@prenta/core 0.118.0

package/dist/preview/sse-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-stream.js","sourceRoot":"","sources":["../../src/preview/sse-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnD,OAAO,EAAE,cAAc,EAAE,CAAA;AAEzB;;;;;;;;;GASG;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AASxD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA0D,EAC1D,OAA6B,EAAE;IAE/B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,wBAAwB,CAAA;IAChE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,2BAA2B,CAAA;IAEvE,IAAI,SAAqD,CAAA;IACzD,IAAI,QAAmD,CAAA;IACvD,IAAI,WAAqC,CAAA;IAEzC,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,UAAU;YACd,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;gBAChC,IAAI,CAAC;oBACH,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;oBAC/D,mEAAmE;gBACrE,CAAC;YACH,CAAC,CAAA;YAED,OAAO,CACL,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAC5F,CAAA;YAED,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;gBACtF,OAAO,CACL,cAAc,CACZ;oBACE,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,GAAG,KAAK,CAAC,OAAO;iBACjB,EACD,QAAQ,CACT,CACF,CAAA;YACH,CAAC,CAAC,CAAA;YAEF,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC3B,OAAO,CAAC,iBAAiB,CAAC,CAAA;YAC5B,CAAC,EAAE,WAAW,CAAC,CAAA;YAEf,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;gBACzB,IAAI,CAAC;oBACH,UAAU,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;YACH,CAAC,EAAE,aAAa,CAAC,CAAA;QACnB,CAAC;QAED,MAAM;YACJ,IAAI,SAAS;gBAAE,aAAa,CAAC,SAAS,CAAC,CAAA;YACvC,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;YACpC,IAAI,WAAW;gBAAE,WAAW,EAAE,CAAA;QAChC,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,cAAc,EAAE,kCAAkC;IAClD,eAAe,EAAE,wBAAwB;IACzC,UAAU,EAAE,YAAY;IACxB,wEAAwE;IACxE,iDAAiD;IACjD,mBAAmB,EAAE,IAAI;CAC1B,CAAA;AAED,MAAM,UAAU,2BAA2B,CACzC,OAA0D,EAC1D,IAA2B;IAE3B,OAAO,IAAI,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;QACtD,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,mBAAmB;KAC7B,CAAC,CAAA;AACJ,CAAC"}

package/dist/privacy/index.d.ts

@@ -0,0 +1,33 @@
+export interface UserDataExport {
+    user: Record<string, unknown>;
+    documents: Record<string, unknown>[];
+    media: Record<string, unknown>[];
+    auditLogs: Record<string, unknown>[];
+    sessions: Record<string, unknown>[];
+    exportedAt: string;
+}
+export interface RetentionPolicy {
+    collection: string;
+    maxAgeDays: number;
+    action: 'delete' | 'anonymize' | 'archive';
+}
+export interface ErasureResult {
+    deletedDocuments: number;
+    anonymizedRecords: number;
+    deletedMedia: number;
+    deletedSessions: number;
+}
+/** Export all data associated with a user (GDPR Article 20 - Right to Data Portability). */
+export declare function exportUserData(_userId: string, _db: unknown): Promise<UserDataExport>;
+/** Erase all personal data for a user (GDPR Article 17 - Right to Erasure). */
+export declare function eraseUserData(_userId: string, _db: unknown): Promise<ErasureResult>;
+/** Apply retention policies to documents past their retention period. */
+export declare function applyRetentionPolicies(_policies: RetentionPolicy[], _db: unknown): Promise<{
+    processed: number;
+    actions: Array<{
+        collection: string;
+        count: number;
+        action: string;
+    }>;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/privacy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/privacy/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAChC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACnC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAA;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,4FAA4F;AAC5F,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAG3F;AAED,+EAA+E;AAC/E,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAGzF;AAED,yEAAyE;AACzE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,eAAe,EAAE,EAC5B,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;IACT,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtE,CAAC,CAED"}

package/dist/privacy/index.js

@@ -0,0 +1,15 @@
+/** Export all data associated with a user (GDPR Article 20 - Right to Data Portability). */
+export async function exportUserData(_userId, _db) {
+    // TODO: gather all user-related data from all tables
+    throw new Error('Not implemented');
+}
+/** Erase all personal data for a user (GDPR Article 17 - Right to Erasure). */
+export async function eraseUserData(_userId, _db) {
+    // TODO: delete or anonymize all user data, revoke sessions, remove PII
+    throw new Error('Not implemented');
+}
+/** Apply retention policies to documents past their retention period. */
+export async function applyRetentionPolicies(_policies, _db) {
+    throw new Error('Not implemented');
+}
+//# sourceMappingURL=index.js.map

package/dist/privacy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/privacy/index.ts"],"names":[],"mappings":"AAsBA,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,GAAY;IAChE,qDAAqD;IACrD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACpC,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,GAAY;IAC/D,uEAAuE;IACvE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACpC,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA4B,EAC5B,GAAY;IAKZ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;AACpC,CAAC"}

package/dist/public-redirects.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Framework-neutral public SEO redirect engine.
+ *
+ * Matches Next scaffold / apps/dev middleware semantics so Astro (and any
+ * non-Next public host) can apply admin-managed redirects against
+ * `PRENTA_CMS_URL` without reimplementing fetch/cache/chain/hit logic.
+ *
+ * @see create-prenta `generateProxy()` — historical source of truth
+ */
+export declare const PUBLIC_REDIRECT_CACHE_TTL_MS = 60000;
+export interface PublicRedirectRule {
+    id?: string;
+    fromUrl: string;
+    toUrl: string;
+    statusCode: number;
+    preserveQuery: boolean;
+    isActive?: boolean;
+}
+export interface MatchedPublicRedirect {
+    /** Terminal rule after chain collapse. */
+    rule: PublicRedirectRule;
+    /** Absolute or path destination ready for Location (query may be appended). */
+    destination: string;
+    /** HTTP status to issue (301/302/307/308/410). */
+    status: number;
+}
+export interface ApplyPublicRedirectOptions {
+    /** CMS origin (or same-origin for Next monolith). No trailing slash. */
+    baseUrl: string;
+    /** API prefix. Default `/api/cms`. */
+    apiPath?: string;
+    /** Extra path prefixes to skip (in addition to defaults). */
+    skipPrefixes?: string[];
+    /** Admin / login mount paths to skip. Default `['/admin']`. */
+    adminPaths?: string[];
+    /** Override fetch (tests). */
+    fetchImpl?: typeof fetch;
+    /** Wall clock override (tests). */
+    now?: () => number;
+}
+/** Default prefixes skipped by {@link shouldSkipPublicRedirect}. */
+export declare const DEFAULT_PUBLIC_REDIRECT_SKIP_PREFIXES: readonly ["/api", "/_astro", "/_next", "/.well-known"];
+/** Test hook: clear the in-memory redirect rule cache. */
+export declare function clearPublicRedirectCache(): void;
+/**
+ * Whether this pathname should skip the redirect engine (admin, API, framework
+ * internals, static assets). Legacy content extensions (.html/.php/…) are
+ * re-admitted so migrated URLs can still redirect.
+ */
+export declare function shouldSkipPublicRedirect(pathname: string, options?: {
+    adminPaths?: string[];
+    skipPrefixes?: string[];
+}): boolean;
+/**
+ * Fetch enabled public redirect rules with a short in-isolate TTL cache.
+ * On network/HTTP failure, returns the previous cache (if any) or `[]`.
+ */
+export declare function fetchPublicRedirects(baseUrl: string, options?: {
+    apiPath?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}): Promise<PublicRedirectRule[]>;
+/**
+ * Match a pathname against rules, following internal chains to a terminal hop
+ * (bounded to 10, loop-guarded). Returns null when no rule matches.
+ */
+export declare function matchPublicRedirect(pathname: string, rules: PublicRedirectRule[], search?: string): MatchedPublicRedirect | null;
+/** Fire-and-forget hit increment for the Redirects tab analytics. */
+export declare function recordPublicRedirectHit(baseUrl: string, path: string, options?: {
+    apiPath?: string;
+    fetchImpl?: typeof fetch;
+}): void;
+/**
+ * Resolve a public redirect for an incoming request.
+ * Returns a Web `Response` (redirect or 410) or `null` to continue.
+ */
+export declare function applyPublicRedirect(request: Request, options: ApplyPublicRedirectOptions): Promise<Response | null>;
+//# sourceMappingURL=public-redirects.d.ts.map

package/dist/public-redirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-redirects.d.ts","sourceRoot":"","sources":["../src/public-redirects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAElD,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,IAAI,EAAE,kBAAkB,CAAA;IACxB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAA;IACf,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAOD,oEAAoE;AACpE,eAAO,MAAM,qCAAqC,wDAKxC,CAAA;AAIV,0DAA0D;AAC1D,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAeD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC/D,OAAO,CAkBT;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GAC/E,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAyB/B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,kBAAkB,EAAE,EAC3B,MAAM,SAAK,GACV,qBAAqB,GAAG,IAAI,CAsC9B;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GAC3D,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0C1B"}

package/dist/public-redirects.js

@@ -0,0 +1,187 @@
+/**
+ * Framework-neutral public SEO redirect engine.
+ *
+ * Matches Next scaffold / apps/dev middleware semantics so Astro (and any
+ * non-Next public host) can apply admin-managed redirects against
+ * `PRENTA_CMS_URL` without reimplementing fetch/cache/chain/hit logic.
+ *
+ * @see create-prenta `generateProxy()` — historical source of truth
+ */
+import { normalizeRedirectPath } from './redirects/graph.js';
+export const PUBLIC_REDIRECT_CACHE_TTL_MS = 60_000;
+const DEFAULT_API_PATH = '/api/cms';
+const REDIRECT_STATUSES = new Set([301, 302, 307, 308]);
+const LEGACY_CONTENT_EXT = /\.(?:html?|php|aspx?|jsp|cfm)$/i;
+const STATIC_ASSET_EXT = /\.[a-zA-Z0-9]+$/;
+/** Default prefixes skipped by {@link shouldSkipPublicRedirect}. */
+export const DEFAULT_PUBLIC_REDIRECT_SKIP_PREFIXES = [
+    '/api',
+    '/_astro',
+    '/_next',
+    '/.well-known',
+];
+let redirectCache = null;
+/** Test hook: clear the in-memory redirect rule cache. */
+export function clearPublicRedirectCache() {
+    redirectCache = null;
+}
+function trimSlash(url) {
+    return url.replace(/\/+$/, '');
+}
+function normalizeApiPath(apiPath) {
+    const path = apiPath.startsWith('/') ? apiPath : `/${apiPath}`;
+    return trimSlash(path);
+}
+function cmsApiBase(baseUrl, apiPath = DEFAULT_API_PATH) {
+    return `${trimSlash(baseUrl)}${normalizeApiPath(apiPath)}`;
+}
+/**
+ * Whether this pathname should skip the redirect engine (admin, API, framework
+ * internals, static assets). Legacy content extensions (.html/.php/…) are
+ * re-admitted so migrated URLs can still redirect.
+ */
+export function shouldSkipPublicRedirect(pathname, options = {}) {
+    const adminPaths = options.adminPaths?.length ? options.adminPaths : ['/admin'];
+    const skipPrefixes = [...DEFAULT_PUBLIC_REDIRECT_SKIP_PREFIXES, ...(options.skipPrefixes ?? [])];
+    for (const admin of adminPaths) {
+        const prefix = admin.startsWith('/') ? admin : `/${admin}`;
+        if (pathname === prefix || pathname.startsWith(`${prefix}/`))
+            return true;
+    }
+    for (const skip of skipPrefixes) {
+        const prefix = skip.startsWith('/') ? skip : `/${skip}`;
+        if (pathname === prefix || pathname.startsWith(`${prefix}/`))
+            return true;
+    }
+    // Extensionless paths always eligible.
+    if (!STATIC_ASSET_EXT.test(pathname))
+        return false;
+    // Re-admit legacy content-page extensions (Next matcher parity).
+    if (LEGACY_CONTENT_EXT.test(pathname))
+        return false;
+    return true;
+}
+/**
+ * Fetch enabled public redirect rules with a short in-isolate TTL cache.
+ * On network/HTTP failure, returns the previous cache (if any) or `[]`.
+ */
+export async function fetchPublicRedirects(baseUrl, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const now = options.now ?? Date.now;
+    const key = cmsApiBase(baseUrl, options.apiPath);
+    if (redirectCache &&
+        redirectCache.key === key &&
+        now() - redirectCache.ts < PUBLIC_REDIRECT_CACHE_TTL_MS) {
+        return redirectCache.rules;
+    }
+    try {
+        const res = await fetchImpl(`${key}/redirects/public`, {
+            headers: { 'x-prenta-mw': '1' },
+        });
+        if (!res.ok)
+            return redirectCache?.key === key ? redirectCache.rules : [];
+        const json = (await res.json());
+        const rules = json?.data?.redirects ?? [];
+        redirectCache = { key, rules, ts: now() };
+        return rules;
+    }
+    catch {
+        return redirectCache?.key === key ? redirectCache.rules : [];
+    }
+}
+/**
+ * Match a pathname against rules, following internal chains to a terminal hop
+ * (bounded to 10, loop-guarded). Returns null when no rule matches.
+ */
+export function matchPublicRedirect(pathname, rules, search = '') {
+    if (rules.length === 0)
+        return null;
+    const byFrom = new Map();
+    for (const r of rules) {
+        if (r.isActive === false)
+            continue;
+        const key = normalizeRedirectPath(r.fromUrl);
+        if (!byFrom.has(key))
+            byFrom.set(key, r);
+    }
+    const norm = normalizeRedirectPath(pathname);
+    let match = byFrom.get(norm);
+    if (!match)
+        return null;
+    const seen = new Set([norm]);
+    for (let i = 0; i < 10; i++) {
+        if (/^https?:\/\//i.test(match.toUrl))
+            break;
+        const nextKey = normalizeRedirectPath(match.toUrl);
+        if (seen.has(nextKey))
+            break;
+        const next = byFrom.get(nextKey);
+        if (!next)
+            break;
+        seen.add(nextKey);
+        match = next;
+    }
+    let destination = match.toUrl;
+    if (match.preserveQuery && search) {
+        destination += destination.includes('?') ? `&${search.slice(1)}` : search;
+    }
+    const status = match.statusCode === 410
+        ? 410
+        : REDIRECT_STATUSES.has(match.statusCode)
+            ? match.statusCode
+            : 301;
+    return { rule: match, destination, status };
+}
+/** Fire-and-forget hit increment for the Redirects tab analytics. */
+export function recordPublicRedirectHit(baseUrl, path, options = {}) {
+    const normalized = path.trim();
+    if (!normalized)
+        return;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const base = cmsApiBase(baseUrl, options.apiPath);
+    void fetchImpl(`${base}/redirects/record-hit`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ path: normalized }),
+    }).catch(() => { });
+}
+/**
+ * Resolve a public redirect for an incoming request.
+ * Returns a Web `Response` (redirect or 410) or `null` to continue.
+ */
+export async function applyPublicRedirect(request, options) {
+    if (request.method !== 'GET' && request.method !== 'HEAD')
+        return null;
+    const url = new URL(request.url);
+    const { pathname, search } = url;
+    if (shouldSkipPublicRedirect(pathname, {
+        adminPaths: options.adminPaths,
+        skipPrefixes: options.skipPrefixes,
+    })) {
+        return null;
+    }
+    const rules = await fetchPublicRedirects(options.baseUrl, {
+        apiPath: options.apiPath,
+        fetchImpl: options.fetchImpl,
+        now: options.now,
+    });
+    const matched = matchPublicRedirect(pathname, rules, search);
+    if (!matched)
+        return null;
+    recordPublicRedirectHit(options.baseUrl, pathname, {
+        apiPath: options.apiPath,
+        fetchImpl: options.fetchImpl,
+    });
+    if (matched.status === 410) {
+        return new Response('Gone', { status: 410 });
+    }
+    const isExternal = /^https?:\/\//i.test(matched.destination);
+    const location = isExternal
+        ? matched.destination
+        : new URL(matched.destination, url.origin).toString();
+    return new Response(null, {
+        status: matched.status,
+        headers: { Location: location },
+    });
+}
+//# sourceMappingURL=public-redirects.js.map

package/dist/public-redirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-redirects.js","sourceRoot":"","sources":["../src/public-redirects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAA;AAmClD,MAAM,gBAAgB,GAAG,UAAU,CAAA;AACnC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AACvD,MAAM,kBAAkB,GAAG,iCAAiC,CAAA;AAC5D,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAE1C,oEAAoE;AACpE,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,MAAM;IACN,SAAS;IACT,QAAQ;IACR,cAAc;CACN,CAAA;AAEV,IAAI,aAAa,GAAoE,IAAI,CAAA;AAEzF,0DAA0D;AAC1D,MAAM,UAAU,wBAAwB;IACtC,aAAa,GAAG,IAAI,CAAA;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAA;IAC9D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,OAAO,GAAG,gBAAgB;IAC7D,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,UAA8D,EAAE;IAEhE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC/E,MAAM,YAAY,GAAG,CAAC,GAAG,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAA;IAEhG,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAA;QAC1D,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IAC3E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;QACvD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IAC3E,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,UAA8E,EAAE;IAEhF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAEhD,IACE,aAAa;QACb,aAAa,CAAC,GAAG,KAAK,GAAG;QACzB,GAAG,EAAE,GAAG,aAAa,CAAC,EAAE,GAAG,4BAA4B,EACvD,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAA;IAC5B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,mBAAmB,EAAE;YACrD,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE;SAChC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,aAAa,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAA;QAClF,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE,CAAA;QACzC,aAAa,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;QACzC,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,KAA2B,EAC3B,MAAM,GAAG,EAAE;IAEX,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAA;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK;YAAE,SAAQ;QAClC,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,MAAK;QAC5C,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAK;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI;YAAE,MAAK;QAChB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjB,KAAK,GAAG,IAAI,CAAA;IACd,CAAC;IAED,IAAI,WAAW,GAAG,KAAK,CAAC,KAAK,CAAA;IAC7B,IAAI,KAAK,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;QAClC,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3E,CAAC;IAED,MAAM,MAAM,GACV,KAAK,CAAC,UAAU,KAAK,GAAG;QACtB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACvC,CAAC,CAAC,KAAK,CAAC,UAAU;YAClB,CAAC,CAAC,GAAG,CAAA;IAEX,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,IAAY,EACZ,UAA0D,EAAE;IAE5D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,CAAC,UAAU;QAAE,OAAM;IACvB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IACjD,KAAK,SAAS,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;KAC3C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAmC;IAEnC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAEtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEhC,IACE,wBAAwB,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,EACF,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE;QACxD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE;QACjD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,UAAU;QACzB,CAAC,CAAC,OAAO,CAAC,WAAW;QACrB,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEvD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;KAChC,CAAC,CAAA;AACJ,CAAC"}

package/dist/public-security-headers.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Baseline security headers for public HTML hosts (Next `withPrentaCMS` and
+ * Astro split-deploy). Matches Next `PRENTA_SECURITY_HEADERS` — no enforcing
+ * public CSP by default (site-owned).
+ */
+export interface PublicSecurityHeaderEntry {
+    key: string;
+    value: string;
+}
+/** Same baseline `withPrentaCMS()` applies to Next `/:path*`. */
+export declare const PUBLIC_SECURITY_HEADER_ENTRIES: readonly PublicSecurityHeaderEntry[];
+export interface ApplySecurityHeadersOptions {
+    /**
+     * Optional enforcing Content-Security-Policy for the public site.
+     * Omitted by default — marketing CSP remains site-owned.
+     * Pass `false` to skip even if a CSP header is somehow present in extras.
+     */
+    contentSecurityPolicy?: string | false;
+    /** Extra headers merged after the baseline (does not clobber existing). */
+    headers?: Record<string, string>;
+}
+/**
+ * Apply CMS baseline security headers to a Response without clobbering headers
+ * already set on the response.
+ */
+export declare function applySecurityHeaders(response: Response, options?: ApplySecurityHeadersOptions): Response;
+//# sourceMappingURL=public-security-headers.d.ts.map

package/dist/public-security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-security-headers.d.ts","sourceRoot":"","sources":["../src/public-security-headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,iEAAiE;AACjE,eAAO,MAAM,8BAA8B,EAAE,SAAS,yBAAyB,EAKrE,CAAA;AAEV,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACtC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,2BAAgC,GACxC,QAAQ,CAwBV"}

package/dist/public-security-headers.js

@@ -0,0 +1,40 @@
+/**
+ * Baseline security headers for public HTML hosts (Next `withPrentaCMS` and
+ * Astro split-deploy). Matches Next `PRENTA_SECURITY_HEADERS` — no enforcing
+ * public CSP by default (site-owned).
+ */
+/** Same baseline `withPrentaCMS()` applies to Next `/:path*`. */
+export const PUBLIC_SECURITY_HEADER_ENTRIES = [
+    { key: 'X-Content-Type-Options', value: 'nosniff' },
+    { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
+    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+    { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains' },
+];
+/**
+ * Apply CMS baseline security headers to a Response without clobbering headers
+ * already set on the response.
+ */
+export function applySecurityHeaders(response, options = {}) {
+    const headers = new Headers(response.headers);
+    for (const { key, value } of PUBLIC_SECURITY_HEADER_ENTRIES) {
+        if (!headers.has(key))
+            headers.set(key, value);
+    }
+    if (typeof options.contentSecurityPolicy === 'string' && options.contentSecurityPolicy) {
+        if (!headers.has('Content-Security-Policy')) {
+            headers.set('Content-Security-Policy', options.contentSecurityPolicy);
+        }
+    }
+    if (options.headers) {
+        for (const [key, value] of Object.entries(options.headers)) {
+            if (!headers.has(key))
+                headers.set(key, value);
+        }
+    }
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+//# sourceMappingURL=public-security-headers.js.map

package/dist/public-security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-security-headers.js","sourceRoot":"","sources":["../src/public-security-headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,iEAAiE;AACjE,MAAM,CAAC,MAAM,8BAA8B,GAAyC;IAClF,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;IACnD,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE;IAC/C,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACpE,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,qCAAqC,EAAE;CAC1E,CAAA;AAaV;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7C,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,8BAA8B,EAAE,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,qBAAqB,KAAK,QAAQ,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC"}

package/dist/publishing/publish-sync.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Publish sync status (#677) — distinguishes CMS DB "Published" from
+ * outbound publish-webhook delivery. Never reports "frontend live" from a
+ * webhook HTTP 200 alone (that would be a false ack without host confirmation).
+ */
+import type { PrentaDB } from '../db/client-types.js';
+export type PublishWebhookDeliveryState = 'not_configured' | 'no_delivery' | 'pending' | 'retrying' | 'delivered' | 'failed';
+export interface PublishSyncDelivery {
+    id: string;
+    endpointId: string;
+    endpointName: string | null;
+    endpointUrl: string;
+    event: string;
+    status: string;
+    attempts: number;
+    maxAttempts: number;
+    responseStatus: number | null;
+    lastAttemptAt: string | null;
+    nextRetryAt: string | null;
+    createdAt: string;
+}
+export interface PublishSyncStatus {
+    documentId: string;
+    /** CMS document status (DRAFT / PUBLISHED / …). */
+    cmsStatus: string;
+    publishedAt: string | null;
+    /** True when at least one active endpoint listens for `document.published`. */
+    publishWebhookConfigured: boolean;
+    /**
+     * Outbound webhook delivery state for this document's latest publish event.
+     * `delivered` means the webhook endpoint returned 2xx — not that the public
+     * host has finished a rebuild or purged cache.
+     */
+    webhookDelivery: {
+        state: PublishWebhookDeliveryState;
+        /** Editor-facing copy — never claims the public site is live. */
+        label: string;
+        deliveries: PublishSyncDelivery[];
+    };
+    /** Guidance when no rebuild webhook is configured (TTL / SSR lag). */
+    publicHostNote: string;
+}
+/** Whether any active endpoint subscribes to `document.published`. */
+export declare function isPublishWebhookConfigured(db?: PrentaDB): Promise<boolean>;
+/**
+ * Resolve CMS-published vs webhook-notify status for a document.
+ * Editors should treat `cmsStatus === 'PUBLISHED'` as DB truth only.
+ */
+export declare function getPublishSyncStatus(documentId: string, db?: PrentaDB): Promise<PublishSyncStatus | null>;
+//# sourceMappingURL=publish-sync.d.ts.map

package/dist/publishing/publish-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-sync.d.ts","sourceRoot":"","sources":["../../src/publishing/publish-sync.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAKrD,MAAM,MAAM,2BAA2B,GACnC,gBAAgB,GAChB,aAAa,GACb,SAAS,GACT,UAAU,GACV,WAAW,GACX,QAAQ,CAAA;AAEZ,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,+EAA+E;IAC/E,wBAAwB,EAAE,OAAO,CAAA;IACjC;;;;OAIG;IACH,eAAe,EAAE;QACf,KAAK,EAAE,2BAA2B,CAAA;QAClC,iEAAiE;QACjE,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAClC,CAAA;IACD,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAA;CACvB;AA6CD,sEAAsE;AACtE,wBAAsB,0BAA0B,CAAC,EAAE,GAAE,QAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAUzF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,EAAE,GAAE,QAAkB,GACrB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA2DnC"}

package/dist/publishing/publish-sync.js

@@ -0,0 +1,124 @@
+/**
+ * Publish sync status (#677) — distinguishes CMS DB "Published" from
+ * outbound publish-webhook delivery. Never reports "frontend live" from a
+ * webhook HTTP 200 alone (that would be a false ack without host confirmation).
+ */
+import { getDB } from '../db.js';
+const PUBLISH_EVENTS = ['document.published'];
+function labelFor(state) {
+    switch (state) {
+        case 'not_configured':
+            return 'Published in CMS only — no publish webhook configured.';
+        case 'no_delivery':
+            return 'Publish webhook configured, but no delivery recorded for this document yet.';
+        case 'pending':
+            return 'Publish webhook delivery pending.';
+        case 'retrying':
+            return 'Publish webhook delivery retrying after a failure.';
+        case 'delivered':
+            return 'Publish webhook delivered (host notified). This is not a guarantee the public page is already refreshed.';
+        case 'failed':
+            return 'Publish webhook failed — the public host may not have been notified. Retry from Settings → Webhooks.';
+        default: {
+            const _exhaustive = state;
+            return _exhaustive;
+        }
+    }
+}
+function publicHostNote(configured) {
+    if (configured) {
+        return 'A successful webhook only means your rebuild/purge endpoint was notified. Runtime SSR hosts may still serve cached HTML until TTL expires or the host finishes rebuild/purge.';
+    }
+    return 'No publish webhook is configured, so public pages stay cached until CDN/fetch TTLs expire (often ~60s, longer on cache-static sites). Add a webhook to your site’s purge endpoint (the Astro starter ships one at /api/prenta/purge) for instant freshness on publish.';
+}
+function mapStatus(status) {
+    switch (status) {
+        case 'success':
+            return 'delivered';
+        case 'failed':
+            return 'failed';
+        case 'retrying':
+            return 'retrying';
+        case 'pending':
+            return 'pending';
+        default:
+            return 'pending';
+    }
+}
+/** Whether any active endpoint subscribes to `document.published`. */
+export async function isPublishWebhookConfigured(db = getDB()) {
+    if (!db?.webhookEndpoint?.findMany)
+        return false;
+    const endpoints = await db.webhookEndpoint.findMany({
+        where: { active: true },
+        select: { events: true },
+    });
+    return endpoints.some((ep) => {
+        const events = Array.isArray(ep.events) ? ep.events : [];
+        return events.includes('document.published');
+    });
+}
+/**
+ * Resolve CMS-published vs webhook-notify status for a document.
+ * Editors should treat `cmsStatus === 'PUBLISHED'` as DB truth only.
+ */
+export async function getPublishSyncStatus(documentId, db = getDB()) {
+    if (!db?.document?.findUnique)
+        return null;
+    const doc = await db.document.findUnique({
+        where: { id: documentId },
+        select: { id: true, status: true, publishedAt: true, deletedAt: true },
+    });
+    if (!doc || doc.deletedAt)
+        return null;
+    const publishWebhookConfigured = await isPublishWebhookConfigured(db);
+    let deliveries = [];
+    if (db.webhookDeliveryLog?.findMany) {
+        const rows = await db.webhookDeliveryLog.findMany({
+            where: {
+                event: { in: PUBLISH_EVENTS },
+                payload: { path: ['data', 'id'], equals: documentId },
+            },
+            include: { endpoint: { select: { id: true, name: true, url: true } } },
+            orderBy: { createdAt: 'desc' },
+            take: 10,
+        });
+        deliveries = rows.map((r) => ({
+            id: r.id,
+            endpointId: r.endpointId,
+            endpointName: r.endpoint?.name ?? null,
+            endpointUrl: r.endpoint?.url ?? '',
+            event: r.event,
+            status: r.status,
+            attempts: r.attempts,
+            maxAttempts: r.maxAttempts,
+            responseStatus: r.responseStatus ?? null,
+            lastAttemptAt: r.lastAttemptAt ? r.lastAttemptAt.toISOString() : null,
+            nextRetryAt: r.nextRetryAt ? r.nextRetryAt.toISOString() : null,
+            createdAt: r.createdAt.toISOString(),
+        }));
+    }
+    let state;
+    if (!publishWebhookConfigured) {
+        state = 'not_configured';
+    }
+    else if (deliveries.length === 0) {
+        state = 'no_delivery';
+    }
+    else {
+        state = mapStatus(deliveries[0].status);
+    }
+    return {
+        documentId: doc.id,
+        cmsStatus: doc.status,
+        publishedAt: doc.publishedAt ? doc.publishedAt.toISOString() : null,
+        publishWebhookConfigured,
+        webhookDelivery: {
+            state,
+            label: labelFor(state),
+            deliveries,
+        },
+        publicHostNote: publicHostNote(publishWebhookConfigured),
+    };
+}
+//# sourceMappingURL=publish-sync.js.map

package/dist/publishing/publish-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-sync.js","sourceRoot":"","sources":["../../src/publishing/publish-sync.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAIhC,MAAM,cAAc,GAAmB,CAAC,oBAAoB,CAAC,CAAA;AA+C7D,SAAS,QAAQ,CAAC,KAAkC;IAClD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,gBAAgB;YACnB,OAAO,wDAAwD,CAAA;QACjE,KAAK,aAAa;YAChB,OAAO,6EAA6E,CAAA;QACtF,KAAK,SAAS;YACZ,OAAO,mCAAmC,CAAA;QAC5C,KAAK,UAAU;YACb,OAAO,oDAAoD,CAAA;QAC7D,KAAK,WAAW;YACd,OAAO,0GAA0G,CAAA;QACnH,KAAK,QAAQ;YACX,OAAO,sGAAsG,CAAA;QAC/G,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,KAAK,CAAA;YAChC,OAAO,WAAW,CAAA;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,UAAmB;IACzC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,+KAA+K,CAAA;IACxL,CAAC;IACD,OAAO,wQAAwQ,CAAA;AACjR,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,WAAW,CAAA;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAA;QACjB,KAAK,UAAU;YACb,OAAO,UAAU,CAAA;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAA;QAClB;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAe,KAAK,EAAE;IACrE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC;QAClD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACvB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACzB,CAAC,CAAA;IACF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,MAAmB,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,KAAe,KAAK,EAAE;IAEtB,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU;QAAE,OAAO,IAAI,CAAA;IAE1C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvC,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;QACzB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KACvE,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAEtC,MAAM,wBAAwB,GAAG,MAAM,0BAA0B,CAAC,EAAE,CAAC,CAAA;IACrE,IAAI,UAAU,GAA0B,EAAE,CAAA;IAE1C,IAAI,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YAChD,KAAK,EAAE;gBACL,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;gBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;aACtD;YACD,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YACtE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,EAAE;SACT,CAAC,CAAA;QACF,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI;YACtC,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;YACxC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YACrE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YAC/D,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC,CAAA;IACL,CAAC;IAED,IAAI,KAAkC,CAAA;IACtC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,KAAK,GAAG,gBAAgB,CAAA;IAC1B,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,KAAK,GAAG,aAAa,CAAA;IACvB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,EAAE;QAClB,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,wBAAwB;QACxB,eAAe,EAAE;YACf,KAAK;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YACtB,UAAU;SACX;QACD,cAAc,EAAE,cAAc,CAAC,wBAAwB,CAAC;KACzD,CAAA;AACH,CAAC"}