@heyo-sh/heyo-cms 0.0.0-stage → 0.1.0

package/dist/webhooks/service.d.ts

@@ -0,0 +1,53 @@
+import type { ResolvedCmsConfig } from "../types/config";
+import type { DatabaseAdapter } from "../types/database";
+import type { Tx } from "../types/query";
+import type { CmsWebhooks, WebhookDelivery } from "../types/webhooks";
+import type { BufferedEvent, OutboxEntryMeta } from "../engine/outbox";
+/**
+ * The service, plus the one operation only a sweep needs.
+ *
+ * `cms.webhooks` is the public `CmsWebhooks`; the runner holds this. Keeping
+ * "re-attempt this exact row" off the public type is deliberate: a caller
+ * that wants to re-send something wants `retry()`, which records a new
+ * attempt instead of quietly rewriting the history of an old one.
+ */
+export interface WebhookRuntime extends CmsWebhooks {
+    attemptDelivery(id: string, at?: Date): Promise<WebhookDelivery | null>;
+}
+/**
+ * What the service needs from `fetch`, and no more.
+ *
+ * Narrower than `typeof fetch` on purpose: that type carries whatever the
+ * host runtime bolted on — Bun adds `preconnect` — and a package that has to
+ * build the same way on Node, Bun and Workers cannot depend on which one is
+ * compiling it.
+ */
+export type WebhookFetch = (url: string, init: RequestInit) => Promise<Response>;
+export interface WebhookServiceOptions {
+    config: ResolvedCmsConfig;
+    database(): Promise<DatabaseAdapter>;
+    emit(tx: Tx, events: BufferedEvent[], meta: OutboxEntryMeta): Promise<void>;
+    deliver(): void;
+    /** Injectable so a test does not need a socket. Defaults to `fetch`. */
+    fetch?: WebhookFetch;
+    now?: () => Date;
+}
+/**
+ * `cms.webhooks`.
+ *
+ * The contract, in one place, is section 7:
+ *
+ * - **Signed.** Every request carries an HMAC over `timestamp.body`, so a
+ *   receiver can tell a delivery from a stranger with a URL.
+ * - **Identified.** `x-heyo-event-id` and `x-heyo-delivery-id` let a consumer
+ *   be idempotent, which matters because retries are a promise rather than an
+ *   accident.
+ * - **Retried, then parked.** Five attempts with exponential backoff, then
+ *   the delivery is `failed` and stays in the table for replay. A dead letter
+ *   that disappears is a dead letter nobody can act on.
+ * - **Ordered per document, not globally.** The outbox is drained in
+ *   insertion order and a document's events are inserted in the order they
+ *   happened; across documents, parallel delivery is the point.
+ */
+export declare function createWebhooks(options: WebhookServiceOptions): WebhookRuntime;
+//# sourceMappingURL=service.d.ts.map

package/dist/webhooks/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/webhooks/service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,OAAO,KAAK,EAAgB,EAAE,EAAS,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EACV,WAAW,EAEX,eAAe,EAUhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAUvE;;;;;;;GAOG;AACH,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACzE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,KACd,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,IAAI,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CA4gB7E"}

package/dist/webhooks/sign.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The signature a consumer verifies.
+ *
+ * `t=<unix seconds>,v1=<hex hmac>` over `${t}.${body}`, which is the shape
+ * Stripe popularised and most receivers already have code for. The timestamp
+ * is inside the signed string on purpose: without it a captured delivery can
+ * be replayed forever, and the consumer has no way to notice.
+ */
+export declare const signatureHeader = "x-heyo-signature";
+export declare function signPayload(body: string, secret: string, timestamp?: number): Promise<string>;
+/**
+ * Verifies a signature the way a consumer should.
+ *
+ * Exported because the first thing anybody writes after subscribing is this
+ * function, and the second thing they do is get it subtly wrong — comparing
+ * with `===`, or forgetting that the timestamp is part of the signed string.
+ */
+export declare function verifySignature(options: {
+    body: string;
+    header: string;
+    secret: string;
+    /** Rejects a delivery older than this. Defaults to five minutes. */
+    toleranceSeconds?: number;
+    now?: number;
+}): Promise<boolean>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/webhooks/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/webhooks/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,SAAgC,GACxC,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBnB"}

package/dist/webhooks.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `@heyo-sh/heyo-cms/webhooks`.
+ *
+ * Subscriptions are managed through `cms.webhooks` and the routes under
+ * `/webhooks`. What is here is the part a *consumer* needs: the signature
+ * scheme, and a verifier so nobody has to write the HMAC comparison again.
+ */
+export { signatureHeader, signPayload, verifySignature } from "./webhooks/sign";
+export type { CmsWebhooks, WebhookCreateArgs, WebhookDelivery, WebhookDeliveryListArgs, WebhookDeliveryPage, WebhookDeliveryStatus, WebhookDispatchReport, WebhookFilters, WebhookListArgs, WebhookRetryArgs, WebhookSubscription, WebhookTestArgs, WebhookUpdateArgs, } from "./types/webhooks";
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChF,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAClB,MAAM,kBAAkB,CAAC"}

package/dist/webhooks.js

@@ -0,0 +1 @@
+import{be,we,wn}from"./index-7k091gpe.js";export{we as signPayload,be as signatureHeader,wn as verifySignature};

package/package.json

@@ -1,6 +1,185 @@
 {
   "name": "@heyo-sh/heyo-cms",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Framework-agnostic, TypeScript-first headless CMS with its own panel, RBAC, i18n, native AI and first-class media.",
+  "keywords": [
+    "cms",
+    "headless-cms",
+    "typescript",
+    "postgres",
+    "mongodb",
+    "sqlite",
+    "cloudflare-workers",
+    "vercel"
+  ],
+  "homepage": "https://heyo.sh",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/heyo-sh/heyo-cms.git",
+    "directory": "packages/heyo-cms"
+  },
+  "bugs": {
+    "url": "https://github.com/heyo-sh/heyo-cms/issues"
+  },
+  "license": "MIT",
+  "type": "module",
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "bin": {
+    "heyo-cms": "./dist/cli.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "typebox": "1.3.30",
+    "zod": "4.6.5"
+  },
+  "peerDependencies": {
+    "@mariozechner/pi-agent-core": "^0.73.0",
+    "@mariozechner/pi-ai": "^0.73.0",
+    "mongodb": "^6.0.0 || ^7.0.0",
+    "pg": "^8.0.0",
+    "sharp": "^0.33.0 || ^0.34.0 || ^0.35.0"
+  },
+  "peerDependenciesMeta": {
+    "@mariozechner/pi-agent-core": {
+      "optional": true
+    },
+    "@mariozechner/pi-ai": {
+      "optional": true
+    },
+    "mongodb": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    },
+    "sharp": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@electric-sql/pglite": "0.5.8",
+    "@mariozechner/pi-agent-core": "0.73.1",
+    "@mariozechner/pi-ai": "0.73.1",
+    "pg": "8.16.3"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "default": "./dist/types.js"
+    },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "default": "./dist/config.js"
+    },
+    "./fields": {
+      "types": "./dist/fields.d.ts",
+      "default": "./dist/fields.js"
+    },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "default": "./dist/http.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    },
+    "./content": {
+      "types": "./dist/content.d.ts",
+      "default": "./dist/content.js"
+    },
+    "./telemetry": {
+      "types": "./dist/telemetry.d.ts",
+      "default": "./dist/telemetry.js"
+    },
+    "./next": {
+      "types": "./dist/adapters/next.d.ts",
+      "default": "./dist/adapters/next.js"
+    },
+    "./astro": {
+      "types": "./dist/adapters/astro.d.ts",
+      "default": "./dist/adapters/astro.js"
+    },
+    "./react-router": {
+      "types": "./dist/adapters/react-router.d.ts",
+      "default": "./dist/adapters/react-router.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/adapters/sveltekit.d.ts",
+      "default": "./dist/adapters/sveltekit.js"
+    },
+    "./nuxt": {
+      "types": "./dist/adapters/nuxt.d.ts",
+      "default": "./dist/adapters/nuxt.js"
+    },
+    "./schema": {
+      "types": "./dist/schema.d.ts",
+      "default": "./dist/schema.js"
+    },
+    "./query": {
+      "types": "./dist/query.d.ts",
+      "default": "./dist/query.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations.d.ts",
+      "default": "./dist/migrations.js"
+    },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
+    },
+    "./uploads": {
+      "types": "./dist/uploads.d.ts",
+      "default": "./dist/uploads.js"
+    },
+    "./editor": {
+      "types": "./dist/editor.d.ts",
+      "default": "./dist/editor.js"
+    },
+    "./ai": {
+      "types": "./dist/ai.d.ts",
+      "default": "./dist/ai.js"
+    },
+    "./webhooks": {
+      "types": "./dist/webhooks.d.ts",
+      "default": "./dist/webhooks.js"
+    },
+    "./jobs": {
+      "types": "./dist/jobs.d.ts",
+      "default": "./dist/jobs.js"
+    },
+    "./postgres": {
+      "types": "./dist/db/postgres.d.ts",
+      "default": "./dist/db/postgres.js"
+    },
+    "./sqlite": {
+      "types": "./dist/db/sqlite.d.ts",
+      "default": "./dist/db/sqlite.js"
+    },
+    "./d1": {
+      "types": "./dist/db/d1.d.ts",
+      "default": "./dist/db/d1.js"
+    },
+    "./mongodb": {
+      "types": "./dist/db/mongodb.d.ts",
+      "default": "./dist/db/mongodb.js"
+    }
+  },
+  "scripts": {
+    "dev": "bun run build --watch",
+    "build": "rm -rf dist && bun run build:core && bun run build:types",
+    "build:core": "bun build src/index.ts src/types.ts src/config.ts src/fields.ts src/schema.ts src/query.ts src/migrations.ts src/auth.ts src/uploads.ts src/editor.ts src/ai.ts src/webhooks.ts src/jobs.ts src/http.ts src/client.ts src/content.ts src/telemetry.ts src/cli.ts src/adapters/next.ts src/adapters/astro.ts src/adapters/react-router.ts src/adapters/sveltekit.ts src/adapters/nuxt.ts src/db/postgres.ts src/db/sqlite.ts src/db/d1.ts src/db/mongodb.ts --outdir dist --root src --target node --production --splitting --external zod --external pg --external mongodb --external sharp --external @mariozechner/pi-ai --external @mariozechner/pi-agent-core --external typebox",
+    "build:types": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "bun test"
+  }
+}