@heyo-sh/heyo-cms 0.0.0-stage → 0.1.0

package/dist/engine/outbox.d.ts

@@ -0,0 +1,81 @@
+import type { Actor } from "../types/actor";
+import type { DatabaseAdapter } from "../types/database";
+import type { AnyEventType, CmsEvent, HookEventEmitter } from "../types/events";
+import type { JsonObject } from "../types/json";
+import type { Tx } from "../types/query";
+export declare const outboxTable = "outbox";
+export interface BufferedEvent {
+    type: AnyEventType;
+    data: JsonObject;
+    previous: JsonObject | null;
+}
+/**
+ * `ctx.events`: the only way a hook causes a side effect.
+ *
+ * Emitting queues; it never sends. A mail or a webhook fired inside the
+ * transaction would go out even when the write is rolled back, and a mail
+ * fired after the commit without a record would be lost when the process
+ * dies between the two. The queue is drained into the outbox table by the
+ * engine, inside the same transaction as the write (section 5).
+ */
+export declare class EventBuffer implements HookEventEmitter {
+    private readonly queued;
+    emit(type: AnyEventType, data: JsonObject, previous?: JsonObject | null): void;
+    /** Empties the queue; the caller is now responsible for the events. */
+    take(): BufferedEvent[];
+}
+export interface OutboxEntryMeta {
+    actor: Actor | null;
+    collection?: string;
+    documentId?: string;
+}
+export interface OutboxOptions {
+    /** Section 7: five attempts, then the delivery is dead. */
+    maxAttempts?: number;
+    /** Exponential by default: 1s, 2s, 4s, 8s. */
+    backoff?: (attempt: number) => number;
+    /** Abandoned deliveries become claimable again. Subscribers must deduplicate event.id. */
+    leaseMs?: number;
+    now?: () => Date;
+}
+export type EventDispatch = (event: CmsEvent) => Promise<void>;
+/**
+ * The transactional outbox.
+ *
+ * Rows are written inside the transaction that produced them and delivered
+ * afterwards. That is the whole mechanism behind two promises the plan makes:
+ * a rolled back write sends nothing, and a committed one sends even if the
+ * process dies one line later (sections 5 and 7). It also means an engine
+ * without real transactions still has a defined behaviour — the row lands in
+ * the same operation sequence as the document, and the worker is idempotent
+ * because it claims a row before delivering it.
+ */
+export declare class Outbox {
+    private readonly adapter;
+    private readonly dispatch;
+    private readonly maxAttempts;
+    private readonly backoff;
+    private readonly leaseMs;
+    private readonly now;
+    constructor(adapter: DatabaseAdapter, dispatch: EventDispatch, options?: OutboxOptions);
+    append(tx: Tx, events: BufferedEvent[], meta: OutboxEntryMeta): Promise<void>;
+    /**
+     * Delivers what is due and reports how much it delivered.
+     *
+     * Claim, deliver, settle — three short transactions rather than one long
+     * one, because a delivery is an HTTP call and holding a row lock across it
+     * is how an outbox turns into an outage.
+     */
+    drain(limit?: number): Promise<number>;
+    /**
+     * Takes ownership of a row, or finds out somebody else already has.
+     *
+     * A conditional update is the portable claim: it works on all three
+     * engines, needs no row locking and makes a second worker — or a retried
+     * request on serverless — harmless.
+     */
+    private hasPredecessor;
+    private claim;
+    private settle;
+}
+//# sourceMappingURL=outbox.d.ts.map

package/dist/engine/outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../src/engine/outbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAO,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAG9C,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,qBAAa,WAAY,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAE9C,IAAI,CACF,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,UAAU,GAAG,IAAW,GACjC,IAAI,CAEN;IAED,uEAAuE;IACvE,IAAI,IAAI,aAAa,EAAE,CAEtB;CACF;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,qBAAa,MAAM;IAOf,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAP3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IAEjC,YACmB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,aAAa,EACxC,OAAO,GAAE,aAAkB,EAM5B;IAEK,MAAM,CACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,aAAa,EAAE,EACvB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAED;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAmCvC;IAED;;;;;;OAMG;YACW,cAAc;YAoBd,KAAK;YAuBL,MAAM;CAmCrB"}

package/dist/engine/relations.d.ts

@@ -0,0 +1,60 @@
+import type { Actor } from "../types/actor";
+import type { RbacConfig, ResolvedCollection } from "../types/config";
+import type { DatabaseAdapter } from "../types/database";
+import type { FieldDefinition } from "../types/fields";
+import type { JsonObject } from "../types/json";
+import type { Tx } from "../types/query";
+import type { LocaleContext } from "./locales";
+export interface RelationLoaderOptions {
+    adapter: DatabaseAdapter;
+    tx: Tx;
+    locale: LocaleContext;
+    /** Every declared collection and global, keyed by name. */
+    collections: Record<string, ResolvedCollection>;
+    includeTrashed?: boolean;
+    /**
+     * Whose read this is.
+     *
+     * A related document is filtered by the rules of the collection it belongs
+     * to, not by the one that pointed at it: `depth` must not be a way to read
+     * a field through a relation that cannot be read directly.
+     */
+    actor?: Actor | null;
+    rbac?: RbacConfig | undefined;
+}
+/**
+ * `depth`, resolved by batching instead of by joining.
+ *
+ * Collect the ids at this level, run one query per target collection, then
+ * recurse. The query count depends on the shape of the schema, never on the
+ * number of documents — which is the N+1 problem Payload users hit with
+ * `depth`, and the reason section 12 rules joins out: one batching strategy
+ * works identically on Postgres, SQLite and MongoDB.
+ */
+export declare class RelationLoader {
+    private readonly options;
+    /** Shared across levels, so a document fetched once is never fetched again. */
+    private readonly cache;
+    /** Counted so a test can assert the absence of N+1 rather than infer it. */
+    private queries;
+    constructor(options: RelationLoaderOptions);
+    get queryCount(): number;
+    expand(documents: JsonObject[], collection: ResolvedCollection, depth: number): Promise<void>;
+    private load;
+    /**
+     * Replaces ids with documents, remembering what was replaced so the next
+     * level can be batched. A reference that no longer resolves stays an id
+     * rather than becoming `null`: losing the value would hide the dangling
+     * reference instead of reporting it.
+     */
+    private substitute;
+}
+/**
+ * What a field points at.
+ *
+ * `media` is a relation that does not spell it out: the value is an id in the
+ * `media` table, which is what makes the usage counting in section 6
+ * possible. Treating it as one here means `depth` resolves a cover image.
+ */
+export declare function relationTarget(field: FieldDefinition): string | undefined;
+//# sourceMappingURL=relations.d.ts.map

package/dist/engine/relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../../src/engine/relations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAIzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,aAAa,CAAC;IACtB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAMb,OAAO,CAAC,QAAQ,CAAC,OAAO;IALpC,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwC;IAC9D,4EAA4E;IAC5E,OAAO,CAAC,OAAO,CAAK;IAEpB,YAA6B,OAAO,EAAE,qBAAqB,EAAI;IAE/D,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,MAAM,CACV,SAAS,EAAE,UAAU,EAAE,EACvB,UAAU,EAAE,kBAAkB,EAC9B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CA8Cf;YAEa,IAAI;IAiElB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;CA4BnB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAGzE"}

package/dist/engine/scoped-db.d.ts

@@ -0,0 +1,13 @@
+import type { DatabaseAdapter } from "../types/database";
+import type { ScopedDb } from "../types/hooks";
+import type { Tx } from "../types/query";
+/**
+ * `ctx.db`: the handle that bypasses access control, by name.
+ *
+ * Everything it does happens inside the caller's transaction, so a hook that
+ * writes an audit row and then throws leaves nothing behind. The alternative
+ * — a pooled connection of its own — would commit independently of the
+ * operation that triggered it.
+ */
+export declare function scopedDb(adapter: DatabaseAdapter, tx: Tx): ScopedDb;
+//# sourceMappingURL=scoped-db.d.ts.map

package/dist/engine/scoped-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../src/engine/scoped-db.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAwB,EAAE,EAAS,MAAM,gBAAgB,CAAC;AAEtE;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,GAAG,QAAQ,CA6CnE"}

package/dist/engine/trash.d.ts

@@ -0,0 +1,25 @@
+import type { ResolvedCmsConfig, ResolvedCollection } from "../types/config";
+import type { DatabaseAdapter } from "../types/database";
+import type { TrashListArgs, TrashPage } from "../types/trash";
+export interface ListTrashedOptions {
+    adapter: DatabaseAdapter;
+    config: ResolvedCmsConfig;
+    /** Collections and globals, by name. */
+    collections: Record<string, ResolvedCollection>;
+    args: TrashListArgs;
+}
+/**
+ * The trash across collections.
+ *
+ * One query, not one per collection: the panel shows a single list ordered by
+ * when things were deleted, and assembling that from per-collection pages
+ * would page wrongly the moment two collections have entries.
+ *
+ * Access control is folded into the filter rather than applied afterwards —
+ * the same rule as everywhere else (stage 4). Each collection contributes one
+ * branch of an `OR`, carrying its own `read` filter; a collection the actor
+ * may not read contributes nothing and is therefore invisible rather than
+ * forbidden.
+ */
+export declare function listTrashed(options: ListTrashedOptions): Promise<TrashPage>;
+//# sourceMappingURL=trash.d.ts.map

package/dist/engine/trash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trash.d.ts","sourceRoot":"","sources":["../../src/engine/trash.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAa/D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,EAAE,aAAa,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,SAAS,CAAC,CAuFpB"}

package/dist/errors.d.ts

@@ -0,0 +1,42 @@
+/**
+ * One error type for everything a caller can provoke.
+ *
+ * A hook that throws, an access rule that refuses and a field that fails
+ * validation all end up in the same HTTP response builder, so they all carry
+ * the status and a machine-readable code instead of leaving the transport
+ * layer to guess from the message.
+ */
+export declare class CmsError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: unknown;
+    constructor(message: string, options?: {
+        status?: number;
+        code?: string;
+        details?: unknown;
+        /**
+         * The error this one replaces, for the operator's log.
+         *
+         * `details` is part of the response and `cause` never is: when a
+         * provider or a driver fails, the caller gets a sentence and a code
+         * while the original stack stays where somebody debugging can reach it.
+         */
+        cause?: unknown;
+    });
+    static notFound(message?: string): CmsError;
+    static forbidden(message?: string): CmsError;
+    static unauthorized(message?: string): CmsError;
+    static conflict(message: string): CmsError;
+    static validation(message: string, details?: unknown): CmsError;
+}
+/**
+ * A mistake in the configuration, not in a request.
+ *
+ * These are thrown while `heyoCms()` is still building, so they must read like
+ * a compiler diagnostic: what is wrong, where, and what to write instead.
+ */
+export declare class CmsConfigError extends Error {
+    readonly path: string;
+    constructor(path: string, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAE3B,YACE,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;;;;WAMG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACZ,EAOP;IAED,MAAM,CAAC,QAAQ,CAAC,OAAO,SAAc,GAAG,QAAQ,CAE/C;IAED,MAAM,CAAC,SAAS,CAAC,OAAO,SAAc,GAAG,QAAQ,CAEhD;IAED,MAAM,CAAC,YAAY,CAAC,OAAO,SAAiB,GAAG,QAAQ,CAEtD;IAED,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAEzC;IAED,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAM9D;CACF;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIxC;CACF"}

package/dist/fields/builtin.d.ts

@@ -0,0 +1,142 @@
+import type { FieldDefinition, FieldOptions } from "../types/fields";
+import type { JsonObject, JsonValue } from "../types/json";
+import { type FieldValue } from "./registry";
+export interface TextOptions extends FieldOptions {
+    default?: string;
+    minLength?: number;
+    maxLength?: number;
+    /** Source string for the pattern; kept serialisable for the snapshot. */
+    pattern?: string;
+}
+export declare const text: import("./registry").FieldBuilder<string, TextOptions>;
+export interface TextareaOptions extends TextOptions {
+    rows?: number;
+}
+export declare const textarea: import("./registry").FieldBuilder<string, TextareaOptions>;
+/** A ProseMirror document. TipTap writes it, the serialisers read it. */
+export type RichTextValue = JsonObject;
+export interface RichTextOptions extends FieldOptions {
+    /** Editor nodes allowed in this field; the panel hides the rest. */
+    nodes?: string[];
+    default?: RichTextValue;
+}
+export declare const richText: import("./registry").FieldBuilder<JsonObject, RichTextOptions>;
+export interface NumberOptions extends FieldOptions {
+    default?: number;
+    min?: number;
+    max?: number;
+    integer?: boolean;
+}
+export declare const number: import("./registry").FieldBuilder<number, NumberOptions>;
+export interface BooleanOptions extends FieldOptions {
+    default?: boolean;
+}
+export declare const boolean: import("./registry").FieldBuilder<boolean, BooleanOptions>;
+export interface DateOptions extends FieldOptions {
+    default?: string;
+    /** `date` hides the clock in the panel; storage is identical. */
+    mode?: "date" | "datetime";
+}
+/**
+ * Dates are ISO strings, not `Date` objects.
+ *
+ * The value travels through JSON on every path the engine has — storage, REST,
+ * webhook payloads — and a string survives all of them unchanged. Converting
+ * at the edges would mean three places that can disagree about time zones.
+ */
+export declare const date: import("./registry").FieldBuilder<string, DateOptions>;
+export type SelectChoice = string | {
+    label: string;
+    value: string;
+};
+export interface SelectOptions extends FieldOptions {
+    options: readonly SelectChoice[];
+    default?: string;
+}
+/** Literal choices become a union in the document type. */
+export type SelectValue<TOptions extends {
+    options: readonly SelectChoice[];
+}> = TOptions["options"][number] extends infer TChoice ? TChoice extends string ? TChoice : TChoice extends {
+    value: infer TValue;
+} ? TValue : never : never;
+/**
+ * A plain choice field.
+ *
+ * `status` is one of its uses and nothing more: the engine attaches no meaning
+ * to it, which is what removed the whole publish/unpublish lifecycle from the
+ * core (sections 3 and 11).
+ */
+export declare function select<const TOptions extends SelectOptions>(options: TOptions): FieldDefinition<FieldValue<SelectValue<TOptions>, TOptions>>;
+export interface MultiselectOptions extends FieldOptions {
+    options: readonly SelectChoice[];
+    default?: string[];
+    minItems?: number;
+    maxItems?: number;
+}
+export declare function multiselect<const TOptions extends MultiselectOptions>(options: TOptions): FieldDefinition<FieldValue<SelectValue<TOptions>[], TOptions>>;
+export interface JsonFieldOptions extends FieldOptions {
+    default?: JsonValue;
+}
+export declare const json: import("./registry").FieldBuilder<JsonValue, JsonFieldOptions>;
+export interface MediaOptions extends FieldOptions {
+    /** MIME whitelist for the picker, e.g. `image/*`. */
+    accept?: string;
+}
+/**
+ * A reference to a row in `media`.
+ *
+ * Storing the id rather than a URL is what makes the media lifecycle work:
+ * `media_usages` can count references, and a file that loses its last one is
+ * orphaned rather than deleted (section 6).
+ */
+export declare const media: import("./registry").FieldBuilder<string, MediaOptions>;
+export interface RelationOptions extends FieldOptions {
+    relationTo?: string;
+    /** Many-to-many: the value is an array of ids. */
+    many?: boolean;
+}
+/**
+ * A reference to another collection.
+ *
+ * Resolved by a batch loader rather than a join: one query per collection per
+ * depth level works the same on all three engines and removes the N+1 problem
+ * that Payload users hit with `depth` (section 12).
+ */
+export declare function relation<const TOptions extends RelationOptions>(to: string, options?: TOptions): FieldDefinition<FieldValue<string, TOptions>>;
+/**
+ * There is no `slug` type, and that is deliberate.
+ *
+ * It was one of these for a while, and it earned its keep by being `text`
+ * with `unique`, `index` and a hyphen pattern already set — plus a `from`
+ * option that promised the value would be derived from another field and
+ * never did it, because nothing in the engine generates one field out of
+ * another. A type whose only feature is a default and a promise is a type
+ * that teaches the wrong thing. A URL handle is a `text` field:
+ *
+ * ```ts
+ * handle: text({
+ *   unique: true,
+ *   index: true,
+ *   pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$",
+ * })
+ * ```
+ *
+ * and generating it from the title is a `create.before` hook, which runs
+ * before validation precisely so that it can fill a required field.
+ */
+export declare const email: import("./registry").FieldBuilder<string, TextOptions>;
+export declare const url: import("./registry").FieldBuilder<string, TextOptions>;
+/**
+ * SEO as fields, not as a plugin.
+ *
+ * A plugin would own the fields, the prompts and the panel section; a preset
+ * spreads into `fields` and stays editable (`...seoFields()`), which is the
+ * decision recorded in section 11.
+ */
+export declare function seoFields(): {
+    seoTitle: FieldDefinition<string | null>;
+    seoDescription: FieldDefinition<string | null>;
+    ogImage: FieldDefinition<string | null>;
+    canonical: FieldDefinition<string | null>;
+};
+//# sourceMappingURL=builtin.d.ts.map

package/dist/fields/builtin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin.d.ts","sourceRoot":"","sources":["../../src/fields/builtin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAsC1D,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,IAAI,wDAsBf,CAAC;AAEH,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,QAAQ,4DAanB,CAAC;AAMH,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC;AAEvC,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,eAAO,MAAM,QAAQ,gEASnB,CAAC;AAMH,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,MAAM,0DAkBjB,CAAC;AAEH,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,OAAO,4DAUlB,CAAC;AAEH,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,wDAcf,CAAC;AAMH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,2DAA2D;AAC3D,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS;IAAE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,IAC3E,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,SAAS,MAAM,OAAO,GAC7C,OAAO,SAAS,MAAM,GACpB,OAAO,GACP,OAAO,SAAS;IAAE,KAAK,EAAE,MAAM,MAAM,CAAA;CAAE,GACrC,MAAM,GACN,KAAK,GACT,KAAK,CAAC;AA2BZ;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,KAAK,CAAC,QAAQ,SAAS,aAAa,EACzD,OAAO,EAAE,QAAQ,GAChB,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAI9D;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD,wBAAgB,WAAW,CAAC,KAAK,CAAC,QAAQ,SAAS,kBAAkB,EACnE,OAAO,EAAE,QAAQ,GAChB,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAIhE;AAMD,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED,eAAO,MAAM,IAAI,gEAKf,CAAC;AAEH,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,yDAQhB,CAAC;AAEH,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAgBD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,CAAC,QAAQ,SAAS,eAAe,EAC7D,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,QAAQ,GACjB,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAK/C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,KAAK,wDAKhB,CAAC;AAEH,eAAO,MAAM,GAAG,wDAKd,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,SAAS,IAAI;IAC3B,QAAQ,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,cAAc,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3C,CAuBA"}

package/dist/fields/index.d.ts

@@ -0,0 +1,3 @@
+export { defineField, getFieldType, registeredFieldTypes, registerFieldType, type FieldBuilder, type FieldValue, } from "./registry";
+export * from "./builtin";
+//# sourceMappingURL=index.d.ts.map

package/dist/fields/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/fields/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,cAAc,WAAW,CAAC"}

package/dist/fields/registry.d.ts

@@ -0,0 +1,35 @@
+import type { FieldDefinition, FieldOptions, FieldType } from "../types/fields";
+import type { JsonValue } from "../types/json";
+/**
+ * Nullability is a property of the options, not of the field type.
+ *
+ * `text()` holds `string | null` and `text({ required: true })` holds
+ * `string`, and both facts are visible in the inferred document type instead
+ * of being discovered at runtime.
+ */
+export type FieldValue<TValue, TOptions> = TOptions extends {
+    required: true;
+} ? TValue : TValue | null;
+export interface FieldBuilderOptions extends FieldOptions {
+    default?: JsonValue;
+}
+/**
+ * A field builder: what `text`, `select` or a third-party `rating` is.
+ *
+ * `const TOptions` captures literal option values, which is what lets
+ * `select({ options: ["draft", "published"] })` infer a union rather than
+ * `string`.
+ */
+export type FieldBuilder<TValue, TOptions extends FieldOptions> = <const TGiven extends TOptions>(options?: TGiven) => FieldDefinition<FieldValue<TValue, TGiven>>;
+export declare function registerFieldType<TValue, TOptions extends FieldOptions>(type: FieldType<TValue, TOptions>): void;
+export declare function getFieldType<TValue = unknown>(name: string): FieldType<TValue, FieldOptions> | undefined;
+export declare function registeredFieldTypes(): string[];
+/**
+ * Declares a field type and returns its builder.
+ *
+ * Every built-in field goes through this function. A shortcut for built-ins
+ * would mean the public extension API is the one nobody uses, which is how
+ * extension points rot (stage 9).
+ */
+export declare function defineField<TValue, TOptions extends FieldOptions>(type: FieldType<TValue, TOptions>): FieldBuilder<TValue, TOptions>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/fields/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/fields/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,eAAe,EACf,YAAY,EACZ,SAAS,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,IAAI,QAAQ,SAAS;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC1E,MAAM,GACN,MAAM,GAAG,IAAI,CAAC;AAElB,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,SAAS,YAAY,IAAI,CAChE,KAAK,CAAC,MAAM,SAAS,QAAQ,EAE7B,OAAO,CAAC,EAAE,MAAM,KACb,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAUjD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,QAAQ,SAAS,YAAY,EACrE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChC,IAAI,CASN;AAED,wBAAgB,YAAY,CAAC,MAAM,GAAG,OAAO,EAC3C,IAAI,EAAE,MAAM,GACX,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,SAAS,CAE7C;AAED,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,QAAQ,SAAS,YAAY,EAC/D,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAkGhC"}

package/dist/fields.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The field registry and every built-in type.
+ *
+ * Built-ins are declared with the same `defineField()` a third-party package
+ * uses, so there is no privileged path into the registry (stage 9).
+ */
+export * from "./fields/index";
+//# sourceMappingURL=fields.d.ts.map

package/dist/fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,gBAAgB,CAAC"}

package/dist/fields.js

@@ -0,0 +1 @@
+import{ro,Jo,No,T}from"./index-k8wbg1dw.js";import{z as e}from"zod";var i=e.looseObject({label:e.string().optional(),description:e.string().optional(),localized:e.boolean().optional(),required:e.boolean().optional(),unique:e.boolean().optional(),index:e.boolean().optional(),readOnly:e.boolean().optional()}),o=e.lazy(()=>e.union([e.string(),e.number(),e.boolean(),e.null(),e.array(o),e.record(e.string(),o)])),l=T({name:"text",optionsSchema:i.extend({default:e.string().optional(),minLength:e.number().int().nonnegative().optional(),maxLength:e.number().int().positive().optional(),pattern:e.string().optional()}),schema:(n)=>{let t=e.string();if(n.minLength!==void 0)t=t.min(n.minLength);if(n.maxLength!==void 0)t=t.max(n.maxLength);if(n.pattern!==void 0)t=t.regex(new RegExp(n.pattern));return t},column:(n)=>({type:"text",...n.default===void 0?{}:{default:n.default}}),aiActions:["generate","improve","summarize","translate"]}),r=T({name:"textarea",optionsSchema:i.extend({default:e.string().optional(),maxLength:e.number().int().positive().optional(),rows:e.number().int().positive().optional()}),schema:(n)=>n.maxLength===void 0?e.string():e.string().max(n.maxLength),column:()=>({type:"text"}),aiActions:["generate","improve","summarize","translate"]}),f=T({name:"richText",optionsSchema:i.extend({nodes:e.array(e.string()).optional()}),schema:()=>e.looseObject({type:e.string()}),column:()=>({type:"json"}),aiActions:["generate","improve","summarize","translate"]}),O=T({name:"number",optionsSchema:i.extend({default:e.number().optional(),min:e.number().optional(),max:e.number().optional(),integer:e.boolean().optional()}),schema:(n)=>{let t=n.integer===!0?e.number().int():e.number();if(n.min!==void 0)t=t.min(n.min);if(n.max!==void 0)t=t.max(n.max);return t},column:(n)=>({type:n.integer===!0?"integer":"real",...n.default===void 0?{}:{default:n.default}})}),h=T({name:"boolean",optionsSchema:i.extend({default:e.boolean().optional()}),schema:()=>e.boolean(),column:(n)=>({type:"boolean",...n.default===void 0?{}:{default:n.default}})}),y=T({name:"date",optionsSchema:i.extend({default:e.string().optional(),mode:e.enum(["date","datetime"]).optional()}),schema:()=>e.string().refine((n)=>!Number.isNaN(Date.parse(n)),"must be an ISO 8601 date"),column:()=>({type:"timestamp"})}),a=(n)=>n.map((t)=>typeof t==="string"?t:t.value),s=i.extend({options:e.array(e.union([e.string(),e.strictObject({label:e.string(),value:e.string()})])).min(1),default:e.string().optional()}),p=T({name:"select",optionsSchema:s,schema:(n)=>e.enum(a(n.options)),column:(n)=>({type:"text",...n.default===void 0?{}:{default:n.default}})});function b(n){return p(n)}var m=T({name:"multiselect",optionsSchema:s.extend({default:e.array(e.string()).optional(),minItems:e.number().int().nonnegative().optional(),maxItems:e.number().int().positive().optional()}),schema:(n)=>{let t=e.array(e.enum(a(n.options)));if(n.minItems!==void 0)t=t.min(n.minItems);if(n.maxItems!==void 0)t=t.max(n.maxItems);return t},column:()=>({type:"json",array:!0}),aiActions:["tags"]});function F(n){return m(n)}var S=T({name:"json",optionsSchema:i,schema:()=>o,column:()=>({type:"json"})}),u=T({name:"media",optionsSchema:i.extend({accept:e.string().optional()}),schema:()=>e.string().min(1),column:()=>({type:"text"}),aiActions:["alt"]}),d=T({name:"relation",optionsSchema:i.extend({relationTo:e.string().min(1),many:e.boolean().optional()}),schema:()=>e.string().min(1),column:(n)=>({type:"text",...n.many===!0?{type:"json",array:!0}:{}}),aiActions:["tags"]});function V(n,t){return d({...t??{},relationTo:n})}var z=T({name:"email",optionsSchema:i,schema:()=>e.string().email(),column:()=>({type:"text"})}),c=T({name:"url",optionsSchema:i,schema:()=>e.string().url(),column:()=>({type:"text"})});function w(){return{seoTitle:l({label:"SEO title",localized:!0,maxLength:70,aiGenerate:{label:"Suggest an SEO title",prompt:"Write a search-friendly title under 60 characters."}}),seoDescription:r({label:"SEO description",localized:!0,maxLength:160,aiGenerate:{label:"Suggest an SEO description",prompt:"Summarise the article in one sentence under 155 characters."}}),ogImage:u({label:"Social image",accept:"image/*"}),canonical:c({label:"Canonical URL"})}}export{h as boolean,y as date,T as defineField,z as email,Jo as getFieldType,S as json,u as media,F as multiselect,O as number,ro as registerFieldType,No as registeredFieldTypes,V as relation,f as richText,b as select,w as seoFields,l as text,r as textarea,c as url};

package/dist/http/guard.d.ts

@@ -0,0 +1,45 @@
+import type { Actor, OperationSource } from "../types/actor";
+import type { ResolvedCmsConfig } from "../types/config";
+/**
+ * Who may call the administrative endpoints.
+ *
+ * Document and media routes need nothing from this file: the engine already
+ * answers "may this actor do this" for them, including the anonymous case —
+ * a collection with `read: () => true` is a public API and that is the point.
+ *
+ * The endpoints that manage the CMS itself are different. `GET /users` has no
+ * collection to carry an `access` rule, so the rule is here, and it has two
+ * parts:
+ *
+ * 1. **Always an authenticated caller.** Without `rbac` a collection defaults
+ *    to open, which is a sensible default for content and a catastrophic one
+ *    for user management.
+ * 2. **With `rbac`, also the permission.** Declaring roles is the statement
+ *    that this deployment distinguishes between editors, so the distinction
+ *    is applied here too.
+ *
+ * The permission names follow the same `resource:action` grammar as
+ * everything else — `users:invite`, `roles:create`, `webhooks:create`,
+ * `activity:read`, `jobs:run` — so an administrator writes them in `rbac`
+ * without learning a second vocabulary.
+ */
+export declare function requireActor(actor: Actor | null): Actor;
+export declare function requirePermission(config: ResolvedCmsConfig, actor: Actor | null, permission: string): Actor;
+/**
+ * A session, specifically.
+ *
+ * Used by the endpoints that mint credentials: an API key that can create
+ * another API key turns a leaked read-only key into a permanent foothold,
+ * and the same argument applies to enrolling a second factor.
+ */
+export declare function requireSession(actor: Actor | null): Actor;
+/**
+ * Where the call came from, for hooks, events and the activity log.
+ *
+ * Everything over HTTP is `rest` unless the panel says otherwise with a
+ * header. Trusting a client header is fine precisely because it grants
+ * nothing: it is a label on a log line, and the panel is the only thing that
+ * sends it.
+ */
+export declare function requestSource(request: Request): OperationSource;
+//# sourceMappingURL=guard.d.ts.map

package/dist/http/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/http/guard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,CAKvD;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,UAAU,EAAE,MAAM,GACjB,KAAK,CAOP;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,CAQzD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAI/D"}

package/dist/http/handler.d.ts

@@ -0,0 +1,31 @@
+import type { CmsHandler, CmsInstance, RouteInspection } from "../types/instance";
+import type { JsonObject } from "../types/json";
+/**
+ * `cms.handler`: the only HTTP contract in the product.
+ *
+ * `basePath` is stripped and the rest is matched, which is the whole of the
+ * Better Auth arrangement the plan asks for (section 10): one catch-all route
+ * in any framework mounts the API, the panel and every plugin route, and a
+ * route added to the core or to a plugin tomorrow needs no change in the
+ * application.
+ *
+ * The order inside a request is fixed and worth knowing:
+ *
+ * 1. the path is resolved against `basePath`,
+ * 2. the caller is resolved from the cookie or the `Authorization` header,
+ * 3. `hooks.before` run, and may answer instead of the route,
+ * 4. the route's own middleware wrap the handler,
+ * 5. `hooks.after` see the response and may add to it.
+ *
+ * Authentication is resolved before the hooks because a rate limiter that
+ * cannot tell an editor from a stranger is a rate limiter on the wrong thing.
+ */
+export interface CmsHttp {
+    handler: CmsHandler;
+    /** What `cms.inspect().routes` prints. */
+    routes(): RouteInspection[];
+    /** The generated document, memoised. */
+    openapi(): JsonObject;
+}
+export declare function createCmsHttp(cms: CmsInstance): CmsHttp;
+//# sourceMappingURL=handler.d.ts.map

package/dist/http/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/http/handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAsBhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,UAAU,CAAC;IACpB,0CAA0C;IAC1C,MAAM,IAAI,eAAe,EAAE,CAAC;IAC5B,wCAAwC;IACxC,OAAO,IAAI,UAAU,CAAC;CACvB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAsFvD"}

package/dist/http/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The HTTP layer.
+ *
+ * Nothing here knows how a document is stored, who may read it or what a
+ * hook does: every handler parses a URL, calls one method on the instance and
+ * serialises the answer. That is what keeps `cms.api.posts.find()` and
+ * `GET /api/heyo-cms/posts` the same operation rather than two implementations
+ * of the same intention (section 10).
+ */
+export { createCmsHttp, type CmsHttp } from "./handler";
+export { buildOpenApi } from "./openapi";
+export { Router, type RouteHandler, type RouteMatch, type RouteMiddleware, type RouteRecord, } from "./router";
+//# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACL,MAAM,EACN,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC"}

package/dist/http/openapi.d.ts

@@ -0,0 +1,5 @@
+import type { CmsInstance } from "../types/instance";
+import type { JsonObject } from "../types/json";
+import type { RouteRecord } from "./router";
+export declare function buildOpenApi(cms: CmsInstance, routes: RouteRecord[]): JsonObject;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/http/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/http/openapi.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAgD5C,wBAAgB,YAAY,CAC1B,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,WAAW,EAAE,GACpB,UAAU,CAiEZ"}

package/dist/http/params.d.ts

@@ -0,0 +1,32 @@
+import type { Actor } from "../types/actor";
+import type { FindArgs, ReadArgs } from "../types/api";
+import type { ResolvedCollection } from "../types/config";
+import type { OrderBy, Where } from "../types/query";
+export interface ReadQueryOptions {
+    actor: Actor | null;
+    /** `rest` for everything over HTTP; the panel is marked by a header. */
+    source: ReadArgs["source"];
+}
+/** Locale, depth and the trash flag: what every read takes. */
+export declare function readArgs(query: URLSearchParams, options: ReadQueryOptions): ReadArgs;
+/** The whole of `GET /posts`: filters, sort, paging. */
+export declare function findArgs(query: URLSearchParams, collection: ResolvedCollection, options: ReadQueryOptions): FindArgs;
+/**
+ * The filter, from either syntax.
+ *
+ * Both are resolved through the same path resolver, which is what makes a
+ * localized field filterable without the caller knowing it is stored as a map:
+ * `?title=Hello` with `?locale=de` becomes `data.title.de`, because that is
+ * where the German title lives (section 9).
+ */
+export declare function parseWhere(query: URLSearchParams, collection: ResolvedCollection, locale: string | null): Where | undefined;
+export declare function parseSort(raw: string | null, collection: ResolvedCollection, locale: string | null): OrderBy[] | undefined;
+export declare function integer(raw: string | null, name: string, min: number, max: number): number | undefined;
+/**
+ * `?flag`, `?flag=true` and `?flag=1` all mean yes.
+ *
+ * A bare `?permanent` with no value is what somebody types, and reading it as
+ * "false" would make a destructive flag silently do nothing.
+ */
+export declare function boolean(raw: string | null, name: string): boolean | undefined;
+//# sourceMappingURL=params.d.ts.map

package/dist/http/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../../src/http/params.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAA2B,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAiF9E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;CAC5B;AAED,+DAA+D;AAC/D,wBAAgB,QAAQ,CACtB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,gBAAgB,GACxB,QAAQ,CAiBV;AAED,wDAAwD;AACxD,wBAAgB,QAAQ,CACtB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,gBAAgB,GACxB,QAAQ,CAkBV;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,KAAK,GAAG,SAAS,CAiCnB;AA0ED,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,EAAE,GAAG,SAAS,CAevB;AA2HD,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAOpB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAK7E"}