@micacms/runtime 0.2.0

package/dist/schema.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Acquiring the content model at runtime.
+ *
+ * The server ships with no model of its own. It reads one out of the content
+ * repository, at `.mica/schema.json`, through the same connector it reads
+ * entries with. The Astro project writes that file and the developer commits
+ * it, so the model reaches the server the way content does — no artifact to
+ * mount, no second channel to keep in step, and a model change that is
+ * reviewable in a diff.
+ *
+ * That is what lets one published image serve any project: the model is plain
+ * data (field descriptors hold no functions, so `JSON.stringify(site)`
+ * round-trips), and every consumer downstream — form generation, payload
+ * validation, the admin — already reads it out of the request context.
+ *
+ * Whatever arrives is re-validated as if it had just been written by hand. A
+ * manifest from a repository is untrusted input: it may have been produced by a
+ * different version of `@micacms/core`, hand-edited, or truncated.
+ */
+import { type ContentSource, type Site } from "@micacms/core";
+export declare class SchemaError extends Error {
+    name: string;
+}
+/** Where a model came from, for logs and the system screen. */
+export declare function schemaOrigin(source: ContentSource): string;
+/**
+ * Reads the model the content repository publishes.
+ *
+ * A missing file is the interesting failure and gets the long message: it is
+ * what a first deployment hits, and the fix — build the Astro project, commit
+ * the result — is not guessable from "not found".
+ */
+export declare function loadSchema(source: ContentSource): Promise<Site>;
+/**
+ * Re-runs the checks `defineSite` performs on a hand-written model, plus the
+ * one it does not: that every `kind` is a kind this build knows about.
+ *
+ * `defineSite` assumes its input came from the typed builders, so it never
+ * questions a `kind`. Field kinds reach a `switch` with no default when a form
+ * is rendered and when a payload is validated, so an unknown one surfaces as an
+ * incoherent failure much later, on an editor's screen. Catching it here turns
+ * a version mismatch between the project's `@micacms/core` and the image's
+ * into a startup error that names the field.
+ */
+export declare function checkSchema(raw: unknown, origin?: string): Site;
+/**
+ * A stable short digest of a model, for spotting drift.
+ *
+ * Logged at startup and returned by the schema endpoint so that a website built
+ * against one model and a CMS serving another is a visible mismatch rather than
+ * a puzzling absence of fields. Key order follows the model's own declaration
+ * order, which is meaningful here — reordering fields reorders the admin form,
+ * so it is a real change and should produce a different digest.
+ */
+export declare function schemaFingerprint(site: Site): Promise<string>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAQL,KAAK,aAAa,EAGlB,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAEvB,qBAAa,WAAY,SAAQ,KAAK;IAC3B,IAAI,SAAiB;CAC/B;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BrE;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,SAAe,GAAG,IAAI,CAuErE;AA0BD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAGnE"}

package/dist/schema.js

@@ -0,0 +1,173 @@
+/**
+ * Acquiring the content model at runtime.
+ *
+ * The server ships with no model of its own. It reads one out of the content
+ * repository, at `.mica/schema.json`, through the same connector it reads
+ * entries with. The Astro project writes that file and the developer commits
+ * it, so the model reaches the server the way content does — no artifact to
+ * mount, no second channel to keep in step, and a model change that is
+ * reviewable in a diff.
+ *
+ * That is what lets one published image serve any project: the model is plain
+ * data (field descriptors hold no functions, so `JSON.stringify(site)`
+ * round-trips), and every consumer downstream — form generation, payload
+ * validation, the admin — already reads it out of the request context.
+ *
+ * Whatever arrives is re-validated as if it had just been written by hand. A
+ * manifest from a repository is untrusted input: it may have been produced by a
+ * different version of `@micacms/core`, hand-edited, or truncated.
+ */
+import { checkCompatibility, defineSite, isFieldKind, isProtocolManifest, MANIFEST_PATH, PROTOCOL_VERSION, } from "@micacms/core";
+export class SchemaError extends Error {
+    name = "SchemaError";
+}
+/** Where a model came from, for logs and the system screen. */
+export function schemaOrigin(source) {
+    return `${source.origin}/${MANIFEST_PATH}`;
+}
+/**
+ * Reads the model the content repository publishes.
+ *
+ * A missing file is the interesting failure and gets the long message: it is
+ * what a first deployment hits, and the fix — build the Astro project, commit
+ * the result — is not guessable from "not found".
+ */
+export async function loadSchema(source) {
+    const origin = schemaOrigin(source);
+    let text;
+    try {
+        text = await source.read(MANIFEST_PATH);
+    }
+    catch (error) {
+        // A repository that cannot be reached is not a bad model. Say which it is,
+        // because the two have completely different fixes.
+        throw new SchemaError(`Could not read the content model from ${source.origin}.\n` +
+            `  ${error.message}\n` +
+            `  The repository has to be reachable before Mica can start: the model\n` +
+            `  lives in it, at ${MANIFEST_PATH}.`);
+    }
+    if (text === null)
+        throw new SchemaError(describeMissing(origin));
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (error) {
+        throw new SchemaError(`${origin} is not valid JSON: ${error.message}`);
+    }
+    return checkSchema(raw, origin);
+}
+function describeMissing(origin) {
+    return (`No content model at ${origin}.\n` +
+        `  Mica ships without one — the Astro project defines it and writes it here.\n` +
+        `  In the project:  npx astro build   (or start the dev server once)\n` +
+        `  then commit ${MANIFEST_PATH} and push it to the branch Mica is reading.`);
+}
+/**
+ * Re-runs the checks `defineSite` performs on a hand-written model, plus the
+ * one it does not: that every `kind` is a kind this build knows about.
+ *
+ * `defineSite` assumes its input came from the typed builders, so it never
+ * questions a `kind`. Field kinds reach a `switch` with no default when a form
+ * is rendered and when a payload is validated, so an unknown one surfaces as an
+ * incoherent failure much later, on an editor's screen. Catching it here turns
+ * a version mismatch between the project's `@micacms/core` and the image's
+ * into a startup error that names the field.
+ */
+export function checkSchema(raw, origin = "the schema") {
+    if (raw === null || typeof raw !== "object") {
+        throw new SchemaError(`${origin} is ${raw === null ? "null" : typeof raw}, expected an object.`);
+    }
+    // Only when the envelope says so. A bare `{ collections }` is still accepted:
+    // the protocol version is a backstop for changes that cannot be detected by
+    // looking, not an admission ticket.
+    if (isProtocolManifest(raw)) {
+        const compatibility = checkCompatibility(raw);
+        if (!compatibility.ok && compatibility.reason === "newer") {
+            throw new SchemaError(`${origin} follows protocol version ${compatibility.version}; this build of Mica ` +
+                `understands version ${PROTOCOL_VERSION}.\n` +
+                `  The project was built against a newer @micacms/astro. Upgrade Mica.`);
+        }
+    }
+    const candidate = raw;
+    if (candidate.collections === null || typeof candidate.collections !== "object") {
+        throw new SchemaError(`${origin} has no \`collections\`. Expected defineSite({ collections: { ... } }).`);
+    }
+    // `globals` was the term before the model settled on `singletons`. A manifest
+    // outlives the release that produced it, so both spellings are read here;
+    // only the new one is written anywhere.
+    const rawSingletons = candidate.singletons ?? candidate.globals;
+    if (rawSingletons !== undefined && (rawSingletons === null || typeof rawSingletons !== "object")) {
+        throw new SchemaError(`${origin} has a \`singletons\` that is not an object.`);
+    }
+    const collections = candidate.collections;
+    const singletons = (rawSingletons ?? {});
+    for (const [name, def] of Object.entries(collections)) {
+        assertFieldMap(def?.fields, `collections.${name}`, origin);
+    }
+    for (const [name, def] of Object.entries(singletons)) {
+        assertFieldMap(def?.fields, `singletons.${name}`, origin);
+    }
+    /**
+     * A default sort naming a field the collection does not declare is dropped
+     * here rather than refused.
+     *
+     * `defineSite` rejects it, which is right when somebody is writing the model
+     * and can fix the line they are looking at. By the time it reaches Mica the
+     * model is committed and a site is starting against it: the entries are
+     * intact, the fields are intact, and the only casualty is the order of a
+     * list. Refusing to serve the site over that would be out of proportion —
+     * and models written before the check existed contain exactly this, because
+     * the old fixed list of sort fields offered names no collection had.
+     *
+     * So the option is dropped, the list falls back to the order editors
+     * arranged by hand, and the project's next build reports it properly.
+     */
+    for (const def of Object.values(collections)) {
+        const field = def?.defaultSort?.field;
+        if (field && field !== "position" && !def.fields?.[field])
+            delete def.defaultSort;
+    }
+    // Name injection and every cross-reference check — unknown relation targets,
+    // slugs derived from absent siblings, reserved collection names — come from
+    // the same function a hand-written model goes through.
+    try {
+        return defineSite({ collections, singletons });
+    }
+    catch (error) {
+        throw new SchemaError(`${origin} is not a valid content model.\n  ${error.message}`);
+    }
+}
+function assertFieldMap(fields, at, origin) {
+    if (fields === null || typeof fields !== "object") {
+        throw new SchemaError(`${origin}: "${at}" has no \`fields\` object.`);
+    }
+    for (const [key, field] of Object.entries(fields)) {
+        const here = `${at}.${key}`;
+        if (field === null || typeof field !== "object") {
+            throw new SchemaError(`${origin}: field "${here}" is not an object.`);
+        }
+        if (!isFieldKind(field.kind)) {
+            throw new SchemaError(`${origin}: field "${here}" has unknown kind "${String(field.kind)}".\n` +
+                `  This build of Mica does not support it — the project may have been built\n` +
+                `  against a newer @micacms/astro than the server is running.`);
+        }
+        if (field.kind === "object" || field.kind === "repeater") {
+            assertFieldMap(field.fields, here, origin);
+        }
+    }
+}
+/**
+ * A stable short digest of a model, for spotting drift.
+ *
+ * Logged at startup and returned by the schema endpoint so that a website built
+ * against one model and a CMS serving another is a visible mismatch rather than
+ * a puzzling absence of fields. Key order follows the model's own declaration
+ * order, which is meaningful here — reordering fields reorders the admin form,
+ * so it is a real change and should produce a different digest.
+ */
+export async function schemaFingerprint(site) {
+    const { createHash } = await import("node:crypto");
+    return createHash("sha256").update(JSON.stringify(site)).digest("hex").slice(0, 12);
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,gBAAgB,GAMjB,MAAM,eAAe,CAAC;AAEvB,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB;IACpD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,IAAI,WAAW,CACnB,yCAAyC,MAAM,CAAC,MAAM,KAAK;YACzD,KAAM,KAAe,CAAC,OAAO,IAAI;YACjC,yEAAyE;YACzE,qBAAqB,aAAa,GAAG,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAElE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,uBAAwB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CACL,uBAAuB,MAAM,KAAK;QAClC,+EAA+E;QAC/E,uEAAuE;QACvE,iBAAiB,aAAa,6CAA6C,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,MAAM,GAAG,YAAY;IAC7D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,uBAAuB,CAAC,CAAC;IACnG,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,oCAAoC;IACpC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,aAAa,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,WAAW,CACnB,GAAG,MAAM,6BAA6B,aAAa,CAAC,OAAO,uBAAuB;gBAChF,uBAAuB,gBAAgB,KAAK;gBAC5C,uEAAuE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,GAAyE,CAAC;IAE5F,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChF,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,yEAAyE,CAAC,CAAC;IAC5G,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,OAAO,CAAC;IAChE,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,8CAA8C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAyC,CAAC;IACxE,MAAM,UAAU,GAAG,CAAC,aAAa,IAAI,EAAE,CAA8B,CAAC;IAEtE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC;QACtC,IAAI,KAAK,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,WAAW,CAAC;IACpF,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,qCAAsC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAe,EAAE,EAAU,EAAE,MAAc;IACjE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAkB,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC;QAE5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,YAAY,IAAI,qBAAqB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CACnB,GAAG,MAAM,YAAY,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM;gBACtE,8EAA8E;gBAC9E,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACzD,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Listening, and stopping.
+ *
+ * The shared half of every app's entry point: bind the Hono app to a socket,
+ * shut down cleanly on SIGTERM/SIGINT, and turn the one most likely first-run
+ * failure — a busy port — into a message instead of a stack trace. What the
+ * apps keep for themselves is what to *say* when the server is up, because
+ * that is where a laptop and a container genuinely differ.
+ */
+import type { Hono } from "hono";
+import type { Env } from "./http.js";
+import type { Logger } from "./lib/logger.js";
+export interface StartServerOptions {
+    app: Hono<Env>;
+    host: string;
+    port: number;
+    logger: Logger;
+    /** Called once the socket is listening — the banner or the log line. */
+    onListening(info: {
+        port: number;
+    }): void;
+    /** The message for a busy port. Defaults to a plain sentence. */
+    portInUseMessage?(): string;
+    /** Releases what the composition holds — timers, the database. */
+    shutdown(): Promise<void>;
+}
+export declare function startServer(options: StartServerOptions): void;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,WAAW,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,iEAAiE;IACjE,gBAAgB,CAAC,IAAI,MAAM,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CA+C7D"}

package/dist/server.js

@@ -0,0 +1,47 @@
+/**
+ * Listening, and stopping.
+ *
+ * The shared half of every app's entry point: bind the Hono app to a socket,
+ * shut down cleanly on SIGTERM/SIGINT, and turn the one most likely first-run
+ * failure — a busy port — into a message instead of a stack trace. What the
+ * apps keep for themselves is what to *say* when the server is up, because
+ * that is where a laptop and a container genuinely differ.
+ */
+import { serve } from "@hono/node-server";
+export function startServer(options) {
+    const { logger } = options;
+    const server = serve({ fetch: options.app.fetch, hostname: options.host, port: options.port }, (info) => options.onListening({ port: info.port }));
+    server.on("error", (error) => {
+        if (error.code !== "EADDRINUSE")
+            throw error;
+        process.stderr.write(options.portInUseMessage?.() ??
+            `Port ${options.port} on ${options.host} is already in use. Stop the other ` +
+                `process, or set PORT.\n`);
+        process.exit(1);
+    });
+    let shuttingDown = false;
+    const shutdown = (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        logger.info("Shutting down", { signal });
+        // Stop accepting connections, then release whatever the app holds.
+        server.close(() => {
+            void options.shutdown().then(() => {
+                logger.info("Shutdown complete");
+                process.exit(0);
+            });
+        });
+        // Do not let a hung connection block a container restart indefinitely.
+        setTimeout(() => {
+            logger.warn("Forcing exit after shutdown timeout");
+            process.exit(1);
+        }, 15_000).unref();
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    process.on("unhandledRejection", (reason) => {
+        logger.error("Unhandled promise rejection", { reason: String(reason) });
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAmB1C,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,MAAM,MAAM,GAAG,KAAK,CAClB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EACxE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CACnD,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAE7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,OAAO,CAAC,gBAAgB,EAAE,EAAE;YAC1B,QAAQ,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,qCAAqC;gBAC1E,yBAAyB,CAC9B,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACxC,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzC,mEAAmE;QACnE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBAChC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/media.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Media uploads.
+ *
+ * Every uploaded byte passes through here, so this is where the file is judged:
+ * size, and the real content type read from the bytes rather than from the
+ * browser's claim.
+ *
+ * An upload is a *file in the content repository*. There is no media table, no
+ * generated key and no object store — a media value is the path to a file a
+ * reviewer can see in the diff.
+ *
+ * The filename therefore matters. It is derived from what the editor uploaded,
+ * slugified so it is safe as a path segment, and made unique inside its own
+ * directory rather than globally.
+ */
+import type { RepositoryConnector } from "@micacms/connectors";
+/** Where uploads go when they are not attached to a particular entry. */
+export declare const SHARED_MEDIA_DIR = "media";
+export interface MediaServiceDeps {
+    connector: RepositoryConnector;
+    maxBytes: number;
+}
+export interface MediaFile {
+    /** Path relative to the content root — the value a `media()` field holds. */
+    path: string;
+    filename: string;
+    mimeType: string;
+    size: number;
+    width: number | null;
+    height: number | null;
+}
+export declare function createMediaService(deps: MediaServiceDeps): {
+    /**
+     * Reads and checks an upload, without writing it.
+     *
+     * Separate from the commit so that an entry and the media it references go
+     * into the repository in *one* change set. Uploading first and saving
+     * second would leave an orphaned file behind whenever the editor changed
+     * their mind.
+     */
+    prepare(input: {
+        file: File;
+        /** Directory to place the file in, relative to the content root. */
+        directory?: string;
+        accept?: "image" | "document" | "any";
+    }): Promise<{
+        file: MediaFile;
+        contents: Uint8Array;
+    }>;
+    /**
+     * Every media file in the repository, for the editor's picker.
+     *
+     * A walk of the content tree rather than a table scan. Content trees are
+     * small, and the alternative — an index Mica maintains — would be a second
+     * source of truth that could disagree with the repository.
+     */
+    list(): Promise<MediaFile[]>;
+    read(mediaPath: string): Promise<{
+        bytes: Uint8Array;
+        mimeType: string;
+    } | null>;
+};
+export type MediaService = ReturnType<typeof createMediaService>;
+export declare function formatBytes(bytes: number): string;
+//# sourceMappingURL=media.d.ts.map

package/dist/services/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../src/services/media.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM/D,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB;IAyBrD;;;;;;;OAOG;mBACkB;QACnB,IAAI,EAAE,IAAI,CAAC;QACX,oEAAoE;QACpE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,KAAK,CAAC;KACvC,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,UAAU,CAAA;KAAE,CAAC;IAwCtD;;;;;;OAMG;YACW,OAAO,CAAC,SAAS,EAAE,CAAC;oBAmCZ,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;EAOzF;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AA2DjE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjD"}

package/dist/services/media.js

@@ -0,0 +1,180 @@
+/**
+ * Media uploads.
+ *
+ * Every uploaded byte passes through here, so this is where the file is judged:
+ * size, and the real content type read from the bytes rather than from the
+ * browser's claim.
+ *
+ * An upload is a *file in the content repository*. There is no media table, no
+ * generated key and no object store — a media value is the path to a file a
+ * reviewer can see in the diff.
+ *
+ * The filename therefore matters. It is derived from what the editor uploaded,
+ * slugified so it is safe as a path segment, and made unique inside its own
+ * directory rather than globally.
+ */
+import path from "node:path";
+import { slugify } from "@micacms/core";
+import { imageSize } from "image-size";
+import { ApiError, badRequest } from "../lib/errors.js";
+import { detectFileType, isAccepted, isImageType } from "../lib/file-type.js";
+/** Where uploads go when they are not attached to a particular entry. */
+export const SHARED_MEDIA_DIR = "media";
+export function createMediaService(deps) {
+    const { connector, maxBytes } = deps;
+    /**
+     * A name that is unique in `directory`.
+     *
+     * Scoped to the directory rather than to the whole repository, because that
+     * is where a collision would actually overwrite something — and because
+     * `haus-a/media/exterior.jpg` and `haus-b/media/exterior.jpg` are two
+     * perfectly reasonable files with the same name.
+     */
+    const uniqueName = async (directory, filename) => {
+        const taken = new Set((await connector.list(directory)).filter((item) => item.type === "file").map((item) => item.name));
+        const extension = path.extname(filename);
+        const stem = filename.slice(0, filename.length - extension.length);
+        let candidate = filename;
+        for (let n = 2; taken.has(candidate); n += 1)
+            candidate = `${stem}-${n}${extension}`;
+        return candidate;
+    };
+    return {
+        /**
+         * Reads and checks an upload, without writing it.
+         *
+         * Separate from the commit so that an entry and the media it references go
+         * into the repository in *one* change set. Uploading first and saving
+         * second would leave an orphaned file behind whenever the editor changed
+         * their mind.
+         */
+        async prepare(input) {
+            const { file } = input;
+            const directory = input.directory ?? SHARED_MEDIA_DIR;
+            if (file.size === 0)
+                throw badRequest("The file is empty.");
+            if (file.size > maxBytes) {
+                throw new ApiError("payload_too_large", `The file is ${formatBytes(file.size)}. The limit is ${formatBytes(maxBytes)}.`);
+            }
+            const contents = new Uint8Array(await file.arrayBuffer());
+            // From the bytes, never from the browser's claim about them.
+            const detected = detectFileType(contents);
+            if (!detected) {
+                throw new ApiError("unsupported_media_type", "This file type is not supported.");
+            }
+            if (!isAccepted(detected.mimeType, input.accept ?? "any")) {
+                throw new ApiError("unsupported_media_type", `A ${input.accept} was expected, but this is a ${detected.mimeType}.`);
+            }
+            const filename = await uniqueName(directory, safeName(file.name, detected.extension));
+            return {
+                contents,
+                file: {
+                    path: `${directory}/${filename}`,
+                    filename,
+                    mimeType: detected.mimeType,
+                    size: contents.byteLength,
+                    ...dimensions(contents, detected.mimeType),
+                },
+            };
+        },
+        /**
+         * Every media file in the repository, for the editor's picker.
+         *
+         * A walk of the content tree rather than a table scan. Content trees are
+         * small, and the alternative — an index Mica maintains — would be a second
+         * source of truth that could disagree with the repository.
+         */
+        async list() {
+            const found = [];
+            const walk = async (directory) => {
+                for (const item of await connector.list(directory)) {
+                    const child = directory === "" ? item.name : `${directory}/${item.name}`;
+                    if (item.type === "directory") {
+                        await walk(child);
+                        continue;
+                    }
+                    if (!isMediaName(item.name))
+                        continue;
+                    const bytes = await connector.readBinary(child);
+                    if (!bytes)
+                        continue;
+                    // The bytes are authoritative; the extension is the fallback for the
+                    // formats the sniffer does not cover, such as SVG.
+                    const mimeType = detectFileType(bytes)?.mimeType ?? mimeFromName(item.name);
+                    found.push({
+                        path: child,
+                        filename: item.name,
+                        mimeType,
+                        size: bytes.byteLength,
+                        ...dimensions(bytes, mimeType),
+                    });
+                }
+            };
+            await walk("");
+            return found.sort((a, b) => a.path.localeCompare(b.path));
+        },
+        async read(mediaPath) {
+            const bytes = await connector.readBinary(mediaPath);
+            if (!bytes)
+                return null;
+            return { bytes, mimeType: detectFileType(bytes)?.mimeType ?? mimeFromName(mediaPath) };
+        },
+    };
+}
+/* ------------------------------------------------------------------ */
+/**
+ * A filename that is safe as a path segment and still recognisable.
+ *
+ * Slugified rather than sanitised: the result is part of a URL in the built
+ * site and part of a path in a Git repository, and both are better off without
+ * spaces, accents or case.
+ */
+function safeName(original, extension) {
+    const stem = slugify(path.basename(original).replace(/\.[^.]*$/, "")).slice(0, 80);
+    return `${stem || "upload"}.${extension}`;
+}
+/**
+ * Extension to media type, for the formats byte-sniffing does not identify.
+ *
+ * A fallback, never the first answer: a file's own bytes are the only thing
+ * that cannot be renamed to lie.
+ */
+const BY_EXTENSION = {
+    svg: "image/svg+xml",
+    pdf: "application/pdf",
+    txt: "text/plain",
+    csv: "text/csv",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xls: "application/vnd.ms-excel",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+};
+function mimeFromName(name) {
+    const extension = path.extname(name).slice(1).toLowerCase();
+    return BY_EXTENSION[extension] ?? "application/octet-stream";
+}
+/** Files a `media()` field could plausibly point at. */
+function isMediaName(name) {
+    return /\.(jpe?g|png|webp|avif|gif|tiff?|svg|pdf|docx?|xlsx?|txt|csv)$/i.test(name);
+}
+function dimensions(bytes, mimeType) {
+    if (bytes.byteLength === 0 || !isImageType(mimeType) || mimeType === "image/svg+xml") {
+        return { width: null, height: null };
+    }
+    try {
+        const size = imageSize(Buffer.from(bytes));
+        return { width: size.width ?? null, height: size.height ?? null };
+    }
+    catch {
+        // A format image-size cannot read is still a valid upload.
+        return { width: null, height: null };
+    }
+}
+export function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${Math.round(bytes / 1024)} kB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+//# sourceMappingURL=media.js.map

package/dist/services/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../../src/services/media.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAiBxC,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAErC;;;;;;;OAOG;IACH,MAAM,UAAU,GAAG,KAAK,EAAE,SAAiB,EAAE,QAAgB,EAAmB,EAAE;QAChF,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAClG,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAEnE,IAAI,SAAS,GAAG,QAAQ,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC;YAAE,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACL;;;;;;;WAOG;QACH,KAAK,CAAC,OAAO,CAAC,KAKb;YACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;YACvB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC;YAEtD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,UAAU,CAAC,oBAAoB,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,IAAI,QAAQ,CAChB,mBAAmB,EACnB,eAAe,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAChF,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1D,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,QAAQ,CAChB,wBAAwB,EACxB,KAAK,KAAK,CAAC,MAAM,gCAAgC,QAAQ,CAAC,QAAQ,GAAG,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YAEtF,OAAO;gBACL,QAAQ;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE;oBAChC,QAAQ;oBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,IAAI,EAAE,QAAQ,CAAC,UAAU;oBACzB,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;iBAC3C;aACF,CAAC;QACJ,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,IAAI;YACR,MAAM,KAAK,GAAgB,EAAE,CAAC;YAE9B,MAAM,IAAI,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;gBACtD,KAAK,MAAM,IAAI,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnD,MAAM,KAAK,GAAG,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAEzE,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;wBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;wBAClB,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAEtC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAChD,IAAI,CAAC,KAAK;wBAAE,SAAS;oBAErB,qEAAqE;oBACrE,mDAAmD;oBACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAE5E,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,KAAK;wBACX,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ;wBACR,IAAI,EAAE,KAAK,CAAC,UAAU;wBACtB,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC;qBAC/B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,SAAiB;YAC1B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,QAAQ,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC;AAID,wEAAwE;AAExE;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,GAAG,IAAI,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,oBAAoB;IACzB,IAAI,EAAE,yEAAyE;IAC/E,GAAG,EAAE,0BAA0B;IAC/B,IAAI,EAAE,mEAAmE;CAC1E,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAC/D,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,UAAU,CACjB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACrF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;QAC3D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,IAAI,CAAC;IACtC,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACjE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC"}

package/dist/services/staging-local.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Working-tree staging: local mode's half of the staging service.
+ *
+ * The checked-out working tree *is* the draft workspace. Autosave has already
+ * written the files — that is what lets the Astro dev server hot-reload them,
+ * which is the whole value of local mode — so this service's job is reading
+ * what Git thinks of the tree and, on Publish, turning exactly the reviewed
+ * paths into one commit and one push.
+ *
+ * Three rules keep it safe in a repository that belongs to a developer:
+ *
+ *   - Only Mica-managed paths. Every Git operation is limited to an explicit
+ *     path set derived from the change list — never `git add -A` over the
+ *     repository, so unrelated work in the same checkout is never swept in.
+ *   - HEAD is verified against the base the editor reviewed. A repository
+ *     that moved refuses, like a provider branch that moved.
+ *   - A commit and a push are two operations. When the push fails the commit
+ *     is retained and reported as `committed-pending-push`; a retry pushes
+ *     again and never creates a second commit.
+ */
+import type { RepositoryConnector } from "@micacms/connectors";
+import { type ContentChange, type Site } from "@micacms/core";
+import type { Logger } from "../lib/logger.js";
+import { type ContentStagingService } from "./staging.js";
+export interface WorkingTreeStagingDeps {
+    model: Site;
+    /** Reads the working tree — the same local connector autosave writes through. */
+    connector: RepositoryConnector;
+    /** Absolute path of the content root. */
+    contentRoot: string;
+    /** Revision of `.mica/schema.json` when the model was loaded. */
+    schemaRevision: string | null;
+    /** `MICA_LOCAL_PUBLISH`. False reduces this to a read-only changes view. */
+    publishEnabled: boolean;
+    logger: Logger;
+}
+/** A changed file plus what only Git status knows about it. */
+export interface TreeChange extends ContentChange {
+    /** Not yet known to Git — discarding means deleting, not restoring. */
+    untracked: boolean;
+    /** Mid-merge conflict markers. Unpublishable until resolved with Git tools. */
+    conflicted: boolean;
+}
+export declare function createWorkingTreeStagingService(deps: WorkingTreeStagingDeps): ContentStagingService;
+/**
+ * Parses `git status --porcelain=v1 -z` into content-root-relative changes.
+ *
+ * The `-z` format is the one that never munges a path: entries are
+ * NUL-terminated, and a rename is two fields — the new path, then the one it
+ * came from. A rename becomes a create and a delete, which is how the rest of
+ * Mica already thinks about moves.
+ *
+ * `.mica/` is excluded. The manifest there is build output a developer
+ * commits with their own tools; the editor neither shows nor publishes it,
+ * and model changes are guarded separately, by the drift check.
+ */
+export declare function parseStatus(raw: string, prefix: string): TreeChange[];
+//# sourceMappingURL=staging-local.d.ts.map

package/dist/services/staging-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging-local.d.ts","sourceRoot":"","sources":["../../src/services/staging-local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAGL,KAAK,aAAa,EAIlB,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAOL,KAAK,qBAAqB,EAI3B,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,IAAI,CAAC;IACZ,iFAAiF;IACjF,SAAS,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+DAA+D;AAC/D,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,UAAU,EAAE,OAAO,CAAC;CACrB;AAQD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,sBAAsB,GAC3B,qBAAqB,CA2QvB;AAmED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAmDrE"}