@prenta/core 0.118.0

package/dist/upgrade/upgrade-pr.js

@@ -0,0 +1,128 @@
+const GITHUB_API = 'https://api.github.com';
+async function ghFetch(path, token, options = {}) {
+    return fetch(`${GITHUB_API}${path}`, {
+        ...options,
+        headers: {
+            Authorization: `token ${token}`,
+            Accept: 'application/vnd.github.v3+json',
+            'Content-Type': 'application/json',
+            ...options.headers,
+        },
+    });
+}
+const SAFE_NAME = /^[a-zA-Z0-9._-]+$/;
+const SAFE_VERSION = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
+/** Create a GitHub Pull Request that bumps Prenta CMS package versions. */
+export async function createUpgradePR(options) {
+    const { owner, repo, githubToken, targetVersion, changesDescription } = options;
+    if (!SAFE_NAME.test(owner))
+        throw new Error('Invalid repository owner');
+    if (!SAFE_NAME.test(repo))
+        throw new Error('Invalid repository name');
+    if (!SAFE_VERSION.test(targetVersion))
+        throw new Error('Invalid version format');
+    const baseBranch = options.baseBranch ?? 'main';
+    const branchName = `prenta/upgrade-${targetVersion}`;
+    // 1. Get the latest commit SHA on the base branch
+    const refRes = await ghFetch(`/repos/${owner}/${repo}/git/ref/heads/${baseBranch}`, githubToken);
+    if (!refRes.ok) {
+        throw new Error(`Failed to get base branch: ${refRes.status} ${await refRes.text()}`);
+    }
+    const refData = (await refRes.json());
+    const baseSha = refData.object.sha;
+    // 2. Get the current package.json from the base branch
+    const pkgRes = await ghFetch(`/repos/${owner}/${repo}/contents/package.json?ref=${baseBranch}`, githubToken);
+    if (!pkgRes.ok) {
+        throw new Error(`Failed to read package.json: ${pkgRes.status}`);
+    }
+    const pkgData = (await pkgRes.json());
+    const pkgContent = atob(pkgData.content.replace(/\n/g, ''));
+    const pkg = JSON.parse(pkgContent);
+    // 3. Bump @prenta/* dependencies to the target version
+    const prentaPackages = [
+        '@prenta/core',
+        '@prenta/admin',
+        '@prenta/plugin-seo',
+        '@prenta/plugin-forms',
+        '@prenta/plugin-media',
+        '@prenta/plugin-email',
+        '@prenta/plugin-blocks',
+        '@prenta/plugin-redirects',
+        '@prenta/plugin-navigation',
+        '@prenta/plugin-commerce',
+        '@prenta/plugin-ai',
+    ];
+    for (const dep of prentaPackages) {
+        if (pkg.dependencies?.[dep]) {
+            pkg.dependencies[dep] = `^${targetVersion}`;
+        }
+        if (pkg.devDependencies?.[dep]) {
+            pkg.devDependencies[dep] = `^${targetVersion}`;
+        }
+    }
+    const updatedPkg = JSON.stringify(pkg, null, 2) + '\n';
+    const encodedContent = btoa(updatedPkg);
+    // 4. Create a new branch from the base
+    const createBranchRes = await ghFetch(`/repos/${owner}/${repo}/git/refs`, githubToken, {
+        method: 'POST',
+        body: JSON.stringify({
+            ref: `refs/heads/${branchName}`,
+            sha: baseSha,
+        }),
+    });
+    if (!createBranchRes.ok) {
+        const errText = await createBranchRes.text();
+        if (!errText.includes('Reference already exists')) {
+            throw new Error(`Failed to create branch: ${createBranchRes.status} ${errText}`);
+        }
+    }
+    // 5. Update package.json on the new branch
+    const updateFileRes = await ghFetch(`/repos/${owner}/${repo}/contents/package.json`, githubToken, {
+        method: 'PUT',
+        body: JSON.stringify({
+            message: `chore: bump Prenta CMS to ${targetVersion}`,
+            content: encodedContent,
+            sha: pkgData.sha,
+            branch: branchName,
+        }),
+    });
+    if (!updateFileRes.ok) {
+        throw new Error(`Failed to update package.json: ${updateFileRes.status} ${await updateFileRes.text()}`);
+    }
+    // 6. Create the pull request
+    const title = `chore: upgrade Prenta CMS to ${targetVersion}`;
+    const body = [
+        `## Prenta CMS Upgrade to ${targetVersion}`,
+        '',
+        changesDescription,
+        '',
+        '### After merging',
+        '',
+        '```bash',
+        'npm install',
+        'npx prisma migrate deploy',
+        '```',
+        '',
+        '---',
+        '*This PR was automatically created by the Prenta CMS admin panel.*',
+    ].join('\n');
+    const prRes = await ghFetch(`/repos/${owner}/${repo}/pulls`, githubToken, {
+        method: 'POST',
+        body: JSON.stringify({
+            title,
+            body,
+            head: branchName,
+            base: baseBranch,
+        }),
+    });
+    if (!prRes.ok) {
+        throw new Error(`Failed to create PR: ${prRes.status} ${await prRes.text()}`);
+    }
+    const pr = (await prRes.json());
+    return {
+        prNumber: pr.number,
+        prUrl: pr.html_url,
+        branchName,
+    };
+}
+//# sourceMappingURL=upgrade-pr.js.map

package/dist/upgrade/upgrade-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-pr.js","sourceRoot":"","sources":["../../src/upgrade/upgrade-pr.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAE3C,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,UAAuB,EAAE;IAC3E,OAAO,KAAK,CAAC,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE;QACnC,GAAG,OAAO;QACV,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,KAAK,EAAE;YAC/B,MAAM,EAAE,gCAAgC;YACxC,cAAc,EAAE,kBAAkB;YAClC,GAAI,OAAO,CAAC,OAA8C;SAC3D;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,mBAAmB,CAAA;AACrC,MAAM,YAAY,GAAG,2BAA2B,CAAA;AAEhD,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB;IAC7D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAA;IAE/E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACvE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACrE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAEhF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAA;IAC/C,MAAM,UAAU,GAAG,kBAAkB,aAAa,EAAE,CAAA;IAEpD,kDAAkD;IAClD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,kBAAkB,UAAU,EAAE,EAAE,WAAW,CAAC,CAAA;IAChG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,MAAM,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAgC,CAAA;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAA;IAElC,uDAAuD;IACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,UAAU,KAAK,IAAI,IAAI,8BAA8B,UAAU,EAAE,EACjE,WAAW,CACZ,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAqC,CAAA;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAElC,uDAAuD;IACvD,MAAM,cAAc,GAAG;QACrB,cAAc;QACd,eAAe;QACf,oBAAoB;QACpB,sBAAsB;QACtB,sBAAsB;QACtB,sBAAsB;QACtB,uBAAuB;QACvB,0BAA0B;QAC1B,2BAA2B;QAC3B,yBAAyB;QACzB,mBAAmB;KACpB,CAAA;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,EAAE,CAAA;QAC7C,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;IAEvC,uCAAuC;IACvC,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,WAAW,EAAE,WAAW,EAAE;QACrF,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG,EAAE,cAAc,UAAU,EAAE;YAC/B,GAAG,EAAE,OAAO;SACb,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAA;QAC5C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,4BAA4B,eAAe,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,aAAa,GAAG,MAAM,OAAO,CACjC,UAAU,KAAK,IAAI,IAAI,wBAAwB,EAC/C,WAAW,EACX;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,6BAA6B,aAAa,EAAE;YACrD,OAAO,EAAE,cAAc;YACvB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,UAAU;SACnB,CAAC;KACH,CACF,CAAA;IAED,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,kCAAkC,aAAa,CAAC,MAAM,IAAI,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,CACvF,CAAA;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,KAAK,GAAG,gCAAgC,aAAa,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG;QACX,4BAA4B,aAAa,EAAE;QAC3C,EAAE;QACF,kBAAkB;QAClB,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,SAAS;QACT,aAAa;QACb,2BAA2B;QAC3B,KAAK;QACL,EAAE;QACF,KAAK;QACL,oEAAoE;KACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,IAAI;YACJ,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,UAAU;SACjB,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,MAAM,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAyC,CAAA;IAEvE,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,MAAM;QACnB,KAAK,EAAE,EAAE,CAAC,QAAQ;QAClB,UAAU;KACX,CAAA;AACH,CAAC"}

package/dist/upgrade/version-check.d.ts

@@ -0,0 +1,59 @@
+export type ChangeType = 'feature' | 'fix' | 'improvement' | 'breaking' | 'security' | 'deprecation';
+export interface ChangelogItem {
+    version: string;
+    date: string;
+    summary: string;
+    /** Real classification when sourced from the update server; absent for the
+     * npm-registry fallback (which can't categorize). */
+    type?: ChangeType;
+}
+export interface PluginCompatibilityInfo {
+    name: string;
+    compatible: boolean;
+    minVersion?: string;
+}
+export interface VersionInfo {
+    current: string;
+    latest: string;
+    updateAvailable: boolean;
+    severity?: 'patch' | 'minor' | 'major' | 'security';
+    releaseDate?: string;
+    changelog?: ChangelogItem[];
+    updateCommand?: string;
+    /** Human-readable breaking-change notes (update server only). */
+    breakingChanges?: string[];
+    /** True when the upgrade requires running database migrations. */
+    hasMigrations?: boolean;
+    /** Per-plugin compatibility hints (update server only). */
+    pluginCompatibility?: PluginCompatibilityInfo[];
+    /** Which backend produced this result — useful for diagnostics. */
+    source?: 'update-server' | 'npm';
+}
+/** Copy-paste command for admin Updates and the update server (0.x-safe). */
+export declare const PRENTA_UPGRADE_COMMAND = "npx prenta upgrade && npm install && npx prenta db:sync && npx prisma migrate deploy";
+/**
+ * Resolve the update status with the production-grade hybrid strategy:
+ * query the Prenta update server first (rich, real release notes derived from
+ * the published CHANGELOG), and transparently fall back to a direct npm
+ * registry check if the server is unreachable or misconfigured. The server URL
+ * is a fixed, trusted host (overridable via `PRENTA_UPDATE_SERVER_URL`) — never
+ * user-supplied — so this is not an SSRF surface.
+ */
+export declare function getUpdateStatus(currentVersion: string): Promise<VersionInfo>;
+/**
+ * Query the update server. Returns null on ANY failure (network, timeout,
+ * non-2xx, malformed body) so the caller falls back to the npm check.
+ */
+export declare function checkForUpdatesViaServer(currentVersion: string, serverUrl: string): Promise<VersionInfo | null>;
+/**
+ * Check the npm registry directly for the latest published version.
+ * No external update server needed — works everywhere.
+ */
+export declare function checkForUpdates(currentVersion: string): Promise<VersionInfo>;
+/** Parse a semver string into its components. */
+export declare function parseSemver(version: string): {
+    major: number;
+    minor: number;
+    patch: number;
+} | null;
+//# sourceMappingURL=version-check.d.ts.map

package/dist/upgrade/version-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.d.ts","sourceRoot":"","sources":["../../src/upgrade/version-check.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,KAAK,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CAAA;AAEpG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf;yDACqD;IACrD,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,aAAa,EAAE,CAAA;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,uBAAuB,EAAE,CAAA;IAC/C,mEAAmE;IACnE,MAAM,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;CACjC;AAID,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,yFACqD,CAAA;AAKxF;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAQlF;AAcD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAyC7B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA2ClF;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQxD"}

package/dist/upgrade/version-check.js

@@ -0,0 +1,142 @@
+const CORE_PACKAGE = '@prenta/core';
+/** Copy-paste command for admin Updates and the update server (0.x-safe). */
+export const PRENTA_UPGRADE_COMMAND = 'npx prenta upgrade && npm install && npx prenta db:sync && npx prisma migrate deploy';
+const NPM_REGISTRY = 'https://registry.npmjs.org';
+const DEFAULT_UPDATE_SERVER = 'https://updates.prentacms.com';
+const FETCH_TIMEOUT_MS = 10_000;
+/**
+ * Resolve the update status with the production-grade hybrid strategy:
+ * query the Prenta update server first (rich, real release notes derived from
+ * the published CHANGELOG), and transparently fall back to a direct npm
+ * registry check if the server is unreachable or misconfigured. The server URL
+ * is a fixed, trusted host (overridable via `PRENTA_UPDATE_SERVER_URL`) — never
+ * user-supplied — so this is not an SSRF surface.
+ */
+export async function getUpdateStatus(currentVersion) {
+    const serverUrl = (process.env.PRENTA_UPDATE_SERVER_URL ?? DEFAULT_UPDATE_SERVER).trim();
+    if (serverUrl) {
+        const viaServer = await checkForUpdatesViaServer(currentVersion, serverUrl);
+        if (viaServer)
+            return viaServer;
+    }
+    const viaNpm = await checkForUpdates(currentVersion);
+    return { ...viaNpm, source: 'npm' };
+}
+/**
+ * Query the update server. Returns null on ANY failure (network, timeout,
+ * non-2xx, malformed body) so the caller falls back to the npm check.
+ */
+export async function checkForUpdatesViaServer(currentVersion, serverUrl) {
+    // The server only accepts a bare `x.y.z`; strip any pre-release/build suffix.
+    const normalized = currentVersion.match(/^\d+\.\d+\.\d+/)?.[0];
+    if (!normalized)
+        return null;
+    try {
+        const url = new URL('/api/updates', serverUrl);
+        url.searchParams.set('currentVersion', normalized);
+        const res = await fetch(url.toString(), {
+            headers: { Accept: 'application/json' },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        if (!data.latestVersion)
+            return null;
+        if (data.upToDate || compareSemver(data.latestVersion, currentVersion) <= 0) {
+            return {
+                current: currentVersion,
+                latest: data.latestVersion,
+                updateAvailable: false,
+                source: 'update-server',
+            };
+        }
+        return {
+            current: currentVersion,
+            latest: data.latestVersion,
+            updateAvailable: true,
+            severity: data.severity ?? determineSeverity(currentVersion, data.latestVersion),
+            releaseDate: data.changelog?.[0]?.date || undefined,
+            changelog: data.changelog,
+            updateCommand: data.updateCommand ?? PRENTA_UPGRADE_COMMAND,
+            breakingChanges: data.breakingChanges,
+            hasMigrations: data.hasMigrations,
+            pluginCompatibility: data.pluginCompatibility,
+            source: 'update-server',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check the npm registry directly for the latest published version.
+ * No external update server needed — works everywhere.
+ */
+export async function checkForUpdates(currentVersion) {
+    const res = await fetch(`${NPM_REGISTRY}/${encodeURIComponent(CORE_PACKAGE)}`, {
+        headers: { Accept: 'application/json' },
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!res.ok) {
+        throw new Error(`Update check failed: ${res.status}`);
+    }
+    const data = (await res.json());
+    const latest = data['dist-tags'].latest;
+    const updateAvailable = compareSemver(latest, currentVersion) > 0;
+    let changelog;
+    if (updateAvailable) {
+        const newVersions = Object.keys(data.versions)
+            .filter((v) => /^\d+\.\d+\.\d+$/.test(v))
+            .filter((v) => compareSemver(v, currentVersion) > 0)
+            .sort((a, b) => compareSemver(b, a))
+            .slice(0, 20);
+        changelog = newVersions.map((v) => ({
+            version: v,
+            date: data.time[v]?.split('T')[0] ?? '',
+            summary: `Update to ${v}`,
+        }));
+    }
+    return {
+        current: currentVersion,
+        latest,
+        updateAvailable,
+        severity: updateAvailable ? determineSeverity(currentVersion, latest) : undefined,
+        releaseDate: data.time[latest]?.split('T')[0],
+        changelog,
+        updateCommand: updateAvailable ? PRENTA_UPGRADE_COMMAND : undefined,
+    };
+}
+/** Parse a semver string into its components. */
+export function parseSemver(version) {
+    const match = version.match(/^(\d+)\.(\d+)\.(\d+)/);
+    if (!match)
+        return null;
+    return {
+        major: parseInt(match[1], 10),
+        minor: parseInt(match[2], 10),
+        patch: parseInt(match[3], 10),
+    };
+}
+function compareSemver(a, b) {
+    const pa = a.split('.').map(Number);
+    const pb = b.split('.').map(Number);
+    for (let i = 0; i < 3; i++) {
+        const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+function determineSeverity(current, latest) {
+    const cur = parseSemver(current);
+    const lat = parseSemver(latest);
+    if (!cur || !lat)
+        return 'patch';
+    if (lat.major > cur.major)
+        return 'major';
+    if (lat.minor > cur.minor)
+        return 'minor';
+    return 'patch';
+}
+//# sourceMappingURL=version-check.js.map

package/dist/upgrade/version-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../src/upgrade/version-check.ts"],"names":[],"mappings":"AAmCA,MAAM,YAAY,GAAG,cAAc,CAAA;AAEnC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GACjC,sFAAsF,CAAA;AACxF,MAAM,YAAY,GAAG,4BAA4B,CAAA;AACjD,MAAM,qBAAqB,GAAG,+BAA+B,CAAA;AAC7D,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,cAAsB;IAC1D,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAA;IACxF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;QAC3E,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,CAAA;IACpD,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AACrC,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,cAAsB,EACtB,SAAiB;IAEjB,8EAA8E;IAC9E,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAE5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAA;QAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACtC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAA;QACvD,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAA;QAEpC,IAAI,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,OAAO;gBACL,OAAO,EAAE,cAAc;gBACvB,MAAM,EAAE,IAAI,CAAC,aAAa;gBAC1B,eAAe,EAAE,KAAK;gBACtB,MAAM,EAAE,eAAe;aACxB,CAAA;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B,eAAe,EAAE,IAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC;YAChF,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,sBAAsB;YAC3D,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,MAAM,EAAE,eAAe;SACxB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,cAAsB;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE;QAC7E,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAA;IACvC,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAA;IAEjE,IAAI,SAAmC,CAAA;IACvC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;aACnD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAEf,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACvC,OAAO,EAAE,aAAa,CAAC,EAAE;SAC1B,CAAC,CAAC,CAAA;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,MAAM;QACN,eAAe;QACf,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACjF,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7C,SAAS;QACT,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;KACpE,CAAA;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,WAAW,CACzB,OAAe;IAEf,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;QAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;QAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;KAC/B,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IAC7B,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAA;IAChC,IAAI,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK;QAAE,OAAO,OAAO,CAAA;IACzC,IAAI,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK;QAAE,OAAO,OAAO,CAAA;IACzC,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/validation/publish.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Server-side publish validation gate.
+ *
+ * The admin UI runs pre-publish checks, but the data layer is reachable by the
+ * SDK, MCP tools, agents, and the public API — all of which could otherwise
+ * publish broken content straight past those checks. This module is the single
+ * shared validator the action layer runs on every publish so the rules hold no
+ * matter who writes.
+ *
+ * Scope is deliberately narrow and universal: only publicly-routed content
+ * (collections typed `page` or `post`) is gated, and only on hard, content-
+ * agnostic invariants that make a *published* page genuinely broken (no title,
+ * no URL). Field-shape rules belong in the collection's own field definitions.
+ * Softer quality issues (missing description, etc.) are returned as warnings
+ * and never block.
+ */
+import type { PrentaCMSConfig, CollectionDefinition } from '../config/types.js';
+export type PublishValidationMode = 'block' | 'warn' | 'off';
+export interface PublishValidationResult {
+    errors: string[];
+    warnings: string[];
+}
+/**
+ * Resolve the configured gate mode. Defaults to `block` — a published page that
+ * fails a hard invariant is a defect, and the whole point of the gate is to
+ * stop it server-side. Operators can relax to `warn` (log only) or `off`.
+ */
+export declare function resolvePublishValidationMode(config: Pick<PrentaCMSConfig, 'seo'> | null | undefined): PublishValidationMode;
+/**
+ * Only publicly-routed content is gated. A collection qualifies when it is
+ * explicitly typed `page` or `post`; everything else (internal singletons,
+ * untyped/utility collections, forms with their own lifecycle) is skipped.
+ */
+export declare function isGatedContentCollection(collectionDef: CollectionDefinition | null | undefined): boolean;
+/**
+ * Validate a document that is about to be (or remain) published. `data` is the
+ * full, merged document data as it will be stored.
+ */
+export declare function validatePublishableDocument(params: {
+    data: Record<string, unknown>;
+}): PublishValidationResult;
+/**
+ * Run the gate for a publish and apply the configured mode. Throws a single
+ * combined error in `block` mode when there are hard errors; logs (non-test)
+ * in `warn` mode; no-ops in `off` mode. Returns the raw result so callers can
+ * surface warnings.
+ */
+export declare function enforcePublishValidation(params: {
+    collectionDef: CollectionDefinition | null | undefined;
+    data: Record<string, unknown>;
+    config: Pick<PrentaCMSConfig, 'seo'> | null | undefined;
+}): PublishValidationResult;
+//# sourceMappingURL=publish.d.ts.map

package/dist/validation/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/validation/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG/E,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAE5D,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,SAAS,GACtD,qBAAqB,CAGvB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GACrD,OAAO,CAGT;AASD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,GAAG,uBAAuB,CAiC1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAA;IACtD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,SAAS,CAAA;CACxD,GAAG,uBAAuB,CAc1B"}

package/dist/validation/publish.js

@@ -0,0 +1,75 @@
+import { validateSlug } from '../content/slug.js';
+/**
+ * Resolve the configured gate mode. Defaults to `block` — a published page that
+ * fails a hard invariant is a defect, and the whole point of the gate is to
+ * stop it server-side. Operators can relax to `warn` (log only) or `off`.
+ */
+export function resolvePublishValidationMode(config) {
+    const mode = config?.seo?.publishValidation;
+    return mode === 'warn' || mode === 'off' ? mode : 'block';
+}
+/**
+ * Only publicly-routed content is gated. A collection qualifies when it is
+ * explicitly typed `page` or `post`; everything else (internal singletons,
+ * untyped/utility collections, forms with their own lifecycle) is skipped.
+ */
+export function isGatedContentCollection(collectionDef) {
+    const type = collectionDef?.type;
+    return type === 'page' || type === 'post';
+}
+function firstNonEmptyString(...candidates) {
+    for (const c of candidates) {
+        if (typeof c === 'string' && c.trim().length > 0)
+            return c.trim();
+    }
+    return undefined;
+}
+/**
+ * Validate a document that is about to be (or remain) published. `data` is the
+ * full, merged document data as it will be stored.
+ */
+export function validatePublishableDocument(params) {
+    const errors = [];
+    const warnings = [];
+    const data = params.data ?? {};
+    const page = data.pageSettings ?? {};
+    const title = firstNonEmptyString(data.metaTitle, page.metaTitle, data.title, page.title);
+    if (!title) {
+        errors.push('A published page needs a title.');
+    }
+    const slug = firstNonEmptyString(data.slug);
+    const path = firstNonEmptyString(data.path);
+    if (!slug && !path) {
+        errors.push('A published page needs a slug or path so it has a public URL.');
+    }
+    const slugError = validateSlug(slug);
+    if (slugError) {
+        errors.push(slugError);
+    }
+    const description = firstNonEmptyString(data.metaDescription, page.metaDescription, data.excerpt, data.description);
+    if (!description) {
+        warnings.push('No meta description — search engines will generate a snippet for you.');
+    }
+    return { errors, warnings };
+}
+/**
+ * Run the gate for a publish and apply the configured mode. Throws a single
+ * combined error in `block` mode when there are hard errors; logs (non-test)
+ * in `warn` mode; no-ops in `off` mode. Returns the raw result so callers can
+ * surface warnings.
+ */
+export function enforcePublishValidation(params) {
+    const empty = { errors: [], warnings: [] };
+    const mode = resolvePublishValidationMode(params.config);
+    if (mode === 'off' || !isGatedContentCollection(params.collectionDef))
+        return empty;
+    const result = validatePublishableDocument({ data: params.data });
+    if (result.errors.length > 0 && mode === 'block') {
+        throw new Error(`Cannot publish — ${result.errors.join(' ')}`);
+    }
+    if (result.errors.length > 0 && mode === 'warn' && process.env.NODE_ENV !== 'test') {
+        console.warn('[prenta] publish validation (warn mode):', result.errors.join(' '));
+    }
+    return result;
+}
+//# sourceMappingURL=publish.js.map

package/dist/validation/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/validation/publish.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAuD;IAEvD,MAAM,IAAI,GAAI,MAAM,EAAE,GAAmD,EAAE,iBAAiB,CAAA;IAC5F,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAsD;IAEtD,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,CAAA;IAChC,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAA;AAC3C,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAG,UAAqB;IACnD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACnE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAE3C;IACC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAI,IAAI,CAAC,YAAoD,IAAI,EAAE,CAAA;IAE7E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CACrC,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,WAAW,CACjB,CAAA;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;IACxF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAIxC;IACC,MAAM,KAAK,GAA4B,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACnE,MAAM,IAAI,GAAG,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxD,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnF,MAAM,MAAM,GAAG,2BAA2B,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAEjE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/webhooks/index.d.ts

@@ -0,0 +1,99 @@
+export type WebhookEvent = 'document.created' | 'document.updated' | 'document.published' | 'document.unpublished' | 'document.deleted' | 'media.uploaded' | 'media.deleted' | 'user.created' | 'user.updated' | 'form.submitted';
+export interface WebhookEndpointInput {
+    url: string;
+    events: WebhookEvent[];
+    secret: string;
+    name?: string;
+    active?: boolean;
+}
+export interface WebhookPayload {
+    event: WebhookEvent;
+    timestamp: string;
+    data: Record<string, unknown>;
+}
+export { signPayload, verifySignature, signPrentaWebhook, verifyPrentaWebhook, PRENTA_WEBHOOK_TOLERANCE_SECONDS, } from './signing.js';
+export type { VerifyPrentaWebhookInput, VerifyPrentaWebhookResult, VerifyPrentaWebhookFailureCode, } from './signing.js';
+/** Grace window for previous signing secret after rotation. */
+export declare const WEBHOOK_SECRET_GRACE_MS: number;
+type RedactedEndpoint = {
+    id: string;
+    url: string;
+    events: unknown;
+    active: boolean;
+    name: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    previousSecretValidUntil: Date | null;
+    secret: null;
+    previousSecret: null;
+};
+/**
+ * Create a new webhook endpoint. Validates URL against SSRF rules.
+ * Returns the redacted endpoint plus `plaintextSecret` exactly once.
+ */
+export declare function createEndpoint(input: WebhookEndpointInput): Promise<{
+    endpoint: RedactedEndpoint;
+    plaintextSecret: string;
+}>;
+/** List all webhook endpoints (secrets redacted). */
+export declare function listEndpoints(): Promise<RedactedEndpoint[]>;
+/** Update a webhook endpoint. Validates URL against SSRF rules if URL is changed. */
+export declare function updateEndpoint(id: string, data: Partial<WebhookEndpointInput>): Promise<RedactedEndpoint>;
+/**
+ * Rotate signing secret with a grace window so consumers can verify with
+ * either secret until `previousSecretValidUntil`.
+ */
+export declare function rotateEndpointSecret(id: string, graceMs?: number): Promise<{
+    endpoint: RedactedEndpoint;
+    plaintextSecret: string;
+}>;
+/** Decrypt current (+ in-grace previous) secrets for signing/verification helpers. */
+export declare function resolveEndpointSigningSecrets(endpoint: {
+    secret: string;
+    previousSecret?: string | null;
+    previousSecretValidUntil?: Date | null;
+}): Promise<string[]>;
+/** Delete a webhook endpoint and all its delivery logs. */
+export declare function deleteEndpoint(id: string): Promise<import("../db/model-types.js").WebhookEndpoint>;
+/** Get recent deliveries for an endpoint. */
+export declare function getDeliveries(endpointId: string, limit?: number): Promise<import("../db/model-types.js").WebhookDeliveryLog[]>;
+export interface ListDeliveriesFilter {
+    status?: string | string[];
+    event?: string;
+    page?: number;
+    pageSize?: number;
+}
+/** List webhook deliveries across endpoints (admin inbox / retry UI). */
+export declare function listDeliveries(filter?: ListDeliveriesFilter): Promise<{
+    docs: import("../db/model-types.js").WebhookDeliveryLog[];
+    total: number;
+    page: number;
+    pageSize: number;
+}>;
+/**
+ * Retry a single delivery immediately (admin). Decrypts the endpoint secret
+ * and reuses the stored payload.
+ */
+export declare function retryDelivery(deliveryId: string): Promise<{
+    status: string;
+    error?: string;
+}>;
+/**
+ * Dispatch a webhook event: finds matching endpoints, creates delivery records,
+ * and attempts immediate delivery. Failed deliveries are queued for retry.
+ */
+export declare function dispatch(event: WebhookEvent, data: Record<string, unknown>): Promise<{
+    queued: number;
+    delivered: number;
+    failed: number;
+}>;
+/**
+ * Process pending retries. Call this from a cron job (e.g. every 1-2 minutes).
+ * Finds deliveries with status='retrying' and nextRetryAt <= now.
+ */
+export declare function processRetries(): Promise<{
+    retried: number;
+    succeeded: number;
+    failed: number;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,cAAc,GACd,gBAAgB,CAAA;AAEpB,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,YAAY,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,gCAAgC,GACjC,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,cAAc,CAAA;AAIrB,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,QAAsB,CAAA;AAE1D,KAAK,gBAAgB,GAAG;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,wBAAwB,EAAE,IAAI,GAAG,IAAI,CAAA;IACrC,MAAM,EAAE,IAAI,CAAA;IACZ,cAAc,EAAE,IAAI,CAAA;CACrB,CAAA;AAgCD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBlE;AAED,qDAAqD;AACrD,wBAAsB,aAAa,gCAIlC;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,6BAwBnF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,MAAgC,GACxC,OAAO,CAAC;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAelE;AAED,sFAAsF;AACtF,wBAAsB,6BAA6B,CAAC,QAAQ,EAAE;IAC5D,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,wBAAwB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CACvC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAcpB;AAED,2DAA2D;AAC3D,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,2DAG9C;AAED,6CAA6C;AAC7C,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAK,gEAOjE;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,yEAAyE;AACzE,wBAAsB,cAAc,CAAC,MAAM,GAAE,oBAAyB;;;;;GA6BrE;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoC7C;AAMD;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA0DhE;AAiHD;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,CAAC,CA4CD"}