@micacms/runtime 0.2.0

package/dist/lib/schema-stats.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Summarises a content model.
+ *
+ * The admin already receives the whole model and could count fields itself, but
+ * the interesting numbers are the recursive ones — objects and repeaters nest —
+ * and the relation graph, which is only visible after walking every branch.
+ * Doing it here keeps that walk in one place, next to the schema checks that
+ * use the same shapes.
+ *
+ * Pure: it reads a `Site` and nothing else, so it is the same answer for the
+ * same model whatever the state of the database.
+ */
+import { type FieldKind, type Site } from "@micacms/core";
+export interface KindUsage {
+    kind: FieldKind;
+    count: number;
+}
+export interface RelationEdge {
+    /** Collection or singleton the field is declared in. */
+    from: string;
+    fromType: "collection" | "singleton";
+    /** Dotted path to the field, with `[]` marking a repeater. */
+    path: string;
+    /** Collection the relation points at. */
+    to: string;
+    multiple: boolean;
+}
+export interface FieldCounts {
+    /** Fields declared directly on the collection or singleton. */
+    top: number;
+    /** Every field, including those nested in objects and repeaters. */
+    total: number;
+    required: number;
+}
+export interface CollectionStats {
+    name: string;
+    label: string;
+    fields: FieldCounts;
+    titleField: string | null;
+    slugField: string | null;
+    listed: number;
+    sortable: boolean;
+    /** Deepest level of nesting; 1 means no objects or repeaters. */
+    depth: number;
+}
+export interface SingletonStats {
+    name: string;
+    label: string;
+    fields: FieldCounts;
+    depth: number;
+}
+export interface SchemaStats {
+    collections: CollectionStats[];
+    singletons: SingletonStats[];
+    totals: FieldCounts & {
+        collections: number;
+        singletons: number;
+    };
+    /** Field kinds in use, most used first. */
+    kinds: KindUsage[];
+    relations: RelationEdge[];
+}
+export declare function schemaStats(site: Site): SchemaStats;
+//# sourceMappingURL=schema-stats.d.ts.map

package/dist/lib/schema-stats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-stats.d.ts","sourceRoot":"","sources":["../../src/lib/schema-stats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAKL,KAAK,SAAS,EAEd,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,GAAG,WAAW,CAAC;IACrC,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,2CAA2C;IAC3C,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AA2CD,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,CAkEnD"}

package/dist/lib/schema-stats.js

@@ -0,0 +1,103 @@
+/**
+ * Summarises a content model.
+ *
+ * The admin already receives the whole model and could count fields itself, but
+ * the interesting numbers are the recursive ones — objects and repeaters nest —
+ * and the relation graph, which is only visible after walking every branch.
+ * Doing it here keeps that walk in one place, next to the schema checks that
+ * use the same shapes.
+ *
+ * Pure: it reads a `Site` and nothing else, so it is the same answer for the
+ * same model whatever the state of the database.
+ */
+import { listedFields, resolveSlugField, resolveTitleField, } from "@micacms/core";
+/** The two kinds that carry a nested `fields` map. */
+function children(field) {
+    return field.kind === "object" || field.kind === "repeater" ? field.fields : null;
+}
+/**
+ * Depth-first walk over a field map, visiting nested fields too.
+ *
+ * `path` is what an editor would say out loud — `blocks[].heading` rather than
+ * `blocks.fields.heading` — so it can be printed as-is.
+ */
+function walk(fields, visit, prefix = "", depth = 1) {
+    for (const [key, field] of Object.entries(fields)) {
+        const path = prefix ? `${prefix}.${key}` : key;
+        visit(key, field, path, depth);
+        const nested = children(field);
+        if (nested) {
+            walk(nested, visit, field.kind === "repeater" ? `${path}[]` : path, depth + 1);
+        }
+    }
+}
+function countFields(fields) {
+    const counts = { top: Object.keys(fields).length, total: 0, required: 0 };
+    let deepest = 1;
+    walk(fields, (_key, field, _path, depth) => {
+        counts.total++;
+        if (field.required)
+            counts.required++;
+        if (depth > deepest)
+            deepest = depth;
+    });
+    return { counts, depth: deepest };
+}
+export function schemaStats(site) {
+    const kinds = new Map();
+    const relations = [];
+    const totals = {
+        collections: 0,
+        singletons: 0,
+        top: 0,
+        total: 0,
+        required: 0,
+    };
+    const tally = (fields, from, fromType) => {
+        walk(fields, (_key, field, path) => {
+            kinds.set(field.kind, (kinds.get(field.kind) ?? 0) + 1);
+            if (field.kind === "relation") {
+                relations.push({ from, fromType, path, to: field.collection, multiple: field.multiple ?? false });
+            }
+        });
+    };
+    const collections = Object.values(site.collections).map((def) => {
+        const { counts, depth } = countFields(def.fields);
+        tally(def.fields, def.name, "collection");
+        totals.collections++;
+        totals.top += counts.top;
+        totals.total += counts.total;
+        totals.required += counts.required;
+        return {
+            name: def.name,
+            label: def.label,
+            fields: counts,
+            // The same resolution the editor sees, not the raw declaration: both keys
+            // are optional in the model and fall back to a convention.
+            titleField: resolveTitleField(def) ?? null,
+            slugField: resolveSlugField(def) ?? null,
+            listed: listedFields(def).length,
+            sortable: def.sortable ?? false,
+            depth,
+        };
+    });
+    const singletons = Object.values(site.singletons).map((def) => {
+        const { counts, depth } = countFields(def.fields);
+        tally(def.fields, def.name, "singleton");
+        totals.singletons++;
+        totals.top += counts.top;
+        totals.total += counts.total;
+        totals.required += counts.required;
+        return { name: def.name, label: def.label, fields: counts, depth };
+    });
+    return {
+        collections,
+        singletons,
+        totals,
+        kinds: [...kinds]
+            .map(([kind, count]) => ({ kind, count }))
+            .sort((a, b) => b.count - a.count || a.kind.localeCompare(b.kind)),
+        relations,
+    };
+}
+//# sourceMappingURL=schema-stats.js.map

package/dist/lib/schema-stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-stats.js","sourceRoot":"","sources":["../../src/lib/schema-stats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAKlB,MAAM,eAAe,CAAC;AAsDvB,sDAAsD;AACtD,SAAS,QAAQ,CAAC,KAAe;IAC/B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI,CACX,MAAgB,EAChB,KAA0E,EAC1E,MAAM,GAAG,EAAE,EACX,KAAK,GAAG,CAAC;IAET,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAE/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAgB;IACnC,MAAM,MAAM,GAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvF,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,GAAG,OAAO;YAAE,OAAO,GAAG,KAAK,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAU;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,SAAS,GAAmB,EAAE,CAAC;IAErC,MAAM,MAAM,GAA8D;QACxE,WAAW,EAAE,CAAC;QACd,UAAU,EAAE,CAAC;QACb,GAAG,EAAE,CAAC;QACN,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,CAAC;KACZ,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,MAAgB,EAAE,IAAY,EAAE,QAAkC,EAAQ,EAAE;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACjC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAExD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAmB,EAAE;QAC/E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAE1C,MAAM,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC;QACzB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;QAEnC,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,MAAM;YACd,0EAA0E;YAC1E,2DAA2D;YAC3D,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,IAAI;YAC1C,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI;YACxC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;YAC/B,KAAK;SACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAkB,EAAE;QAC5E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEzC,MAAM,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC;QACzB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;QAEnC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,UAAU;QACV,MAAM;QACN,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;aACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpE,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/lib/version.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The version of this build, read from the package manifest.
+ *
+ * Read rather than imported: an import would need a JSON module attribute and
+ * would put a second copy of the manifest in `dist/`. The file is a fixed
+ * distance from this module in both layouts — `src/lib` and `dist/lib`
+ * are the same depth below the package root, and the Docker image copies
+ * `package.json` next to `dist/` — so one path serves both.
+ *
+ * A missing or unreadable manifest is not worth failing a request over; the
+ * system page shows "unknown" instead.
+ */
+export declare const VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/lib/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/lib/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,eAAO,MAAM,OAAO,QAAgB,CAAC"}

package/dist/lib/version.js

@@ -0,0 +1,25 @@
+/**
+ * The version of this build, read from the package manifest.
+ *
+ * Read rather than imported: an import would need a JSON module attribute and
+ * would put a second copy of the manifest in `dist/`. The file is a fixed
+ * distance from this module in both layouts — `src/lib` and `dist/lib`
+ * are the same depth below the package root, and the Docker image copies
+ * `package.json` next to `dist/` — so one path serves both.
+ *
+ * A missing or unreadable manifest is not worth failing a request over; the
+ * system page shows "unknown" instead.
+ */
+import fs from "node:fs";
+import path from "node:path";
+function readVersion() {
+    try {
+        const manifest = fs.readFileSync(path.resolve(import.meta.dirname, "../../package.json"), "utf8");
+        return JSON.parse(manifest).version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+export const VERSION = readVersion();
+//# sourceMappingURL=version.js.map

package/dist/lib/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/lib/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EACvD,MAAM,CACP,CAAC;QACF,OAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA0B,CAAC,OAAO,IAAI,SAAS,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Middleware.
+ *
+ * Ordering matters and is asserted in `app.ts`:
+ *   requestContext → guards → securityHeaders → errorBoundary → rateLimit
+ *   → originGuard → the auth surface's gate → route
+ *
+ * The gate itself is not here. Whether a request is anybody — a session
+ * middleware, `allowAll()` — belongs to the composing app, which is what
+ * keeps this package authentication-neutral.
+ */
+import type { ErrorHandler, MiddlewareHandler } from "hono";
+import { type Env } from "../http.js";
+/** Attaches the container, a request id and a scoped logger; logs the result. */
+export declare function requestContext(ctx: Env["Variables"]["ctx"]): MiddlewareHandler<Env>;
+export declare function securityHeaders(): MiddlewareHandler<Env>;
+/**
+ * Converts thrown errors into the API error envelope. Deliberate failures
+ * (`ApiError`) are reported as-is; anything else is a bug and becomes a bare
+ * 500, with the stack kept in the log rather than sent to the client.
+ *
+ * Registered with `app.onError`, not as middleware: Hono's `compose` wraps each
+ * handler individually and routes a throw to `onError` at that level, so a
+ * try/catch in an outer middleware would never see it.
+ */
+export declare function errorHandler(): ErrorHandler<Env>;
+/** Coarse per-IP limit, applied to the whole API surface. */
+export declare function rateLimit(): MiddlewareHandler<Env>;
+export declare function allowedOrigins(config: {
+    MICA_PUBLIC_URL: string;
+    adminOrigins: string[];
+}): string[];
+/**
+ * First CSRF layer: the browser sets `Origin` on every state-changing request
+ * and a page on another site cannot forge it.
+ *
+ * Applied to the whole API — including sign-in, which has no session yet and
+ * so cannot use the token check below.
+ */
+export declare function originGuard(): MiddlewareHandler<Env>;
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI5D,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,YAAY,CAAC;AAGhD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAmCnF;AAED,wBAAgB,eAAe,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAUxD;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,CAyBhD;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAalD;AAYD,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,MAAM,EAAE,CAEX;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAsBpD"}

package/dist/middleware/index.js

@@ -0,0 +1,142 @@
+/**
+ * Middleware.
+ *
+ * Ordering matters and is asserted in `app.ts`:
+ *   requestContext → guards → securityHeaders → errorBoundary → rateLimit
+ *   → originGuard → the auth surface's gate → route
+ *
+ * The gate itself is not here. Whether a request is anybody — a session
+ * middleware, `allowAll()` — belongs to the composing app, which is what
+ * keeps this package authentication-neutral.
+ */
+import { ApiError } from "../lib/errors.js";
+import { clientIp } from "../http.js";
+import { randomToken } from "../lib/id.js";
+/** Attaches the container, a request id and a scoped logger; logs the result. */
+export function requestContext(ctx) {
+    return async (c, next) => {
+        const requestId = c.req.header("x-request-id") ?? randomToken(8);
+        const logger = ctx.logger.child({ requestId });
+        c.set("ctx", ctx);
+        c.set("requestId", requestId);
+        c.set("logger", logger);
+        c.header("x-request-id", requestId);
+        const startedAt = performance.now();
+        await next();
+        const duration = Math.round(performance.now() - startedAt);
+        const line = {
+            method: c.req.method,
+            path: new URL(c.req.url).pathname,
+            status: c.res.status,
+            duration,
+        };
+        /**
+         * "Am I signed in?" — "No."
+         *
+         * `/auth/me` is the SPA's first request on every page load, and a 401 is
+         * one of its two correct answers, not a rejection worth a warning. Logging
+         * it as one puts a scary line in the terminal of everybody who has simply
+         * opened the editor while signed out.
+         */
+        const expected401 = c.res.status === 401 && line.path === "/api/auth/me";
+        if (c.res.status >= 500)
+            logger.error("Request failed", line);
+        else if (c.res.status >= 400 && !expected401)
+            logger.warn("Request rejected", line);
+        else
+            logger.debug("Request", line);
+    };
+}
+export function securityHeaders() {
+    return async (c, next) => {
+        await next();
+        c.header("x-content-type-options", "nosniff");
+        c.header("referrer-policy", "same-origin");
+        c.header("x-frame-options", "DENY");
+        // The admin is a first-party SPA; nothing here needs to be embedded.
+        c.header("permissions-policy", "geolocation=(), microphone=(), camera=()");
+    };
+}
+/**
+ * Converts thrown errors into the API error envelope. Deliberate failures
+ * (`ApiError`) are reported as-is; anything else is a bug and becomes a bare
+ * 500, with the stack kept in the log rather than sent to the client.
+ *
+ * Registered with `app.onError`, not as middleware: Hono's `compose` wraps each
+ * handler individually and routes a throw to `onError` at that level, so a
+ * try/catch in an outer middleware would never see it.
+ */
+export function errorHandler() {
+    return (error, c) => {
+        const logger = c.get("logger") ?? c.get("ctx").logger;
+        if (error instanceof ApiError) {
+            logger.debug("Handled error", { code: error.code, message: error.message });
+            return c.json(error.toBody(), error.status, error.headers);
+        }
+        logger.error("Unhandled error", {
+            error: error instanceof Error ? (error.stack ?? error.message) : String(error),
+            path: new URL(c.req.url).pathname,
+        });
+        return c.json({
+            error: {
+                code: "internal_error",
+                message: "Something went wrong. Please try again.",
+                requestId: c.get("requestId"),
+            },
+        }, 500);
+    };
+}
+/** Coarse per-IP limit, applied to the whole API surface. */
+export function rateLimit() {
+    return async (c, next) => {
+        const { limiters } = c.get("ctx");
+        const result = limiters.api.check(clientIp(c));
+        if (!result.allowed) {
+            throw new ApiError("rate_limited", "Too many requests. Please slow down.", {
+                headers: { "retry-after": String(result.retryAfter) },
+            });
+        }
+        await next();
+    };
+}
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const normaliseOrigin = (value) => {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return value;
+    }
+};
+export function allowedOrigins(config) {
+    return [...new Set([config.MICA_PUBLIC_URL, ...config.adminOrigins].map(normaliseOrigin))];
+}
+/**
+ * First CSRF layer: the browser sets `Origin` on every state-changing request
+ * and a page on another site cannot forge it.
+ *
+ * Applied to the whole API — including sign-in, which has no session yet and
+ * so cannot use the token check below.
+ */
+export function originGuard() {
+    return async (c, next) => {
+        if (SAFE_METHODS.has(c.req.method)) {
+            await next();
+            return;
+        }
+        const { config } = c.get("ctx");
+        const origin = c.req.header("origin");
+        if (origin) {
+            if (!allowedOrigins(config).includes(normaliseOrigin(origin))) {
+                throw new ApiError("forbidden", "Request origin is not allowed.");
+            }
+        }
+        else if (config.isProduction) {
+            // A browser always sends Origin on writes; its absence means the request
+            // did not come from one. Tolerated in development for curl-based testing.
+            throw new ApiError("forbidden", "Missing Origin header.");
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAY,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAA4B;IACzD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/C,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAEpC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;YACjC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,QAAQ;SACT,CAAC;QAEF;;;;;;;WAOG;QACH,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC;QAEzE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;aACzD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;;YAC/E,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QAEb,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpC,qEAAqE;QACrE,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IAC7E,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAEtD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAA8B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAC9B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC9E,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAyB;gBAC/B,OAAO,EAAE,yCAAyC;gBAClD,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;aAC9B;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,sCAAsC,EAAE;gBACzE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,MAG9B;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/admin-content.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Admin content routes — entries and singletons.
+ *
+ * Thin: parse, delegate to the content store, serialise. Every rule about
+ * validation, slugs and layout lives in the store, which is shared with the
+ * Astro build rather than reimplemented here.
+ *
+ * Three things shape this surface:
+ *
+ *   - An entry is addressed by `collection/slug`. The path in the API is the
+ *     path in the repository, so a URL here can be read off a diff.
+ *   - There are no revision endpoints. Git is the history.
+ *   - There is no status endpoint. Committed is published, and a draft is
+ *     unsaved work in the editor that never reaches the server.
+ *
+ * `revision` is what makes concurrent editing safe: an opaque token naming the
+ * version an editor opened, sent back with the save.
+ */
+import { Hono } from "hono";
+import { type Env } from "../http.js";
+export declare function adminContentRoutes(): Hono<Env>;
+//# sourceMappingURL=admin-content.d.ts.map

package/dist/routes/admin-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-content.d.ts","sourceRoot":"","sources":["../../src/routes/admin-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAW,KAAK,GAAG,EAAE,MAAM,YAAY,CAAC;AAwC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAAC,GAAG,CAAC,CA0K9C"}

package/dist/routes/admin-content.js

@@ -0,0 +1,194 @@
+/**
+ * Admin content routes — entries and singletons.
+ *
+ * Thin: parse, delegate to the content store, serialise. Every rule about
+ * validation, slugs and layout lives in the store, which is shared with the
+ * Astro build rather than reimplemented here.
+ *
+ * Three things shape this surface:
+ *
+ *   - An entry is addressed by `collection/slug`. The path in the API is the
+ *     path in the repository, so a URL here can be read off a diff.
+ *   - There are no revision endpoints. Git is the history.
+ *   - There is no status endpoint. Committed is published, and a draft is
+ *     unsaved work in the editor that never reaches the server.
+ *
+ * `revision` is what makes concurrent editing safe: an opaque token naming the
+ * version an editor opened, sent back with the save.
+ */
+import { ConflictError, ValidationError } from "@micacms/connectors";
+import { collectionEntryPath, compareEntries, entryTitle, singletonPath } from "@micacms/core";
+import { Hono } from "hono";
+import { z } from "zod";
+import { ApiError, badRequest, notFound } from "../lib/errors.js";
+import { actorOf } from "../http.js";
+const saveSchema = z.object({
+    data: z.record(z.string(), z.unknown()),
+    slug: z.string().max(120).optional(),
+    /**
+     * The revision the editor opened. `null` asserts the entry did not exist,
+     * which is what makes two simultaneous creates fail instead of one silently
+     * overwriting the other.
+     */
+    revision: z.string().nullable().optional(),
+});
+const reorderSchema = z.object({ slugs: z.array(z.string().min(1)).max(2000) });
+async function jsonBody(c) {
+    return c.req.json().catch(() => {
+        throw badRequest("The request body must be valid JSON.");
+    });
+}
+/**
+ * Turns a store failure into the HTTP answer it deserves.
+ *
+ * A conflict is 409 and is recoverable in the editor — reload and reapply. A
+ * validation failure is 422 with the offending fields. Everything else is a
+ * genuine fault and reaches the error handler unchanged.
+ */
+async function handled(run) {
+    try {
+        return await run();
+    }
+    catch (error) {
+        if (error instanceof ConflictError)
+            throw new ApiError("conflict", error.message);
+        if (error instanceof ValidationError) {
+            throw new ApiError("validation_failed", error.message, { issues: error.issues });
+        }
+        throw error;
+    }
+}
+export function adminContentRoutes() {
+    const app = new Hono();
+    /* ------------------------------------------------------------ entries */
+    app.get("/collections/:collection/entries", async (c) => {
+        const { content } = c.get("ctx").services;
+        const collection = c.req.param("collection");
+        const def = content.requireCollection(collection);
+        const entries = await handled(() => content.list(collection));
+        const search = c.req.query("search")?.trim().toLowerCase();
+        const items = entries
+            .map((entry) => ({
+            slug: entry.slug,
+            position: entry.position,
+            title: entryTitle(def, entry.data),
+            data: entry.data,
+        }))
+            // A substring match over the payload, which is what the SQL `LIKE` did.
+            // Content trees are small enough that filtering in memory is simpler than
+            // an index, and it can no longer disagree with what is on disk.
+            .filter((item) => !search || JSON.stringify(item.data).toLowerCase().includes(search))
+            // The order the model asks for — newest first for news, by hand for a
+            // menu. Ties fall back to the manual position, so the list is stable
+            // between requests whatever the sort field says.
+            .sort(compareEntries(def));
+        return c.json({ items, total: items.length });
+    });
+    app.post("/collections/:collection/entries", async (c) => {
+        const { content } = c.get("ctx").services;
+        const parsed = saveSchema.safeParse(await jsonBody(c));
+        if (!parsed.success)
+            throw badRequest("The entry payload is malformed.");
+        const saved = await handled(() => content.save(c.req.param("collection"), {
+            data: parsed.data.data,
+            // A create asserts absence unless the client says otherwise.
+            expectedRevision: parsed.data.revision ?? null,
+            author: actorOf(c) ? { name: actorOf(c).email, email: actorOf(c).email } : undefined,
+        }));
+        return c.json(saved, 201);
+    });
+    app.post("/collections/:collection/reorder", async (c) => {
+        const { content } = c.get("ctx").services;
+        const parsed = reorderSchema.safeParse(await jsonBody(c));
+        if (!parsed.success)
+            throw badRequest("Expected a list of entry slugs.");
+        await handled(() => content.reorder(c.req.param("collection"), parsed.data.slugs));
+        return c.json({ ok: true });
+    });
+    /** Server-side slug generation, so the URL preview matches what is saved. */
+    app.get("/collections/:collection/slug", async (c) => {
+        const { content } = c.get("ctx").services;
+        const source = c.req.query("source") ?? "";
+        if (!source.trim())
+            return c.json({ slug: "" });
+        return c.json({
+            slug: await handled(() => content.suggestSlug(c.req.param("collection"), source, c.req.query("except"))),
+        });
+    });
+    app.get("/collections/:collection/entries/:slug", async (c) => {
+        const { content } = c.get("ctx").services;
+        const collection = c.req.param("collection");
+        const slug = c.req.param("slug");
+        const entry = await handled(() => content.get(collection, slug));
+        if (!entry)
+            throw notFound("This entry no longer exists.");
+        const def = content.requireCollection(collection);
+        return c.json({
+            collection,
+            slug: entry.slug,
+            position: entry.position,
+            title: entryTitle(def, entry.data),
+            data: entry.data,
+            // Where this entry is on disk. Derived from the model, because whether an
+            // entry is one file or a directory depends on whether it has rich text or
+            // media — a rule the editor should not have to reimplement to show it.
+            path: collectionEntryPath(def.fields, collection, entry.slug),
+            // Sent back with the save. Without it the editor cannot tell the server
+            // which version of the entry it was looking at.
+            revision: await content.revisionOf(collection, slug),
+        });
+    });
+    app.put("/collections/:collection/entries/:slug", async (c) => {
+        const { content } = c.get("ctx").services;
+        const parsed = saveSchema.safeParse(await jsonBody(c));
+        if (!parsed.success)
+            throw badRequest("The entry payload is malformed.");
+        const actor = actorOf(c);
+        const saved = await handled(() => content.save(c.req.param("collection"), {
+            data: parsed.data.data,
+            slug: c.req.param("slug"),
+            expectedRevision: parsed.data.revision,
+            author: actor ? { name: actor.email, email: actor.email } : undefined,
+        }));
+        return c.json(saved);
+    });
+    app.delete("/collections/:collection/entries/:slug", async (c) => {
+        const { content } = c.get("ctx").services;
+        const actor = actorOf(c);
+        await handled(() => content.remove(c.req.param("collection"), c.req.param("slug"), {
+            author: actor ? { name: actor.email, email: actor.email } : undefined,
+        }));
+        return c.json({ ok: true });
+    });
+    /** Entries elsewhere that point at this one — shown before a delete. */
+    app.get("/collections/:collection/entries/:slug/references", async (c) => {
+        const { content } = c.get("ctx").services;
+        const references = await handled(() => content.findReferences(c.req.param("collection"), c.req.param("slug")));
+        return c.json({ references });
+    });
+    /* --------------------------------------------------------- singletons */
+    app.get("/singletons/:name", async (c) => {
+        const { content } = c.get("ctx").services;
+        const name = c.req.param("name");
+        const def = content.requireSingleton(name);
+        return c.json({
+            name,
+            label: def.label,
+            path: singletonPath(def.fields, name),
+            data: await handled(() => content.getSingleton(name)),
+            revision: await content.revisionOfSingleton(name),
+        });
+    });
+    app.put("/singletons/:name", async (c) => {
+        const { content } = c.get("ctx").services;
+        const body = (await jsonBody(c));
+        const actor = actorOf(c);
+        const saved = await handled(() => content.saveSingleton(c.req.param("name"), body?.data ?? {}, {
+            expectedRevision: body?.revision,
+            author: actor ? { name: actor.email, email: actor.email } : undefined,
+        }));
+        return c.json(saved);
+    });
+    return app;
+}
+//# sourceMappingURL=admin-content.js.map