@prenta/core 0.118.0

package/dist/config/index.d.ts

@@ -0,0 +1,31 @@
+import type { PrentaCMSConfig, PluginDefinition } from './types.js';
+export type { PrentaCMSConfig } from './types.js';
+export * from './types.js';
+/**
+ * Apply each plugin's contributions to the config. For every entry in
+ * `config.plugins`, in order:
+ *   1. run `init(config)` — a plugin may transform any part of the config;
+ *   2. merge its `collections` — the existing config and earlier plugins win on
+ *      slug conflicts, so a plugin can never silently clobber a consumer's own
+ *      collection;
+ *   3. accumulate reusable `fields` presets and `adminNavItems`.
+ *
+ * Accumulated field presets and nav items are attached as `_pluginFields` /
+ * `_pluginNavItems` (the config schema is `.passthrough()`), so the admin and
+ * field resolvers can surface plugin contributions without every plugin having
+ * to be hand-wired into the consumer's config. Plugin `hooks` are harvested
+ * separately at handler setup (see handler-factory).
+ */
+export declare function applyPlugins(config: PrentaCMSConfig): PrentaCMSConfig;
+/** Define and validate an Prenta CMS configuration. */
+export declare function defineConfig(config: PrentaCMSConfig): PrentaCMSConfig;
+/**
+ * Define an Prenta plugin against the canonical `PluginDefinition` contract.
+ *
+ * Identity helper (like `defineConfig`) — no runtime behavior. It exists so
+ * plugin authors type-check against ONE shared definition instead of a
+ * hand-rolled local `PrentaPlugin` interface that silently drifts from core
+ * (dropping `version`/`init`, widening hook payloads to `unknown[]`, etc.).
+ */
+export declare function definePlugin(plugin: PluginDefinition): PluginDefinition;
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EAGf,gBAAgB,EACjB,MAAM,YAAY,CAAA;AAEnB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,cAAc,YAAY,CAAA;AAsG1B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA0CrE;AA+BD,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAEvE"}

package/dist/config/index.js

@@ -0,0 +1,196 @@
+import { z } from 'zod';
+export * from './types.js';
+const collectionSeoSchema = z
+    .object({
+    sitemapPriority: z.number().min(0).max(1).optional(),
+    sitemapChangeFreq: z
+        .enum(['always', 'hourly', 'daily', 'weekly', 'monthly', 'yearly', 'never'])
+        .optional(),
+    excludeFromSitemap: z.boolean().optional(),
+    archivePath: z.string().optional(),
+})
+    .optional();
+const collectionSchema = z
+    .object({
+    slug: z.string(),
+    labels: z.object({ singular: z.string(), plural: z.string() }),
+    urlPrefix: z.string().optional(),
+    type: z.enum(['page', 'post']).optional(),
+    seo: collectionSeoSchema,
+    fields: z.record(z.any()),
+    access: z.any().optional(),
+    hooks: z.any().optional(),
+    timestamps: z.boolean().optional(),
+    softDelete: z.boolean().optional(),
+    versions: z.union([z.boolean(), z.object({ maxPerDoc: z.number().optional() })]).optional(),
+    defaultSort: z.string().optional(),
+    admin: z
+        .object({
+        useAsTitle: z.string().optional(),
+        defaultColumns: z.array(z.string()).optional(),
+        group: z.string().optional(),
+        hidden: z.boolean().optional(),
+        description: z.string().optional(),
+        preview: z.any().optional(),
+        icon: z.string().optional(),
+    })
+        .optional(),
+})
+    .passthrough();
+const secretSchema = z.string().min(32, 'CMS secret must be at least 32 characters').optional();
+const layoutRegionSchema = z.object({
+    collection: z.string(),
+    label: z.string().optional(),
+});
+const layoutSchema = z
+    .object({
+    regions: z.record(layoutRegionSchema),
+    defaults: z.record(z.string()).optional(),
+    inherit: z.boolean().optional(),
+})
+    .optional();
+const configSchema = z.object({
+    secret: secretSchema,
+    platform: z.object({
+        database: z.any(),
+        storage: z.any(),
+        cache: z.any().optional(),
+        email: z.any().optional(),
+        scheduler: z.any().optional(),
+        rateLimit: z.any().optional(),
+    }),
+    auth: z.object({
+        providers: z.array(z.object({
+            id: z.string(),
+            type: z.enum(['google', 'github', 'microsoft', 'oidc', 'saml']),
+            clientId: z.string(),
+            clientSecret: z.string(),
+            tenantId: z.string().optional(),
+            issuer: z.string().optional(),
+        })),
+        credentials: z
+            .object({
+            enabled: z.boolean(),
+            requireEmailVerification: z.boolean().optional(),
+            passwordPolicy: z.any().optional(),
+        })
+            .optional(),
+        autoProvision: z.boolean().optional(),
+        sessionMaxAge: z.number().optional(),
+        mfa: z.object({ totp: z.boolean().optional() }).optional(),
+    }),
+    plugins: z.array(z.any()).optional(),
+    collections: z.record(collectionSchema),
+    globals: z.record(z.any()).optional(),
+    layout: layoutSchema,
+    i18n: z.any().optional(),
+    admin: z
+        .object({
+        path: z.string().startsWith('/').optional(),
+        branding: z.any().optional(),
+        ipAllowlist: z.array(z.string()).optional(),
+    })
+        .optional(),
+});
+/**
+ * Apply each plugin's contributions to the config. For every entry in
+ * `config.plugins`, in order:
+ *   1. run `init(config)` — a plugin may transform any part of the config;
+ *   2. merge its `collections` — the existing config and earlier plugins win on
+ *      slug conflicts, so a plugin can never silently clobber a consumer's own
+ *      collection;
+ *   3. accumulate reusable `fields` presets and `adminNavItems`.
+ *
+ * Accumulated field presets and nav items are attached as `_pluginFields` /
+ * `_pluginNavItems` (the config schema is `.passthrough()`), so the admin and
+ * field resolvers can surface plugin contributions without every plugin having
+ * to be hand-wired into the consumer's config. Plugin `hooks` are harvested
+ * separately at handler setup (see handler-factory).
+ */
+export function applyPlugins(config) {
+    const plugins = Array.isArray(config.plugins) ? [...config.plugins] : [];
+    if (plugins.length === 0)
+        return config;
+    let result = config;
+    const pluginFields = {};
+    const navItems = [];
+    for (const plugin of plugins) {
+        if (!plugin)
+            continue;
+        if (typeof plugin.init === 'function') {
+            result = plugin.init(result) ?? result;
+        }
+        if (plugin.collections) {
+            const merged = { ...result.collections };
+            for (const [slug, def] of Object.entries(plugin.collections)) {
+                // Existing config / earlier plugins win — never clobber a consumer collection.
+                if (!(slug in merged))
+                    merged[slug] = def;
+            }
+            result = { ...result, collections: merged };
+        }
+        if (plugin.fields) {
+            for (const [name, def] of Object.entries(plugin.fields)) {
+                if (!(name in pluginFields))
+                    pluginFields[name] = def;
+            }
+        }
+        if (Array.isArray(plugin.adminNavItems)) {
+            for (const item of plugin.adminNavItems) {
+                if (item && !navItems.some((n) => n.path === item.path))
+                    navItems.push(item);
+            }
+        }
+    }
+    return {
+        ...result,
+        ...(Object.keys(pluginFields).length > 0 ? { _pluginFields: pluginFields } : {}),
+        ...(navItems.length > 0 ? { _pluginNavItems: navItems } : {}),
+    };
+}
+/**
+ * Warn when two+ collections share the same `seo.archivePath` — that produces
+ * duplicate archive URLs in multiple child sitemaps (the careers/help-articles
+ * `/blog/` footgun).
+ */
+function warnOnDuplicateArchivePaths(config) {
+    const collections = config.collections;
+    if (!collections)
+        return;
+    const byPath = new Map();
+    for (const [slug, collection] of Object.entries(collections)) {
+        const archive = collection?.seo?.archivePath;
+        if (typeof archive !== 'string' || !archive.trim())
+            continue;
+        const key = archive.replace(/\/+$/, '') || '/';
+        const list = byPath.get(key) ?? [];
+        list.push(slug);
+        byPath.set(key, list);
+    }
+    for (const [path, slugs] of byPath) {
+        if (slugs.length < 2)
+            continue;
+        console.warn(`[prenta] Multiple collections share seo.archivePath "${path}": ${slugs.join(', ')}. ` +
+            'Each post-type collection should set a distinct archivePath (or omit it) ' +
+            'so sitemaps do not advertise the same listing URL repeatedly.');
+    }
+}
+/** Define and validate an Prenta CMS configuration. */
+export function defineConfig(config) {
+    const applied = applyPlugins(config);
+    configSchema.parse(applied);
+    warnOnDuplicateArchivePaths(applied);
+    return applied;
+}
+/**
+ * Define an Prenta plugin against the canonical `PluginDefinition` contract.
+ *
+ * Identity helper (like `defineConfig`) — no runtime behavior. It exists so
+ * plugin authors type-check against ONE shared definition instead of a
+ * hand-rolled local `PrentaPlugin` interface that silently drifts from core
+ * (dropping `version`/`init`, widening hook payloads to `unknown[]`, etc.).
+ */
+export function definePlugin(plugin) {
+    return plugin;
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,cAAc,YAAY,CAAA;AAE1B,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,iBAAiB,EAAE,CAAC;SACjB,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;SAC3E,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,QAAQ,EAAE,CAAA;AAEb,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,GAAG,EAAE,mBAAmB;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,EAAE,CAAA;AAEhB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,EAAE,CAAA;AAE/F,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,QAAQ,EAAE,CAAA;AAEb,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;QACjB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzB,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC7B,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,KAAK,CAChB,CAAC,CAAC,MAAM,CAAC;YACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;YACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC,CACH;QACD,WAAW,EAAE,CAAC;aACX,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC;aACD,QAAQ,EAAE;QACb,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC5C,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAEvC,IAAI,MAAM,GAAoB,MAAM,CAAA;IACpC,MAAM,YAAY,GAAoC,EAAE,CAAA;IACxD,MAAM,QAAQ,GAAyD,EAAE,CAAA;IAEzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAQ;QAErB,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAA;QACxC,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,MAAM,GAAyC,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;YAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,+EAA+E;gBAC/E,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;QAC7C,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA;YACvD,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACxC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,MAAuB;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;IACtC,IAAI,CAAC,WAAW;QAAE,OAAM;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,UAAU,EAAE,GAAG,EAAE,WAAW,CAAA;QAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAQ;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACf,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC9B,OAAO,CAAC,IAAI,CACV,wDAAwD,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACpF,2EAA2E;YAC3E,+DAA+D,CAClE,CAAA;IACH,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACpC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3B,2BAA2B,CAAC,OAAO,CAAC,CAAA;IACpC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/config/runtime.d.ts

@@ -0,0 +1,107 @@
+/**
+ * @file Runtime config storage.
+ *
+ * # The `globalThis.__prentaConfig` contract (audit issue M8)
+ *
+ * The Prenta handler factory stashes the resolved CMS config on
+ * `globalThis.__prentaConfig` so that every downstream module
+ * (actions, plugins, page-builder, auth) can read it without a
+ * dependency-injected handle. This is intentionally a single-process
+ * mutable global, with these constraints:
+ *
+ * 1. **One config per process.** A given Node / Edge isolate runs exactly
+ *    one Prenta CMS instance. Calling `handlePrentaAPI({ config })`
+ *    twice with different configs in the same process is unsupported and
+ *    will silently overwrite. (If you need multi-tenant per-request
+ *    configs, fork at the request layer — not via `globalThis`.)
+ *
+ * 2. **Set once at boot, read everywhere after.** Plugins and feature
+ *    code MUST treat the returned object as read-only. Mutating it after
+ *    boot will change behaviour for every subsequent request and is a
+ *    common source of "phantom" bugs.
+ *
+ * 3. **Serverless cold starts re-init.** On Vercel / Lambda each cold
+ *    start invokes `handlePrentaAPI()` again, which re-reads the
+ *    consumer's `prenta.config.ts` and re-stashes the global. There is
+ *    no cross-instance synchronisation — assume per-isolate isolation.
+ *
+ * 4. **Tests reset between suites.** Vitest gives each test file its own
+ *    Node worker with a fresh `globalThis`, but tests *within* a file
+ *    share state. If your test mutates the config global, restore it in
+ *    `afterEach`. The pattern is documented in
+ *    `page-builder/__tests__/blocks.test.ts`.
+ *
+ * # Why `globalThis` and not React Context / dependency injection?
+ *
+ *   - The code paths that need the config (Prisma actions, server-side
+ *     guards, plugin hooks) are not React-rendered and have no natural
+ *     prop-drilling path.
+ *   - Threading a config handle through every public API would be a
+ *     breaking change for every consumer.
+ *   - Global state is acceptable here because the config IS global per
+ *     process by definition (point 1).
+ *
+ * If we ever migrate off `globalThis` (e.g. to AsyncLocalStorage for
+ * multi-tenant), the consumer-facing `getPrentaConfig()` API stays the
+ * same — only this file changes. That's why every reader goes through
+ * the helper instead of touching `globalThis` directly.
+ */
+import type { PrentaCMSConfig } from './types.js';
+/**
+ * The runtime view of an Prenta CMS config. The handler factory enriches
+ * the user's `defineConfig({...})` object with internal caches (e.g.
+ * `_pluginHooks`) and consumers may register experimental top-level fields
+ * (e.g. `redirects`, custom plugin sub-configs) before the schema is ready.
+ *
+ * We keep the public shape strongly typed via `PrentaCMSConfig` and add a
+ * permissive index signature for the runtime extras. Callers that need a
+ * field defined on `PrentaCMSConfig` get full type safety; callers reaching
+ * into runtime-only fields are forced to acknowledge they are off-schema by
+ * narrowing themselves.
+ */
+export type RuntimePrentaConfig = PrentaCMSConfig & {
+    /** Internal cache of plugin lifecycle hooks. Populated by the handler. */
+    _pluginHooks?: unknown[];
+    /** Reusable field presets contributed by plugins. Populated by applyPlugins. */
+    _pluginFields?: Record<string, unknown>;
+    /** Admin nav items contributed by plugins. Populated by applyPlugins. */
+    _pluginNavItems?: Array<{
+        label: string;
+        icon: string;
+        path: string;
+    }>;
+    /** Forward-compat slot for runtime-registered extensions. */
+    [key: string]: unknown;
+};
+/**
+ * Read the per-process Prenta CMS config that `handlePrentaAPI()` stashed
+ * on `globalThis`. Returns `undefined` when no config has been registered
+ * yet (e.g. during early test setup or when the API handler has never been
+ * invoked).
+ *
+ * **Why a helper instead of reading `globalThis.__prentaConfig` directly?**
+ * - Centralizes the unsafe cast so we never sprinkle `as any` across the
+ *   codebase. If the storage strategy ever moves off `globalThis` (issue M8
+ *   from the engineering audit), only this file changes.
+ * - Gives every caller the same typed handle, which makes mocking in tests
+ *   straightforward (set the global once, all readers see it).
+ *
+ * **Mutability warning:** the returned object is the *same reference* the
+ * platform handler holds. Callers must not mutate it. For mutations (e.g.
+ * a plugin registering a new collection at init time), use the platform's
+ * own plugin lifecycle — not this getter.
+ */
+export declare function getPrentaConfig(): RuntimePrentaConfig | undefined;
+/**
+ * Register the running config on `globalThis`. Only the platform-level API
+ * handler should call this; plugins and feature code should read the config
+ * via `getPrentaConfig()` instead.
+ */
+export declare function setPrentaConfig(config: RuntimePrentaConfig | PrentaCMSConfig): void;
+/**
+ * Read the cms-core version that was stamped onto `globalThis` at handler
+ * init. Used by `/api/cms/health` and the `/updates/check` endpoint.
+ */
+export declare function getPrentaCoreVersion(): string | undefined;
+export declare function setPrentaCoreVersion(version: string): void;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/config/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/config/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG;IAClD,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;IACxB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvC,yEAAyE;IACzE,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtE,6DAA6D;IAC7D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,IAAI,mBAAmB,GAAG,SAAS,CAEjE;AAqCD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,eAAe,GAAG,IAAI,CAInF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAEzD;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1D"}

package/dist/config/runtime.js

@@ -0,0 +1,77 @@
+/**
+ * Read the per-process Prenta CMS config that `handlePrentaAPI()` stashed
+ * on `globalThis`. Returns `undefined` when no config has been registered
+ * yet (e.g. during early test setup or when the API handler has never been
+ * invoked).
+ *
+ * **Why a helper instead of reading `globalThis.__prentaConfig` directly?**
+ * - Centralizes the unsafe cast so we never sprinkle `as any` across the
+ *   codebase. If the storage strategy ever moves off `globalThis` (issue M8
+ *   from the engineering audit), only this file changes.
+ * - Gives every caller the same typed handle, which makes mocking in tests
+ *   straightforward (set the global once, all readers see it).
+ *
+ * **Mutability warning:** the returned object is the *same reference* the
+ * platform handler holds. Callers must not mutate it. For mutations (e.g.
+ * a plugin registering a new collection at init time), use the platform's
+ * own plugin lifecycle — not this getter.
+ */
+export function getPrentaConfig() {
+    return globalThis.__prentaConfig;
+}
+/**
+ * One-time, boot-time sanity check for collection configs.
+ *
+ * `cms-core` reads `collection.fields` as an **object map** keyed by field name
+ * (`getCollectionFields` → `applyFieldAccess` → `sanitizeDocumentData`). If a
+ * consumer declares `fields` as an **array** (a natural mistake, and the shape
+ * some docs/examples imply), `Object.entries()` yields numeric keys (`"0"`,
+ * `"1"`, …) that never match real data keys, so every custom field is silently
+ * stripped on write — the document saves but its body vanishes.
+ *
+ * That failure is invisible (no error, empty data), so we surface it loudly at
+ * registration. We only warn (never throw): a misconfigured field map must not
+ * take down the whole instance at boot.
+ */
+function warnOnArrayFields(config) {
+    try {
+        const collections = config
+            .collections;
+        if (!collections || typeof collections !== 'object')
+            return;
+        for (const [slug, def] of Object.entries(collections)) {
+            if (Array.isArray(def?.fields)) {
+                console.warn(`[prenta] Collection "${slug}" declares \`fields\` as an array. ` +
+                    'cms-core expects an object map keyed by field name ' +
+                    '(e.g. `fields: { title: { type: "text" } }`). ' +
+                    'Array fields are ignored, so custom field values will be dropped on write. ' +
+                    'Convert this collection to the object-map shape.');
+            }
+        }
+    }
+    catch {
+        /* Config validation must never break boot; a bad shape is the caller's bug. */
+    }
+}
+/**
+ * Register the running config on `globalThis`. Only the platform-level API
+ * handler should call this; plugins and feature code should read the config
+ * via `getPrentaConfig()` instead.
+ */
+export function setPrentaConfig(config) {
+    warnOnArrayFields(config);
+    globalThis.__prentaConfig =
+        config;
+}
+/**
+ * Read the cms-core version that was stamped onto `globalThis` at handler
+ * init. Used by `/api/cms/health` and the `/updates/check` endpoint.
+ */
+export function getPrentaCoreVersion() {
+    return globalThis.__prentaCoreVersion;
+}
+export function setPrentaCoreVersion(version) {
+    ;
+    globalThis.__prentaCoreVersion = version;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/config/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/config/runtime.ts"],"names":[],"mappings":"AAyEA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAQ,UAAuD,CAAC,cAAc,CAAA;AAChF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CAAC,MAA6C;IACtE,IAAI,CAAC;QACH,MAAM,WAAW,GAAI,MAAiE;aACnF,WAAW,CAAA;QACd,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAM;QAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,CACV,wBAAwB,IAAI,qCAAqC;oBAC/D,qDAAqD;oBACrD,gDAAgD;oBAChD,6EAA6E;oBAC7E,kDAAkD,CACrD,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA6C;IAC3E,iBAAiB,CAAC,MAAM,CAAC,CACxB;IAAC,UAAuD,CAAC,cAAc;QACtE,MAA6B,CAAA;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAQ,UAA+C,CAAC,mBAAmB,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,CAAC;IAAC,UAA+C,CAAC,mBAAmB,GAAG,OAAO,CAAA;AACjF,CAAC"}