@nonext/husk 0.2.3

package/dist/cli/templates/firestore.rules

@@ -0,0 +1,393 @@
+rules_version = '2';
+
+// Husk security rules.
+//
+// These encode the same truth table as `can()` in the application and the checks in the
+// adapter. Three layers, one matrix: the UI hides what is denied, the adapter refuses it,
+// and these rules refuse it again for a client that skipped both.
+//
+// Roles come from a custom claim so a rule never has to read a user document. M3 syncs the
+// claim when a user's role changes.
+
+service cloud.firestore {
+  match /databases/{database}/documents {
+
+    function signedIn() {
+      return request.auth != null;
+    }
+
+    function role() {
+      return signedIn() ? request.auth.token.get('role', 'none') : 'none';
+    }
+
+    // A role the CMS knows. An account whose claim has not been written yet reports 'none',
+    // which is not one of these, so a session without a synced claim can read nothing. That
+    // is deliberate: claim sync is the only thing that grants access, so a failed sync has
+    // to fail closed.
+    function knownRole() {
+      return role() == 'admin' || role() == 'editor' || role() == 'author';
+    }
+
+    function enabled() {
+      return signedIn() && knownRole() && request.auth.token.get('disabled', false) != true;
+    }
+
+    function isAdmin() {
+      return enabled() && role() == 'admin';
+    }
+
+    function isEditor() {
+      return enabled() && (role() == 'admin' || role() == 'editor');
+    }
+
+    function isAuthor() {
+      return enabled() && (role() == 'admin' || role() == 'editor' || role() == 'author');
+    }
+
+    function typeIsLocked(slug) {
+      return exists(/databases/$(database)/documents/content/$(slug))
+        && get(/databases/$(database)/documents/content/$(slug)).data.get('locked', false) == true;
+    }
+
+    // Audit fields belong to the adapter. A client may not forge authorship, and may not
+    // rewrite the creation record of an entry it is updating.
+    function authorshipIsHonest() {
+      return request.resource.data.createdBy == request.auth.uid
+        && request.resource.data.updatedBy == request.auth.uid;
+    }
+
+    function preservesCreation() {
+      return request.resource.data.createdBy == resource.data.createdBy
+        && request.resource.data.createdAt == resource.data.createdAt
+        && request.resource.data.updatedBy == request.auth.uid;
+    }
+
+    function ownsEntry() {
+      return signedIn() && resource.data.createdBy == request.auth.uid;
+    }
+
+    // ---------------------------------------------------------------------------------
+    // The per-content-type permission matrix.
+    //
+    // `content/{slug}.permissions` is a map of entry action to the roles that keep it, for
+    // example `{ "delete": ["admin", "editor"] }`. It is the same map `can()` reads in the
+    // application and the same one the Developer area edits, and it is written only by an
+    // admin, because `content/{slug}` is an admin-only document.
+    //
+    // It narrows and never widens, which is the whole design. The role clauses below
+    // (isEditor, isAuthor, ownsEntry) are evaluated from the token exactly as before, and
+    // the matrix can only take an action away on top of them. A rule that read a privilege
+    // out of a document would be letting a document grant a privilege, and `can()` matches
+    // this by refusing to widen either: ticking `author` under `delete` changes nothing in
+    // either layer. See permissions/matrix.ts and .docs/decisions/2026-09-19-permission-matrix-enforcement.md.
+    //
+    // What it costs: one document read per authenticated entry operation on a type whose
+    // metadata document exists. The unauthenticated published-entry branch is evaluated
+    // first and never reaches this, so a customer's public website, which is the volume
+    // path, pays nothing.
+    // ---------------------------------------------------------------------------------
+
+    // Written as a chain of "no narrowing applies" escapes rather than with a map default,
+    // so that a missing metadata document, a document with no matrix, and a matrix that is
+    // silent about this action all mean the same thing: not narrowed. A project that never
+    // provisioned `content/{slug}` therefore behaves exactly as it did before the matrix
+    // existed rather than locking everybody out of a type whose metadata is missing.
+    //
+    // The path is repeated instead of held in a local because rules functions are single
+    // expressions; Firestore caches repeated access calls within one evaluation, so this
+    // is one document read and not four.
+    function matrixAllows(slug, action) {
+      return role() == 'admin'
+        || !exists(/databases/$(database)/documents/content/$(slug))
+        || !('permissions' in get(/databases/$(database)/documents/content/$(slug)).data)
+        || !(action in get(/databases/$(database)/documents/content/$(slug)).data.permissions)
+        || role() in get(/databases/$(database)/documents/content/$(slug)).data.permissions[action];
+    }
+
+    // ---------------------------------------------------------------------------------
+    // Payload and write-rate guards.
+    //
+    // What Firestore rules can actually see, and nothing beyond it. A rule can count the
+    // top-level fields of the incoming document and can compare `request.time` against a
+    // timestamp already stored, so those two are enforced here. A rule cannot see the byte
+    // size of a Firestore document and cannot count a client's writes across documents, so
+    // neither is claimed here: the per-document byte ceiling is Firestore's own 1 MiB, and
+    // the cross-document burst check lives in the adapter, where it is a courtesy rather
+    // than a guarantee. core/write-limits.ts holds the numbers for both sides.
+    // ---------------------------------------------------------------------------------
+
+    function withinFieldCount(maximum) {
+      return request.resource.data.keys().size() <= maximum;
+    }
+
+    // At least this long between two writes to the same document. It throttles a runaway
+    // client to five writes a second on one document without being reachable by a human
+    // clicking save. A document with no stored `updatedAt` is not throttled, because there
+    // is nothing to measure from.
+    function notTooSoon() {
+      return !(resource.data.get('updatedAt', null) is timestamp)
+        || request.time > resource.data.updatedAt + duration.value(200, 'ms');
+    }
+
+    function entryStatusValid() {
+      return request.resource.data.status in ['draft', 'published', 'archived'];
+    }
+
+    // Checked only when present. An entry written before stamping existed is legitimate,
+    // and is exactly what the migration runner is for; an entry claiming a version that is
+    // not an integer is not.
+    function entryVersionValid() {
+      return !('schemaVersion' in request.resource.data)
+        || request.resource.data.schemaVersion is int;
+    }
+
+    // Schema definitions. Only an admin manages structure, and a type locked in code is
+    // immutable from any client, admin included: its definition lives in git.
+    //
+    // The field cap is the payload guard for a schema document. A content type with more
+    // than 100 fields is a spreadsheet, not a content type, and the cap is what stops a
+    // generated definition from growing until a write starts failing on Firestore's own
+    // document limit with an error nobody can act on.
+    match /schemas/{slug} {
+      allow read: if enabled();
+      allow create, update: if isAdmin()
+        && !typeIsLocked(slug)
+        && withinFieldCount(30)
+        && schemaFieldsValid()
+        && permissionsShapeValid(request.resource.data);
+      allow delete: if isAdmin() && !typeIsLocked(slug);
+    }
+
+    // Checked only when present, so a partially provisioned definition is still writable.
+    // An absent field map has no fields to cap.
+    function schemaFieldsValid() {
+      return !('fields' in request.resource.data)
+        || (request.resource.data.fields is map
+            && request.resource.data.fields.keys().size() <= 100);
+    }
+
+    // The matrix, wherever it is stored. Both `schemas/{slug}` and `content/{slug}` carry
+    // it: the first is the definition the Schema Builder edits, the second is the copy the
+    // rules above read, and a malformed one in either place would make `matrixAllows`
+    // deny without ever saying why. An absent matrix is valid and means "not narrowed".
+    function permissionsShapeValid(data) {
+      return !('permissions' in data)
+        || (data.permissions is map
+            && data.permissions.keys().hasOnly(['read', 'create', 'update', 'delete'])
+            && rolesListValid(data.permissions, 'read')
+            && rolesListValid(data.permissions, 'create')
+            && rolesListValid(data.permissions, 'update')
+            && rolesListValid(data.permissions, 'delete'));
+    }
+
+    function rolesListValid(matrix, action) {
+      return !(action in matrix)
+        || (matrix[action] is list
+            && matrix[action].hasOnly(['admin', 'editor', 'author']));
+    }
+
+    // Per-content-type metadata: schema version, kind, lock flag. Provisioned by an admin
+    // during setup, never by an editor.
+    //
+    // Creating the record is allowed even for a locked type, because the record has to come
+    // into existence somehow and a locked type is provisioned exactly like any other. Once
+    // it exists and says locked, it is frozen: no update, no delete, and the lock flag
+    // itself can never be flipped from a client.
+    //
+    // It also carries the permission matrix the entry rules below read. That it is an
+    // admin-only document is the reason the matrix can be trusted at all: an editor who
+    // could write here could write themselves a wider matrix, and then the rule would be
+    // reading its own permission from a document the caller controls.
+    match /content/{slug} {
+      allow read: if enabled();
+      allow create: if isAdmin() && permissionsShapeValid(request.resource.data);
+      allow update: if isAdmin()
+        && !typeIsLocked(slug)
+        && request.resource.data.get('locked', false) == resource.data.get('locked', false)
+        && permissionsShapeValid(request.resource.data);
+      allow delete: if isAdmin() && !typeIsLocked(slug);
+
+      // Entries. An author works on their own entries; an editor works on all of them.
+      //
+      // The public read is the carve-out, and it is what makes a customer's website work.
+      // A visitor is unauthenticated: the SDK reads through the same Firestore project with
+      // no session, so without this branch every public page would be a permission error.
+      // It is restricted to published entries, which is the same guarantee the SDK's
+      // published-only default gives, enforced where a client cannot argue with it.
+      //
+      // `get` and `list` are separated because they need different clauses. A `get` names
+      // one document and the rule can look at it; the `resource == null` branch is for a
+      // document that does not exist, which returns nothing either way and would otherwise
+      // fail as a permission error rather than as "not found". A `list` is checked against
+      // the query, so an unauthenticated query is allowed only when it says
+      // `status == "published"` itself: an unrestricted one is refused before a document is
+      // read. That is why `CmsAdapter.getBySlug` takes a status.
+      //
+      // Every clause is now three things in a row: the role default from the token, the
+      // matrix narrowing on top of it, and the document checks. The published branches are
+      // evaluated first so that a public read short-circuits before the matrix lookup and
+      // costs no extra document read.
+      //
+      // The one thing the read matrix genuinely cannot do, stated rather than implied: it
+      // cannot hide a published entry, because a published entry is readable by anyone who
+      // knows its address by design and that is what makes a customer's website work.
+      // Denying `read` hides a type inside the admin and hides its drafts; taking content
+      // off the public web is unpublishing it. MATRIX_LIMITS.publicRead says the same thing
+      // in the Developer area, in those words.
+      match /entries/{entryId} {
+        allow get: if resource == null
+          || resource.data.status == 'published'
+          || (enabled() && matrixAllows(slug, 'read'));
+        allow list: if resource.data.status == 'published'
+          || (enabled() && matrixAllows(slug, 'read'));
+        allow create: if isAuthor()
+          && matrixAllows(slug, 'create')
+          && authorshipIsHonest()
+          && entryStatusValid()
+          && entryVersionValid()
+          && withinFieldCount(200);
+        allow update: if (isEditor() || (isAuthor() && ownsEntry()))
+          && matrixAllows(slug, 'update')
+          && preservesCreation()
+          && entryStatusValid()
+          && entryVersionValid()
+          && withinFieldCount(200)
+          && notTooSoon();
+        allow delete: if isEditor() && matrixAllows(slug, 'delete');
+      }
+    }
+
+    // Media metadata. The bytes live in Storage and storage.rules polices them; this block
+    // polices the document, because the document is what the library lists, what the
+    // dashboard sums for its storage figure, and what an entry references. A document is
+    // cheap to write and can claim anything, so its shape is checked here rather than
+    // trusted from the adapter.
+    //
+    // The MIME allowlist is the same one as storage.rules and
+    // packages/cms/src/core/media-constraints.ts. The ceiling here is the global 25 MB
+    // rather than the per-type one: the tighter image limit is enforced where the bytes
+    // actually arrive, and repeating a second table here would be a third copy to keep in
+    // step for no additional guarantee.
+    function mediaFields() {
+      return ['name', 'type', 'size', 'url', 'path', 'alt', 'width', 'height',
+              'createdAt', 'createdBy'];
+    }
+
+    function mediaTypeAllowed(type) {
+      return type in ['image/jpeg', 'image/png', 'image/webp', 'image/avif', 'image/gif',
+                      'application/pdf', 'video/mp4', 'video/webm',
+                      'audio/mpeg', 'audio/ogg', 'audio/wav'];
+    }
+
+    function mediaShapeValid(mediaId) {
+      return request.resource.data.keys().hasOnly(mediaFields())
+        && request.resource.data.keys().hasAll(mediaFields())
+        && request.resource.data.name is string
+        && request.resource.data.name.size() > 0
+        && mediaTypeAllowed(request.resource.data.type)
+        && request.resource.data.size is int
+        && request.resource.data.size > 0
+        && request.resource.data.size <= 25 * 1024 * 1024
+        && request.resource.data.url is string
+        && request.resource.data.path is string
+        && request.resource.data.path.matches('media/' + mediaId + '/.*')
+        && (request.resource.data.alt == null || request.resource.data.alt is string)
+        && (request.resource.data.width == null || request.resource.data.width is int)
+        && (request.resource.data.height == null || request.resource.data.height is int);
+    }
+
+    match /media/{mediaId} {
+      // A single media document is public, the library listing is not. A public page that
+      // renders an image needs its alt text and dimensions, and the id has to be known
+      // already: it comes from a published entry that references it. The bytes behind it
+      // are served by Storage from a download URL that is public in the same way. Listing
+      // the library is a different question, because that is every file a customer ever
+      // uploaded, referenced or not, and a visitor has no business enumerating it.
+      allow get: if true;
+      allow list: if enabled();
+      allow create: if isAuthor()
+        && request.resource.data.createdBy == request.auth.uid
+        && mediaShapeValid(mediaId);
+      // Alt text, name and, when M7's replace lands, url, size and type may change. The
+      // creation record and the object path may not: the path is what ties the document to
+      // its bytes, and a document that could be repointed at somebody else's object would
+      // make every reference in every entry unreliable.
+      //
+      // `mediaShapeValid` is already the payload guard for this document: it names every
+      // field that may be present and caps the recorded size, so there is no field count
+      // to add. The write-rate floor is the same one entries get.
+      allow update: if isAuthor()
+        && mediaShapeValid(mediaId)
+        && request.resource.data.createdBy == resource.data.createdBy
+        && request.resource.data.createdAt == resource.data.createdAt
+        && request.resource.data.path == resource.data.path
+        && notTooSoon();
+      allow delete: if isEditor();
+    }
+
+    // A user reads and edits their own profile. Role and disabled are managed by an admin,
+    // because a user who could set their own role would be an admin by definition.
+    //
+    // Self-read does not require a synced claim, so a session whose claim was lost can
+    // still read the role it is supposed to have and hand it to claim sync for repair.
+    // Reading your own profile grants nothing else.
+    //
+    // Self-create exists because a new account has to record itself somewhere and only an
+    // admin may create anyone else's profile. It is pinned to the lowest role and to
+    // enabled, so signing up can never be a way to write yourself a higher one. The first
+    // admin of a project does not go through this branch: that account already holds the
+    // admin claim it won at settings/bootstrap, so it passes isAdmin().
+    match /users/{uid} {
+      allow read: if isAdmin() || (signedIn() && request.auth.uid == uid);
+      allow create: if isAdmin()
+        || (signedIn()
+            && request.auth.uid == uid
+            && request.resource.data.role == 'author'
+            && request.resource.data.disabled == false);
+      allow update: if isAdmin()
+        || (enabled()
+            && request.auth.uid == uid
+            && request.resource.data.role == resource.data.role
+            && request.resource.data.disabled == resource.data.disabled);
+      allow delete: if isAdmin();
+    }
+
+    match /settings/{key} {
+      allow read: if enabled();
+      // The bootstrap marker is carved out: it is settings by storage only, and an editor
+      // who could overwrite it could reopen the first-run window.
+      //
+      // A settings document holds a handful of keys. The cap is what stops it being used
+      // as a general-purpose bucket by anything that can write one, and a delete carries
+      // no incoming document to measure, which is why it is spelled out separately.
+      allow create, update: if isEditor()
+        && key != 'bootstrap'
+        && withinFieldCount(100);
+      allow delete: if isEditor() && key != 'bootstrap';
+    }
+
+    // First-run marker. Its existence means "this project already has an admin", so the
+    // whole guarantee is that it can be written exactly once and then never again.
+    //
+    // Allows: any signed-in account, claim or no claim, to create it naming itself, once.
+    // Denies: every update and every delete, admin included, so the window cannot be
+    // reopened; any create naming a different uid; any extra field, so nothing else can be
+    // smuggled into a document that no one can later correct.
+    //
+    // Two simultaneous sign-ups both attempt the create and Firestore commits one of them;
+    // the other is evaluated against the now-existing document as an update and denied.
+    match /settings/bootstrap {
+      allow read: if signedIn();
+      allow create: if signedIn()
+        && request.resource.data.firstAdminUid == request.auth.uid
+        && request.resource.data.keys().hasOnly(['firstAdminUid', 'createdAt']);
+      allow update, delete: if false;
+    }
+
+    // Anything not matched above is denied. Adding a collection means adding a rule and a
+    // test for it, not relaxing this.
+    match /{document=**} {
+      allow read, write: if false;
+    }
+  }
+}

package/dist/cli/templates/storage.rules

@@ -0,0 +1,165 @@
+rules_version = '2';
+
+// Husk storage rules.
+//
+// Media bytes live under media/{mediaId}/{fileName}; the metadata document lives in
+// Firestore at media/{mediaId}. The path is built by storageObjectPath() in
+// packages/cms/src/firebase/paths.ts, so code and rules agree on one shape.
+//
+// The allowlist, the per-type size ceilings and the extensions below are the same set as
+// packages/cms/src/core/media-constraints.ts. Neither file can import the other, so
+// media-constraints.test.ts reads this file and fails when the two drift apart.
+//
+// What these rules actually enforce, stated plainly because a rule nobody can describe is
+// a rule nobody can review:
+//
+// ALLOWED: a signed-in, enabled account with role author, editor or admin may write an
+// object under media/{mediaId}/{fileName} when the declared content type is on the
+// allowlist, the byte count is above zero and within that type's ceiling (10 MB for an
+// image, 25 MB otherwise), the file name matches the extension that type requires, and the
+// object's custom metadata names the writer as uploadedBy. Overwriting an existing object
+// additionally requires being its uploader, or being an editor. An editor or admin may
+// delete any object; an author may delete only their own, which is what lets a failed
+// upload undo itself. Any enabled account may read.
+//
+// DENIED: anonymous access entirely; a disabled account or one with no role claim; every
+// content type outside the allowlist, image/svg+xml among them; a zero-byte object; an
+// oversized one; a name whose extension contradicts the declared type; an object claiming
+// somebody else's uploadedBy; an author overwriting or deleting another account's object;
+// and everything outside media/.
+//
+// WHAT A CLIENT CAN STILL LIE ABOUT: contentType is declared by the uploader and the bucket
+// does not sniff the bytes, so a renamed executable sent as image/png with the name
+// photo.png satisfies every rule here. The extension check does not prove content either;
+// it only forces the lie to be consistent, and it keeps an honest client from writing a
+// name the library would later mis-render. What cannot be faked is request.resource.size,
+// which the service measures, and request.auth.uid, which comes from the verified token.
+// Byte-level validation would need a Cloud Function, which this product does not have; the
+// mitigation that does hold is that objects are served from the Storage host and never from
+// the customer's own origin.
+
+service firebase.storage {
+  match /b/{bucket}/o {
+
+    function signedIn() {
+      return request.auth != null;
+    }
+
+    function role() {
+      return signedIn() ? request.auth.token.get('role', 'none') : 'none';
+    }
+
+    // A role the CMS knows. An account whose claim has not been synced yet reports 'none'
+    // and can do nothing, the same fail-closed stance firestore.rules takes.
+    function knownRole() {
+      return role() == 'admin' || role() == 'editor' || role() == 'author';
+    }
+
+    function enabled() {
+      return signedIn() && knownRole() && request.auth.token.get('disabled', false) != true;
+    }
+
+    function isEditor() {
+      return enabled() && (role() == 'admin' || role() == 'editor');
+    }
+
+    function isAuthor() {
+      return enabled() && (role() == 'admin' || role() == 'editor' || role() == 'author');
+    }
+
+    // MIME type to size ceiling, in megabytes. Membership in this map is the allowlist.
+    function sizeLimits() {
+      return {
+        'image/jpeg': 10,
+        'image/png': 10,
+        'image/webp': 10,
+        'image/avif': 10,
+        'image/gif': 10,
+        'application/pdf': 25,
+        'video/mp4': 25,
+        'video/webm': 25,
+        'audio/mpeg': 25,
+        'audio/ogg': 25,
+        'audio/wav': 25
+      };
+    }
+
+    // MIME type to the file name pattern it requires. matches() is anchored, hence the .*
+    function namePatterns() {
+      return {
+        'image/jpeg': '.*[.]jpe?g',
+        'image/png': '.*[.]png',
+        'image/webp': '.*[.]webp',
+        'image/avif': '.*[.]avif',
+        'image/gif': '.*[.]gif',
+        'application/pdf': '.*[.]pdf',
+        'video/mp4': '.*[.]mp4',
+        'video/webm': '.*[.]webm',
+        'audio/mpeg': '.*[.]mp3',
+        'audio/ogg': '.*[.]ogg',
+        'audio/wav': '.*[.]wav'
+      };
+    }
+
+    function declaredType() {
+      return request.resource.contentType;
+    }
+
+    function typeAllowed() {
+      return declaredType() != null
+        && sizeLimits().keys().hasAny([declaredType()]);
+    }
+
+    // Only ever evaluated after typeAllowed(), because indexing the map with an unknown key
+    // is an error rather than a denial. && short-circuits, which is what makes that safe.
+    function withinSizeLimit() {
+      return request.resource.size > 0
+        && request.resource.size <= sizeLimits()[declaredType()] * 1024 * 1024;
+    }
+
+    function nameMatchesType(fileName) {
+      return fileName.lower().matches(namePatterns()[declaredType()]);
+    }
+
+    function validUpload(fileName) {
+      return typeAllowed() && withinSizeLimit() && nameMatchesType(fileName);
+    }
+
+    // The writer names themselves in the object's custom metadata. Set by
+    // createMediaUpload() in packages/cms/src/firebase/media-upload.ts.
+    function namesSelf() {
+      return request.resource.metadata != null
+        && request.resource.metadata.get('uploadedBy', '') == request.auth.uid;
+    }
+
+    function ownsExisting() {
+      return resource != null
+        && resource.metadata != null
+        && resource.metadata.get('uploadedBy', '') == request.auth.uid;
+    }
+
+    // create and update share one condition on purpose. A resumable upload over an object
+    // that already exists is not reliably classified as an update by the emulator, so the
+    // ownership check is written into both branches rather than relying on which one fires.
+    // A retry overwrites its own object, and M7's replace flow overwrites an editor's;
+    // nobody else's bytes can be replaced from under them either way.
+    function mayWrite(fileName) {
+      return isAuthor()
+        && namesSelf()
+        && validUpload(fileName)
+        && (resource == null || isEditor() || ownsExisting());
+    }
+
+    match /media/{mediaId}/{fileName} {
+      allow read: if enabled();
+      allow create, update: if mayWrite(fileName);
+      // An author deleting their own object is not a library delete; it is how a failed
+      // upload cleans up after itself before any document exists to delete.
+      allow delete: if isEditor() || (isAuthor() && ownsExisting());
+    }
+
+    match /{allPaths=**} {
+      allow read, write: if false;
+    }
+  }
+}

package/dist/client/index.d.ts

@@ -0,0 +1,27 @@
+import { f as ContentTypeMap, d as CmsReadConfig, C as Cms } from '../cms-9fSA3uQV.js';
+export { b as CmsCountQuery, c as CmsQuery, e as CollectionReader, E as EntryOf, M as MediaReader, S as SettingsReader, g as SingleReader } from '../cms-9fSA3uQV.js';
+import '../entry-D3kiE8T1.js';
+import '../field-Diyf5siF.js';
+import '../auth-B2gBtHl5.js';
+import '../adapter-C_0mhENy.js';
+
+/**
+ * The `@nonext/husk/client` surface: the read SDK for browser code.
+ *
+ * Same verbs as the server entry, one deliberate omission: there is no preview. A browser
+ * instance reads published entries and nothing else.
+ *
+ * That is not a limitation the client happens to have, it is the point. Preview reads
+ * unpublished content, so whatever decides to enable it is a security control; a value that
+ * reaches the browser has been through the network and is whatever the visitor made it. The
+ * config type below has no `preview` key at all, so passing one is a compile error rather
+ * than a code review question, and the returned `Cms` has no method that could turn one on.
+ *
+ * The admin is not a consumer of this. It reads and writes through `CmsAdapter` directly,
+ * with a signed-in user and the whole permission layer, which is how it sees drafts without
+ * this entry needing to.
+ */
+type ClientCmsConfig<TTypes extends ContentTypeMap = ContentTypeMap> = CmsReadConfig<TTypes>;
+declare function createClientCMS<TTypes extends ContentTypeMap = ContentTypeMap>(config: ClientCmsConfig<TTypes>): Cms<TTypes>;
+
+export { type ClientCmsConfig, Cms, ContentTypeMap, createClientCMS };

package/dist/client/index.js

@@ -0,0 +1,15 @@
+import { createCMS } from '../chunk-3I6337WJ.js';
+import '../chunk-R4O7APIX.js';
+import '../chunk-4Z6P3XCE.js';
+
+// src/client/index.ts
+function createClientCMS(config) {
+  const contentTypes = config.contentTypes;
+  return createCMS(
+    contentTypes === void 0 ? { adapter: config.adapter } : { adapter: config.adapter, contentTypes }
+  );
+}
+
+export { createClientCMS };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;AAuBO,SAAS,gBACd,MAAA,EACa;AAGb,EAAA,MAAM,eAAe,MAAA,CAAO,YAAA;AAC5B,EAAA,OAAO,SAAA;AAAA,IACL,YAAA,KAAiB,MAAA,GACb,EAAE,OAAA,EAAS,MAAA,CAAO,OAAA,EAAQ,GAC1B,EAAE,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,YAAA;AAAa,GAC9C;AACF","file":"index.js","sourcesContent":["import { createCMS } from \"../core/cms.js\"\nimport type { Cms, CmsReadConfig, ContentTypeMap } from \"../core/cms.js\"\n\n/**\n * The `@nonext/husk/client` surface: the read SDK for browser code.\n *\n * Same verbs as the server entry, one deliberate omission: there is no preview. A browser\n * instance reads published entries and nothing else.\n *\n * That is not a limitation the client happens to have, it is the point. Preview reads\n * unpublished content, so whatever decides to enable it is a security control; a value that\n * reaches the browser has been through the network and is whatever the visitor made it. The\n * config type below has no `preview` key at all, so passing one is a compile error rather\n * than a code review question, and the returned `Cms` has no method that could turn one on.\n *\n * The admin is not a consumer of this. It reads and writes through `CmsAdapter` directly,\n * with a signed-in user and the whole permission layer, which is how it sees drafts without\n * this entry needing to.\n */\n\nexport type ClientCmsConfig<TTypes extends ContentTypeMap = ContentTypeMap> =\n  CmsReadConfig<TTypes>\n\nexport function createClientCMS<TTypes extends ContentTypeMap = ContentTypeMap>(\n  config: ClientCmsConfig<TTypes>,\n): Cms<TTypes> {\n  // Never spreads the config. An extra `preview` that arrived through a widened type would\n  // be ignored here rather than forwarded, so the omission survives a caller that lies.\n  const contentTypes = config.contentTypes\n  return createCMS<TTypes>(\n    contentTypes === undefined\n      ? { adapter: config.adapter }\n      : { adapter: config.adapter, contentTypes },\n  )\n}\n\nexport type {\n  Cms,\n  CmsCountQuery,\n  CmsQuery,\n  CollectionReader,\n  ContentTypeMap,\n  EntryOf,\n  MediaReader,\n  SettingsReader,\n  SingleReader,\n} from \"../core/cms.js\"\n"]}