@nonext/husk 0.2.3

package/dist/chunk-SOTQ3WP5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types/content-type.ts","../src/types/field.ts"],"names":[],"mappings":";AAiHO,IAAM,mBAAA,GAAsB;AAAA,EACjC,IAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF;;;ACxHO,IAAM,WAAA,GAAc;AAAA,EACzB,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF","file":"chunk-SOTQ3WP5.js","sourcesContent":["import type { FieldDefinition, FieldInputValues, FieldMap, FieldValues } from \"./field.js\"\nimport type { PermissionMatrix } from \"./auth.js\"\n\nexport type ContentTypeKind = \"collection\" | \"singleton\"\n\n/**\n * A field that was removed from a content type while its stored values were kept.\n *\n * Removal is a state, not an absence. The definition is parked here instead of being\n * deleted, so the admin can name the field in a warning, offer it back unchanged, and so a\n * later purge knows what it is about to destroy. Nothing downstream of the registry reads\n * this map: forms, validation, list columns and the SDK all read `fields`, which is why a\n * removed field is inert everywhere without a single consumer having to filter it out.\n */\nexport interface RemovedField {\n  /** Exactly the definition the field had at the moment it was removed. */\n  field: FieldDefinition\n  /** ISO 8601. A plain string, because a stored content type is plain JSON. */\n  removedAt: string\n  /** uid of whoever removed it. */\n  removedBy: string\n}\n\nexport type RemovedFieldMap = { readonly [key: string]: RemovedField }\n\n/** Where a content type came from. Code always wins a slug conflict. See the registry. */\nexport type ContentTypeSource = \"code\" | \"database\"\n\nexport interface ContentType<TFields extends FieldMap = FieldMap> {\n  slug: string\n  kind: ContentTypeKind\n  label: string\n  /** Plural label for a collection. Defaults to `label` when absent. */\n  labelPlural?: string\n  description?: string\n  /** Lucide icon name from the fixed vocabulary in .docs/styleguide/05-icons.md. */\n  icon?: string\n  fields: TFields\n  /**\n   * The order the fields are shown in, as a list of field keys.\n   *\n   * It exists because `fields` is a map, and object key order is not a place to store\n   * meaning: it is not a documented Firestore guarantee, Firestore's own ordering of map\n   * values compares keys sorted, and any re-serialization on the way through may change it.\n   * An array has one order and keeps it. A code-defined type never round trips and keeps its\n   * literal's order, so this key is absent there and the object order is used; the Schema\n   * Builder writes it on every save, which is what makes a reorder survive a reload.\n   *\n   * It is a hint, not a second source of truth. An unknown key in it is ignored and a field\n   * missing from it is appended, so a `fieldOrder` that has drifted from `fields` still\n   * renders every field exactly once.\n   */\n  fieldOrder?: readonly string[]\n  /**\n   * Fields removed from `fields` whose stored values are still on the entries. Absent on a\n   * type that has never had a field removed.\n   */\n  removedFields?: RemovedFieldMap\n  /**\n   * A locked type cannot be edited or deleted through the Schema Builder, and the adapter\n   * rejects schema writes against it even when the UI is bypassed. Only meaningful for a\n   * code-defined type; a database-defined type is never locked.\n   */\n  locked?: boolean\n  /** Field key shown as the entry's title in lists and pickers. */\n  titleField?: keyof TFields & string\n  /** Default sort for list views, as a field key with a direction. */\n  defaultSort?: { field: keyof TFields & string; direction: \"asc\" | \"desc\" }\n  permissions?: PermissionMatrix\n  /** Bumped when the stored shape changes. Read by the M10 migration runner. */\n  schemaVersion?: number\n}\n\n/**\n * A content type with its field map erased to `FieldMap`.\n *\n * `ContentType<TFields>` is invariant in `TFields`, so a concrete content type produced by\n * `defineContentType` is not assignable to `ContentType<FieldMap>`. Everything that handles\n * content types generically (the registry, the adapter, the Schema Builder) takes this\n * structural shape instead, which a concrete content type does satisfy. Authoring and\n * inference keep the generic form.\n */\nexport interface ContentTypeLike {\n  slug: string\n  kind: ContentTypeKind\n  label: string\n  labelPlural?: string\n  description?: string\n  icon?: string\n  fields: FieldMap\n  /**\n   * The order the fields are shown in, as a list of field keys.\n   *\n   * It exists because `fields` is a map and a map does not keep an order once it has been\n   * through Firestore: a stored document returns its map keys sorted, not in the order they\n   * were written. A code-defined type never round trips and keeps its literal's order, so\n   * this key is absent there and the object order is used; the Schema Builder writes it on\n   * every save, which is what makes a reorder survive a reload.\n   *\n   * It is a hint, not a second source of truth. An unknown key in it is ignored and a field\n   * missing from it is appended, so a `fieldOrder` that has drifted from `fields` still\n   * renders every field exactly once.\n   */\n  fieldOrder?: readonly string[]\n  removedFields?: RemovedFieldMap\n  locked?: boolean\n  titleField?: string\n  defaultSort?: { field: string; direction: \"asc\" | \"desc\" }\n  permissions?: PermissionMatrix\n  schemaVersion?: number\n}\n\n/** Field keys the entry metadata already owns; a content type may not redefine them. */\nexport const RESERVED_FIELD_KEYS = [\n  \"id\",\n  \"status\",\n  \"createdAt\",\n  \"createdBy\",\n  \"updatedAt\",\n  \"updatedBy\",\n  \"publishedAt\",\n  \"schemaVersion\",\n] as const\n\nexport type ReservedFieldKey = (typeof RESERVED_FIELD_KEYS)[number]\n\nexport type ContentTypeValues<TType extends { fields: FieldMap }> = FieldValues<\n  TType[\"fields\"]\n>\n\nexport type ContentTypeInputValues<TType extends { fields: FieldMap }> = FieldInputValues<\n  TType[\"fields\"]\n>\n","import type { MediaReference } from \"./media.js\"\n\nexport const FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"number\",\n  \"boolean\",\n  \"select\",\n  \"date\",\n  \"slug\",\n  \"richtext\",\n  \"image\",\n  \"file\",\n  \"relation\",\n  \"repeater\",\n] as const\n\nexport type FieldType = (typeof FIELD_TYPES)[number]\n\n/**\n * The full rule vocabulary. Every rule compiles to the same runtime validator, which the\n * admin form and the adapter both run, so a rule can never be enforced in one place only.\n */\nexport interface ValidationRules {\n  required?: boolean\n  minLength?: number\n  maxLength?: number\n  min?: number\n  max?: number\n  /** Serialized as a string, not a RegExp, because rules travel through Firestore. */\n  pattern?: string\n  /** Rejects a value already held by another entry of the same content type. */\n  unique?: boolean\n}\n\ninterface FieldCommon {\n  label: string\n  description?: string\n  placeholder?: string\n  validation?: ValidationRules\n  /** Hidden fields still store and validate; they are simply not rendered in the form. */\n  hidden?: boolean\n  readonly?: boolean\n}\n\nexport interface TextField extends FieldCommon {\n  type: \"text\"\n  defaultValue?: string\n}\n\nexport interface TextareaField extends FieldCommon {\n  type: \"textarea\"\n  rows?: number\n  defaultValue?: string\n}\n\nexport interface NumberField extends FieldCommon {\n  type: \"number\"\n  step?: number\n  defaultValue?: number\n}\n\nexport interface BooleanField extends FieldCommon {\n  type: \"boolean\"\n  defaultValue?: boolean\n}\n\nexport interface SelectOption<TValue extends string = string> {\n  value: TValue\n  label: string\n}\n\nexport interface SelectField<TValue extends string = string> extends FieldCommon {\n  type: \"select\"\n  options: readonly SelectOption<TValue>[]\n  multiple?: boolean\n  defaultValue?: TValue\n}\n\nexport interface DateField extends FieldCommon {\n  type: \"date\"\n  /** `date` stores `YYYY-MM-DD`; `datetime` stores a full ISO 8601 instant. */\n  precision?: \"date\" | \"datetime\"\n}\n\nexport interface SlugField extends FieldCommon {\n  type: \"slug\"\n  /** Field key the slug is derived from until the editor overrides it. */\n  from?: string\n}\n\n/**\n * Rich text is stored as a serialized document, not as an HTML string, so the editor choice\n * (settled in M5) stays an implementation detail and the value can be re-rendered rather\n * than re-parsed.\n */\nexport interface RichTextValue {\n  format: \"husk-richtext-v1\"\n  content: unknown\n}\n\nexport interface RichtextField extends FieldCommon {\n  type: \"richtext\"\n  /** Marks and blocks the toolbar offers. Absent means the default set. */\n  features?: readonly string[]\n}\n\nexport interface ImageField extends FieldCommon {\n  type: \"image\"\n  accept?: readonly string[]\n}\n\nexport interface FileField extends FieldCommon {\n  type: \"file\"\n  accept?: readonly string[]\n}\n\nexport interface RelationField<TTo extends string = string> extends FieldCommon {\n  type: \"relation\"\n  /** Slug of the referenced content type. */\n  to: TTo\n  many?: boolean\n}\n\nexport interface RepeaterField<TFields extends FieldMap = FieldMap> extends FieldCommon {\n  type: \"repeater\"\n  fields: TFields\n  min?: number\n  max?: number\n}\n\nexport type FieldDefinition =\n  | TextField\n  | TextareaField\n  | NumberField\n  | BooleanField\n  | SelectField\n  | DateField\n  | SlugField\n  | RichtextField\n  | ImageField\n  | FileField\n  | RelationField\n  | RepeaterField\n\nexport type FieldMap = { readonly [key: string]: FieldDefinition }\n\n/** The value one field definition produces, before required-ness is applied. */\nexport type FieldValue<TField extends FieldDefinition> = TField extends\n  TextField | TextareaField | SlugField\n  ? string\n  : TField extends NumberField\n    ? number\n    : TField extends BooleanField\n      ? boolean\n      : TField extends DateField\n        ? string\n        : TField extends SelectField<infer TOption>\n          ? TField extends { multiple: true }\n            ? TOption[]\n            : TOption\n          : TField extends RichtextField\n            ? RichTextValue\n            : TField extends ImageField | FileField\n              ? MediaReference\n              : TField extends RelationField\n                ? TField extends { many: true }\n                  ? string[]\n                  : string\n                : TField extends RepeaterField<infer TFields>\n                  ? FieldValues<TFields>[]\n                  : never\n\ntype IsRequired<TField extends FieldDefinition> = TField extends {\n  validation: { required: true }\n}\n  ? true\n  : false\n\n/**\n * Read shape: every key is present. An optional field reads as `null` rather than\n * `undefined`, so a consumer never has to distinguish \"absent\" from \"empty\".\n */\nexport type FieldValues<TFields extends FieldMap> = {\n  [K in keyof TFields]: IsRequired<TFields[K]> extends true\n    ? FieldValue<TFields[K]>\n    : FieldValue<TFields[K]> | null\n}\n\n/** Write shape: optional fields may be omitted entirely. */\nexport type FieldInputValues<TFields extends FieldMap> = {\n  [K in keyof TFields as IsRequired<TFields[K]> extends true ? K : never]: FieldValue<\n    TFields[K]\n  >\n} & {\n  [K in keyof TFields as IsRequired<TFields[K]> extends true ? never : K]?: FieldValue<\n    TFields[K]\n  > | null\n}\n"]}

package/dist/chunk-TCFFHTY3.js

@@ -0,0 +1,97 @@
+import { PERMISSION_DEFAULTS, resolveDecision } from './chunk-NPDBQBLW.js';
+import { ENTRY_ACTIONS, ROLES } from './chunk-TS7Y7GEZ.js';
+import { SchemaError } from './chunk-4Z6P3XCE.js';
+
+// src/permissions/matrix.ts
+var MATRIX_ACTIONS = ENTRY_ACTIONS;
+var MATRIX_LIMITS = {
+  admin: "An admin is never restricted by a matrix. Removing every other role from an action leaves it admin-only; there is no way to lock an admin out of their own project.",
+  ownership: "An author may only ever update or delete entries they created. Ticking an author here grants the action on their own entries, never on somebody else's.",
+  narrowing: "A matrix can only take permissions away. Ticking a role that its own role does not grant changes nothing, and the row says so.",
+  publicRead: "Denying read hides entries from the admin, not from the public website. A published entry is readable by anyone with its address by design; unpublish it to take it down."
+};
+function isEntryActionKey(value) {
+  return ENTRY_ACTIONS.includes(value);
+}
+function isRole(value) {
+  return typeof value === "string" && ROLES.includes(value);
+}
+function assertValidPermissionMatrix(slug, matrix) {
+  if (matrix === void 0) return;
+  if (typeof matrix !== "object" || matrix === null || Array.isArray(matrix)) {
+    throw new SchemaError(
+      `Content type "${slug}" has a permissions matrix that is not an object.`
+    );
+  }
+  for (const [action, roles] of Object.entries(matrix)) {
+    if (!isEntryActionKey(action)) {
+      throw new SchemaError(
+        `Content type "${slug}" has a permissions entry for "${action}", which is not an entry action. Use one of: ${ENTRY_ACTIONS.join(", ")}.`
+      );
+    }
+    if (!Array.isArray(roles)) {
+      throw new SchemaError(
+        `Content type "${slug}" lists permissions for "${action}" as something other than a list of roles.`
+      );
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const role of roles) {
+      if (!isRole(role)) {
+        throw new SchemaError(
+          `Content type "${slug}" grants "${action}" to "${String(role)}", which is not a role. Known roles: ${ROLES.join(", ")}.`
+        );
+      }
+      if (seen.has(role)) {
+        throw new SchemaError(
+          `Content type "${slug}" lists "${role}" twice under "${action}".`
+        );
+      }
+      seen.add(role);
+    }
+  }
+}
+function normalizePermissionMatrix(matrix) {
+  if (matrix === void 0) return void 0;
+  const normalized = {};
+  for (const action of MATRIX_ACTIONS) {
+    const roles = matrix[action];
+    if (roles === void 0) continue;
+    const kept = ROLES.filter((role) => roles.includes(role));
+    if (sameRoles(kept, defaultRoles(action))) continue;
+    normalized[action] = kept;
+  }
+  return Object.keys(normalized).length === 0 ? void 0 : normalized;
+}
+function defaultRoles(action) {
+  return ROLES.filter((role) => PERMISSION_DEFAULTS[role][action] !== "deny");
+}
+function sameRoles(left, right) {
+  return left.length === right.length && left.every((role) => right.includes(role));
+}
+function matrixDecision(type, role, action) {
+  return resolveDecision(role, action, type);
+}
+function permissionMatrixRows(type) {
+  return MATRIX_ACTIONS.map((action) => ({
+    action,
+    cells: ROLES.map((role) => {
+      const listed = type?.permissions?.[action];
+      return {
+        role,
+        listed: listed === void 0 ? true : listed.includes(role),
+        decision: matrixDecision(type, role, action),
+        fixed: role === "admin" || PERMISSION_DEFAULTS[role][action] === "deny"
+      };
+    })
+  }));
+}
+function withMatrixRole(matrix, action, role, listed) {
+  if (role === "admin" || PERMISSION_DEFAULTS[role][action] === "deny") return matrix;
+  const current = matrix?.[action] ?? defaultRoles(action);
+  const next = listed ? ROLES.filter((candidate) => candidate === role || current.includes(candidate)) : current.filter((candidate) => candidate !== role);
+  return normalizePermissionMatrix({ ...matrix, [action]: next });
+}
+
+export { MATRIX_ACTIONS, MATRIX_LIMITS, assertValidPermissionMatrix, defaultRoles, matrixDecision, normalizePermissionMatrix, permissionMatrixRows, withMatrixRole };
+//# sourceMappingURL=chunk-TCFFHTY3.js.map
+//# sourceMappingURL=chunk-TCFFHTY3.js.map

package/dist/chunk-TCFFHTY3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/permissions/matrix.ts"],"names":[],"mappings":";;;;;AA4BO,IAAM,cAAA,GAAyC;AAY/C,IAAM,aAAA,GAAgB;AAAA,EAC3B,KAAA,EACE,qKAAA;AAAA,EACF,SAAA,EACE,yJAAA;AAAA,EACF,SAAA,EACE,gIAAA;AAAA,EACF,UAAA,EACE;AACJ;AAEA,SAAS,iBAAiB,KAAA,EAAqC;AAC7D,EAAA,OAAQ,aAAA,CAAoC,SAAS,KAAK,CAAA;AAC5D;AAEA,SAAS,OAAO,KAAA,EAA+B;AAC7C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAa,KAAA,CAA4B,SAAS,KAAK,CAAA;AACjF;AAUO,SAAS,2BAAA,CAA4B,MAAc,MAAA,EAAuB;AAC/E,EAAA,IAAI,WAAW,MAAA,EAAW;AAE1B,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAI,WAAA;AAAA,MACR,iBAAiB,IAAI,CAAA,iDAAA;AAAA,KACvB;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAiC,CAAA,EAAG;AAC/E,IAAA,IAAI,CAAC,gBAAA,CAAiB,MAAM,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,CAAA,cAAA,EAAiB,IAAI,CAAA,+BAAA,EAAkC,MAAM,gDAAgD,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,OACvI;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,CAAA,cAAA,EAAiB,IAAI,CAAA,yBAAA,EAA4B,MAAM,CAAA,0CAAA;AAAA,OACzD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,IAAA,KAAA,MAAW,QAAQ,KAAA,EAA6B;AAC9C,MAAA,IAAI,CAAC,MAAA,CAAO,IAAI,CAAA,EAAG;AACjB,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,CAAA,cAAA,EAAiB,IAAI,CAAA,UAAA,EAAa,MAAM,CAAA,MAAA,EAAS,MAAA,CAAO,IAAI,CAAC,CAAA,qCAAA,EAAwC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,SACvH;AAAA,MACF;AACA,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,EAAG;AAClB,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,CAAA,cAAA,EAAiB,IAAI,CAAA,SAAA,EAAY,IAAI,kBAAkB,MAAM,CAAA,EAAA;AAAA,SAC/D;AAAA,MACF;AACA,MAAA,IAAA,CAAK,IAAI,IAAI,CAAA;AAAA,IACf;AAAA,EACF;AACF;AAWO,SAAS,0BACd,MAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAEjC,EAAA,MAAM,aAAiE,EAAC;AAExE,EAAA,KAAA,MAAW,UAAU,cAAA,EAAgB;AACnC,IAAA,MAAM,KAAA,GAAQ,OAAO,MAAM,CAAA;AAC3B,IAAA,IAAI,UAAU,MAAA,EAAW;AAEzB,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,CAAC,SAAS,KAAA,CAAM,QAAA,CAAS,IAAI,CAAC,CAAA;AACxD,IAAA,IAAI,SAAA,CAAU,IAAA,EAAM,YAAA,CAAa,MAAM,CAAC,CAAA,EAAG;AAE3C,IAAA,UAAA,CAAW,MAAM,CAAA,GAAI,IAAA;AAAA,EACvB;AAEA,EAAA,OAAO,OAAO,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,KAAW,IAAI,MAAA,GAAY,UAAA;AAC5D;AAGO,SAAS,aAAa,MAAA,EAAsC;AACjE,EAAA,OAAO,KAAA,CAAM,OAAO,CAAC,IAAA,KAAS,oBAAoB,IAAI,CAAA,CAAE,MAAM,CAAA,KAAM,MAAM,CAAA;AAC5E;AAEA,SAAS,SAAA,CAAU,MAAuB,KAAA,EAAiC;AACzE,EAAA,OAAO,IAAA,CAAK,MAAA,KAAW,KAAA,CAAM,MAAA,IAAU,IAAA,CAAK,KAAA,CAAM,CAAC,IAAA,KAAS,KAAA,CAAM,QAAA,CAAS,IAAI,CAAC,CAAA;AAClF;AAQO,SAAS,cAAA,CACd,IAAA,EACA,IAAA,EACA,MAAA,EACgB;AAGhB,EAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,MAAA,EAAQ,IAAI,CAAA;AAC3C;AAuBO,SAAS,qBACd,IAAA,EACsB;AACtB,EAAA,OAAO,cAAA,CAAe,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,IACrC,MAAA;AAAA,IACA,KAAA,EAAO,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS;AACzB,MAAA,MAAM,MAAA,GAAS,IAAA,EAAM,WAAA,GAAc,MAAM,CAAA;AACzC,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,QAAQ,MAAA,KAAW,MAAA,GAAY,IAAA,GAAO,MAAA,CAAO,SAAS,IAAI,CAAA;AAAA,QAC1D,QAAA,EAAU,cAAA,CAAe,IAAA,EAAM,IAAA,EAAM,MAAM,CAAA;AAAA,QAC3C,OAAO,IAAA,KAAS,OAAA,IAAW,oBAAoB,IAAI,CAAA,CAAE,MAAM,CAAA,KAAM;AAAA,OACnE;AAAA,IACF,CAAC;AAAA,GACH,CAAE,CAAA;AACJ;AAWO,SAAS,cAAA,CACd,MAAA,EACA,MAAA,EACA,IAAA,EACA,MAAA,EAC8B;AAC9B,EAAA,IAAI,IAAA,KAAS,WAAW,mBAAA,CAAoB,IAAI,EAAE,MAAM,CAAA,KAAM,QAAQ,OAAO,MAAA;AAE7E,EAAA,MAAM,OAAA,GAAU,MAAA,GAAS,MAAM,CAAA,IAAK,aAAa,MAAM,CAAA;AACvD,EAAA,MAAM,OAAO,MAAA,GACT,KAAA,CAAM,OAAO,CAAC,SAAA,KAAc,cAAc,IAAA,IAAQ,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAC,CAAA,GAC7E,OAAA,CAAQ,OAAO,CAAC,SAAA,KAAc,cAAc,IAAI,CAAA;AAEpD,EAAA,OAAO,yBAAA,CAA0B,EAAE,GAAG,MAAA,EAAQ,CAAC,MAAM,GAAG,MAAM,CAAA;AAChE","file":"chunk-TCFFHTY3.js","sourcesContent":["import { SchemaError } from \"../core/errors.js\"\nimport { ENTRY_ACTIONS, ROLES } from \"../types/auth.js\"\nimport type { EntryAction, PermissionMatrix, Role } from \"../types/auth.js\"\nimport type { ContentTypeLike } from \"../types/content-type.js\"\n\nimport { PERMISSION_DEFAULTS, resolveDecision } from \"./can.js\"\nimport type { Decision } from \"./can.js\"\n\n/**\n * The per-content-type permission matrix: the editable half of the truth table.\n *\n * `can()` is the resolver. This module is everything around it that is not a decision: what\n * a stored matrix is allowed to look like, what one means once the role defaults are\n * applied, and how an editing screen turns a checkbox into the next matrix. It is here\n * rather than in `can.ts` so the resolver stays a pure lookup that a render can call in a\n * loop.\n *\n * The one rule that governs the whole module: **a matrix narrows, it never widens.** The\n * effective answer is the intersection of the role default and the matrix, so listing\n * `author` under `delete` does not give an author a delete. That is not a simplification\n * for its own sake. The security rules enforce the role defaults directly from the token,\n * and only consult the matrix to narrow further, because widening in the rules would mean\n * trusting a document to grant a privilege. A matrix that could widen would therefore be\n * accepted by this resolver and refused by the database, which is the one thing a\n * permission system must never do.\n */\n\n/** Every action a matrix can speak about. An admin action is never per content type. */\nexport const MATRIX_ACTIONS: readonly EntryAction[] = ENTRY_ACTIONS\n\n/** What a role may do with an action once the defaults and the matrix are both applied. */\nexport type MatrixDecision = Decision\n\n/**\n * The limitations the Developer area has to state rather than imply.\n *\n * A screen that draws a checkbox for something no layer enforces is worse than a screen\n * that omits it: it reads as a guarantee. These are the exact gaps, in the words the\n * screen should use.\n */\nexport const MATRIX_LIMITS = {\n  admin:\n    \"An admin is never restricted by a matrix. Removing every other role from an action leaves it admin-only; there is no way to lock an admin out of their own project.\",\n  ownership:\n    \"An author may only ever update or delete entries they created. Ticking an author here grants the action on their own entries, never on somebody else's.\",\n  narrowing:\n    \"A matrix can only take permissions away. Ticking a role that its own role does not grant changes nothing, and the row says so.\",\n  publicRead:\n    \"Denying read hides entries from the admin, not from the public website. A published entry is readable by anyone with its address by design; unpublish it to take it down.\",\n} as const\n\nfunction isEntryActionKey(value: string): value is EntryAction {\n  return (ENTRY_ACTIONS as readonly string[]).includes(value)\n}\n\nfunction isRole(value: unknown): value is Role {\n  return typeof value === \"string\" && (ROLES as readonly string[]).includes(value)\n}\n\n/**\n * Refuses a malformed matrix before it is stored.\n *\n * Called from `assertValidContentType`, so a database-defined type read back out of\n * Firestore goes through exactly the same check as a code-defined one. A matrix that named\n * an unknown role would be read by the security rules as a list that simply never matches,\n * which denies silently; better to refuse the write than to ship a rule nobody can explain.\n */\nexport function assertValidPermissionMatrix(slug: string, matrix: unknown): void {\n  if (matrix === undefined) return\n\n  if (typeof matrix !== \"object\" || matrix === null || Array.isArray(matrix)) {\n    throw new SchemaError(\n      `Content type \"${slug}\" has a permissions matrix that is not an object.`,\n    )\n  }\n\n  for (const [action, roles] of Object.entries(matrix as Record<string, unknown>)) {\n    if (!isEntryActionKey(action)) {\n      throw new SchemaError(\n        `Content type \"${slug}\" has a permissions entry for \"${action}\", which is not an entry action. Use one of: ${ENTRY_ACTIONS.join(\", \")}.`,\n      )\n    }\n\n    if (!Array.isArray(roles)) {\n      throw new SchemaError(\n        `Content type \"${slug}\" lists permissions for \"${action}\" as something other than a list of roles.`,\n      )\n    }\n\n    const seen = new Set<string>()\n    for (const role of roles as readonly unknown[]) {\n      if (!isRole(role)) {\n        throw new SchemaError(\n          `Content type \"${slug}\" grants \"${action}\" to \"${String(role)}\", which is not a role. Known roles: ${ROLES.join(\", \")}.`,\n        )\n      }\n      if (seen.has(role)) {\n        throw new SchemaError(\n          `Content type \"${slug}\" lists \"${role}\" twice under \"${action}\".`,\n        )\n      }\n      seen.add(role)\n    }\n  }\n}\n\n/**\n * The stored form: known actions only, roles deduplicated and in a fixed order.\n *\n * Fixed order because the matrix is written to Firestore and read back by the Schema\n * Builder, and a list whose order changes on every save shows a diff where nothing changed.\n * An action whose list matches the roles the defaults already allow is dropped, so an\n * untouched matrix is stored as absent rather than as a copy of the defaults that would\n * silently stop tracking them.\n */\nexport function normalizePermissionMatrix(\n  matrix: PermissionMatrix | undefined,\n): PermissionMatrix | undefined {\n  if (matrix === undefined) return undefined\n\n  const normalized: { -readonly [K in EntryAction]?: readonly Role[] } = {}\n\n  for (const action of MATRIX_ACTIONS) {\n    const roles = matrix[action]\n    if (roles === undefined) continue\n\n    const kept = ROLES.filter((role) => roles.includes(role))\n    if (sameRoles(kept, defaultRoles(action))) continue\n\n    normalized[action] = kept\n  }\n\n  return Object.keys(normalized).length === 0 ? undefined : normalized\n}\n\n/** The roles whose own defaults allow an action at all, ownership aside. */\nexport function defaultRoles(action: EntryAction): readonly Role[] {\n  return ROLES.filter((role) => PERMISSION_DEFAULTS[role][action] !== \"deny\")\n}\n\nfunction sameRoles(left: readonly Role[], right: readonly Role[]): boolean {\n  return left.length === right.length && left.every((role) => right.includes(role))\n}\n\n/**\n * The effective decision for one role and one action on one content type.\n *\n * Exactly what `can()` resolves, minus the entry lookup, so a screen can label a row\n * without inventing a user. Keep the two in step: a test drives both over the same inputs.\n */\nexport function matrixDecision(\n  type: Pick<ContentTypeLike, \"permissions\"> | undefined,\n  role: Role,\n  action: EntryAction,\n): MatrixDecision {\n  // Delegated rather than reimplemented. The screen must label a cell with the answer the\n  // adapter and the rules will give, not with a second opinion that happens to agree today.\n  return resolveDecision(role, action, type)\n}\n\n/** One role's cell in the Developer area's table. */\nexport interface MatrixCell {\n  role: Role\n  /** Whether the checkbox is ticked: the role is listed, or the matrix is silent. */\n  listed: boolean\n  /** What the three layers will actually do. */\n  decision: MatrixDecision\n  /**\n   * True when the checkbox cannot change the outcome: an admin, who is never restricted,\n   * or a role whose own defaults deny the action regardless of the matrix. The screen\n   * disables the control and says why rather than offering a lie.\n   */\n  fixed: boolean\n}\n\nexport interface MatrixRow {\n  action: EntryAction\n  cells: readonly MatrixCell[]\n}\n\n/** The whole table, in a fixed order, ready to render. */\nexport function permissionMatrixRows(\n  type: Pick<ContentTypeLike, \"permissions\"> | undefined,\n): readonly MatrixRow[] {\n  return MATRIX_ACTIONS.map((action) => ({\n    action,\n    cells: ROLES.map((role) => {\n      const listed = type?.permissions?.[action]\n      return {\n        role,\n        listed: listed === undefined ? true : listed.includes(role),\n        decision: matrixDecision(type, role, action),\n        fixed: role === \"admin\" || PERMISSION_DEFAULTS[role][action] === \"deny\",\n      }\n    }),\n  }))\n}\n\n/**\n * The next matrix after one checkbox is toggled.\n *\n * Unticking a role while the matrix is silent about the action has to materialize the\n * action first, from the defaults rather than from nothing: an empty list means \"nobody but\n * an admin\", and a screen that produced one from a single untick would revoke two roles for\n * one click. Toggling a fixed cell returns the matrix unchanged, so a UI bug cannot store a\n * row that claims something no layer will do.\n */\nexport function withMatrixRole(\n  matrix: PermissionMatrix | undefined,\n  action: EntryAction,\n  role: Role,\n  listed: boolean,\n): PermissionMatrix | undefined {\n  if (role === \"admin\" || PERMISSION_DEFAULTS[role][action] === \"deny\") return matrix\n\n  const current = matrix?.[action] ?? defaultRoles(action)\n  const next = listed\n    ? ROLES.filter((candidate) => candidate === role || current.includes(candidate))\n    : current.filter((candidate) => candidate !== role)\n\n  return normalizePermissionMatrix({ ...matrix, [action]: next })\n}\n"]}

package/dist/chunk-TS7Y7GEZ.js

@@ -0,0 +1,7 @@
+// src/types/auth.ts
+var ROLES = ["admin", "editor", "author"];
+var ENTRY_ACTIONS = ["read", "create", "update", "delete"];
+
+export { ENTRY_ACTIONS, ROLES };
+//# sourceMappingURL=chunk-TS7Y7GEZ.js.map
+//# sourceMappingURL=chunk-TS7Y7GEZ.js.map

package/dist/chunk-TS7Y7GEZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types/auth.ts"],"names":[],"mappings":";AAAO,IAAM,KAAA,GAAQ,CAAC,OAAA,EAAS,QAAA,EAAU,QAAQ;AAa1C,IAAM,aAAA,GAAgB,CAAC,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAQ","file":"chunk-TS7Y7GEZ.js","sourcesContent":["export const ROLES = [\"admin\", \"editor\", \"author\"] as const\n\nexport type Role = (typeof ROLES)[number]\n\n/** Actions performed on the entries of one content type. */\nexport type EntryAction = \"read\" | \"create\" | \"update\" | \"delete\"\n\n/** Actions that are not scoped to a content type. */\nexport type AdminAction =\n  \"manage-schema\" | \"manage-users\" | \"manage-settings\" | \"manage-media\"\n\nexport type Action = EntryAction | AdminAction\n\nexport const ENTRY_ACTIONS = [\"read\", \"create\", \"update\", \"delete\"] as const\n\n/**\n * Who may do what with one content type. A missing action falls back to the role defaults\n * in `can()`, so an empty matrix means \"use the defaults\", not \"deny everything\".\n */\nexport type PermissionMatrix = Partial<Record<EntryAction, readonly Role[]>>\n\n/** One resolved permission question, as the UI, the adapter, and the tests all phrase it. */\nexport interface Permission {\n  action: Action\n  /** Content type slug. Absent for an `AdminAction`. */\n  contentType?: string\n}\n\nexport interface AuthUser {\n  uid: string\n  email: string\n  displayName: string | null\n  role: Role\n  disabled: boolean\n}\n"]}

package/dist/chunk-VLGR5PZX.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-VLGR5PZX.js.map
+//# sourceMappingURL=chunk-VLGR5PZX.js.map

package/dist/chunk-VLGR5PZX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-VLGR5PZX.js"}

package/dist/chunk-ZW2PUSVS.js

@@ -0,0 +1,40 @@
+import { SchemaError } from './chunk-4Z6P3XCE.js';
+
+// src/schema/field-type.ts
+function registerFieldTypes(specs) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const spec of specs) {
+    if (byName.has(spec.name)) {
+      throw new SchemaError(
+        `Field type "${spec.name}" is registered twice. Each field type has exactly one spec.`
+      );
+    }
+    byName.set(spec.name, spec);
+  }
+  return {
+    get: (name) => byName.get(name),
+    has: (name) => byName.has(name),
+    require(name) {
+      const spec = byName.get(name);
+      if (!spec) {
+        throw new SchemaError(
+          `Unknown field type "${name}". Registered types: ${[...byName.keys()].join(", ") || "none"}.`
+        );
+      }
+      return spec;
+    },
+    names: [...byName.keys()]
+  };
+}
+var UNKNOWN_TS_TYPE = "unknown";
+function resolveTsType(registry, field) {
+  const spec = registry.get(field.type);
+  if (spec === void 0) return UNKNOWN_TS_TYPE;
+  const declared = spec.tsType;
+  if (typeof declared === "string") return declared;
+  return declared(field, (nested) => resolveTsType(registry, nested));
+}
+
+export { UNKNOWN_TS_TYPE, registerFieldTypes, resolveTsType };
+//# sourceMappingURL=chunk-ZW2PUSVS.js.map
+//# sourceMappingURL=chunk-ZW2PUSVS.js.map

package/dist/chunk-ZW2PUSVS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema/field-type.ts"],"names":[],"mappings":";;;AAwLO,SAAS,mBACd,KAAA,EACmB;AACnB,EAAA,MAAM,MAAA,uBAAa,GAAA,EAA8B;AAEjD,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,CAAA,YAAA,EAAe,KAAK,IAAI,CAAA,4DAAA;AAAA,OAC1B;AAAA,IACF;AACA,IAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAAA,EAC5B;AAEA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,IAAI,CAAA;AAAA,IAC9B,GAAA,EAAK,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,IAAI,CAAA;AAAA,IAC9B,QAAQ,IAAA,EAAM;AACZ,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC5B,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,CAAA,oBAAA,EAAuB,IAAI,CAAA,qBAAA,EAAwB,CAAC,GAAG,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,IAAK,MAAM,CAAA,CAAA;AAAA,SAC5F;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,KAAA,EAAO,CAAC,GAAG,MAAA,CAAO,MAAM;AAAA,GAC1B;AACF;AAGO,IAAM,eAAA,GAAkB;AAUxB,SAAS,aAAA,CACd,UACA,KAAA,EACQ;AACR,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AACpC,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,eAAA;AAE/B,EAAA,MAAM,WAAwB,IAAA,CAAK,MAAA;AACnC,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,EAAU,OAAO,QAAA;AAEzC,EAAA,OAAO,SAAS,KAAA,EAAO,CAAC,WAAW,aAAA,CAAc,QAAA,EAAU,MAAM,CAAC,CAAA;AACpE","file":"chunk-ZW2PUSVS.js","sourcesContent":["import type { ComponentType } from \"react\"\n\nimport { SchemaError } from \"../core/errors.js\"\nimport type { AnyContentTypeShape, FieldError } from \"../types/entry.js\"\nimport type {\n  FieldDefinition,\n  FieldMap,\n  FieldType,\n  ValidationRules,\n} from \"../types/field.js\"\n\n/** Props every admin field input receives. Field types never read from a store directly. */\nexport interface FieldInputProps<\n  TValue,\n  TField extends FieldDefinition = FieldDefinition,\n> {\n  /** Dotted path, unique within the form: `title`, `blocks.2.heading`. */\n  path: string\n  field: TField\n  value: TValue | null\n  onChange: (value: TValue | null) => void\n  // Spelled with the explicit `| undefined` that `exactOptionalPropertyTypes` requires of a\n  // caller forwarding an optional prop. A repeater passes its own `onBlur` straight down to\n  // every nested input, and without this it could not.\n  onBlur?: (() => void) | undefined\n  errors: readonly FieldError[]\n  disabled?: boolean | undefined\n  readonly?: boolean | undefined\n}\n\nexport type FieldInputComponent<\n  TValue,\n  TField extends FieldDefinition = FieldDefinition,\n> = ComponentType<FieldInputProps<TValue, TField>>\n\n/** Everything a validator may know without touching the database. */\nexport interface ValidateCtx {\n  path: string\n  contentType: AnyContentTypeShape\n  /** All values of the entry being validated, for cross-field rules. */\n  entry: Record<string, unknown>\n}\n\n/**\n * Recursion, for the two field types that contain other fields.\n *\n * `repeater` holds a whole field map, and it cannot convert or name what is inside it\n * without applying the same field type contract one level down. It must not reach for the\n * registry itself: the registry imports every spec, so a spec that imports the registry\n * closes a cycle. The caller that already holds the registry passes the recursion in\n * instead, and both members below are optional, so a spec that nests nothing ignores them\n * and a caller that has no registry still gets a working round trip.\n */\nexport interface NestedConverter {\n  toStored(fields: FieldMap, values: Record<string, unknown>): Record<string, unknown>\n  fromStored(fields: FieldMap, data: Record<string, unknown>): Record<string, unknown>\n}\n\n/** Names the SDK-facing type of any field definition, one level down. */\nexport type TsTypeResolver = (field: FieldDefinition) => string\n\n/**\n * Layer 5, as a value or as a function of the field.\n *\n * A plain string is the common case and stays exactly as it was. A function is what lets a\n * field type whose SDK type depends on its own options say so: `select` narrows on\n * `multiple`, `relation` on `many`, and `repeater` names the object its rows actually\n * hold. `FieldValue<TField>` in types/field.ts already narrows all three for a code-defined\n * type; this is what codegen can say for a type created in the Schema Builder, where the\n * field definition exists only at runtime.\n */\nexport type FieldTsType<TField extends FieldDefinition = FieldDefinition> =\n  string | ((field: TField, resolve: TsTypeResolver) => string)\n\n/**\n * How one per-type option is edited in the Schema Builder.\n *\n * A control, not a field type: `\"choice\"` is a fixed list of values, `\"content-type\"` is a\n * slug picked from the live registry, `\"field-key\"` is a sibling field of the same level.\n * The field editor implements this small vocabulary once, and every field type describes\n * its own options in it, which is what keeps `switch (field.type)` out of the screen.\n */\nexport type FieldOptionControl =\n  | \"text\"\n  | \"number\"\n  | \"boolean\"\n  | \"choice\"\n  | \"select-options\"\n  | \"content-type\"\n  | \"field-key\"\n  | \"string-list\"\n  | \"fields\"\n\nexport interface FieldOptionDescriptor {\n  /** The property this option writes on the field definition. */\n  key: string\n  label: string\n  control: FieldOptionControl\n  help?: string\n  /** A field of this type is incomplete until the option has a value. */\n  required?: boolean\n  /** The values a `\"choice\"` control offers. */\n  choices?: readonly { value: string; label: string }[]\n}\n\n/**\n * Layer 7: what the Schema Builder may configure on this field type, and what it starts as.\n *\n * It exists so that the field editor is generated from the registry exactly as every other\n * admin screen is. Without it, one screen would hold a list of which options belong to\n * which field type, and a field type added later would render as a bare label until\n * somebody remembered to edit that list.\n */\nexport interface FieldEditorSpec {\n  /** Name shown in the field type picker. */\n  label: string\n  /** One line, shown under the name in the picker. */\n  description: string\n  /** The shared validation rules this field type honours. See VALIDATION_RULE_CONTROLS. */\n  rules: readonly (keyof ValidationRules)[]\n  /** The per-type options, in the order the editor shows them. */\n  options: readonly FieldOptionDescriptor[]\n  /**\n   * Everything a new field of this type needs besides `type` and `label`.\n   *\n   * A select with no options and a repeater with no nested fields are both invalid, so a\n   * newly added field cannot start as `{ type, label }` alone.\n   */\n  defaults: Record<string, unknown>\n}\n\n/**\n * The seven-layer contract. A field type is not \"added\" until every member here is\n * implemented; a partial field type is a field type that behaves differently in the form\n * than it does on the server.\n *\n *   1. `name`         schema definition: the discriminator a content type writes\n *   2. `toStored` /\n *      `fromStored`   stored shape: the round trip through Firestore\n *   3. `Input`        admin input component\n *   4. `validate`     validation, run identically by the form and by the adapter\n *   5. `tsType`       SDK-facing type, used by codegen and by the Developer area\n *   6. `defaultValue` registration data: what a new entry starts with\n *   7. `editor`       Schema Builder data: the options, rules and defaults of the type\n */\nexport interface FieldTypeSpec<TValue, TField extends FieldDefinition = FieldDefinition> {\n  name: FieldType\n  toStored(value: TValue | null, field: TField, nested?: NestedConverter): unknown\n  fromStored(raw: unknown, field: TField, nested?: NestedConverter): TValue | null\n  Input: FieldInputComponent<TValue, TField>\n  validate(\n    value: TValue | null,\n    rules: ValidationRules,\n    ctx: ValidateCtx,\n    field: TField,\n  ): FieldError[]\n  tsType: FieldTsType<TField>\n  defaultValue(field: TField): TValue | null\n  editor: FieldEditorSpec\n}\n\n/**\n * A spec whose value and field types have been erased, for storage in the registry.\n *\n * The registry is heterogeneous by construction: one spec per field type, each with a\n * different value type. The erasure stops at this alias; every consumer goes back through\n * the typed `FieldTypeSpec` for the field it is actually handling.\n */\n/* eslint-disable-next-line @typescript-eslint/no-explicit-any */\nexport type AnyFieldTypeSpec = FieldTypeSpec<any, any>\n\nexport interface FieldTypeRegistry {\n  get(name: string): AnyFieldTypeSpec | undefined\n  require(name: string): AnyFieldTypeSpec\n  has(name: string): boolean\n  readonly names: readonly FieldType[]\n}\n\n/**\n * Builds the single registration point for field types.\n *\n * The admin never switches on a field name: it looks the spec up here and renders\n * `spec.Input`. If a screen needs `switch (field.type)`, the abstraction has failed.\n */\nexport function registerFieldTypes(\n  specs: readonly AnyFieldTypeSpec[],\n): FieldTypeRegistry {\n  const byName = new Map<string, AnyFieldTypeSpec>()\n\n  for (const spec of specs) {\n    if (byName.has(spec.name)) {\n      throw new SchemaError(\n        `Field type \"${spec.name}\" is registered twice. Each field type has exactly one spec.`,\n      )\n    }\n    byName.set(spec.name, spec)\n  }\n\n  return {\n    get: (name) => byName.get(name),\n    has: (name) => byName.has(name),\n    require(name) {\n      const spec = byName.get(name)\n      if (!spec) {\n        throw new SchemaError(\n          `Unknown field type \"${name}\". Registered types: ${[...byName.keys()].join(\", \") || \"none\"}.`,\n        )\n      }\n      return spec\n    },\n    names: [...byName.keys()] as FieldType[],\n  }\n}\n\n/** What codegen writes for a field whose type nothing has registered. */\nexport const UNKNOWN_TS_TYPE = \"unknown\"\n\n/**\n * Layer 5 for one field definition, resolved through the registry.\n *\n * The one place that knows a `tsType` may be a function, so no caller has to branch on it,\n * and the one place that supplies the recursion a nesting field type asks for. An\n * unregistered field type resolves to `unknown` rather than throwing: codegen for a\n * database-defined content type must not fail on one field it does not recognise.\n */\nexport function resolveTsType(\n  registry: FieldTypeRegistry,\n  field: FieldDefinition,\n): string {\n  const spec = registry.get(field.type)\n  if (spec === undefined) return UNKNOWN_TS_TYPE\n\n  const declared: FieldTsType = spec.tsType\n  if (typeof declared === \"string\") return declared\n\n  return declared(field, (nested) => resolveTsType(registry, nested))\n}\n"]}

package/dist/chunk-ZYNBMYJ6.js

@@ -0,0 +1,392 @@
+import { ROLES } from './chunk-TS7Y7GEZ.js';
+import { Timestamp, getDoc, doc, setDoc, serverTimestamp, updateDoc } from 'firebase/firestore';
+import { onAuthStateChanged, signOut, createUserWithEmailAndPassword, updateProfile, signInWithEmailAndPassword } from 'firebase/auth';
+
+var META_KEYS = [
+  "id",
+  "status",
+  "createdAt",
+  "createdBy",
+  "updatedAt",
+  "updatedBy",
+  "publishedAt",
+  "schemaVersion"
+];
+function toIso(value) {
+  if (value === null || value === void 0) return null;
+  if (value instanceof Timestamp) return value.toDate().toISOString();
+  if (value instanceof Date) return value.toISOString();
+  if (typeof value === "string") return value;
+  return null;
+}
+function defaultToStored(value, field) {
+  if (value === null || value === void 0) return null;
+  switch (field.type) {
+    case "repeater": {
+      if (!Array.isArray(value)) return null;
+      return value.map(
+        (row) => typeof row === "object" && row !== null && !Array.isArray(row) ? valuesToStored(field.fields, row, void 0) : null
+      );
+    }
+    // A date is stored as the string the editor typed, not as a Timestamp. It is a calendar
+    // value chosen by a human, not an instant, and converting it would move it across a
+    // time-zone boundary on the way back out.
+    default:
+      return value;
+  }
+}
+function defaultFromStored(raw, field) {
+  if (raw === null || raw === void 0) return null;
+  switch (field.type) {
+    case "repeater": {
+      if (!Array.isArray(raw)) return null;
+      return raw.map(
+        (row) => typeof row === "object" && row !== null && !Array.isArray(row) ? valuesFromStored(field.fields, row, void 0) : null
+      );
+    }
+    case "date":
+      return raw instanceof Timestamp ? toIso(raw) : raw;
+    default:
+      return raw;
+  }
+}
+function nestedConverter(fieldTypes) {
+  return {
+    toStored: (fields, values) => valuesToStored(fields, values, fieldTypes),
+    fromStored: (fields, data) => valuesFromStored(fields, data, fieldTypes)
+  };
+}
+function valuesToStored(fields, values, fieldTypes) {
+  const stored = {};
+  const nested = nestedConverter(fieldTypes);
+  for (const [key, field] of Object.entries(fields)) {
+    const value = values[key] ?? null;
+    const spec = fieldTypes?.get(field.type);
+    stored[key] = spec ? spec.toStored(value, field, nested) : defaultToStored(value, field);
+  }
+  for (const [key, value] of Object.entries(values)) {
+    if (key in fields) continue;
+    if (META_KEYS.includes(key)) continue;
+    stored[key] = value;
+  }
+  return stored;
+}
+function valuesFromStored(fields, data, fieldTypes) {
+  const values = {};
+  const nested = nestedConverter(fieldTypes);
+  for (const [key, field] of Object.entries(fields)) {
+    const raw = data[key] ?? null;
+    const spec = fieldTypes?.get(field.type);
+    values[key] = spec ? spec.fromStored(raw, field, nested) : defaultFromStored(raw, field);
+  }
+  return values;
+}
+function metaFromStored(entryId, data) {
+  const status = data["status"];
+  return {
+    id: entryId,
+    status: status === "published" || status === "archived" || status === "draft" ? status : "draft",
+    createdAt: toIso(data["createdAt"]) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+    createdBy: typeof data["createdBy"] === "string" ? data["createdBy"] : "",
+    updatedAt: toIso(data["updatedAt"]) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+    updatedBy: typeof data["updatedBy"] === "string" ? data["updatedBy"] : "",
+    publishedAt: toIso(data["publishedAt"]),
+    schemaVersion: typeof data["schemaVersion"] === "number" ? data["schemaVersion"] : 1
+  };
+}
+function entryFromStored(type, entryId, data, fieldTypes) {
+  return {
+    ...metaFromStored(entryId, data),
+    ...valuesFromStored(type.fields, data, fieldTypes)
+  };
+}
+
+// src/firebase/paths.ts
+var SCHEMAS = "schemas";
+var CONTENT = "content";
+var ENTRIES = "entries";
+var MEDIA = "media";
+var USERS = "users";
+var SETTINGS = "settings";
+function schemaPath(slug) {
+  return `${SCHEMAS}/${slug}`;
+}
+function contentPath(slug) {
+  return `${CONTENT}/${slug}`;
+}
+function entriesPath(slug) {
+  return `${CONTENT}/${slug}/${ENTRIES}`;
+}
+function entryPath(slug, entryId) {
+  return `${entriesPath(slug)}/${entryId}`;
+}
+function mediaPath(mediaId) {
+  return `${MEDIA}/${mediaId}`;
+}
+function userPath(uid) {
+  return `${USERS}/${uid}`;
+}
+function settingsPath(key) {
+  return `${SETTINGS}/${key}`;
+}
+var BOOTSTRAP_KEY = "bootstrap";
+function bootstrapPath() {
+  return settingsPath(BOOTSTRAP_KEY);
+}
+function storageObjectPath(mediaId, fileName) {
+  return `${MEDIA}/${mediaId}/${fileName}`;
+}
+
+// src/firebase/users.ts
+function isRole(value) {
+  return typeof value === "string" && ROLES.includes(value);
+}
+function userFromStored(uid, data) {
+  return {
+    uid,
+    email: typeof data["email"] === "string" ? data["email"] : "",
+    displayName: typeof data["displayName"] === "string" ? data["displayName"] : null,
+    role: isRole(data["role"]) ? data["role"] : "author",
+    createdAt: toIso(data["createdAt"]) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+    disabled: data["disabled"] === true
+  };
+}
+function toAuthUser(stored) {
+  return {
+    uid: stored.uid,
+    email: stored.email,
+    displayName: stored.displayName,
+    role: stored.role,
+    disabled: stored.disabled
+  };
+}
+async function readUser(db, uid) {
+  const snapshot = await getDoc(doc(db, userPath(uid)));
+  return snapshot.exists() ? userFromStored(uid, snapshot.data()) : null;
+}
+async function writeUser(db, user) {
+  const reference = doc(db, userPath(user.uid));
+  await setDoc(reference, {
+    email: user.email,
+    displayName: user.displayName ?? null,
+    role: user.role,
+    disabled: false,
+    createdAt: serverTimestamp()
+  });
+  const written = await getDoc(reference);
+  return userFromStored(user.uid, written.data() ?? {});
+}
+async function patchUser(db, uid, patch) {
+  const reference = doc(db, userPath(uid));
+  const changes = {};
+  if (patch.displayName !== void 0) changes["displayName"] = patch.displayName;
+  if (patch.role !== void 0) changes["role"] = patch.role;
+  if (patch.disabled !== void 0) changes["disabled"] = patch.disabled;
+  if (Object.keys(changes).length > 0) await updateDoc(reference, changes);
+  const written = await getDoc(reference);
+  return userFromStored(uid, written.data() ?? {});
+}
+var AuthError = class extends Error {
+  name = "AuthError";
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+var CREDENTIAL_CODES = /* @__PURE__ */ new Set([
+  "auth/invalid-credential",
+  "auth/wrong-password",
+  "auth/user-not-found",
+  "auth/invalid-email"
+]);
+function errorCode(thrown) {
+  return thrown.code;
+}
+function createHuskAuth(deps) {
+  const { auth, db, claimSync } = deps;
+  const defaultRole = deps.defaultRole ?? "author";
+  async function claimFirstAdmin(uid) {
+    try {
+      await setDoc(doc(db, bootstrapPath()), {
+        firstAdminUid: uid,
+        createdAt: serverTimestamp()
+      });
+      return true;
+    } catch (thrown) {
+      const code = errorCode(thrown);
+      if (code === "permission-denied" || code === "already-exists") {
+        return await markerNames(uid);
+      }
+      throw thrown;
+    }
+  }
+  async function markerNames(uid) {
+    try {
+      const marker = await getDoc(doc(db, bootstrapPath()));
+      return marker.exists() && marker.data()["firstAdminUid"] === uid;
+    } catch {
+      return false;
+    }
+  }
+  async function tokenClaims(user) {
+    const result = await user.getIdTokenResult();
+    const role = result.claims["role"];
+    const disabled = result.claims["disabled"];
+    return {
+      ...typeof role === "string" ? { role } : {},
+      ...typeof disabled === "boolean" ? { disabled } : {}
+    };
+  }
+  async function syncClaims(uid, claims) {
+    await claimSync.sync(uid, claims);
+    if (auth.currentUser?.uid === uid) await auth.currentUser.getIdToken(true);
+  }
+  async function reconcile(user, stored) {
+    const claims = await tokenClaims(user);
+    if (claims.role === stored.role && claims.disabled === stored.disabled) return;
+    await syncClaims(stored.uid, { role: stored.role, disabled: stored.disabled });
+  }
+  async function provision(user) {
+    const role = await claimFirstAdmin(user.uid) ? "admin" : defaultRole;
+    await syncClaims(user.uid, { role, disabled: false });
+    const stored = await writeUser(db, {
+      uid: user.uid,
+      email: user.email ?? "",
+      displayName: user.displayName,
+      role
+    });
+    return toAuthUser(stored);
+  }
+  async function resolve(user) {
+    const existing = await readUser(db, user.uid);
+    if (existing === null) return provision(user);
+    if (existing.disabled) {
+      await signOut(auth);
+      throw new AuthError("disabled", "This account has been disabled.");
+    }
+    await reconcile(user, existing);
+    return toAuthUser(existing);
+  }
+  return {
+    async signIn(email, password) {
+      try {
+        const credential = await signInWithEmailAndPassword(auth, email, password);
+        return await resolve(credential.user);
+      } catch (thrown) {
+        const code = errorCode(thrown);
+        if (code !== void 0 && CREDENTIAL_CODES.has(code)) {
+          throw new AuthError("invalid-credentials", "Email or password is incorrect.");
+        }
+        throw thrown;
+      }
+    },
+    async signUp(input) {
+      const credential = await createUserWithEmailAndPassword(
+        auth,
+        input.email,
+        input.password
+      );
+      if (input.displayName !== void 0) {
+        await updateProfile(credential.user, { displayName: input.displayName });
+      }
+      return resolve(credential.user);
+    },
+    async signOut() {
+      await signOut(auth);
+    },
+    async currentUser() {
+      const user = auth.currentUser;
+      return user === null ? null : await resolve(user);
+    },
+    onChange(listener, onError) {
+      return onAuthStateChanged(auth, (user) => {
+        if (user === null) {
+          listener(null);
+          return;
+        }
+        resolve(user).then(listener, (error) => {
+          listener(null);
+          onError?.(error);
+        });
+      });
+    },
+    getUser(uid) {
+      return readUser(db, uid);
+    },
+    updateProfile(uid, patch) {
+      return patchUser(db, uid, patch);
+    },
+    async setRole(uid, role) {
+      const stored = await patchUser(db, uid, { role });
+      await syncClaims(uid, { role: stored.role, disabled: stored.disabled });
+      return stored;
+    },
+    async setDisabled(uid, disabled) {
+      const stored = await patchUser(db, uid, { disabled });
+      await syncClaims(uid, { role: stored.role, disabled: stored.disabled });
+      return stored;
+    }
+  };
+}
+
+// src/firebase/claims.ts
+var ClaimSyncError = class extends Error {
+  name = "ClaimSyncError";
+  uid;
+  constructor(uid, message) {
+    super(message);
+    this.uid = uid;
+  }
+};
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+function isLoopback(host) {
+  const [hostname] = host.split(":");
+  return hostname !== void 0 && LOOPBACK.has(hostname);
+}
+function createEmulatorClaimSync(options) {
+  const { authHost, projectId } = options;
+  if (!isLoopback(authHost)) {
+    throw new ClaimSyncError(
+      "*",
+      `Emulator claim sync refuses the host "${authHost}". The bearer token "owner" is an emulator affordance and is not accepted by the real Identity Toolkit, so this implementation is loopback-only.`
+    );
+  }
+  return {
+    async sync(uid, claims) {
+      const response = await fetch(
+        `http://${authHost}/identitytoolkit.googleapis.com/v1/projects/${projectId}/accounts:update`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: "Bearer owner" },
+          body: JSON.stringify({
+            localId: uid,
+            customAttributes: JSON.stringify(claims)
+          })
+        }
+      );
+      if (!response.ok) {
+        throw new ClaimSyncError(
+          uid,
+          `Could not set custom claims on ${uid}: ${response.status} ${await response.text()}`
+        );
+      }
+    }
+  };
+}
+function createUnavailableClaimSync(reason) {
+  return {
+    sync(uid) {
+      return Promise.reject(
+        new ClaimSyncError(
+          uid,
+          reason ?? "No custom claim writer is configured. Setting a custom claim needs a privileged context (Admin SDK, Cloud Function, or the Auth emulator), which the client SDK cannot provide. Pass a ClaimSync implementation to createHuskAuth."
+        )
+      );
+    }
+  };
+}
+
+export { AuthError, BOOTSTRAP_KEY, ClaimSyncError, ENTRIES, MEDIA, SCHEMAS, contentPath, createEmulatorClaimSync, createHuskAuth, createUnavailableClaimSync, entriesPath, entryFromStored, entryPath, mediaPath, metaFromStored, patchUser, readUser, schemaPath, settingsPath, storageObjectPath, toAuthUser, toIso, valuesToStored, writeUser };
+//# sourceMappingURL=chunk-ZYNBMYJ6.js.map
+//# sourceMappingURL=chunk-ZYNBMYJ6.js.map