@krantho/api 0.0.0-stage → 1.0.0

package/dist/assistant/tools/support.js

@@ -0,0 +1,63 @@
+import { canGetContent } from '@krantho/persistence';
+import { changedByFromAuth } from '../../permissions.js';
+import { signPendingAction } from '../pending-action.js';
+/** `changedBy` of an assistant write: the user's own, marked as made through the assistant */
+export function assistantChangedBy(user) {
+    return `${changedByFromAuth(user)} via assistant`;
+}
+/** The locale a tool acts on: the one asked for, else the site's default */
+export function localeOf(ctx, locale) {
+    return locale ?? ctx.config.site.defaultLocale;
+}
+/** The current version of exactly this document in exactly this locale — never a fallback */
+export async function exactDocument(ctx, collection, slug, locale) {
+    if (!canGetContent(ctx.adapter))
+        return null;
+    return ctx.adapter.getContent(collection, slug, locale);
+}
+/** A document's reference, with its version */
+export function refOf(doc) {
+    const { collection, slug, locale, version } = doc.meta;
+    return { collection, slug, locale, version };
+}
+/** `collection/slug` */
+export function pathOf(ref) {
+    return `${ref.collection}/${ref.slug}`;
+}
+/** A failed tool call: the error for the model, and what Studio shows */
+export function failure(error, activity = {}) {
+    return {
+        result: { ok: false, error },
+        activity: {
+            status: 'failed',
+            summary: activity.summary ?? error,
+            documents: activity.documents ?? [],
+        },
+    };
+}
+/**
+ * A pending action: the signed token and what it does go to Studio in the
+ * activity only; the model is told a proposal awaits the user, without the token.
+ */
+export function proposal(run, action, view, activity) {
+    const { ctx } = run;
+    const secret = ctx.config.auth.jwtSecret;
+    if (!secret || !ctx.auth)
+        throw new Error('Proposals need a signed-in user and a signing secret');
+    const signed = signPendingAction(action, ctx.auth.id, secret, ctx.config.assistant.confirmTtlSec);
+    return {
+        result: {
+            ok: true,
+            pending: true,
+            awaiting: 'user confirmation in the chat',
+            note: 'Nothing is written, saved or published until the user confirms.',
+            what: view.title,
+        },
+        activity: {
+            ...activity,
+            status: 'pending',
+            pending: { token: signed.token, kind: action.kind, ...view, expiresAt: signed.expiresAt },
+        },
+    };
+}
+//# sourceMappingURL=support.js.map

package/dist/assistant/tools/support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.js","sourceRoot":"","sources":["../../../src/assistant/tools/support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAsB,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAI5E,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,IAAmC;IACpE,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAA;AACnD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,GAAe,EAAE,MAA0B;IAClE,OAAO,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;AAChD,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAe,EACf,UAAkB,EAClB,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,KAAK,CAAC,GAAoB;IACxC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IACtD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC9C,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,MAAM,CAAC,GAAyC;IAC9D,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,OAAO,CACrB,KAAa,EACb,WAAoF,EAAE;IAEtF,OAAO;QACL,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QAC5B,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,KAAK;YAClC,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,EAAE;SACpC;KACF,CAAA;AACH,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,GAAmB,EACnB,MAAqB,EACrB,IAAkB,EAClB,QAAuE;IAEvE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;IACnB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACjG,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACjG,OAAO;QACL,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,+BAA+B;YACzC,IAAI,EAAE,iEAAiE;YACvE,IAAI,EAAE,IAAI,CAAC,KAAK;SACjB;QACD,QAAQ,EAAE;YACR,GAAG,QAAQ;YACX,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;SAC1F;KACF,CAAA;AACH,CAAC"}

package/dist/assistant/untrusted.d.ts

@@ -0,0 +1,15 @@
+/** Frames document text for the model */
+export interface Framer {
+    /** `text` inside an `<untrusted-content>` frame that names where it came from */
+    frame(source: string, text: string): string;
+}
+/**
+ * A framer for one chat request. Its frames carry a random nonce the model has
+ * never seen in document text, so a document cannot close its own frame; the
+ * tag name is also rewritten wherever it appears inside the text. `source` is
+ * built by the server (collection, slug, version), never from document text.
+ */
+export declare function createFramer(): Framer;
+/** The first `max` characters of `text`, never splitting a surrogate pair */
+export declare function truncate(text: string, max: number): string;
+//# sourceMappingURL=untrusted.d.ts.map

package/dist/assistant/untrusted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted.d.ts","sourceRoot":"","sources":["../../src/assistant/untrusted.ts"],"names":[],"mappings":"AAEA,yCAAyC;AACzC,MAAM,WAAW,MAAM;IACrB,iFAAiF;IACjF,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;CAC5C;AAKD;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CASrC;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D"}

package/dist/assistant/untrusted.js

@@ -0,0 +1,27 @@
+import { randomUUID } from 'node:crypto';
+/** Any spelling of the frame's tag name; rewritten inside framed text */
+const TAG_NAME = /untrusted-content/gi;
+/**
+ * A framer for one chat request. Its frames carry a random nonce the model has
+ * never seen in document text, so a document cannot close its own frame; the
+ * tag name is also rewritten wherever it appears inside the text. `source` is
+ * built by the server (collection, slug, version), never from document text.
+ */
+export function createFramer() {
+    const nonce = randomUUID().replace(/-/g, '').slice(0, 16);
+    return {
+        frame(source, text) {
+            const safeSource = source.replace(TAG_NAME, 'untrusted_content').replace(/["<>\r\n]/g, ' ');
+            const safeText = text.replace(TAG_NAME, 'untrusted_content');
+            return `<untrusted-content id="${nonce}" source="${safeSource}">\n${safeText}\n</untrusted-content id="${nonce}">`;
+        },
+    };
+}
+/** The first `max` characters of `text`, never splitting a surrogate pair */
+export function truncate(text, max) {
+    if (text.length <= max)
+        return text;
+    const end = /[\uD800-\uDBFF]/.test(text.charAt(max - 1)) ? max - 1 : max;
+    return text.slice(0, Math.max(0, end));
+}
+//# sourceMappingURL=untrusted.js.map

package/dist/assistant/untrusted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted.js","sourceRoot":"","sources":["../../src/assistant/untrusted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAQxC,yEAAyE;AACzE,MAAM,QAAQ,GAAG,qBAAqB,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzD,OAAO;QACL,KAAK,CAAC,MAAM,EAAE,IAAI;YAChB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;YAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;YAC5D,OAAO,0BAA0B,KAAK,aAAa,UAAU,OAAO,QAAQ,6BAA6B,KAAK,IAAI,CAAA;QACpH,CAAC;KACF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAW;IAChD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACxE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;AACxC,CAAC"}

package/dist/assistant/write-policy.d.ts

@@ -0,0 +1,20 @@
+import type { DocumentChange, DocumentRef } from './protocol.js';
+/** Whether a write happens now or waits for the user's confirmation */
+export type WriteDecision = 'write' | 'confirm';
+/** `collection/slug@locale` */
+export declare function documentKey(ref: DocumentRef): string;
+/**
+ * The write policy of one chat request: one document may be written at once —
+ * a new one, or empty values filled in an existing one — and a document created
+ * in this request may be written again. Everything else is shown first: text
+ * that replaces or removes a value, and any further document.
+ */
+export declare class WritePolicy {
+    private readonly written;
+    private readonly created;
+    /** Decide for one document's change in this request */
+    decide(change: DocumentChange): WriteDecision;
+    /** Record an immediate write */
+    recordWrite(change: DocumentChange): void;
+}
+//# sourceMappingURL=write-policy.d.ts.map

package/dist/assistant/write-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-policy.d.ts","sourceRoot":"","sources":["../../src/assistant/write-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhE,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,CAAA;AAE/C,+BAA+B;AAC/B,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C,uDAAuD;IACvD,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa;IAO7C,gCAAgC;IAChC,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;CAK1C"}

package/dist/assistant/write-policy.js

@@ -0,0 +1,32 @@
+import { isOverwrite } from './document-change.js';
+/** `collection/slug@locale` */
+export function documentKey(ref) {
+    return `${ref.collection}/${ref.slug}@${ref.locale}`;
+}
+/**
+ * The write policy of one chat request: one document may be written at once —
+ * a new one, or empty values filled in an existing one — and a document created
+ * in this request may be written again. Everything else is shown first: text
+ * that replaces or removes a value, and any further document.
+ */
+export class WritePolicy {
+    written = new Set();
+    created = new Set();
+    /** Decide for one document's change in this request */
+    decide(change) {
+        const key = documentKey(change.ref);
+        if (this.created.has(key))
+            return 'write';
+        if (this.written.size > 0 && !this.written.has(key))
+            return 'confirm';
+        return isOverwrite(change) ? 'confirm' : 'write';
+    }
+    /** Record an immediate write */
+    recordWrite(change) {
+        const key = documentKey(change.ref);
+        this.written.add(key);
+        if (change.baseVersion === 0)
+            this.created.add(key);
+    }
+}
+//# sourceMappingURL=write-policy.js.map

package/dist/assistant/write-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-policy.js","sourceRoot":"","sources":["../../src/assistant/write-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAMlD,+BAA+B;AAC/B,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACL,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IAC3B,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IAE5C,uDAAuD;IACvD,MAAM,CAAC,MAAsB;QAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAA;QACzC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QACrE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IAClD,CAAC;IAED,gCAAgC;IAChC,WAAW,CAAC,MAAsB;QAChC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,IAAI,MAAM,CAAC,WAAW,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACrD,CAAC;CACF"}

package/dist/auth-tokens.d.ts

@@ -0,0 +1,31 @@
+import type { AuthSection } from '@krantho/config';
+import type { IAuthAdapter, Role } from '@krantho/persistence';
+interface TokenUser {
+    id: string;
+    email: string;
+    name: string;
+    roles: Role[];
+}
+interface IssueTokenPairOptions {
+    user: TokenUser;
+    /** The effective signing secret (`config.auth.jwtSecret`) */
+    jwtSecret: string;
+    /** The resolved auth section — session TTLs, cookie names and flags */
+    auth: AuthSection;
+    headers: Record<string, string> | undefined;
+    authAdapter: IAuthAdapter | undefined;
+}
+interface IssuedTokens {
+    /** Set-Cookie values — access + optional refresh, one entry per cookie (RFC 6265). */
+    cookies: string[];
+}
+/**
+ * Issue JWT access token + refresh token pair, returning one Set-Cookie value
+ * per cookie (access + optional refresh). Shared by auth-login, auth-callback,
+ * and auth-refresh handlers.
+ */
+export declare function issueTokenPair(options: IssueTokenPairOptions): Promise<IssuedTokens>;
+/** Set-Cookie values that clear both session cookies */
+export declare function clearSessionCookies(auth: AuthSection, headers: Record<string, string> | undefined): string[];
+export {};
+//# sourceMappingURL=auth-tokens.d.ts.map

package/dist/auth-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tokens.d.ts","sourceRoot":"","sources":["../src/auth-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAI9D,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,IAAI,EAAE,CAAA;CACd;AAED,UAAU,qBAAqB;IAC7B,IAAI,EAAE,SAAS,CAAA;IACf,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IAC3C,WAAW,EAAE,YAAY,GAAG,SAAS,CAAA;CACtC;AAED,UAAU,YAAY;IACpB,sFAAsF;IACtF,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAqC1F;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,MAAM,EAAE,CAOV"}

package/dist/auth-tokens.js

@@ -0,0 +1,35 @@
+import { accessCookieName, buildCookie, isSecureRequest, refreshCookieName } from './cookies.js';
+import { generateRefreshToken, hashRefreshToken, signJwt } from './jwt.js';
+/**
+ * Issue JWT access token + refresh token pair, returning one Set-Cookie value
+ * per cookie (access + optional refresh). Shared by auth-login, auth-callback,
+ * and auth-refresh handlers.
+ */
+export async function issueTokenPair(options) {
+    const { user, jwtSecret, auth, headers, authAdapter } = options;
+    const { accessTtlSec, refreshTtlSec, sameSite } = auth.session;
+    const accessToken = signJwt({ sub: user.id, email: user.email, name: user.name, roles: user.roles }, jwtSecret, accessTtlSec);
+    const isSecure = isSecureRequest(headers, auth);
+    const accessCookie = buildCookie(accessCookieName(auth.session), accessToken, accessTtlSec, isSecure, sameSite);
+    let refreshCookie = '';
+    if (authAdapter) {
+        const refreshToken = generateRefreshToken();
+        const refreshHash = hashRefreshToken(refreshToken, jwtSecret);
+        const expiresAt = new Date(Date.now() + refreshTtlSec * 1000).toISOString();
+        await authAdapter.createRefreshToken(user.id, refreshHash, expiresAt);
+        refreshCookie = buildCookie(refreshCookieName(auth.session), refreshToken, refreshTtlSec, isSecure, sameSite);
+    }
+    return {
+        cookies: refreshCookie ? [accessCookie, refreshCookie] : [accessCookie],
+    };
+}
+/** Set-Cookie values that clear both session cookies */
+export function clearSessionCookies(auth, headers) {
+    const isSecure = isSecureRequest(headers, auth);
+    const { sameSite } = auth.session;
+    return [
+        buildCookie(accessCookieName(auth.session), '', 0, isSecure, sameSite),
+        buildCookie(refreshCookieName(auth.session), '', 0, isSecure, sameSite),
+    ];
+}
+//# sourceMappingURL=auth-tokens.js.map

package/dist/auth-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tokens.js","sourceRoot":"","sources":["../src/auth-tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAwB1E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC/D,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;IAE9D,MAAM,WAAW,GAAG,OAAO,CACzB,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACvE,SAAS,EACT,YAAY,CACb,CAAA;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC/C,MAAM,YAAY,GAAG,WAAW,CAC9B,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,QAAQ,CACT,CAAA;IAED,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAA;QAC3C,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3E,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;QACrE,aAAa,GAAG,WAAW,CACzB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAC/B,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,CACT,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;KACxE,CAAA;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,mBAAmB,CACjC,IAAiB,EACjB,OAA2C;IAE3C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;IACjC,OAAO;QACL,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACtE,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACxE,CAAA;AACH,CAAC"}

package/dist/content-change.d.ts

@@ -0,0 +1,16 @@
+import type { ContentChange, ContentChangeListener, IContentEngine } from '@krantho/core';
+import type { ApiContext } from './types.js';
+/**
+ * Deliver committed writes' changes: clear the content engine's cache once, so
+ * no later read in this process sees data from before the writes, then run
+ * every listener for each change, awaited. A failing listener is logged and
+ * never fails the write.
+ */
+export declare function deliverChanges(engine: IContentEngine, listeners: readonly ContentChangeListener[] | undefined, changes: readonly ContentChange[]): Promise<void>;
+/** Deliver one committed write's change (see {@link deliverChanges}) */
+export declare function deliverChange(engine: IContentEngine, listeners: readonly ContentChangeListener[] | undefined, change: ContentChange): Promise<void>;
+/** Announce committed writes from a handler, inside the request that made them */
+export declare function announceChanges(ctx: ApiContext, changes: readonly ContentChange[]): Promise<void>;
+/** Announce one committed write from a handler, inside the request that made it */
+export declare function announceChange(ctx: ApiContext, change: ContentChange): Promise<void>;
+//# sourceMappingURL=content-change.d.ts.map

package/dist/content-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-change.d.ts","sourceRoot":"","sources":["../src/content-change.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,SAAS,qBAAqB,EAAE,GAAG,SAAS,EACvD,OAAO,EAAE,SAAS,aAAa,EAAE,GAChC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAC3B,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,SAAS,qBAAqB,EAAE,GAAG,SAAS,EACvD,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjG;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF"}

package/dist/content-change.js

@@ -0,0 +1,34 @@
+/**
+ * Deliver committed writes' changes: clear the content engine's cache once, so
+ * no later read in this process sees data from before the writes, then run
+ * every listener for each change, awaited. A failing listener is logged and
+ * never fails the write.
+ */
+export async function deliverChanges(engine, listeners, changes) {
+    if (changes.length === 0)
+        return;
+    engine.clearCache();
+    for (const change of changes) {
+        for (const listener of listeners ?? []) {
+            try {
+                await listener(change);
+            }
+            catch (err) {
+                console.warn('[krantho] content change listener failed:', err);
+            }
+        }
+    }
+}
+/** Deliver one committed write's change (see {@link deliverChanges}) */
+export function deliverChange(engine, listeners, change) {
+    return deliverChanges(engine, listeners, [change]);
+}
+/** Announce committed writes from a handler, inside the request that made them */
+export function announceChanges(ctx, changes) {
+    return deliverChanges(ctx.engine, ctx.changeListeners, changes);
+}
+/** Announce one committed write from a handler, inside the request that made it */
+export function announceChange(ctx, change) {
+    return announceChanges(ctx, [change]);
+}
+//# sourceMappingURL=content-change.js.map

package/dist/content-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-change.js","sourceRoot":"","sources":["../src/content-change.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,SAAuD,EACvD,OAAiC;IAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAChC,MAAM,CAAC,UAAU,EAAE,CAAA;IACnB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAC3B,MAAsB,EACtB,SAAuD,EACvD,MAAqB;IAErB,OAAO,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,OAAiC;IAChF,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;AACjE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,MAAqB;IACnE,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;AACvC,CAAC"}

package/dist/content-locks.d.ts

@@ -0,0 +1,27 @@
+import type { ApiContext, ApiResponse } from './types.js';
+/** An edit lock someone else holds on a document */
+export interface HeldLock {
+    lockedBy: string;
+    expiresAt: string;
+}
+/** One document, addressed by collection, slug and locale (the site's default locale when absent) */
+export interface LockTarget {
+    collection: string;
+    slug: string;
+    locale?: string | undefined;
+}
+/** Who the signed-in caller is to the lock table */
+export declare function lockOwner(ctx: ApiContext): string;
+/**
+ * The unexpired edit lock on a document held by someone other than the
+ * signed-in user, or null when the document is free or the lock is theirs.
+ */
+export declare function lockHolder(ctx: ApiContext, target: LockTarget): Promise<HeldLock | null>;
+/**
+ * 423 when someone else holds the document's edit lock, else null: saving,
+ * publishing, unpublishing, restoring and deleting wait until the lock is
+ * released or expires. The holder is named in `lockedBy`, never in `error` —
+ * the assistant passes an error's text on to its model provider.
+ */
+export declare function lockedByOther(ctx: ApiContext, target: LockTarget): Promise<ApiResponse | null>;
+//# sourceMappingURL=content-locks.d.ts.map

package/dist/content-locks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-locks.d.ts","sourceRoot":"","sources":["../src/content-locks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAEzD,oDAAoD;AACpD,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qGAAqG;AACrG,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B;AAED,oDAAoD;AACpD,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAEjD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAO9F;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAW7B"}

package/dist/content-locks.js

@@ -0,0 +1,40 @@
+import { changedByFromAuth } from './permissions.js';
+/** Who the signed-in caller is to the lock table */
+export function lockOwner(ctx) {
+    return changedByFromAuth(ctx.auth);
+}
+/**
+ * The unexpired edit lock on a document held by someone other than the
+ * signed-in user, or null when the document is free or the lock is theirs.
+ */
+export async function lockHolder(ctx, target) {
+    const locale = target.locale ?? ctx.config.site.defaultLocale;
+    const lock = await ctx.lockAdapter?.getLock(target.collection, target.slug, locale);
+    if (!lock)
+        return null;
+    if (new Date(lock.expiresAt).getTime() <= Date.now())
+        return null;
+    if (lock.lockedBy === lockOwner(ctx))
+        return null;
+    return { lockedBy: lock.lockedBy, expiresAt: lock.expiresAt };
+}
+/**
+ * 423 when someone else holds the document's edit lock, else null: saving,
+ * publishing, unpublishing, restoring and deleting wait until the lock is
+ * released or expires. The holder is named in `lockedBy`, never in `error` —
+ * the assistant passes an error's text on to its model provider.
+ */
+export async function lockedByOther(ctx, target) {
+    const held = await lockHolder(ctx, target);
+    if (!held)
+        return null;
+    return {
+        status: 423,
+        body: {
+            error: `${target.collection}/${target.slug} is being edited by another user`,
+            lockedBy: held.lockedBy,
+            expiresAt: held.expiresAt,
+        },
+    };
+}
+//# sourceMappingURL=content-locks.js.map

package/dist/content-locks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-locks.js","sourceRoot":"","sources":["../src/content-locks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAgBpD,oDAAoD;AACpD,MAAM,UAAU,SAAS,CAAC,GAAe;IACvC,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,MAAkB;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;IAC7D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAA;IACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAe,EACf,MAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,kCAAkC;YAC5E,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;KACF,CAAA;AACH,CAAC"}

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+import type { AuthSection } from '@krantho/config';
+type SessionConfig = AuthSection['session'];
+/** Name of the cookie carrying the access token */
+export declare function accessCookieName(session: SessionConfig): string;
+/** Name of the cookie carrying the refresh token */
+export declare function refreshCookieName(session: SessionConfig): string;
+/** Build a HttpOnly session cookie string */
+export declare function buildCookie(name: string, value: string, maxAge: number, secure: boolean, sameSite: SessionConfig['sameSite']): string;
+/**
+ * Decide whether session cookies carry `Secure`.
+ *
+ * `always` and `never` force the flag. `auto` infers it from the request: a
+ * verbatim `x-forwarded-proto: https` always counts, and `auth.trustProxy`
+ * widens that to the other headers a terminating proxy may send instead — a
+ * proxy-chain list, `x-forwarded-ssl`, and RFC 7239 `Forwarded`.
+ */
+export declare function isSecureRequest(headers: Record<string, string> | undefined, auth: AuthSection): boolean;
+export {};
+//# sourceMappingURL=cookies.d.ts.map

package/dist/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAElD,KAAK,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;AAE3C,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAE/D;AAED,oDAAoD;AACpD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAEhE;AAQD,6CAA6C;AAC7C,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,GAClC,MAAM,CAWR;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE,WAAW,GAChB,OAAO,CAaT"}

package/dist/cookies.js

@@ -0,0 +1,52 @@
+/** Name of the cookie carrying the access token */
+export function accessCookieName(session) {
+    return `${session.cookiePrefix}_access`;
+}
+/** Name of the cookie carrying the refresh token */
+export function refreshCookieName(session) {
+    return `${session.cookiePrefix}_refresh`;
+}
+const SAME_SITE_ATTRIBUTE = {
+    lax: 'Lax',
+    strict: 'Strict',
+    none: 'None',
+};
+/** Build a HttpOnly session cookie string */
+export function buildCookie(name, value, maxAge, secure, sameSite) {
+    return [
+        `${name}=${value}`,
+        'HttpOnly',
+        `SameSite=${SAME_SITE_ATTRIBUTE[sameSite]}`,
+        'Path=/',
+        secure ? 'Secure' : '',
+        `Max-Age=${maxAge}`,
+    ]
+        .filter(Boolean)
+        .join('; ');
+}
+/**
+ * Decide whether session cookies carry `Secure`.
+ *
+ * `always` and `never` force the flag. `auto` infers it from the request: a
+ * verbatim `x-forwarded-proto: https` always counts, and `auth.trustProxy`
+ * widens that to the other headers a terminating proxy may send instead — a
+ * proxy-chain list, `x-forwarded-ssl`, and RFC 7239 `Forwarded`.
+ */
+export function isSecureRequest(headers, auth) {
+    if (auth.session.secure === 'always')
+        return true;
+    if (auth.session.secure === 'never')
+        return false;
+    const forwardedProto = headers?.['x-forwarded-proto'];
+    if (forwardedProto === 'https')
+        return true;
+    if (!auth.trustProxy)
+        return false;
+    if (forwardedProto?.split(',')[0]?.trim().toLowerCase() === 'https')
+        return true;
+    if (headers?.['x-forwarded-ssl']?.toLowerCase() === 'on')
+        return true;
+    const forwarded = headers?.['forwarded'];
+    return forwarded !== undefined && /(?:^|[;,\s])proto="?https"?(?:$|[;,\s])/i.test(forwarded);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,OAAO,GAAG,OAAO,CAAC,YAAY,SAAS,CAAA;AACzC,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,OAAO,GAAG,OAAO,CAAC,YAAY,UAAU,CAAA;AAC1C,CAAC;AAED,MAAM,mBAAmB,GAA8C;IACrE,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;CACb,CAAA;AAED,6CAA6C;AAC7C,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,KAAa,EACb,MAAc,EACd,MAAe,EACf,QAAmC;IAEnC,OAAO;QACL,GAAG,IAAI,IAAI,KAAK,EAAE;QAClB,UAAU;QACV,YAAY,mBAAmB,CAAC,QAAQ,CAAC,EAAE;QAC3C,QAAQ;QACR,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACtB,WAAW,MAAM,EAAE;KACpB;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA2C,EAC3C,IAAiB;IAEjB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAEjD,MAAM,cAAc,GAAG,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;IACrD,IAAI,cAAc,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAElC,IAAI,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAChF,IAAI,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAErE,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACxC,OAAO,SAAS,KAAK,SAAS,IAAI,0CAA0C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC9F,CAAC"}

package/dist/create-api-handlers.d.ts

@@ -0,0 +1,128 @@
+import type { KranthoConfig } from '@krantho/config';
+import type { ContentChangeListener, IContentEngine } from '@krantho/core';
+import type { IAuthAdapter, ICheckpointAdapter, IContentMigrationAdapter, ILockAdapter, IPageCacheStore, IPersistenceAdapter, IRetentionAdapter, ISecretVault, ISiteSettingsAdapter, IWebhookDeliveryAdapter } from '@krantho/persistence';
+import type { ContentConfig, PageDefinition } from '@krantho/schema';
+import { acquireLock, bulkDelete, bulkPublish, capabilities, checkLock, contentChanges, createContent, deleteContent, deleteRuntimeField, exportBundle, exportContent, exportSchema, getContent, getRuntimeSchema, getSchema, getVersion, importBundle, importContent, listCollection, listCollections, listContent, listContentTree, listLocks, listVersions, mediaDelete, mediaGet, mediaImage, mediaImageInfo, mediaInfo, mediaList, mediaRegister, mediaUpdate, mediaUpload, migrationConflicts, migrationStatus, publishContent, publishImpact, releaseLock, resolveConflict, resolvePageRoute, restoreVersion, saveRuntimeField, searchContent, seoGenerate, seoPreview, seoRobots, seoSitemap, seoStatus, seoStructuredData, siteConfigHandler, snapshotCreate, snapshotDelete, snapshotGet, snapshotList, snapshotRestore, updateContent, validateAll, webhookDeliveries, webhookRetry } from './handlers/index.js';
+import type { ContentHooks } from './hooks.js';
+import type { KranthoPlugin } from './plugins.js';
+import { type SaveDocumentInput, type SaveDocumentResult } from './save-document.js';
+import type { ApiRequest, ApiResponse, MediaConfig, ServerFramework, SitePreviewMode, WebhookConfig } from './types.js';
+export interface CreateApiHandlersConfig {
+    contentConfig: ContentConfig;
+    /** The resolved configuration tree */
+    config: KranthoConfig;
+    adapter: IPersistenceAdapter;
+    engine: IContentEngine;
+    pages?: readonly PageDefinition[] | undefined;
+    webhooks?: readonly WebhookConfig[] | undefined;
+    hooks?: ContentHooks | undefined;
+    /** Told about every committed write, inside the request that made it */
+    onContentChange?: ContentChangeListener | undefined;
+    /**
+     * Keep work that outlives a request — a background job — running until it
+     * settles, on hosts that end a request's work with its response
+     */
+    waitUntil?: ((work: Promise<unknown>) => void) | undefined;
+    plugins?: KranthoPlugin[] | undefined;
+    /** Media metadata, folders and file store — enables the media routes */
+    media?: MediaConfig | undefined;
+    /** Checkpoint adapter for backup/restore */
+    checkpoints?: ICheckpointAdapter | undefined;
+    /** Content migration adapter for conflict resolution */
+    contentMigration?: IContentMigrationAdapter | undefined;
+    /** Auth adapter for user/token operations */
+    authAdapter?: IAuthAdapter | undefined;
+    /** Current schema version from migration runner */
+    schemaVersion?: number | undefined;
+    /** Persistence adapter type for capabilities reporting */
+    persistenceType?: 'filesystem' | 'sqlite' | 'postgres' | undefined;
+    /**
+     * The host renders drafts for editors on the site itself: registers
+     * `GET /api/preview`, answered as the mode says
+     */
+    sitePreview?: SitePreviewMode | undefined;
+    /** The server package hosting the API, reported by `GET /api/capabilities`; each server package sets it */
+    framework?: ServerFramework | undefined;
+    /** Advisory lock adapter */
+    lockAdapter?: ILockAdapter | undefined;
+    /** The page cache the site's instances share, when `cache.shared` is `database` */
+    pageCacheStore?: IPageCacheStore | undefined;
+    /** Webhook delivery log adapter */
+    webhookDeliveryAdapter?: IWebhookDeliveryAdapter | undefined;
+    /** Version retention adapter */
+    retentionAdapter?: IRetentionAdapter | undefined;
+    /** Site settings adapter */
+    siteSettingsAdapter?: ISiteSettingsAdapter | undefined;
+    /** Vault that seals the secrets stored in site settings; none means a site stores none */
+    secrets?: ISecretVault | undefined;
+    /** SEO configuration adapter */
+    seoConfigAdapter?: import('@krantho/persistence').ISeoConfigAdapter | undefined;
+}
+export interface ApiHandlers {
+    /** Trusted repository edits share validation, hooks, locks and draft publication with REST saves. */
+    saveRepositoryDocument(input: Omit<SaveDocumentInput, 'changedBy'>): Promise<SaveDocumentResult>;
+    /** Handle any API request via route matching */
+    handle(req: ApiRequest): Promise<ApiResponse>;
+    /** Direct access to individual handlers */
+    listCollections: typeof listCollections;
+    listCollection: typeof listCollection;
+    listContent: typeof listContent;
+    listContentTree: typeof listContentTree;
+    getContent: typeof getContent;
+    createContent: typeof createContent;
+    updateContent: typeof updateContent;
+    deleteContent: typeof deleteContent;
+    publishContent: typeof publishContent;
+    getSchema: typeof getSchema;
+    listVersions: typeof listVersions;
+    getVersion: typeof getVersion;
+    restoreVersion: typeof restoreVersion;
+    validateAll: typeof validateAll;
+    resolvePageRoute: typeof resolvePageRoute;
+    searchContent: typeof searchContent;
+    bulkDelete: typeof bulkDelete;
+    bulkPublish: typeof bulkPublish;
+    siteConfigHandler: typeof siteConfigHandler;
+    seoStatus: typeof seoStatus;
+    seoStructuredData: typeof seoStructuredData;
+    seoPreview: typeof seoPreview;
+    seoSitemap: typeof seoSitemap;
+    seoRobots: typeof seoRobots;
+    seoGenerate: typeof seoGenerate;
+    getRuntimeSchema: typeof getRuntimeSchema;
+    saveRuntimeField: typeof saveRuntimeField;
+    deleteRuntimeField: typeof deleteRuntimeField;
+    exportSchema: typeof exportSchema;
+    exportContent: typeof exportContent;
+    importContent: typeof importContent;
+    mediaList: typeof mediaList;
+    mediaGet: typeof mediaGet;
+    mediaUpload: typeof mediaUpload;
+    mediaRegister: typeof mediaRegister;
+    mediaUpdate: typeof mediaUpdate;
+    mediaDelete: typeof mediaDelete;
+    mediaImage: typeof mediaImage;
+    mediaInfo: typeof mediaInfo;
+    mediaImageInfo: typeof mediaImageInfo;
+    snapshotList: typeof snapshotList;
+    snapshotCreate: typeof snapshotCreate;
+    snapshotGet: typeof snapshotGet;
+    snapshotRestore: typeof snapshotRestore;
+    snapshotDelete: typeof snapshotDelete;
+    migrationStatus: typeof migrationStatus;
+    migrationConflicts: typeof migrationConflicts;
+    resolveConflict: typeof resolveConflict;
+    capabilities: typeof capabilities;
+    acquireLock: typeof acquireLock;
+    releaseLock: typeof releaseLock;
+    checkLock: typeof checkLock;
+    listLocks: typeof listLocks;
+    publishImpact: typeof publishImpact;
+    contentChanges: typeof contentChanges;
+    exportBundle: typeof exportBundle;
+    importBundle: typeof importBundle;
+    webhookDeliveries: typeof webhookDeliveries;
+    webhookRetry: typeof webhookRetry;
+}
+export declare function createApiHandlers(config: CreateApiHandlersConfig): ApiHandlers;
+//# sourceMappingURL=create-api-handlers.d.ts.map

package/dist/create-api-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-api-handlers.d.ts","sourceRoot":"","sources":["../src/create-api-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,aAAa,EAAgB,MAAM,iBAAiB,CAAA;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC1E,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAGpE,OAAO,EACL,WAAW,EASX,UAAU,EACV,WAAW,EACX,YAAY,EACZ,SAAS,EACT,cAAc,EACd,aAAa,EAEb,aAAa,EAEb,kBAAkB,EAElB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,UAAU,EAGV,gBAAgB,EAChB,SAAS,EAET,UAAU,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,SAAS,EACT,YAAY,EAGZ,WAAW,EAMX,QAAQ,EACR,UAAU,EACV,cAAc,EACd,SAAS,EACT,SAAS,EAET,aAAa,EAGb,WAAW,EACX,WAAW,EAGX,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EAMd,gBAAgB,EAEhB,aAAa,EAMb,WAAW,EAGX,UAAU,EAEV,SAAS,EAET,UAAU,EAEV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EAEjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,eAAe,EAGf,aAAa,EAUb,WAAW,EAGX,iBAAiB,EACjB,YAAY,EACb,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAQ9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAgB,MAAM,oBAAoB,CAAA;AAClG,OAAO,KAAK,EAEV,UAAU,EACV,WAAW,EACX,WAAW,EACX,eAAe,EACf,eAAe,EACf,aAAa,EACd,MAAM,YAAY,CAAA;AAInB,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,aAAa,CAAA;IAC5B,sCAAsC;IACtC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,cAAc,CAAA;IACtB,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAA;IAC/C,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;IAChC,wEAAwE;IACxE,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAA;IACnD;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAA;IAC1D,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,SAAS,CAAA;IACrC,wEAAwE;IACxE,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IAC/B,4CAA4C;IAC5C,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAA;IAC5C,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAA;IACvD,6CAA6C;IAC7C,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;IACtC,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,0DAA0D;IAC1D,eAAe,CAAC,EAAE,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAA;IAClE;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,GAAG,SAAS,CAAA;IACzC,2GAA2G;IAC3G,SAAS,CAAC,EAAE,eAAe,GAAG,SAAS,CAAA;IACvC,4BAA4B;IAC5B,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;IACtC,mFAAmF;IACnF,cAAc,CAAC,EAAE,eAAe,GAAG,SAAS,CAAA;IAC5C,mCAAmC;IACnC,sBAAsB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAA;IAC5D,gCAAgC;IAChC,gBAAgB,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAA;IAChD,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACtD,0FAA0F;IAC1F,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;IAClC,gCAAgC;IAChC,gBAAgB,CAAC,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,GAAG,SAAS,CAAA;CAChF;AAED,MAAM,WAAW,WAAW;IAC1B,qGAAqG;IACrG,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAChG,gDAAgD;IAChD,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7C,2CAA2C;IAC3C,eAAe,EAAE,OAAO,eAAe,CAAA;IACvC,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,eAAe,EAAE,OAAO,eAAe,CAAA;IACvC,UAAU,EAAE,OAAO,UAAU,CAAA;IAC7B,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,UAAU,EAAE,OAAO,UAAU,CAAA;IAC7B,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,gBAAgB,EAAE,OAAO,gBAAgB,CAAA;IACzC,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,UAAU,EAAE,OAAO,UAAU,CAAA;IAC7B,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,iBAAiB,EAAE,OAAO,iBAAiB,CAAA;IAC3C,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,iBAAiB,EAAE,OAAO,iBAAiB,CAAA;IAC3C,UAAU,EAAE,OAAO,UAAU,CAAA;IAC7B,UAAU,EAAE,OAAO,UAAU,CAAA;IAC7B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,gBAAgB,EAAE,OAAO,gBAAgB,CAAA;IACzC,gBAAgB,EAAE,OAAO,gBAAgB,CAAA;IACzC,kBAAkB,EAAE,OAAO,kBAAkB,CAAA;IAC7C,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,QAAQ,EAAE,OAAO,QAAQ,CAAA;IACzB,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,UAAU,EAAE,OAAO,UAAU,CAAA;IAC7B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,eAAe,EAAE,OAAO,eAAe,CAAA;IACvC,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,eAAe,EAAE,OAAO,eAAe,CAAA;IACvC,kBAAkB,EAAE,OAAO,kBAAkB,CAAA;IAC7C,eAAe,EAAE,OAAO,eAAe,CAAA;IACvC,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,WAAW,EAAE,OAAO,WAAW,CAAA;IAC/B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,iBAAiB,EAAE,OAAO,iBAAiB,CAAA;IAC3C,YAAY,EAAE,OAAO,YAAY,CAAA;CAClC;AAmOD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,WAAW,CA2L9E"}