@murumets-ee/menus 0.0.0-preview-20261014110621

package/LICENSE

@@ -0,0 +1,94 @@
+Elastic License 2.0 (ELv2)
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set
+of the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If your company
+makes such a claim, your patent license ends immediately for work on behalf
+of your company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license
+no later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your
+licenses to terminate automatically and permanently.
+
+## No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is
+the software the licensor makes available under these terms, including any
+portion of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+**control** means ownership of substantially all the assets of an entity, or
+the power to direct the management and policies of an entity (for example, by
+voting right, contract, or otherwise). Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your
+licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

package/dist/admin.d.mts

@@ -0,0 +1,363 @@
+import { z } from "zod";
+import { AdminRoute, ToolkitApp } from "@murumets-ee/core";
+import { TranslatableSource, TranslatableSourceText } from "@murumets-ee/content/translation";
+import { ResolvedMenuNavItem } from "@murumets-ee/blocks";
+
+//#region src/menu-item-schema.d.ts
+/**
+ * Absolute nesting cap for any menu, independent of a menu's own `maxDepth`
+ * (phase 07 §2.7 — "depth is capped per menu (default 3, max 6)"). Also the
+ * bound that keeps the recursive parse from being a DoS vector.
+ */
+declare const MAX_MENU_DEPTH = 6;
+/**
+ * Upper bound on the number of nodes in one menu tree. Navigation menus are
+ * hand-curated: a few dozen items is a big one. The cap exists so a single
+ * PATCH can't hand the validator (and `extractRefs`' ref walk, and every
+ * subsequent render) an unbounded amount of work — CLAUDE.md's
+ * "no unbounded fan-out" rule applied to a single request payload.
+ */
+declare const MAX_MENU_TREE_NODES = 500;
+/**
+ * Max length of an entity-link fragment/anchor.
+ *
+ * Exported because this module is the SINGLE OWNER of the anchor bounds: the
+ * write-side schema below, the read-side anchor walk
+ * (`admin/anchors.ts`) and the editor's manual-entry fallback
+ * (`@murumets-ee/menus-ui`'s anchor picker, via the client-safe `./schema`
+ * subpath) all validate against exactly these two constants. Two of those three
+ * used to carry their own copy; a drift between them would let the picker offer
+ * — or the editor accept — a value the write boundary then rejects.
+ */
+declare const MAX_ANCHOR_LENGTH = 128;
+/**
+ * Anchors are slugified by the block editor (phase 08 §5) and rendered into an
+ * `href` as `#<anchor>`; restricting them to slug characters keeps that
+ * interpolation inert.
+ *
+ * Exported for the same single-owner reason as {@link MAX_ANCHOR_LENGTH}.
+ */
+declare const ANCHOR_PATTERN: RegExp;
+/**
+ * A menu item's link target — the item-type union phase 07 §2.2 and phase 08 §3
+ * define: `entity` (+ optional anchor) | `url` | `email`.
+ *
+ * **A NARROWED SUBSET of `@murumets-ee/blocks`' `LinkValue`, deliberately.**
+ * Blocks additionally carries a `media` kind; menus does NOT, because no phase
+ * gives a menu a media-href seam to resolve one with (phase 11 §2 specifies
+ * `href` as "canonical path from `toolkit_paths`; external URLs verbatim;
+ * header items null" and nothing else). Accepting a `media` link would let it
+ * validate, persist, and register an `entity_refs` row — arming delete
+ * protection for that file — while the renderer had no way to emit it: the item
+ * would silently never appear. Rejecting it at the write boundary turns that
+ * dead weight into a real 400. Widening later is additive (an arm here plus a
+ * `resolveMediaHref` dep on `MenuResolveDeps`) and needs no shape change.
+ *
+ * Every `MenuLinkValue` IS a valid blocks `LinkValue` (the subset direction, and
+ * the one `resolveLinkHref` needs) — pinned at compile time by an assignment in
+ * `menu-item-schema.test.ts`, so a drift in blocks' union is a build error
+ * rather than a silent divergence.
+ *
+ * The `anchor?: string | undefined` is forced by the combination of Zod and this
+ * repo's `exactOptionalPropertyTypes`: `.optional()` always widens to
+ * `T | undefined`, which is NOT assignable to blocks' `anchor?: string` under
+ * that flag.
+ */
+type MenuLinkValue = {
+  kind: 'entity';
+  entity: string;
+  id: string;
+  anchor?: string | undefined;
+} | {
+  kind: 'url';
+  url: string;
+} | {
+  kind: 'email';
+  email: string;
+};
+/**
+ * A menu tree node (phase 08 §3 / D009).
+ *
+ * `label: null` means "use the LIVE title of the linked entity, per locale";
+ * a map is an explicit per-locale override. `enabled` is per-locale visibility
+ * in BOTH directions — absent/`true` shows the item, `false` hides it in that
+ * locale — so one tree serves every locale (no `menu_translations` table).
+ *
+ * Declared as a `type`, NOT an `interface`, on purpose: only type aliases get
+ * TypeScript's implicit index signature, and without it `MenuItem[]` is not
+ * assignable to the `Record<string, unknown>[]` arm of `AdminClient.create/
+ * update`'s json-field value type — every caller storing a typed tree would
+ * need a cast.
+ */
+type MenuItem = {
+  /** Stable id — DND identity + anchor for audit diffs. */id: string; /** `header` = a text-only dropdown parent with no link of its own. */
+  kind: 'link' | 'header';
+  /**
+   * Present iff `kind === 'link'`.
+   *
+   * The explicit `| undefined` is required by the repo's
+   * `exactOptionalPropertyTypes` — Zod's `.optional()` emits
+   * `LinkValue | undefined`, and without it the schema wouldn't typecheck
+   * against this interface.
+   */
+  link?: MenuLinkValue | undefined; /** `null` = live entity title per locale; a map = explicit override. */
+  label: Record<string, string> | null; /** Per-locale visibility. Absent/`true` = visible; `false` = hidden. */
+  enabled?: Record<string, boolean> | undefined;
+  newTab?: boolean | undefined;
+  children: MenuItem[];
+};
+/**
+ * One menu item's target, as the editor needs to render its row
+ * (`@murumets-ee/menus/admin`'s `resolveMenuItemSummaries`).
+ *
+ * Declared here — not in `admin/summaries.ts` — for the same reason
+ * {@link BlockAnchor} is: it is a pure data shape with no server dependency,
+ * so the client-safe `./schema` subpath can re-export it without pulling the
+ * server-only resolver along. `import type` is erased at compile time either
+ * way, but a single canonical home (this leaf module) is simpler to reason
+ * about than "which of two server-only files owns the type".
+ */
+interface MenuItemSummary {
+  /**
+   * The target row's live title, or `null` when the entity declares no
+   * display-able field. Unlike the public render path — which DROPS such an
+   * item rather than show a raw uuid as navigation — the admin editor still
+   * reports the target as present, just unlabelled.
+   */
+  title: string | null;
+  /** `false` = the target row is gone (deleted) → a BROKEN item. */
+  exists: boolean;
+  /** `null` when the entity isn't publishable — no draft/published distinction applies. */
+  published: boolean | null;
+}
+/**
+ * One addressable block anchor on a document (`@murumets-ee/menus/admin`'s
+ * `collectBlockAnchors` / the anchors endpoint). See {@link MenuItemSummary}'s
+ * doc for why this pure shape lives here rather than in `admin/anchors.ts`.
+ */
+interface BlockAnchor {
+  /** The stable id rendered as the block element's `id` attribute. */
+  anchor: string;
+  /** Display text — `anchorLabel` when usable, else the anchor value itself. */
+  label: string;
+}
+/** Options for {@link buildMenuItemSchema} / {@link buildMenuTreeSchema}. */
+interface MenuSchemaOptions {
+  /**
+   * Locale codes accepted as keys in `label` / `enabled` maps. Anything else
+   * is a validation error — a typo'd locale would produce a label no renderer
+   * ever reads (the same failure mode content's `validateLocale` guards).
+   */
+  allowedLocales: readonly string[];
+}
+/**
+ * The recursive per-node schema. Input is `unknown` (this parses untrusted
+ * JSONB), output is a fully-narrowed {@link MenuItem}. Unknown properties are
+ * STRIPPED by Zod's default object behavior, so writing the parse result back
+ * onto the payload also sanitizes it — nothing a caller invents gets stored.
+ */
+declare function buildMenuItemSchema(options: MenuSchemaOptions): z.ZodType<MenuItem, z.ZodTypeDef, unknown>;
+/** The whole tree — an array of {@link buildMenuItemSchema} nodes. */
+declare function buildMenuTreeSchema(options: MenuSchemaOptions): z.ZodType<MenuItem[], z.ZodTypeDef, unknown>;
+/** Result of {@link measureMenuTree}. */
+interface MenuTreeMeasurement {
+  /** Deepest nesting level; `0` for an empty tree, `1` for flat items. */
+  depth: number;
+  /** Total node count across every level. */
+  nodeCount: number;
+}
+/**
+ * Measure a (possibly untrusted) tree's depth + node count **iteratively**, so
+ * measuring can never blow the stack the way a recursive walk over a hostile
+ * payload would. Stops early once either hard bound is exceeded and reports
+ * the over-limit value — the caller turns that into a validation error.
+ *
+ * Accepts `unknown` on purpose: this runs BEFORE the Zod parse (bounding the
+ * work that parse will do), so it can't assume a well-formed shape.
+ */
+declare function measureMenuTree(tree: unknown): MenuTreeMeasurement;
+/**
+ * Cross-field check: does `tree` nest no deeper than the menu's own
+ * `maxDepth`? Lives outside the node schema because a per-node Zod refinement
+ * has no visibility of the sibling `maxDepth` COLUMN — the behavior calls this
+ * after the recursive parse.
+ */
+declare function validateTreeDepth(tree: unknown, maxDepth: number): boolean;
+//#endregion
+//#region src/translatable-source.d.ts
+/** The largest page `list` returns, whatever the caller asks for. */
+declare const MAX_MENU_SOURCE_PAGE = 200;
+/**
+ * What identifies the tree a set of texts was read from: sha256 of its JSON.
+ *
+ * Any change to the tree — a label, an order, a new item — is a new revision,
+ * so `write` can refuse to lay translations over a tree that moved under them.
+ */
+declare function menuTreeRevision(tree: unknown): string;
+/**
+ * The labels of a stored tree that want a translation.
+ *
+ * An item contributes when its `label` is a MAP with a non-empty string for
+ * `sourceLocale` and — in `'missing'` mode — no non-empty string yet for
+ * `targetLocale`. `label: null` means "use the linked entity's live title",
+ * which is that entity's text, not the menu's, and is never offered.
+ */
+declare function collectMenuLabelTexts(tree: unknown, input: {
+  sourceLocale: string;
+  targetLocale: string;
+  mode: 'missing' | 'all';
+}): TranslatableSourceText[];
+/**
+ * A copy of `tree` with `label[targetLocale]` set on each item named in
+ * `texts`. The input is not modified.
+ *
+ * Only an item whose label is already a map takes a translation: a `null`
+ * label stays `null` (it follows the linked entity's title in every locale),
+ * and an id in `texts` that matches no such item is ignored. A text is trimmed;
+ * an empty one is skipped; one longer than {@link MAX_LABEL_LENGTH} throws,
+ * naming the item.
+ */
+declare function applyMenuLabelTranslations(tree: unknown, targetLocale: string, texts: Readonly<Record<string, string>>): {
+  tree: unknown[];
+  applied: number;
+};
+/**
+ * Menu labels, for a whole-site translation. Contributed on the menus plugin's
+ * `contributes['content.translatableSources']` via {@link menusContributions}.
+ */
+declare const menuTranslatableSource: TranslatableSource;
+/**
+ * Everything `@murumets-ee/menus` contributes to other plugins' slots, as the
+ * value of the menus plugin's `contributes` field.
+ *
+ * Declared HERE rather than inline in the factory because the factory lives in
+ * `@murumets-ee/menus-ui/plugin` (this package stays react-free) while what is
+ * contributed is server behaviour this package owns.
+ */
+declare const menusContributions: {
+  'content.translatableSources': TranslatableSource[];
+};
+//#endregion
+//#region src/admin/editor-state.d.ts
+/** The menu row projected to exactly what the embedded editor needs. */
+interface MenuEditorStateMenu {
+  id: string;
+  handle: string;
+  title: string;
+  maxDepth: number;
+  status: 'draft' | 'published';
+  tree: MenuItem[];
+  /**
+   * Which content types this menu accepts links to (routing PR12), narrowed by
+   * `normalizeMenuEntityTypes`. `null` = accepts every type. Read with
+   * draft-then-live precedence, same as `tree`.
+   */
+  entityTypes: string[] | null;
+}
+/** One content type offered in the "Add link" picker's Content tab. */
+interface MenuEditorStateEntityType {
+  name: string;
+  label: string;
+}
+/** Full response body for `GET /api/admin/menus/editor-state?handle=`. */
+interface MenuEditorStateResponse {
+  menu: MenuEditorStateMenu;
+  /** Keyed `` `${entity}:${id}` `` — see `resolveMenuItemSummaries`. */
+  summaries: Readonly<Record<string, MenuItemSummary>>;
+  locales: ReadonlyArray<{
+    code: string;
+    label: string;
+  }>;
+  defaultLocale: string;
+  /**
+   * How many stored nodes the tolerant `normalizeMenuTree` could NOT read.
+   *
+   * Every menu write is whole-tree, so `> 0` means a save from this surface
+   * would PERMANENTLY delete those items — `<MenuTreeEditor>` refuses to save
+   * past it without an explicit confirm. Counted against the very read being
+   * handed back (not a separate projection), so the number always describes
+   * the tree the editor is about to write.
+   */
+  droppedItemCount: number;
+  entityTypes: readonly MenuEditorStateEntityType[];
+  canPublish: boolean;
+  /**
+   * The pending draft for this menu, when one exists.
+   *
+   * Structurally identical to `@murumets-ee/admin-ui`'s `DraftInfo` (declared
+   * here rather than imported — `menus` must not depend on a UI package), and
+   * assignability is checked at the seam where `menus-ui` passes it into
+   * `MenuTreeEditorProps.draft`.
+   *
+   * **Load-bearing, not cosmetic.** `useContentEditor.saveDraft` REPLACES the
+   * draft's `data` rather than merging, so the editor must know the existing
+   * payload to spread it back — otherwise saving the tree from this surface
+   * silently drops a `title` / `handle` / `maxDepth` edit staged in the same
+   * draft from the entity form. `<MenuTreeEditor>` does that spread; this
+   * field is what makes it possible here as well as on the standalone page.
+   */
+  draft?: {
+    data: Record<string, unknown>;
+    createdBy: string;
+    createdByName: string | null;
+    updatedAt: string;
+  };
+}
+//#endregion
+//#region src/admin/routes.d.ts
+/**
+ * Most distinct handles one request resolves — the amplification bound.
+ *
+ * The number is `MAX_RENDERED_MENU_HANDLES` in `@murumets-ee/blocks/library`:
+ * what one canvas resolves when it opens, so what one canvas can come to need.
+ * Restated rather than imported because that entry is the whole block library
+ * and this module is on the `lumi.config.ts` load path; `routes.test.ts` holds
+ * the two equal.
+ */
+declare const MAX_RESOLVED_HANDLES = 8;
+/** `GET /api/admin/menus/resolved` — `null` for a handle with no published menu. */
+interface ResolvedMenusResponse {
+  menus: Record<string, ResolvedMenuNavItem[] | null>;
+}
+/**
+ * Every admin route this package contributes, in the `AdminRoute[]` shape
+ * `createAdminApiHandler` consumes.
+ *
+ * Wired declaratively via the plugin's `server.routes` slot — see
+ * `@murumets-ee/menus-ui`.
+ *
+ * @example
+ * ```ts
+ * import { menusRoutes } from '@murumets-ee/menus/admin'
+ *
+ * definePlugin({ name: '…', server: { routes: menusRoutes() } })
+ * ```
+ */
+declare function menusRoutes(): AdminRoute[];
+//#endregion
+//#region src/admin/summaries.d.ts
+/**
+ * Batch-resolve the live title + existence + publish state of every
+ * `{ entity, id }` target, keyed `` `${entity}:${id}` `` (the same key shape
+ * `resolveRowTitles` uses).
+ *
+ * **A MISSING map entry means "not resolvable here", NOT "broken."** It happens
+ * when the entity type isn't registered in this app, when the caller holds no
+ * `view` grant on it, when that group's read failed, or (for a `team`/`user`-
+ * scoped entity only) when the row belongs to a different scope than this
+ * request's — a scope filter excludes it the same way a delete would, and
+ * this function cannot tell the two apart. Callers should render such items
+ * as indeterminate — only an explicit `exists: false` (reported ONLY for a
+ * `global`-scoped entity, where no scope filter can ever apply) means the
+ * target was really deleted.
+ *
+ * Best-effort per group: one group's failure never takes down the others (and
+ * therefore never takes down the editor page).
+ */
+declare function resolveMenuItemSummaries(app: ToolkitApp, refs: ReadonlyArray<{
+  entity: string;
+  id: string;
+}>): Promise<Map<string, MenuItemSummary>>;
+//#endregion
+export { ANCHOR_PATTERN, type BlockAnchor, MAX_ANCHOR_LENGTH, MAX_MENU_DEPTH, MAX_MENU_SOURCE_PAGE, MAX_MENU_TREE_NODES, MAX_RESOLVED_HANDLES, type MenuEditorStateEntityType, type MenuEditorStateMenu, type MenuEditorStateResponse, type MenuItem, type MenuItemSummary, type MenuSchemaOptions, type ResolvedMenusResponse, applyMenuLabelTranslations, buildMenuItemSchema, buildMenuTreeSchema, collectMenuLabelTexts, measureMenuTree, menuTranslatableSource, menuTreeRevision, menusContributions, menusRoutes, resolveMenuItemSummaries, validateTreeDepth };
+//# sourceMappingURL=admin.d.mts.map

package/dist/admin.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/menu-item-schema.ts","../src/translatable-source.ts","../src/admin/editor-state.ts","../src/admin/routes.ts","../src/admin/summaries.ts"],"mappings":";;;;;;AA+HA;;;;;AAAA,cA7Fa,cAAA;;;;;;AAgGa;AAgB1B;cApGa,mBAAA;;;;AAuHO;AAcpB;;;;;;;cAlGa,iBAAA;;AAmIG;AAmHhB;;;;;cAnOa,cAAA,EAAc,MAAqB;;;;;;;;;;;;AAqOb;AAkDnC;;;;;;;;;;;;;KA5PY,aAAA;EACN,IAAA;EAAgB,MAAA;EAAgB,EAAA;EAAY,MAAA;AAAA;EAC5C,IAAA;EAAa,GAAA;AAAA;EACb,IAAA;EAAe,KAAA;AAAA;;;AAgR8C;AA0CnE;;;;AAAiE;;;;AClYjE;;;KDwFY,QAAA;ECxFqB,yDD0F/B,EAAA,UC/C8B;EDiD9B,IAAA;ECjD4C;AAAA;AAc9C;;;;;;ED4CE,IAAA,GAAO,aAAA,cC1C8C;ED4CrD,KAAA,EAAO,MAAA,yBC3CN;ED6CD,OAAA,GAAU,MAAA;EACV,MAAA;EACA,QAAA,EAAU,QAAA;AAAA;;;;;;;;;;;ACZiB;UD0BZ,eAAA;ECqNhB;;;AAAA;AAUD;;EDxNE,KAAA;;EAEA,MAAA;;EAEA,SAAA;AAAA;AErKF;;;;;AAAA,UF6KiB,WAAA;EE1Kf;EF4KA,MAAA;EE1KA;EF4KA,KAAK;AAAA;;UAIU,iBAAA;EEzKJ;AAIb;;;;EF2KE,cAAc;AAAA;AG4R2B;AAmH3C;;;;AAAyC;AAnHE,iBHzK3B,mBAAA,CACd,OAAA,EAAS,iBAAA,GACR,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,CAAA,CAAE,UAAA;;iBAkDT,mBAAA,CACd,OAAA,EAAS,iBAAA,GACR,CAAA,CAAE,OAAA,CAAQ,QAAA,IAAY,CAAA,CAAE,UAAA;AInR3B;AAAA,UJwRiB,mBAAA;;EAEf,KAAA;EIxRM;EJ0RN,SAAS;AAAA;;;;;;;;;;iBAYK,eAAA,CAAgB,IAAA,YAAgB,mBAAmB;;;;AIrS7B;;;iBJ+UtB,iBAAA,CAAkB,IAAA,WAAe,QAAgB;;;AA1SjE;AAAA,cCxFa,oBAAA;;;;;;;iBA2CG,gBAAA,CAAiB,IAAa;;;;;;;;;iBAc9B,qBAAA,CACd,IAAA,WACA,KAAA;EAAS,YAAA;EAAsB,YAAA;EAAsB,IAAA;AAAA,IACpD,sBAAsB;AD6DzB;;;;;;;;AAWW;AAQX;AAnBA,iBC9BgB,0BAAA,CACd,IAAA,WACA,YAAA,UACA,KAAA,EAAO,QAAQ,CAAC,MAAA;EACb,IAAA;EAAiB,OAAA;AAAA;;;;;cAsOT,sBAAA,EAAwB,kBASpC;;;;;;;;;cAUY,kBAAA;iCAE+D,kBAAA;AAAA;;;;UC3X3D,mBAAA;EACf,EAAA;EACA,MAAA;EACA,KAAA;EACA,QAAA;EACA,MAAA;EACA,IAAA,EAAM,QAAQ;EFiGV;;;;;EE3FJ,WAAA;AAAA;;UAIe,yBAAA;EACf,IAAA;EACA,KAAK;AAAA;;UAIU,uBAAA;EACf,IAAA,EAAM,mBAAA;EFmHI;EEjHV,SAAA,EAAW,QAAA,CAAS,MAAA,SAAe,eAAA;EACnC,OAAA,EAAS,aAAA;IAAgB,IAAA;IAAc,KAAA;EAAA;EACvC,aAAA;EF2GO;;;;;;;;;EEjGP,gBAAA;EACA,WAAA,WAAsB,yBAAA;EACtB,UAAA;;;;;;;AF8HS;AAQX;;;;AAIO;AAIP;;;EE9HE,KAAA;IACE,IAAA,EAAM,MAAA;IACN,SAAA;IACA,aAAA;IACA,SAAA;EAAA;AAAA;;;;;AF0GO;AAQX;;;;AAIO;AAIP;cGiRa,oBAAA;;UAYI,qBAAA;EAKf,KAAA,EAAO,MAAM,SAAS,mBAAA;AAAA;;;;;;;;;;;;;;;iBAmHR,WAAA,IAAe,UAAU;;;AHjdzC;;;;;;;;;;;;;;;;;;AAAA,iBIxCsB,wBAAA,CACpB,GAAA,EAAK,UAAA,EACL,IAAA,EAAM,aAAA;EAAgB,MAAA;EAAgB,EAAA;AAAA,KACrC,OAAA,CAAQ,GAAA,SAAY,eAAA"}

package/dist/admin.mjs

@@ -0,0 +1,2 @@
+import{a as e,c as t,d as n,f as r,i,l as a,n as o,o as s,r as c,s as l,t as u,u as d}from"./columns-DwDukx_r.mjs";import{resolveLinkHref as f}from"@murumets-ee/blocks/links";import{z as p}from"zod";import{createHash as m}from"node:crypto";import{getContentConfig as h}from"@murumets-ee/content/plugin";import{combineAdminRoutes as g,defineAdminRoute as _,getContext as v,getCurrentApp as y,getCurrentScope as b,siteSecurityFields as x}from"@murumets-ee/core";import{asc as S,eq as ee,gt as C,inArray as w}from"drizzle-orm";import{VIEW_UNPUBLISHED_ACTION as T,getBlockTreeFieldName as E,getEntityTitleField as D,getSearchableConfig as te}from"@murumets-ee/entity";import{QueryClient as O}from"@murumets-ee/entity/query";const ne=200,k=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function A(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function j(e){return typeof e==`string`&&e.trim()!==``}function M(e){let t=[],n=Array.isArray(e)?[...e].reverse():[];for(;n.length>0;){let e=n.pop();if(A(e)){if(t.push(e),t.length>500)throw Error(`menu tree has more than 500 items`);if(Array.isArray(e.children))for(let t=e.children.length-1;t>=0;t--)n.push(e.children[t])}}return t}function N(e){return m(`sha256`).update(JSON.stringify(Array.isArray(e)?e:[])).digest(`hex`)}function P(e,t){let{sourceLocale:n,targetLocale:r,mode:i}=t;if(n===r)return[];let a=[],o=new Set;for(let t of M(e)){let{id:e,label:s}=t;if(!j(e)||o.has(e)||!A(s))continue;let c=Object.hasOwn(s,n)?s[n]:void 0;if(!j(c))continue;let l=Object.hasOwn(s,r)?s[r]:void 0;i===`missing`&&j(l)||(o.add(e),a.push({key:e,text:c,maxLength:200}))}return a}function F(e,t,n){let r=Array.isArray(e)?structuredClone(e):[],i=0;for(let e of M(r)){let{id:r,label:a}=e;if(typeof r!=`string`||!Object.hasOwn(n,r)||!A(a))continue;let o=n[r];if(typeof o!=`string`)continue;let s=o.trim();if(s!==``){if(s.length>200)throw Error(`menu item ${r}: the translated label is longer than 200 characters`);e.label={...a,[t]:s},i++}}return{tree:r,applied:i}}function I(e){if(e===null||typeof e==`string`||typeof e==`boolean`)return e;if(typeof e==`number`)return Number.isFinite(e)?e:null;if(Array.isArray(e))return e.map(I);if(A(e)){let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=I(r));return t}return null}async function re(e){let{ContentClient:t}=await import(`@murumets-ee/content/client`);return new t({admin:e.getClient(o),entity:o})}async function L(e,t){if(!k.test(t))return null;let n=await e.getClient(o).findById(t);if(!n)return null;let r=await re(e),i=await r.getDraft(t,`_`),a=A(i?.data)?i.data:void 0;return{tree:a!==void 0&&`tree`in a?a.tree:n.tree,draftData:a,content:r}}async function ie(e,t){if(t.after!==void 0&&!k.test(t.after))throw Error("menu translatable source: `after` is not a menu id");let n=Number.isFinite(t.limit)?Math.min(Math.max(Math.trunc(t.limit),1),200):200,r=e.getClient(o),i=u(r.getTable(),`id`);return(await r.findMany({...t.after!==void 0&&{where:C(i,t.after)},orderBy:S(i),limit:n})).map(e=>{let t=e;return{id:t.id,label:typeof t.title==`string`?t.title:``}})}async function ae(e,t){let n=await L(e,t.id);return n===null?null:{revision:N(n.tree),texts:P(n.tree,t)}}function oe(){let e=v(),t=e?.user?.groups[0];if(t===void 0||e?.checker?.(t,o.name,`update`)!==!0)throw Error(`menu translatable source: the caller may not update menus`)}async function se(e,t,n){oe();let r=await L(e,t.id);if(r===null)return`not_found`;if(N(r.tree)!==t.revision)return`changed`;if(!n.includes(t.targetLocale))throw Error(`menu ${t.id}: the target locale is not one of the site's content languages (${n.join(`, `)})`);let{tree:i,applied:a}=F(r.tree,t.targetLocale,t.texts);if(a===0)return`written`;let s=d({allowedLocales:n}).safeParse(i);if(!s.success){let e=s.error.issues.slice(0,5).map(e=>`${e.path.join(`.`)}: ${e.message}`).join(`; `);throw Error(`menu ${t.id}: the translated tree is not valid — ${e}`)}let{LockService:c}=await import(`@murumets-ee/content/lock`),l=await new c({app:e}).getLock(o.name,t.id,`_`);if(l&&l.lockedBy!==t.user.id)throw Error(`menu ${t.id}: is being edited by ${l.lockedByName??l.lockedBy} — try again when they have finished`);return await r.content.saveDraft(t.id,{...r.draftData,tree:I(s.data)},`_`,t.user),`written`}function R(){let e=y();if(e===void 0)throw Error(`menu translatable source: called outside a request context`);return e}function ce(){let e=v()?.availableLocales;return e!==void 0&&e.length>0?e:h().locales.map(e=>e.code)}const z={kind:`menu`,label:`Menus`,labelKey:`Menus.translatableSource.menu`,permission:{resource:`menu`,action:`update`},draft:!0,list:e=>ie(R(),e),read:e=>ae(R(),e),write:e=>se(R(),e,ce())},le={"content.translatableSources":[z]};function B(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))return;let r=e;for(let e of t===n?[t]:[t,n]){if(!Object.hasOwn(r,e))continue;let t=r[e];if(typeof t==`string`&&t.length>0)return t}}function ue(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return;let n=e;if(!Object.hasOwn(n,t))return;let r=n[t];return typeof r==`boolean`?r:void 0}function de(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function fe(t,n,r,i){let a=new Map,o=new Map,s=500,c=0;function l(e,t,n){let r=e.get(t);r?r.add(n):e.set(t,new Set([n]))}function u(t,d){if(d>i||!Array.isArray(t))return[];let f=t,p=[];for(let t of f){if(s<=0){c++;continue}if(!de(t))continue;let i=t.id,f=t.kind;if(typeof i!=`string`||i.length===0||f!==`link`&&f!==`header`||ue(t.enabled,n)===!1)continue;s--;let m;if(f===`link`){let n=e.safeParse(t.link);if(!n.success)continue;m=n.data}else if(t.link!==void 0)continue;let h=u(t.children,d+1);m?.kind===`entity`&&(l(a,m.entity,m.id),B(t.label,n,r)===void 0&&l(o,m.entity,m.id)),p.push({id:i,kind:f,link:m,label:t.label,newTab:t.newTab===!0,children:h})}return p}return{nodes:u(t,1),idsByType:a,titleIdsByType:o,droppedForBudget:c}}async function pe(e,t,n,r){let i=new Map,a=new Map,o=new Map,s=[...e.idsByType.entries()];return s.length>16&&n.logger?.warn({handle:r,locale:t,entityTypes:s.length,cap:16},`menu resolution dropped entity-type groups over the fan-out cap`),await Promise.all(s.slice(0,16).map(async([r,s])=>{let c=[...s],l=await n.resolveCanonicalPaths(r,c,t);if(i.set(r,l),l.size===0)return;let u=[...l.keys()],d=await n.filterPublished(r,u,t);a.set(r,d);let f=e.titleIdsByType.get(r);if(f===void 0)return;let p=u.filter(e=>f.has(e)&&d.has(e));p.length!==0&&o.set(r,await n.resolveTitles(r,p,t))})),{paths:i,published:a,titles:o}}function V(e,t,n,r){let i=[];for(let a of e){let e=V(a.children,t,n,r),o=B(a.label,t,r.defaultLocale);if(a.kind===`header`){if(e.length===0||o===void 0)continue;i.push({id:a.id,kind:`header`,label:o,href:null,newTab:!1,isActive:!1,inActiveTrail:!1,children:e});continue}let s=a.link;if(s===void 0)continue;let c,l=o;if(s.kind===`entity`){let e=n.paths.get(s.entity)?.get(s.id);if(e===void 0||n.published.get(s.entity)?.has(s.id)!==!0)continue;c=s.anchor===void 0?e:`${e}#${s.anchor}`,l??=n.titles.get(s.entity)?.get(s.id)}else c=f(s);c===null||c.length===0||l===void 0||l.length===0||i.push({id:a.id,kind:`link`,label:l,href:c,newTab:a.newTab,isActive:!1,inActiveTrail:!1,children:e})}return i}function H(e){let t=e.indexOf(`#`),n=t===-1?e:e.slice(0,t);return n.length>1&&n.endsWith(`/`)?n.slice(0,-1):n}function U(e,t){let n=!1;return{items:e.map(e=>{let r=U(e.children,t),i=e.href!==null&&H(e.href)===t,a=r.containsActive;return(i||a)&&(n=!0),{...e,isActive:i,inActiveTrail:a,children:r.items}}),containsActive:n}}function me(e,t){return{...e,items:U(e.items,H(t)).items}}async function he(e,t,n){if(e.length===0||e.length>128)return null;let r=await n.getMenuRow(e);if(r===null)return null;let i=r.maxDepth,a=typeof i==`number`&&Number.isInteger(i)&&i>=1?Math.min(i,6):3,o=fe(r.tree,t.locale,n.defaultLocale,a);o.droppedForBudget>0&&n.logger?.warn({handle:e,locale:t.locale,dropped:o.droppedForBudget,cap:500},`menu resolution dropped items over the node budget`);let s=await pe(o,t.locale,n,e),c={handle:e,items:V(o.nodes,t.locale,s,n)};return t.currentPath===void 0?c:me(c,t.currentPath)}function W(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function G(e,t){if(!W(e))return;let n={};for(let[r,i]of Object.entries(e))t(i)&&(n[r]=i);return n}const ge=e=>typeof e==`string`,_e=e=>typeof e==`boolean`;function ve(t){let n=500,r=0;function i(t,a){if(!Array.isArray(t))return[];let o=t;if(a>6)return r+=o.length,[];let s=[];for(let t of o){if(!W(t)){r++;continue}let o=t.id,c=t.kind;if(typeof o!=`string`||o.length===0){r++;continue}if(c!==`link`&&c!==`header`){r++;continue}let l;if(c===`link`){let n=e.safeParse(t.link);if(!n.success){r++;continue}l=n.data}else if(t.link!==void 0){r++;continue}if(n<=0){r++;continue}n--;let u=G(t.label,ge),d=u!==void 0&&Object.keys(u).length>0?u:void 0,f=G(t.enabled,_e),p=f!==void 0&&Object.keys(f).length>0?f:void 0;s.push({id:o,kind:c,link:l,label:d??null,enabled:p,newTab:typeof t.newTab==`boolean`?t.newTab:void 0,children:i(t.children,a+1)})}return s}return{items:i(t,1),dropped:r}}function ye(e){let t=new Set,n=[];function r(e){for(let i of e){let e=i.link;if(e?.kind===`entity`){let r=`${e.entity}:${e.id}`;t.has(r)||(t.add(r),n.push({entity:e.entity,id:e.id}))}r(i.children)}}return r(e),n}const K=1e3;function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function be(e){let t=e.props;if(!q(t))return;let n=t.anchor;if(typeof n!=`string`||n.length===0||n.length>128||!i.test(n))return;let r=t.anchorLabel;return{anchor:n,label:typeof r==`string`&&r.length>0&&r.length<=200?r:n}}function xe(e,t){let n=[];if(!Array.isArray(e))return{anchors:n,truncated:!1,visited:0};let r=e,i=0,a=!1;r.length>1e3&&(a=!0);let o=[];for(let e=Math.min(r.length,K)-1;e>=0;e--)o.push(r[e]);for(;o.length>0;){if(i>=1e3||n.length>=200){a=!0;break}let e=o.pop();if(i++,!q(e))continue;let t=be(e);t!==void 0&&n.push(t);let r=e.children;if(Array.isArray(r)){let e=r,t=Math.max(K-i,0);e.length>t&&(a=!0);for(let n=Math.min(e.length,t)-1;n>=0;n--)o.push(e[n])}}return a&&t?.warn({visited:i,collected:n.length,nodeBudget:K,resultCap:200},`anchor collection stopped at a hard bound — the returned list is incomplete`),{anchors:n,truncated:a,visited:i}}function J(e,t){return`${e}:${t}`}const Se={title:null,exists:!1,published:null};function Ce(e){let t=new Map,n=0,r=0;for(let i of e){if(typeof i.entity!=`string`||typeof i.id!=`string`||i.entity.length===0||i.id.length===0)continue;let e=t.get(i.entity);if(!e?.has(i.id)){if(n>=500){r++;continue}n++,e?e.add(i.id):t.set(i.entity,new Set([i.id]))}}let i=Math.max(0,t.size-16);return{groups:t,droppedRefs:r,droppedGroups:i}}async function Y(e,t){let n=new Map;if(t.length===0)return n;let r=e.logger.child({resolve:`menu-item-summaries`}),{groups:i,droppedRefs:a,droppedGroups:o}=Ce(t);return a>0&&r.warn({dropped:a,cap:500},`menu item summaries dropped targets over the ref budget — some rows will show no status`),o>0&&r.warn({dropped:o,cap:16},`menu item summaries dropped entity-type groups over the fan-out cap`),await Promise.all([...i.entries()].slice(0,16).map(([t,i])=>we(e,r,t,i,n))),n}async function we(e,t,n,r,i){let a=e.entities.get(n);if(a===void 0)return;let o=D(a),s=o!==`id`,c=a.behaviors?.some(e=>e.name===`publishable`)??!1,l=[...r];try{let t=e.getClient(a),r=await t.findMany({where:w(u(t.getTable(),`id`),l),limit:l.length}),d=new Set;for(let e of r){let t=e,r=t.id;if(typeof r!=`string`)continue;let a=s?t[o]:void 0;d.add(r),i.set(J(n,r),{title:typeof a==`string`&&a.length>0?a:null,exists:!0,published:c?t.status===`published`:null})}if((a.scope??`global`)===`global`)for(let e of l)d.has(e)||i.set(J(n,e),Se)}catch(e){t.warn({entity:n,count:l.length,error:String(e)},`menu item summaries could not be resolved for this entity type`)}}const Te=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function X(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function Z(e,t){return X({error:e},t)}function Q(){return X([])}function Ee(e){return E(e)??null}const De=_({prefix:`menus`,path:`anchors`,method:`GET`,permission:`menu:view`,defaultRoles:[`admin`],description:`List a published document's addressable block anchors for the menu editor's anchor picker.`,tokens:`accept`,handler:async(e,t)=>{let n=new URL(e.url).searchParams,r=n.get(`entity`),i=n.get(`id`);if(r===null||r.length===0)return Z(`query param 'entity' is required`,400);if(r.length>64)return Z(`query param 'entity' is too long`,400);if(i===null||!Te.test(i))return Z(`query param 'id' must be a uuid`,400);let a=y();if(a===void 0)return Z(`Internal error`,500);let o=a.logger.child({route:`menus/anchors`,entity:r});if(!t.checkPermission(r,`view`))return o.debug({userId:t.user.id,role:t.user.role},`anchors lookup returned empty — caller holds no view grant on the target entity`),Q();let s=a.entities.get(r);if(s===void 0)return Q();let c=Ee(s);if(c===null)return Q();let l=b(),u=await new O({entity:s,db:a.db.readOnly,logger:o,contextResolver:()=>({user:{id:t.user.id,groups:[t.user.role??`viewer`]},checker:(e,n,r)=>r!==T&&t.checkPermission(n,r),...l!==void 0&&{scope:l},...x(void 0,a)})}).findById(i,{...t.locale!==void 0&&{locale:t.locale},...t.defaultLocale!==void 0&&{defaultLocale:t.defaultLocale}});if(u===null)return Q();let{anchors:d}=xe(u[c],o);return X(d)}}),Oe=async(e,t)=>{let n=new URL(e.url).searchParams.get(`handle`);if(n===null||n.length===0)return Z(`query param 'handle' is required`,400);if(n.length>128)return Z(`query param 'handle' is too long`,400);let r=y();if(r===void 0)return Z(`Internal error`,500);let i=r.logger.child({route:`menus/editor-state`}),a=r.getClient(o),s=(await a.findMany({where:ee(u(a.getTable(),`handle`),n),limit:1}))[0];if(s===void 0)return Z(`Menu not found`,404);let l=s.id,d=typeof s.title==`string`?s.title:``,f=s.maxDepth,p=typeof f==`number`&&Number.isInteger(f)&&f>=1?Math.min(f,6):3,m=s.status===`published`?`published`:`draft`,h=v()?.availableLocales,g=t.defaultLocale??h?.[0]??`en`,_=h&&h.length>0?[...h]:[],b=(_.includes(g)?_:[g,..._]).map(e=>({code:e,label:e})),x=await ke(r,l,i),S=x?.data,{items:C,dropped:w}=ve(S!==void 0&&`tree`in S?S.tree:s.tree);w>0&&i.warn({menuId:l,handle:n,dropped:w},`menu editor-state: stored tree contained items that could not be read — the embedded editor shows the rest`);let T=await Y(r,ye(C)),E=Object.fromEntries(T),D=[...r.entities.values()].filter(e=>te(e)!==void 0&&t.checkPermission(e.name,`view`)).map(e=>({name:e.name,label:e.admin?.labelSingular??e.admin?.label??e.name})),O=t.checkPermission(`menu`,`publish`);return X({menu:{id:l,handle:n,title:d,maxDepth:p,status:m,tree:C,entityTypes:c(S!==void 0&&`entityTypes`in S?S.entityTypes:s.entityTypes)},summaries:E,locales:b,defaultLocale:g,droppedItemCount:w,entityTypes:D,canPublish:O,...x!==void 0&&{draft:x}})};async function ke(e,t,n){try{let{ContentClient:n}=await import(`@murumets-ee/content/client`),r=await new n({admin:e.getClient(o),entity:o}).getDraft(t,`_`);return r?{data:r.data,createdBy:r.createdBy,createdByName:r.createdByName,updatedAt:r.updatedAt instanceof Date?r.updatedAt.toISOString():String(r.updatedAt)}:void 0}catch(e){n.warn({err:e,menuId:t},`menu editor-state: draft state unavailable — continuing without`);return}}const Ae=_({prefix:`menus`,path:`editor-state`,method:`GET`,permission:`menu:view`,defaultRoles:[`admin`],description:`Read a menu's full tree + editor metadata by handle, for the blocks editor's in-place Tier 3 menu surface.`,tokens:`accept`,handler:Oe}),$=8,je=p.object({handles:p.array(p.string().min(1).max(128)).min(1).max(8)}),Me=_({prefix:`menus`,path:`resolved`,method:`GET`,permission:`blocks:read-editor-state`,defaultRoles:[`admin`,`editor`],description:`Read the published, resolved items of the menus an editing canvas names, by handle.`,tokens:`accept`,handler:async(e,t)=>{let n=je.safeParse({handles:[...new Set(new URL(e.url).searchParams.getAll(`handle`))]});if(!n.success)return Z(`query param 'handle' must be given 1 to 8 times, each 1 to 128 characters`,400);let{handles:r}=n.data,i=y();if(i===void 0)return Z(`Internal error`,500);let a=i.logger.child({route:`menus/resolved`}),{buildMenuResolveDeps:o}=await import(`./menu-resolve-context-DLIUP8RY.mjs`),s=o(i),c=t.locale??t.defaultLocale??s.defaultLocale,l=await Promise.all(r.map(async e=>{try{let t=await he(e,{locale:c},s);return[e,t===null?null:t.items]}catch(t){a.warn({err:t,handle:e,locale:c},`menu failed to resolve for the canvas; it is left out of the answer`);return}}));return X({menus:Object.fromEntries(l.filter(e=>e!==void 0))})}});function Ne(){return g([De,Ae,Me])}export{i as ANCHOR_PATTERN,s as MAX_ANCHOR_LENGTH,l as MAX_MENU_DEPTH,ne as MAX_MENU_SOURCE_PAGE,t as MAX_MENU_TREE_NODES,$ as MAX_RESOLVED_HANDLES,F as applyMenuLabelTranslations,a as buildMenuItemSchema,d as buildMenuTreeSchema,P as collectMenuLabelTexts,n as measureMenuTree,z as menuTranslatableSource,N as menuTreeRevision,le as menusContributions,Ne as menusRoutes,Y as resolveMenuItemSummaries,r as validateTreeDepth};
+//# sourceMappingURL=admin.mjs.map