@infuro/cms-core 1.0.52 → 1.0.54

package/dist/index.js

@@ -1,6 +1,6 @@
 export { emitOrderNotificationTrigger, fireOrderNotificationTrigger } from './chunk-MXIWUFBP.js';
-import { checkMultiVendorEnabled, loadUserVendorContext, getPublicSettingsGroup, BlogGeneratorService } from './chunk-UO5Q5RXB.js';
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging } from './chunk-UO5Q5RXB.js';
+import { checkMultiVendorEnabled, loadUserVendorContext, getPublicSettingsGroup, BlogGeneratorService } from './chunk-PDA4L2LS.js';
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, countRecentOtpSends, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createOtpChallenge, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, generateNumericOtp, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hashOtpCode, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizePhoneE164, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, queueSms, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, registerSmsQueueProcessor, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, verifyAndConsumeOtpChallenge, verifyOtpCodeHash, whatsappPlugin, wrapGetCmsWithMessaging } from './chunk-PDA4L2LS.js';
 import { PgBossService } from './chunk-GO7PPYNU.js';
 export { JOB_RUNNER_QUEUE, PgBossService } from './chunk-GO7PPYNU.js';
 export { deductInventoryForConfirmedOrder, mergeInventoryLines, orderInventorySnapshotFromRow, orderStatusHoldsStock, reconcileOrderInventoryBetweenSnapshots, restoreInventoryForCancelledOrder, validateInventoryForConfirmedOrderLines, validateInventoryForOrderBecomingConfirmed } from './chunk-3K5AIEIZ.js';
@@ -1046,6 +1046,76 @@ function paymentPlugin(config) {
 __name(paymentPlugin, "paymentPlugin");
 
 // src/plugins/storage/s3.ts
+var LOG = "[s3]";
+function serializeS3Error(err) {
+  if (!err || typeof err !== "object") {
+    return {
+      error: String(err)
+    };
+  }
+  const e = err;
+  return {
+    name: e.name,
+    message: e.message,
+    code: e.Code ?? e.code,
+    httpStatus: e.$metadata?.httpStatusCode,
+    requestId: e.$metadata?.requestId,
+    extendedRequestId: e.$metadata?.extendedRequestId,
+    cfId: e.$metadata?.cfId
+  };
+}
+__name(serializeS3Error, "serializeS3Error");
+function publicObjectUrl(config, fullKey) {
+  if (config.baseUrl) {
+    return `${config.baseUrl.replace(/\/$/, "")}/${fullKey}`;
+  }
+  return `https://s3.${config.region}.amazonaws.com/${config.bucket}/${fullKey}`;
+}
+__name(publicObjectUrl, "publicObjectUrl");
+async function probePublicUrl(url) {
+  try {
+    const head = await fetch(url, {
+      method: "HEAD",
+      redirect: "manual"
+    });
+    const headInfo = {
+      url,
+      status: head.status,
+      ok: head.ok,
+      contentType: head.headers.get("content-type"),
+      location: head.headers.get("location")
+    };
+    if (head.ok) {
+      console.info(LOG, "public URL reachable (HEAD)", headInfo);
+      return;
+    }
+    const getRes = await fetch(url, {
+      method: "GET",
+      headers: {
+        Range: "bytes=0-0"
+      },
+      redirect: "manual"
+    });
+    let bodySnippet = "";
+    try {
+      bodySnippet = (await getRes.text()).slice(0, 400);
+    } catch {
+    }
+    console.error(LOG, "public URL not readable \u2014 admin images will not display", {
+      ...headInfo,
+      getStatus: getRes.status,
+      getOk: getRes.ok,
+      getContentType: getRes.headers.get("content-type"),
+      bodySnippet
+    });
+  } catch (err) {
+    console.error(LOG, "public URL probe failed", {
+      url,
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+__name(probePublicUrl, "probePublicUrl");
 function getS3Storage(config) {
   const prefix = (config.prefix ?? "uploads").replace(/\/$/, "");
   const keyPrefix = prefix ? `${prefix}/` : "";
@@ -1060,16 +1130,38 @@ function getS3Storage(config) {
         }
       });
       const fullKey = keyPrefix + key.replace(/^\/+/, "");
-      await client.send(new PutObjectCommand({
-        Bucket: config.bucket,
-        Key: fullKey,
-        Body: buffer,
-        ContentType: contentType
-      }));
-      if (config.baseUrl) {
-        return `${config.baseUrl.replace(/\/$/, "")}/${fullKey}`;
+      const started = Date.now();
+      try {
+        await client.send(new PutObjectCommand({
+          Bucket: config.bucket,
+          Key: fullKey,
+          Body: buffer,
+          ContentType: contentType
+        }));
+      } catch (err) {
+        console.error(LOG, "PutObject failed", {
+          bucket: config.bucket,
+          region: config.region,
+          key: fullKey,
+          contentType,
+          bytes: buffer.length,
+          ...serializeS3Error(err)
+        });
+        throw err;
       }
-      return `https://s3.${config.region}.amazonaws.com/${config.bucket}/${fullKey}`;
+      const url = publicObjectUrl(config, fullKey);
+      console.info(LOG, "PutObject ok", {
+        bucket: config.bucket,
+        region: config.region,
+        key: fullKey,
+        contentType,
+        bytes: buffer.length,
+        ms: Date.now() - started,
+        url,
+        hasCustomBaseUrl: Boolean(config.baseUrl)
+      });
+      void probePublicUrl(url);
+      return url;
     }
   };
 }
@@ -1086,8 +1178,29 @@ function s3StoragePlugin(config) {
       const baseUrl = config.baseUrl ?? context.config.S3_MEDIA_URL ?? context.config.S3_CUSTOM_DOMAIN;
       const resolvedBaseUrl = typeof baseUrl === "string" && baseUrl ? baseUrl.startsWith("http") ? baseUrl : `https://${baseUrl}` : void 0;
       if (!region || !accessKeyId || !secretAccessKey || !bucket) {
+        console.error(LOG, "plugin init missing config", {
+          hasRegion: Boolean(region),
+          hasAccessKeyId: Boolean(accessKeyId),
+          hasSecretAccessKey: Boolean(secretAccessKey),
+          hasBucket: Boolean(bucket),
+          hasBaseUrl: Boolean(resolvedBaseUrl)
+        });
         throw new Error("S3 storage plugin: missing region, accessKeyId, secretAccessKey or bucket");
       }
+      let baseUrlHost = null;
+      try {
+        baseUrlHost = resolvedBaseUrl ? new URL(resolvedBaseUrl).host : null;
+      } catch {
+        baseUrlHost = resolvedBaseUrl ?? null;
+      }
+      console.info(LOG, "plugin ready", {
+        region,
+        bucket,
+        prefix: config.prefix ?? "uploads",
+        hasBaseUrl: Boolean(resolvedBaseUrl),
+        baseUrlHost,
+        accessKeyIdLast4: accessKeyId.slice(-4)
+      });
       return getS3Storage({
         region,
         accessKeyId,
@@ -1121,7 +1234,14 @@ function getLocalStorage(config) {
         recursive: true
       });
       await fs.writeFile(filePath, buffer);
-      return `${publicPath.replace(/\/$/, "")}/${fileName}`;
+      const url = `${publicPath.replace(/\/$/, "")}/${fileName}`;
+      console.info("[storage:local] wrote file", {
+        dir: fullDir,
+        key: fileName,
+        bytes: buffer.length,
+        url
+      });
+      return url;
     }
   };
 }
@@ -1132,6 +1252,9 @@ function localStoragePlugin(config = {}) {
     version: "1.0.0",
     async init(context) {
       const dir = config.dir ?? context.config.UPLOAD_DIR ?? "public/uploads";
+      console.info("[storage:local] plugin ready", {
+        dir
+      });
       return getLocalStorage({
         ...config,
         dir

package/dist/middleware.d.cts

@@ -0,0 +1,50 @@
+interface CmsMiddlewareRequest {
+    nextUrl: {
+        pathname: string;
+    };
+    url: string;
+    method: string;
+    cookies: {
+        get: (name: string) => {
+            value?: string;
+        } | undefined;
+    };
+    /**
+     * Full Next.js request (e.g. `NextRequest`). When provided, session is resolved via
+     * cookie presence or `getToken()`.
+     */
+    req?: unknown;
+}
+interface CmsMiddlewareConfig {
+    publicAdminPaths?: string[];
+    publicApiPaths?: string[];
+    /** path -> allowed methods */
+    publicApiMethods?: Record<string, string[]>;
+    signInPath?: string;
+    /** @deprecated Prefer passing `req` on the request; used only when `req` is omitted. */
+    getSessionToken?: (request: CmsMiddlewareRequest) => string | undefined;
+    secret?: string;
+}
+/** Default public API paths (no auth). Sites should extend this with their own routes. */
+declare const defaultPublicApiMethods: Record<string, string[]>;
+/**
+ * Returns middleware logic. Use from Next.js middleware:
+ *   import { createCmsMiddleware } from '@infuro/cms-core';
+ *   export async function middleware(request: NextRequest) {
+ *     const result = await cmsMiddleware({ ...request fields, req: request });
+ *     ...
+ *   }
+ *   export const config = { matcher: ['/admin/:path*', '/api/:path*'] };
+ */
+declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: CmsMiddlewareRequest) => Promise<{
+    type: "next";
+} | {
+    type: "redirect";
+    url: string;
+} | {
+    type: "json";
+    status: number;
+    body: unknown;
+}>;
+
+export { type CmsMiddlewareConfig, type CmsMiddlewareRequest, createCmsMiddleware, defaultPublicApiMethods };

package/dist/middleware.d.ts

@@ -0,0 +1,50 @@
+interface CmsMiddlewareRequest {
+    nextUrl: {
+        pathname: string;
+    };
+    url: string;
+    method: string;
+    cookies: {
+        get: (name: string) => {
+            value?: string;
+        } | undefined;
+    };
+    /**
+     * Full Next.js request (e.g. `NextRequest`). When provided, session is resolved via
+     * cookie presence or `getToken()`.
+     */
+    req?: unknown;
+}
+interface CmsMiddlewareConfig {
+    publicAdminPaths?: string[];
+    publicApiPaths?: string[];
+    /** path -> allowed methods */
+    publicApiMethods?: Record<string, string[]>;
+    signInPath?: string;
+    /** @deprecated Prefer passing `req` on the request; used only when `req` is omitted. */
+    getSessionToken?: (request: CmsMiddlewareRequest) => string | undefined;
+    secret?: string;
+}
+/** Default public API paths (no auth). Sites should extend this with their own routes. */
+declare const defaultPublicApiMethods: Record<string, string[]>;
+/**
+ * Returns middleware logic. Use from Next.js middleware:
+ *   import { createCmsMiddleware } from '@infuro/cms-core';
+ *   export async function middleware(request: NextRequest) {
+ *     const result = await cmsMiddleware({ ...request fields, req: request });
+ *     ...
+ *   }
+ *   export const config = { matcher: ['/admin/:path*', '/api/:path*'] };
+ */
+declare function createCmsMiddleware(config?: CmsMiddlewareConfig): (request: CmsMiddlewareRequest) => Promise<{
+    type: "next";
+} | {
+    type: "redirect";
+    url: string;
+} | {
+    type: "json";
+    status: number;
+    body: unknown;
+}>;
+
+export { type CmsMiddlewareConfig, type CmsMiddlewareRequest, createCmsMiddleware, defaultPublicApiMethods };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infuro/cms-core",
-  "version": "1.0.52",
+  "version": "1.0.54",
   "private": false,
   "type": "module",
   "main": "./dist/index.cjs",