@heyo-sh/heyo-cms 0.0.0-stage → 0.1.0

package/dist/http/request-db.d.ts

@@ -0,0 +1,19 @@
+import type { DatabaseAdapter } from "../types/database";
+import type { ScopedDb } from "../types/hooks";
+/**
+ * `ctx.db` for a route rather than for a hook.
+ *
+ * A hook runs inside the operation's transaction, so its `db` joins it. A
+ * route is not an operation: there is nothing for a second statement to be
+ * atomic with, and holding a transaction open across an `await fetch()` in
+ * somebody's plugin would pin a pool connection for as long as the slowest
+ * third party takes to answer. So every call here gets its own short
+ * transaction, and a route that genuinely needs two statements to agree asks
+ * for the adapter and opens one itself.
+ *
+ * Lazy on purpose: resolving the adapter is what opens a pool or reads a
+ * binding, and most requests — a bundled asset, the OpenAPI document, a 404 —
+ * never touch the database at all.
+ */
+export declare function requestDb(database: () => Promise<DatabaseAdapter>): ScopedDb;
+//# sourceMappingURL=request-db.d.ts.map

package/dist/http/request-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-db.d.ts","sourceRoot":"","sources":["../../src/http/request-db.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,QAAQ,CAuB5E"}

package/dist/http/respond.d.ts

@@ -0,0 +1,48 @@
+import type { JsonObject } from "../types/json";
+/**
+ * Every response the handler produces, in one place.
+ *
+ * The shape matters more than it looks: a client written against this has to
+ * be able to tell "the hook stopped it" from "the document is not there" from
+ * "your filter is nonsense" without parsing prose, which is why errors carry
+ * `code` and why a stopped write is a status rather than a body.
+ */
+export declare const jsonContentType = "application/json; charset=utf-8";
+export declare function json(body: unknown, status?: number, headers?: Record<string, string>): Response;
+export declare function text(body: string, status?: number): Response;
+export declare function noContent(headers?: Record<string, string>): Response;
+/**
+ * A write a `before` hook stopped.
+ *
+ * `null` is the local API's answer (section 5) and HTTP has no `null`, so this
+ * is the translation: nothing happened, nothing to return, and a header that
+ * says which of the two reasons for a 204 this is. The typed client turns it
+ * back into `null`.
+ */
+export declare function stopped(): Response;
+/**
+ * The one error shape.
+ *
+ * A `CmsError` already carries the status and the code — a hook that threw, a
+ * refused access rule and a failed field validation all arrive here as one
+ * type — so this function never has to guess. Anything else is a bug in the
+ * CMS and is reported as a 500 whose message is not forwarded: an exception
+ * from a database driver routinely contains a connection string.
+ */
+export declare function errorResponse(error: unknown): Response;
+/**
+ * The JSON body of a request.
+ *
+ * An empty body reads as `{}` because `PATCH /posts/:id` with nothing to say
+ * is a legal, if pointless, request — and answering it with a parse error
+ * would be a worse description of what happened.
+ */
+export declare function readJson(request: Request): Promise<unknown>;
+/** The body as an object, which is what every write route wants. */
+export declare function readJsonObject(request: Request): Promise<JsonObject>;
+/** `data` out of a write body, refusing the shapes that cannot be a patch. */
+export declare function requireData(body: JsonObject, key?: string): JsonObject;
+export declare function requireString(body: JsonObject, key: string): string;
+export declare function optionalString(body: JsonObject, key: string): string | undefined;
+export declare function optionalStringArray(body: JsonObject, key: string): string[] | undefined;
+//# sourceMappingURL=respond.d.ts.map

package/dist/http/respond.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/http/respond.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;;GAOG;AAEH,eAAO,MAAM,eAAe,oCAAoC,CAAC;AAEjE,wBAAgB,IAAI,CAClB,IAAI,EAAE,OAAO,EACb,MAAM,SAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,QAAQ,CAKV;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,QAAQ,CAKzD;AAED,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,QAAQ,CAEpE;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,IAAI,QAAQ,CAElC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CA4BtD;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjE;AAED,oEAAoE;AACpE,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAS1E;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,SAAS,GAAG,UAAU,CAStE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMnE;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAOpB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,GAAG,SAAS,CAStB"}

package/dist/http/rich-text.d.ts

@@ -0,0 +1,30 @@
+import type { ResolvedCollection } from "../types/config";
+import type { RichTextFormat } from "../types/editor";
+import type { JsonObject } from "../types/json";
+/**
+ * `?richText=html` on a read.
+ *
+ * The reason this exists is the one `defineEditorNode()` enforces: a
+ * ProseMirror document is useless to a consumer that has no ProseMirror. A
+ * static site generator, an RSS feed, a mail template and a search index all
+ * want the same thing, and without this each of them writes its own
+ * half-correct renderer against a tree they do not control.
+ *
+ * It is opt-in and not the default, because the document *is* the stored
+ * value: a client that writes back what it read must get back what is
+ * stored, and a response that silently replaced a document with a string
+ * would make `GET` then `PATCH` destructive.
+ */
+export declare function richTextFormat(value: string | null): RichTextFormat | undefined;
+export interface RenderOptions {
+    collection: ResolvedCollection;
+    format: RichTextFormat;
+    /** Resolves a `mediaId` on an image node to a URL this deployment serves. */
+    mediaUrl: (id: string) => string;
+}
+/** Renders every rich-text field of one document, in place. */
+export declare function renderDocumentRichText(document: JsonObject, options: RenderOptions): JsonObject;
+export declare function renderPageRichText(documents: JsonObject[], options: RenderOptions): void;
+/** The URL the CMS itself serves a file from, for an image inside prose. */
+export declare function mediaUrlResolver(basePath: string): (id: string) => string;
+//# sourceMappingURL=rich-text.d.ts.map

package/dist/http/rich-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-text.d.ts","sourceRoot":"","sources":["../../src/http/rich-text.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,cAAc,GAAG,SAAS,CAQ5B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;CAClC;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,aAAa,GACrB,UAAU,CAYZ;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,UAAU,EAAE,EACvB,OAAO,EAAE,aAAa,GACrB,IAAI,CAEN;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAEzE"}

package/dist/http/router.d.ts

@@ -0,0 +1,55 @@
+import type { RouteInspection } from "../types/instance";
+import type { OpenApiRouteSpec, RouteContext, RouteMethod } from "../types/plugin";
+/**
+ * The router.
+ *
+ * Written here rather than taken from a package, and that is a decision worth
+ * defending. The plan points at Better Auth's arrangement (section 10) and
+ * Better Auth does exactly this: its own matcher, because the router ends up
+ * in the public contract. Ours is in `RouteContext`, which a plugin author
+ * types against — and a plugin ecosystem pinned to somebody else's router
+ * major version is the framework coupling this project exists to avoid.
+ *
+ * What it owes: `:param` and a trailing `*`, static-before-dynamic
+ * precedence, 405 with an `Allow` header, and collisions detected while the
+ * configuration is still loading.
+ */
+export type RouteHandler = (context: RouteContext) => Response | Promise<Response>;
+export type RouteMiddleware = (context: RouteContext, next: () => Promise<Response>) => Promise<Response>;
+export interface RouteRecord {
+    method: RouteMethod;
+    /** Relative to `basePath`: `/posts/:id`, `/admin/*`. */
+    path: string;
+    /** `core`, or the id of the plugin that registered it. */
+    source: string;
+    handler: RouteHandler;
+    middleware?: RouteMiddleware[];
+    openapi?: OpenApiRouteSpec;
+}
+export type RouteMatch = {
+    kind: "found";
+    route: RouteRecord;
+    params: Record<string, string>;
+} | {
+    kind: "method-not-allowed";
+    allowed: RouteMethod[];
+} | {
+    kind: "not-found";
+};
+export declare class Router {
+    private readonly compiled;
+    private readonly signatures;
+    add(route: RouteRecord): void;
+    /** Registration order is not match order; this is match order. */
+    list(): RouteRecord[];
+    /**
+     * What `cms.inspect().routes` prints.
+     *
+     * Paths carry `basePath`, because the question somebody has when they print
+     * this is "what do I call", and the answer to that is a URL rather than a
+     * pattern the router happens to store.
+     */
+    routes(basePath: string): RouteInspection[];
+    match(method: string, path: string): RouteMatch;
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/http/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/http/router.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,KAClB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAeD,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAuC5B;IAED,kEAAkE;IAClE,IAAI,IAAI,WAAW,EAAE,CAEpB;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE,CAO1C;IAED,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAkB9C;CACF"}

package/dist/http/routes/access.d.ts

@@ -0,0 +1,13 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * Who may edit, and what each role means.
+ *
+ * These are the endpoints with no collection behind them, so the permission
+ * check is explicit — `users:read`, `roles:create` — and an authenticated
+ * caller is required even when `rbac` is absent (see `guard.ts`). Everything
+ * else is `cms.auth`, unchanged: the panel and a provisioning script get the
+ * same invitations, the same hashed secrets and the same events.
+ */
+export declare function accessRoutes(cms: CmsInstance): RouteRecord[];
+//# sourceMappingURL=access.d.ts.map

package/dist/http/routes/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/http/routes/access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAyT5D"}

package/dist/http/routes/admin.d.ts

@@ -0,0 +1,28 @@
+import type { CmsInstance } from "../../types/instance";
+import type { JsonObject } from "../../types/json";
+import type { RouteRecord } from "../router";
+/**
+ * The panel, served from the same handler as the API.
+ *
+ * No separate deployment, no CORS, no second origin to configure: the bundle
+ * is files, the handler serves files, and the panel talks to the API through
+ * relative URLs (section 10). `admin.assets` is where the files come from —
+ * an interface rather than a directory, because the bundle has to be readable
+ * from a Worker, where there is no filesystem.
+ *
+ * Without one — `admin.assets` unset — this answers with a page that says
+ * what is missing and links to the generated OpenAPI document.
+ * Deliberately not a 404: a mount point that answers nothing is
+ * indistinguishable from a mount point that is wrong, and the first thing
+ * somebody does after wiring the catch-all route is open this URL.
+ */
+export declare function adminRoutes(cms: CmsInstance): RouteRecord[];
+/**
+ * `GET /openapi.json`: the canonical description of this deployment.
+ *
+ * Takes a function rather than the document because the document describes
+ * this route too: the router has to be complete before it can be generated,
+ * and generating it on first request also keeps it off the cold-start path.
+ */
+export declare function openApiRoute(document: () => JsonObject): RouteRecord;
+//# sourceMappingURL=admin.d.ts.map

package/dist/http/routes/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/http/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAyF3D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,UAAU,GAAG,WAAW,CAepE"}

package/dist/http/routes/ai.d.ts

@@ -0,0 +1,26 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * The AI endpoints, generated from the configuration like everything else.
+ *
+ * Two shapes per field action, and the reason there are two is that a document
+ * being written for the first time has no id. The panel asks about what is on
+ * the screen, which for a new document is only in the browser, so the draft
+ * travels in the body and the stored document — when there is one — is read
+ * through `cms.api` and merged underneath it.
+ *
+ *   POST /posts/:id/ai/:field/:action
+ *   POST /posts/ai/:field/:action        (an unsaved draft)
+ *
+ * Then the panel-wide assistant, which is addressed by nothing in particular
+ * because it is not about one collection:
+ *
+ *   POST /ai/assistant                   (SSE)
+ *   POST /ai/assistant/plans/:id/approve
+ *
+ * The per-field routes exist only when a field declares `aiGenerate` or a legacy `ai` action.
+ * A deployment with no AI has no AI endpoints, which is what
+ * `cms.inspect().routes` should say (section 8).
+ */
+export declare function aiRoutes(cms: CmsInstance): RouteRecord[];
+//# sourceMappingURL=ai.d.ts.map

package/dist/http/routes/ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../../src/http/routes/ai.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CA+JxD"}

package/dist/http/routes/auth.d.ts

@@ -0,0 +1,13 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * Editor authentication over HTTP.
+ *
+ * Every handler is a call into `cms.auth` plus a cookie, and the routes that
+ * exist are decided by `admin.auth.methods`: a deployment that never enabled
+ * magic links does not answer `POST /auth/magic-link` with "not configured",
+ * it does not have the endpoint. `cms.inspect().routes` is then a true
+ * statement about the doors this deployment has.
+ */
+export declare function authRoutes(cms: CmsInstance): RouteRecord[];
+//# sourceMappingURL=auth.d.ts.map

package/dist/http/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/http/routes/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAkpB1D"}

package/dist/http/routes/documents.d.ts

@@ -0,0 +1,24 @@
+import type { ResolvedCollection } from "../../types/config";
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * CRUD, generated from the configuration.
+ *
+ * Every handler here is three lines around a call into `cms.api`, and that is
+ * the whole design: the REST layer parses a URL and serialises a result, and
+ * knows nothing about access control, hooks, locales, the trash or events.
+ * A second implementation of any of those — the usual outcome of writing
+ * route handlers by hand — is a second set of bugs (section 10).
+ */
+export declare function documentRoutes(cms: CmsInstance): RouteRecord[];
+/**
+ * Singletons.
+ *
+ * Mounted under `/globals/` rather than at the root: a global and a
+ * collection are the same machinery, but a URL that could be either would
+ * make `/settings` ambiguous the day somebody adds a `settings` collection.
+ */
+export declare function globalRoutes(cms: CmsInstance): RouteRecord[];
+export declare function schemaName(collection: ResolvedCollection): string;
+export declare function inputName(collection: ResolvedCollection): string;
+//# sourceMappingURL=documents.d.ts.map

package/dist/http/routes/documents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../src/http/routes/documents.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAiBxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAkE7C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAmS9D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAuI5D;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,CAEjE;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,CAEhE"}

package/dist/http/routes/generate.d.ts

@@ -0,0 +1,5 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/** Deterministic field generation: server functions stay on the server. */
+export declare function generateRoutes(cms: CmsInstance): RouteRecord[];
+//# sourceMappingURL=generate.d.ts.map

package/dist/http/routes/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/http/routes/generate.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CA6J9D"}

package/dist/http/routes/media.d.ts

@@ -0,0 +1,28 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * The media library over HTTP.
+ *
+ * Registered only when `uploads` is configured. A deployment with no storage
+ * adapter has no library, and routes that exist in order to answer "add an
+ * uploads section" would put that sentence in `cms.inspect().routes` as if it
+ * were a feature.
+ *
+ * Reading is not gated by RBAC and writing is: a file's URL is public the
+ * moment it is on a page, so gating reads would break anonymous rendering and
+ * protect nothing that a private bucket and a signed URL do not already
+ * protect (stage 6).
+ */
+export declare function mediaRoutes(cms: CmsInstance): RouteRecord[];
+/**
+ * The orphan sweep, as an endpoint.
+ *
+ * Here rather than in the jobs module because it is the media lifecycle's
+ * only destructive step and reads better next to the library it collects
+ * from. It is also registered in `cms.jobs`, so a deployment with a cron
+ * never needs this route.
+ */
+export declare function mediaCollectRoute(cms: CmsInstance): RouteRecord[];
+/** The two names a declared size may not take; see the variant route. */
+export declare const reservedMediaSubRoutes: string[];
+//# sourceMappingURL=media.d.ts.map

package/dist/http/routes/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/http/routes/media.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAW7C;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAoT3D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAsCjE;AAED,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,UAA0C,CAAC"}

package/dist/http/routes/panel.d.ts

@@ -0,0 +1,20 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * `GET /panel`: the configuration, as data.
+ *
+ * The panel is one static bundle that has to render every deployment, so the
+ * first thing it does is ask what this one is: which collections exist, what
+ * fields they carry, which languages are registered, whether there is a
+ * trash, what the caller is allowed to press. All of it is derived from the
+ * configuration — there is no second place to maintain it, which is the same
+ * argument that produced the auto-router and the generated OpenAPI document.
+ *
+ * Open to anonymous callers on purpose. It describes the shape of the
+ * deployment, never its content and never a secret, and the sign-in screen
+ * needs the title and the enabled methods *before* anybody is signed in. The
+ * per-actor parts — `can`, and field-level access — simply answer for
+ * "nobody" then, which is the correct answer for nobody.
+ */
+export declare function panelRoutes(cms: CmsInstance): RouteRecord[];
+//# sourceMappingURL=panel.d.ts.map

package/dist/http/routes/panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"panel.d.ts","sourceRoot":"","sources":["../../../src/http/routes/panel.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CA8B3D"}

package/dist/http/routes/system.d.ts

@@ -0,0 +1,25 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * The endpoints that are about the CMS rather than about content: the trash,
+ * the language registry, the audit trail and the sweeps.
+ *
+ * All four are read through an instance method rather than a query written
+ * here, for the same reason the document routes are three lines each. The
+ * trash list in particular has to be one paged query across collections —
+ * assembling it per collection would page wrongly the moment two collections
+ * have entries.
+ */
+export declare function trashRoutes(cms: CmsInstance): RouteRecord[];
+export declare function localeRoutes(cms: CmsInstance): RouteRecord[];
+export declare function activityRoutes(cms: CmsInstance): RouteRecord[];
+/**
+ * The sweeps, as endpoints.
+ *
+ * The package deliberately starts no timer (`cms.jobs` is not a daemon,
+ * because it has to run on Workers and on Lambda), so something has to call
+ * this: a Vercel cron with an API key, `wrangler`'s scheduled handler calling
+ * `cms.jobs.run()` directly, or a developer with curl.
+ */
+export declare function jobRoutes(cms: CmsInstance): RouteRecord[];
+//# sourceMappingURL=system.d.ts.map

package/dist/http/routes/system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../src/http/routes/system.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAkH3D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAmC5D;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CA4D9D;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CAqEzD"}

package/dist/http/routes/webhooks.d.ts

@@ -0,0 +1,17 @@
+import type { CmsInstance } from "../../types/instance";
+import type { RouteRecord } from "../router";
+/**
+ * Subscriptions, deliveries, replay.
+ *
+ * Registered only when `webhooks.enabled` is true, so a deployment that does
+ * not use them does not answer on these paths at all — and the panel, which
+ * reads `cms.inspect()`-shaped data from `/panel`, hides the screen rather
+ * than showing one that 501s.
+ *
+ * Every endpoint needs a permission in the `resource:action` grammar the
+ * rest of the product uses: `webhooks:read`, `webhooks:create`,
+ * `webhooks:update`, `webhooks:delete`. Managing where this CMS sends its
+ * content is an administrative act, not an editorial one.
+ */
+export declare function webhookRoutes(cms: CmsInstance): RouteRecord[];
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/http/routes/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/http/routes/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,CA2N7D"}

package/dist/http/spec.d.ts

@@ -0,0 +1,28 @@
+import type { JsonObject } from "../types/json";
+/**
+ * The small vocabulary the route modules use to document themselves.
+ *
+ * Keeping it here rather than inline is not tidiness: a response envelope
+ * described slightly differently on forty endpoints produces a generated
+ * document nobody can code-generate a client from.
+ */
+export declare function ref(schema: string): JsonObject;
+export declare function pathParam(name: string, description: string): JsonObject;
+export declare function queryParam(name: string, type: "string" | "integer" | "boolean", description: string, extra?: JsonObject): JsonObject;
+/** Locale and fallback: every read takes them, so they are written once. */
+export declare const localeParams: JsonObject[];
+export declare const depthParam: JsonObject;
+/** The filter, sort and paging parameters of a list endpoint. */
+export declare function listParams(collection: string): JsonObject[];
+export declare function jsonBody(schema: JsonObject, required?: boolean): JsonObject;
+export declare function okJson(schema: JsonObject, description: string): JsonObject;
+/**
+ * The responses every write shares.
+ *
+ * `204` is in here on purpose: a `before` hook returning `false` stops the
+ * operation without an error (section 5), and a client that does not know
+ * that will read an empty body as a broken endpoint.
+ */
+export declare function writeResponses(schema: JsonObject, description: string, status?: number): JsonObject;
+export declare function readResponses(schema: JsonObject, description: string): JsonObject;
+//# sourceMappingURL=spec.d.ts.map

package/dist/http/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/http/spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;GAMG;AAEH,wBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAE9C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAQvE;AAED,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,EACtC,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,UAAe,GACrB,UAAU,CAQZ;AAED,4EAA4E;AAC5E,eAAO,MAAM,YAAY,EAAE,UAAU,EAGpC,CAAC;AAEF,eAAO,MAAM,UAAU,YAKtB,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE,CAoB3D;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,UAAO,GAAG,UAAU,CAKxE;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAK1E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,MAAM,SAAM,GACX,UAAU,CAaZ;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,GAClB,UAAU,CAKZ"}

package/dist/http.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `@heyo-sh/heyo-cms/http`.
+ *
+ * The HTTP layer, for the two callers who need it directly: a plugin writing
+ * route handlers, and a test or tool that wants the router without a request.
+ * An application mounts `cms.handler` through a framework adapter and never
+ * imports this.
+ */
+export { createCmsHttp, type CmsHttp } from "./http/handler";
+export { buildOpenApi } from "./http/openapi";
+export { Router, type RouteHandler, type RouteMatch, type RouteMiddleware, type RouteRecord, } from "./http/router";
+export { errorResponse, json, noContent, optionalString, optionalStringArray, readJson, readJsonObject, requireData, requireString, stopped, text, } from "./http/respond";
+export { requestSource, requireActor, requirePermission, requireSession, } from "./http/guard";
+export { boolean as booleanParam, findArgs, integer as integerParam, parseSort, parseWhere, readArgs, } from "./http/params";
+export { requestDb } from "./http/request-db";
+export { jsonBody, listParams, localeParams, okJson, pathParam, queryParam, readResponses, ref, writeResponses, } from "./http/spec";
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,MAAM,EACN,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,aAAa,EACb,IAAI,EACJ,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,OAAO,EACP,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,OAAO,IAAI,YAAY,EACvB,QAAQ,EACR,OAAO,IAAI,YAAY,EACvB,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,MAAM,EACN,SAAS,EACT,UAAU,EACV,aAAa,EACb,GAAG,EACH,cAAc,GACf,MAAM,aAAa,CAAC"}

package/dist/http.js

@@ -0,0 +1 @@
+import"./index-vxw0a03g.js";import"./index-2z1qe5mw.js";import"./index-9zqnf6gx.js";import{Fe,m,Je,y,E,vn,Kn,Yn,R,H,i,An,G,B,Gt,Kt,f,Oe,v,F,ve,o,l,a,K,xn,h,r,M,yt,kn,Rn,_e,Pe}from"./index-nvgwyykk.js";import"./index-vq2978e7.js";import"./index-5ngtc7gy.js";export{_e as Router,H as booleanParam,kn as buildOpenApi,Pe as createCmsHttp,Gt as errorResponse,vn as findArgs,R as integerParam,i as json,h as jsonBody,xn as listParams,K as localeParams,G as noContent,r as okJson,F as optionalString,ve as optionalStringArray,Yn as parseSort,Kn as parseWhere,l as pathParam,a as queryParam,E as readArgs,Kt as readJson,f as readJsonObject,yt as readResponses,o as ref,Rn as requestDb,y as requestSource,Fe as requireActor,Oe as requireData,m as requirePermission,Je as requireSession,v as requireString,B as stopped,An as text,M as writeResponses};

package/dist/i18n/index.d.ts

@@ -0,0 +1,12 @@
+import type { ResolvedCmsConfig } from "../types/config";
+import type { LocaleRecord } from "../types/locales";
+export { isRtlLocale, localeName, LOCALE_NAMES } from "./names";
+/**
+ * The configured languages, named.
+ *
+ * In the order they were configured: a switcher that reorders what somebody
+ * typed is a switcher whose order nobody can control. The default locale is
+ * flagged rather than hoisted, for the same reason.
+ */
+export declare function localeRecords(config: ResolvedCmsConfig): LocaleRecord[];
+//# sourceMappingURL=index.d.ts.map

package/dist/i18n/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/i18n/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEhE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,YAAY,EAAE,CAOvE"}

package/dist/i18n/names.d.ts

@@ -0,0 +1,25 @@
+/**
+ * What a locale code is called, in English.
+ *
+ * The configuration is a list of codes — `["en", "pl"]` — because that is all
+ * a deployment should have to type. A panel cannot put `pl` in a language
+ * switcher and call it a language, so the display name is looked up here
+ * rather than asked for: one table, filled in once, instead of a `name` on
+ * every entry of every configuration.
+ *
+ * English names rather than endonyms ("Polish", not "Polski"): the panel's
+ * chrome is English, and a switcher that mixes the two is a list nobody can
+ * scan.
+ */
+export declare const LOCALE_NAMES: Record<string, string>;
+/**
+ * `"pl"` → `"Polish"`, `"pt-BR"` → `"Portuguese (Brazil)"`.
+ *
+ * An unknown code is returned as it was written rather than guessed at: a
+ * switcher reading `"kw"` is a configuration to fix, and inventing a name for
+ * it would hide that.
+ */
+export declare function localeName(code: string): string;
+/** Whether a code names a right-to-left language, region tag included. */
+export declare function isRtlLocale(code: string): boolean;
+//# sourceMappingURL=names.d.ts.map

package/dist/i18n/names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.d.ts","sourceRoot":"","sources":["../../src/i18n/names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqF/C,CAAC;AAkDF;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW/C;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD"}

package/dist/ids.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Identifiers and checksums.
+ *
+ * Ids are generated in the engine rather than by the database: MongoDB,
+ * Postgres and D1 would otherwise each produce a different shape, and the
+ * value has to exist before the insert so hooks and events can reference the
+ * document they are about.
+ */
+/**
+ * A sortable, prefixed id: `doc_01jq8z4m2k7xqf3h`.
+ *
+ * Time-ordered like a ULID, because an id that sorts by creation turns
+ * "newest first" into an index scan instead of a sort, and makes a log of
+ * ids readable. Randomness is eight base-36 characters — about 41 bits —
+ * which is far more than a single millisecond of inserts needs.
+ */
+export declare function createId(prefix: string): string;
+export declare function createOrderedId(prefix: string): string;
+/**
+ * A fingerprint of a migration file.
+ *
+ * FNV-1a, not a cryptographic hash: this answers "has this file changed since
+ * it was applied", which is a question about accidents, not attackers. A
+ * 64-bit digest makes an accidental collision impossible in a directory that
+ * will hold hundreds of files, not billions.
+ */
+export declare function checksum(content: string): string;
+//# sourceMappingURL=ids.d.ts.map

package/dist/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0BH;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/C;AAaD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD"}

package/dist/index-2757kej5.js

@@ -0,0 +1,2 @@
+var me="/api/heyo-cms",He="/admin",Be="./migrations";
+export{me,He,Be};

package/dist/index-2kb5nbxx.js

@@ -0,0 +1,2 @@
+function i(t){let e="";while(e.length<t){let o=crypto.getRandomValues(new Uint8Array(t*2));for(let r of o){if(r>=252)continue;if(e+="0123456789abcdefghijklmnopqrstuvwxyz"[r%36],e.length===t)break}}return e}function w(t){let n=Date.now().toString(36).padStart(9,"0");return`${t}_${n}${i(8)}`}var f=0;function ge(t){f=(f+1)%60466175;let n=Date.now().toString(36).padStart(9,"0"),e=f.toString(36).padStart(5,"0");return`${t}_${n}${e}${i(3)}`}function lo(t){let n=0xcbf29ce484222325n,e=0x100000001b3n,o=0xffffffffffffffffn,r=new TextEncoder().encode(t);for(let c of r)n=(n^BigInt(c))*e&o;return n.toString(16).padStart(16,"0")}
+export{w,ge,lo};

package/dist/index-2z1qe5mw.js

@@ -0,0 +1,2 @@
+import{e}from"./index-x72d1hzh.js";var so="*";function Rt(t,n){return`${t}:${n}`}function m(t){if(t==="*")return["*","*"];let n=t.indexOf(":");if(n===-1)return[t,"*"];return[t.slice(0,n),t.slice(n+1)]}function y(t,n){return t==="*"||t===n}function Ln(t,n){let[o,r]=m(t),[i,s]=m(n);return y(o,i)&&y(r,s)}function P(t,n){if(!t)return!1;return t.permissions.some((o)=>Ln(o,n))}function Ge(t,n){let o=new Set;for(let r of t)for(let i of n[r]??[])o.add(i);return[...o].sort()}function Ct(t,n){let o=new Set;for(let r of t){let[i,s]=m(r);for(let a of n){let[l,u]=m(a),f=j(i,l),d=j(s,u);if(f===null||d===null)continue;o.add(f==="*"&&d==="*"?"*":`${f}:${d}`)}}return[...o].sort()}function j(t,n){if(t==="*")return n;if(n==="*")return t;return t===n?t:null}function Tt(t){let n=new Set;for(let o of t){if(o==="*"||o.includes(":")){n.add(o);continue}switch(o){case"read":n.add("*:read");break;case"write":n.add("*:read"),n.add("*:create"),n.add("*:update");break;case"delete":n.add("*:delete");break;default:break}}return[...n].sort()}function Re(t){if(t==="*")return!0;if(["read","write","delete"].includes(t))return!0;return/^[a-z0-9_*-]+:[a-z0-9_*-]+$/.test(t)}function S(t,n={}){let o=n.locale??t.i18n.defaultLocale;return{locale:o,chain:[o,...h(t,o,n)]}}function h(t,n,o){if(o.fallbackLocale===!1)return[];if(typeof o.fallbackLocale==="string")return o.fallbackLocale===n?[]:[o.fallbackLocale];let r=t.i18n.defaultLocale;return r===n?[]:[r]}function rn(t,n){let o=O(t)?t:{};for(let r of n.chain){let i=o[r];if(i!==void 0&&i!==null)return{value:i,from:r}}return{value:null,from:null}}function J(t,n,o){let r=O(t)?{...t}:{};return r[n]=o,r}function O(t){return typeof t==="object"&&t!==null&&!Array.isArray(t)}var C=["id","revision","createdAt","updatedAt","updatedBy","deletedAt","purgeAfter","scheduledAt","scheduledPatch","_fallback","_localeFields"],V=new Set(C);function A(t,n,o){let r=p(t.data),i={},s={},a=[];for(let[l,u]of Object.entries(n.fields)){if(u.localized){let d=r[l];if(d&&typeof d==="object"&&!Array.isArray(d)&&Object.hasOwn(d,o.locale))a.push(l);let g=rn(d,o);if(i[l]=g.value??b(u),g.from!==null&&g.from!==o.locale)s[l]=g.from;continue}let f=r[l];i[l]=f===void 0?b(u):f}if(Object.values(n.fields).some((l)=>l.localized))i._localeFields=a;if(i.id=String(t.id),i.revision=sn(t.revision),i.createdAt=c(t.created_at),i.updatedAt=c(t.updated_at),i.updatedBy=t.updated_by===void 0?null:t.updated_by,i.deletedAt=c(t.deleted_at),i.purgeAfter=c(t.purge_after),i.scheduledAt=c(t.scheduled_at),i.scheduledPatch=Te(t)?.data??null,Object.keys(s).length>0)i._fallback=s;return i}function Ce(t,n,o,r){v(t,n);let i=r===void 0,s={...r??{}},a=[];for(let[l,u]of Object.entries(t.fields)){let f=n[l];if(f!==void 0){s[l]=u.localized?J(s[l],o.locale,f):f,a.push(l);continue}if(!i)continue;let d=b(u);if(s[l]=u.localized?d===null?{}:{[o.locale]:d}:d,d!==null)a.push(l)}return{data:s,touched:a}}function Ie(t,n,o,r){let i={};for(let s of r){let a=t.fields[s];if(!a)continue;let l=a.localized?p(n[s])[o.locale]??null:n[s]??null;if(l===null&&a.required){i[s]="is required";continue}let u=a.schema.safeParse(l);if(!u.success)i[s]=u.error.issues[0]?.message??"is invalid"}if(Object.keys(i).length>0)throw e.validation(`${t.name}: ${Object.entries(i).map(([s,a])=>`${s} ${a}`).join(", ")}`,{fields:i})}function ao(t,n,o){return Object.keys(t.fields).filter((r)=>!L(n[r],o[r]))}function co(t){let n={};for(let[o,r]of Object.entries(t))n[R(o)]=r instanceof Date?r.toISOString():r instanceof Uint8Array?null:r;return n}function Te(t){let n=t.scheduled_patch;if(n===null||n===void 0)return null;let o=p(n),r=p(o.data),i=typeof o.locale==="string"?o.locale:null;if(i===null)return null;return{data:r,locale:i,actor:w(o.actor)}}function w(t){if(typeof t!=="object"||t===null||Array.isArray(t))return null;let n=t;if(typeof n.id!=="string")return null;return{id:n.id,source:n.source==="api-key"?"api-key":"session",roles:x(n.roles),permissions:x(n.permissions)}}function x(t){return Array.isArray(t)?t.filter((n)=>typeof n==="string"):[]}function sn(t){let n=Number(t??1);return Number.isFinite(n)&&n>0?Math.trunc(n):1}function c(t){if(t===void 0||t===null)return null;if(t instanceof Date)return t.toISOString();return String(t)}function p(t){return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:{}}function b(t){let n=t.defaultValue??t.column.default;return n===void 0?null:n}function v(t,n){let o=Object.keys(n).filter((r)=>!(r in t.fields)&&!V.has(r));if(o.length>0)throw e.validation(`${t.name} has no field ${o.map((r)=>`"${r}"`).join(", ")}`,{unknown:o})}function L(t,n){if(t===n)return!0;if(t===void 0||n===void 0)return!1;if(typeof t!=="object"||typeof n!=="object")return!1;return JSON.stringify(t)===JSON.stringify(n)}function R(t){return t.replace(/_([a-z0-9])/g,(n,o)=>o.toUpperCase())}
+export{so,Rt,Ln,P,Ge,Ct,Tt,Re,S,rn,A,Ce,Ie,ao,co,Te,sn,c,p};

package/dist/index-34s342fz.js

@@ -0,0 +1,2 @@
+import{createHash as u}from"node:crypto";import{arch as f,platform as m,release as p}from"node:os";var uo="https://telemetry.heyo.sh/v1/cms";function St(e,n=process.env){if(e?.enabled===!1)return{enabled:!1,reason:"telemetry: { enabled: false } in the configuration"};if(l(n.HEYO_TELEMETRY_DISABLED))return{enabled:!1,reason:"HEYO_TELEMETRY_DISABLED is set"};if(l(n.DO_NOT_TRACK))return{enabled:!1,reason:"DO_NOT_TRACK is set"};if(l(n.CI))return{enabled:!1,reason:"this is CI"};if(n.NODE_ENV==="test")return{enabled:!1,reason:"NODE_ENV is test"};return{enabled:!0,reason:"on by default; see `heyo-cms telemetry`"}}function Ot(e,n,o){let t=n._config,r=Object.values(t.collections),i=Object.values(t.globals),c=r.reduce((s,a)=>s+Object.keys(a.fields).length,0)+i.reduce((s,a)=>s+Object.keys(a.fields).length,0),d=typeof t.database==="function"?"lazy":t.database.id;return{event:e,version:o,project:y([t.basePath,d,...r.map((s)=>s.slug).sort(),...i.map((s)=>s.slug).sort()]),runtime:b(),system:{platform:m(),arch:f(),release:p()},database:d,usage:{collections:r.length,globals:i.length,fields:c,plugins:t.plugins.length,locales:t.i18n.locales.length},features:{panel:t.admin.assets!==void 0,auth:t.admin.auth!==void 0,uploads:g(t.uploads?.storage),ai:t.ai!==void 0,webhooks:t.webhooks?.enabled===!0,trash:t.trash.enabled}}}async function po(e,n={}){let o=n.fetch??globalThis.fetch;try{return(await o(n.endpoint??uo,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e),signal:AbortSignal.timeout(n.timeout??2000)})).ok?"sent":"failed"}catch{return"failed"}}async function an(e){let n=St(e.config,e.environment);if(!n.enabled)return{decision:n,result:"skipped"};let o=Ot(e.event,e.cms,e.version),t=await po(o,{...e.send,...e.config?.endpoint?{endpoint:e.config.endpoint}:{}});return{decision:n,result:t}}function g(e){if(e===void 0)return null;return typeof e==="function"?"lazy":e.id}function y(e){return u("sha256").update(e.join("|")).digest("hex").slice(0,16)}function b(){let e=globalThis.Bun;if(e)return{name:"bun",version:e.version};let n=globalThis.Deno;if(n)return{name:"deno",version:n.version.deno};return{name:"node",version:process.versions.node}}function l(e){return e!==void 0&&e!==""&&e!=="0"&&e!=="false"}
+export{uo,St,Ot,po,an};