@obelism/content 0.0.0-stage → 0.1.0

package/dist/site.mjs

@@ -0,0 +1,302 @@
+import { n as normalizeUrl, a as DEFAULT_TIMEOUT, D as DEFAULT_URL } from './config-c6qktlz6.mjs';
+
+// Editing on your own site, outside the visual editor (the CMS's
+// docs/site-editing.md). One handler serves everything under `/cms` (the
+// `basePath`) on your site:
+//
+// - `/cms/login?return_to=/pricing` — sends the browser to Obelism Content
+//   to sign in, with a PKCE challenge, and…
+// - `/cms/callback` — …takes it back: trades the one-time code for a site
+//   token, keeps it in an httpOnly cookie, calls `onSignIn` (turn on your
+//   framework's draft mode there) and returns to `return_to`.
+// - `/cms/logout` — ends the session in the CMS, clears the cookies, calls
+//   `onSignOut`.
+// - `/cms/api/…` — what the bridge's prompt bar calls in the browser,
+//   forwarded to the CMS with the token. The token never reaches page
+//   scripts.
+//
+// While signed in, render drafts by reading the delivery API with the token
+// (`readSiteToken`), and the bridge shows the prompt bar with Save and
+// Publish.
+const SITE_TOKEN_COOKIE = 'obelism_content_token';
+// Readable by the page: tells the bridge the site is being edited, and where
+// this handler lives. Holds no secret.
+const SITE_EDITING_COOKIE = 'obelism_content_editing';
+const FLOW_COOKIE = 'obelism_content_flow';
+// The bridge sends it with every write, which a cross-site form can't.
+const SITE_REQUEST_HEADER = 'x-obelism-content';
+const SITE_PATH = '/api/site/v1';
+const FLOW_MAX_AGE = 10 * 60;
+// The site token from a Cookie header (or a framework's cookie store), or
+// null when not signed in to edit:
+//
+//   const token = readSiteToken(request.headers.get('cookie'))
+//   const content = token ? new ContentClient({ token, init: { cache: 'no-store' } }) : delivery
+const readSiteToken = (cookies)=>{
+    if (!cookies) return null;
+    if (typeof cookies !== 'string') return cookies.get(SITE_TOKEN_COOKIE)?.value || null;
+    return parseCookies(cookies).get(SITE_TOKEN_COOKIE) || null;
+};
+const parseCookies = (header)=>{
+    const cookies = new Map();
+    for (const part of header.split(';')){
+        const index = part.indexOf('=');
+        if (index < 0) continue;
+        const name = part.slice(0, index).trim();
+        if (!name || cookies.has(name)) continue;
+        try {
+            cookies.set(name, decodeURIComponent(part.slice(index + 1).trim()));
+        } catch  {
+            cookies.set(name, part.slice(index + 1).trim());
+        }
+    }
+    return cookies;
+};
+const serializeCookie = (name, value, { maxAge, path, httpOnly, secure })=>[
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${path}`,
+        `Max-Age=${Math.max(0, Math.floor(maxAge))}`,
+        // Also Expires: Next.js re-serializes response cookies when draft mode
+        // changes, and drops a Max-Age of 0.
+        `Expires=${new Date(maxAge > 0 ? Date.now() + maxAge * 1000 : 0).toUTCString()}`,
+        'SameSite=Lax',
+        httpOnly && 'HttpOnly',
+        secure && 'Secure'
+    ].filter(Boolean).join('; ');
+const base64Url = (bytes)=>{
+    let binary = '';
+    for (const byte of bytes)binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const randomString = (bytes = 32)=>base64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+const pkceChallenge = async (verifier)=>base64Url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
+// Only a path on this site: never an open redirect.
+const safeReturnTo = (value)=>value && value.startsWith('/') && !value.startsWith('//') && !value.includes('\\') ? value : '/';
+const normalizeBasePath = (basePath)=>`/${basePath.replace(/^\/+|\/+$/g, '')}`;
+// What the browser may reach through `/cms/api/…`: reads, and the writes
+// the prompt bar makes. Nothing else of the site API is exposed.
+const PROXY_ROUTES = [
+    {
+        method: 'GET',
+        pattern: /^session$/
+    },
+    {
+        method: 'GET',
+        pattern: /^entries\/[\w-]+$/
+    },
+    {
+        method: 'POST',
+        pattern: /^entries\/[\w-]+\/(preview|prompt|save|publish)$/
+    }
+];
+// The handler for everything under `basePath`. In Next.js:
+//
+//   // app/cms/[...path]/route.ts
+//   const handler = createSiteEditing({
+//     spaceId: process.env.CONTENT_SPACE_ID!,
+//     environment: 'production',
+//     onSignIn: async () => (await draftMode()).enable(),
+//     onSignOut: async () => (await draftMode()).disable(),
+//   })
+//   export { handler as GET, handler as POST }
+const createSiteEditing = ({ spaceId, environment, url, basePath = '/cms', siteUrl, onSignIn, onSignOut, timeout = DEFAULT_TIMEOUT, fetch: fetchImpl })=>{
+    const cms = normalizeUrl(url || DEFAULT_URL);
+    const base = normalizeBasePath(basePath);
+    const doFetch = fetchImpl ?? ((...args)=>fetch(...args));
+    const callCms = (path, init = {})=>doFetch(`${cms}${SITE_PATH}/${path}`, {
+            ...init,
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeout)
+        });
+    return async (request)=>{
+        const requestUrl = new URL(request.url);
+        const origin = siteUrl ? normalizeUrl(siteUrl) : requestUrl.origin;
+        const secure = origin.startsWith('https:');
+        const redirectUri = `${origin}${base}/callback`;
+        const cookies = parseCookies(request.headers.get('cookie') ?? '');
+        const path = requestUrl.pathname.startsWith(`${base}/`) ? requestUrl.pathname.slice(base.length + 1) : null;
+        const sessionCookies = (session)=>[
+                serializeCookie(SITE_TOKEN_COOKIE, session.token, {
+                    maxAge: session.maxAge,
+                    path: '/',
+                    httpOnly: true,
+                    secure
+                }),
+                serializeCookie(SITE_EDITING_COOKIE, session.token ? base : '', {
+                    maxAge: session.maxAge,
+                    path: '/',
+                    httpOnly: false,
+                    secure
+                })
+            ];
+        const clearedCookies = ()=>sessionCookies({
+                token: '',
+                maxAge: 0
+            });
+        const redirect = (location, setCookies = [])=>{
+            const headers = new Headers({
+                Location: location,
+                'Cache-Control': 'no-store'
+            });
+            for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
+            return new Response(null, {
+                status: 302,
+                headers
+            });
+        };
+        if (path === 'login' && request.method === 'GET') {
+            const state = randomString(16);
+            const verifier = randomString(48);
+            const flow = JSON.stringify({
+                state,
+                verifier,
+                returnTo: safeReturnTo(requestUrl.searchParams.get('return_to'))
+            });
+            const connect = new URL(`${cms}/site/connect`);
+            connect.search = new URLSearchParams({
+                space: spaceId,
+                environment,
+                redirect_uri: redirectUri,
+                state,
+                code_challenge: await pkceChallenge(verifier),
+                code_challenge_method: 'S256'
+            }).toString();
+            return redirect(connect.toString(), [
+                serializeCookie(FLOW_COOKIE, flow, {
+                    maxAge: FLOW_MAX_AGE,
+                    path: base,
+                    httpOnly: true,
+                    secure
+                })
+            ]);
+        }
+        if (path === 'callback' && request.method === 'GET') {
+            const clearFlow = serializeCookie(FLOW_COOKIE, '', {
+                maxAge: 0,
+                path: base,
+                httpOnly: true,
+                secure
+            });
+            let flow;
+            try {
+                flow = JSON.parse(cookies.get(FLOW_COOKIE) ?? '');
+            } catch  {
+                flow = {};
+            }
+            const code = requestUrl.searchParams.get('code');
+            if (!code || typeof flow.state !== 'string' || typeof flow.verifier !== 'string' || flow.state !== requestUrl.searchParams.get('state')) {
+                return textResponse(400, 'This sign-in link is invalid or expired. Start again from the login link.', [
+                    clearFlow
+                ]);
+            }
+            const response = await callCms('token', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    code,
+                    code_verifier: flow.verifier,
+                    redirect_uri: redirectUri
+                })
+            });
+            if (!response.ok) {
+                return textResponse(400, 'Obelism Content did not accept the sign-in. Start again from the login link.', [
+                    clearFlow
+                ]);
+            }
+            const session = await response.json();
+            await onSignIn?.(session);
+            const maxAge = (Date.parse(session.expiresAt) - Date.now()) / 1000;
+            return redirect(safeReturnTo(flow.returnTo), [
+                clearFlow,
+                ...sessionCookies({
+                    token: session.token,
+                    maxAge
+                })
+            ]);
+        }
+        if (path === 'logout') {
+            const token = cookies.get(SITE_TOKEN_COOKIE);
+            if (token) {
+                await callCms('session', {
+                    method: 'DELETE',
+                    headers: {
+                        Authorization: `Bearer ${token}`
+                    }
+                }).catch(()=>null);
+            }
+            await onSignOut?.();
+            return redirect(safeReturnTo(requestUrl.searchParams.get('return_to')), clearedCookies());
+        }
+        if (path?.startsWith('api/')) {
+            const route = path.slice('api/'.length);
+            if (!PROXY_ROUTES.some(({ method, pattern })=>method === request.method && pattern.test(route))) {
+                return Response.json({
+                    error: 'Not found'
+                }, {
+                    status: 404
+                });
+            }
+            if (request.method !== 'GET' && request.headers.get(SITE_REQUEST_HEADER) !== '1') {
+                return Response.json({
+                    error: 'Forbidden'
+                }, {
+                    status: 403
+                });
+            }
+            const token = cookies.get(SITE_TOKEN_COOKIE);
+            if (!token) {
+                return Response.json({
+                    error: 'Not signed in'
+                }, {
+                    status: 401
+                });
+            }
+            const response = await callCms(route, {
+                method: request.method,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    ...request.method !== 'GET' && {
+                        'Content-Type': 'application/json'
+                    }
+                },
+                ...request.method !== 'GET' && {
+                    body: await request.text()
+                }
+            });
+            const headers = new Headers({
+                'Content-Type': 'application/json',
+                'Cache-Control': 'no-store'
+            });
+            // The session ended in the CMS: stop showing the editing UI.
+            if (response.status === 401) {
+                for (const cookie of clearedCookies()){
+                    headers.append('Set-Cookie', cookie);
+                }
+            }
+            return new Response(await response.text(), {
+                status: response.status,
+                headers
+            });
+        }
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    };
+};
+const textResponse = (status, text, setCookies)=>{
+    const headers = new Headers({
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Cache-Control': 'no-store'
+    });
+    for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
+    return new Response(text, {
+        status,
+        headers
+    });
+};
+
+export { SITE_EDITING_COOKIE, SITE_REQUEST_HEADER, SITE_TOKEN_COOKIE, createSiteEditing, pkceChallenge, readSiteToken, safeReturnTo };

package/dist/types-pa96z6po.d.ts

@@ -0,0 +1,120 @@
+type Environment = 'develop' | 'staging' | 'production';
+type RichTextFormat = 'json' | 'html';
+type Asset = {
+    id: string;
+    url: string;
+    filename: string;
+    mimeType: string;
+    size: number;
+    width: number | null;
+    height: number | null;
+    title: string | Record<string, string> | null;
+    alt: string | Record<string, string> | null;
+};
+type Entry<TFields extends Record<string, unknown> = Record<string, unknown>, TContentType extends string = string> = {
+    id: string;
+    contentType: TContentType;
+    name: string;
+    slug: string | null;
+    path: string | null;
+    publishedAt: string | null;
+    firstPublishedAt: string | null;
+    updatedAt: string;
+    fields: TFields;
+};
+type EntryStub<TContentType extends string = string> = {
+    id: string;
+    contentType: TContentType;
+};
+type Block<TFields extends Record<string, unknown> = Record<string, unknown>, TType extends string = string> = {
+    _uid: string;
+    _type: TType;
+} & TFields;
+type RichTextMark = {
+    type: 'bold' | 'italic' | 'underline' | 'strike' | 'code' | 'link' | string;
+    attrs?: Record<string, unknown>;
+};
+type RichTextNode = {
+    type: string;
+    attrs?: Record<string, unknown>;
+    content?: RichTextNode[];
+    text?: string;
+    marks?: RichTextMark[];
+};
+type RichTextDocument = RichTextNode & {
+    type: 'doc';
+};
+type EntryList<TEntry extends Entry = Entry> = {
+    items: TEntry[];
+    total: number;
+    limit: number;
+    skip: number;
+};
+type ContentTypeKind = 'page' | 'data' | 'block';
+type BaseField = {
+    apiId: string;
+    name: string;
+    description?: string;
+    required?: boolean;
+    localized?: boolean;
+};
+type FieldDefinition = BaseField & ({
+    type: 'text';
+    minLength?: number;
+    maxLength?: number;
+    pattern?: string;
+} | {
+    type: 'textarea';
+    minLength?: number;
+    maxLength?: number;
+} | {
+    type: 'richtext';
+} | {
+    type: 'number';
+    integer?: boolean;
+    min?: number;
+    max?: number;
+} | {
+    type: 'boolean';
+} | {
+    type: 'datetime';
+    withTime?: boolean;
+} | {
+    type: 'select';
+    multiple?: boolean;
+    options: {
+        value: string;
+        label: string;
+    }[];
+} | {
+    type: 'asset';
+    multiple?: boolean;
+    mimeTypes?: string[];
+} | {
+    type: 'reference';
+    multiple?: boolean;
+    contentTypes?: string[];
+} | {
+    type: 'blocks';
+    allowedBlocks?: string[];
+    min?: number;
+    max?: number;
+} | {
+    type: 'json';
+});
+type FieldType = FieldDefinition['type'];
+type ContentTypeDefinition = {
+    apiId: string;
+    name: string;
+    kind: ContentTypeKind;
+    description?: string | null;
+    fields: FieldDefinition[];
+};
+type ModelFile = {
+    $schema?: string;
+    version: 1;
+    contentTypes: ContentTypeDefinition[];
+};
+
+export type { Asset as A, Block as B, ContentTypeDefinition as C, Entry as E, FieldDefinition as F, ModelFile as M, RichTextFormat as R, EntryList as a, EntryStub as b, RichTextNode as c, ContentTypeKind as d, Environment as e, FieldType as f, RichTextDocument as g, RichTextMark as h };
+//# sourceMappingURL=types-pa96z6po.d.ts.map

package/dist/types-pa96z6po.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-pa96z6po.d.ts","sources":["../src/types.ts"],"mappings":"AAAA,KAAK,WAAW;AAChB,KAAK,cAAc;AACnB,KAAK,KAAK;AACV;AACA;AACA;AACA;AACA;AACA;AACA;AACA,oBAAoB,MAAM;AAC1B,kBAAkB,MAAM;AACxB;AACA,KAAK,KAAK,iBAAiB,MAAM,oBAAoB,MAAM;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,KAAK,SAAS;AACd;AACA;AACA;AACA,KAAK,KAAK,iBAAiB,MAAM,oBAAoB,MAAM;AAC3D;AACA;AACA;AACA,KAAK,YAAY;AACjB;AACA,YAAY,MAAM;AAClB;AACA,KAAK,YAAY;AACjB;AACA,YAAY,MAAM;AAClB,cAAc,YAAY;AAC1B;AACA,YAAY,YAAY;AACxB;AACA,KAAK,gBAAgB,GAAG,YAAY;AACpC;AACA;AACA,KAAK,SAAS,gBAAgB,KAAK,GAAG,KAAK;AAC3C;AACA;AACA;AACA;AACA;AACA,KAAK,eAAe;AACpB,KAAK,SAAS;AACd;AACA;AACA;AACA;AACA;AACA;AACA,KAAK,eAAe,GAAG,SAAS;AAChC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,KAAK,SAAS,GAAG,eAAe;AAChC,KAAK,qBAAqB;AAC1B;AACA;AACA,UAAU,eAAe;AACzB;AACA,YAAY,eAAe;AAC3B;AACA,KAAK,SAAS;AACd;AACA;AACA,kBAAkB,qBAAqB;AACvC;;","names":[]}

package/package.json

@@ -1,6 +1,92 @@
 {
-  "name": "@obelism/content",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "@obelism/content",
+	"description": "Obelism Content SDK: the delivery API client, the visual editor bridge with prompt editing, editing on your own site, and the content model CLI",
+	"version": "0.1.0",
+	"keywords": [
+		"cms",
+		"headless-cms",
+		"visual-editor",
+		"typescript",
+		"obelism"
+	],
+	"license": "MIT",
+	"author": "Obelism <hello@obelism.studio> (https://www.obelism.studio)",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/Obelism/content-sdk"
+	},
+	"sideEffects": false,
+	"files": [
+		"dist"
+	],
+	"bin": {
+		"content": "./dist/bin/content.js"
+	},
+	"exports": {
+		".": {
+			"import": {
+				"types": "./dist/index.d.mts",
+				"default": "./dist/index.mjs"
+			},
+			"require": {
+				"types": "./dist/index.d.ts",
+				"default": "./dist/index.js"
+			}
+		},
+		"./bridge": {
+			"import": {
+				"types": "./dist/bridge.d.mts",
+				"default": "./dist/bridge.mjs"
+			},
+			"require": {
+				"types": "./dist/bridge.d.ts",
+				"default": "./dist/bridge.js"
+			}
+		},
+		"./site": {
+			"import": {
+				"types": "./dist/site.d.mts",
+				"default": "./dist/site.mjs"
+			},
+			"require": {
+				"types": "./dist/site.d.ts",
+				"default": "./dist/site.js"
+			}
+		},
+		"./prompt": {
+			"import": {
+				"types": "./dist/prompt.d.mts",
+				"default": "./dist/prompt.mjs"
+			},
+			"require": {
+				"types": "./dist/prompt.d.ts",
+				"default": "./dist/prompt.js"
+			}
+		}
+	},
+	"scripts": {
+		"build": "bunchee",
+		"dev": "bunchee --watch --no-clean",
+		"test": "vitest",
+		"test:coverage": "vitest run --coverage",
+		"test:ci": "vitest run",
+		"lint": "npm-run-all --parallel lint:*",
+		"lint:oxlint": "oxlint",
+		"lint:types": "tsc --noEmit",
+		"clean": "rm -rf ./node_modules && rm -rf ./dist && rm -rf ./.turbo"
+	},
+	"devDependencies": {
+		"@obelism/content-typescript-config": "^0.0.0",
+		"@types/node": "^24.0.0",
+		"@typescript/typescript6": "^6.0.2",
+		"bunchee": "^7.0.2",
+		"jsdom": "^30.1.2",
+		"npm-run-all2": "^9.0.2",
+		"oxlint": "^1.88.0",
+		"typescript": "^7.0.2",
+		"vitest": "^5.0.4"
+	},
+	"engines": {
+		"node": ">=20"
+	}
+}