@krantho/api 0.0.0-stage → 1.0.1

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAuBrD,6DAA6D;AAC7D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqD,CAAA;AAEnF,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,GAAG,CAAA;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAA;IAC9E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;IAC/C,mBAAmB;IACnB,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAA;IACjE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,mBAAmB;IACjC,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAkBD,mDAAmD;AACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8C,CAAA;AAEvE,uCAAuC;AACvC,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,SAAS,OAAO,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAA;IAC/C,mBAAmB;IACnB,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAA;IACtE,OAAO,IAAI,CAAC,IAAI,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;AACjD,MAAM,0BAA0B,GAAG,MAAM,CAAA;AAEzC,8FAA8F;AAC9F,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,0BAA0B;QAAE,OAAO,KAAK,CAAA;IAC/E,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACjC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,SAAS,CAAC,KAAK,EAAE,CAAA;QACjB,eAAe,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACzB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;AACH,CAAC;AA2BD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,OAAe;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAA;IAE/E,2BAA2B;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAGhE,CAAA;IAER,IAAI,MAAM,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,GAAG,4BAA4B,CAAC,CAAA;IACpF,CAAC;IAED,mCAAmC;IACnC,IAAI,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAA;IAEnE,kFAAkF;IAClF,IAAI,CAAC,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACzB,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;QAC7B,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,2CAA2C;IAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3C,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAA;IAC7C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;IAE9D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACnF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,MAAiC,CAAA;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,QAA6B;IAE7B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAA;IACjD,MAAM,MAAM,GAAG,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAA6B,CAAA;IAEpF,kBAAkB;IAClB,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACjD,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6BAA6B,gBAAgB,SAAS,WAAW,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,oBAAoB;IACpB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACvE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,WAAW,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACrC,CAAC;IAED,6DAA6D;IAC7D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,eAAe;AAEf,gEAAgE;AAChE,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAcD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,KAAmB;IAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;KAClC,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IAErE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAiF,CAAA;AAClG,CAAC;AAED,kBAAkB;AAElB,iDAAiD;AACjD,SAAS,QAAQ,CAAC,GAAQ;IACxB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAEzC,mCAAmC;IACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC3D,MAAM,YAAY,GAAG,cAAc,CAAC,eAAe,CAAC,CAAA;IAEpD,+BAA+B;IAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/B,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KACzF,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnE,YAAY;KACb,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IAErE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;IAC5C,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAA;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9C,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IACrF,4DAA4D;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,IAAI,CAAA,CAAC,6BAA6B;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AACvF,CAAC"}

package/dist/openapi.d.ts

@@ -0,0 +1,13 @@
+import type { AuthSection } from '@krantho/config';
+import type { ApiRouter } from './router.js';
+import type { ApiHandler } from './types.js';
+/** Build OpenAPI 3.1 spec from router */
+export declare function buildOpenApiSpec(router: ApiRouter, site: {
+    name: string;
+    baseUrl: string;
+}, auth: AuthSection): Record<string, unknown>;
+/** GET /api/openapi.json */
+export declare function createOpenApiSpecHandler(router: ApiRouter): ApiHandler;
+/** GET /api/docs — Scalar UI */
+export declare function createOpenApiDocsHandler(): ApiHandler;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAElD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AA2C5C,yCAAyC;AACzC,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACvC,IAAI,EAAE,WAAW,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyDzB;AAED,4BAA4B;AAC5B,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAKtE;AAED,gCAAgC;AAChC,wBAAgB,wBAAwB,IAAI,UAAU,CAgBrD"}

package/dist/openapi.js

@@ -0,0 +1,133 @@
+import { accessCookieName } from './cookies.js';
+/** Infer a tag from an API route path */
+function routeTag(path) {
+    if (path.startsWith('/api/auth'))
+        return 'Auth';
+    if (path.startsWith('/api/assistant'))
+        return 'Assistant';
+    if (path.includes('/versions'))
+        return 'Versions';
+    if (path.includes('/lock'))
+        return 'Locking';
+    if (path.includes('/publish'))
+        return 'Publishing';
+    if (path.includes('/search'))
+        return 'Search';
+    if (path.startsWith('/api/content'))
+        return 'Content';
+    if (path.startsWith('/api/collections'))
+        return 'Collections';
+    if (path.startsWith('/api/schema'))
+        return 'Schema';
+    if (path.startsWith('/api/seo'))
+        return 'SEO';
+    if (path.startsWith('/api/media'))
+        return 'Media';
+    if (path.startsWith('/api/checkpoints'))
+        return 'Checkpoints';
+    if (path.startsWith('/api/webhooks'))
+        return 'Webhooks';
+    if (path.startsWith('/api/users'))
+        return 'Users';
+    if (path.startsWith('/api/settings'))
+        return 'Settings';
+    if (path.startsWith('/api/site-config'))
+        return 'Site Config';
+    if (path.startsWith('/api/migration'))
+        return 'Migrations';
+    if (path.startsWith('/api/export') || path.includes('/export'))
+        return 'Import/Export';
+    if (path.startsWith('/api/import') || path.includes('/import'))
+        return 'Import/Export';
+    return 'Other';
+}
+/** Convert :param to {param} */
+function toOpenApiPath(pattern) {
+    return pattern.replace(/:([a-zA-Z]+)/g, '{$1}');
+}
+/** Extract path parameters */
+function extractParams(pattern) {
+    const params = [];
+    for (const match of pattern.matchAll(/:([a-zA-Z]+)/g)) {
+        params.push({ name: match[1], in: 'path', required: true, schema: { type: 'string' } });
+    }
+    return params;
+}
+/** Build OpenAPI 3.1 spec from router */
+export function buildOpenApiSpec(router, site, auth) {
+    const routes = router.listRoutes();
+    const paths = {};
+    for (const route of routes) {
+        if (route.pattern === '/api/openapi.json' || route.pattern === '/api/docs')
+            continue;
+        const openApiPath = toOpenApiPath(route.pattern);
+        const method = route.method.toLowerCase();
+        const tag = routeTag(route.pattern);
+        const params = extractParams(route.pattern);
+        if (!paths[openApiPath])
+            paths[openApiPath] = {};
+        const operation = {
+            tags: [tag],
+            summary: `${route.method} ${route.pattern}`,
+            responses: {
+                '200': { description: 'Success' },
+                '400': { description: 'Bad Request' },
+                '404': { description: 'Not Found' },
+            },
+        };
+        if (params.length > 0)
+            operation.parameters = params;
+        if (['post', 'put', 'patch'].includes(method)) {
+            operation.requestBody = {
+                content: { 'application/json': { schema: { type: 'object' } } },
+            };
+        }
+        paths[openApiPath][method] = operation;
+    }
+    const spec = {
+        openapi: '3.1.0',
+        info: {
+            title: `${site.name} API`,
+            version: '1.0.0',
+            description: 'krantho CMS REST API',
+        },
+        servers: [{ url: site.baseUrl }],
+        paths,
+    };
+    if (auth.mode !== 'none') {
+        spec.components = {
+            securitySchemes: {
+                bearerAuth: { type: 'http', scheme: 'bearer' },
+                cookieAuth: { type: 'apiKey', in: 'cookie', name: accessCookieName(auth.session) },
+            },
+        };
+        spec.security = [{ bearerAuth: [] }, { cookieAuth: [] }];
+    }
+    return spec;
+}
+/** GET /api/openapi.json */
+export function createOpenApiSpecHandler(router) {
+    return async (_req, ctx) => {
+        const spec = buildOpenApiSpec(router, ctx.config.site, ctx.config.auth);
+        return { status: 200, body: spec };
+    };
+}
+/** GET /api/docs — Scalar UI */
+export function createOpenApiDocsHandler() {
+    return async (_req, ctx) => {
+        const html = `<!doctype html>
+<html>
+<head>
+  <title>${ctx.config.site.name} — API Docs</title>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+</head>
+<body>
+  <script id="api-reference" data-url="${ctx.config.site.baseUrl}/api/openapi.json"></script>
+  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.28.12"></script>
+</body>
+</html>`;
+        return { status: 200, headers: { 'Content-Type': 'text/html' }, body: html };
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAI/C,yCAAyC;AACzC,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,MAAM,CAAA;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,WAAW,CAAA;IACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,UAAU,CAAA;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,YAAY,CAAA;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAA;IACrD,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,aAAa,CAAA;IAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAA;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,aAAa,CAAA;IAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,UAAU,CAAA;IACvD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAA;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,UAAU,CAAA;IACvD,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,aAAa,CAAA;IAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,YAAY,CAAA;IAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,eAAe,CAAA;IACtF,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,eAAe,CAAA;IACtF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,gCAAgC;AAChC,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AAED,8BAA8B;AAC9B,SAAS,aAAa,CACpB,OAAe;IAEf,MAAM,MAAM,GACV,EAAE,CAAA;IACJ,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,IAAuC,EACvC,IAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAClC,MAAM,KAAK,GAA4C,EAAE,CAAA;IAEzD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,OAAO,KAAK,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW;YAAE,SAAQ;QAEpF,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAE3C,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;QAEhD,MAAM,SAAS,GAA4B;YACzC,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE;YAC3C,SAAS,EAAE;gBACT,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;gBACjC,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;gBACrC,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;aACpC;SACF,CAAA;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,GAAG,MAAM,CAAA;QAEpD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,SAAS,CAAC,WAAW,GAAG;gBACtB,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;aAChE,CAAA;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACxC,CAAC;IAED,MAAM,IAAI,GAA4B;QACpC,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,MAAM;YACzB,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,sBAAsB;SACpC;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,KAAK;KACN,CAAA;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG;YAChB,eAAe,EAAE;gBACf,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;aACnF;SACF,CAAA;QACD,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,wBAAwB,CAAC,MAAiB;IACxD,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACvE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACpC,CAAC,CAAA;AACH,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG;;;WAGN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;;;;;yCAKU,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;;;QAGxD,CAAA;QACJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC9E,CAAC,CAAA;AACH,CAAC"}

package/dist/permissions.d.ts

@@ -0,0 +1,37 @@
+import type { Role } from '@krantho/persistence';
+import type { ApiResponse, AuthenticatedUser } from './types.js';
+/** All valid roles in the permission system */
+export declare const VALID_ROLES: readonly Role[];
+/**
+ * Per-collection permission overrides are stored in the auth adapters and
+ * exposed via the user-permissions API, but resolution in requireRole is
+ * deferred to the Zitadel deep integration (#99). The infrastructure is
+ * wired up — the middleware just doesn't consult per-collection overrides yet.
+ */
+/** Type guard: check if a string is a valid Role */
+export declare function isValidRole(value: unknown): value is Role;
+/**
+ * Narrow a configured role string to a `Role`, naming the configuration path
+ * when it is not one. Called once at startup so a bad value fails the boot
+ * instead of minting tokens with a role every permission check rejects.
+ */
+export declare function assertRole(value: string, configPath: string): Role;
+/** Check if a user's highest role meets or exceeds the required role */
+export declare function hasRole(user: AuthenticatedUser, required: Role): boolean;
+/**
+ * Check if the authenticated user has sufficient permissions.
+ * Returns null if authorized, or a 403 response if not.
+ *
+ * Usage in handlers:
+ * ```ts
+ * const denied = requireRole(ctx.auth, 'editor')
+ * if (denied) return denied
+ * ```
+ */
+export declare function requireRole(user: AuthenticatedUser | undefined, required: Role): ApiResponse | null;
+/**
+ * Build a changedBy string from the authenticated user.
+ * Format: "role:email" (e.g., "admin:user@example.com")
+ */
+export declare function changedByFromAuth(user: AuthenticatedUser | undefined): string;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAGhE,+CAA+C;AAC/C,eAAO,MAAM,WAAW,EAAE,SAAS,IAAI,EAA2C,CAAA;AAElF;;;;;GAKG;AAEH,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAOlE;AASD,wEAAwE;AACxE,wBAAgB,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,GAAG,OAAO,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,iBAAiB,GAAG,SAAS,EACnC,QAAQ,EAAE,IAAI,GACb,WAAW,GAAG,IAAI,CAepB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,MAAM,CAI7E"}

package/dist/permissions.js

@@ -0,0 +1,69 @@
+import { isOneOf } from './validators.js';
+/** All valid roles in the permission system */
+export const VALID_ROLES = ['admin', 'editor', 'viewer'];
+/**
+ * Per-collection permission overrides are stored in the auth adapters and
+ * exposed via the user-permissions API, but resolution in requireRole is
+ * deferred to the Zitadel deep integration (#99). The infrastructure is
+ * wired up — the middleware just doesn't consult per-collection overrides yet.
+ */
+/** Type guard: check if a string is a valid Role */
+export function isValidRole(value) {
+    return typeof value === 'string' && isOneOf(VALID_ROLES, value);
+}
+/**
+ * Narrow a configured role string to a `Role`, naming the configuration path
+ * when it is not one. Called once at startup so a bad value fails the boot
+ * instead of minting tokens with a role every permission check rejects.
+ */
+export function assertRole(value, configPath) {
+    if (!isValidRole(value)) {
+        throw new Error(`[krantho] ${configPath}: "${value}" is not a valid role (${VALID_ROLES.join(', ')})`);
+    }
+    return value;
+}
+/** Role hierarchy: admin > editor > viewer */
+const ROLE_LEVEL = {
+    admin: 3,
+    editor: 2,
+    viewer: 1,
+};
+/** Check if a user's highest role meets or exceeds the required role */
+export function hasRole(user, required) {
+    return user.roles.some((r) => (ROLE_LEVEL[r] ?? 0) >= ROLE_LEVEL[required]);
+}
+/**
+ * Check if the authenticated user has sufficient permissions.
+ * Returns null if authorized, or a 403 response if not.
+ *
+ * Usage in handlers:
+ * ```ts
+ * const denied = requireRole(ctx.auth, 'editor')
+ * if (denied) return denied
+ * ```
+ */
+export function requireRole(user, required) {
+    if (!user) {
+        return { status: 401, body: { error: 'Authentication required' } };
+    }
+    if (!hasRole(user, required)) {
+        return {
+            status: 403,
+            body: {
+                error: `Insufficient permissions. Required: ${required}, have: ${user.roles.join(', ')}`,
+            },
+        };
+    }
+    return null;
+}
+/**
+ * Build a changedBy string from the authenticated user.
+ * Format: "role:email" (e.g., "admin:user@example.com")
+ */
+export function changedByFromAuth(user) {
+    if (!user)
+        return 'api';
+    const role = user.roles[0] ?? 'unknown';
+    return `${role}:${user.email}`;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEzC,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAElF;;;;;GAKG;AAEH,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,UAAkB;IAC1D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,aAAa,UAAU,MAAM,KAAK,0BAA0B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,GAAyB;IACvC,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;CACV,CAAA;AAED,wEAAwE;AACxE,MAAM,UAAU,OAAO,CAAC,IAAuB,EAAE,QAAc;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,IAAmC,EACnC,QAAc;IAEd,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAA;IACpE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,uCAAuC,QAAQ,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzF;SACF,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmC;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;IACvC,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAA;AAChC,CAAC"}

package/dist/plugins.d.ts

@@ -0,0 +1,64 @@
+import type { ContentHooks } from './hooks.js';
+import type { ApiHandler } from './types.js';
+/** Custom API route definition */
+export interface PluginRoute {
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    path: string;
+    handler: ApiHandler;
+}
+/** Custom Studio page definition (metadata only — admin renders based on this) */
+export interface PluginStudioPage {
+    /** Route path in Studio (e.g., 'analytics') → /studio/plugins/analytics */
+    path: string;
+    /** Display name in sidebar */
+    label: string;
+    /** URL to the page component (loaded via iframe or script) */
+    componentUrl?: string | undefined;
+}
+/** Custom field type definition */
+export interface PluginFieldType {
+    /** Type name used in schema (e.g., 'markdown-preview') */
+    type: string;
+    /** Display label in field editor */
+    label: string;
+    /** URL to the field renderer component */
+    componentUrl?: string | undefined;
+}
+/** Plugin manifest — the contract for extending krantho */
+export interface KranthoPlugin {
+    /** Unique plugin name (e.g., '@myorg/krantho-analytics') */
+    name: string;
+    /** Plugin version */
+    version: string;
+    /** Plugin description */
+    description?: string | undefined;
+    /** Lifecycle hooks */
+    hooks?: ContentHooks | undefined;
+    /** Custom API routes (mounted under /api/plugins/:pluginName/) */
+    routes?: PluginRoute[] | undefined;
+    /** Custom Studio pages (metadata for Studio sidebar) */
+    studioPages?: PluginStudioPage[] | undefined;
+    /** Custom field types */
+    fieldTypes?: PluginFieldType[] | undefined;
+    /** Called once when the plugin is loaded */
+    onLoad?: (() => Promise<void> | void) | undefined;
+    /** Called when the server shuts down */
+    onUnload?: (() => Promise<void> | void) | undefined;
+}
+/** Merged plugin state after loading all plugins */
+export interface PluginRegistry {
+    hooks: ContentHooks;
+    routes: Array<PluginRoute & {
+        plugin: string;
+    }>;
+    studioPages: Array<PluginStudioPage & {
+        plugin: string;
+    }>;
+    fieldTypes: Array<PluginFieldType & {
+        plugin: string;
+    }>;
+}
+/** Load and merge multiple plugins into a single registry */
+export declare function loadPlugins(plugins: KranthoPlugin[]): Promise<PluginRegistry>;
+export declare function mergeHooks(a: ContentHooks, b: ContentHooks): ContentHooks;
+//# sourceMappingURL=plugins.d.ts.map

package/dist/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../src/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAA;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,UAAU,CAAA;CACpB;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAED,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAA;IACZ,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,sBAAsB;IACtB,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;IAChC,kEAAkE;IAClE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,SAAS,CAAA;IAClC,wDAAwD;IACxD,WAAW,CAAC,EAAE,gBAAgB,EAAE,GAAG,SAAS,CAAA;IAC5C,yBAAyB;IACzB,UAAU,CAAC,EAAE,eAAe,EAAE,GAAG,SAAS,CAAA;IAC1C,4CAA4C;IAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,CAAA;IACjD,wCAAwC;IACxC,QAAQ,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,CAAA;CACpD;AAED,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,KAAK,CAAC,WAAW,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC/C,WAAW,EAAE,KAAK,CAAC,gBAAgB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzD,UAAU,EAAE,KAAK,CAAC,eAAe,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACxD;AAED,6DAA6D;AAC7D,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CA0CnF;AA8BD,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CASzE"}

package/dist/plugins.js

@@ -0,0 +1,73 @@
+/** Load and merge multiple plugins into a single registry */
+export async function loadPlugins(plugins) {
+    const registry = {
+        hooks: {},
+        routes: [],
+        studioPages: [],
+        fieldTypes: [],
+    };
+    for (const plugin of plugins) {
+        // Run onLoad
+        if (plugin.onLoad) {
+            await plugin.onLoad();
+        }
+        // Merge hooks (chain multiple hooks for the same event)
+        if (plugin.hooks) {
+            registry.hooks = mergeHooks(registry.hooks, plugin.hooks);
+        }
+        // Collect routes with plugin prefix
+        if (plugin.routes) {
+            for (const route of plugin.routes) {
+                registry.routes.push({ ...route, plugin: plugin.name });
+            }
+        }
+        // Collect Studio pages
+        if (plugin.studioPages) {
+            for (const page of plugin.studioPages) {
+                registry.studioPages.push({ ...page, plugin: plugin.name });
+            }
+        }
+        // Collect field types
+        if (plugin.fieldTypes) {
+            for (const fieldType of plugin.fieldTypes) {
+                registry.fieldTypes.push({ ...fieldType, plugin: plugin.name });
+            }
+        }
+    }
+    return registry;
+}
+/** Chain two hook functions — runs both in order */
+function chainHook(existing, incoming) {
+    if (!existing)
+        return incoming;
+    if (!incoming)
+        return existing;
+    return async (ctx) => {
+        const result1 = await existing(ctx);
+        const updated = (result1 ?? ctx);
+        const result2 = await incoming(updated);
+        return result2 ?? updated;
+    };
+}
+/** Chain two void hook functions — runs both in order */
+function chainVoidHook(existing, incoming) {
+    if (!existing)
+        return incoming;
+    if (!incoming)
+        return existing;
+    return async (ctx) => {
+        await existing(ctx);
+        await incoming(ctx);
+    };
+}
+export function mergeHooks(a, b) {
+    return {
+        beforeSave: chainHook(a.beforeSave, b.beforeSave),
+        afterCreate: chainVoidHook(a.afterCreate, b.afterCreate),
+        afterUpdate: chainVoidHook(a.afterUpdate, b.afterUpdate),
+        afterPublish: chainVoidHook(a.afterPublish, b.afterPublish),
+        beforeDelete: chainVoidHook(a.beforeDelete, b.beforeDelete),
+        afterDelete: chainVoidHook(a.afterDelete, b.afterDelete),
+    };
+}
+//# sourceMappingURL=plugins.js.map

package/dist/plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../src/plugins.ts"],"names":[],"mappings":"AA4DA,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB;IACxD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,EAAE;QACf,UAAU,EAAE,EAAE;KACf,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,aAAa;QACb,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;QACvB,CAAC;QAED,wDAAwD;QACxD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3D,CAAC;QAED,oCAAoC;QACpC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACzD,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1C,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,oDAAoD;AACpD,SAAS,SAAS,CAChB,QAAqD,EACrD,QAAqD;IAErD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC9B,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC9B,OAAO,KAAK,EAAE,GAAM,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAM,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QACvC,OAAO,OAAO,IAAI,OAAO,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,aAAa,CACpB,QAAiD,EACjD,QAAiD;IAEjD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC9B,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC9B,OAAO,KAAK,EAAE,GAAM,EAAE,EAAE;QACtB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;QACnB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAe,EAAE,CAAe;IACzD,OAAO;QACL,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;QACjD,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;QACxD,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;QACxD,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;QAC3D,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;QAC3D,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;KACzD,CAAA;AACH,CAAC"}

package/dist/preview-token.d.ts

@@ -0,0 +1,13 @@
+/** The query parameter that carries a signed preview token on a page URL */
+export declare const PREVIEW_PARAM = "krantho-preview";
+/**
+ * A preview token for one page path: base64url(`exp`) + `.` +
+ * HMAC-SHA256(`secret`, `<path>|<exp>`), valid for ten minutes.
+ */
+export declare function signPreviewToken(path: string, secret: string): string;
+/**
+ * Whether `token` was signed with `secret` for `path` and has not expired.
+ * A malformed token is rejected, never thrown on.
+ */
+export declare function verifyPreviewToken(token: string, path: string, secret: string): boolean;
+//# sourceMappingURL=preview-token.d.ts.map

package/dist/preview-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-token.d.ts","sourceRoot":"","sources":["../src/preview-token.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,eAAO,MAAM,aAAa,oBAAoB,CAAA;AAiB9C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAevF"}

package/dist/preview-token.js

@@ -0,0 +1,45 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/** The query parameter that carries a signed preview token on a page URL */
+export const PREVIEW_PARAM = 'krantho-preview';
+/** How long a signed preview link stays valid, in seconds */
+const PREVIEW_TOKEN_TTL_SEC = 600;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/** A positive integer, spelled one way only: no sign, no leading zeros */
+const EXP = /^[1-9]\d*$/;
+function nowSec() {
+    return Math.floor(Date.now() / 1000);
+}
+function mac(path, exp, secret) {
+    return createHmac('sha256', secret).update(`${path}|${exp}`).digest('base64url');
+}
+/**
+ * A preview token for one page path: base64url(`exp`) + `.` +
+ * HMAC-SHA256(`secret`, `<path>|<exp>`), valid for ten minutes.
+ */
+export function signPreviewToken(path, secret) {
+    const exp = nowSec() + PREVIEW_TOKEN_TTL_SEC;
+    return `${Buffer.from(String(exp)).toString('base64url')}.${mac(path, exp, secret)}`;
+}
+/**
+ * Whether `token` was signed with `secret` for `path` and has not expired.
+ * A malformed token is rejected, never thrown on.
+ */
+export function verifyPreviewToken(token, path, secret) {
+    const parts = token.split('.');
+    if (parts.length !== 2)
+        return false;
+    const [expPart, macPart] = parts;
+    if (!BASE64URL.test(expPart) || !BASE64URL.test(macPart))
+        return false;
+    const expText = Buffer.from(expPart, 'base64url').toString('utf-8');
+    // Only the canonical encoding: no second spelling of the same token
+    if (!EXP.test(expText) || Buffer.from(expText).toString('base64url') !== expPart)
+        return false;
+    const exp = Number(expText);
+    if (!Number.isSafeInteger(exp) || exp <= nowSec())
+        return false;
+    const expected = Buffer.from(mac(path, exp, secret));
+    const actual = Buffer.from(macPart);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+//# sourceMappingURL=preview-token.js.map

package/dist/preview-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-token.js","sourceRoot":"","sources":["../src/preview-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAE9C,6DAA6D;AAC7D,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAEjC,MAAM,SAAS,GAAG,kBAAkB,CAAA;AACpC,0EAA0E;AAC1E,MAAM,GAAG,GAAG,YAAY,CAAA;AAExB,SAAS,MAAM;IACb,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,MAAc;IACpD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,qBAAqB,CAAA;IAC5C,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAA;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,KAAyB,CAAA;IACpD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAEtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACnE,oEAAoE;IACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,MAAM,EAAE;QAAE,OAAO,KAAK,CAAA;IAE/D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAC/E,CAAC"}

package/dist/public-cache.d.ts

@@ -0,0 +1,8 @@
+/**
+ * What a CDN may keep of a response that is the same for every visitor and changes only
+ * when content is published — the sitemap, robots.txt and llms.txt. An hour fresh, then a
+ * day served stale while one request renews it, so crawlers never wait and the database is
+ * read once an hour at most, not once per crawl.
+ */
+export declare const PUBLIC_MACHINE_READ_CACHE_CONTROL = "public, max-age=0, s-maxage=3600, stale-while-revalidate=86400";
+//# sourceMappingURL=public-cache.d.ts.map

package/dist/public-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-cache.d.ts","sourceRoot":"","sources":["../src/public-cache.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,mEACoB,CAAA"}

package/dist/public-cache.js

@@ -0,0 +1,8 @@
+/**
+ * What a CDN may keep of a response that is the same for every visitor and changes only
+ * when content is published — the sitemap, robots.txt and llms.txt. An hour fresh, then a
+ * day served stale while one request renews it, so crawlers never wait and the database is
+ * read once an hour at most, not once per crawl.
+ */
+export const PUBLIC_MACHINE_READ_CACHE_CONTROL = 'public, max-age=0, s-maxage=3600, stale-while-revalidate=86400';
+//# sourceMappingURL=public-cache.js.map

package/dist/public-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-cache.js","sourceRoot":"","sources":["../src/public-cache.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,gEAAgE,CAAA"}

package/dist/reference-resolver.d.ts

@@ -0,0 +1,21 @@
+import { type ContentDocument, type IPersistenceAdapter } from '@krantho/persistence';
+import type { ContentConfig } from '@krantho/schema';
+/**
+ * Resolve reference fields in a ContentDocument.
+ *
+ * Collects all reference field slugs, batch-loads them per collection,
+ * and replaces slug strings with full ContentDocument objects.
+ */
+export declare function resolveReferences(doc: ContentDocument, adapter: IPersistenceAdapter): Promise<ContentDocument>;
+/**
+ * Find all content items that reference a specific slug in a specific collection.
+ *
+ * Scans all collections for reference fields pointing to the target collection,
+ * then checks each item's field values.
+ */
+export declare function findReferencingItems(targetCollection: string, targetSlug: string, adapter: IPersistenceAdapter, contentConfig: ContentConfig): Promise<Array<{
+    collection: string;
+    slug: string;
+    field: string;
+}>>;
+//# sourceMappingURL=reference-resolver.d.ts.map

package/dist/reference-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-resolver.d.ts","sourceRoot":"","sources":["../src/reference-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EAIpB,KAAK,mBAAmB,EAEzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AA4BpD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA2D1B;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,mBAAmB,EAC5B,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAuCrE"}