@growth-labs/cms 0.1.0

package/dist/engine/validator/types.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Shared types for the article-body validator. The body validator is
+ * the single source of truth for ingest-time formatting QA. Each
+ * `checks/<code>.ts` module imports from here and returns
+ * `ValidationError[]` for the input it's given.
+ *
+ * Ported verbatim from fulcrum-labs/fronts
+ * src/lib/article-body-validator/types.ts (inventory §1: extract).
+ * Severity defaults to `warn` for new checks; a code is promoted to
+ * `block` only when it's a proven render-breaker.
+ */
+export interface ArticleBodyInput {
+    body_markdown: string | null;
+    body_html: string | null;
+}
+export interface ValidationSpan {
+    start: number;
+    end: number;
+}
+export type Severity = 'block' | 'warn';
+export interface ValidationError {
+    code: ValidationErrorCode;
+    message: string;
+    severity?: Severity;
+    span?: ValidationSpan;
+}
+export type ValidationErrorCode = 'data-uri-artifact' | 'baked-astro-error-template' | 'escaped-raw-html' | 'unbalanced-markdown-emphasis' | 'malformed-data-image-markdown' | 'single-sentence-paragraphs-pattern' | 'backslash-over-escape' | 'html-entity-in-heading' | 'empty-body' | 'broken-footnote-label' | 'unresolved-footnote-anchor' | 'word-gdocs-paste-artifacts' | 'html-comment-leak' | 'raw-block-html' | 'double-encoded-entities' | 'invisible-control-chars' | 'bare-url-not-autolinked' | 'empty-alt-text' | 'iframe-missing-dims-and-wrapper' | 'heading-hierarchy-skip' | 'paywall-marker-leak' | 'stale-body-html';
+export type ValidationResult = {
+    ok: true;
+} | {
+    ok: false;
+    errors: ValidationError[];
+};
+/**
+ * Per-code severity defaults. Used by callers that surface block vs
+ * warn separately (publish-guard returns 422 for any block-severity
+ * code, 200 + warnings for warn-only codes).
+ */
+export declare const SEVERITY: Readonly<Record<ValidationErrorCode, Severity>>;
+export interface ValidatorOptions {
+    /**
+     * Threshold for {@link checkSingleSentenceParagraphsPattern}. Kept
+     * tunable so the heuristic can be relaxed for pull-quote-heavy
+     * formats (e.g. video transcripts).
+     */
+    singleSentenceParagraphRun: number;
+}
+export declare const DEFAULT_OPTIONS: ValidatorOptions;
+export declare function makeError(code: ValidationErrorCode, message: string, span?: ValidationSpan): ValidationError;
+//# sourceMappingURL=types.d.ts.map

package/dist/engine/validator/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/engine/validator/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX;AAED,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAA;AAEvC,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,mBAAmB,CAAA;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,CAAC,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,MAAM,mBAAmB,GAG5B,mBAAmB,GACnB,4BAA4B,GAC5B,kBAAkB,GAClB,8BAA8B,GAC9B,+BAA+B,GAC/B,oCAAoC,GACpC,uBAAuB,GACvB,wBAAwB,GACxB,YAAY,GAEZ,uBAAuB,GACvB,4BAA4B,GAC5B,4BAA4B,GAC5B,mBAAmB,GACnB,gBAAgB,GAChB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,gBAAgB,GAChB,iCAAiC,GACjC,wBAAwB,GACxB,qBAAqB,GACrB,iBAAiB,CAAA;AAEpB,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAAA;AAEtF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAyBpE,CAAA;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAA;CAClC;AAED,eAAO,MAAM,eAAe,EAAE,gBAE7B,CAAA;AAED,wBAAgB,SAAS,CACxB,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACnB,eAAe,CAIjB"}

package/dist/engine/validator/types.js

@@ -0,0 +1,51 @@
+/**
+ * Shared types for the article-body validator. The body validator is
+ * the single source of truth for ingest-time formatting QA. Each
+ * `checks/<code>.ts` module imports from here and returns
+ * `ValidationError[]` for the input it's given.
+ *
+ * Ported verbatim from fulcrum-labs/fronts
+ * src/lib/article-body-validator/types.ts (inventory §1: extract).
+ * Severity defaults to `warn` for new checks; a code is promoted to
+ * `block` only when it's a proven render-breaker.
+ */
+/**
+ * Per-code severity defaults. Used by callers that surface block vs
+ * warn separately (publish-guard returns 422 for any block-severity
+ * code, 200 + warnings for warn-only codes).
+ */
+export const SEVERITY = {
+    // Existing Phase 0 / Phase 1 — keep block for the proven render-breakers.
+    'data-uri-artifact': 'block',
+    'baked-astro-error-template': 'block',
+    'escaped-raw-html': 'block',
+    'unbalanced-markdown-emphasis': 'warn',
+    'malformed-data-image-markdown': 'block',
+    'single-sentence-paragraphs-pattern': 'warn',
+    'backslash-over-escape': 'block',
+    'html-entity-in-heading': 'block',
+    'empty-body': 'block',
+    // Phase 2.
+    'broken-footnote-label': 'block',
+    'unresolved-footnote-anchor': 'warn',
+    'word-gdocs-paste-artifacts': 'block',
+    'html-comment-leak': 'block',
+    'raw-block-html': 'warn',
+    'double-encoded-entities': 'block',
+    'invisible-control-chars': 'block',
+    'bare-url-not-autolinked': 'warn',
+    'empty-alt-text': 'warn',
+    'iframe-missing-dims-and-wrapper': 'warn',
+    'heading-hierarchy-skip': 'warn',
+    'paywall-marker-leak': 'block',
+    'stale-body-html': 'block',
+};
+export const DEFAULT_OPTIONS = {
+    singleSentenceParagraphRun: 10,
+};
+export function makeError(code, message, span) {
+    return span
+        ? { code, message, span, severity: SEVERITY[code] }
+        : { code, message, severity: SEVERITY[code] };
+}
+//# sourceMappingURL=types.js.map

package/dist/engine/validator/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/engine/validator/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkDH;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAoD;IACxE,0EAA0E;IAC1E,mBAAmB,EAAE,OAAO;IAC5B,4BAA4B,EAAE,OAAO;IACrC,kBAAkB,EAAE,OAAO;IAC3B,8BAA8B,EAAE,MAAM;IACtC,+BAA+B,EAAE,OAAO;IACxC,oCAAoC,EAAE,MAAM;IAC5C,uBAAuB,EAAE,OAAO;IAChC,wBAAwB,EAAE,OAAO;IACjC,YAAY,EAAE,OAAO;IACrB,WAAW;IACX,uBAAuB,EAAE,OAAO;IAChC,4BAA4B,EAAE,MAAM;IACpC,4BAA4B,EAAE,OAAO;IACrC,mBAAmB,EAAE,OAAO;IAC5B,gBAAgB,EAAE,MAAM;IACxB,yBAAyB,EAAE,OAAO;IAClC,yBAAyB,EAAE,OAAO;IAClC,yBAAyB,EAAE,MAAM;IACjC,gBAAgB,EAAE,MAAM;IACxB,iCAAiC,EAAE,MAAM;IACzC,wBAAwB,EAAE,MAAM;IAChC,qBAAqB,EAAE,OAAO;IAC9B,iBAAiB,EAAE,OAAO;CAC1B,CAAA;AAWD,MAAM,CAAC,MAAM,eAAe,GAAqB;IAChD,0BAA0B,EAAE,EAAE;CAC9B,CAAA;AAED,MAAM,UAAU,SAAS,CACxB,IAAyB,EACzB,OAAe,EACf,IAAqB;IAErB,OAAO,IAAI;QACV,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACnD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAA;AAC/C,CAAC"}

package/dist/engine/webhook-signer.d.ts

@@ -0,0 +1,39 @@
+import type { D1Database } from './d1.js';
+/**
+ * Sign a webhook body with HMAC-SHA256 using the given secret.
+ *
+ * Returns the hex-encoded HMAC digest. Uses Web Crypto (crypto.subtle) —
+ * workerd-native, no node:crypto dependency.
+ *
+ * Called by the default dispatchWebhook impl with the secret read from ctx.env.
+ * Tests can call this directly to assert the signing behaviour.
+ */
+export declare function signWebhookBody(body: string, secret: string): Promise<string>;
+/**
+ * The Cloudflare Secrets Store binding name for the webhook HMAC secret.
+ * The host wires a [[secrets_store_secrets]] binding with this name.
+ * Callers that need a custom binding name supply their own dispatchWebhook.
+ */
+export declare const WEBHOOK_HMAC_BINDING = "WEBHOOK_HMAC_SECRET";
+/**
+ * Build the package-default dispatchWebhook implementation.
+ *
+ * The impl:
+ *   1. Loads registered webhook URLs for the workspace + eventType from D1.
+ *   2. Reads the HMAC signing secret from ctx.env[bindingName] (Secrets Store).
+ *      If the binding is absent, dispatches unsigned (no crash, no D1 read).
+ *   3. Builds the standard envelope, signs the body (if secret present), POSTs.
+ *   4. Updates last_status / last_fired_at on each webhook row.
+ *
+ * The package defines the seam; the host can override by injecting its own impl.
+ */
+export declare function buildDefaultDispatchWebhook(db: D1Database, options?: {
+    bindingName?: string;
+}): (ctx: {
+    env?: Record<string, unknown>;
+}, payload: {
+    eventType: string;
+    workspaceId: string;
+    data: unknown;
+}) => Promise<void>;
+//# sourceMappingURL=webhook-signer.d.ts.map

package/dist/engine/webhook-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signer.d.ts","sourceRoot":"","sources":["../../src/engine/webhook-signer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAQzC;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAanF;AAMD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAC1C,EAAE,EAAE,UAAU,EACd,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,CACF,GAAG,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACtC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,KAC9D,OAAO,CAAC,IAAI,CAAC,CAkEjB"}

package/dist/engine/webhook-signer.js

@@ -0,0 +1,117 @@
+// webhook-signer.ts — HMAC-SHA256 signing for outbound webhook payloads (P7 Task 9).
+//
+// Security invariants (spec §12 scope guard 4):
+//   - The signing secret is NEVER stored in D1, in a row, in a log, or in a response.
+//   - The secret is read ONLY from ctx.env (a Cloudflare Secrets Store binding wired
+//     by the host at cutover). The package defines the seam; the host injects the impl.
+//   - A missing binding produces an unsigned/disabled state — never a crash, never a D1
+//     read, never an exception that propagates past the try/catch in the caller.
+//
+// Uses Web Crypto (crypto.subtle) — workerd-native, no node:crypto.
+import { validateWebhookUrl } from './url-guard.js';
+import { buildWebhookEnvelope, listWebhooks, updateWebhookStatus } from './webhooks.js';
+// ---------------------------------------------------------------------------
+// HMAC signer (pure, testable in isolation)
+// ---------------------------------------------------------------------------
+/**
+ * Sign a webhook body with HMAC-SHA256 using the given secret.
+ *
+ * Returns the hex-encoded HMAC digest. Uses Web Crypto (crypto.subtle) —
+ * workerd-native, no node:crypto dependency.
+ *
+ * Called by the default dispatchWebhook impl with the secret read from ctx.env.
+ * Tests can call this directly to assert the signing behaviour.
+ */
+export async function signWebhookBody(body, secret) {
+    const enc = new TextEncoder();
+    const keyMaterial = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', keyMaterial, enc.encode(body));
+    return Array.from(new Uint8Array(sig))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+// ---------------------------------------------------------------------------
+// Default dispatchWebhook implementation
+// ---------------------------------------------------------------------------
+/**
+ * The Cloudflare Secrets Store binding name for the webhook HMAC secret.
+ * The host wires a [[secrets_store_secrets]] binding with this name.
+ * Callers that need a custom binding name supply their own dispatchWebhook.
+ */
+export const WEBHOOK_HMAC_BINDING = 'WEBHOOK_HMAC_SECRET';
+/**
+ * Build the package-default dispatchWebhook implementation.
+ *
+ * The impl:
+ *   1. Loads registered webhook URLs for the workspace + eventType from D1.
+ *   2. Reads the HMAC signing secret from ctx.env[bindingName] (Secrets Store).
+ *      If the binding is absent, dispatches unsigned (no crash, no D1 read).
+ *   3. Builds the standard envelope, signs the body (if secret present), POSTs.
+ *   4. Updates last_status / last_fired_at on each webhook row.
+ *
+ * The package defines the seam; the host can override by injecting its own impl.
+ */
+export function buildDefaultDispatchWebhook(db, options = {}) {
+    const bindingName = options.bindingName ?? WEBHOOK_HMAC_BINDING;
+    return async (ctx, { eventType, workspaceId, data }) => {
+        // Load registered webhooks for this workspace + event.
+        const all = await listWebhooks(db, workspaceId);
+        const matching = all.filter((w) => w.eventType === eventType);
+        if (matching.length === 0)
+            return;
+        // Build the envelope once; reuse for all matching webhooks.
+        const envelope = buildWebhookEnvelope({ eventType, workspaceId, data });
+        const body = JSON.stringify(envelope);
+        // Read the signing secret from ctx.env (Secrets Store binding only).
+        // A missing binding means we dispatch unsigned — never a crash or D1 read.
+        const secret = ctx.env && typeof ctx.env[bindingName] === 'string' ? ctx.env[bindingName] : null;
+        let signature = null;
+        if (secret) {
+            try {
+                signature = await signWebhookBody(body, secret);
+            }
+            catch {
+                // Signing failure → dispatch unsigned; never propagate.
+            }
+        }
+        // POST to each matching URL.
+        for (const webhook of matching) {
+            // Defense in depth: re-validate the stored URL at fire time. The route
+            // guard rejects unsafe URLs on create, but a row could predate the guard
+            // or be written out-of-band — never POST to a loopback/link-local/
+            // metadata/private/internal target. Mark the delivery 'blocked' and skip.
+            if (!validateWebhookUrl(webhook.url).ok) {
+                try {
+                    await updateWebhookStatus(db, webhook.id, 'blocked');
+                }
+                catch {
+                    // Status update failure must not propagate.
+                }
+                continue;
+            }
+            const headers = {
+                'Content-Type': 'application/json',
+                'X-Masthead-Event': eventType,
+                'X-Masthead-Delivery': envelope.id,
+            };
+            if (signature) {
+                headers['X-Masthead-Signature'] = `sha256=${signature}`;
+            }
+            let status = 'error';
+            try {
+                const res = await fetch(webhook.url, { method: 'POST', headers, body });
+                status = String(res.status);
+            }
+            catch {
+                status = 'error';
+            }
+            try {
+                await updateWebhookStatus(db, webhook.id, status);
+            }
+            catch {
+                // Status update failure must not propagate.
+            }
+        }
+    };
+}
+//# sourceMappingURL=webhook-signer.js.map

package/dist/engine/webhook-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signer.js","sourceRoot":"","sources":["../../src/engine/webhook-signer.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,gDAAgD;AAChD,sFAAsF;AACtF,qFAAqF;AACrF,wFAAwF;AACxF,wFAAwF;AACxF,iFAAiF;AACjF,EAAE;AACF,oEAAoE;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEvF,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAChD,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAClB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACR,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACX,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CAC1C,EAAc,EACd,UAAoC,EAAE;IAKtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAA;IAE/D,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE;QACtD,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAEjC,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAErC,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,MAAM,GACX,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAA;QAE9F,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACJ,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACR,wDAAwD;YACzD,CAAC;QACF,CAAC;QAED,6BAA6B;QAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,uEAAuE;YACvE,yEAAyE;YACzE,mEAAmE;YACnE,0EAA0E;YAC1E,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;gBACzC,IAAI,CAAC;oBACJ,MAAM,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACR,4CAA4C;gBAC7C,CAAC;gBACD,SAAQ;YACT,CAAC;YAED,MAAM,OAAO,GAA2B;gBACvC,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,SAAS;gBAC7B,qBAAqB,EAAE,QAAQ,CAAC,EAAE;aAClC,CAAA;YACD,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,sBAAsB,CAAC,GAAG,UAAU,SAAS,EAAE,CAAA;YACxD,CAAC;YAED,IAAI,MAAM,GAAG,OAAO,CAAA;YACpB,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,GAAG,OAAO,CAAA;YACjB,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAClD,CAAC;YAAC,MAAM,CAAC;gBACR,4CAA4C;YAC7C,CAAC;QACF,CAAC;IACF,CAAC,CAAA;AACF,CAAC"}

package/dist/engine/webhooks.d.ts

@@ -0,0 +1,75 @@
+import type { D1Database } from './d1.js';
+/** The 12 webhook event types (authoritative; spec §12 §Task 8). */
+export declare const WEBHOOK_EVENTS: readonly ["content.published", "content.unpublished", "content.scheduled", "content.created", "content.deleted", "content.review", "content.duplicated", "video.processed", "video.failed", "author.created", "media.uploaded", "webhook.test"];
+export type WebhookEvent = (typeof WEBHOOK_EVENTS)[number];
+export interface CreateWebhookInput {
+    workspaceId: string;
+    eventType: string;
+    url: string;
+}
+/** A webhook registration record (no secret field). */
+export interface WebhookRecord {
+    id: string;
+    workspaceId: string;
+    eventType: string;
+    url: string;
+    lastStatus: string | null;
+    lastFiredAt: number | null;
+    createdAt: number;
+}
+/** The standard outbound webhook payload envelope. */
+export interface WebhookEnvelope {
+    /** Unique id for this delivery (UUID). */
+    id: string;
+    /** The event type, e.g. 'content.published'. */
+    event: string;
+    /** The workspace the event originated in. */
+    workspaceId: string;
+    /** Unix epoch seconds of when the event occurred. */
+    occurredAt: number;
+    /** Event-specific data payload. */
+    data: unknown;
+}
+/**
+ * Register a new webhook for a workspace.
+ *
+ * Validates the eventType against the WEBHOOK_EVENTS enum; rejects unknown
+ * values so misconfigured hooks surface early. The row has NO secret column —
+ * the HMAC secret is read from ctx.env at dispatch time only.
+ */
+export declare function createWebhook(db: D1Database, input: CreateWebhookInput): Promise<WebhookRecord>;
+/**
+ * List all webhooks registered for a workspace.
+ * Ordered by created_at ASC (deterministic).
+ */
+export declare function listWebhooks(db: D1Database, workspaceId: string): Promise<WebhookRecord[]>;
+/**
+ * Delete a webhook registration by its id, SCOPED to the caller's workspace.
+ *
+ * The workspaceId is resolved from the authenticated caller (auth/locals) and
+ * MUST be passed by the route — never trusted from the client. Scoping the
+ * DELETE by workspace_id closes a cross-workspace IDOR: a member of workspace A
+ * cannot delete workspace B's webhook by id.
+ *
+ * No-ops for non-existent / out-of-workspace ids (idempotent).
+ */
+export declare function deleteWebhook(db: D1Database, id: string, workspaceId: string): Promise<void>;
+/**
+ * Update the last_status and last_fired_at on a webhook row.
+ * Called after a dispatch attempt (success or failure) to record the result.
+ */
+export declare function updateWebhookStatus(db: D1Database, id: string, status: string): Promise<void>;
+/** Input for building a standard webhook payload envelope. */
+export interface BuildWebhookEnvelopeInput {
+    eventType: string;
+    workspaceId: string;
+    data: unknown;
+}
+/**
+ * Build the standard outbound webhook payload envelope.
+ *
+ * Pure function — no D1 access, no secret access.
+ * Format: { id, event, workspaceId, occurredAt, data }
+ */
+export declare function buildWebhookEnvelope(input: BuildWebhookEnvelopeInput): WebhookEnvelope;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/engine/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/engine/webhooks.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAMzC,oEAAoE;AACpE,eAAO,MAAM,cAAc,iPAajB,CAAA;AAEV,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;CACX;AAED,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC/B,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAA;IAClB,mCAAmC;IACnC,IAAI,EAAE,OAAO,CAAA;CACb;AAMD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAClC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CA4BhG;AAMD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAClC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAKf;AAMD;;;GAGG;AACH,wBAAsB,mBAAmB,CACxC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAMf;AAMD,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,OAAO,CAAA;CACb;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,eAAe,CAQtF"}

package/dist/engine/webhooks.js

@@ -0,0 +1,139 @@
+// webhooks.ts — CMS webhooks engine (P7 Task 8).
+//
+// Implements:
+//   WEBHOOK_EVENTS        — 12-event enum (the authoritative list)
+//   createWebhook()       — validate event type, insert row (no secret column)
+//   listWebhooks()        — list all webhooks for a workspace
+//   deleteWebhook()       — delete a webhook row by id
+//   updateWebhookStatus() — update last_status + last_fired_at after a dispatch
+//   buildWebhookEnvelope()— build the standard payload envelope
+//
+// Security invariants (spec §12 scope guard 4 + §8):
+//   - cms_webhooks has NO secret column — deliberately omitted in migration 0010.
+//   - The HMAC signing secret lives ONLY in ctx.env (Cloudflare Secrets Store
+//     binding wired by the host). No engine function reads or writes a secret to D1.
+//   - buildWebhookEnvelope is a pure function — no secret access here.
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+/** The 12 webhook event types (authoritative; spec §12 §Task 8). */
+export const WEBHOOK_EVENTS = [
+    'content.published',
+    'content.unpublished',
+    'content.scheduled',
+    'content.created',
+    'content.deleted',
+    'content.review',
+    'content.duplicated',
+    'video.processed',
+    'video.failed',
+    'author.created',
+    'media.uploaded',
+    'webhook.test',
+];
+// ---------------------------------------------------------------------------
+// createWebhook
+// ---------------------------------------------------------------------------
+/**
+ * Register a new webhook for a workspace.
+ *
+ * Validates the eventType against the WEBHOOK_EVENTS enum; rejects unknown
+ * values so misconfigured hooks surface early. The row has NO secret column —
+ * the HMAC secret is read from ctx.env at dispatch time only.
+ */
+export async function createWebhook(db, input) {
+    const validEvents = new Set(WEBHOOK_EVENTS);
+    if (!validEvents.has(input.eventType)) {
+        throw new Error(`Invalid event type: '${input.eventType}'. Must be one of: ${WEBHOOK_EVENTS.join(', ')}`);
+    }
+    const id = crypto.randomUUID();
+    const now = Math.floor(Date.now() / 1000);
+    await db
+        .prepare(`INSERT INTO cms_webhooks (id, workspace_id, event_type, url, created_at)
+			 VALUES (?, ?, ?, ?, ?)`)
+        .bind(id, input.workspaceId, input.eventType, input.url, now)
+        .run();
+    return {
+        id,
+        workspaceId: input.workspaceId,
+        eventType: input.eventType,
+        url: input.url,
+        lastStatus: null,
+        lastFiredAt: null,
+        createdAt: now,
+    };
+}
+// ---------------------------------------------------------------------------
+// listWebhooks
+// ---------------------------------------------------------------------------
+/**
+ * List all webhooks registered for a workspace.
+ * Ordered by created_at ASC (deterministic).
+ */
+export async function listWebhooks(db, workspaceId) {
+    const result = await db
+        .prepare(`SELECT id, workspace_id, event_type, url, last_status, last_fired_at, created_at
+			 FROM cms_webhooks
+			 WHERE workspace_id = ?
+			 ORDER BY created_at ASC`)
+        .bind(workspaceId)
+        .all();
+    return (result.results ?? []).map((row) => ({
+        id: row.id,
+        workspaceId: row.workspace_id,
+        eventType: row.event_type,
+        url: row.url,
+        lastStatus: row.last_status,
+        lastFiredAt: row.last_fired_at,
+        createdAt: row.created_at,
+    }));
+}
+// ---------------------------------------------------------------------------
+// deleteWebhook
+// ---------------------------------------------------------------------------
+/**
+ * Delete a webhook registration by its id, SCOPED to the caller's workspace.
+ *
+ * The workspaceId is resolved from the authenticated caller (auth/locals) and
+ * MUST be passed by the route — never trusted from the client. Scoping the
+ * DELETE by workspace_id closes a cross-workspace IDOR: a member of workspace A
+ * cannot delete workspace B's webhook by id.
+ *
+ * No-ops for non-existent / out-of-workspace ids (idempotent).
+ */
+export async function deleteWebhook(db, id, workspaceId) {
+    await db
+        .prepare(`DELETE FROM cms_webhooks WHERE id = ? AND workspace_id = ?`)
+        .bind(id, workspaceId)
+        .run();
+}
+// ---------------------------------------------------------------------------
+// updateWebhookStatus
+// ---------------------------------------------------------------------------
+/**
+ * Update the last_status and last_fired_at on a webhook row.
+ * Called after a dispatch attempt (success or failure) to record the result.
+ */
+export async function updateWebhookStatus(db, id, status) {
+    const now = Math.floor(Date.now() / 1000);
+    await db
+        .prepare(`UPDATE cms_webhooks SET last_status = ?, last_fired_at = ? WHERE id = ?`)
+        .bind(status, now, id)
+        .run();
+}
+/**
+ * Build the standard outbound webhook payload envelope.
+ *
+ * Pure function — no D1 access, no secret access.
+ * Format: { id, event, workspaceId, occurredAt, data }
+ */
+export function buildWebhookEnvelope(input) {
+    return {
+        id: crypto.randomUUID(),
+        event: input.eventType,
+        workspaceId: input.workspaceId,
+        occurredAt: Math.floor(Date.now() / 1000),
+        data: input.data,
+    };
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/engine/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/engine/webhooks.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,cAAc;AACd,mEAAmE;AACnE,+EAA+E;AAC/E,8DAA8D;AAC9D,uDAAuD;AACvD,gFAAgF;AAChF,gEAAgE;AAChE,EAAE;AACF,qDAAqD;AACrD,kFAAkF;AAClF,8EAA8E;AAC9E,qFAAqF;AACrF,uEAAuE;AAIvE,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,mBAAmB;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;CACL,CAAA;AAmCV,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,EAAc,EACd,KAAyB;IAEzB,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAA;IAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACd,wBAAwB,KAAK,CAAC,SAAS,sBAAsB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAA;IACF,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,EAAE;SACN,OAAO,CACP;2BACwB,CACxB;SACA,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;SAC5D,GAAG,EAAE,CAAA;IAEP,OAAO;QACN,EAAE;QACF,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,GAAG;KACd,CAAA;AACF,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAc,EAAE,WAAmB;IACrE,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;4BAGyB,CACzB;SACA,IAAI,CAAC,WAAW,CAAC;SACjB,GAAG,EAQA,CAAA;IAEL,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,WAAW,EAAE,GAAG,CAAC,aAAa;QAC9B,SAAS,EAAE,GAAG,CAAC,UAAU;KACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,EAAc,EACd,EAAU,EACV,WAAmB;IAEnB,MAAM,EAAE;SACN,OAAO,CAAC,4DAA4D,CAAC;SACrE,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SACrB,GAAG,EAAE,CAAA;AACR,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,EAAc,EACd,EAAU,EACV,MAAc;IAEd,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,EAAE;SACN,OAAO,CAAC,yEAAyE,CAAC;SAClF,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;SACrB,GAAG,EAAE,CAAA;AACR,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACpE,OAAO;QACN,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;KAChB,CAAA;AACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './engine/index.js';
+export * from './providers/index.js';
+export type { CmsUser } from './routes/context.js';
+export { type ArticleContentRow, type AuthorRow, applyMigrations, CMS_MIGRATION_SQL, CMS_MIGRATIONS_0002_PLUS, CMS_TABLES, type CmsActivityLogRow, type CmsApiKeyRow, type CmsNotificationRow, type CmsRole, type CmsTableName, type CmsWebhookRow, type ContentContributorRow, type ContentImportRow, type ContentItemRow, type ContentRelationRow, type ContentRevisionRow, type ContentSlugRedirectRow, type ContentStatus, type ContentTagLinkRow, type ContentTagRow, type ContentType, type ContentVisibility, type FoundryCallbackEventRow, type MastheadUserRow, type MediaAssetRow, NON_CMS_TABLES, type PodcastContentRow, splitStatements, type VideoContentRow, type VideoProcessingState, type WorkspaceInviteRow, type WorkspaceMembershipRow, type WorkspaceSettingsRow, } from './schema/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgCA,cAAc,mBAAmB,CAAA;AAGjC,cAAc,sBAAsB,CAAA;AAGpC,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,eAAe,EAEf,iBAAiB,EACjB,wBAAwB,EAExB,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,iBAAiB,EACtB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GACzB,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -0,0 +1,40 @@
+// @growth-labs/cms — the reusable Fronts-proven publishing/admin engine, as a
+// package (NOT a shared engine). See docs/reference/cms-reuse-decision.md.
+//
+// This package ships the D1 schema contract (the 11-table
+// content/revision/media/authors/foundry-callback set) + its TypeScript row
+// types (WS7-04/06 foundation) AND the publishing engine — the content
+// data-access core (WS7-05):
+//
+//   WS7-05 (this release) — the publishing engine: publisher.ts core
+//            (createContent, updateContentItem, scheduleContent,
+//            publishContent, unpublishContent, duplicateContentItem,
+//            createRevision, getContentSnapshot,
+//            setContentTags/setContentRelations, ensureUniqueSlug, countWords,
+//            estimateReadTime, validation guards) + its validators / sanitize /
+//            slug helpers + publisher-cron. Every function takes an injected
+//            D1Database (the site supplies its own binding); NO Fronts imports
+//            remain. Carries the INSERT…SELECT duplicateContentItem
+//            column-alignment gotcha (inventory §6) — the column lists are
+//            ported verbatim against this schema or a duplicate silently drops
+//            fields.
+//   WS7-07 (this release) — the API routes: the /api/v1/publisher/*
+//            content/authors/media/cron handlers, as framework-agnostic
+//            mountable factories with auth/authz INJECTED. Available at the
+//            `@growth-labs/cms/routes` subpath (kept off the root so the
+//            engine/schema imports stay zod-free). The Foundry media-dispatch
+//            routes (dispatch-video + callback) + their state-machine glue land
+//            in bead 08 (gated on OD-CMS7); the article-takeaways publish
+//            dispatch is exposed as an OPTIONAL injected hook so the package
+//            carries no Foundry/Hermes coupling.
+// The publishing engine — the content data-access core (WS7-05). Also
+// available at the `@growth-labs/cms/engine` subpath.
+export * from './engine/index.js';
+// Injected-provider interfaces + null implementations (spec §3.3).
+export * from './providers/index.js';
+export { applyMigrations, 
+// migration contract
+CMS_MIGRATION_SQL, CMS_MIGRATIONS_0002_PLUS, 
+// table contract
+CMS_TABLES, NON_CMS_TABLES, splitStatements, } from './schema/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,0DAA0D;AAC1D,4EAA4E;AAC5E,uEAAuE;AACvE,6BAA6B;AAC7B,EAAE;AACF,qEAAqE;AACrE,iEAAiE;AACjE,qEAAqE;AACrE,iDAAiD;AACjD,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,oEAAoE;AACpE,2EAA2E;AAC3E,+EAA+E;AAC/E,qBAAqB;AACrB,oEAAoE;AACpE,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,6EAA6E;AAC7E,iDAAiD;AAEjD,sEAAsE;AACtE,sDAAsD;AACtD,cAAc,mBAAmB,CAAA;AAEjC,mEAAmE;AACnE,cAAc,sBAAsB,CAAA;AAKpC,OAAO,EAGN,eAAe;AACf,qBAAqB;AACrB,iBAAiB,EACjB,wBAAwB;AACxB,iBAAiB;AACjB,UAAU,EAsBV,cAAc,EAEd,eAAe,GAMf,MAAM,mBAAmB,CAAA"}

package/dist/integration/index.d.ts

@@ -0,0 +1,6 @@
+import type { AstroIntegration } from 'astro';
+import { type CmsIntegrationOptions } from './options.js';
+export default function growthLabsCms(userOptions: CmsIntegrationOptions): AstroIntegration;
+export type { CmsIntegrationOptions, ResolvedCmsIntegrationOptions } from './options.js';
+export { cmsIntegrationOptionsSchema } from './options.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/integration/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/integration/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAA;AAC7C,OAAO,EAAE,KAAK,qBAAqB,EAA+B,MAAM,cAAc,CAAA;AActF,MAAM,CAAC,OAAO,UAAU,aAAa,CAAC,WAAW,EAAE,qBAAqB,GAAG,gBAAgB,CAsR1F;AAED,YAAY,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAA;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAA"}