@obelism/content 0.0.0-stage → 0.1.0

package/dist/index.mjs

@@ -0,0 +1,284 @@
+import { n as normalizeUrl, a as DEFAULT_TIMEOUT, b as DELIVERY_PATH, D as DEFAULT_URL } from './config-c6qktlz6.mjs';
+export { E as ENTRY_ATTRIBUTE, P as PREVIEW_PARAMS, U as UID_ATTRIBUTE, e as editable, r as readPreviewParams } from './preview-kvotryzw.mjs';
+
+// A response from the API that wasn't a success. `message` is the API's own
+// `error` text when it sent one.
+class ContentApiError extends Error {
+    constructor(status, url, body){
+        const apiMessage = typeof body === 'object' && body !== null && typeof body.error === 'string' ? body.error : null;
+        super(apiMessage ?? `Obelism Content answered ${status} for ${url}`);
+        this.name = 'ContentApiError';
+        this.status = status;
+        this.url = url;
+        this.body = body;
+    }
+}
+
+const trimSlashes = (path)=>path.replace(/^\/+|\/+$/g, '');
+// Reads one space environment's content through the delivery API. The token
+// decides the space, the environment and whether drafts are visible.
+//
+//   const content = new ContentClient({ token: process.env.CONTENT_TOKEN })
+//   const page = await content.getPage('blog/hello', { locale: 'nl' })
+class ContentClient {
+    #token;
+    #defaults;
+    #timeout;
+    #init;
+    #fetch;
+    constructor({ token, url, locale, depth, richText, timeout, init, fetch: fetchImpl }){
+        // The page at a path (`blog/hello`), or null when there is none. A site's
+        // catch-all route asks for this.
+        this.getPage = async (path, options = {})=>{
+            const trimmed = trimSlashes(path);
+            if (!trimmed) throw new Error('getPage needs a path');
+            const result = await this.#request('/pages', {
+                path: trimmed
+            }, options, {
+                notFound: true
+            });
+            return result?.entry ?? null;
+        };
+        // An entry by id, or null when there is none (or it isn't published, for a
+        // delivery token).
+        this.getEntry = async (id, options = {})=>{
+            const result = await this.#request(`/entries/${encodeURIComponent(id)}`, {}, options, {
+                notFound: true
+            });
+            return result?.entry ?? null;
+        };
+        // One page of entries, ordered as in the space's tree.
+        this.getEntries = ({ contentType, parentPath, limit, skip, ...options } = {})=>this.#request('/entries', {
+                contentType,
+                parentPath: parentPath === undefined ? undefined : trimSlashes(parentPath),
+                limit,
+                skip
+            }, options);
+        // The environment's content model, e.g. to generate types in a build.
+        this.getContentModel = (options = {})=>this.#request('/content-model', {}, options, {
+                defaults: false
+            });
+        this.url = normalizeUrl(url || DEFAULT_URL);
+        this.#token = token;
+        this.#defaults = {
+            locale,
+            depth,
+            richText
+        };
+        this.#timeout = timeout ?? DEFAULT_TIMEOUT;
+        this.#init = init;
+        this.#fetch = fetchImpl ?? ((...args)=>fetch(...args));
+    }
+    // Every entry matching the query, fetching pages of `limit` (default 100)
+    // as it goes.
+    //
+    //   for await (const post of content.getAllEntries({ contentType: 'post' }))
+    async *getAllEntries(query = {}) {
+        const limit = query.limit ?? 100;
+        let skip = 0;
+        while(true){
+            const page = await this.getEntries({
+                ...query,
+                limit,
+                skip
+            });
+            yield* page.items;
+            skip += page.items.length;
+            if (page.items.length === 0 || skip >= page.total) return;
+        }
+    }
+    // null for a 404 when `notFound` is set; throws ContentApiError otherwise.
+    async #request(path, query, { init, ...options }, { notFound = false, defaults = true } = {}) {
+        // Checked here rather than in the constructor, so a module creating a
+        // client still loads (and a build still runs) without the variable.
+        if (!this.#token) throw new Error('ContentClient needs a token');
+        const { locale, depth, richText } = {
+            ...defaults && this.#defaults,
+            ...withoutUndefined(options)
+        };
+        const params = new URLSearchParams();
+        const values = {
+            ...query,
+            locale,
+            depth,
+            richtext: richText
+        };
+        for (const [key, value] of Object.entries(values)){
+            if (value !== undefined) params.set(key, String(value));
+        }
+        const search = params.size > 0 ? `?${params}` : '';
+        const url = `${this.url}${DELIVERY_PATH}${path}${search}`;
+        const merged = {
+            ...this.#init,
+            ...init
+        };
+        const timeout = AbortSignal.timeout(this.#timeout);
+        const response = await this.#fetch(url, {
+            ...merged,
+            headers: {
+                ...headersToObject(merged.headers),
+                Accept: 'application/json',
+                Authorization: `Bearer ${this.#token}`
+            },
+            signal: merged.signal ? AbortSignal.any([
+                merged.signal,
+                timeout
+            ]) : timeout
+        });
+        if (notFound && response.status === 404) return null;
+        const text = await response.text();
+        let body = text;
+        try {
+            body = JSON.parse(text);
+        } catch  {
+        // Not JSON: keep the text for the error.
+        }
+        if (!response.ok) throw new ContentApiError(response.status, url, body);
+        return body;
+    }
+}
+const withoutUndefined = (value)=>Object.fromEntries(Object.entries(value).filter(([, entry])=>entry !== undefined));
+const headersToObject = (headers)=>headers ? Object.fromEntries(new Headers(headers)) : {};
+
+const KEYS = [
+    'w',
+    'h',
+    'fit',
+    'format',
+    'q'
+];
+// An asset's URL with a resize / re-encode query. PNG, JPEG, GIF, WebP and
+// AVIF are transformed; other files ignore the query.
+//
+//   imageUrl(asset, { w: 800 })
+const imageUrl = (asset, transform = {})=>{
+    const url = new URL(typeof asset === 'string' ? asset : asset.url);
+    for (const key of KEYS){
+        const value = transform[key];
+        if (value !== undefined) url.searchParams.set(key, String(value));
+    }
+    return url.toString();
+};
+// A `srcset` with one candidate per width.
+//
+//   <img src={imageUrl(asset, { w: 960 })}
+//        srcSet={imageSrcSet(asset, [480, 960, 1440])}
+//        sizes="(min-width: 60rem) 50vw, 100vw" />
+const imageSrcSet = (asset, widths, transform = {})=>widths.map((w)=>`${imageUrl(asset, {
+            ...transform,
+            w
+        })} ${w}w`).join(', ');
+
+// Links are only rendered for these; anything else (`javascript:` …) keeps its
+// text without the link. The same rule the CMS validates with.
+const SAFE_HREF = /^(https?:\/\/|mailto:|tel:|#|\/(?!\/))/i;
+const escapeHtml = (value)=>value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+const MARK_TAGS = {
+    bold: 'strong',
+    italic: 'em',
+    underline: 'u',
+    strike: 's',
+    code: 'code'
+};
+const defaultRenderAsset = (asset)=>{
+    const url = escapeHtml(asset.url);
+    if (asset.mimeType.startsWith('image/')) {
+        const alt = typeof asset.alt === 'string' ? asset.alt : '';
+        const size = asset.width && asset.height ? ` width="${asset.width}" height="${asset.height}"` : '';
+        return `<figure><img src="${url}" alt="${escapeHtml(alt)}"${size}></figure>`;
+    }
+    return `<p><a href="${url}">${escapeHtml(asset.filename)}</a></p>`;
+};
+// Rich text JSON (what the delivery API answers by default) to plain, safe
+// HTML — the same HTML the API renders with `richText: 'html'`, except that
+// embeds are up to you.
+const richTextToHtml = (doc, { renderEntry, renderAsset = defaultRenderAsset } = {})=>{
+    if (!doc) return '';
+    const marks = (node, html)=>(node.marks ?? []).reduceRight((inner, mark)=>{
+            if (mark.type === 'link') {
+                const href = String(mark.attrs?.href ?? '');
+                if (!SAFE_HREF.test(href)) return inner;
+                const target = mark.attrs?.target === '_blank' ? ' target="_blank" rel="noopener noreferrer"' : '';
+                const title = mark.attrs?.title ? ` title="${escapeHtml(String(mark.attrs.title))}"` : '';
+                return `<a href="${escapeHtml(href)}"${target}${title}>${inner}</a>`;
+            }
+            const tag = MARK_TAGS[mark.type];
+            return tag ? `<${tag}>${inner}</${tag}>` : inner;
+        }, html);
+    const render = (node)=>{
+        const children = ()=>(node.content ?? []).map(render).join('');
+        switch(node.type){
+            case 'doc':
+                return children();
+            case 'text':
+                return marks(node, escapeHtml(node.text ?? ''));
+            case 'hardBreak':
+                return '<br>';
+            case 'paragraph':
+                return `<p>${children()}</p>`;
+            case 'heading':
+                {
+                    const tag = `h${headingLevel(node)}`;
+                    return `<${tag}>${children()}</${tag}>`;
+                }
+            case 'blockquote':
+                return `<blockquote>${children()}</blockquote>`;
+            case 'bulletList':
+                return `<ul>${children()}</ul>`;
+            case 'orderedList':
+                {
+                    const start = Number(node.attrs?.start ?? 1);
+                    return `<ol${start !== 1 ? ` start="${start}"` : ''}>${children()}</ol>`;
+                }
+            case 'listItem':
+                return `<li>${children()}</li>`;
+            case 'codeBlock':
+                {
+                    const language = node.attrs?.language;
+                    const className = language ? ` class="language-${escapeHtml(String(language))}"` : '';
+                    return `<pre><code${className}>${children()}</code></pre>`;
+                }
+            case 'horizontalRule':
+                return '<hr>';
+            case 'embeddedEntry':
+                {
+                    const entry = node.attrs?.entry;
+                    return entry && renderEntry ? renderEntry(entry, node) : '';
+                }
+            case 'embeddedAsset':
+                {
+                    const asset = node.attrs?.asset;
+                    return asset ? renderAsset(asset, node) : '';
+                }
+            default:
+                return '';
+        }
+    };
+    return render(doc);
+};
+const headingLevel = (node)=>{
+    const level = Number(node.attrs?.level);
+    return level >= 1 && level <= 6 ? level : 2;
+};
+// The text of a document without any markup, e.g. for a meta description.
+const richTextToPlainText = (doc)=>{
+    if (!doc) return '';
+    const BLOCKS = new Set([
+        'paragraph',
+        'heading',
+        'blockquote',
+        'listItem',
+        'codeBlock'
+    ]);
+    const parts = [];
+    const walk = (node)=>{
+        if (node.type === 'text') parts.push(node.text ?? '');
+        else if (node.type === 'hardBreak') parts.push('\n');
+        node.content?.forEach(walk);
+        if (BLOCKS.has(node.type)) parts.push('\n');
+    };
+    walk(doc);
+    return parts.join('').replace(/\n+/g, '\n').trim();
+};
+
+export { ContentApiError, ContentClient, DEFAULT_URL, SAFE_HREF, escapeHtml, headingLevel, imageSrcSet, imageUrl, richTextToHtml, richTextToPlainText };

package/dist/preview-by8d54dt.js

@@ -0,0 +1,68 @@
+const UID_ATTRIBUTE = 'data-cms-uid';
+const ENTRY_ATTRIBUTE = 'data-cms-entry';
+// The attribute that lets editors select a block on the page, in the visual
+// editor and on the site. Spread it on the block's outermost element:
+//
+//   <section {...editable(block)}>…</section>
+//
+// Given an entry, it marks the element the entry renders into, which editing
+// on the site (outside the visual editor) needs to know what a prompt, Save
+// and Publish act on:
+//
+//   <main {...editable(entry)}>…</main>
+const editable = (target)=>{
+    if (!target) return {};
+    if ('_uid' in target && target._uid) return {
+        'data-cms-uid': target._uid
+    };
+    if ('id' in target && 'fields' in target && target.id) {
+        return {
+            'data-cms-entry': target.id
+        };
+    }
+    return {};
+};
+
+// The visual editor loads the site in an iframe at the environment's preview
+// URL plus the entry's path, with these parameters added. A request carrying
+// `cms_preview` should be answered with drafts: fetch with a preview token.
+const PREVIEW_PARAMS = {
+    preview: 'cms_preview',
+    entry: 'cms_entry',
+    environment: 'cms_environment'
+};
+const toSearchParams = (input)=>{
+    if (input instanceof URL) return input.searchParams;
+    if (input instanceof URLSearchParams) return input;
+    if (typeof input === 'string') {
+        return input.includes('://') ? new URL(input).searchParams : new URLSearchParams(input);
+    }
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(input)){
+        if (value === undefined) continue;
+        for (const item of Array.isArray(value) ? value : [
+            value
+        ]){
+            params.append(key, item);
+        }
+    }
+    return params;
+};
+// The editor's parameters when this is a preview request, else null.
+//
+//   const preview = readPreviewParams(request.url)
+//   const content = preview ? previewClient : deliveryClient
+const readPreviewParams = (input)=>{
+    const params = toSearchParams(input);
+    if (!params.has(PREVIEW_PARAMS.preview)) return null;
+    return {
+        entryId: params.get(PREVIEW_PARAMS.entry),
+        environment: params.get(PREVIEW_PARAMS.environment)
+    };
+};
+
+exports.ENTRY_ATTRIBUTE = ENTRY_ATTRIBUTE;
+exports.PREVIEW_PARAMS = PREVIEW_PARAMS;
+exports.UID_ATTRIBUTE = UID_ATTRIBUTE;
+exports.editable = editable;
+exports.readPreviewParams = readPreviewParams;

package/dist/preview-kvotryzw.mjs

@@ -0,0 +1,64 @@
+const UID_ATTRIBUTE = 'data-cms-uid';
+const ENTRY_ATTRIBUTE = 'data-cms-entry';
+// The attribute that lets editors select a block on the page, in the visual
+// editor and on the site. Spread it on the block's outermost element:
+//
+//   <section {...editable(block)}>…</section>
+//
+// Given an entry, it marks the element the entry renders into, which editing
+// on the site (outside the visual editor) needs to know what a prompt, Save
+// and Publish act on:
+//
+//   <main {...editable(entry)}>…</main>
+const editable = (target)=>{
+    if (!target) return {};
+    if ('_uid' in target && target._uid) return {
+        'data-cms-uid': target._uid
+    };
+    if ('id' in target && 'fields' in target && target.id) {
+        return {
+            'data-cms-entry': target.id
+        };
+    }
+    return {};
+};
+
+// The visual editor loads the site in an iframe at the environment's preview
+// URL plus the entry's path, with these parameters added. A request carrying
+// `cms_preview` should be answered with drafts: fetch with a preview token.
+const PREVIEW_PARAMS = {
+    preview: 'cms_preview',
+    entry: 'cms_entry',
+    environment: 'cms_environment'
+};
+const toSearchParams = (input)=>{
+    if (input instanceof URL) return input.searchParams;
+    if (input instanceof URLSearchParams) return input;
+    if (typeof input === 'string') {
+        return input.includes('://') ? new URL(input).searchParams : new URLSearchParams(input);
+    }
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(input)){
+        if (value === undefined) continue;
+        for (const item of Array.isArray(value) ? value : [
+            value
+        ]){
+            params.append(key, item);
+        }
+    }
+    return params;
+};
+// The editor's parameters when this is a preview request, else null.
+//
+//   const preview = readPreviewParams(request.url)
+//   const content = preview ? previewClient : deliveryClient
+const readPreviewParams = (input)=>{
+    const params = toSearchParams(input);
+    if (!params.has(PREVIEW_PARAMS.preview)) return null;
+    return {
+        entryId: params.get(PREVIEW_PARAMS.entry),
+        environment: params.get(PREVIEW_PARAMS.environment)
+    };
+};
+
+export { ENTRY_ATTRIBUTE as E, PREVIEW_PARAMS as P, UID_ATTRIBUTE as U, editable as e, readPreviewParams as r };

package/dist/prompt.d.mts

@@ -0,0 +1,26 @@
+type PromptMessage = {
+    role: 'user' | 'assistant';
+    content: string;
+};
+type PromptRequest = {
+    type: 'content.prompt';
+    system: string;
+    messages: PromptMessage[];
+    schema: Record<string, unknown>;
+};
+declare class PromptVerificationError extends Error {
+    constructor(message: string);
+}
+declare const verifyPromptRequest: (request: Request, secret: string, { tolerance, now }?: {
+    tolerance?: number | undefined;
+    now?: number | undefined;
+}) => Promise<PromptRequest>;
+type PromptHandlerOptions = {
+    secret: string;
+    generate: (request: PromptRequest) => Promise<unknown>;
+};
+declare const createPromptHandler: ({ secret, generate }: PromptHandlerOptions) => (request: Request) => Promise<Response>;
+
+export { PromptVerificationError, createPromptHandler, verifyPromptRequest };
+export type { PromptHandlerOptions, PromptMessage, PromptRequest };
+//# sourceMappingURL=prompt.d.mts.map

package/dist/prompt.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.mts","sources":["../src/prompt.ts"],"mappings":"AAAA,KAAK,aAAa;AAClB;AACA;AACA;AACA,KAAK,aAAa;AAClB;AACA;AACA,cAAc,aAAa;AAC3B,YAAY,MAAM;AAClB;AACA,cAAc,uBAAuB,SAAS,KAAK;AACnD;AACA;AACA,cAAc,mBAAmB,YAAY,OAAO;AACpD;AACA;AACA,MAAM,OAAO,CAAC,aAAa;AAC3B,KAAK,oBAAoB;AACzB;AACA,wBAAwB,aAAa,KAAK,OAAO;AACjD;AACA,cAAc,mBAAmB,yBAAyB,oBAAoB,eAAe,OAAO,KAAK,OAAO,CAAC,QAAQ;;","names":[]}

package/dist/prompt.d.ts

@@ -0,0 +1,26 @@
+type PromptMessage = {
+    role: 'user' | 'assistant';
+    content: string;
+};
+type PromptRequest = {
+    type: 'content.prompt';
+    system: string;
+    messages: PromptMessage[];
+    schema: Record<string, unknown>;
+};
+declare class PromptVerificationError extends Error {
+    constructor(message: string);
+}
+declare const verifyPromptRequest: (request: Request, secret: string, { tolerance, now }?: {
+    tolerance?: number | undefined;
+    now?: number | undefined;
+}) => Promise<PromptRequest>;
+type PromptHandlerOptions = {
+    secret: string;
+    generate: (request: PromptRequest) => Promise<unknown>;
+};
+declare const createPromptHandler: ({ secret, generate }: PromptHandlerOptions) => (request: Request) => Promise<Response>;
+
+export { PromptVerificationError, createPromptHandler, verifyPromptRequest };
+export type { PromptHandlerOptions, PromptMessage, PromptRequest };
+//# sourceMappingURL=prompt.d.ts.map

package/dist/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sources":["../src/prompt.ts"],"mappings":"AAAA,KAAK,aAAa;AAClB;AACA;AACA;AACA,KAAK,aAAa;AAClB;AACA;AACA,cAAc,aAAa;AAC3B,YAAY,MAAM;AAClB;AACA,cAAc,uBAAuB,SAAS,KAAK;AACnD;AACA;AACA,cAAc,mBAAmB,YAAY,OAAO;AACpD;AACA;AACA,MAAM,OAAO,CAAC,aAAa;AAC3B,KAAK,oBAAoB;AACzB;AACA,wBAAwB,aAAa,KAAK,OAAO;AACjD;AACA,cAAc,mBAAmB,yBAAyB,oBAAoB,eAAe,OAAO,KAAK,OAAO,CAAC,QAAQ;;","names":[]}

package/dist/prompt.js

@@ -0,0 +1,112 @@
+Object.defineProperty(exports, '__esModule', { value: true });
+
+// Your own model for prompt editing in the visual editor. Set the endpoint
+// under Space settings → Prompt editing; the CMS then sends each prompt there
+// instead of to Workers AI, as a signed POST (Standard Webhooks, the same
+// scheme as webhooks), with the instructions, the conversation and the JSON
+// Schema of the answer already written. Your endpoint only runs a model:
+//
+//   // app/api/content-prompt/route.ts
+//   import { createPromptHandler } from '@obelism/content/prompt'
+//
+//   export const POST = createPromptHandler({
+//     secret: process.env.CONTENT_PROMPT_SECRET,
+//     generate: async ({ system, messages, schema }) => {
+//       // … call any model; return the answer object (or its JSON text)
+//     },
+//   })
+//
+// The CMS checks the answer like any edit, so a bad one changes nothing.
+class PromptVerificationError extends Error {
+    constructor(message){
+        super(message);
+        this.name = 'PromptVerificationError';
+    }
+}
+const SECRET_PREFIX = 'whsec_';
+// Seconds a request's timestamp may be off, against replays.
+const DEFAULT_TOLERANCE = 5 * 60;
+const base64ToBytes = (value)=>Uint8Array.from(atob(value), (char)=>char.charCodeAt(0));
+// Checks a request's Standard Webhooks signature and returns its body.
+// Throws PromptVerificationError when it isn't from the CMS.
+const verifyPromptRequest = async (request, secret, { tolerance = DEFAULT_TOLERANCE, now = Date.now() } = {})=>{
+    if (!secret?.startsWith(SECRET_PREFIX)) {
+        throw new Error('The prompt secret must be the whsec_… from Space settings');
+    }
+    const id = request.headers.get('webhook-id');
+    const timestamp = request.headers.get('webhook-timestamp');
+    const signatures = request.headers.get('webhook-signature');
+    if (!id || !timestamp || !signatures) {
+        throw new PromptVerificationError('Missing signature headers');
+    }
+    const seconds = Number(timestamp);
+    if (!Number.isFinite(seconds) || Math.abs(now / 1000 - seconds) > tolerance) {
+        throw new PromptVerificationError('Timestamp outside the tolerance');
+    }
+    const body = await request.text();
+    const key = await crypto.subtle.importKey('raw', base64ToBytes(secret.slice(SECRET_PREFIX.length)), {
+        name: 'HMAC',
+        hash: 'SHA-256'
+    }, false, [
+        'verify'
+    ]);
+    const signed = new TextEncoder().encode(`${id}.${timestamp}.${body}`);
+    let valid = false;
+    for (const signature of signatures.split(' ')){
+        const [version, value] = signature.split(',');
+        if (version !== 'v1' || !value) continue;
+        let bytes;
+        try {
+            bytes = base64ToBytes(value);
+        } catch  {
+            continue;
+        }
+        // crypto.subtle.verify compares in constant time.
+        if (await crypto.subtle.verify('HMAC', key, bytes, signed)) valid = true;
+    }
+    if (!valid) throw new PromptVerificationError('Invalid signature');
+    let payload;
+    try {
+        payload = JSON.parse(body);
+    } catch  {
+        throw new PromptVerificationError('The body is not JSON');
+    }
+    if (payload.type !== 'content.prompt') {
+        throw new PromptVerificationError(`Unexpected type "${payload.type}"`);
+    }
+    return payload;
+};
+// A fetch-style handler (Request → Response) for the prompt endpoint: Next.js
+// route handlers, Hono, Workers, Bun, Deno. Answers 401 to anything not signed
+// by the CMS and { output } otherwise.
+const createPromptHandler = ({ secret, generate })=>async (request)=>{
+        let payload;
+        try {
+            payload = await verifyPromptRequest(request, secret);
+        } catch (error) {
+            if (error instanceof PromptVerificationError) {
+                return Response.json({
+                    error: error.message
+                }, {
+                    status: 401
+                });
+            }
+            throw error;
+        }
+        try {
+            return Response.json({
+                output: await generate(payload)
+            });
+        } catch (error) {
+            console.error('[@obelism/content prompt]', error);
+            return Response.json({
+                error: 'The model failed'
+            }, {
+                status: 502
+            });
+        }
+    };
+
+exports.PromptVerificationError = PromptVerificationError;
+exports.createPromptHandler = createPromptHandler;
+exports.verifyPromptRequest = verifyPromptRequest;