@heyo-sh/heyo-cms 0.0.0-stage → 0.2.0

package/dist/auth/crypto.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Every cryptographic primitive the auth layer needs, on Web Crypto alone.
+ *
+ * No `node:crypto`, no native dependency, no `bcrypt` build step: the same
+ * code has to run on Node, Bun, Cloudflare Workers and Vercel's edge runtime,
+ * and an auth package that only works on one of them would quietly undo the
+ * "zero framework coupling" promise at the deployment layer.
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verifies a password against a stored hash.
+ *
+ * Reads the iteration count from the stored value instead of assuming the
+ * current one, so raising the cost later does not invalidate every existing
+ * password.
+ */
+export declare function verifyPassword(password: string, stored: string | null | undefined): Promise<boolean>;
+/**
+ * A secret nobody can guess: 32 bytes of CSPRNG, URL-safe.
+ *
+ * Used for session tokens, API keys, invitations, magic links and OAuth
+ * state. One generator means one place to be wrong about entropy.
+ */
+export declare function randomToken(bytes?: number): string;
+/**
+ * What goes in the database when the plaintext goes to the user.
+ *
+ * SHA-256 rather than PBKDF2 on purpose: these are 256-bit random secrets, not
+ * passwords, so there is nothing to brute-force and the lookup has to be a
+ * single indexed read on every request.
+ */
+export declare function hashToken(token: string): Promise<string>;
+/**
+ * Comparison whose duration does not depend on where the strings differ.
+ *
+ * A fast `===` on a token hash leaks the prefix one byte at a time to anyone
+ * willing to measure.
+ */
+export declare function timingSafeEqual(left: string, right: string): boolean;
+export declare function base64url(bytes: Uint8Array): string;
+export declare function fromBase64url(value: string): Uint8Array;
+/** SHA-256 of a string, base64url — the PKCE challenge, and nothing else. */
+export declare function sha256Base64Url(value: string): Promise<string>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAsBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAE9C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAOpE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAInD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAQvD;AAQD,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpE"}

package/dist/auth/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Editor authentication: configuration builders and the runtime behind
+ * `cms.auth`.
+ *
+ * The CMS has accounts for the people who edit content and for the machines
+ * that call its API, and for nobody else — the application being built brings
+ * its own identity layer (section 0). Everything here is Web Crypto and the
+ * database adapter, so the same sign-in works on Node, Bun and Workers.
+ */
+export { cmsUsers, oidc, type CmsUsersOptions, type OidcOptions } from "./config";
+export { apiKeyPrefix, createAuth, sessionCookieName, type AuthServiceOptions, } from "./service";
+export { base64url, hashPassword, hashToken, randomToken, verifyPassword, } from "./crypto";
+export { generateTotpSecret, totpCode, totpUri, verifyTotp } from "./totp";
+export { builtinProviders, decodeIdToken, type OAuthProfile, type OAuthProvider, } from "./oauth";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,EACL,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,SAAS,EACT,YAAY,EACZ,SAAS,EACT,WAAW,EACX,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,SAAS,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,93 @@
+import type { JsonObject } from "../types/json";
+/**
+ * OAuth 2.0 and OpenID Connect, as plain functions.
+ *
+ * Nothing here touches the database or the configuration: a provider is a
+ * record of endpoints plus a function that turns whatever the provider
+ * returns into the three things the CMS needs — a stable id, an email and a
+ * display name. Adding a provider is therefore a literal, not a subclass.
+ */
+export interface OAuthProfile {
+    /** Stable at the provider. Never the email: emails get reassigned. */
+    id: string;
+    email: string | null;
+    name: string | null;
+    avatarUrl: string | null;
+    /** Everything the provider said, for `oidc().mapRoles`. */
+    claims: JsonObject;
+}
+export interface OAuthTokens {
+    accessToken: string;
+    idToken?: string;
+    tokenType?: string;
+}
+export interface OAuthEndpoints {
+    authorization: string;
+    token: string;
+    userinfo?: string;
+}
+export interface OAuthProvider {
+    id: string;
+    endpoints: OAuthEndpoints;
+    scope: string;
+    /** Proof Key for Code Exchange. Off for GitHub, which does not accept it. */
+    pkce: boolean;
+    profile(tokens: OAuthTokens, fetchImpl: FetchLike): Promise<OAuthProfile>;
+}
+/**
+ * Just the call signature, not `typeof fetch`.
+ *
+ * Runtimes decorate the global with their own extras — Bun adds `preconnect`
+ * — and typing against the global would make a hand-written test double fail
+ * to compile for a reason that has nothing to do with HTTP.
+ */
+export type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+/**
+ * The three providers the plan names.
+ *
+ * Google and Microsoft are OpenID Connect, so the profile comes from the
+ * id_token and needs no second round trip. GitHub is plain OAuth 2 and hides
+ * a verified address behind a separate endpoint when the public profile has
+ * none, which is the common case for a work account.
+ */
+export declare const builtinProviders: Record<string, OAuthProvider>;
+/** The shape every OIDC provider agrees on, including a custom issuer. */
+export declare function oidcProfile(claims: JsonObject): OAuthProfile;
+/**
+ * Reads an id_token without verifying its signature.
+ *
+ * Allowed, and only allowed, because of how it arrives: the authorization code
+ * flow fetches it from the token endpoint over TLS, with the client
+ * authenticating itself — OpenID Connect Core 3.1.3.7 explicitly permits
+ * skipping signature validation on that path. A token that reached us any
+ * other way must never be passed to this function.
+ */
+export declare function decodeIdToken(token: string): JsonObject;
+export declare function discoverOidc(issuer: string, fetchImpl: FetchLike): Promise<OAuthEndpoints>;
+export interface AuthorizeUrlOptions {
+    endpoints: OAuthEndpoints;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    /** The S256 challenge; omitted for providers that reject PKCE. */
+    codeChallenge?: string;
+    extra?: Record<string, string>;
+}
+export declare function buildAuthorizeUrl(options: AuthorizeUrlOptions): string;
+/** The PKCE pair: a verifier to keep, a challenge to publish. */
+export declare function pkcePair(verifier: string): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+export interface ExchangeOptions {
+    endpoints: OAuthEndpoints;
+    clientId: string;
+    clientSecret: string;
+    code: string;
+    redirectUri: string;
+    codeVerifier?: string;
+    fetchImpl: FetchLike;
+}
+export declare function exchangeCode(options: ExchangeOptions): Promise<OAuthTokens>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD;;;;;;;GAOG;AAEH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2DAA2D;IAC3D,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,cAAc,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3E;AAED;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,KACf,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAyE1D,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAQ5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAavD;AAWD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,cAAc,CAAC,CA8BzB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAetE;AAED,iEAAiE;AACjE,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAElD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,WAAW,CAAC,CAuCtB"}

package/dist/auth/service.d.ts

@@ -0,0 +1,38 @@
+import type { CmsAuth } from "../types/auth";
+import type { ResolvedCmsConfig } from "../types/config";
+import type { DatabaseAdapter } from "../types/database";
+import type { Tx } from "../types/query";
+import type { BufferedEvent, OutboxEntryMeta } from "../engine/outbox";
+import { type FetchLike } from "./oauth";
+/** The cookie the panel uses. Named here so stage 7 cannot invent a second. */
+export declare const sessionCookieName = "heyo_cms_session";
+/**
+ * API keys announce themselves.
+ *
+ * One `Authorization: Bearer` header carries either a session token or a
+ * machine key, and the prefix is what tells them apart without a database
+ * round trip against both tables.
+ */
+export declare const apiKeyPrefix = "hck_";
+export interface AuthServiceOptions {
+    config: ResolvedCmsConfig;
+    database: () => Promise<DatabaseAdapter>;
+    /** Appends events to the outbox inside the caller's transaction. */
+    emit: (tx: Tx, events: BufferedEvent[], meta: OutboxEntryMeta) => Promise<void>;
+    /** Schedules delivery once the transaction has committed. */
+    deliver: () => void;
+    /** Injectable for tests and for runtimes with a bound fetch. */
+    fetch?: FetchLike;
+}
+/**
+ * Editor authentication and RBAC.
+ *
+ * One implementation, used by the local API today and by the REST routes in
+ * stage 7 — the same reason `cms.api` exists. Everything is a method on this
+ * object rather than a route handler, so a CLI, a seed script and a panel all
+ * get identical behaviour, including the parts that are easy to get wrong:
+ * single-use tokens, hashed secrets, and a second factor that cannot be
+ * skipped by calling a different function.
+ */
+export declare function createAuth(options: AuthServiceOptions): CmsAuth;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAEV,OAAO,EAYR,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAGV,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAO,EAAE,EAAS,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAQL,KAAK,SAAS,EAIf,MAAM,SAAS,CAAC;AAUjB,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,SAAS,CAAC;AAoBnC,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACzC,oEAAoE;IACpE,IAAI,EAAE,CACJ,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,aAAa,EAAE,EACvB,IAAI,EAAE,eAAe,KAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,gEAAgE;IAChE,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CA0qD/D"}

package/dist/auth/totp.d.ts

@@ -0,0 +1,34 @@
+/**
+ * TOTP (RFC 6238), on Web Crypto.
+ *
+ * Six digits, thirty seconds, HMAC-SHA1 — not because SHA-1 is a good hash in
+ * 2026, but because it is what every authenticator app implements, and a
+ * second factor nobody can enrol is not a second factor.
+ */
+/** 160 bits, the size RFC 4226 recommends for the HMAC-SHA1 key. */
+export declare function generateTotpSecret(): string;
+/**
+ * The `otpauth://` URI an authenticator scans.
+ *
+ * The issuer appears twice — as a label prefix and as a parameter — which is
+ * redundant and is also what every app expects.
+ */
+export declare function totpUri(options: {
+    secret: string;
+    account: string;
+    issuer: string;
+}): string;
+export declare function totpCode(secret: string, at?: number): Promise<string>;
+/**
+ * Verifies a code, allowing one step either side.
+ *
+ * The window is for clock drift between the phone and the server, not for
+ * convenience: widening it multiplies the number of codes that are valid at
+ * any moment, which is exactly what the second factor is trying to limit.
+ */
+export declare function verifyTotp(secret: string | null | undefined, code: string, options?: {
+    at?: number;
+    window?: number;
+}): Promise<boolean>;
+export declare function base32Encode(bytes: Uint8Array): string;
+//# sourceMappingURL=totp.d.ts.map

package/dist/auth/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAUT;AAED,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,EAAE,SAAa,GACd,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,OAAO,CAAC,OAAO,CAAC,CAmBlB;AA+BD,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAetD"}

package/dist/auth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `@heyo-sh/heyo-cms/auth`.
+ *
+ * `cmsUsers()` and `oidc()` describe who may sign in; the service behind
+ * `cms.auth` does the signing in. Both live here so a configuration file and
+ * a route handler import from the same place.
+ */
+export * from "./auth/index";
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,cAAc,CAAC"}

package/dist/auth.js

@@ -0,0 +1 @@
+import"./index-6m1kjq9g.js";import{_e}from"./index-sgdnp83t.js";import{Nn,$t,Un,Jn,Qo,cn,be,dn,un}from"./index-2prbs05k.js";import{Pe,pn,we,re,ie}from"./index-p2cqsmvw.js";import{w}from"./index-rw0hze6x.js";import{n}from"./index-x72d1hzh.js";function o(e){if(e.methods.length===0)throw new n("admin.auth.methods","at least one sign-in method is required");for(let[s,t]of[["session",e.session?.expiresIn],["invites",e.invites?.expiresIn],["magicLink",e.magicLink?.expiresIn],["passwordReset",e.passwordReset?.expiresIn],["apiKeys",e.apiKeys?.expiresIn]])if(t)w(t,`admin.auth.${s}.expiresIn`);for(let s of e.apiKeys?.scopes??[])if(!_e(s))throw new n("admin.auth.apiKeys.scopes",`"${s}" is not a scope; use "read", "write", "delete", "*" or "collection:action"`);let i=e.firstUser;if(typeof i==="object"){let s=i.roles;if(s!==void 0&&s.length===0)throw new n("admin.auth.firstUser.roles","the first account needs at least one role")}if(i!==void 0&&i!==!1&&!e.methods.includes("password"))throw new n("admin.auth.firstUser",'the first account signs in with a password; add "password" to methods, or set firstUser: false');let r=e.password?.minLength;if(r!==void 0&&r<8)throw new n("admin.auth.password.minLength","must be at least 8");return{kind:"cms-users",...e}}function a(e){if(!/^https?:\/\//.test(e.issuer))throw new n("admin.auth.sso.issuer","must be an HTTP(S) issuer URL");return{kind:"oidc",...e}}export{dn as apiKeyPrefix,ie as base64url,Nn as builtinProviders,o as cmsUsers,un as createAuth,$t as decodeIdToken,Un as generateTotpSecret,Pe as hashPassword,re as hashToken,a as oidc,we as randomToken,be as sessionCookieName,Qo as totpCode,Jn as totpUri,pn as verifyPassword,cn as verifyTotp};

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function main(argv: string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA8DA,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B1D"}

package/dist/cli.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import"./index-sgdnp83t.js";import"./index-6m1kjq9g.js";import"./index-abfzb1ve.js";import"./index-cv0hpz3d.js";import"./index-g041kfa5.js";import"./index-8x2em6c8.js";import"./index-hpast878.js";import"./index-kc1j3h6z.js";import{an,Dn,qn,Ln}from"./index-vkwzdfte.js";import{Ut,Jt,yn}from"./index-szaq03qq.js";import{Dt,qt,Lt,Ft,Nt}from"./index-rg9tpg3p.js";import"./index-6w10rch0.js";import"./index-91fa1gzf.js";import"./index-2prbs05k.js";import{createRequire as C}from"node:module";var m=C(import.meta.url);import{createReadStream as b,createWriteStream as v}from"node:fs";import{readFile as p,stat as k}from"node:fs/promises";import{isAbsolute as I,resolve as l}from"node:path";import{pathToFileURL as M}from"node:url";import{randomBytes as P}from"node:crypto";var g=`
+  heyo-cms generate [--name <name>]   write a migration for what changed
+  heyo-cms migrate                    apply pending migrations
+  heyo-cms status                     show applied, pending and unplanned changes
+
+  heyo-cms create-admin               create an editor account from a shell
+    --email <address>   required unless HEYO_CMS_ADMIN_EMAIL is set
+    --password <value>  default: generated and printed once
+    --name <name>       display name
+    --roles <a,b>       default: admin
+
+  heyo-cms seed [--file <path>]       run the project's seed module
+
+  heyo-cms export [--out <file>]      write content as NDJSON (default: stdout)
+    --collections <a,b>  default: every collection
+    --globals <a,b>      default: every global
+    --include-trashed    include documents in the trash
+
+  heyo-cms import <file>              read an export back ("-" is stdin)
+    --on-conflict <skip|update|fail>   default: skip
+    --dry-run            parse and report without writing
+
+  heyo-cms telemetry                  print exactly what would be reported
+
+  --config <path>   configuration module (default: ./heyo-cms.config.ts)
+  --dir <path>      migrations directory (default: the one in the config)
+  --env <path>      environment file (default: ./.env, then ./.env.local)
+`;async function _(e){let{command:n,positionals:o,flags:t}=N(e);if(!n||n==="help"||t.has("--help"))return console.log(g),n&&n!=="help"?1:0;await U(t.get("--env"));let s=await j(t.get("--config"));switch(n){case"generate":case"migrate":case"status":return await A(n,s,t);case"create-admin":return await d(n,s,await x(s,t));case"seed":return await d(n,s,await O(s,t));case"export":return await d(n,s,await R(s,t));case"import":return await d(n,s,await W(s,o[1],t));case"telemetry":return await D(s);default:return console.error(`Unknown command: ${n}`),console.log(g),1}}async function A(e,n,o){let t=l(o.get("--dir")??n._config.migrationsDirectory),s=new an(t),a=await n.database();if(e==="generate"){let i=await Dn({adapter:a,store:s,target:n.schema,plugins:n._config.plugins.flatMap((c)=>(c.migrations??[]).map((u)=>({plugin:c.id,id:u.id,steps:u.steps}))),...o.get("--name")?{name:o.get("--name")}:{}});if(i.created){console.log(`Wrote ${i.file}`);for(let c of i.summary)console.log(`  ${c}`)}for(let c of i.plugins??[])console.log(`Wrote ${c.file} (plugin migration)`);if(!i.created&&(i.plugins??[]).length===0)console.log("No schema changes. Nothing to generate.");return await d(e,n,0)}if(e==="migrate"){let i=await qn({adapter:a,store:s});if(i.applied.length===0)return console.log(`Up to date (${i.alreadyApplied} migration(s) already applied).`),await d(e,n,0);for(let c of i.applied)console.log(`Applied ${c}`);return await d(e,n,0)}let r=await Ln({adapter:a,store:s,target:n.schema});console.log(`Applied:  ${r.applied.length}`);for(let i of r.pending)console.log(`  pending  ${i}`);for(let i of r.modified)console.log(`  MODIFIED ${i} (applied, then edited)`);if(r.unplanned.length>0)console.log(`  ${r.unplanned.length} change(s) in the configuration have no migration yet; run "heyo-cms generate".`);return r.pending.length>0||r.modified.length>0||r.unplanned.length>0?1:0}async function x(e,n){let o=n.get("--email")??process.env.HEYO_CMS_ADMIN_EMAIL;if(!o)return console.error("An address is required: heyo-cms create-admin --email you@example.com"),1;let t=n.get("--password")??process.env.HEYO_CMS_ADMIN_PASSWORD,s=t??E(),a=(n.get("--roles")??"admin").split(",").map((c)=>c.trim()).filter((c)=>c.length>0),r=await e.auth.users.byEmail(o);if(r)return console.error(`${o} already has an account (${r.status}). Use the panel, or cms.auth.users.setPassword().`),1;let i=await e.auth.users.create({email:o,password:s,roles:a,status:"active",...n.get("--name")?{name:n.get("--name")}:{}});if(await e.drainEvents(),console.log(`Created ${i.email} with role(s) ${i.roles.join(", ")}.`),!t)console.log(`Password: ${s}`),console.log("This is the only time it is shown.");return console.log(`Sign in at ${e._config.basePath}${e._config.admin.path}.`),0}function E(){return P(24).toString("base64url")}var S=["heyo-cms.seed.ts","heyo-cms.seed.js","seed.ts","src/heyo-cms.seed.ts"];async function O(e,n){let o=n.get("--file")?l(n.get("--file")):await y(S,"seed module"),t=await h(o),s=t.seed??t.default;if(typeof s!=="function")return console.error(`${o} does not export a seed. Add \`export async function seed(cms) { ... }\`.`),1;return await s(e),await e.drainEvents(),console.log(`Seeded from ${o}.`),0}async function R(e,n){let o=n.get("--out"),t=o?F(l(o)):Y(),s=0,a=0;try{for await(let r of Ft(e,{...f(n,"--collections","collections"),...f(n,"--globals","globals"),...n.has("--include-trashed")?{includeTrashed:!0}:{}})){if(r.kind==="document")s+=1;if(r.kind==="global")a+=1;await t.line(Lt(r))}}finally{await t.close()}return console.error(`Exported ${s} document(s) and ${a} global(s).`),0}async function W(e,n,o){if(!n)return console.error('A file is required: heyo-cms import content.ndjson (or "-").'),1;let t=o.get("--on-conflict")??"skip";if(!["skip","update","fail"].includes(t))return console.error(`--on-conflict takes skip, update or fail; got ${t}.`),1;let s={onConflict:t,...o.has("--dry-run")?{dryRun:!0}:{}},a=n==="-"?H():q(l(n)),r=await Nt(e,Dt(qt(a)),s),i=s.dryRun?"Would import":"Imported";if(console.log(`${i} ${r.documents.created} new and ${r.documents.updated} updated document(s), ${r.globals.updated} global(s).`),r.documents.skipped>0)console.log(`Skipped ${r.documents.skipped} document(s).`);for(let c of r.errors)console.error(`  ${c}`);return r.errors.length>0?1:0}async function D(e){let n=Ut(e._config.telemetry),o=Jt("telemetry",e,await w());return console.log(n.enabled?"Telemetry: on":"Telemetry: off"),console.log(`  ${n.reason}`),console.log(""),console.log("  What a command would send, in full:"),console.log(""),console.log(JSON.stringify(o,null,2)),console.log(""),console.log("  Turn it off with any of:"),console.log("    HEYO_TELEMETRY_DISABLED=1"),console.log("    DO_NOT_TRACK=1"),console.log("    telemetry: { enabled: false } in heyo-cms.config.ts"),console.log(""),0}async function d(e,n,o){try{await yn({event:e,cms:n,version:await w(),...n._config.telemetry?{config:n._config.telemetry}:{}})}catch{}return o}function N(e){let n=new Map,o=[];for(let t=0;t<e.length;t+=1){let s=e[t];if(!s.startsWith("--")){o.push(s);continue}let a=e[t+1];if(a!==void 0&&!a.startsWith("--"))n.set(s,a),t+=1;else n.set(s,"true")}return{command:o[0],positionals:o,flags:n}}function f(e,n,o){let t=e.get(n);if(!t||t==="true")return{};return{[o]:t.split(",").map((s)=>s.trim()).filter((s)=>s.length>0)}}var T=["heyo-cms.config.ts","heyo-cms.config.js","heyo-cms.config.mjs","src/heyo-cms.config.ts","app/heyo-cms.config.ts"];async function j(e){let n=e?l(e):await y(T,"configuration"),o=await h(n),t=o.cms??o.default;if(!L(t))throw Error(`${n} does not export a CMS. Add \`export const cms = heyoCms({ ... })\`.`);return t}async function h(e){return await(I(e)?import(M(e).href):import(e))}async function y(e,n){for(let o of e){let t=l(o);try{return await k(t),t}catch{}}throw Error(`No ${n} found. Looked for ${e.join(", ")}. Use --config or --file.`)}function L(e){return typeof e==="object"&&e!==null&&"_config"in e&&"schema"in e&&typeof e.database==="function"}async function U(e){let n=e?[l(e)]:[l(".env"),l(".env.local")];for(let o of n){let t;try{t=await p(o,"utf8")}catch{if(e)throw Error(`No environment file at ${o}.`);continue}for(let s of t.split(`
+`)){let a=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(s);if(!a)continue;let[,r,i]=a;if(process.env[r]!==void 0)continue;let c=i.trim(),u=/^(["'])([\s\S]*)\1$/.exec(c);process.env[r]=u?u[2]:c.split(" #")[0].trim()}}}async function w(){try{let e=await p(new URL("../package.json",import.meta.url),"utf8");return JSON.parse(e).version??"0.0.0"}catch{return"0.0.0"}}function F(e){let n=v(e,{encoding:"utf8"});return{line:(o)=>new Promise((t,s)=>{n.write(o,(a)=>a?s(a):t())}),close:()=>new Promise((o)=>n.end(()=>o()))}}function Y(){return{line:(e)=>new Promise((n,o)=>{process.stdout.write(e,(t)=>t?o(t):n())}),close:async()=>{}}}async function*q(e){let n=b(e,{encoding:"utf8"});for await(let o of n)yield o}async function*H(){process.stdin.setEncoding("utf8");for await(let e of process.stdin)yield e}if(m.main==m.module)_(process.argv.slice(2)).then((e)=>{process.exitCode=e}).catch((e)=>{console.error(e instanceof Error?e.message:String(e)),process.exitCode=1});export{_ as main};

package/dist/client/index.d.ts

@@ -0,0 +1,51 @@
+import type { CmsPlugin } from "../types/plugin";
+import type { CmsClient, PluginExtensions } from "./types";
+/**
+ * The typed client.
+ *
+ * The public entry point picks up the project's registered CMS type, so
+ * `heyoCmsClient()` is typed without importing server configuration into the
+ * browser bundle. `heyoCmsClient<typeof cms>()` remains available for a
+ * project with more than one CMS. The methods
+ * mirror `cms.api` exactly, because the routes they call are three lines
+ * around `cms.api`: code written against the local API moves to the client by
+ * changing the object it is called on.
+ *
+ * What it is not: an ORM, a cache or a state manager. It is `fetch` with the
+ * URL building, the error shape and the 204 convention taken care of, and it
+ * is tiny on purpose — this ships to browsers.
+ */
+export interface CmsClientOptions<TPlugins extends readonly CmsPlugin<unknown>[] = []> {
+    /**
+     * Where the handler is mounted.
+     *
+     * Defaults to the same-origin `/api/heyo-cms` mount in a browser. Set this
+     * for a custom mount or a CMS on another origin, e.g.
+     * `https://cms.acme.dev/api/heyo-cms`.
+     */
+    baseUrl?: string;
+    /**
+     * A session token or an API key.
+     *
+     * A function is resolved per request, which is what makes a rotating key or
+     * a token read out of a cookie store work without rebuilding the client.
+     * Omit it in a browser: the session cookie is sent automatically.
+     */
+    token?: string | (() => string | null | undefined | Promise<string | null | undefined>);
+    headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);
+    /** Injectable so a test, a Worker or a framework's own `fetch` can be used. */
+    fetch?: typeof fetch;
+    /** Defaults to `same-origin`, which is what a cookie session needs. */
+    credentials?: RequestCredentials;
+    /**
+     * The plugins whose client extensions should be installed.
+     *
+     * Passed rather than discovered: the configuration lives on the server and
+     * the client is a browser bundle, so the only way the extension types can
+     * reach it is through this list.
+     */
+    plugins?: TPlugins;
+}
+export declare function heyoCmsClient<TCms = import("../types/instance").CmsInstance, const TPlugins extends readonly CmsPlugin<unknown>[] = []>(options?: CmsClientOptions<TPlugins>): CmsClient<TCms> & PluginExtensions<TPlugins>;
+export type * from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EASV,SAAS,EACT,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,gBAAgB,CAC/B,QAAQ,SAAS,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtB,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,uEAAuE;IACvE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC;CACpB;AAED,wBAAgB,aAAa,CAC3B,IAAI,GAAG,OAAO,mBAAmB,EAAE,WAAW,EAC9C,KAAK,CAAC,QAAQ,SAAS,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAEzD,OAAO,GAAE,gBAAgB,CAAC,QAAQ,CAAM,GACvC,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAmO9C;AA4TD,mBAAmB,SAAS,CAAC"}