?.value;
+    if (!token)
+        return false;
+    return parseToken(token) !== null;
+}
+//# sourceMappingURL=session.js.map

package/dist/runtime/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/runtime/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAOzC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACjF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAElE,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,qCAAqC;IACrC,IAAI,iBAAiB,EAAE,KAAK,IAAI;QAAE,OAAO,mBAAmB,CAAC;IAE7D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,6FAA6F;YAC3F,6EAA6E,CAChF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,yEAAyE;YACvE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,OAAO,UAAU,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,4BAA4B,CACnC,KAAa,EACb,IAAY,EACZ,MAAc,EACd,OAAiB;IAEjB,MAAM,KAAK,GAAG;QACZ,GAAG,mBAAmB,IAAI,KAAK,EAAE;QACjC,QAAQ,IAAI,EAAE;QACd,UAAU;QACV,cAAc;QACd,WAAW,MAAM,EAAE;KACpB,CAAC;IAEF,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,OAAuB;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACtC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAc,CAAC;IACnB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3C,CAAC;QACb,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhF,MAAM,OAAO,GAAG,MAAiC,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAE3C,OAAO,OAAyB,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAChF,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,OAAO,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAI,GAAG,GAAG,EAAE,OAAiB;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,GAAG,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,4BAA4B,CACjC,kBAAkB,CAAC,KAAK,CAAC,EACzB,IAAI,EACJ,mBAAmB,EACnB,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAI,GAAG,GAAG,EAAE,OAAiB;IACpE,OAAO,4BAA4B,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,iBAAiB,EAAE,KAAK,IAAI,CAAC;AACtC,CAAC;AAQD,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,yEAAyE;IACzE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,GAAG,EAAE,QAAQ,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACpC,CAAC"}

package/dist/runtime/bind.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Explicit inline binding per ADR-004.
+ *
+ * Usage in .astro:
+ *   const e = bindEntry({ collection: 'pages', id: 'home' })
+ *   <h1 {...e('hero.title')}>{hero.title}</h1>
+ */
+export declare function bindEntry(entry: {
+    collection: string;
+    id: string;
+}): (field: string, options?: {
+    rich?: boolean;
+}) => Record<string, string>;
+//# sourceMappingURL=bind.d.ts.map

package/dist/runtime/bind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind.d.ts","sourceRoot":"","sources":["../../src/runtime/bind.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,IACzD,OAAO,MAAM,EAAE,UAAU;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,4BASpD"}

package/dist/runtime/bind.js

@@ -0,0 +1,19 @@
+/**
+ * Explicit inline binding per ADR-004.
+ *
+ * Usage in .astro:
+ *   const e = bindEntry({ collection: 'pages', id: 'home' })
+ *   <h1 {...e('hero.title')}>{hero.title}</h1>
+ */
+export function bindEntry(entry) {
+    return (field, options) => {
+        const attrs = {
+            "data-caret": `${entry.collection}::${entry.id}::${field}`,
+        };
+        if (options?.rich) {
+            attrs["data-caret-rich"] = "";
+        }
+        return attrs;
+    };
+}
+//# sourceMappingURL=bind.js.map

package/dist/runtime/bind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bind.js","sourceRoot":"","sources":["../../src/runtime/bind.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAyC;IACjE,OAAO,CAAC,KAAa,EAAE,OAA4B,EAAE,EAAE;QACrD,MAAM,KAAK,GAA2B;YACpC,YAAY,EAAE,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE;SAC3D,CAAC;QACF,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/runtime/config.d.ts

@@ -0,0 +1,20 @@
+import type { CaretMode } from "../types.js";
+export type CaretBrandConfig = {
+    name: string;
+    logo: string | null;
+    faviconUrl: string | null;
+};
+export type CaretThemeConfig = {
+    presetId: string | null;
+    tokenOverrides: Record<string, string>;
+};
+export type CaretRuntimeConfig = {
+    mountPath: string;
+    apiBasePath: string;
+    mode: CaretMode;
+    theme: CaretThemeConfig;
+    brand: CaretBrandConfig;
+};
+export declare function normalizePath(input: string | undefined, fallback: string): string;
+export declare function getRuntimeConfig(): CaretRuntimeConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/runtime/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/runtime/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASjF;AAsBD,wBAAgB,gBAAgB,IAAI,kBAAkB,CAcrD"}

package/dist/runtime/config.js

@@ -0,0 +1,40 @@
+export function normalizePath(input, fallback) {
+    if (!input)
+        return fallback;
+    const trimmed = input.trim();
+    if (!trimmed)
+        return fallback;
+    const withLeadingSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+    if (withLeadingSlash.length > 1 && withLeadingSlash.endsWith("/")) {
+        return withLeadingSlash.slice(0, -1);
+    }
+    return withLeadingSlash;
+}
+function safeParse(raw, fallback) {
+    if (!raw)
+        return fallback;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return fallback;
+    }
+}
+const DEFAULT_BRAND = {
+    name: "Content Studio",
+    logo: null,
+    faviconUrl: null,
+};
+const DEFAULT_THEME = {
+    presetId: null,
+    tokenOverrides: {},
+};
+export function getRuntimeConfig() {
+    const mountPath = normalizePath(__ASTRO_CARET_MOUNT_PATH__, "/admin");
+    const apiBasePath = normalizePath(__ASTRO_CARET_API_BASE_PATH__, "/api/cms");
+    const mode = (__ASTRO_CARET_MODE__ ?? "embedded");
+    const theme = safeParse(__ASTRO_CARET_THEME_CONFIG__, DEFAULT_THEME);
+    const brand = safeParse(__ASTRO_CARET_BRAND_CONFIG__, DEFAULT_BRAND);
+    return { mountPath, apiBasePath, mode, theme, brand };
+}
+//# sourceMappingURL=config.js.map

package/dist/runtime/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/runtime/config.ts"],"names":[],"mappings":"AA2BA,MAAM,UAAU,aAAa,CAAC,KAAyB,EAAE,QAAgB;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC3E,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAI,GAAuB,EAAE,QAAW;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAqB;IACtC,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,aAAa,GAAqB;IACtC,QAAQ,EAAE,IAAI;IACd,cAAc,EAAE,EAAE;CACnB,CAAC;AAEF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,SAAS,GAAG,aAAa,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,aAAa,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,CAAC,oBAAoB,IAAI,UAAU,CAAc,CAAC;IAC/D,MAAM,KAAK,GAAG,SAAS,CACrB,4BAA4B,EAC5B,aAAa,CACd,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CACrB,4BAA4B,EAC5B,aAAa,CACd,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC"}

package/dist/runtime/content.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Public content loading API for Astro pages.
+ *
+ * Use these in your .astro frontmatter to load CMS content:
+ *
+ *   import { loadEntry, loadCollection } from '@caretcms/core/runtime'
+ *
+ *   const home = await loadEntry('pages', 'home')
+ *   const posts = await loadCollection('posts')
+ */
+import type { EntryData } from "../types.js";
+export type { EntryData };
+/**
+ * Load a single entry by collection and id.
+ * Returns the entry data, or null if not found.
+ */
+export declare function loadEntry(collection: string, id: string): Promise<Record<string, unknown> | null>;
+/**
+ * Load all entries in a collection.
+ * Returns an array of { id, data } objects.
+ */
+export declare function loadCollection(collection: string): Promise<EntryData[]>;
+/**
+ * Discover all collection names.
+ * Returns sorted collection names.
+ */
+export declare function listCollections(): Promise<string[]>;
+//# sourceMappingURL=content.d.ts.map

package/dist/runtime/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/runtime/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAIzC;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAG7E;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGzD"}

package/dist/runtime/content.js

@@ -0,0 +1,37 @@
+/**
+ * Public content loading API for Astro pages.
+ *
+ * Use these in your .astro frontmatter to load CMS content:
+ *
+ *   import { loadEntry, loadCollection } from '@caretcms/core/runtime'
+ *
+ *   const home = await loadEntry('pages', 'home')
+ *   const posts = await loadCollection('posts')
+ */
+import { requireRequestContext } from "./request-context.js";
+/**
+ * Load a single entry by collection and id.
+ * Returns the entry data, or null if not found.
+ */
+export async function loadEntry(collection, id) {
+    const { adapter } = requireRequestContext();
+    const entry = await adapter.getEntry(collection, id);
+    return entry?.data ?? null;
+}
+/**
+ * Load all entries in a collection.
+ * Returns an array of { id, data } objects.
+ */
+export async function loadCollection(collection) {
+    const { adapter } = requireRequestContext();
+    return adapter.listEntries(collection);
+}
+/**
+ * Discover all collection names.
+ * Returns sorted collection names.
+ */
+export async function listCollections() {
+    const { adapter } = requireRequestContext();
+    return adapter.discoverCollections();
+}
+//# sourceMappingURL=content.js.map

package/dist/runtime/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/runtime/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAI7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAAkB,EAClB,EAAU;IAEV,MAAM,EAAE,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,MAAM,EAAE,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAC5C,OAAO,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAC5C,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC;AACvC,CAAC"}

package/dist/runtime/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Runtime exports for use in Astro pages.
+ *
+ *   import { bindEntry, loadEntry, loadCollection } from '@caretcms/core/runtime'
+ */
+export { bindEntry } from "./bind.js";
+export { loadEntry, loadCollection, listCollections } from "./content.js";
+export type { EntryData } from "./content.js";
+export { SessionOverlayAdapter } from "./storage/session-overlay-adapter.js";
+export { QuotaUploadHandler } from "./storage/quota-upload-handler.js";
+export type { QuotaCounter, QuotaUploadHandlerOptions, } from "./storage/quota-upload-handler.js";
+export { IMAGE_KIND_TO_EXT, IMAGE_MAX_SIZE, IMAGE_MIME_TO_KIND, detectImageKind, readAndValidateImage, sanitizeImageBaseName, } from "./storage/image-validation.js";
+export type { AllowedImageKind } from "./storage/image-validation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1E,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,YAAY,EACV,YAAY,EACZ,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/runtime/index.js

@@ -0,0 +1,16 @@
+/**
+ * Runtime exports for use in Astro pages.
+ *
+ *   import { bindEntry, loadEntry, loadCollection } from '@caretcms/core/runtime'
+ */
+// Binding — ADR-004 explicit inline binding (power-user API)
+export { bindEntry } from "./bind.js";
+// Content loading — read stored data in .astro frontmatter (power-user API)
+export { loadEntry, loadCollection, listCollections } from "./content.js";
+// Sandbox / multi-tenant primitives — used by Cloudflare adapter for demo mode
+export { SessionOverlayAdapter } from "./storage/session-overlay-adapter.js";
+export { QuotaUploadHandler } from "./storage/quota-upload-handler.js";
+// Shared image-upload validation — adapter authors should call
+// readAndValidateImage() before writing user-supplied bytes to storage.
+export { IMAGE_KIND_TO_EXT, IMAGE_MAX_SIZE, IMAGE_MIME_TO_KIND, detectImageKind, readAndValidateImage, sanitizeImageBaseName, } from "./storage/image-validation.js";
+//# sourceMappingURL=index.js.map

package/dist/runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,6DAA6D;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,4EAA4E;AAC5E,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG1E,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAMvE,+DAA+D;AAC/D,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC"}

package/dist/runtime/middleware.d.ts

@@ -0,0 +1,14 @@
+import "virtual:caretcms/schemas";
+type MiddlewareContext = {
+    locals: Record<string, unknown>;
+    cookies?: {
+        get: (name: string) => {
+            value: string;
+        } | undefined;
+    };
+    request?: Request;
+};
+type MiddlewareNext = () => Promise<Response>;
+export declare function onRequest(context: MiddlewareContext, next: MiddlewareNext): Promise<Response>;
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/runtime/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/runtime/middleware.ts"],"names":[],"mappings":"AASA,OAAO,0BAA0B,CAAC;AAElC,KAAK,iBAAiB,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KACtD,CAAC;IACF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAkBF,KAAK,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9C,wBAAsB,SAAS,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAkEnB"}

package/dist/runtime/middleware.js

@@ -0,0 +1,80 @@
+import { isEditorAuthenticated } from "./auth/session.js";
+import { isDemoModeEnabled, resolveDemoSession } from "./auth/demo-session.js";
+import { getRuntimeServices } from "./providers.js";
+import { runWithRequestContext } from "./request-context.js";
+import { rewriteCaretAttributes } from "./rewrite.js";
+import { SessionOverlayAdapter } from "./storage/session-overlay-adapter.js";
+// Side-effect import: registers any user-provided schemas into the schema registry
+import "virtual:caretcms/schemas";
+let _cachedRuntimeEnv;
+async function resolveRuntimeEnv() {
+    if (_cachedRuntimeEnv !== undefined)
+        return _cachedRuntimeEnv;
+    try {
+        const moduleId = "cloudflare:workers";
+        const mod = (await import(/* @vite-ignore */ moduleId));
+        _cachedRuntimeEnv = mod.env ?? null;
+    }
+    catch {
+        _cachedRuntimeEnv = null;
+    }
+    return _cachedRuntimeEnv;
+}
+export async function onRequest(context, next) {
+    const services = await getRuntimeServices();
+    const runtimeEnv = await resolveRuntimeEnv();
+    let adapter = services.adapter;
+    let uploadHandler = services.uploadHandler;
+    let sessionId = null;
+    let setCookieHeader = null;
+    const demoMode = isDemoModeEnabled(runtimeEnv);
+    if (demoMode) {
+        const request = context.request ?? new Request("http://localhost/");
+        const resolution = resolveDemoSession(context, request);
+        sessionId = resolution.sessionId;
+        setCookieHeader = resolution.setCookieHeader;
+        if (services.adapter.makeSessionOverlay) {
+            const overlay = await services.adapter.makeSessionOverlay(sessionId);
+            adapter = new SessionOverlayAdapter(services.adapter, overlay);
+        }
+        if (services.uploadHandler.makeSessionWrapper) {
+            uploadHandler = await services.uploadHandler.makeSessionWrapper(sessionId);
+        }
+    }
+    return runWithRequestContext({ adapter, uploadHandler, sessionId, demoMode }, async () => {
+        context.locals.isEditor = isEditorAuthenticated(context);
+        const inner = await next();
+        const contentType = inner.headers.get("content-type") ?? "";
+        const contentEncoding = inner.headers.get("content-encoding") ?? "";
+        // Skip compressed bodies — calling .text() on a gzip/brotli stream
+        // returns binary garbage, which then either fails the data-caret probe
+        // (silent corruption) or injects rewrites into a non-text payload.
+        // Identity / empty are the only encodings safe to decode as text.
+        const isIdentity = contentEncoding === "" || contentEncoding.toLowerCase() === "identity";
+        const isHtml = contentType.includes("text/html") && isIdentity;
+        let body = inner.body;
+        let bodyConsumed = false;
+        let rewritten = false;
+        if (isHtml) {
+            const html = await inner.text();
+            bodyConsumed = true;
+            if (html.includes("data-caret")) {
+                body = await rewriteCaretAttributes(html, adapter);
+                rewritten = true;
+            }
+            else {
+                body = html;
+            }
+        }
+        if (!bodyConsumed && !setCookieHeader) {
+            return inner;
+        }
+        const headers = new Headers(inner.headers);
+        if (rewritten)
+            headers.delete("content-length");
+        if (setCookieHeader)
+            headers.append("Set-Cookie", setCookieHeader);
+        return new Response(body, { status: inner.status, headers });
+    });
+}
+//# sourceMappingURL=middleware.js.map