@lemonadecms/client 0.0.0-stage → 0.1.1

package/dist/rich-text.js

@@ -0,0 +1,228 @@
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+const model = /^[a-z][a-z0-9_]{0,47}$/;
+const encoder = new TextEncoder();
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function escape(value) {
+    return value.replace(/[&<>"']/g, (character) => {
+        switch (character) {
+            case '&':
+                return '&amp;';
+            case '<':
+                return '&lt;';
+            case '>':
+                return '&gt;';
+            case '"':
+                return '&quot;';
+            default:
+                return '&#39;';
+        }
+    });
+}
+function safeUrl(value, image) {
+    if (typeof value !== 'string' ||
+        value.length > (image ? 4096 : 2048) ||
+        /[\s\\\u0000-\u0020\u007f-\u009f]/u.test(value))
+        return null;
+    // Only the consuming-site preview proxy's fixed same-origin route is relative.
+    if (image &&
+        /^\/lemonade\/preview\/assets\/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value))
+        return value;
+    if (!/^https?:\/\//i.test(value) && (image || !/^mailto:/i.test(value)))
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.username || url.password)
+            return null;
+        if ((url.protocol === 'https:' || url.protocol === 'http:') && url.hostname)
+            return value;
+        return !image && url.protocol === 'mailto:' && url.pathname ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function matchingResource(node) {
+    const attrs = node.attrs, resource = node.resource;
+    if (!record(attrs) ||
+        !record(resource) ||
+        typeof attrs.id !== 'string' ||
+        attrs.id.length !== 36 ||
+        !uuid.test(attrs.id) ||
+        typeof resource.id !== 'string' ||
+        resource.id.length !== 36 ||
+        attrs.id.toLowerCase() !== resource.id.toLowerCase())
+        return null;
+    return resource;
+}
+function convert(value, format) {
+    if (!record(value) ||
+        value.version !== 1 ||
+        !record(value.document) ||
+        value.document.type !== 'doc')
+        return '';
+    // The CMS bounds the authored document. Apply independent bounds to unknown
+    // consumer input and expanded strings as well; exhaustion discards all output.
+    let remaining = 500, embeds = 20, bytes = 65_536, exhausted = false;
+    function string(value, maximum = 20_000) {
+        if (typeof value !== 'string')
+            return '';
+        if (value.length > maximum) {
+            exhausted = true;
+            return '';
+        }
+        const size = encoder.encode(value).byteLength;
+        bytes -= size;
+        if (size > maximum || bytes < 0) {
+            exhausted = true;
+            return '';
+        }
+        return value;
+    }
+    function visit(value, context, depth) {
+        if (exhausted)
+            return '';
+        if (depth > 8 || --remaining < 0) {
+            exhausted = true;
+            return '';
+        }
+        if (!record(value))
+            return '';
+        const children = (next) => {
+            if (value.content === undefined)
+                return '';
+            if (!Array.isArray(value.content) || value.content.length > 200) {
+                exhausted = true;
+                return '';
+            }
+            return value.content.map((child) => visit(child, next, depth + 1)).join('');
+        };
+        if (context === 'inline') {
+            if (value.type === 'hardBreak')
+                return format === 'html' ? '<br>' : '\n';
+            if (value.type !== 'text')
+                return '';
+            const source = string(value.text);
+            if (format === 'text')
+                return source;
+            let text = escape(source);
+            const marks = value.marks;
+            if (marks !== undefined && (!Array.isArray(marks) || marks.length > 6)) {
+                exhausted = true;
+                return '';
+            }
+            const seen = new Set();
+            for (const mark of Array.isArray(marks) ? marks : []) {
+                if (!record(mark) ||
+                    typeof mark.type !== 'string' ||
+                    mark.type.length > 9 ||
+                    seen.has(mark.type))
+                    continue;
+                seen.add(mark.type);
+                switch (mark.type) {
+                    case 'bold':
+                        text = `<strong>${text}</strong>`;
+                        break;
+                    case 'italic':
+                        text = `<em>${text}</em>`;
+                        break;
+                    case 'underline':
+                        text = `<u>${text}</u>`;
+                        break;
+                    case 'strike':
+                        text = `<s>${text}</s>`;
+                        break;
+                    case 'code':
+                        text = `<code>${text}</code>`;
+                        break;
+                    case 'link': {
+                        const href = safeUrl(record(mark.attrs) ? mark.attrs.href : null, false);
+                        if (href)
+                            text = `<a href="${escape(string(href, 2048))}" rel="noopener noreferrer">${text}</a>`;
+                    }
+                }
+            }
+            return text;
+        }
+        if (context === 'root')
+            return value.type === 'doc' ? children('block') : '';
+        if (context === 'list') {
+            if (value.type !== 'listItem')
+                return '';
+            const content = children('item');
+            return format === 'html' ? `<li>${content}</li>` : content.trimEnd() + '\n';
+        }
+        if (value.type === 'paragraph') {
+            const content = children('inline');
+            return format === 'html'
+                ? `<p>${content}</p>`
+                : content + (context === 'item' ? '\n' : '\n\n');
+        }
+        if (value.type === 'bulletList' || value.type === 'orderedList') {
+            const content = children('list');
+            const tag = value.type === 'bulletList' ? 'ul' : 'ol';
+            return format === 'html'
+                ? `<${tag}>${content}</${tag}>`
+                : content + (context === 'item' ? '' : '\n');
+        }
+        if (context !== 'block')
+            return '';
+        if (value.type === 'heading') {
+            if (!record(value.attrs) ||
+                typeof value.attrs.level !== 'number' ||
+                ![2, 3, 4].includes(value.attrs.level))
+                return '';
+            const content = children('inline');
+            return format === 'html'
+                ? `<h${value.attrs.level}>${content}</h${value.attrs.level}>`
+                : content + '\n\n';
+        }
+        if (value.type !== 'image' && value.type !== 'entry')
+            return '';
+        if (--embeds < 0) {
+            exhausted = true;
+            return '';
+        }
+        if (format === 'text')
+            return '';
+        const resource = matchingResource(value);
+        if (!resource || !record(value.attrs))
+            return '';
+        if (value.type === 'image') {
+            if (typeof resource.content_type !== 'string' ||
+                !['image/jpeg', 'image/png', 'image/webp', 'image/gif'].includes(resource.content_type))
+                return '';
+            const src = safeUrl(resource.url, true);
+            if (!src)
+                return '';
+            const metadata = record(resource.metadata) ? resource.metadata : {};
+            const alt = typeof value.attrs.alt === 'string' ? value.attrs.alt : metadata.alt;
+            return `<figure><img src="${escape(string(src, 4096))}" alt="${escape(string(alt, 2000))}" loading="lazy" decoding="async"></figure>`;
+        }
+        if (typeof value.attrs.target !== 'string' ||
+            value.attrs.target.length > 48 ||
+            model.exec(value.attrs.target)?.[0] !== value.attrs.target ||
+            (resource.content_type !== undefined &&
+                (!record(resource.content_type) ||
+                    resource.content_type.key !== value.attrs.target)) ||
+            !record(resource.fields))
+            return '';
+        const caption = typeof resource.fields.title === 'string'
+            ? resource.fields.title
+            : resource.fields.name;
+        return typeof caption === 'string'
+            ? `<aside class="rich-text-reference"><p>${escape(string(caption))}</p></aside>`
+            : '';
+    }
+    const output = visit(value.document, 'root', 0);
+    return exhausted ? '' : format === 'text' ? output.trim() : output;
+}
+/** Escaped HTML for rich-text v1, including safe expanded images/entry captions. */
+export function richTextToHtml(value) {
+    return convert(value, 'html');
+}
+/** Authored text with block/hard-break newlines; excludes embeds and link URLs. */
+export function richTextToPlainText(value) {
+    return convert(value, 'text');
+}

package/dist/server.browser.d.ts

@@ -0,0 +1,2 @@
+export * from "./errors.js";
+export declare function createCMSPreviewClient(): never;

package/dist/server.browser.js

@@ -0,0 +1,9 @@
+// Browser-condition replacement for the server-only entry point.
+// A bundler resolving the package with the browser condition loads this module
+// instead of server.ts. Calling its factory fails immediately, before any fetch.
+// Keep real secret keys in server configuration regardless of this guard.
+import { CMSConfigurationError } from "./errors.js";
+export * from "./errors.js";
+export function createCMSPreviewClient() {
+    throw new CMSConfigurationError("The preview client must run on a server. Import @lemonadecms/client for published content.");
+}

package/dist/server.d.ts

@@ -0,0 +1,10 @@
+import type { CMSClient, CMSPreviewOptions, ModelMap, PreviewModels, UntypedModels } from "./types.js";
+export * from "./errors.js";
+export type { CountOptions, GetManyOptions, ContentSearch, SearchOptions, TextField } from "./types.js";
+export type { CMSPreviewOptions, PreviewModels, ContentEntry, ContentPage, ContentTypeIdentity, ContentEnvironment, FindOneOptions } from "./types.js";
+/** Import only from server-owned code. Draft fields may be missing or null. */
+export declare function createCMSPreviewClient<Models extends ModelMap<Models> = UntypedModels>(options: CMSPreviewOptions): CMSClient<PreviewModels<Models>>;
+export { imageSrcSet } from "./images.js";
+export type { RemoteValue } from "./types.js";
+export type { ContentRendition } from "./images.js";
+export { richTextToHtml, richTextToPlainText } from "./rich-text.js";

package/dist/server.js

@@ -0,0 +1,17 @@
+// Server-only preview factory, exported as @lemonadecms/client/server.
+// Preview reads the latest draft with a secret key. The package browser condition
+// and the runtime browser-global check both help catch accidental client imports;
+// the backend's authorization remains the actual security boundary.
+// PreviewModels expresses that unpublished values can be absent or null.
+import { createTransport } from "./transport.js";
+import { CMSConfigurationError } from "./errors.js";
+export * from "./errors.js";
+/** Import only from server-owned code. Draft fields may be missing or null. */
+export function createCMSPreviewClient(options) {
+    if (typeof window !== "undefined" || typeof document !== "undefined") {
+        throw new CMSConfigurationError("The preview client must run on a server.");
+    }
+    return createTransport(options, options?.secretKey, "preview");
+}
+export { imageSrcSet } from "./images.js";
+export { richTextToHtml, richTextToPlainText } from "./rich-text.js";

package/dist/transport.d.ts

@@ -0,0 +1,3 @@
+import type { CMSBaseOptions, CMSClient, ModelMap } from "./types.js";
+/** Internal shared transport; public exports choose the credential and route. */
+export declare function createTransport<Models extends ModelMap<Models>>(options: CMSBaseOptions, key: unknown, mode: "content" | "preview"): CMSClient<Models>;