@orion-studios/cms 0.5.0

package/dist/forms/react.d.ts

@@ -0,0 +1,45 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import { ReactNode } from 'react';
+import { F as FormConfig } from '../submission-CzrfXu17.js';
+
+/**
+ * The shared, config-driven form renderer: the same component renders a form
+ * in the Studio's form editor preview and on the public site, from the same
+ * `cms_forms.config`. Sites theme it through the `classNames` map — the
+ * markup is plain semantic HTML.
+ */
+type FormRendererClassNames = {
+    form?: string;
+    field?: string;
+    fieldError?: string;
+    errorText?: string;
+    label?: string;
+    input?: string;
+    textarea?: string;
+    select?: string;
+    checkbox?: string;
+    radioGroup?: string;
+    button?: string;
+    success?: string;
+    formError?: string;
+    stepTitle?: string;
+};
+type FormRendererProps = {
+    /** Form slug — submissions POST to `${basePath}/forms/${slug}/submit`. */
+    slug: string;
+    config: FormConfig;
+    successMessage?: string;
+    /** Defaults to /api/cms. */
+    basePath?: string;
+    classNames?: FormRendererClassNames;
+    /** Optional heading + intro rendered above the fields. */
+    title?: ReactNode;
+    intro?: ReactNode;
+    submitLabel?: string;
+    /** Preview mode (Studio): renders fields but never submits. */
+    preview?: boolean;
+    onSuccess?: () => void;
+};
+declare function FormRenderer({ slug, config, successMessage, basePath, classNames, title, intro, submitLabel, preview, onSuccess, }: FormRendererProps): react_jsx_runtime.JSX.Element;
+
+export { FormRenderer, type FormRendererClassNames, type FormRendererProps };

package/dist/forms/react.js

@@ -0,0 +1,8 @@
+'use client';
+"use client";
+import {
+  FormRenderer
+} from "../chunk-WQDHEQDE.js";
+export {
+  FormRenderer
+};

package/dist/server/index.d.ts

@@ -0,0 +1,403 @@
+import { SupabaseClient } from '@supabase/supabase-js';
+import { BlockRegistry, PageLayout } from '../blocks/index.js';
+import { F as FormConfig, R as RateLimitStore } from '../submission-BKdBedOe.js';
+export { CONTENT_CACHE_TAG } from '../content/index.js';
+import 'react';
+import 'zod';
+
+/**
+ * Submission email notifications. Vendor-thin: one fetch to Resend's REST API
+ * (no SDK), swappable via the `sendEmail` route option for tests or other
+ * providers. Failures are logged and never break the submission.
+ */
+type EmailMessage = {
+    to: string[];
+    subject: string;
+    text: string;
+    replyTo?: string;
+};
+type EmailSender = (message: EmailMessage) => Promise<void>;
+type ResendSenderOptions = {
+    /** Defaults to process.env.RESEND_API_KEY. */
+    apiKey?: string;
+    /** Defaults to process.env.CMS_EMAIL_FROM, then onboarding@resend.dev. */
+    from?: string;
+};
+/** Returns a Resend-backed sender, or null when no API key is configured. */
+declare function createResendSender(options?: ResendSenderOptions): EmailSender | null;
+/** Human-readable plain-text rendering of a submission's data. */
+declare function formatSubmissionText(data: Record<string, unknown>): string;
+type NotifySubmissionArgs = {
+    sendEmail: EmailSender;
+    formTitle: string;
+    config: FormConfig;
+    successMessage?: string;
+    data: Record<string, unknown>;
+    siteName?: string;
+};
+/**
+ * Sends the notification email(s) for one accepted submission: a copy to each
+ * configured notify address, and (optionally) an auto-reply to the submitter.
+ * Never throws — a mail failure must not break the submit.
+ */
+declare function notifySubmission(args: NotifySubmissionArgs): Promise<void>;
+
+type CmsRoutesOptions = {
+    registry: BlockRegistry;
+    /** Overrides the service client (tests). */
+    client?: SupabaseClient;
+    /** Origins allowed for public form submissions. Defaults to same-origin. */
+    allowedOrigins?: string[];
+    /** Rate limiter for public submissions. Defaults to in-memory (5/min/IP). */
+    rateLimitStore?: RateLimitStore | null;
+    /** Token accepted by POST /sync and POST /cron/* in addition to admin bearer auth. */
+    syncToken?: string;
+    /** Extra domains never flagged as email typos. */
+    knownGoodEmailDomains?: string[];
+    /**
+     * Email sender for submission notifications. Defaults to Resend when
+     * RESEND_API_KEY is set; pass null to disable.
+     */
+    sendEmail?: EmailSender | null;
+    /** Site name used in notification emails. */
+    siteName?: string;
+    /** Secret for draft preview tokens. Defaults to the service-role key. */
+    previewSecret?: string;
+    /** Cloudflare Turnstile secret — when set, public submits must include a valid `_turnstileToken`. */
+    turnstileSecret?: string;
+    /** Max upload size in bytes (default 15 MB). */
+    maxUploadBytes?: number;
+    /** Days of raw analytics events to keep (default 90). */
+    analyticsRetentionDays?: number;
+    /**
+     * Dev-only: uploads are stored as data URLs instead of Supabase Storage so
+     * the memory backend can serve them. Never enable in production.
+     */
+    memoryMode?: boolean;
+};
+type RouteContext = {
+    params: Promise<{
+        path?: string[];
+    }> | {
+        path?: string[];
+    };
+};
+/**
+ * Durable rate limiting for multi-instance serverless. Backed by an atomic
+ * cms_rate_limit_consume() upsert so concurrent requests across lambdas share
+ * one counter with no count-then-insert race. Fails open (allow) if the DB /
+ * migration is unavailable, so a transient error never blocks real users.
+ */
+declare function createDurableRateLimitStore(getClient: () => SupabaseClient, options?: {
+    max?: number;
+    windowMs?: number;
+    bucket?: string;
+}): RateLimitStore;
+declare function createCmsRoutes(options: CmsRoutesOptions): {
+    GET: (request: Request, context: RouteContext) => Promise<Response>;
+    POST: (request: Request, context: RouteContext) => Promise<Response>;
+    PATCH: (request: Request, context: RouteContext) => Promise<Response>;
+    DELETE: (request: Request, context: RouteContext) => Promise<Response>;
+};
+
+declare const PREVIEW_TOKEN_TTL_MS: number;
+declare function createPreviewToken(pageId: string, secret: string, ttlMs?: number): string;
+/** Returns the page id when the token is valid and unexpired, else null. */
+declare function verifyPreviewToken(token: string, secret: string): string | null;
+type PreviewPage = {
+    id: string;
+    slug: string;
+    path: string;
+    title: string;
+    seo: Record<string, unknown>;
+    layout: PageLayout;
+};
+/**
+ * Site-side helper: verifies a preview token and loads the page's DRAFT
+ * layout with the given (service or memory) client.
+ */
+declare function getPreviewPage(client: SupabaseClient, token: string, secret: string): Promise<PreviewPage | null>;
+
+/**
+ * Pure analytics aggregation: raw event rows in, the full dashboard payload
+ * out. Isomorphic and dependency-free so the same code serves the Supabase
+ * and memory backends and is trivially testable.
+ *
+ * Conversion = a call tap, a form submission, or an email click. A session
+ * "converted" when it contains at least one conversion event.
+ */
+type StoredEvent = {
+    id?: number | string;
+    session_key: string;
+    visitor_key?: string;
+    type: string;
+    name: string;
+    path: string;
+    referrer: string;
+    utm: Record<string, string> | null;
+    device: string;
+    region: string;
+    city: string;
+    meta: Record<string, unknown> | null;
+    created_at: string;
+};
+type AnalyticsKpis = {
+    visitors: number;
+    identifiedVisitors: number;
+    returningVisitors: number;
+    sessions: number;
+    pageviews: number;
+    pagesPerVisitor: number;
+    calls: number;
+    formSubmits: number;
+    emails: number;
+    portalClicks: number;
+    conversions: number;
+    conversionRate: number;
+};
+type AnalyticsSummary = {
+    range: {
+        from: string;
+        to: string;
+    };
+    kpis: AnalyticsKpis;
+    previous: AnalyticsKpis;
+    trend: Array<{
+        day: string;
+        visitors: number;
+        conversions: number;
+    }>;
+    pages: Array<{
+        path: string;
+        views: number;
+        entries: number;
+        conversions: number;
+    }>;
+    sources: Array<{
+        source: string;
+        sessions: number;
+        conversions: number;
+    }>;
+    locations: Array<{
+        location: string;
+        sessions: number;
+    }>;
+    devices: Array<{
+        device: string;
+        sessions: number;
+    }>;
+    hours: number[];
+    paths: Array<{
+        path: string[];
+        count: number;
+        converted: number;
+    }>;
+    forms: Array<{
+        form: string;
+        views: number;
+        starts: number;
+        submits: number;
+    }>;
+    notFound: Array<{
+        path: string;
+        count: number;
+    }>;
+};
+declare function aggregateAnalytics(events: StoredEvent[], previousEvents: StoredEvent[], range: {
+    from: string;
+    to: string;
+}): AnalyticsSummary;
+
+/**
+ * Server-side analytics ingest: validation, bot filtering, and the
+ * cookieless session key. The client payload stays dumb — everything
+ * sensitive (session, device, geo) derives from the request server-side.
+ */
+declare const EVENT_TYPES: readonly ["pageview", "click", "form", "not_found"];
+type AnalyticsEventType = (typeof EVENT_TYPES)[number];
+type IncomingEvent = {
+    type: AnalyticsEventType;
+    name?: string;
+    path?: string;
+    referrer?: string;
+    utm?: Record<string, string>;
+    meta?: Record<string, unknown>;
+};
+type AnalyticsEventRow = {
+    session_key: string;
+    visitor_key: string;
+    type: AnalyticsEventType;
+    name: string;
+    path: string;
+    referrer: string;
+    utm: Record<string, string>;
+    device: string;
+    region: string;
+    city: string;
+    meta: Record<string, unknown>;
+};
+/**
+ * Daily-rotating visitor hash: same visitor+day → same key, next day → a new
+ * unrelated key. Orders one visit into a path; can't track anyone over time.
+ */
+declare function sessionKeyFor(ip: string, userAgent: string, secret: string, now?: Date): string;
+/** One-way server hash for a consented first-party visitor cookie. */
+declare function visitorKeyFor(visitorId: unknown, secret: string): string;
+/** True when the request looks like an automated client, not a visitor. */
+declare function isBotRequest(userAgent: string): boolean;
+/** Coarse device class — enough for a mobile/desktop split, nothing more. */
+declare function deviceFrom(userAgent: string): string;
+type ParseEventsResult = {
+    rows: AnalyticsEventRow[];
+    dropped: number;
+};
+/**
+ * Validates and normalizes a client batch into insertable rows. Unknown
+ * types, oversized fields, and junk are dropped silently — analytics ingest
+ * never errors at a visitor.
+ */
+declare function parseEventBatch(body: unknown, context: {
+    sessionKey: string;
+    visitorKey?: string;
+    device: string;
+    region: string;
+    city: string;
+}): ParseEventsResult;
+/** Reads Vercel's geo headers (present in production; empty elsewhere). */
+declare function geoFrom(request: Request): {
+    region: string;
+    city: string;
+};
+
+/**
+ * Server-side Supabase clients.
+ *
+ * - The service client (service-role key) is the API layer's data access path.
+ *   It bypasses RLS; authorization is enforced by the permission matrix in
+ *   routes.ts — a single, testable enforcement point.
+ * - User identity comes from the Studio's bearer token (its Supabase session
+ *   access token), verified via auth.getUser(). Stateless: no cookie plumbing.
+ */
+type CmsEnv = {
+    supabaseUrl: string;
+    serviceRoleKey: string;
+};
+declare function readCmsEnv(): CmsEnv;
+declare function getServiceClient(env?: CmsEnv): SupabaseClient;
+/** Test seam: inject a fake client. */
+declare function setServiceClientForTesting(client: SupabaseClient | null): void;
+type CmsUser = {
+    id: string;
+    email: string | null;
+    role: 'admin' | 'developer' | 'editor' | 'content';
+    name: string;
+};
+/**
+ * Resolves the requesting user from the Authorization bearer token and loads
+ * their CMS role. Returns null for anonymous/invalid tokens.
+ */
+declare function resolveUser(request: Request, client?: SupabaseClient): Promise<CmsUser | null>;
+
+/**
+ * The capability-tier permission matrix. Enforced in the API layer regardless
+ * of what the Studio UI shows.
+ */
+type CmsRole = CmsUser['role'];
+type CmsAction = 'pages.read' | 'pages.saveDraft' | 'pages.changeStructure' | 'pages.publish' | 'pages.create' | 'pages.delete' | 'pages.restore' | 'globals.read' | 'globals.write' | 'media.read' | 'media.upload' | 'media.update' | 'media.delete' | 'forms.read' | 'forms.write' | 'forms.delete' | 'submissions.read' | 'submissions.manage' | 'redirects.manage' | 'activity.read' | 'analytics.read' | 'sync.run' | 'users.manage';
+declare function can(user: CmsUser | null, action: CmsAction): boolean;
+/**
+ * Structural change detection for the content tier: `content` users may edit
+ * block data in place but not add, remove, retype, or reorder blocks.
+ */
+declare function isStructuralChange(previous: PageLayout, next: PageLayout): boolean;
+
+/**
+ * Content-as-code sync: the single implementation used by both the
+ * POST /api/cms/sync route and local `npm run sync` scripts.
+ *
+ * Contract (proven on Currin): create missing pages, refresh metadata always,
+ * write layouts only where the page is not builder-owned, upsert globals and
+ * forms. Idempotent.
+ */
+type SyncPageInput = {
+    slug: string;
+    path?: string;
+    title?: string;
+    seo?: Record<string, unknown>;
+    layout?: unknown;
+};
+type SyncGlobalInput = {
+    key: string;
+    data: Record<string, unknown>;
+};
+type SyncFormInput = {
+    slug: string;
+    title?: string;
+    config?: Record<string, unknown>;
+    successMessage?: string;
+};
+type SyncMediaInput = {
+    storagePath: string;
+    filename?: string;
+    alt?: string;
+    caption?: string;
+    mimeType?: string;
+    width?: number | null;
+    height?: number | null;
+    filesize?: number | null;
+};
+type SyncInput = {
+    pages?: SyncPageInput[];
+    globals?: SyncGlobalInput[];
+    forms?: SyncFormInput[];
+    media?: SyncMediaInput[];
+};
+type SyncResult = {
+    synced: string[];
+    skipped: Array<{
+        slug: string;
+        issues: unknown;
+    }>;
+    globals: number;
+    forms: number;
+    media: number;
+    /** Non-page resources that failed to write (globals/forms). */
+    failed: Array<{
+        kind: 'global' | 'form';
+        key: string;
+        error: string;
+    }>;
+};
+declare function runContentSync(client: SupabaseClient, registry: BlockRegistry, input: SyncInput): Promise<SyncResult>;
+
+/**
+ * In-memory CMS backend for local development and end-to-end tests.
+ *
+ * Lets a freshly scaffolded site run `npm run dev` and use the full Studio
+ * with ZERO Supabase setup: data lives in process memory, auth accepts the
+ * dev token, and uploads become data URLs. Never use in production — the
+ * route factory only enables it when explicitly passed.
+ *
+ * Emulates exactly the supabase-js surface the CMS uses: filtered selects,
+ * insert/upsert/delete, the four cms_* RPC functions, storage, and
+ * auth.getUser.
+ */
+type Row = Record<string, unknown>;
+declare const MEMORY_DEV_TOKEN = "orion-dev-token";
+declare class MemoryStore {
+    tables: Map<string, Row[]>;
+    private serial;
+    table(name: string): Row[];
+    setTable(name: string, rows: Row[]): void;
+    nextSerial(): number;
+}
+type MemoryCms = {
+    client: SupabaseClient;
+    store: MemoryStore;
+    devToken: string;
+};
+declare function createMemoryCms(): MemoryCms;
+/** Process-wide singleton for Next.js dev servers (module state survives HMR via globalThis). */
+declare function getMemoryCms(): MemoryCms;
+
+export { type AnalyticsEventType, type AnalyticsKpis, type AnalyticsSummary, type CmsAction, type CmsEnv, type CmsRole, type CmsRoutesOptions, type CmsUser, type EmailMessage, type EmailSender, type IncomingEvent, MEMORY_DEV_TOKEN, type MemoryCms, PREVIEW_TOKEN_TTL_MS, type PreviewPage, type ResendSenderOptions, type StoredEvent, type SyncFormInput, type SyncGlobalInput, type SyncInput, type SyncMediaInput, type SyncPageInput, type SyncResult, aggregateAnalytics, can, createCmsRoutes, createDurableRateLimitStore, createMemoryCms, createPreviewToken, createResendSender, deviceFrom, formatSubmissionText, geoFrom, getMemoryCms, getPreviewPage, getServiceClient, isBotRequest, isStructuralChange, notifySubmission, parseEventBatch, readCmsEnv, resolveUser, runContentSync, sessionKeyFor, setServiceClientForTesting, verifyPreviewToken, visitorKeyFor };