@fullgrainsoftware/portal 0.9.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alexander Jessen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,242 @@
+# @fullgrainsoftware/portal
+
+Site SDK for the [Fullgrain Portal](https://www.abdevpanel.com) CMS: declare your
+site's structure in a typed manifest, read CMS-managed content in your pages,
+and sync structural changes with one command.
+
+```bash
+npm install @fullgrainsoftware/portal
+```
+
+## How it fits together
+
+- **The manifest owns structure.** `cms.manifest.ts` in your repo declares
+  pages, sections, and fields.
+- **The CMS owns content.** Editors change copy and images in the Fullgrain
+  Portal; your site fetches that content at render time.
+- **Seeds run once.** The `seed` blocks in the manifest fill a section the
+  first time it syncs — after that, the CMS content is the source of truth
+  and drifts from the manifest by design.
+
+## Declare your site
+
+```ts
+// cms.manifest.ts
+import { defineSite } from "@fullgrainsoftware/portal";
+
+export default defineSite({
+  alias: "my_site",
+  pages: [
+    {
+      slug: "/",
+      title: "Home",
+      sections: [
+        {
+          key: "hero",
+          title: "Hero",
+          kind: "singleton",
+          fields: {
+            heading: { label: "Heading", type: "text" },
+            subheading: { label: "Subheading", type: "text" },
+          },
+          seed: [{ name: "Hero", values: { heading: "Welcome" } }],
+        },
+      ],
+    },
+  ],
+});
+```
+
+## Read content in your pages
+
+```tsx
+import { fetchPublicSiteData, readSiteContent, cmsItemProps } from "@fullgrainsoftware/portal";
+import manifest from "../cms.manifest";
+
+// fetchPublicSiteData takes the site's CMS id (a UUID from your Fullgrain Software
+// contact), NOT the manifest alias. It returns { website }, so unwrap it before
+// passing to readSiteContent — otherwise every section silently reads as seed.
+const data = await fetchPublicSiteData(process.env.WEBSITE_ID!);
+const content = readSiteContent(manifest, data.website);
+
+content.hero.heading; // typed field access
+
+// Collection sections are arrays; spread cmsItemProps(item) onto each item's
+// wrapper for live-preview click-to-edit.
+content.showcase.map((item) => (
+  <div key={item._cms.id} {...cmsItemProps(item)}>
+    {item.name}
+  </div>
+));
+```
+
+`fetchPublicSiteData` targets the Fullgrain Portal by default; override with the
+`AB_CMS_URL` environment variable or `{ baseUrl }`.
+
+## Sync structural changes
+
+```bash
+npx fullgrain sync --dry-run   # show what would change
+npx fullgrain sync             # apply schema changes; seed only brand-new sections
+```
+
+Requires `AB_CMS_API_KEY` in the environment (ask your Fullgrain Software contact).
+The dry-run reports existing content as `skipped: seed` and CMS-only content
+as orphans — both are normal, not errors.
+
+## Commerce (Lite Commerce stores)
+
+For sites whose store is enabled in the panel. **Server-only** — the API key
+is a secret; `createCommerce` throws if constructed in the browser.
+
+```ts
+import { createCommerce } from "@fullgrainsoftware/portal";
+
+const commerce = createCommerce({ apiKey: process.env.COMMERCE_API_KEY! });
+
+const { store, products } = await commerce.listProducts();
+const { product } = await commerce.getProduct("demo-tee");
+const result = await commerce.createCheckout({
+  items: [{ variantId: product!.variants[0].id, quantity: 1 }],
+  successUrl: "https://your-site.com/thanks",
+  cancelUrl: "https://your-site.com/cart",
+});
+if ("url" in result) redirect(result.url); // Stripe Checkout
+else showIssues(result.issues);           // sold_out | invalid_items | commerce_paused
+```
+
+`store.checkoutAvailable` says whether buying works right now — the catalog
+keeps serving while a store is paused, so sites can choose to hide the shop
+or show it with purchasing disabled. `store.shippingCents` and
+`store.allowedCountries` mirror what checkout will charge and accept. Ask
+your Fullgrain Software contact for the `COMMERCE_API_KEY`.
+
+Cart pages validate against the live catalog (no stock is held):
+
+```ts
+const { lines, issues, subtotalCents } = await commerce.previewCart(cartItems);
+```
+
+Success pages look the order up by Stripe's `{CHECKOUT_SESSION_ID}`
+template value (add it to your `successUrl` as a query param):
+
+```ts
+const { order } = await commerce.getOrderStatus(searchParams.session_id);
+// order: { status, fulfilled, trackingCarrier, items, totalCents, … } | null
+```
+
+## Inquiries (contact forms)
+
+For sites with a contact/booking form. **Server-only** — the API key is a
+secret; `createInquiries` throws if constructed in the browser.
+
+```ts
+import { createInquiries } from "@fullgrainsoftware/portal";
+
+const inquiries = createInquiries({ apiKey: process.env.INQUIRY_API_KEY! });
+
+const result = await inquiries.submit({
+  form: "contact",                      // lower-kebab, ≤ 40 chars; default "contact"
+  name, email, phone, message,          // name + message required; email or phone required for "contact"
+  fields: { company, subject },         // optional extras, shown as label/value
+  rating: 5,                            // review forms only: a whole number 1–5
+  page: "/contact",                     // optional, where it was sent from
+  honeypot: String(formData.get("website") ?? ""),   // optional; non-empty = bot
+  meta: { ip, userAgent },              // optional; from the request headers
+});
+// { ok: true, id }
+// { ok: false, error: "invalid", issues: Record<string, string> }
+// { ok: false, error: "disabled" | "rate_limited" | "unavailable" }
+```
+
+The site owns its success and error states — `submit` never throws for an
+expected outcome. On `invalid`, show `result.issues` next to the fields; on
+`rate_limited`, say "try again in a few minutes"; on `disabled` (the client
+turned inquiries off in the panel) or `unavailable` (panel unreachable, a
+bad key, or any other unexpected response — already logged via
+`console.error`), fall back to a mailto/phone link rather than a dead form.
+Ask your Fullgrain Software contact for the `INQUIRY_API_KEY` (`abik_…`).
+
+## Bookings (appointments)
+
+For sites whose business takes appointments. **Server-only** — the API key
+is a secret; `createBookings` throws if constructed in the browser. Every
+method returns a typed result and never throws for an expected outcome.
+
+```ts
+import { createBookings } from "@fullgrainsoftware/portal";
+
+const bookings = createBookings({ apiKey: process.env.BOOKING_API_KEY! });
+
+const services = await bookings.listServices();
+if (!services.ok) return fallback();                                  // "disabled" | "unavailable" → show the phone number
+const { timezone, requirePhone } = services;                          // services.services: BookingService[]; requirePhone → mark the phone field required
+
+const days = await bookings.getAvailability({ serviceId, from: "2026-06-11", to: "2026-06-17" });
+if (!days.ok) return days.error === "invalid" ? badRequest(days.issues) : fallback();
+// days.days: [{ date: "2026-06-11", slots: ["2026-06-11T16:00:00.000Z", …] }]
+
+const result = await bookings.book({
+  serviceId, start: slot,                                              // one of the returned slots, verbatim
+  customer: { name, email, phone },                                    // email required; phone if the site requires it
+  note, fields: { "Intake · Area": "left arm" }, page: "/book",
+  honeypot: String(formData.get("website") ?? ""), meta: { ip, userAgent },
+});
+if (!result.ok) { /* "invalid" (result.issues) | "slot_taken" | "too_many_active" | "rate_limited" | "unknown_service" | "disabled" | "unavailable" */ }
+else { /* result.booking: BookingView — its manageUrl is what the customer's emails link to */ }
+await bookings.requestTime({ serviceId, text: "any weekday after 3", customer });   // when no slot fits
+```
+
+Render slots in the business's zone with no library:
+`new Intl.DateTimeFormat("en-US", { timeZone: timezone, weekday: "short", month: "short", day: "numeric", hour: "numeric", minute: "2-digit" }).format(new Date(slot))`.
+
+On `slot_taken`, re-fetch the day and ask for another time; on `disabled` or
+`unavailable`, show the phone number rather than a dead picker. Customers
+manage a booking from the `manageUrl` in their emails (the panel hosts that
+page); a site that wants its own can set a manage URL in the panel and call
+`getBooking(token)`, `cancel`, `reschedule`, and `respond` itself. Such a page
+should pass back the `version` it rendered (`cancel(token, { version: booking.version })`)
+so a stale page can't act on a booking that changed since it loaded.
+
+## Reviews
+
+For sites with a review form. Submit reviews through `createInquiries` with
+`form: "review"` and a `rating` (1–5). When the client turns on review
+moderation in the panel, each review waits in their inbox until they approve
+it; approved reviews then arrive with your content as `website.reviews`
+(newest first, at most 50) and refresh on the same revalidate ping as any
+content edit.
+
+```ts
+import { readReviews, type CMSReview } from "@fullgrainsoftware/portal";
+
+// lib/cms.ts — through the same cached fetch as the content
+export async function getReviews(): Promise<CMSReview[]> {
+  const websiteId = process.env.WEBSITE_ID;
+  if (!websiteId) return [];
+  try {
+    return readReviews((await getPublicSiteData(websiteId)).website);
+  } catch (err) {
+    console.error("[cms] reviews fetch failed:", err);
+    return [];
+  }
+}
+```
+
+Each review is `{ id, name, rating, text, createdAt }`: `name` is the display
+name the business chose (never the reviewer's email or full name), `rating`
+may be `null`, `createdAt` is ISO 8601 UTC. `readReviews` never throws: seed
+mode, reviews switched off, or an older panel all give `[]` — render nothing
+(or a code-owned fallback) for an empty list, and never invent reviews.
+Don't emit `aggregateRating` structured data from these: self-served reviews
+aren't eligible for review stars in search.
+
+## Live preview
+
+`initCmsPreview()` wires a site to the panel's live preview iframe (section
+scrolling, click-to-edit). Call it once client-side; it no-ops outside the
+preview.
+
+## License
+
+MIT © Alexander Jessen

package/bin/fullgrain.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runSync } from "../dist/cli.js";
+process.exit(await runSync(process.argv.slice(2)));

package/dist/bookings.d.ts

@@ -0,0 +1,169 @@
+export type BookingStatus = "requested" | "pending" | "proposed" | "confirmed" | "completed" | "no_show" | "cancelled" | "expired";
+export interface BookingService {
+    id: string;
+    slug: string;
+    name: string;
+    description: string;
+    durationMin: number;
+    priceLabel: string;
+}
+export interface AvailabilityDay {
+    date: string;
+    slots: string[];
+}
+export interface BookingView {
+    id: string;
+    status: BookingStatus;
+    service: {
+        id: string;
+        name: string;
+        durationMin: number;
+        priceLabel: string;
+    };
+    timezone: string;
+    start: string | null;
+    end: string | null;
+    previousStart: string | null;
+    customer: {
+        name: string;
+        email: string;
+        phone: string | null;
+    };
+    note: string;
+    fields: Record<string, string>;
+    requestedText: string | null;
+    manageUrl: string;
+    can: {
+        cancel: boolean;
+        reschedule: boolean;
+        respond: boolean;
+    };
+    policy: {
+        cancelCutoffMin: number;
+        rescheduleCutoffMin: number;
+        reschedulesLeft: number;
+        contactPhone: string;
+    };
+    business: {
+        name: string;
+        location: string;
+    };
+    /** Bumps on every time change. Pass it back to cancel / reschedule / respond
+     *  so a page rendered before a change can't act on the changed booking. */
+    version: number;
+}
+export interface BookingCustomer {
+    name: string;
+    email: string;
+    phone?: string | null;
+}
+export interface BookInput {
+    serviceId: string;
+    /** ISO 8601 instant, exactly one of the slots from getAvailability. */
+    start: string;
+    customer: BookingCustomer;
+    note?: string | null;
+    fields?: Record<string, string>;
+    page?: string | null;
+    honeypot?: string | null;
+    meta?: {
+        ip?: string | null;
+        userAgent?: string | null;
+    };
+}
+export interface RequestTimeInput {
+    serviceId: string;
+    text: string;
+    customer: BookingCustomer;
+    fields?: Record<string, string>;
+    page?: string | null;
+    honeypot?: string | null;
+    meta?: {
+        ip?: string | null;
+        userAgent?: string | null;
+    };
+}
+type Unavailable = {
+    ok: false;
+    error: "unavailable";
+};
+type Invalid = {
+    ok: false;
+    error: "invalid";
+    issues: Record<string, string>;
+};
+export type ServicesResult = {
+    ok: true;
+    timezone: string;
+    /** The site's "require phone" setting: a booking or request without a phone is `invalid`. */
+    requirePhone: boolean;
+    services: BookingService[];
+} | {
+    ok: false;
+    error: "disabled";
+} | Unavailable;
+export type AvailabilityResult = {
+    ok: true;
+    timezone: string;
+    service: BookingService;
+    days: AvailabilityDay[];
+} | Invalid | {
+    ok: false;
+    error: "unknown_service" | "disabled";
+} | Unavailable;
+export type BookResult = {
+    ok: true;
+    booking: BookingView;
+} | Invalid | {
+    ok: false;
+    error: "slot_taken" | "too_many_active" | "rate_limited" | "unknown_service" | "disabled";
+} | Unavailable;
+export type RequestTimeResult = {
+    ok: true;
+    booking: BookingView;
+} | Invalid | {
+    ok: false;
+    error: "rate_limited" | "unknown_service" | "disabled";
+} | Unavailable;
+export type GetBookingResult = {
+    ok: true;
+    booking: BookingView;
+} | {
+    ok: false;
+    error: "not_found" | "disabled";
+} | Unavailable;
+export type ManageResult = {
+    ok: true;
+    booking: BookingView;
+} | Invalid | {
+    ok: false;
+    error: "cutoff" | "limit_reached" | "slot_taken" | "invalid_transition" | "not_found" | "disabled";
+} | Unavailable;
+export interface Bookings {
+    listServices(): Promise<ServicesResult>;
+    getAvailability(args: {
+        serviceId: string;
+        from: string;
+        to?: string;
+    }): Promise<AvailabilityResult>;
+    book(input: BookInput): Promise<BookResult>;
+    requestTime(input: RequestTimeInput): Promise<RequestTimeResult>;
+    getBooking(token: string): Promise<GetBookingResult>;
+    cancel(token: string, opts?: {
+        reason?: string | null;
+        version?: number;
+    }): Promise<ManageResult>;
+    reschedule(token: string, opts: {
+        start: string;
+        version?: number;
+    }): Promise<ManageResult>;
+    respond(token: string, opts: {
+        accept: boolean;
+        version?: number;
+    }): Promise<ManageResult>;
+}
+export declare function createBookings(opts: {
+    apiKey: string;
+    baseUrl?: string;
+}): Bookings;
+export {};

package/dist/bookings.js

@@ -0,0 +1,96 @@
+/* Bookings (spec 2026-09-28): a site lists services, fetches open slots,
+   books or requests a time, and lets the customer act on a booking through
+   its manage token. Server-only — the abbk_ key is a secret — and every
+   method returns a typed result instead of throwing for an expected
+   outcome, so a site can never show a dead picker. */
+const DEFAULT_BASE_URL = "https://www.abdevpanel.com";
+const TIMEOUT_MS = 10_000;
+const versionOf = (o) => (typeof o?.version === "number" ? { version: o.version } : {});
+export function createBookings(opts) {
+    if (typeof window !== "undefined") {
+        throw new Error("createBookings is server-only — never expose BOOKING_API_KEY to the browser");
+    }
+    if (!opts.apiKey?.startsWith("abbk_")) {
+        throw new Error("createBookings needs a booking API key (abbk_…)");
+    }
+    const base = (opts.baseUrl ?? process.env.AB_CMS_URL ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+    const unavailable = (why) => {
+        // The manage token is a bearer credential for the booking: never log it.
+        console.error(`[fullgrain bookings] ${why.replace(/\/manage\/[^\s?#)]+/g, "/manage/…")}`);
+        return { ok: false, error: "unavailable" };
+    };
+    async function call(path, init) {
+        let res;
+        try {
+            res = await fetch(`${base}${path}`, {
+                method: init.method,
+                headers: { Authorization: `Bearer ${opts.apiKey}`, ...(init.body !== undefined ? { "Content-Type": "application/json" } : {}) },
+                body: init.body !== undefined ? JSON.stringify(init.body) : undefined,
+                cache: "no-store",
+                signal: AbortSignal.timeout(TIMEOUT_MS),
+            });
+        }
+        catch (err) {
+            return { failed: `request failed: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        const contentType = res.headers.get("content-type") ?? "";
+        if (!contentType.includes("application/json"))
+            return { failed: `non-JSON response ${res.status} from ${base}${path}` };
+        const body = (await res.json().catch(() => null));
+        return { status: res.status, body };
+    }
+    // One mapper for every method: a 200 with ok:true is the body; the listed
+    // error codes pass through by status; anything else (401, 5xx, an error
+    // the method never declares, junk) is unavailable — so runtime values
+    // never escape a method's declared union.
+    function map(f, path, allowed) {
+        if ("failed" in f)
+            return unavailable(f.failed);
+        const { status, body } = f;
+        if (status === 200 && body?.ok === true)
+            return body;
+        if (status === 400 && body?.error === "invalid" && allowed.includes("invalid"))
+            return { ok: false, error: "invalid", issues: body.issues ?? {} };
+        if (status === 403 && allowed.includes("disabled"))
+            return { ok: false, error: "disabled" };
+        if (status === 429 && allowed.includes("rate_limited"))
+            return { ok: false, error: "rate_limited" };
+        if ((status === 404 || status === 409) && typeof body?.error === "string" && allowed.includes(body.error))
+            return { ok: false, error: body.error };
+        return unavailable(`unexpected response ${status}${body?.error ? ` (${body.error})` : ""} from ${base}${path}`);
+    }
+    const manage = (token, body) => {
+        const path = `/api/booking/manage/${encodeURIComponent(token)}`;
+        return call(path, { method: "POST", body }).then((f) => map(f, path, ["invalid", "not_found", "cutoff", "limit_reached", "slot_taken", "invalid_transition", "disabled"]));
+    };
+    return {
+        async listServices() {
+            const path = "/api/booking/services";
+            const result = map(await call(path, { method: "GET" }), path, ["disabled"]);
+            // Always a boolean, even from a panel that predates the field.
+            return result.ok ? { ...result, requirePhone: result.requirePhone === true } : result;
+        },
+        async getAvailability({ serviceId, from, to }) {
+            const qs = new URLSearchParams({ service: serviceId, from });
+            if (to)
+                qs.set("to", to);
+            const path = `/api/booking/availability?${qs.toString()}`;
+            return map(await call(path, { method: "GET" }), path, ["invalid", "unknown_service", "disabled"]);
+        },
+        async book(input) {
+            const path = "/api/booking/book";
+            return map(await call(path, { method: "POST", body: input }), path, ["invalid", "unknown_service", "slot_taken", "too_many_active", "rate_limited", "disabled"]);
+        },
+        async requestTime(input) {
+            const path = "/api/booking/request";
+            return map(await call(path, { method: "POST", body: input }), path, ["invalid", "unknown_service", "rate_limited", "disabled"]);
+        },
+        async getBooking(token) {
+            const path = `/api/booking/manage/${encodeURIComponent(token)}`;
+            return map(await call(path, { method: "GET" }), path, ["not_found", "disabled"]);
+        },
+        cancel: (token, o) => manage(token, { action: "cancel", ...(o?.reason ? { reason: o.reason } : {}), ...versionOf(o) }),
+        reschedule: (token, o) => manage(token, { action: "reschedule", start: o.start, ...versionOf(o) }),
+        respond: (token, o) => manage(token, { action: o.accept ? "accept" : "decline", ...versionOf(o) }),
+    };
+}

package/dist/cli.d.ts

@@ -0,0 +1,16 @@
+type SyncReport = {
+    dryRun: boolean;
+    website: {
+        id: string;
+        alias: string;
+        name: string;
+    };
+    created: string[];
+    updated: string[];
+    seeded: string[];
+    skipped: string[];
+    orphans: string[];
+};
+export declare function formatReport(report: SyncReport): string;
+export declare function runSync(argv: string[]): Promise<number>;
+export {};

package/dist/cli.js

@@ -0,0 +1,116 @@
+import { createJiti } from "jiti";
+import path from "node:path";
+import { siteManifestSchema } from "./manifest.js";
+export function formatReport(report) {
+    const lines = [];
+    lines.push(`${report.dryRun ? "DRY RUN — no changes applied" : "Applied"} — website "${report.website.name}" (alias ${report.website.alias})`);
+    for (const c of report.created)
+        lines.push(`  + ${c}`);
+    for (const u of report.updated)
+        lines.push(`  * updated: ${u}`);
+    for (const s of report.seeded)
+        lines.push(`  ~ seeded: ${s}`);
+    for (const s of report.skipped)
+        lines.push(`  - skipped: ${s}`);
+    for (const o of report.orphans)
+        lines.push(`  ! orphan: ${o}`);
+    if (!report.created.length && !report.updated.length &&
+        !report.seeded.length && !report.skipped.length && !report.orphans.length) {
+        lines.push("  No changes.");
+    }
+    return lines.join("\n");
+}
+export async function runSync(argv) {
+    if (argv[0] !== "sync") {
+        console.error("Usage: fullgrain sync [--dry-run] [--manifest <path>]");
+        return 2;
+    }
+    // Validate flags and FAIL CLOSED on anything unrecognised. `sync` performs an
+    // irreversible, content-destroying apply when --dry-run is absent, so a typo
+    // like `--dryrun` or `-n` must be an error, never a silent full apply.
+    const manifestFlag = argv.indexOf("--manifest");
+    const flags = argv.slice(1);
+    for (let i = 0; i < flags.length; i++) {
+        const arg = flags[i];
+        if (arg === "--manifest") {
+            i++; // its value is consumed, not a flag
+            continue;
+        }
+        if (arg === "--dry-run")
+            continue;
+        if (arg.startsWith("-")) {
+            console.error(`Unknown flag "${arg}"\nUsage: fullgrain sync [--dry-run] [--manifest <path>]`);
+            return 2;
+        }
+    }
+    const dryRun = argv.includes("--dry-run");
+    const manifestArg = manifestFlag !== -1 ? argv[manifestFlag + 1] : "cms.manifest.ts";
+    if (manifestFlag !== -1 && (!manifestArg || manifestArg.startsWith("--"))) {
+        console.error("--manifest requires a path");
+        return 2;
+    }
+    const manifestPath = path.resolve(manifestArg);
+    const apiKey = process.env.AB_CMS_API_KEY;
+    if (!apiKey) {
+        console.error("AB_CMS_API_KEY is not set");
+        return 1;
+    }
+    const baseUrl = (process.env.AB_CMS_URL ?? "https://www.abdevpanel.com").replace(/\/$/, "");
+    const jiti = createJiti(import.meta.url);
+    let loaded;
+    try {
+        loaded = await jiti.import(manifestPath, { default: true });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`Could not load manifest at ${manifestPath}: ${message}`);
+        return 1;
+    }
+    const parsed = siteManifestSchema.safeParse(loaded);
+    if (!parsed.success) {
+        console.error("Manifest is invalid:");
+        for (const issue of parsed.error.issues) {
+            console.error(`  - ${issue.path.join(".")}: ${issue.message}`);
+        }
+        return 1;
+    }
+    let report;
+    try {
+        const response = await fetch(`${baseUrl}/api/admin/sync-site`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({ manifest: parsed.data, dryRun }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            let parsedBody = null;
+            try {
+                parsedBody = JSON.parse(text);
+            }
+            catch {
+                parsedBody = null;
+            }
+            if (parsedBody && typeof parsedBody === "object" && "partialReport" in parsedBody) {
+                const body = parsedBody;
+                console.error(`Sync failed (${response.status}): ${body.message ?? ""}`);
+                console.error("Partial result:");
+                console.error(formatReport(body.partialReport));
+            }
+            else {
+                console.error(`Sync failed (${response.status}): ${text}`);
+            }
+            return 1;
+        }
+        report = (await response.json());
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`Could not reach ${baseUrl}: ${message}`);
+        return 1;
+    }
+    console.log(formatReport(report));
+    return 0;
+}

package/dist/cms-client.d.ts

@@ -0,0 +1,9 @@
+import type { PublicSiteData } from "./cms-types.js";
+export declare function fetchPublicSiteData(websiteId: string, opts?: {
+    baseUrl?: string;
+    /** Abort the request after this many ms (default 10000). A hung panel must
+     *  not hang the awaiting Server Component render. */
+    timeoutMs?: number;
+    /** Caller-supplied abort signal; combined with the internal timeout. */
+    signal?: AbortSignal;
+}): Promise<PublicSiteData>;