@pramen/cms 0.0.51 → 0.0.53

package/README.md

@@ -489,6 +489,39 @@ become multilingual. `listCmsCapabilities` is what the editor reads; `listLocale
 DATA query (which locales are actually authored), and the two differ while a locale is
 declared but not yet used.
 
+### Which store: D1 or the Durable Object
+
+For a CMS behind a site, **D1 is usually the right store** — and it is the only one that
+lets the CMS live inside an Astro site's own Worker, because D1 is a binding while a
+Durable Object has to be exported from the worker entry.
+
+What you give up, and it is worth knowing before you pick:
+
+- **No atomic multi-statement mutations.** D1 has no interactive transactions, so
+  `transaction(fn)` runs `fn` as-is: a mutation that throws midway keeps what it already
+  wrote. Single-statement writes are still atomic. The Worker logs a specific error naming
+  the handler and how many statements had committed, so a partial write is diagnosable
+  rather than looking like an ordinary 500. Where the CMS does several writes in one
+  mutation — a revision plus the row it belongs to, a delete plus its revision purge — the
+  order is chosen so a failure leaves a benign state, but it is not a rollback.
+- **No live queries.** Those need the Durable Object's socket host. The editor does not use
+  them, so this only matters if your own frontend subscribes.
+- **Scheduled publish needs a Cron trigger.** There is no DO alarm to self-drain the outbox,
+  so a delayed task runs only when a Cron trigger calls `createPramen().scheduled`:
+
+  ```jsonc
+  "triggers": { "crons": ["* * * * *"] }
+  ```
+
+  Forget it and a scheduled publish simply never fires. The Worker now notices — when a
+  request-tail drain leaves a task queued for the future and no Cron drain has ever run, it
+  logs once naming the fix, and stops as soon as a Cron drain is seen.
+- **One shared database, no tenant column.** A non-`main` tenant on D1 is refused unless you
+  set `PRAMEN_D1_ALLOW_MULTITENANT=true`, because the rows would commingle.
+
+Pick the Durable Object store when a mutation must be atomic, when you want live queries, or
+when tenants must be isolated by construction.
+
 ## Limitations
 
 - **Block `fields` are opaque JSON**, so pramen's row/cell-level ACL and relational queries

package/dist/index.d.ts

@@ -908,6 +908,20 @@ export declare function createCmsHandlers(opts?: CmsHandlerOpts): {
         ok: true;
     }>;
     listContentTypes: import("@pramen/server").Handler<unknown, Record<string, unknown>[]>;
+    /** Content-type slugs + names, PUBLIC. The editor-facing `listContentTypes` above is
+     * viewer-gated, which a BUILD cannot satisfy: `@pramen/cms-astro`'s `collections: "auto"`
+     * runs in `astro:config:setup`, where there is no editor session and shipping a token to
+     * CI just to list type names would be the wrong trade.
+     *
+     * Nothing new is exposed. `cmsPolicies().public` already grants anonymous read of
+     * `cms_content_types` ("slugs/names are structural, not sensitive"), and
+     * `listPublishedPages` already returns the content-type slug of every published page.
+     * The projection is deliberately narrow — slug and name only, never the regions or
+     * field schema, which describe the editing surface rather than the published site. */
+    listPublicContentTypes: import("@pramen/server").Handler<unknown, {
+        slug: string;
+        name: string;
+    }[]>;
     getContentType: import("@pramen/server").Handler<{
         id: string;
     }, Record<string, unknown>>;
@@ -1262,6 +1276,20 @@ export declare const cmsHandlers: {
         ok: true;
     }>;
     listContentTypes: import("@pramen/server").Handler<unknown, Record<string, unknown>[]>;
+    /** Content-type slugs + names, PUBLIC. The editor-facing `listContentTypes` above is
+     * viewer-gated, which a BUILD cannot satisfy: `@pramen/cms-astro`'s `collections: "auto"`
+     * runs in `astro:config:setup`, where there is no editor session and shipping a token to
+     * CI just to list type names would be the wrong trade.
+     *
+     * Nothing new is exposed. `cmsPolicies().public` already grants anonymous read of
+     * `cms_content_types` ("slugs/names are structural, not sensitive"), and
+     * `listPublishedPages` already returns the content-type slug of every published page.
+     * The projection is deliberately narrow — slug and name only, never the regions or
+     * field schema, which describe the editing surface rather than the published site. */
+    listPublicContentTypes: import("@pramen/server").Handler<unknown, {
+        slug: string;
+        name: string;
+    }[]>;
     getContentType: import("@pramen/server").Handler<{
         id: string;
     }, Record<string, unknown>>;

package/dist/index.js

@@ -1273,6 +1273,20 @@ export function createCmsHandlers(opts = {}) {
             return { ok: true };
         }, { ...reviewer, ...mediaIdInput }),
         listContentTypes: query((ctx) => cdb(ctx).find({ from: "cms_content_types", orderBy: { column: "name" } }), viewer),
+        /** Content-type slugs + names, PUBLIC. The editor-facing `listContentTypes` above is
+         * viewer-gated, which a BUILD cannot satisfy: `@pramen/cms-astro`'s `collections: "auto"`
+         * runs in `astro:config:setup`, where there is no editor session and shipping a token to
+         * CI just to list type names would be the wrong trade.
+         *
+         * Nothing new is exposed. `cmsPolicies().public` already grants anonymous read of
+         * `cms_content_types` ("slugs/names are structural, not sensitive"), and
+         * `listPublishedPages` already returns the content-type slug of every published page.
+         * The projection is deliberately narrow — slug and name only, never the regions or
+         * field schema, which describe the editing surface rather than the published site. */
+        listPublicContentTypes: query(async (ctx) => {
+            const rows = await cdb(ctx).find({ from: "cms_content_types", orderBy: { column: "name" } });
+            return rows.map((r) => ({ slug: String(r.slug), name: String(r.name ?? r.slug) }));
+        }),
         getContentType: query(async (ctx, input) => {
             const rows = await cdb(ctx).find({ from: "cms_content_types", where: { id: input.id }, limit: 1 });
             return rows[0] ?? null;
@@ -1883,8 +1897,6 @@ export function createCmsHandlers(opts = {}) {
             // has no notion of `x-pramen-store`. Minting on the D1 store therefore produces a
             // link that 404s forever while the editor reports success — refuse instead of
             // handing out a token that cannot work.
-            if (ctx.store === "d1")
-                throw new PramenError("page preview is not available on the D1 store (redemption requires the Durable Object)", 503, "unavailable");
             const db = cdb(ctx);
             // Read the page through the ACL first: minting a link is granting access to it, so a
             // caller who cannot read the page must not be able to mint a link that can.
@@ -2959,12 +2971,6 @@ export function createCollectionHandlers(collections, opts = {}) {
             const secret = previewSecret(ctx.env);
             if (!secret)
                 throw previewUnconfigured(); // fail closed — never mint a forgeable link
-            // Redemption always reaches a Durable Object (callPrivileged -> PRAMEN.get) and has no
-            // notion of `x-pramen-store`, so a link minted on D1 would 404 forever while the
-            // editor reported success.
-            if (ctx.store === "d1") {
-                throw new PramenError("collection preview is not available on the D1 store (redemption requires the Durable Object)", 503, "unavailable");
-            }
             const row = await loadRow(cdb(ctx), c, input.id);
             const ttl = Math.max(60, Math.min(input.expiresIn ?? previewTtl, 30 * 24 * 3600));
             const exp = Math.floor(Date.now() / 1000) + ttl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pramen/cms",
-  "version": "0.0.51",
+  "version": "0.0.53",
   "description": "Optional block/page builder for pramen — Drupal-Paragraphs-style typed blocks in named regions, reusable blocks, scheduled publishing, built entirely from pramen primitives.",
   "license": "MIT",
   "repository": {
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pramen/server": "0.0.51"
+    "@pramen/server": "0.0.53"
   },
   "peerDependencies": {
     "react": ">=18"

package/src/index.ts

@@ -1724,6 +1724,21 @@ export function createCmsHandlers(opts: CmsHandlerOpts = {}) {
 
     listContentTypes: query((ctx) => cdb(ctx).find({ from: "cms_content_types", orderBy: { column: "name" } }), viewer),
 
+    /** Content-type slugs + names, PUBLIC. The editor-facing `listContentTypes` above is
+     * viewer-gated, which a BUILD cannot satisfy: `@pramen/cms-astro`'s `collections: "auto"`
+     * runs in `astro:config:setup`, where there is no editor session and shipping a token to
+     * CI just to list type names would be the wrong trade.
+     *
+     * Nothing new is exposed. `cmsPolicies().public` already grants anonymous read of
+     * `cms_content_types` ("slugs/names are structural, not sensitive"), and
+     * `listPublishedPages` already returns the content-type slug of every published page.
+     * The projection is deliberately narrow — slug and name only, never the regions or
+     * field schema, which describe the editing surface rather than the published site. */
+    listPublicContentTypes: query(async (ctx) => {
+      const rows = await cdb(ctx).find({ from: "cms_content_types", orderBy: { column: "name" } });
+      return rows.map((r) => ({ slug: String(r.slug), name: String(r.name ?? r.slug) }));
+    }),
+
     getContentType: query(async (ctx, input: { id: string }) => {
       const rows = await cdb(ctx).find({ from: "cms_content_types", where: { id: input.id }, limit: 1 });
       return rows[0] ?? null;
@@ -2314,7 +2329,7 @@ export function createCmsHandlers(opts: CmsHandlerOpts = {}) {
       // has no notion of `x-pramen-store`. Minting on the D1 store therefore produces a
       // link that 404s forever while the editor reports success — refuse instead of
       // handing out a token that cannot work.
-      if (ctx.store === "d1") throw new PramenError("page preview is not available on the D1 store (redemption requires the Durable Object)", 503, "unavailable");
+
       const db = cdb(ctx);
       // Read the page through the ACL first: minting a link is granting access to it, so a
       // caller who cannot read the page must not be able to mint a link that can.
@@ -3561,12 +3576,6 @@ export function createCollectionHandlers(collections: readonly CollectionDef[],
       needs(c, "preview");
       const secret = previewSecret(ctx.env);
       if (!secret) throw previewUnconfigured(); // fail closed — never mint a forgeable link
-      // Redemption always reaches a Durable Object (callPrivileged -> PRAMEN.get) and has no
-      // notion of `x-pramen-store`, so a link minted on D1 would 404 forever while the
-      // editor reported success.
-      if (ctx.store === "d1") {
-        throw new PramenError("collection preview is not available on the D1 store (redemption requires the Durable Object)", 503, "unavailable");
-      }
       const row = await loadRow(cdb(ctx), c, input.id);
       const ttl = Math.max(60, Math.min(input.expiresIn ?? previewTtl, 30 * 24 * 3600));
       const exp = Math.floor(Date.now() / 1000) + ttl;