@cogenta/cli 0.4.0 → 0.6.0

package/dist/commands/forms-page.js

@@ -0,0 +1,191 @@
+import { HONEYPOT_FIELD, isFormFileValue, TIMESTAMP_FIELD } from '@cogenta/forms';
+import { escapeHtmlAttribute, escapeHtmlText } from '@cogenta/seo';
+import { renderPageChrome, } from './theme-render.js';
+function labelFor(field) {
+    return field.label + (field.required ? ' *' : '');
+}
+function fieldValueText(state, name) {
+    const raw = state.values?.[name];
+    if (Array.isArray(raw))
+        return raw.join(', ');
+    return typeof raw === 'string' ? raw : '';
+}
+function checkedValues(state, name) {
+    const raw = state.values?.[name];
+    if (Array.isArray(raw))
+        return raw.map(String);
+    return typeof raw === 'string' && raw !== '' ? [raw] : [];
+}
+function fieldHasError(state, field) {
+    return state.errorField === field.name;
+}
+function fieldWrapper(field, hasError, input) {
+    const id = `cg-form-field-${field.name}`;
+    const errorId = `${id}-error`;
+    return `<div class="cg-form__field">
+<label for="${id}">${escapeHtmlText(labelFor(field))}</label>
+${input}
+${field.help !== undefined ? `<p class="cg-form__help">${escapeHtmlText(field.help)}</p>` : ''}
+${hasError ? `<p id="${errorId}" class="cg-form__field-error" role="alert">This field needs your attention.</p>` : ''}
+</div>`;
+}
+function renderField(field, state) {
+    const hasError = fieldHasError(state, field);
+    const id = `cg-form-field-${field.name}`;
+    const errorId = `${id}-error`;
+    const describedBy = hasError ? ` aria-describedby="${errorId}"` : '';
+    const invalid = ` aria-invalid="${hasError ? 'true' : 'false'}"`;
+    const required = field.required ? ' required' : '';
+    const name = escapeHtmlAttribute(field.name);
+    let input;
+    switch (field.kind) {
+        case 'text':
+        case 'email':
+        case 'phone':
+        case 'date': {
+            const type = field.kind === 'email'
+                ? 'email'
+                : field.kind === 'phone'
+                    ? 'tel'
+                    : field.kind === 'date'
+                        ? 'date'
+                        : 'text';
+            input = `<input type="${type}" id="${id}" name="${name}"${required}${invalid}${describedBy} value="${escapeHtmlAttribute(fieldValueText(state, field.name))}">`;
+            break;
+        }
+        case 'number': {
+            input = `<input type="number" id="${id}" name="${name}"${required}${invalid}${describedBy} value="${escapeHtmlAttribute(fieldValueText(state, field.name))}">`;
+            break;
+        }
+        case 'longText': {
+            input = `<textarea id="${id}" name="${name}"${required}${invalid}${describedBy} rows="5">${escapeHtmlText(fieldValueText(state, field.name))}</textarea>`;
+            break;
+        }
+        case 'choiceSingle': {
+            const options = (field.choices ?? [])
+                .map((choice) => {
+                const selected = fieldValueText(state, field.name) === choice ? ' selected' : '';
+                return `<option value="${escapeHtmlAttribute(choice)}"${selected}>${escapeHtmlText(choice)}</option>`;
+            })
+                .join('');
+            input = `<select id="${id}" name="${name}"${required}${invalid}${describedBy}><option value="">—</option>${options}</select>`;
+            break;
+        }
+        case 'choiceMulti': {
+            const checked = checkedValues(state, field.name);
+            input = (field.choices ?? [])
+                .map((choice, index) => {
+                const choiceId = `${id}-${index}`;
+                const isChecked = checked.includes(choice) ? ' checked' : '';
+                return `<label class="cg-form__choice"><input type="checkbox" id="${choiceId}" name="${name}" value="${escapeHtmlAttribute(choice)}"${isChecked}> ${escapeHtmlText(choice)}</label>`;
+            })
+                .join('');
+            break;
+        }
+        case 'file': {
+            // Fiche 47 task 3. A file input can never be pre-filled by a server
+            // (browsers refuse it, for good reason) — the best this can do on
+            // redisplay is say what is already on file, from a value already
+            // resolved to a `FormFileValue` (carried forward via `_accumulated`,
+            // or accepted earlier in this very flow before another field failed).
+            const already = state.values?.[field.name];
+            const note = isFormFileValue(already)
+                ? `<p class="cg-form__help">Already uploaded: ${escapeHtmlText(already.filename)}. Choose a new file only to replace it.</p>`
+                : '';
+            return fieldWrapper(field, hasError, `<input type="file" id="${id}" name="${name}"${invalid}${describedBy}>${note}`);
+        }
+        case 'consent': {
+            const isChecked = fieldValueText(state, field.name) === 'true' ? ' checked' : '';
+            return `<div class="cg-form__field cg-form__field--consent">
+<label><input type="checkbox" id="${id}" name="${name}" value="true"${required}${invalid}${describedBy}${isChecked}> ${escapeHtmlText(field.consentText ?? field.label)}</label>
+${hasError ? `<p id="${errorId}" class="cg-form__field-error" role="alert">Consent is required to submit this form.</p>` : ''}
+</div>`;
+        }
+        default: {
+            input = '';
+        }
+    }
+    return fieldWrapper(field, hasError, input);
+}
+function confirmationPage(definition, options, context) {
+    return shell(definition.label, `<div class="cg-form__confirmation" role="status"><p>${escapeHtmlText(definition.confirmationMessage)}</p></div>`, options, context);
+}
+/**
+ * The real site chrome (`renderPageChrome`, `theme-render.ts`) — the same
+ * skip link, header and footer every collection page renders, not a second,
+ * thinner `<html>` shell of this file's own (L20 audit, points 8-9).
+ */
+async function shell(title, body, options, context) {
+    return renderPageChrome({
+        site: options.site,
+        locale: options.site.defaultLocale,
+        styles: options.styles,
+        headHtml: `<title>${escapeHtmlText(title)} — ${escapeHtmlText(options.site.name)}</title>`,
+        bodyHtml: `<main class="cg-main" id="cg-main">
+<h1 class="cg-page__title">${escapeHtmlText(title)}</h1>
+${body}
+</main>`,
+        ...(options.menus === undefined ? {} : { menus: options.menus }),
+        ...(options.branding === undefined ? {} : { branding: options.branding }),
+        ...(options.activeTheme === undefined ? {} : { activeTheme: options.activeTheme }),
+        ...(options.seo === undefined ? {} : { seo: options.seo }),
+        ...(options.identity === undefined ? {} : { identity: options.identity }),
+        ...(options.loadMedia === undefined ? {} : { loadMedia: options.loadMedia }),
+    }, context);
+}
+function stepFieldsOf(definition, stepIndex) {
+    const stepsCount = definition.steps.length;
+    if (stepsCount <= 1)
+        return { fields: definition.fields, isFinalStep: true };
+    const clamped = Math.min(Math.max(stepIndex, 0), stepsCount - 1);
+    const step = definition.steps[clamped];
+    const names = new Set(step?.fieldNames ?? []);
+    return {
+        fields: definition.fields.filter((field) => names.has(field.name)),
+        isFinalStep: clamped >= stepsCount - 1,
+    };
+}
+/**
+ * The whole page: the form itself (one step of it, for a multi-step form),
+ * or its confirmation view under `?submitted=1` when the form has no
+ * `redirectTo` of its own.
+ */
+export function renderFormPage(definition, state, options, context) {
+    if (state.submitted === true)
+        return confirmationPage(definition, options, context);
+    const stepIndex = state.step ?? 0;
+    const { fields: stepFields, isFinalStep } = stepFieldsOf(definition, stepIndex);
+    const isMultiStep = definition.steps.length > 1;
+    const errorBanner = state.errorMessage != null
+        ? `<p class="cg-form__error" role="alert">${escapeHtmlText(state.errorMessage)}</p>`
+        : '';
+    const fields = stepFields.map((field) => renderField(field, state)).join('\n');
+    const ts = state.ts ?? String(options.now());
+    const needsMultipart = stepFields.some((field) => field.kind === 'file');
+    const stepHiddenFields = isMultiStep
+        ? `<input type="hidden" name="_step" value="${stepIndex}">
+<input type="hidden" name="_accumulated" value="${escapeHtmlAttribute(JSON.stringify(state.accumulated ?? {}))}">`
+        : '';
+    const captcha = isFinalStep && definition.captcha.enabled
+        ? `<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+<div class="cf-turnstile" data-sitekey="${escapeHtmlAttribute(definition.captcha.siteKey ?? '')}"></div>`
+        : '';
+    const submitLabel = isFinalStep ? 'Send' : 'Next';
+    const body = `${errorBanner}
+<form class="cg-form" method="post" action="/api/forms/${encodeURIComponent(definition.name)}/submit"${needsMultipart ? ' enctype="multipart/form-data"' : ''}>
+${fields}
+${stepHiddenFields}
+<div class="cg-form__honeypot" aria-hidden="true" style="position:absolute;left:-9999px;top:-9999px;width:1px;height:1px;overflow:hidden;">
+<label for="cg-form-hp">Leave this field empty</label>
+<input type="text" id="cg-form-hp" name="${HONEYPOT_FIELD}" tabindex="-1" autocomplete="off" value="">
+</div>
+<input type="hidden" name="${TIMESTAMP_FIELD}" value="${escapeHtmlAttribute(ts)}">
+${captcha}
+<button type="submit">${submitLabel}</button>
+</form>`;
+    return shell(definition.label, body, options, context);
+}
+export function renderFormNotFoundPage(options, context) {
+    return shell('Not found', '<p>This form does not exist, or is not accepting submissions.</p>', options, context);
+}
+//# sourceMappingURL=forms-page.js.map

package/dist/commands/forms-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-page.js","sourceRoot":"","sources":["../../src/commands/forms-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEjF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAGL,gBAAgB,GAEjB,MAAM,mBAAmB,CAAA;AAoE1B,SAAS,QAAQ,CAAC,KAA0B;IAC1C,OAAO,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,KAAoB,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,KAAoB,EAAE,KAA0B;IACrE,OAAO,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAA;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,KAA0B,EAAE,QAAiB,EAAE,KAAa;IAChF,MAAM,EAAE,GAAG,iBAAiB,KAAK,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,EAAE,QAAQ,CAAA;IAC7B,OAAO;cACK,EAAE,KAAK,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;EAClD,KAAK;EACL,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;EAC5F,QAAQ,CAAC,CAAC,CAAC,UAAU,OAAO,kFAAkF,CAAC,CAAC,CAAC,EAAE;OAC9G,CAAA;AACP,CAAC;AAED,SAAS,WAAW,CAAC,KAA0B,EAAE,KAAoB;IACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,EAAE,GAAG,iBAAiB,KAAK,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,EAAE,QAAQ,CAAA;IAC7B,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACpE,MAAM,OAAO,GAAG,kBAAkB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAA;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE5C,IAAI,KAAa,CAAA;IACjB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO;gBACpB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;oBACtB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;wBACrB,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,MAAM,CAAA;YAChB,KAAK,GAAG,gBAAgB,IAAI,SAAS,EAAE,WAAW,IAAI,IAAI,QAAQ,GAAG,OAAO,GAAG,WAAW,WAAW,mBAAmB,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;YAC/J,MAAK;QACP,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,KAAK,GAAG,4BAA4B,EAAE,WAAW,IAAI,IAAI,QAAQ,GAAG,OAAO,GAAG,WAAW,WAAW,mBAAmB,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;YAC9J,MAAK;QACP,CAAC;QACD,KAAK,UAAU,EAAE,CAAC;YAChB,KAAK,GAAG,iBAAiB,EAAE,WAAW,IAAI,IAAI,QAAQ,GAAG,OAAO,GAAG,WAAW,aAAa,cAAc,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAA;YACzJ,MAAK;QACP,CAAC;QACD,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;iBAClC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACd,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;gBAChF,OAAO,kBAAkB,mBAAmB,CAAC,MAAM,CAAC,IAAI,QAAQ,IAAI,cAAc,CAAC,MAAM,CAAC,WAAW,CAAA;YACvG,CAAC,CAAC;iBACD,IAAI,CAAC,EAAE,CAAC,CAAA;YACX,KAAK,GAAG,eAAe,EAAE,WAAW,IAAI,IAAI,QAAQ,GAAG,OAAO,GAAG,WAAW,+BAA+B,OAAO,WAAW,CAAA;YAC7H,MAAK;QACP,CAAC;QACD,KAAK,aAAa,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAChD,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;iBAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBACrB,MAAM,QAAQ,GAAG,GAAG,EAAE,IAAI,KAAK,EAAE,CAAA;gBACjC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC5D,OAAO,6DAA6D,QAAQ,WAAW,IAAI,YAAY,mBAAmB,CAAC,MAAM,CAAC,IAAI,SAAS,KAAK,cAAc,CAAC,MAAM,CAAC,UAAU,CAAA;YACtL,CAAC,CAAC;iBACD,IAAI,CAAC,EAAE,CAAC,CAAA;YACX,MAAK;QACP,CAAC;QACD,KAAK,MAAM,EAAE,CAAC;YACZ,oEAAoE;YACpE,kEAAkE;YAClE,iEAAiE;YACjE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;gBACnC,CAAC,CAAC,8CAA8C,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,6CAA6C;gBAC7H,CAAC,CAAC,EAAE,CAAA;YACN,OAAO,YAAY,CACjB,KAAK,EACL,QAAQ,EACR,0BAA0B,EAAE,WAAW,IAAI,IAAI,OAAO,GAAG,WAAW,IAAI,IAAI,EAAE,CAC/E,CAAA;QACH,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA;YAChF,OAAO;oCACuB,EAAE,WAAW,IAAI,iBAAiB,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,KAAK,cAAc,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC;EACrK,QAAQ,CAAC,CAAC,CAAC,UAAU,OAAO,0FAA0F,CAAC,CAAC,CAAC,EAAE;OACtH,CAAA;QACH,CAAC;QACD,SAAS,CAAC;YACR,KAAK,GAAG,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA0B,EAC1B,OAAwB,EACxB,OAAsB;IAEtB,OAAO,KAAK,CACV,UAAU,CAAC,KAAK,EAChB,uDAAuD,cAAc,CAAC,UAAU,CAAC,mBAAmB,CAAC,YAAY,EACjH,OAAO,EACP,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,KAAK,CAClB,KAAa,EACb,IAAY,EACZ,OAAwB,EACxB,OAAsB;IAEtB,OAAO,gBAAgB,CACrB;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,UAAU,cAAc,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;QAC1F,QAAQ,EAAE;6BACa,cAAc,CAAC,KAAK,CAAC;EAChD,IAAI;QACE;QACF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;KAC7E,EACD,OAAO,CACR,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CACnB,UAA0B,EAC1B,SAAiB;IAEjB,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAA;IAC1C,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAE5E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAA;IAC7C,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClE,WAAW,EAAE,OAAO,IAAI,UAAU,GAAG,CAAC;KACvC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,UAA0B,EAC1B,KAAoB,EACpB,OAAwB,EACxB,OAAsB;IAEtB,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAEnF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAA;IACjC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAC/E,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IAE/C,MAAM,WAAW,GACf,KAAK,CAAC,YAAY,IAAI,IAAI;QACxB,CAAC,CAAC,0CAA0C,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM;QACpF,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE9E,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;IAExE,MAAM,gBAAgB,GAAG,WAAW;QAClC,CAAC,CAAC,4CAA4C,SAAS;kDACT,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI;QAC9G,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,OAAO,GACX,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO;QACvC,CAAC,CAAC;0CACkC,mBAAmB,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,UAAU;QACnG,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAEjD,MAAM,IAAI,GAAG,GAAG,WAAW;yDAC4B,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,cAAc,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE;EAC3J,MAAM;EACN,gBAAgB;;;2CAGyB,cAAc;;6BAE5B,eAAe,YAAY,mBAAmB,CAAC,EAAE,CAAC;EAC7E,OAAO;wBACe,WAAW;QAC3B,CAAA;IAEN,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,OAAsB;IAEtB,OAAO,KAAK,CACV,WAAW,EACX,mEAAmE,EACnE,OAAO,EACP,OAAO,CACR,CAAA;AACH,CAAC"}

package/dist/commands/import.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,MAAM,EAGZ,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAElD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAE1C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA+BD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CvE"}
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,MAAM,EAGZ,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAElD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAE1C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA+BD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAsDvE"}

package/dist/commands/import.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import process from 'node:process';
+import { createCommentStore, ensureCommentsTables } from '@cogenta/comments';
 import { createDatabaseRegistry, createLogger, createStorageRegistry, isCogentaError, loadConfig, } from '@cogenta/core';
 import { formatConversionReport, importWordPress } from '@cogenta/import';
 const USAGE = `Usage
@@ -57,7 +58,18 @@ export async function runImport(options) {
         return 1;
     }
     try {
-        const report = await withSite(options, logger, (db, storage) => importWordPress(xml, { db, storage }));
+        const report = await withSite(options, logger, async (db, storage) => {
+            // Contract F (ADR-0025): the CLI always passes a real comment store —
+            // `cogenta import wordpress` is the one caller of `importWordPress`
+            // this project ships, and a WordPress export with comments deserves
+            // to keep them with real status and threading, not the legacy
+            // synthetic collection (`ImportWordPressOptions.comments`'s own
+            // comment explains the fallback that exists only for a caller that
+            // has not wired this yet).
+            await ensureCommentsTables(db);
+            const comments = createCommentStore({ db });
+            return importWordPress(xml, { db, storage, comments });
+        });
         out.heading('WordPress import');
         out.line(formatConversionReport(report));
         return 0;

package/dist/commands/import.js.map

@@ -1 +1 @@
-{"version":3,"file":"import.js","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,qBAAqB,EAErB,cAAc,EAEd,UAAU,GAEX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAezE,MAAM,KAAK,GAAG;;;;;;;CAOb,CAAA;AAED,KAAK,UAAU,QAAQ,CACrB,OAAsB,EACtB,MAAc,EACd,GAA+D;IAE/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG;KACJ,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC3F,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC9F,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE/B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAA;QACxD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACvC,MAAM,CAAC,uBAAuB,OAAO,CAAC,UAAU,SAAS,KAAK,EAAE,CAAC,CAAA;QACjE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAElE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CACJ,mBAAmB,OAAO,CAAC,IAAI,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAChG,CAAA;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAC7D,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CACtC,CAAA;QAED,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC/B,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAA;YAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAA;QACzD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC"}
+{"version":3,"file":"import.js","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,qBAAqB,EAErB,cAAc,EAEd,UAAU,GAEX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAezE,MAAM,KAAK,GAAG;;;;;;;CAOb,CAAA;AAED,KAAK,UAAU,QAAQ,CACrB,OAAsB,EACtB,MAAc,EACd,GAA+D;IAE/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG;KACJ,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC3F,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC9F,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE/B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAA;QACxD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACvC,MAAM,CAAC,uBAAuB,OAAO,CAAC,UAAU,SAAS,KAAK,EAAE,CAAC,CAAA;QACjE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAElE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CACJ,mBAAmB,OAAO,CAAC,IAAI,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAChG,CAAA;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,8DAA8D;YAC9D,gEAAgE;YAChE,mEAAmE;YACnE,2BAA2B;YAC3B,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAA;YAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YAC3C,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC/B,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAA;YAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAA;QACzD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC"}

package/dist/commands/mcp.d.ts

@@ -0,0 +1,35 @@
+import { type Logger } from '@cogenta/core';
+import type { Output, Writer } from '../output.js';
+export interface McpOptions {
+    readonly cwd?: string;
+    readonly env?: Record<string, string | undefined>;
+    readonly logger?: Logger;
+    readonly out: Output;
+    readonly stderr: Writer;
+    /** Resolves the acting user from the real user store — the process that launched this command IS that user. */
+    readonly email?: string;
+    /** A synthetic actor for local testing (`--role viewer`), never combined with --email. */
+    readonly role?: string;
+    /**
+     * A machine-to-machine bearer credential minted from the admin's "MCP"
+     * screen (or the generic "Clés API" one) — resolved through the exact same
+     * `ApiKeyStore` REST's `resolveActor` verifies against
+     * (`@cogenta/auth`'s `createApiKeyStore`), never a second store. The
+     * actor's roles are the key's `scope`, and its id is `apikey:<key id>`,
+     * mirroring `resolveApiKeyActor` in `@cogenta/api` byte for byte — a role
+     * this key was not granted is refused by the same `PermissionLayer` REST
+     * uses, not by anything specific to MCP. Never combined with --email or
+     * --role.
+     */
+    readonly apiKey?: string;
+    /** Injectable for tests — defaults to the real process streams. */
+    readonly stdin?: NodeJS.ReadableStream;
+    readonly stdout?: NodeJS.WritableStream;
+}
+/**
+ * `cogenta mcp` — a real MCP server over stdin/stdout, wired to this site's
+ * actual content and tools. `serveMcpOverStdio` never returns on its own; the
+ * process exits when its stdin closes (the spawning client disconnected).
+ */
+export declare function runMcp(options: McpOptions): Promise<number>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/commands/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AA4BA,OAAO,EAOL,KAAK,MAAM,EAEZ,MAAM,eAAe,CAAA;AAWtB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAGlD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;CACxC;AAiND;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA8FjE"}

package/dist/commands/mcp.js

@@ -0,0 +1,277 @@
+import { dirname } from 'node:path';
+import process from 'node:process';
+import { buildManifest, createContentDeleteTool, createContentPublishTool, createContentReadTool, createContentWriteDraftTool, createMediaReadTool, createMediaWriteTool, createSiteConfigReadTool, createToolRegistry, } from '@cogenta/agents';
+import { createContentService, createPermissionLayer, } from '@cogenta/api';
+import { createApiKeyStore, createUserStore, ensureAuthTables, looksLikeApiKey, } from '@cogenta/auth';
+import { CogentaError, createDatabaseMediaStore, createDatabaseRegistry, createLogger, isCogentaError, loadConfig, } from '@cogenta/core';
+import { createMcpServer, serveMcpOverStdio } from '@cogenta/mcp';
+import { createContentStore, createRolePermissionOverlay, createRolePermissionStore, createSchemaTables, } from '@cogenta/schema';
+import { loadSchemaModule } from './serve.js';
+const USAGE = `Usage
+  cogenta mcp [--email <email> | --role <role> | --api-key <key>]
+
+Starts an MCP (Model Context Protocol) server on stdin/stdout, exposing this
+site's content and site tools to whatever process spawned this command
+(Claude Desktop, Claude Code, Cursor, or any other MCP client). See
+packages/mcp/README.md for how to connect one.
+
+--email resolves the acting user from this site's own user store: every tool
+call runs with that user's real roles, checked by the same permission layer
+REST and GraphQL use (R4). --role hands a synthetic actor with no id and the
+named role(s) (comma-separated) — meant for local testing, never for a real
+deployment. --api-key resolves the acting roles from a key minted in the
+admin's "MCP" or "Clés API" screen, through the exact same key store and
+verification REST uses for that key — a role the key was not granted is
+refused by the same permission layer, exactly as it would be over HTTP.
+
+With none of these flags, tool calls run as an anonymous ("public") actor:
+content tools still run through the real permission layer (a public actor
+sees only what a public actor may see), but media, site-config and
+HTTP-fetch tools — which have no permission check of their own to fall back
+on — are left out of the manifest entirely. See BLOCKERS.md, "MCP actor
+scoping", for why.
+
+Options
+  --email <email>    Run as this user (looked up in the user store; must exist)
+  --role <role,…>    Run as a synthetic actor with these roles, no real user
+  --api-key <key>    Run as the actor a "cogenta_sk_…" API key was granted
+`;
+/** A fresh, undecorated store per collection: an MCP tool call reads and writes content the same way `cogenta serve`'s REST/GraphQL routes do, through the real permission layer, but does not carry the search/redirect/schedule/vector decorators `assembleSite` wraps around a store — those are cache and derived-index maintenance, not permission-relevant, and wiring the whole of `assembleSite` into a single stdio command is out of this task's scope (see BLOCKERS.md). */
+function storeForFactory(db, collections) {
+    const cache = new Map();
+    return (collection) => {
+        const existing = cache.get(collection.name);
+        if (existing !== undefined)
+            return existing;
+        const created = createContentStore({ db, collection, siblings: collections });
+        cache.set(collection.name, created);
+        return created;
+    };
+}
+/**
+ * Adapts `@cogenta/api`'s real `ContentService` to the narrow
+ * `ContentServiceLike` the core content tools (`@cogenta/agents`) declare
+ * against — a `SerialisedEntry` is a plain, already-JSON-safe object (the
+ * exact shape REST hands back as `data`), it merely lacks the string index
+ * signature `Record<string, unknown>` promises structurally. Runtime shape
+ * is identical; this is a type-level seam only.
+ */
+function contentServiceLikeOf(service) {
+    return {
+        read: (context, collection, id, options) => service.read(context, collection, id, options),
+        create: (context, collection, input, options) => service.create(context, collection, input, options),
+        update: (context, collection, id, input, options) => service.update(context, collection, id, input, options),
+        publish: (context, collection, id, input, options) => service.publish(context, collection, id, input, options),
+        remove: (context, collection, id) => service.remove(context, collection, id),
+    };
+}
+/**
+ * Resolves the actor this MCP server's tool calls will run as.
+ *
+ * `--email` looks the user up in the real user store — the account must
+ * already exist (`cogenta users create`); this command never creates one.
+ * `--role` is a synthetic actor for local testing. `--api-key` resolves
+ * through the same `ApiKeyStore` (`@cogenta/auth`) REST's `resolveActor`
+ * verifies against — one store, two callers, never a second lookup path.
+ * None given: the anonymous ("public") actor, same as an unauthenticated
+ * REST request.
+ */
+async function resolveMcpActor(options, db) {
+    const given = [options.email, options.role, options.apiKey].filter((value) => value !== undefined).length;
+    if (given > 1) {
+        throw new CogentaError({
+            code: 'MCP_ACTOR_OPTIONS_CONFLICT',
+            message: '--email, --role and --api-key are mutually exclusive.',
+            hint: 'Pass exactly one: --email resolves a real user, --role is a synthetic test actor, --api-key resolves a minted key.',
+        });
+    }
+    if (options.apiKey !== undefined) {
+        if (!looksLikeApiKey(options.apiKey)) {
+            throw new CogentaError({
+                code: 'MCP_ACTOR_API_KEY_INVALID',
+                message: 'That does not look like a Cogenta API key.',
+                hint: 'A real key starts with "cogenta_sk_" — copy it again from the admin\'s "MCP" screen.',
+            });
+        }
+        await ensureAuthTables(db);
+        const apiKeys = createApiKeyStore(db);
+        const key = await apiKeys.verify(options.apiKey);
+        if (key === null) {
+            throw new CogentaError({
+                code: 'MCP_ACTOR_API_KEY_INVALID',
+                message: 'This API key is unknown, revoked, or expired.',
+                hint: 'Mint a new one from the admin\'s "MCP" screen, or "Clés API" for a general-purpose key.',
+            });
+        }
+        // Mirrors `resolveApiKeyActor` in `@cogenta/api` (`packages/api/src/rest/auth-router.ts`)
+        // exactly: the same id shape and the same "roles = scope" mapping, so a
+        // key behaves identically whether it authenticates an HTTP request or
+        // this stdio server.
+        return { actor: { id: `apikey:${key.id}`, roles: key.scope }, authenticated: true };
+    }
+    if (options.email !== undefined) {
+        await ensureAuthTables(db);
+        const users = createUserStore(db);
+        const user = await users.byEmail(options.email);
+        if (user === null) {
+            throw new CogentaError({
+                code: 'MCP_ACTOR_USER_NOT_FOUND',
+                message: `No user with email "${options.email}".`,
+                hint: 'Create the account first with "cogenta users create --email <email> --roles <role,role>".',
+            });
+        }
+        return { actor: { id: user.id, roles: user.roles }, authenticated: true };
+    }
+    if (options.role !== undefined) {
+        const roles = options.role
+            .split(',')
+            .map((role) => role.trim())
+            .filter((role) => role.length > 0);
+        if (roles.length === 0) {
+            throw new CogentaError({
+                code: 'MCP_ACTOR_ROLE_EMPTY',
+                message: '--role was given but named no role.',
+                hint: 'Pass at least one role name, e.g. --role viewer or --role editor,reviewer.',
+            });
+        }
+        return { actor: { id: null, roles }, authenticated: true };
+    }
+    return { actor: { id: null, roles: ['public'] }, authenticated: false };
+}
+/**
+ * Builds this site's real tool manifest for the resolved actor.
+ *
+ * Content tools (`content.*`) are always included: their actual permission
+ * gate lives inside `ContentService`, which calls the same `PermissionLayer`
+ * REST and GraphQL use, on every call, keyed on `ctx.actor` — so an anonymous
+ * actor is already refused whatever a `public` role may not read or write,
+ * exactly as it would be over HTTP.
+ *
+ * Media, site-config and HTTP-fetch tools have no such internal check (their
+ * own doc comments say so plainly: "this tool's declared permissions is the
+ * actual gate, enforced by the manifest" — meaning by *this* function, not by
+ * the store). They are therefore included only for an authenticated actor
+ * (`--email` or `--role`), never for the anonymous default — R4 requires a
+ * runtime check somewhere, and for these three tools the manifest boundary is
+ * the only place that check can happen.
+ */
+function buildSiteManifest(options) {
+    const registered = [
+        createContentReadTool(options.contentService),
+        createContentWriteDraftTool(options.contentService),
+        createContentPublishTool(options.contentService),
+        createContentDeleteTool(options.contentService),
+    ];
+    if (options.authenticated) {
+        registered.push(createMediaReadTool(options.mediaStore), createMediaWriteTool(options.mediaStore), createSiteConfigReadTool());
+    }
+    const registry = createToolRegistry(registered);
+    return buildManifest(registry, registered.map((tool) => tool.name), {
+        site: options.site,
+        actor: options.actor,
+        logger: {
+            info: (message, fields) => options.logger.info(message, fields),
+            warn: (message, fields) => options.logger.warn(message, fields),
+            error: (message, fields) => options.logger.error(message, fields),
+        },
+    });
+}
+/**
+ * `cogenta mcp` — a real MCP server over stdin/stdout, wired to this site's
+ * actual content and tools. `serveMcpOverStdio` never returns on its own; the
+ * process exits when its stdin closes (the spawning client disconnected).
+ */
+export async function runMcp(options) {
+    const { out, stderr } = options;
+    const env = options.env ?? process.env;
+    const logger = options.logger ?? createLogger({ level: 'silent' });
+    if ([options.email, options.role, options.apiKey].filter((value) => value !== undefined).length > 1) {
+        stderr(`--email, --role and --api-key are mutually exclusive.\n\n${USAGE}`);
+        return 2;
+    }
+    let loaded;
+    try {
+        loaded = await loadConfig({
+            ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
+            env,
+        });
+    }
+    catch (error) {
+        return reportFailure(stderr, error);
+    }
+    const projectRoot = loaded.path === null ? (options.cwd ?? process.cwd()) : dirname(loaded.path);
+    let collections;
+    let taxonomies;
+    try {
+        const loadedSchema = await loadSchemaModule(projectRoot);
+        collections = loadedSchema.collections;
+        taxonomies = loadedSchema.taxonomies;
+    }
+    catch (error) {
+        return reportFailure(stderr, error);
+    }
+    const selection = await createDatabaseRegistry({ logger }).select(loaded.config.database);
+    const db = selection.instance;
+    try {
+        await createSchemaTables(db, collections, []);
+        const { actor, authenticated } = await resolveMcpActor(options, db);
+        // Fiche 63, ADR-0028: `cogenta mcp` builds its own `PermissionLayer`
+        // (never `assembleSite`'s), so it must consult the same override table —
+        // otherwise a permission an admin just revoked in production would stay
+        // granted to any MCP client until the process restarts, exactly the
+        // silent-widening R4 exists to prevent.
+        const rolePermissionOverlay = await createRolePermissionOverlay(createRolePermissionStore({ db, collections, taxonomies }));
+        const permissions = createPermissionLayer({
+            collections,
+            rolePermissionOverrides: rolePermissionOverlay,
+        });
+        const storeFor = storeForFactory(db, collections);
+        const contentService = createContentService({ collections, permissions, storeFor });
+        const mediaStore = createDatabaseMediaStore({ db });
+        const tools = buildSiteManifest({
+            contentService: contentServiceLikeOf(contentService),
+            mediaStore,
+            site: {
+                name: loaded.config.site.name,
+                ...(loaded.config.site.url === undefined ? {} : { url: loaded.config.site.url }),
+                locales: loaded.config.site.locales,
+                defaultLocale: loaded.config.site.defaultLocale,
+            },
+            actor,
+            authenticated,
+            logger,
+        });
+        out.detail(`MCP server ready — ${tools.length} tool(s), actor: ${actor.id ?? '(anonymous)'} [${actor.roles.join(', ')}]`);
+        const server = createMcpServer({ name: 'cogenta', version: '1.0.0', tools });
+        serveMcpOverStdio({
+            server,
+            ...(options.stdin === undefined ? {} : { input: options.stdin }),
+            ...(options.stdout === undefined ? {} : { output: options.stdout }),
+        });
+        // Runs until stdin closes (the MCP client disconnected) — this command
+        // has no other exit condition, matching stdio MCP servers generally.
+        return await new Promise((resolvePromise) => {
+            const input = options.stdin ?? process.stdin;
+            input.once('end', () => resolvePromise(0));
+            input.once('close', () => resolvePromise(0));
+        });
+    }
+    catch (error) {
+        return reportFailure(stderr, error);
+    }
+    finally {
+        await selection.dispose();
+    }
+}
+function reportFailure(stderr, error) {
+    if (isCogentaError(error)) {
+        stderr(`${error.code}: ${error.message}\n`);
+        if (error.hint !== undefined)
+            stderr(`${error.hint}\n`);
+    }
+    else {
+        stderr(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+    }
+    return 1;
+}
+//# sourceMappingURL=mcp.js.map

package/dist/commands/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,aAAa,EAEb,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,GAGnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAGL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EAEZ,cAAc,EAEd,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAGL,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GAEnB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AA6B7C,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bb,CAAA;AAED,udAAud;AACvd,SAAS,eAAe,CACtB,EAAkB,EAClB,WAA4C;IAE5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC7C,OAAO,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAA;QAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;QAC7E,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACnC,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAuB;IACnD,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CACzC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,CAAgD;QAC/F,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC9C,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAEjD;QACH,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAClD,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAErD;QACH,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACnD,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAEtD;QACH,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC;KAC7E,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAmB,EACnB,EAAkB;IAElB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAC/B,CAAC,MAAM,CAAA;IACR,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,oHAAoH;SAC3H,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,4CAA4C;gBACrD,IAAI,EAAE,sFAAsF;aAC7F,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,+CAA+C;gBACxD,IAAI,EAAE,yFAAyF;aAChG,CAAC,CAAA;QACJ,CAAC;QACD,0FAA0F;QAC1F,wEAAwE;QACxE,sEAAsE;QACtE,qBAAqB;QACrB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAC1B,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,uBAAuB,OAAO,CAAC,KAAK,IAAI;gBACjD,IAAI,EAAE,2FAA2F;aAClG,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI;aACvB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EAAE,4EAA4E;aACnF,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,iBAAiB,CAAC,OAO1B;IACC,MAAM,UAAU,GAAqB;QACnC,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC;QAC7C,2BAA2B,CAAC,OAAO,CAAC,cAAc,CAAC;QACnD,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC;QAChD,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC;KAChD,CAAA;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CACb,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,EACvC,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,EACxC,wBAAwB,EAAE,CAC3B,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC/C,OAAO,aAAa,CAClB,QAAQ,EACR,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EACnC;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;YAC/D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;YAC/D,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;SAClE;KACF,CACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAmB;IAC9C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAElE,IACE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAC/F,CAAC;QACD,MAAM,CAAC,4DAA4D,KAAK,EAAE,CAAC,CAAA;QAC3E,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,MAA8C,CAAA;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC;YACxB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1D,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAEhG,IAAI,WAA4C,CAAA;IAChD,IAAI,UAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAA;QACxD,WAAW,GAAG,YAAY,CAAC,WAAW,CAAA;QACtC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAA;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAA;IAE7B,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QAE7C,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAEnE,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,wCAAwC;QACxC,MAAM,qBAAqB,GAAG,MAAM,2BAA2B,CAC7D,yBAAyB,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAC3D,CAAA;QACD,MAAM,WAAW,GAAG,qBAAqB,CAAC;YACxC,WAAW;YACX,uBAAuB,EAAE,qBAAqB;SAC/C,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,cAAc,GAAG,oBAAoB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnF,MAAM,UAAU,GAAG,wBAAwB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnD,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,cAAc,EAAE,oBAAoB,CAAC,cAAc,CAAC;YACpD,UAAU;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;gBAC7B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;gBACnC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;aAChD;YACD,KAAK;YACL,aAAa;YACb,MAAM;SACP,CAAC,CAAA;QAEF,GAAG,CAAC,MAAM,CACR,sBAAsB,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,EAAE,IAAI,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAA;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5E,iBAAiB,CAAC;YAChB,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAc,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAe,EAAE,CAAC;SAC7E,CAAC,CAAA;QAEF,uEAAuE;QACvE,qEAAqE;QACrE,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,EAAE;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAA;YAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,KAAc;IACnD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAA;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAA;IACzD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/commands/roles.d.ts

@@ -0,0 +1,22 @@
+import { type Logger } from '@cogenta/core';
+import type { Output, Writer } from '../output.js';
+/**
+ * `cogenta roles export` — fiche 63, task 3's last requirement: freeze the
+ * `cogenta_role_permissions` table's current state into a file a site can
+ * commit to git, for a site that wants to be able to return to an entirely
+ * versioned source. The file is a snapshot, never a second thing
+ * `PermissionLayer` reads — see `role-permission-export.ts`'s own comment.
+ */
+export type RolesSubcommand = 'export';
+export interface RolesOptions {
+    readonly subcommand: string | undefined;
+    readonly cwd?: string;
+    readonly env?: Record<string, string | undefined>;
+    readonly logger?: Logger;
+    readonly out: Output;
+    readonly stderr: Writer;
+    /** `export` only: where to write the file. Defaults to `cogenta.role-permissions.json` at the project root. */
+    readonly file?: string;
+}
+export declare function runRoles(options: RolesOptions): Promise<number>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/commands/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/commands/roles.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,MAAM,EAEZ,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAGlD;;;;;;GAMG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAA;AAEtC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+GAA+G;IAC/G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAmED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAarE"}