@prenta/core 0.118.0

package/dist/api/handler-factory.js

@@ -0,0 +1,380 @@
+import { createRequire } from 'node:module';
+import { createApiRouter } from './router.js';
+import { registerCMSRoutes } from './handlers.js';
+import { parseCookieHeader } from './route-helpers.js';
+import { getDB, initDB, isDBInitialized } from '../db.js';
+import { validateCsrfToken } from '../security/index.js';
+import { createRateLimiter, warnStrictRateLimitConfigAtBoot } from '../security/rate-limit.js';
+import { DEFAULT_RATE_LIMIT, PUBLIC_READ_RATE_LIMIT, rateLimitBucket, rateLimitPolicyFor, } from '../security/rate-limit-policy.js';
+import { initServerSentry } from '../diagnostics/sentry.js';
+import { getClientIp, isResolvedIp } from '../security/client-ip.js';
+import { isIpAllowed } from '../security/ip-allowlist.js';
+import { getEffectiveIpAllowlist } from '../security/center/gather.js';
+import { autoSeedAdmin } from '../setup/index.js';
+import { setStorageAdapter, getStorageAdapter } from '../storage/index.js';
+import { autoWireStorageAdapter, isAutoWireableStorageProvider } from '../storage/auto-wire.js';
+import { getPrentaConfig, setPrentaConfig, setPrentaCoreVersion } from '../config/runtime.js';
+import { recordApiRequest } from '../diagnostics/api-metrics.js';
+import { createLogger } from '../diagnostics/logger.js';
+import { registerSectionTypes, resetCustomSectionTypes, resolveCustomSectionTypes, } from '../sections/registry.js';
+const handlerLogger = createLogger('api-handler');
+/**
+ * Routes that may legitimately receive a state-mutating request without a
+ * CSRF token. Matched by exact prefix on the rewritten (CMS-relative) path,
+ * not by `pathname.includes(...)` — without exact matching, an attacker could
+ * craft a path like `/collections/auth/login/foo` to bypass CSRF on every
+ * other endpoint.
+ *
+ *   /auth/login           — initial credential POST has no session yet
+ *   /auth/logout          — clears state; CSRF would just block sign-out
+ *   /auth/totp/login      — second factor in the login dance
+ *   /auth/forgot-password — anonymous; pre-account
+ *   /auth/reset-password  — anonymous; pre-account
+ *   /auth/oauth/...       — OAuth init + callback redirects
+ *   /setup/create-admin   — only reachable on a fresh install
+ *   /forms/:id/submit     — public form submissions (regex below)
+ *   /cron/...             — Vercel Cron / external schedulers; auth is via
+ *                           Authorization: Bearer ${CRON_SECRET} instead
+ */
+const CSRF_EXEMPT_PATHS = [
+    '/auth/login',
+    '/auth/logout',
+    '/auth/totp/login',
+    '/auth/forgot-password',
+    '/auth/reset-password',
+    '/auth/oauth/',
+    '/setup/create-admin',
+    '/cron/',
+    // Called from the public site frontend (no session/CSRF token) to log a 404
+    // for broken-link tracking. CSRF has no value here — it only increments a hit
+    // counter, carries no auth, and the handler bounds its inputs. Still subject
+    // to the global per-IP rate limiter above.
+    '/redirects/record-404',
+    // `/dev/login` is the localhost-only auth bypass — already triple-gated
+    // (env flag + non-prod + loopback IP). CSRF on a redirect-style login
+    // doesn't help here and would break the simple browser-navigation flow.
+    '/dev/login',
+];
+function isCsrfExemptPath(pathname) {
+    if (CSRF_EXEMPT_PATHS.some((p) => pathname === p ||
+        pathname.startsWith(`${p}/`) ||
+        (p.endsWith('/') && pathname.startsWith(p)))) {
+        return true;
+    }
+    // Public form submission endpoints (legacy by-id + slug-based public route).
+    return (/^\/forms\/[^/]+\/submit$/.test(pathname) || /^\/public\/forms\/[^/]+\/submit$/.test(pathname));
+}
+/**
+ * Detect requests authenticated with an Prenta API key (`act_sk_...`) so we
+ * can skip the CSRF check for them. API keys are opaque secrets — they cannot
+ * be obtained by a browser via a cross-site request the way session cookies
+ * can, so the CSRF protection has no value here.
+ *
+ * We do NOT verify the key here — full verification still happens inside
+ * `extractSession`. This is only a fast format check so the CSRF middleware
+ * can defer to that downstream check.
+ */
+function isApiKeyRequest(request) {
+    const auth = request.headers.get('Authorization');
+    if (!auth?.startsWith('Bearer '))
+        return false;
+    const token = auth.slice(7);
+    return /^act_sk_[a-f0-9]{32,}$/i.test(token);
+}
+const _require = createRequire(import.meta.url);
+const { version: CMS_CORE_VERSION } = _require('../../package.json');
+let cachedGraphQL = null;
+export function handlePrentaAPI(options = {}) {
+    setPrentaCoreVersion(CMS_CORE_VERSION);
+    // A remote `platform.storage` shorthand that still needs a server-side adapter
+    // wired on the first request (the config itself stays client-safe). Resolved
+    // once, lazily, in the request handler — see `storageWireChecked` below.
+    let pendingStorageProvider = null;
+    if (options.config) {
+        // Cast through `unknown` only to satisfy the typed setter; the public
+        // signature accepts `unknown` deliberately because consumers may have
+        // their own typings. Plugins and downstream code use `getPrentaConfig()`
+        // which gives them the PrentaCMSConfig shape.
+        setPrentaConfig(options.config);
+        warnStrictRateLimitConfigAtBoot();
+        // Fire-and-forget: Sentry init lazily imports the optional @sentry/node and
+        // must never block or break handler construction.
+        void initServerSentry();
+        const config = options.config;
+        // Register config-declared custom section types so coerce, validation, and
+        // discovery (REST + MCP) treat them as first-class. Reset first so a
+        // re-configure (tests, multi-tenant boots) never leaks stale types.
+        resetCustomSectionTypes();
+        registerSectionTypes(resolveCustomSectionTypes(config.sections));
+        const hooks = [];
+        if (Array.isArray(config.plugins)) {
+            for (const plugin of config.plugins) {
+                if (Array.isArray(plugin?.hooks)) {
+                    hooks.push(...plugin.hooks);
+                }
+            }
+        }
+        ;
+        config._pluginHooks = hooks;
+        // Wire up the platform storage adapter so /media/upload routes through
+        // it instead of dynamic-importing @vercel/blob directly. This honors
+        // platform-vercel's `token`/`prefix` options and lets consumers ship
+        // their own adapter (S3, R2, etc.) by registering one in the config.
+        const platformStorage = config.platform?.storage;
+        if (platformStorage &&
+            typeof platformStorage === 'object' &&
+            typeof platformStorage.upload === 'function') {
+            try {
+                setStorageAdapter(platformStorage);
+            }
+            catch (err) {
+                if (process.env.NODE_ENV !== 'test') {
+                    handlerLogger.warn('Failed to register platform storage adapter', {
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+        }
+        // `platform.storage: { provider: 'vercel-blob' }` is a client-safe shorthand
+        // (the config is imported by the admin client bundle, so it must not contain
+        // a real adapter, which pulls in `node:*`). It registers nothing by itself,
+        // so capture the provider and auto-wire the matching platform adapter
+        // server-side on the first request (see `storageWireChecked`).
+        const declaredProvider = platformStorage &&
+            typeof platformStorage === 'object' &&
+            typeof platformStorage.upload !== 'function'
+            ? platformStorage.provider
+            : undefined;
+        if (declaredProvider && declaredProvider !== 'local' && !getStorageAdapter()) {
+            pendingStorageProvider = declaredProvider;
+        }
+    }
+    const router = createApiRouter();
+    const rateLimiter = createRateLimiter(DEFAULT_RATE_LIMIT);
+    const publicReadRateLimiter = createRateLimiter(PUBLIC_READ_RATE_LIMIT);
+    const checkRateLimit = (request, pathname) => {
+        const policy = rateLimitPolicyFor(request.method, pathname);
+        const limiter = policy === PUBLIC_READ_RATE_LIMIT ? publicReadRateLimiter : rateLimiter;
+        return limiter.check(rateLimitBucket(policy, getClientIp(request)));
+    };
+    router.use(async (request, next) => {
+        // Rate-limit per trusted client IP. When we cannot resolve a trustworthy
+        // IP we fall back to a single global bucket — that's deliberately strict
+        // so an attacker who's spoofing X-Forwarded-For shares the bucket with
+        // every other un-authenticated client instead of getting their own.
+        const ip = getClientIp(request);
+        // IP allowlist enforcement for the union of the config `admin.ipAllowlist`
+        // and the database-stored Settings → Security allowlist. The Next.js
+        // middleware can only see the config half (no DB on the edge), so the DB
+        // half is enforced here — where every CMS data request terminates. Setup
+        // routes bypass the check (mirrors the middleware) so a fresh install is
+        // never locked out before an admin exists.
+        const pathname = new URL(request.url).pathname;
+        const isSetupRoute = pathname === '/setup' || pathname.startsWith('/setup/');
+        if (!isSetupRoute && isDBInitialized()) {
+            try {
+                const allowlist = await getEffectiveIpAllowlist(getDB());
+                if (allowlist.length > 0 && (!isResolvedIp(ip) || !isIpAllowed(ip, allowlist))) {
+                    return new Response(JSON.stringify({ error: 'Forbidden' }), {
+                        status: 403,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            }
+            catch {
+                // Policy unreadable — fall through to config-only enforcement in the
+                // middleware rather than taking the whole API down.
+            }
+        }
+        const rateLimitResult = await checkRateLimit(request, pathname);
+        if (!rateLimitResult.allowed) {
+            return new Response(JSON.stringify({ error: 'Too many requests' }), {
+                status: 429,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Retry-After': rateLimitResult.retryAfter?.toString() ?? '60',
+                },
+            });
+        }
+        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(request.method)) {
+            // The router rewrites the URL to drop the `/api/cms` prefix before
+            // dispatch, so by the time we run the path is already CMS-relative
+            // (e.g. `/auth/login`). Match exact prefixes — never `includes()`.
+            if (!isCsrfExemptPath(new URL(request.url).pathname) && !isApiKeyRequest(request)) {
+                const csrfToken = request.headers.get('x-csrf-token');
+                const csrfCookie = parseCookieHeader(request.headers.get('cookie') ?? '')['prenta_csrf'];
+                if (!csrfToken || !csrfCookie || !validateCsrfToken(csrfToken, csrfCookie)) {
+                    return new Response(JSON.stringify({ error: 'Invalid CSRF token' }), {
+                        status: 403,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+            }
+        }
+        return next();
+    });
+    registerCMSRoutes(router);
+    let dbChecked = false;
+    let storageWireChecked = false;
+    /**
+     * Resolve the `platform.storage` shorthand into a real adapter on the first
+     * request (server-only, so importing a platform package is safe). Memoized via
+     * `storageWireChecked`; emits the guidance warning only if auto-wiring fails
+     * (e.g. the platform package isn't installed).
+     */
+    async function ensureStorageAdapter() {
+        if (storageWireChecked)
+            return;
+        storageWireChecked = true;
+        if (!pendingStorageProvider || getStorageAdapter())
+            return;
+        const provider = pendingStorageProvider;
+        const wired = await autoWireStorageAdapter(provider);
+        if (!wired && process.env.NODE_ENV !== 'test') {
+            const hint = isAutoWireableStorageProvider(provider)
+                ? `install the matching platform package (e.g. \`@prenta/platform-${provider === 's3' ? 'aws' : 'vercel'}\`) so it can be auto-wired, or register an adapter server-side via setStorageAdapter()`
+                : 'register a storage adapter server-side via setStorageAdapter() in your API route';
+            handlerLogger.warn(`platform.storage.provider is "${provider}" but no storage adapter could be registered`, {
+                provider,
+                hint,
+            });
+        }
+    }
+    return async function handler(request) {
+        // Capture the start *before* the try-block — we want the duration
+        // to include DB init / setup wiring too, since those costs are
+        // visible to the user as latency.
+        const startedAt = performance.now();
+        const pathname = (() => {
+            try {
+                return new URL(request.url).pathname;
+            }
+            catch {
+                return '/';
+            }
+        })();
+        const response = await runHandler(request);
+        // Fire-and-forget — must NOT delay the response. Wrapping in a
+        // try/catch on the synchronous parts of `recordApiRequest` is
+        // belt-and-braces since the function itself swallows DB errors.
+        try {
+            recordApiRequest({
+                pathname,
+                status: response.status,
+                durationMs: performance.now() - startedAt,
+            });
+        }
+        catch {
+            /* metric pipeline must never break user requests */
+        }
+        return response;
+    };
+    async function runHandler(request) {
+        try {
+            await ensureStorageAdapter();
+            if (!isDBInitialized()) {
+                const client = options.prismaClient ??
+                    (options.prismaClientGetter ? await options.prismaClientGetter() : null);
+                if (client) {
+                    initDB(client);
+                    autoSeedAdmin(client).catch(() => { });
+                }
+            }
+            if (!dbChecked) {
+                dbChecked = true;
+                try {
+                    const client = options.prismaClient;
+                    if (client) {
+                        const required = ['document', 'user', 'session', 'media'];
+                        const missing = required.filter((m) => !(m in client));
+                        if (missing.length > 0) {
+                            handlerLogger.warn('Prisma client is missing CMS models', { missing });
+                        }
+                    }
+                }
+                catch { }
+            }
+            const url = new URL(request.url);
+            const originalPath = url.pathname;
+            if (originalPath === '/api/cms/graphql' || originalPath.startsWith('/api/cms/graphql')) {
+                const secret = process.env.CMS_SECRET;
+                if (!secret || secret.length < 32) {
+                    return new Response(JSON.stringify({ error: 'Server misconfiguration' }), {
+                        status: 500,
+                        headers: { 'Content-Type': 'application/json' },
+                    });
+                }
+                // GraphQL stays on the strict budget whatever the method — it is an
+                // arbitrary-query surface, not a fixed public read.
+                const rateLimitResult = await rateLimiter.check(rateLimitBucket(DEFAULT_RATE_LIMIT, getClientIp(request)));
+                if (!rateLimitResult.allowed) {
+                    return new Response(JSON.stringify({ error: 'Too many requests' }), {
+                        status: 429,
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'Retry-After': rateLimitResult.retryAfter?.toString() ?? '60',
+                        },
+                    });
+                }
+                if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(request.method) &&
+                    !isApiKeyRequest(request)) {
+                    const csrfToken = request.headers.get('x-csrf-token');
+                    const csrfCookie = parseCookieHeader(request.headers.get('cookie') ?? '')['prenta_csrf'];
+                    if (!csrfToken || !csrfCookie || !validateCsrfToken(csrfToken, csrfCookie)) {
+                        return new Response(JSON.stringify({ error: 'Invalid CSRF token' }), {
+                            status: 403,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                }
+                const config = getPrentaConfig();
+                if (config) {
+                    if (!cachedGraphQL) {
+                        const { createGraphQLHandler } = await import('../graphql/index.js');
+                        cachedGraphQL = await createGraphQLHandler({ config, secret });
+                    }
+                    return cachedGraphQL.handle(request);
+                }
+            }
+            const cmsPrefix = '/api/cms';
+            if (originalPath.startsWith(cmsPrefix)) {
+                const strippedPath = originalPath.slice(cmsPrefix.length) || '/';
+                const rewrittenUrl = new URL(strippedPath, url.origin);
+                rewrittenUrl.search = url.search;
+                const rewrittenRequest = new Request(rewrittenUrl.toString(), {
+                    method: request.method,
+                    headers: request.headers,
+                    body: request.body,
+                    // @ts-expect-error -- `duplex` is required for streaming bodies but
+                    // not yet in the lib.dom RequestInit type. Using @ts-expect-error
+                    // (vs @ts-ignore) ensures this directive itself fails when a future
+                    // TS lib update adds the property, prompting us to remove the cast.
+                    duplex: 'half',
+                });
+                return router.handle(rewrittenRequest);
+            }
+            return router.handle(request);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const stack = err instanceof Error ? err.stack : undefined;
+            let route = '/';
+            try {
+                route = new URL(request.url).pathname;
+            }
+            catch {
+                /* ignore malformed URL */
+            }
+            handlerLogger.error('Unhandled error in API handler', { route, error: message, stack });
+            const isDev = process.env.NODE_ENV !== 'production';
+            return new Response(JSON.stringify({
+                error: 'Internal CMS error',
+                ...(isDev && { detail: message, stack }),
+            }), {
+                status: 500,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+    }
+}
+//# sourceMappingURL=handler-factory.js.map

package/dist/api/handler-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-factory.js","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAC9F,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AAC/F,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAEhC,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,iBAAiB,GAA0B;IAC/C,aAAa;IACb,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,sBAAsB;IACtB,cAAc;IACd,qBAAqB;IACrB,QAAQ;IACR,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,2CAA2C;IAC3C,uBAAuB;IACvB,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,YAAY;CACb,CAAA;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IACE,iBAAiB,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CACJ,QAAQ,KAAK,CAAC;QACd,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC9C,EACD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,6EAA6E;IAC7E,OAAO,CACL,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/F,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACjD,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3B,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC/C,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,oBAAoB,CAAwB,CAAA;AAQ3F,IAAI,aAAa,GAEN,IAAI,CAAA;AAEf,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;IAEtC,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,sBAAsB,GAAkB,IAAI,CAAA;IAEhD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,8CAA8C;QAC9C,eAAe,CAAC,OAAO,CAAC,MAAe,CAAC,CAAA;QACxC,+BAA+B,EAAE,CAAA;QACjC,4EAA4E;QAC5E,kDAAkD;QAClD,KAAK,gBAAgB,EAAE,CAAA;QAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAa,CAAA;QAEpC,2EAA2E;QAC3E,qEAAqE;QACrE,oEAAoE;QACpE,uBAAuB,EAAE,CAAA;QACzB,oBAAoB,CAAC,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChE,MAAM,KAAK,GAAU,EAAE,CAAA;QACvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QACD,CAAC;QAAC,MAAc,CAAC,YAAY,GAAG,KAAK,CAAA;QAErC,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAA;QAChD,IACE,eAAe;YACf,OAAO,eAAe,KAAK,QAAQ;YACnC,OAAQ,eAAuB,CAAC,MAAM,KAAK,UAAU,EACrD,CAAC;YACD,IAAI,CAAC;gBACH,iBAAiB,CAAC,eAAe,CAAC,CAAA;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACpC,aAAa,CAAC,IAAI,CAAC,6CAA6C,EAAE;wBAChE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,gBAAgB,GACpB,eAAe;YACf,OAAO,eAAe,KAAK,QAAQ;YACnC,OAAQ,eAAuB,CAAC,MAAM,KAAK,UAAU;YACnD,CAAC,CAAE,eAAuB,CAAC,QAAQ;YACnC,CAAC,CAAC,SAAS,CAAA;QACf,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC7E,sBAAsB,GAAG,gBAAgB,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAEhC,MAAM,WAAW,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;IACzD,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAA;IAEvE,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,QAAgB,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAA;QACvF,OAAO,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACrE,CAAC,CAAA;IAED,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACjC,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAE/B,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9C,MAAM,YAAY,GAAG,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAC5E,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAA;gBACxD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC/E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE;wBAC1D,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,oDAAoD;YACtD,CAAC;QACH,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC/D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;gBAClE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;iBAC9D;aACF,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAA;gBACxF,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;wBACnE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;IAEF,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAEzB,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAE9B;;;;;OAKG;IACH,KAAK,UAAU,oBAAoB;QACjC,IAAI,kBAAkB;YAAE,OAAM;QAC9B,kBAAkB,GAAG,IAAI,CAAA;QACzB,IAAI,CAAC,sBAAsB,IAAI,iBAAiB,EAAE;YAAE,OAAM;QAC1D,MAAM,QAAQ,GAAG,sBAAsB,CAAA;QACvC,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,6BAA6B,CAAC,QAAQ,CAAC;gBAClD,CAAC,CAAC,kEACE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAC9B,yFAAyF;gBAC3F,CAAC,CAAC,kFAAkF,CAAA;YACtF,aAAa,CAAC,IAAI,CAChB,iCAAiC,QAAQ,8CAA8C,EACvF;gBACE,QAAQ;gBACR,IAAI;aACL,CACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAC,OAAgB;QAC5C,kEAAkE;QAClE,+DAA+D;QAC/D,kCAAkC;QAClC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAA;YACZ,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAA;QAC1C,+DAA+D;QAC/D,8DAA8D;QAC9D,gEAAgE;QAChE,IAAI,CAAC;YACH,gBAAgB,CAAC;gBACf,QAAQ;gBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;aAC1C,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IAED,KAAK,UAAU,UAAU,CAAC,OAAgB;QACxC,IAAI,CAAC;YACH,MAAM,oBAAoB,EAAE,CAAA;YAE5B,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBACvB,MAAM,MAAM,GACV,OAAO,CAAC,YAAY;oBACpB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;gBAC1E,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,CAAC,CAAA;oBACd,aAAa,CAAC,MAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACnD,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS,GAAG,IAAI,CAAA;gBAChB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,OAAO,CAAC,YAAmD,CAAA;oBAC1E,IAAI,MAAM,EAAE,CAAC;wBACX,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;wBACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAA;wBACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACvB,aAAa,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;wBACxE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAA;YAEjC,IAAI,YAAY,KAAK,kBAAkB,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;gBACrC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAE;wBACxE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAA;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,oDAAoD;gBACpD,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,KAAK,CAC7C,eAAe,CAAC,kBAAkB,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAC1D,CAAA;gBACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;oBAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;wBAClE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;yBAC9D;qBACF,CAAC,CAAA;gBACJ,CAAC;gBAED,IACE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC3D,CAAC,eAAe,CAAC,OAAO,CAAC,EACzB,CAAC;oBACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;oBACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAA;oBACxF,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;wBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;4BACnE,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;gBAChC,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;wBACpE,aAAa,GAAG,MAAM,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;oBAChE,CAAC;oBACD,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,CAAA;YAC5B,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAChE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;gBACtD,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;gBAEhC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE;oBAC5D,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,oEAAoE;oBACpE,kEAAkE;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,MAAM,EAAE,MAAM;iBACf,CAAC,CAAA;gBAEF,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChE,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YAC1D,IAAI,KAAK,GAAG,GAAG,CAAA;YACf,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;YACD,aAAa,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAEvF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;YACnD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,oBAAoB;gBAC3B,GAAG,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aACzC,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/api/handlers.d.ts

@@ -0,0 +1,8 @@
+import type { ApiRouter } from './router.js';
+/**
+ * Registers every CMS API route on the router. Each domain lives in its own
+ * module under `./routes/`; registration order is preserved from the original
+ * monolithic handler file because route matching is first-match-wins.
+ */
+export declare function registerCMSRoutes(router: ApiRouter): void;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/api/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA6B5C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA4BzD"}

package/dist/api/handlers.js

@@ -0,0 +1,62 @@
+import { registerMetaRoutes } from './routes/meta.js';
+import { registerAuthRoutes } from './routes/auth.js';
+import { registerDocumentRoutes } from './routes/documents.js';
+import { registerSectionRoutes } from './routes/sections.js';
+import { registerMediaRoutes } from './routes/media.js';
+import { registerSystemRoutes } from './routes/system.js';
+import { registerDashboardRoutes } from './routes/dashboard.js';
+import { registerUserRoutes } from './routes/users.js';
+import { registerFormRoutes } from './routes/forms.js';
+import { registerRedirectRoutes } from './routes/redirects.js';
+import { registerSeoRoutes } from './routes/seo.js';
+import { registerSeoPublicRoutes } from './routes/seo-public.js';
+import { registerUrlResolutionRoutes } from './routes/url-resolution.js';
+import { registerFolderRoutes } from './routes/folders.js';
+import { registerPreviewRoutes } from './routes/preview.js';
+import { registerCollabRoutes } from './routes/collab.js';
+import { registerSchedulingRoutes } from './routes/scheduling.js';
+import { registerGlobalRoutes } from './routes/globals.js';
+import { registerNavigationRoutes } from './routes/navigations.js';
+import { registerSecurityCenterRoutes } from './routes/security-center.js';
+import { registerAiSettingsRoutes } from './routes/ai-settings.js';
+import { registerEmailSettingsRoutes } from './routes/email-settings.js';
+import { registerWebhookRoutes } from './routes/webhooks.js';
+import { registerPresenceRoutes } from './routes/presence.js';
+import { registerPageTemplateRoutes } from './routes/page-templates.js';
+import { registerSavedSectionRoutes } from './routes/saved-sections.js';
+import { registerAiSeoRoutes } from './routes/ai-seo.js';
+/**
+ * Registers every CMS API route on the router. Each domain lives in its own
+ * module under `./routes/`; registration order is preserved from the original
+ * monolithic handler file because route matching is first-match-wins.
+ */
+export function registerCMSRoutes(router) {
+    registerMetaRoutes(router);
+    registerAuthRoutes(router);
+    registerDocumentRoutes(router);
+    registerSectionRoutes(router);
+    registerMediaRoutes(router);
+    registerSystemRoutes(router);
+    registerDashboardRoutes(router);
+    registerUserRoutes(router);
+    registerFormRoutes(router);
+    registerRedirectRoutes(router);
+    registerSeoRoutes(router);
+    registerSeoPublicRoutes(router);
+    registerUrlResolutionRoutes(router);
+    registerFolderRoutes(router);
+    registerPreviewRoutes(router);
+    registerCollabRoutes(router);
+    registerSchedulingRoutes(router);
+    registerGlobalRoutes(router);
+    registerNavigationRoutes(router);
+    registerSecurityCenterRoutes(router);
+    registerAiSettingsRoutes(router);
+    registerEmailSettingsRoutes(router);
+    registerWebhookRoutes(router);
+    registerPresenceRoutes(router);
+    registerPageTemplateRoutes(router);
+    registerSavedSectionRoutes(router);
+    registerAiSeoRoutes(router);
+}
+//# sourceMappingURL=handlers.js.map

package/dist/api/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAExD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC1B,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC1B,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC3B,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC5B,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC/B,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC1B,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC1B,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACzB,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC/B,2BAA2B,CAAC,MAAM,CAAC,CAAA;IACnC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC5B,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC5B,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAChC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC5B,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAChC,4BAA4B,CAAC,MAAM,CAAC,CAAA;IACpC,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAChC,2BAA2B,CAAC,MAAM,CAAC,CAAA;IACnC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC9B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,mBAAmB,CAAC,MAAM,CAAC,CAAA;AAC7B,CAAC"}

package/dist/api/index.d.ts

@@ -0,0 +1,8 @@
+export type { ApiRoute, ApiMiddleware, ApiRouter } from './router.js';
+export { createApiRouter } from './router.js';
+export { registerCMSRoutes } from './handlers.js';
+export { handlePrentaAPI } from './handler-factory.js';
+export type { HandlePrentaAPIOptions } from './handler-factory.js';
+export { setStorageAdapter, getStorageAdapter } from '../storage/index.js';
+export type { StorageAdapter } from '../storage/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAKlE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC1E,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/api/index.js

@@ -0,0 +1,8 @@
+export { createApiRouter } from './router.js';
+export { registerCMSRoutes } from './handlers.js';
+export { handlePrentaAPI } from './handler-factory.js';
+// Storage registration is a server-only concern — re-exported here so consumers
+// can wire a custom adapter in their API route (never in the client-imported
+// config). See the "Storage (uploads)" docs.
+export { setStorageAdapter, getStorageAdapter } from '../storage/index.js';
+//# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAGtD,gFAAgF;AAChF,6EAA6E;AAC7E,6CAA6C;AAC7C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/api/openapi.d.ts

@@ -0,0 +1,3 @@
+import type { PrentaCMSConfig } from '../config/types.js';
+export declare function generateOpenAPISpec(config: PrentaCMSConfig): Record<string, unknown>;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/api/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/api/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,oBAAoB,CAAA;AA0gBvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwCpF"}