@materializecms/server 0.0.0-stage → 0.2.0

package/src/mail.d.ts

@@ -0,0 +1,33 @@
+/** Outgoing email settings, saved in the panel. The password never goes back to the browser. */
+export interface MailSettings {
+    host: string;
+    port: number;
+    /** tls: encrypted from the start (465) · starttls: upgraded after connecting (587) · none: plain (tests). */
+    security: 'tls' | 'starttls' | 'none';
+    user: string;
+    pass: string;
+    /** Sender shown to recipients, e.g. "Studio Rossi <sito@example.com>". */
+    from: string;
+    /** Where messages from the site's forms arrive. */
+    to: string;
+}
+export declare const EMPTY_MAIL: MailSettings;
+export declare function isConfigured(m: MailSettings | null): m is MailSettings;
+/** What the panel may see: everything but the password, and whether one is saved. */
+export declare function publicMail(m: MailSettings | null): {
+    host: string;
+    port: number;
+    security: 'tls' | 'starttls' | 'none';
+    user: string;
+    from: string;
+    to: string;
+    hasPassword: boolean;
+};
+export declare function sendMail(m: MailSettings, message: {
+    to: string;
+    subject: string;
+    text: string;
+    replyTo?: string;
+}): Promise<void>;
+/** A message from a site form as plain text: one "Label: value" per field. */
+export declare function submissionText(page: string, data: Record<string, string>): string;

package/src/mail.js

@@ -0,0 +1,36 @@
+import nodemailer from 'nodemailer';
+export const EMPTY_MAIL = {
+    host: '',
+    port: 587,
+    security: 'starttls',
+    user: '',
+    pass: '',
+    from: '',
+    to: '',
+};
+export function isConfigured(m) {
+    return !!m?.host && !!m.from;
+}
+/** What the panel may see: everything but the password, and whether one is saved. */
+export function publicMail(m) {
+    const { pass, ...rest } = { ...EMPTY_MAIL, ...m };
+    return { ...rest, hasPassword: !!pass };
+}
+export async function sendMail(m, message) {
+    const transport = nodemailer.createTransport({
+        host: m.host,
+        port: m.port,
+        secure: m.security === 'tls',
+        requireTLS: m.security === 'starttls',
+        ignoreTLS: m.security === 'none',
+        auth: m.user ? { user: m.user, pass: m.pass } : undefined,
+        connectionTimeout: 10_000,
+        greetingTimeout: 10_000,
+    });
+    await transport.sendMail({ from: m.from, ...message });
+}
+/** A message from a site form as plain text: one "Label: value" per field. */
+export function submissionText(page, data) {
+    const lines = Object.entries(data).map(([k, v]) => `${k}:\n${v}\n`);
+    return `Nuovo messaggio dal modulo del sito${page ? ` (pagina ${page})` : ''}.\n\n${lines.join('\n')}`;
+}

package/src/mcp.d.ts

@@ -0,0 +1,6 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type ApiCall, type SiteTool } from './tools.ts';
+/** Registers the site's tools on an MCP server; each call runs as the person behind `call`. */
+export declare function registerTools(server: McpServer, tools: SiteTool[]): void;
+/** A fresh MCP server for one request (stateless): the tools act as the person who sent it. */
+export declare function createMcpServer(call: ApiCall, version: string): McpServer;

package/src/mcp.js

@@ -0,0 +1,36 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { PAGE_GUIDE, siteTools, ToolError } from './tools.js';
+/** What an MCP client is told about the site when it connects. */
+const INSTRUCTIONS = `This server edits a website built with Materialize, a CMS with a visual page editor.
+Start with get_site to see the collections and their fields; list_entries and get_entry read content.
+Pages built on the canvas are edited with get_page (outline) and edit_page (operations). Changes are saved as drafts: publish_entry puts them online, so publish only when asked.
+${PAGE_GUIDE}`;
+/** Results as text the model reads: strings as they are, the rest as JSON. */
+const asText = (value) => (typeof value === 'string' ? value : JSON.stringify(value, null, 1));
+/** Registers the site's tools on an MCP server; each call runs as the person behind `call`. */
+export function registerTools(server, tools) {
+    for (const t of tools) {
+        server.registerTool(t.name, {
+            title: t.title,
+            description: t.description,
+            inputSchema: t.input,
+            annotations: { readOnlyHint: !!t.readOnly, destructiveHint: !t.readOnly && /remove|unpublish/.test(t.name) },
+        }, async (input) => {
+            try {
+                return { content: [{ type: 'text', text: asText(await t.run(input)) }] };
+            }
+            catch (error) {
+                if (!(error instanceof ToolError))
+                    console.error(error);
+                const message = error instanceof Error ? error.message : String(error);
+                return { content: [{ type: 'text', text: message }], isError: true };
+            }
+        });
+    }
+}
+/** A fresh MCP server for one request (stateless): the tools act as the person who sent it. */
+export function createMcpServer(call, version) {
+    const server = new McpServer({ name: 'materialize', title: 'Materialize', version }, { instructions: INSTRUCTIONS });
+    registerTools(server, siteTools(call));
+    return server;
+}

package/src/media.d.ts

@@ -0,0 +1,46 @@
+import type { MediaAsset } from '@materializecms/db';
+export declare const MAX_UPLOAD: number;
+/** Widths served to the site; requests snap to the nearest one so the cache stays small. */
+export declare const WIDTHS: number[];
+export declare const OUTPUTS: {
+    readonly avif: 'image/avif';
+    readonly webp: 'image/webp';
+    readonly jpg: 'image/jpeg';
+    readonly png: 'image/png';
+};
+export type Output = keyof typeof OUTPUTS;
+export declare class MediaError extends Error {
+}
+export declare const isMediaKey: (key: string) => boolean;
+export declare const mediaUrl: (asset: Pick<MediaAsset, 'key'>) => string;
+/** Files on disk: originals in `dir`, resized versions in `dir/.cache/<key>/`. */
+export declare function createMediaFiles(dir: string): {
+    /**
+     * Checks and stores an upload. Photos are turned upright and lose their metadata
+     * (camera details, GPS position), so publishing a picture never publishes where it was taken.
+     */
+    save(name: string, input: Buffer): Promise<{
+        key: string;
+        mime: string;
+        size: number;
+        width: null;
+        height: null;
+    } | {
+        key: string;
+        mime: string;
+        size: number;
+        width: number;
+        height: number;
+    }>;
+    remove(key: string): Promise<void>;
+    /** The original file, or a resized copy made on first request and kept for next time. */
+    open(key: string, variant?: {
+        width: number;
+        format: Output;
+    }): Promise<{
+        path: string;
+        type: string;
+    } | null>;
+};
+export declare function fileBody(path: string): ReadableStream;
+export type MediaFiles = ReturnType<typeof createMediaFiles>;

package/src/media.js

@@ -0,0 +1,126 @@
+import { randomBytes } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { Readable } from 'node:stream';
+import { slugify } from '@materializecms/core';
+import sharp, {} from 'sharp';
+/** Formats people can upload, by what the file really is (not by its name). */
+const FORMATS = { jpeg: 'jpg', png: 'png', webp: 'webp', gif: 'gif', heif: 'avif' };
+export const MAX_UPLOAD = 25 * 1024 * 1024;
+/** Widths served to the site; requests snap to the nearest one so the cache stays small. */
+export const WIDTHS = [320, 640, 960, 1280, 1600, 1920, 2560];
+export const OUTPUTS = { avif: 'image/avif', webp: 'image/webp', jpg: 'image/jpeg', png: 'image/png' };
+const KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*\.(jpg|png|webp|gif|avif|glb)$/;
+const TYPES = {
+    jpg: 'image/jpeg',
+    png: 'image/png',
+    webp: 'image/webp',
+    gif: 'image/gif',
+    avif: 'image/avif',
+    glb: 'model/gltf-binary',
+};
+/** A binary glTF 2 file: "glTF", version 2, then its declared length. */
+const isGlb = (b) => b.length > 20 && b.toString('latin1', 0, 4) === 'glTF' && b.readUInt32LE(4) === 2;
+export class MediaError extends Error {
+}
+export const isMediaKey = (key) => KEY.test(key);
+export const mediaUrl = (asset) => `/media/${asset.key}`;
+/** Files on disk: originals in `dir`, resized versions in `dir/.cache/<key>/`. */
+export function createMediaFiles(dir) {
+    const root = resolve(dir);
+    const pending = new Map();
+    return {
+        /**
+         * Checks and stores an upload. Photos are turned upright and lose their metadata
+         * (camera details, GPS position), so publishing a picture never publishes where it was taken.
+         */
+        async save(name, input) {
+            // 3D models for WebGL scenes, kept as they are.
+            if (isGlb(input)) {
+                const base = slugify(name.replace(/\.[^.]+$/, ''), 48) || 'modello';
+                const key = `${base}-${randomBytes(4).toString('hex')}.glb`;
+                await mkdir(root, { recursive: true });
+                await writeFile(join(root, key), input);
+                return { key, mime: TYPES.glb, size: input.length, width: null, height: null };
+            }
+            let meta;
+            try {
+                meta = await sharp(input, { animated: true }).metadata();
+            }
+            catch {
+                throw new MediaError('Il file non è un’immagine leggibile né un modello 3D (.glb)');
+            }
+            const format = meta.format;
+            if (!(format in FORMATS))
+                throw new MediaError('Formato non supportato: usa JPG, PNG, WebP, AVIF o GIF');
+            const ext = FORMATS[format];
+            let output = input;
+            let width = meta.width;
+            let height = meta.autoOrient?.height ?? meta.height;
+            if (format === 'jpeg' || format === 'png' || format === 'webp') {
+                const { data, info } = await sharp(input)
+                    .rotate()
+                    .toFormat(format, format === 'png' ? { compressionLevel: 9 } : { quality: 90 })
+                    .toBuffer({ resolveWithObject: true });
+                output = data;
+                width = info.width;
+                height = info.height;
+            }
+            const base = slugify(name.replace(/\.[^.]+$/, ''), 48) || 'immagine';
+            const key = `${base}-${randomBytes(4).toString('hex')}.${ext}`;
+            await mkdir(root, { recursive: true });
+            await writeFile(join(root, key), output);
+            return { key, mime: TYPES[ext], size: output.length, width: width ?? null, height: height ?? null };
+        },
+        async remove(key) {
+            if (!isMediaKey(key))
+                return;
+            await rm(join(root, key), { force: true });
+            await rm(join(root, '.cache', key), { recursive: true, force: true });
+        },
+        /** The original file, or a resized copy made on first request and kept for next time. */
+        async open(key, variant) {
+            if (!isMediaKey(key))
+                return null;
+            const original = join(root, key);
+            if (!(await stat(original).catch(() => null))?.isFile())
+                return null;
+            if (!variant || key.endsWith('.gif') || key.endsWith('.glb')) {
+                return { path: original, type: TYPES[key.split('.').pop()] };
+            }
+            const width = WIDTHS.find((w) => w >= variant.width) ?? WIDTHS[WIDTHS.length - 1];
+            const path = join(root, '.cache', key, `${width}.${variant.format}`);
+            if (!(await stat(path).catch(() => null))) {
+                let job = pending.get(path);
+                if (!job) {
+                    job = render(original, path, width, variant.format).finally(() => pending.delete(path));
+                    pending.set(path, job);
+                }
+                await job;
+            }
+            return { path, type: OUTPUTS[variant.format] };
+        },
+    };
+}
+async function render(source, target, width, format) {
+    await mkdir(join(target, '..'), { recursive: true });
+    const image = sharp(await readFile(source))
+        .rotate()
+        .resize({ width, withoutEnlargement: true });
+    const encoded = format === 'avif'
+        ? image.avif({ quality: 55, effort: 4 })
+        : format === 'webp'
+            ? image.webp({ quality: 78 })
+            : format === 'png'
+                ? image.png({ compressionLevel: 9 })
+                : image.jpeg({ quality: 80, mozjpeg: true });
+    // Written aside and renamed, so a half-written file is never served.
+    const tmp = `${target}.${randomBytes(4).toString('hex')}.tmp`;
+    await writeFile(tmp, await encoded.toBuffer());
+    await rename(tmp, target);
+    return target;
+}
+export function fileBody(path) {
+    return Readable.toWeb(createReadStream(path));
+}

package/src/password.d.ts

@@ -0,0 +1,3 @@
+/** scrypt from the Node standard library: no native dependency to install. */
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;

package/src/password.js

@@ -0,0 +1,25 @@
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+const PARAMS = { N: 2 ** 15, r: 8, p: 1, keylen: 32 };
+function derive(password, salt, o) {
+    const options = { N: o.N, r: o.r, p: o.p, maxmem: 128 * o.N * o.r * 2 };
+    return new Promise((resolve, reject) => scrypt(password.normalize('NFKC'), salt, o.keylen, options, (err, key) => (err ? reject(err) : resolve(key))));
+}
+/** scrypt from the Node standard library: no native dependency to install. */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = await derive(password, salt, PARAMS);
+    return ['scrypt', PARAMS.N, PARAMS.r, PARAMS.p, salt.toString('base64url'), key.toString('base64url')].join('$');
+}
+export async function verifyPassword(password, stored) {
+    const [scheme, n, r, p, salt, hash] = stored.split('$');
+    if (scheme !== 'scrypt' || !salt || !hash)
+        return false;
+    const expected = Buffer.from(hash, 'base64url');
+    const key = await derive(password, Buffer.from(salt, 'base64url'), {
+        N: Number(n),
+        r: Number(r),
+        p: Number(p),
+        keylen: expected.length,
+    });
+    return key.length === expected.length && timingSafeEqual(key, expected);
+}

package/src/remote.d.ts

@@ -0,0 +1,32 @@
+/** Raised when a remote file cannot be fetched: the message says why, in words. */
+export declare class RemoteError extends Error {
+}
+export interface RemoteResponse {
+    status: number;
+    headers: Headers;
+    bytes: Buffer;
+    type: string;
+    /** The file name at the final address (after redirects). */
+    name: string;
+    url: string;
+}
+/**
+ * Fetches from the web: http(s) only, redirects checked one by one, at most `max` bytes. Addresses
+ * on this machine or its network are refused, unless `allowPrivate` (an administrator importing
+ * from a WordPress on their own network). Headers are sent to the first host only.
+ */
+export declare function remoteFetch(url: string, options: {
+    max: number;
+    headers?: Record<string, string>;
+    allowPrivate?: boolean;
+    timeout?: number;
+}): Promise<RemoteResponse>;
+/**
+ * Downloads a public file (an image an AI found on the web): http(s) only, never to an address on
+ * this machine or its network, redirects checked one by one, at most `max` bytes.
+ */
+export declare function fetchPublicFile(url: string, max: number): Promise<{
+    bytes: Buffer;
+    type: string;
+    name: string;
+}>;

package/src/remote.js

@@ -0,0 +1,78 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+/** Raised when a remote file cannot be fetched: the message says why, in words. */
+export class RemoteError extends Error {
+}
+/** Loopback, private, link-local and other addresses a public file never lives at. */
+function isPrivate(address) {
+    if (isIP(address) === 6) {
+        const a = address.toLowerCase();
+        if (a.startsWith('::ffff:'))
+            return isPrivate(a.slice(7));
+        return a === '::1' || a === '::' || a.startsWith('fc') || a.startsWith('fd') || a.startsWith('fe80');
+    }
+    const [x = 0, y = 0] = address.split('.').map(Number);
+    return (x === 10 ||
+        x === 127 ||
+        x === 0 ||
+        (x === 169 && y === 254) ||
+        (x === 172 && y >= 16 && y <= 31) ||
+        (x === 192 && y === 168) ||
+        (x === 100 && y >= 64 && y <= 127) ||
+        x >= 224);
+}
+/**
+ * Fetches from the web: http(s) only, redirects checked one by one, at most `max` bytes. Addresses
+ * on this machine or its network are refused, unless `allowPrivate` (an administrator importing
+ * from a WordPress on their own network). Headers are sent to the first host only.
+ */
+export async function remoteFetch(url, options) {
+    let current = new URL(url);
+    const origin = current.origin;
+    for (let hop = 0; hop < 5; hop++) {
+        if (current.protocol !== 'https:' && current.protocol !== 'http:')
+            throw new RemoteError('Only http and https addresses');
+        if (!options.allowPrivate) {
+            const host = current.hostname.replace(/^\[|\]$/g, '');
+            const addresses = isIP(host) ? [host] : (await lookup(host, { all: true })).map((a) => a.address);
+            if (!addresses.length || addresses.some(isPrivate))
+                throw new RemoteError('This address is not public');
+        }
+        const res = await fetch(current, {
+            redirect: 'manual',
+            headers: current.origin === origin ? options.headers : undefined,
+            signal: AbortSignal.timeout(options.timeout ?? 15_000),
+        });
+        if (res.status >= 300 && res.status < 400) {
+            const to = res.headers.get('location');
+            if (!to)
+                throw new RemoteError(`Redirect without a destination (${res.status})`);
+            current = new URL(to, current);
+            continue;
+        }
+        const type = (res.headers.get('content-type') ?? '').split(';')[0]?.trim() ?? '';
+        if (Number(res.headers.get('content-length') ?? 0) > options.max)
+            throw new RemoteError('The file is too large');
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of res.body ?? []) {
+            size += chunk.length;
+            if (size > options.max)
+                throw new RemoteError('The file is too large');
+            chunks.push(Buffer.from(chunk));
+        }
+        const name = decodeURIComponent(current.pathname.split('/').pop() || 'immagine');
+        return { status: res.status, headers: res.headers, bytes: Buffer.concat(chunks), type, name, url: current.href };
+    }
+    throw new RemoteError('Too many redirects');
+}
+/**
+ * Downloads a public file (an image an AI found on the web): http(s) only, never to an address on
+ * this machine or its network, redirects checked one by one, at most `max` bytes.
+ */
+export async function fetchPublicFile(url, max) {
+    const res = await remoteFetch(url, { max });
+    if (res.status < 200 || res.status >= 300)
+        throw new RemoteError(`The server answered ${res.status}`);
+    return { bytes: res.bytes, type: res.type, name: res.name };
+}

package/src/status-page.d.ts

@@ -0,0 +1,3 @@
+import type { MaterializeConfig } from '@materializecms/core';
+/** Page served at "/" until the site renderer ships: confirms the server works and links to the admin. */
+export declare function statusPage(config: MaterializeConfig, version: string, needsSetup: boolean): Promise<import("hono/utils/html").HtmlEscapedString> | import("hono/utils/html").HtmlEscapedString;

package/src/status-page.js

@@ -0,0 +1,39 @@
+import { html } from 'hono/html';
+/** Page served at "/" until the site renderer ships: confirms the server works and links to the admin. */
+export function statusPage(config, version, needsSetup) {
+    const rows = config.collections.map((c) => html `<li><span>${c.label}</span><code>/api/content/${c.name}</code></li>`);
+    return html `<!doctype html>
+    <html lang="it">
+      <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>${config.site.name} · Materialize</title>
+        <style>
+          :root { color-scheme: light dark; --bg: #fafafa; --fg: #0a0a0b; --muted: #5e5e66; --line: #e6e6ea; --accent: #3d5afe; }
+          @media (prefers-color-scheme: dark) { :root { --bg: #0b0b0c; --fg: #ededef; --muted: #a1a1aa; --line: #232327; --accent: #7c93ff; } }
+          * { box-sizing: border-box; }
+          body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px 16px; background: var(--bg); color: var(--fg); font: 15px/1.55 system-ui, -apple-system, 'Segoe UI', sans-serif; }
+          main { width: 100%; max-width: 560px; }
+          .mark { width: 36px; height: 36px; border-radius: 9px; background: var(--accent); display: grid; place-items: center; color: #fff; font-weight: 700; }
+          h1 { font-size: 22px; margin: 20px 0 4px; letter-spacing: -0.01em; }
+          p { margin: 0 0 16px; color: var(--muted); }
+          ul { list-style: none; padding: 0; margin: 20px 0; border-top: 1px solid var(--line); }
+          li { display: flex; justify-content: space-between; gap: 16px; padding: 12px 0; border-bottom: 1px solid var(--line); flex-wrap: wrap; }
+          code { font: 13px ui-monospace, 'SF Mono', monospace; color: var(--muted); }
+          .note { padding: 12px 14px; border-radius: 10px; border: 1px solid var(--line); font-size: 14px; }
+          .button { display: inline-flex; align-items: center; height: 40px; padding: 0 18px; border-radius: 10px; background: var(--fg); color: var(--bg); font-weight: 600; text-decoration: none; }
+        </style>
+      </head>
+      <body>
+        <main>
+          <div class="mark" aria-hidden="true">M</div>
+          <h1>${config.site.name} è online</h1>
+          <p>Materialize ${version} · ${config.collections.length} collezioni · lingue: ${config.locales.available.join(', ')}</p>
+          <ul>
+            ${rows}
+          </ul>
+          <a class="button" href="/admin/">${needsSetup ? 'Configura il pannello' : 'Apri il pannello'}</a>
+        </main>
+      </body>
+    </html>`;
+}

package/src/tools.d.ts

@@ -0,0 +1,116 @@
+import { type PageNode } from '@materializecms/core/page';
+import { z } from 'zod';
+/**
+ * What an AI can do with the site, shared by the MCP server and the editor's assistant. Every tool
+ * goes through the HTTP API as the person who asked (their token or their session), so it can do
+ * exactly what they could do in the panel: the same checks, the same Content mode limits.
+ */
+/** Calls the site's own API as the person using the tools. */
+export type ApiCall = <T = unknown>(method: string, path: string, body?: unknown) => Promise<T>;
+/** A page being edited: loaded and saved through the API, or held by the editor (the assistant). */
+export interface PageSource {
+    load: () => Promise<PageNode[]>;
+    save: (nodes: PageNode[]) => Promise<void>;
+}
+export interface SiteTool {
+    name: string;
+    /** A short title for clients that show one. */
+    title: string;
+    description: string;
+    input: z.ZodObject;
+    /** Only reads: clients may run it without asking. */
+    readOnly?: boolean;
+    run: (input: never) => Promise<unknown>;
+}
+/** An answer the model can act on: what went wrong, in words. */
+export declare class ToolError extends Error {
+}
+type FieldInfo = {
+    name: string;
+    kind: string;
+    label?: string;
+};
+type CollectionInfo = {
+    name: string;
+    label?: string;
+    singleton?: boolean;
+    fields: FieldInfo[];
+    titleField?: string;
+    slugField?: string;
+};
+type Schema = {
+    site: {
+        name: string;
+    };
+    locales: {
+        default: string;
+        available: string[];
+    };
+    collections: CollectionInfo[];
+};
+/** How the page model works, for a model that is about to edit one. */
+export declare const PAGE_GUIDE = "Pages are trees of nodes. The top level holds sections (type \"frame\"); sections hold frames, texts, images, buttons, icons, videos, scenes and form inputs.\nEvery node has an \"id\" (keep existing ids; new nodes may omit it, one is assigned) and a \"type\".\n\nCommon properties:\n- Layout of a frame: layout \"col\" | \"row\" | \"grid\", cols (grid columns), gap (px), align \"start\"|\"center\"|\"end\"|\"stretch\", justify \"start\"|\"center\"|\"end\"|\"between\", wrap.\n- Size: width \"fill\"|\"hug\"|\"fixed\" with fixedW, maxW, h (px or \"60vh\"), minH (percent of screen height, sections), padX/padY (px), size \"xs\"|\"s\"|\"m\"|\"l\" (a section's vertical padding).\n- Look: bg (theme token or CSS color), scheme \"default\"|\"surface\"|\"inverse\"|\"accent\" (a section's color scheme), radius (px | \"btn\" | \"card\"), border, shadow \"none\"|\"sm\"|\"lg\", gradient, bgImage {src, alt}, bgDim 0-1.\n- Text (\"text\"): text (plain) or runs [{t, b?, i?, href?}], style \"display\"|\"h1\"|\"h2\"|\"h3\"|\"body\"|\"small\"|\"eyebrow\"|\"logo\"|\"button\", tag \"h1\"..\"h4\"|\"p\" (HTML element, defaults from style), color, talign \"left\"|\"center\"|\"right\", fontSize, weight, upper, italic.\n- Button (\"button\"): text, href, variant \"primary\"|\"secondary\"|\"ghost\", newTab.\n- Image (\"image\"): src (a URL from the media library, e.g. /media/photo.jpg), alt, ratio (\"16/9\", \"1/1\"\u2026), fit \"cover\"|\"contain\".\n- Icon (\"icon\"): icon \"lucide:arrow-right\" style names.\n- Motion: anim \"fade\"|\"up\"|\"down\"|\"left\"|\"right\"|\"zoom\"|\"blur\"|\"reveal\"|\"pop\", animTrig \"load\"|\"scroll\", hover \"lift\"|\"grow\"|\"dim\"|\"zoomimg\".\n- Tablet and mobile changes go in over: {tablet: {...}, mobile: {...}} (only the properties that differ).\nTheme color tokens: bg, surface, text, muted, accent, onAccent, inverse, onInverse, border, line.\nPrefer adding ready-made sections from the library (add_section) and then changing their texts, images and colors: they are designed and responsive. Write content in the site's language.";
+/** One line per node, indented: what the model reads before editing. */
+export declare function outline(nodes: PageNode[]): string;
+declare const operation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    op: z.ZodLiteral<"add_section">;
+    key: z.ZodString;
+    index: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"insert">;
+    parentId: z.ZodNullable<z.ZodString>;
+    index: z.ZodOptional<z.ZodNumber>;
+    node: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"update">;
+    nodeId: z.ZodString;
+    props: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"replace">;
+    nodeId: z.ZodString;
+    node: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"remove">;
+    nodeId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"move">;
+    nodeId: z.ZodString;
+    parentId: z.ZodNullable<z.ZodString>;
+    index: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"duplicate">;
+    nodeId: z.ZodString;
+}, z.core.$strip>], "op">;
+export type PageOperation = z.infer<typeof operation>;
+/** Applies edits to a page tree; stops at the first that cannot apply, saying which and why. */
+export declare function applyOperations(nodes: PageNode[], ops: PageOperation[], brand: string): PageNode[];
+/** The page tools: read the outline and a node, and edit. */
+export declare function pageTools(options: {
+    /** The page to work on: by document id (MCP), or the one open in the editor (no id). */
+    source: (id: string | undefined) => Promise<PageSource>;
+    withId: boolean;
+    brand: () => Promise<string>;
+}): SiteTool[];
+/** Tools for the whole site: collections and entries, pages by id, theme, media. */
+export declare function siteTools(call: ApiCall): SiteTool[];
+/**
+ * The editor's assistant: the site tools that make sense next to the open page (no publishing:
+ * the editor has its own button), and page tools working on the page as the editor holds it.
+ */
+export declare function assistantTools(call: ApiCall, page: {
+    nodes: PageNode[];
+}, brand: string): SiteTool[];
+/** Everything but the page editing: shared with the editor's assistant, which edits the open page itself. */
+export declare function contentTools(call: ApiCall, getSchema: () => Promise<Schema>): SiteTool[];
+/**
+ * Calls the API as whoever sent `auth` (cookie or bearer header): in process through the Hono app's
+ * `fetch`, or over the network to a running server at `origin` (`materialize mcp`).
+ */
+export declare function apiCaller(fetch: (req: Request) => Response | Promise<Response>, auth: Record<string, string>, origin?: string): ApiCall;
+export {};