@realiizlabs/admin 0.11.2 → 0.13.0

package/dist/studio/index.cjs

@@ -0,0 +1,1150 @@
+'use strict';
+
+require('server-only');
+var navigation = require('next/navigation');
+var ssr = require('@supabase/ssr');
+var matter = require('gray-matter');
+var unified = require('unified');
+var remarkParse = require('remark-parse');
+var remarkGfm = require('remark-gfm');
+var remarkRehype = require('remark-rehype');
+var rehypeRaw = require('rehype-raw');
+var rehypeSlug = require('rehype-slug');
+var rehypeStringify = require('rehype-stringify');
+var supabaseJs = require('@supabase/supabase-js');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var matter__default = /*#__PURE__*/_interopDefault(matter);
+var remarkParse__default = /*#__PURE__*/_interopDefault(remarkParse);
+var remarkGfm__default = /*#__PURE__*/_interopDefault(remarkGfm);
+var remarkRehype__default = /*#__PURE__*/_interopDefault(remarkRehype);
+var rehypeRaw__default = /*#__PURE__*/_interopDefault(rehypeRaw);
+var rehypeSlug__default = /*#__PURE__*/_interopDefault(rehypeSlug);
+var rehypeStringify__default = /*#__PURE__*/_interopDefault(rehypeStringify);
+
+// src/studio/index.ts
+function createIdentityClient(ctx) {
+  const store = ctx.cookies;
+  return ssr.createServerClient(ctx.url, ctx.anonKey, {
+    cookies: {
+      getAll: () => store.getAll(),
+      setAll: (list) => {
+        try {
+          if (typeof store.setAll === "function") {
+            void store.setAll(list);
+          } else if (typeof store.set === "function") {
+            for (const c of list) store.set(c.name, c.value, c.options);
+          }
+        } catch {
+        }
+      }
+    }
+  });
+}
+
+// src/auth/errors.ts
+var IdentityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IdentityError";
+  }
+};
+var UnauthenticatedError = class extends IdentityError {
+  constructor() {
+    super("Not signed in");
+    this.name = "UnauthenticatedError";
+  }
+};
+var ForbiddenError = class extends IdentityError {
+  constructor(siteId, required, actual) {
+    super(`Requires ${required} on site "${siteId}" (you are ${actual ?? "not a member"})`);
+    this.name = "ForbiddenError";
+    this.siteId = siteId;
+    this.required = required;
+    this.actual = actual;
+  }
+};
+
+// src/auth/session.ts
+async function getCurrentUser(client) {
+  const { data, error } = await client.auth.getUser();
+  if (error || !data.user) return null;
+  return { id: data.user.id, email: data.user.email ?? null };
+}
+
+// src/auth/types.ts
+var ROLE_RANK = { editor: 1, owner: 2, staff: 3 };
+
+// src/auth/roles.ts
+async function getSiteRole(client, siteId, userId) {
+  const uid = userId ?? (await getCurrentUser(client))?.id;
+  if (!uid) return null;
+  const [staff, member] = await Promise.all([
+    client.from("staff").select("user_id").eq("user_id", uid).maybeSingle(),
+    client.from("site_users").select("role").eq("user_id", uid).eq("site_id", siteId).maybeSingle()
+  ]);
+  if (staff.error) throw staff.error;
+  if (member.error) throw member.error;
+  if (staff.data) return "staff";
+  const role = member.data?.role;
+  return role === "owner" || role === "editor" ? role : null;
+}
+function roleAtLeast(actual, minimum) {
+  return actual !== null && ROLE_RANK[actual] >= ROLE_RANK[minimum];
+}
+async function requireSiteUser(client, siteId, opts = {}) {
+  const user = await getCurrentUser(client);
+  if (!user) throw new UnauthenticatedError();
+  const minimum = opts.minimumRole ?? "editor";
+  const role = await getSiteRole(client, siteId, user.id);
+  if (!roleAtLeast(role, minimum)) throw new ForbiddenError(siteId, minimum, role);
+  return { user, role };
+}
+
+// src/studio/context.ts
+function makeContext(config) {
+  const identityClient = async () => {
+    const store = await config.cookies();
+    return createIdentityClient({ ...config.env().identity, cookies: store });
+  };
+  const requireAdmin = async (opts = {}) => {
+    try {
+      return await requireSiteUser(await identityClient(), config.env().siteId, opts);
+    } catch (err) {
+      if (err instanceof UnauthenticatedError) navigation.redirect("/admin/sign-in");
+      if (err instanceof ForbiddenError) throw err;
+      throw err;
+    }
+  };
+  return { identityClient, requireAdmin };
+}
+
+// src/studio/registry.ts
+function makeRegistry(config) {
+  const entries = Object.values(config.contentTypes);
+  const entry = (typeId) => config.contentTypes[typeId] ?? null;
+  const slugOf = (e, fileName) => {
+    if (e.slugFromFilename) return e.slugFromFilename(fileName);
+    return fileName.endsWith(".mdx") ? fileName.slice(0, -4) : null;
+  };
+  const locate = (path) => {
+    for (const e of entries) {
+      if (!path.startsWith(`${e.folder}/`)) continue;
+      const slug = slugOf(e, path.slice(e.folder.length + 1));
+      if (slug) return { typeId: e.id, slug, entry: e };
+    }
+    return null;
+  };
+  const publicUrlFor = (typeId, slug) => config.publicUrls?.[typeId]?.(slug) ?? null;
+  const publicDirFor = (typeId) => {
+    const e = entry(typeId);
+    return `/${e?.folder.split("/").filter(Boolean).pop() ?? "images"}/`;
+  };
+  return { entries, entry, slugOf, locate, publicUrlFor, publicDirFor };
+}
+
+// src/git/errors.ts
+var GitHubError = class extends Error {
+  constructor(message, opts) {
+    super(message);
+    this.name = "GitHubError";
+    this.status = opts.status;
+    this.path = opts.path;
+    this.body = opts.body;
+  }
+};
+var StaleBaseError = class extends GitHubError {
+  constructor(pullNumber, opts) {
+    super(`Pull request #${pullNumber} conflicts with the base branch`, opts);
+    this.name = "StaleBaseError";
+    this.pullNumber = pullNumber;
+  }
+};
+var _TokenScopeError = class _TokenScopeError extends GitHubError {
+  constructor(opts) {
+    super(
+      `GitHub refused ${opts.path} (${opts.status}). The repo token needs these fine-grained permissions: ${_TokenScopeError.REQUIRED_PERMISSIONS}`,
+      opts
+    );
+    this.name = "TokenScopeError";
+  }
+};
+_TokenScopeError.REQUIRED_PERMISSIONS = "Contents: Read and write, Pull requests: Read and write, Commit statuses: Read-only";
+var TokenScopeError = _TokenScopeError;
+var ChecksFailedError = class extends Error {
+  constructor(pullNumber, failingCheck) {
+    super(
+      `Pull request #${pullNumber} has failing checks${failingCheck ? ` (${failingCheck})` : ""}`
+    );
+    this.name = "ChecksFailedError";
+    this.pullNumber = pullNumber;
+    this.failingCheck = failingCheck;
+  }
+};
+
+// src/git/client.ts
+var API = "https://api.github.com";
+var GITHUB_TIMEOUT_MS = 1e4;
+async function ghFetch(ctx, method, path, body) {
+  const res = await fetch(API + path, {
+    method,
+    signal: AbortSignal.timeout(GITHUB_TIMEOUT_MS),
+    headers: {
+      Authorization: `Bearer ${ctx.token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "realiizlabs-admin",
+      ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    body: body !== void 0 ? JSON.stringify(body) : void 0
+  });
+  const text = await res.text();
+  let json = null;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+      json = { raw: text };
+    }
+  }
+  return { ok: res.ok, status: res.status, json };
+}
+async function ghFetchOrThrow(ctx, method, path, body) {
+  const res = await ghFetch(ctx, method, path, body);
+  if (!res.ok) throw toError(res, path);
+  return res.json;
+}
+function toError(res, path) {
+  const opts = { status: res.status, path, body: res.json };
+  if (res.status === 403) return new TokenScopeError(opts);
+  const message = res.json?.message ?? `GitHub ${res.status} on ${path}`;
+  return new GitHubError(message, opts);
+}
+function repoPath(ctx) {
+  return `/repos/${encodeURIComponent(ctx.owner)}/${encodeURIComponent(ctx.repo)}`;
+}
+function baseBranch(ctx) {
+  return ctx.baseBranch ?? "main";
+}
+
+// src/git/pulls.ts
+async function openPullRequest(ctx, branch, opts) {
+  const pr = await ghFetchOrThrow(ctx, "POST", `${repoPath(ctx)}/pulls`, {
+    title: opts.title,
+    head: branch,
+    base: baseBranch(ctx),
+    body: opts.body ?? ""
+  });
+  return { number: pr.number, html_url: pr.html_url, headSha: pr.head.sha, branch };
+}
+async function getPullRequest(ctx, number) {
+  return ghFetchOrThrow(ctx, "GET", `${repoPath(ctx)}/pulls/${number}`);
+}
+async function listOpenPullRequests(ctx, opts) {
+  const prs = await ghFetchOrThrow(ctx, "GET", `${repoPath(ctx)}/pulls?state=open&per_page=100`);
+  return prs.filter((p) => p.head.ref.startsWith(opts.headPrefix)).map((p) => ({ number: p.number, title: p.title, html_url: p.html_url, headSha: p.head.sha, branch: p.head.ref }));
+}
+async function closePullRequest(ctx, number) {
+  await ghFetchOrThrow(ctx, "PATCH", `${repoPath(ctx)}/pulls/${number}`, { state: "closed" });
+}
+
+// src/git/status.ts
+async function getPullRequestStatus(ctx, number, log = console) {
+  const pr = await getPullRequest(ctx, number);
+  if (pr.mergeable === null || pr.mergeable_state === "unknown") {
+    return { state: "pending" };
+  }
+  const combined = await ghFetchOrThrow(
+    ctx,
+    "GET",
+    `${repoPath(ctx)}/commits/${pr.head.sha}/status`
+  );
+  const failing = combined.statuses.find((s) => s.state === "failure" || s.state === "error");
+  if (pr.mergeable_state === "dirty") {
+    return { state: "red", failingCheck: failing?.context ?? "merge conflict" };
+  }
+  if (failing || pr.mergeable_state === "unstable") {
+    return { state: "red", failingCheck: failing?.context ?? null };
+  }
+  if (combined.total_count === 0) {
+    if (pr.mergeable_state === "clean" || pr.mergeable_state === "behind") {
+      const warning = `[admin/git] ${ctx.owner}/${ctx.repo} has no CI statuses on PR #${number} \u2014 treating as green. A client site with no CI is a setup bug.`;
+      log.warn(warning);
+      return { state: "green", warning };
+    }
+    return { state: "pending" };
+  }
+  if (combined.state === "success" && pr.mergeable_state !== "blocked") {
+    const previewUrl = await previewUrlFor(ctx, pr.head.sha, combined);
+    return previewUrl ? { state: "green", previewUrl } : { state: "green" };
+  }
+  return { state: "pending" };
+}
+var DASHBOARD_HOST = /^https:\/\/(www\.)?(vercel\.com|app\.netlify\.com)\//i;
+async function previewUrlFor(ctx, sha, combined) {
+  const deployments = await ghFetch(ctx, "GET", `${repoPath(ctx)}/deployments?sha=${sha}&per_page=10`);
+  if (deployments.ok && Array.isArray(deployments.json)) {
+    for (const d of deployments.json.filter((d2) => !/^prod/i.test(d2.environment))) {
+      const statuses = await ghFetch(ctx, "GET", `${repoPath(ctx)}/deployments/${d.id}/statuses?per_page=10`);
+      if (!statuses.ok || !Array.isArray(statuses.json)) continue;
+      const live = statuses.json.find((s) => s.state === "success" && s.environment_url && !DASHBOARD_HOST.test(s.environment_url));
+      if (live?.environment_url) return live.environment_url;
+    }
+  }
+  const status = combined.statuses.find(
+    (s) => s.state === "success" && /vercel|netlify|deploy|preview/i.test(s.context) && s.target_url && !DASHBOARD_HOST.test(s.target_url)
+  );
+  return status?.target_url ?? null;
+}
+
+// src/studio/pending.ts
+var BRANCH_RE = /^admin\/([a-z0-9-]+)\/(.+)-\d{8}T\d{3,6}$/;
+function makePending(config, registry) {
+  const repo = () => config.env().repo;
+  const listPendingChanges = async () => {
+    const ctx = repo();
+    const prs = await listOpenPullRequests(ctx, { headPrefix: "admin/" });
+    const out = /* @__PURE__ */ new Map();
+    const resolved = await Promise.all(
+      prs.map(async (pr) => {
+        const m = BRANCH_RE.exec(pr.branch);
+        if (!m) return null;
+        const entry = registry.entry(m[1]);
+        if (!entry) return null;
+        const path = `${entry.folder}/${m[2]}.mdx`;
+        const status = await getPullRequestStatus(ctx, pr.number);
+        const state = status.state === "green" ? "ready" : status.state === "red" ? "failed" : "checking";
+        return {
+          number: pr.number,
+          branch: pr.branch,
+          title: pr.title.replace(/^(Publish|Remove):\s*/, ""),
+          removal: pr.title.startsWith("Remove: "),
+          html_url: pr.html_url,
+          path,
+          typeId: entry.id,
+          state,
+          failingCheck: status.state === "red" ? status.failingCheck : null
+        };
+      })
+    );
+    for (const p of resolved) {
+      if (!p) continue;
+      const prev = out.get(p.path);
+      if (!prev || p.number > prev.number) out.set(p.path, p);
+    }
+    return out;
+  };
+  const pendingFor = async (path) => (await listPendingChanges()).get(path) ?? null;
+  return { listPendingChanges, pendingFor };
+}
+var pendingLabel = {
+  checking: "Checking\u2026",
+  ready: "Ready to publish",
+  failed: "Needs fixing"
+};
+function pendingText(p) {
+  if (p.removal) return p.state === "ready" ? "Removal ready" : p.state === "failed" ? "Removal needs fixing" : "Removing\u2026";
+  return pendingLabel[p.state];
+}
+
+// src/git/reads.ts
+var NotFoundError = class extends GitHubError {
+  constructor(path) {
+    super(`Not found in repo: ${path}`, { status: 404, path, body: null });
+    this.name = "NotFoundError";
+  }
+};
+function contentsPath(ctx, path, ref) {
+  const clean = path.replace(/^\/+|\/+$/g, "");
+  const encoded = clean.split("/").map(encodeURIComponent).join("/");
+  return `${repoPath(ctx)}/contents/${encoded}?ref=${encodeURIComponent(ref ?? baseBranch(ctx))}`;
+}
+async function listDirectory(ctx, path, opts = {}) {
+  const url = contentsPath(ctx, path, opts.ref);
+  const res = await ghFetch(ctx, "GET", url);
+  if (res.status === 404) return [];
+  if (!res.ok) throw toError(res, url);
+  const list = Array.isArray(res.json) ? res.json : [];
+  return list.filter((e) => e.type === "file").map((e) => ({ name: e.name, path: e.path, sha: e.sha, size: e.size, type: "file" })).sort((a, b) => a.name.localeCompare(b.name));
+}
+async function readFile(ctx, path, opts = {}) {
+  const url = contentsPath(ctx, path, opts.ref);
+  const res = await ghFetch(ctx, "GET", url);
+  if (res.status === 404) throw new NotFoundError(path);
+  if (!res.ok) throw toError(res, url);
+  const entry = res.json;
+  if (Array.isArray(entry) || entry.type !== "file") throw new GitHubError(`${path} is not a file`, { status: res.status, path: url, body: entry });
+  if (typeof entry.content !== "string") {
+    throw new GitHubError(`${path} is too large to read through the Contents API`, { status: res.status, path: url, body: null });
+  }
+  const content = decodeBase64Utf8(entry.content);
+  return { path: entry.path, sha: entry.sha, content };
+}
+function decodeBase64Utf8(b64) {
+  const clean = b64.replace(/\s+/g, "");
+  const bin = atob(clean);
+  const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+  return new TextDecoder("utf-8").decode(bytes);
+}
+
+// src/studio/readers.ts
+var NotHere = class extends Error {
+  constructor(slug) {
+    super(`No item with the web address "${slug}".`);
+    this.name = "NotHere";
+  }
+};
+var LIST_CAP = 50;
+var isItem = (name) => name.endsWith(".mdx") && !name.startsWith("_");
+function dateOf(data) {
+  const raw = data.publishedAt ?? data.date;
+  if (!raw) return null;
+  const d = new Date(raw);
+  return Number.isNaN(d.getTime()) ? null : d.toISOString();
+}
+function makeReaders(config, registry, pending) {
+  const repo = () => config.env().repo;
+  const need = (typeId) => {
+    const e = registry.entry(typeId);
+    if (!e) throw new Error(`Unknown content type "${typeId}"`);
+    return e;
+  };
+  const pathOf = async (typeId, slug) => {
+    const e = need(typeId);
+    if (!e.slugFromFilename) return `${e.folder}/${slug}.mdx`;
+    const entries = await listDirectory(repo(), e.folder);
+    return entries.find((x) => registry.slugOf(e, x.name) === slug)?.path ?? null;
+  };
+  const listItems = async (typeId) => {
+    const e = need(typeId);
+    const ctx = repo();
+    const [entries, open] = await Promise.all([
+      listDirectory(ctx, e.folder).then((all) => all.filter((x) => isItem(x.name))),
+      pending.listPendingChanges()
+    ]);
+    const describe = async (path, ref, extra) => {
+      const fileName = path.slice(e.folder.length + 1);
+      const slug = registry.slugOf(e, fileName) ?? fileName.replace(/\.mdx$/, "");
+      try {
+        const file = await readFile(ctx, path, ref ? { ref } : {});
+        const { data } = matter__default.default(file.content);
+        return {
+          slug,
+          path,
+          title: typeof data.title === "string" && data.title ? data.title : slug,
+          date: dateOf(data),
+          needsAttention: !e.schema.safeParse(data).success,
+          ...extra
+        };
+      } catch {
+        return { slug, path, title: slug, date: null, needsAttention: true, ...extra };
+      }
+    };
+    const live = await Promise.all(entries.slice(0, LIST_CAP).map((x) => describe(x.path, void 0, { pending: open.get(x.path) ?? null, isNew: false })));
+    const livePaths = new Set(entries.map((x) => x.path));
+    const onlyPending = await Promise.all(
+      [...open.values()].filter((p) => p.typeId === e.id && !livePaths.has(p.path)).map((p) => describe(p.path, p.branch, { pending: p, isNew: true }))
+    );
+    return [...onlyPending, ...live].sort((a, b) => a.isNew !== b.isNew ? a.isNew ? -1 : 1 : (b.date ?? "").localeCompare(a.date ?? ""));
+  };
+  const countItems = async (typeId) => {
+    const entries = await listDirectory(repo(), need(typeId).folder);
+    return entries.filter((x) => isItem(x.name)).length;
+  };
+  const readItem = async (typeId, slug, opts = {}) => {
+    const path = await pathOf(typeId, slug);
+    if (!path) throw new NotHere(slug);
+    const file = await readFile(repo(), path, opts.ref ? { ref: opts.ref } : {});
+    const { data, content } = matter__default.default(file.content);
+    return { frontmatter: data, body: content.trim(), sha: file.sha, path };
+  };
+  const lastAuthor = async (typeId) => {
+    for (const p of await listItems(typeId)) {
+      if (p.isNew) continue;
+      try {
+        const { frontmatter } = await readItem(typeId, p.slug);
+        if (typeof frontmatter.author === "string" && frontmatter.author) return frontmatter.author;
+      } catch {
+      }
+    }
+    return null;
+  };
+  const getPullRequest2 = async (number) => {
+    try {
+      const pr = await getPullRequest(repo(), number);
+      const body = pr.body ?? "";
+      return {
+        number: pr.number,
+        title: pr.title,
+        html_url: pr.html_url,
+        merged: pr.merged,
+        state: pr.state,
+        postPath: body.match(/File: `([^`]+)`/)?.[1] ?? null,
+        branch: pr.head.ref,
+        removal: /^Action: remove$/m.test(body) || pr.title.startsWith("Remove: "),
+        mergeCommitSha: pr.merged ? pr.merge_commit_sha ?? null : null
+      };
+    } catch (err) {
+      if (err instanceof GitHubError && err.status === 404) return null;
+      throw err;
+    }
+  };
+  const prStatus = (number) => getPullRequestStatus(repo(), number);
+  return { pathOf, listItems, countItems, readItem, lastAuthor, getPullRequest: getPullRequest2, prStatus };
+}
+
+// src/git/branch.ts
+async function getBranchSha(ctx, branch) {
+  const ref = await ghFetchOrThrow(
+    ctx,
+    "GET",
+    `${repoPath(ctx)}/git/ref/heads/${encodeURIComponent(branch)}`
+  );
+  return ref.object.sha;
+}
+async function createBranch(ctx, branch) {
+  const baseSha = await getBranchSha(ctx, baseBranch(ctx));
+  await ghFetchOrThrow(ctx, "POST", `${repoPath(ctx)}/git/refs`, {
+    ref: `refs/heads/${branch}`,
+    sha: baseSha
+  });
+  return { branch, baseSha };
+}
+async function deleteBranch(ctx, branch) {
+  await ghFetchOrThrow(
+    ctx,
+    "DELETE",
+    `${repoPath(ctx)}/git/refs/heads/${encodeURIComponent(branch)}`
+  );
+}
+
+// src/git/files.ts
+async function writeFiles(ctx, branch, files, message, opts = {}) {
+  const remove = opts.remove ?? [];
+  if (files.length === 0 && remove.length === 0) throw new Error("writeFiles: no files given");
+  const base = repoPath(ctx);
+  const parentSha = await getBranchSha(ctx, branch);
+  const tree = [];
+  for (const file of files) {
+    if (file.encoding === "base64") {
+      const blob = await ghFetchOrThrow(ctx, "POST", `${base}/git/blobs`, {
+        content: file.content,
+        encoding: "base64"
+      });
+      tree.push({ path: file.path, mode: "100644", type: "blob", sha: blob.sha });
+    } else {
+      tree.push({ path: file.path, mode: "100644", type: "blob", content: file.content });
+    }
+  }
+  for (const path of remove) tree.push({ path, mode: "100644", type: "blob", sha: null });
+  const newTree = await ghFetchOrThrow(ctx, "POST", `${base}/git/trees`, {
+    base_tree: parentSha,
+    tree
+  });
+  const commit = await ghFetchOrThrow(ctx, "POST", `${base}/git/commits`, {
+    message,
+    tree: newTree.sha,
+    parents: [parentSha]
+  });
+  await ghFetchOrThrow(
+    ctx,
+    "PATCH",
+    `${base}/git/refs/heads/${encodeURIComponent(branch)}`,
+    { sha: commit.sha, force: false }
+  );
+  return { branch, commitSha: commit.sha, treeSha: newTree.sha, fileCount: files.length + remove.length };
+}
+
+// src/studio/images.ts
+var IMAGE_LIMITS = { maxEach: 800 * 1024, maxTotal: 3.5 * 1024 * 1024, prefix: "/blog/" };
+var IMAGE_ERRORS = {
+  path: "That image path isn\u2019t allowed.",
+  size: "That picture is too large to send \u2014 try a smaller one."
+};
+var SAFE_PATH = /^[a-z0-9][a-z0-9/_-]*\.webp$/;
+function decodedSize(b64) {
+  const clean = b64.replace(/\s+/g, "");
+  const pad = clean.endsWith("==") ? 2 : clean.endsWith("=") ? 1 : 0;
+  return Math.floor(clean.length * 3 / 4) - pad;
+}
+function validateImages(images, limits = IMAGE_LIMITS) {
+  let total = 0;
+  const files = [];
+  for (const img of images) {
+    if (typeof img?.path !== "string" || typeof img?.base64 !== "string") return { ok: false, error: IMAGE_ERRORS.path };
+    if (!img.path.startsWith(limits.prefix) || img.path.includes("..")) return { ok: false, error: IMAGE_ERRORS.path };
+    const rel = img.path.slice(1);
+    if (!SAFE_PATH.test(rel)) return { ok: false, error: IMAGE_ERRORS.path };
+    const size = decodedSize(img.base64);
+    if (size === 0 || size > limits.maxEach) return { ok: false, error: IMAGE_ERRORS.size };
+    total += size;
+    if (total > limits.maxTotal) return { ok: false, error: IMAGE_ERRORS.size };
+    files.push({ path: `public/${rel}`, content: img.base64.replace(/\s+/g, ""), encoding: "base64" });
+  }
+  return { ok: true, files };
+}
+
+// src/studio/publish.ts
+var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var stamp = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").slice(0, 13);
+function serialiseDates(fm) {
+  const out = {};
+  for (const [k, v] of Object.entries(fm)) {
+    if (v === void 0) continue;
+    out[k] = v instanceof Date ? v.toISOString() : v;
+  }
+  return out;
+}
+function makePublish(config, registry, ctx, readers) {
+  const publishContent = async (input) => {
+    const { user } = await ctx.requireAdmin();
+    const entry = registry.entry(input.type);
+    if (!entry) return { ok: false, error: `Unknown content type "${input.type}"` };
+    const parsed = entry.schema.safeParse(input.frontmatter);
+    if (!parsed.success) return { ok: false, error: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ") };
+    const fm = serialiseDates(parsed.data);
+    const fileName = entry.filename(fm);
+    const path = `${entry.folder}/${fileName}`;
+    const content = matter__default.default.stringify(`
+${input.body.trim()}
+`, fm);
+    const title = String(fm.title ?? fileName);
+    const pictures = validateImages(input.images ?? [], { ...IMAGE_LIMITS, prefix: registry.publicDirFor(entry.id) });
+    if (!pictures.ok) return { ok: false, error: pictures.error };
+    const files = [{ path, content }, ...pictures.files];
+    const repo = config.env().repo;
+    if (input.existing && await stillOpen(input.existing.number)) {
+      await writeFiles(repo, input.existing.branch, files, `Update: ${title}`);
+      navigation.redirect(`/admin/pr/${input.existing.number}`);
+    }
+    const branch = `admin/${entry.id}/${fileName.replace(/\.mdx$/, "")}-${stamp()}`;
+    await createBranch(repo, branch);
+    await writeFiles(repo, branch, files, `Publish: ${title}`);
+    const pr = await openPullRequest(repo, branch, {
+      title: `Publish: ${title}`,
+      body: `Published from the dashboard by ${user.email ?? user.id}.
+
+File: \`${path}\``
+    });
+    navigation.redirect(`/admin/pr/${pr.number}`);
+  };
+  const stillOpen = async (number) => {
+    try {
+      const pr = await readers.getPullRequest(number);
+      return Boolean(pr && pr.state === "open" && !pr.merged);
+    } catch {
+      return false;
+    }
+  };
+  const removeContent = async (input) => {
+    const { user } = await ctx.requireAdmin();
+    const entry = registry.entry(input.type);
+    if (!entry) return { ok: false, error: `Unknown content type "${input.type}"` };
+    if (!SLUG_RE.test(input.slug)) return { ok: false, error: "That web address isn't valid." };
+    const path = await readers.pathOf(input.type, input.slug) ?? `${entry.folder}/${input.slug}.mdx`;
+    const repo = config.env().repo;
+    const branch = `admin/${entry.id}/${input.slug}-${stamp()}`;
+    await createBranch(repo, branch);
+    await writeFiles(repo, branch, [], `Remove: ${input.slug}`, { remove: [path] });
+    const pr = await openPullRequest(repo, branch, {
+      title: `Remove: ${input.slug}`,
+      body: `Removed from the dashboard by ${user.email ?? user.id}.
+
+File: \`${path}\`
+Action: remove`
+    });
+    navigation.redirect(`/admin/pr/${pr.number}`);
+  };
+  return { publishContent, removeContent };
+}
+
+// src/git/merge.ts
+async function mergePullRequest(ctx, number, opts = {}) {
+  const requireGreen = opts.requireGreen ?? true;
+  const path = `${repoPath(ctx)}/pulls/${number}/merge`;
+  if (requireGreen) {
+    const status = await getPullRequestStatus(ctx, number);
+    if (status.state === "pending") return { merged: false, state: "pending" };
+    if (status.state === "red") {
+      const pr = await getPullRequest(ctx, number);
+      if (pr.mergeable_state === "dirty") {
+        throw new StaleBaseError(number, { status: 0, path, body: pr });
+      }
+      throw new ChecksFailedError(number, status.failingCheck);
+    }
+  }
+  const res = await ghFetch(ctx, "PUT", path, {
+    merge_method: "squash",
+    ...opts.commitTitle ? { commit_title: opts.commitTitle } : {}
+  });
+  if (!res.ok) {
+    if (res.status === 405 || res.status === 409) {
+      throw new StaleBaseError(number, { status: res.status, path, body: res.json });
+    }
+    throw toError(res, path);
+  }
+  if (opts.deleteBranch ?? true) {
+    const pr = await getPullRequest(ctx, number);
+    await deleteBranch(ctx, pr.head.ref);
+  }
+  return { merged: true, sha: res.json.sha };
+}
+
+// src/studio/merge.ts
+function makeMerge(config, ctx, readers) {
+  const revalidate = config.revalidate ?? (() => {
+  });
+  const mergeContentPr = async (number) => {
+    await ctx.requireAdmin();
+    try {
+      const result = await mergePullRequest(config.env().repo, number, { requireGreen: true });
+      revalidate(`/admin/pr/${number}`);
+      return result.merged ? { state: "merged", sha: result.sha } : { state: "pending" };
+    } catch (err) {
+      if (err instanceof StaleBaseError) return { state: "stale" };
+      if (err instanceof ChecksFailedError) return { state: "red", failingCheck: err.failingCheck };
+      return { state: "error", message: err instanceof Error ? err.message : String(err) };
+    }
+  };
+  const discardChange = async (number, branch) => {
+    await ctx.requireAdmin();
+    const repo = config.env().repo;
+    try {
+      const pr = await readers.getPullRequest(number);
+      if (pr?.merged) return { state: "already-published" };
+      if (pr && pr.state === "open") await closePullRequest(repo, number);
+      if (branch.startsWith("admin/")) {
+        try {
+          await deleteBranch(repo, branch);
+        } catch {
+        }
+      }
+      revalidate("/admin");
+      const m = /^admin\/([a-z0-9-]+)\//.exec(branch);
+      if (m) revalidate(`/admin/${m[1]}`);
+      return { state: "discarded" };
+    } catch (err) {
+      return { state: "error", message: err instanceof Error ? err.message : String(err) };
+    }
+  };
+  return { mergeContentPr, discardChange };
+}
+var MAX_CHARS = 2e5;
+var processor = unified.unified().use(remarkParse__default.default).use(remarkGfm__default.default).use(remarkRehype__default.default, { allowDangerousHtml: true }).use(rehypeRaw__default.default).use(rehypeSlug__default.default).use(rehypeStringify__default.default);
+function makePreview(ctx) {
+  const previewBody = async (markdown) => {
+    await ctx.requireAdmin();
+    if (markdown.length > MAX_CHARS) return { error: "That's longer than the preview will render." };
+    try {
+      const source = markdown.replace(/^(import|export)\s.*$/gm, "");
+      return { html: String(await processor.process(source)) };
+    } catch (err) {
+      return { error: err instanceof Error ? err.message.split("\n")[0] : String(err) };
+    }
+  };
+  return { previewBody };
+}
+
+// src/auth/branding.ts
+async function getSiteBranding(client, siteId) {
+  const { data, error } = await client.from("sites").select("name, logo_url, favicon_url, business_email, business_phone").eq("site_id", siteId).maybeSingle();
+  if (error) throw error;
+  if (!data) return null;
+  const r = data;
+  return { name: r.name, logoUrl: r.logo_url, faviconUrl: r.favicon_url, businessEmail: r.business_email, businessPhone: r.business_phone };
+}
+async function updateSiteBranding(client, siteId, patch) {
+  const row = {
+    site_id: siteId,
+    name: patch.name.trim(),
+    logo_url: patch.logoUrl ?? null,
+    favicon_url: patch.faviconUrl ?? null,
+    business_email: emptyToNull(patch.businessEmail),
+    business_phone: emptyToNull(patch.businessPhone)
+  };
+  const { error } = await client.from("sites").upsert(row, { onConflict: "site_id" });
+  if (error) throw error;
+}
+function emptyToNull(v) {
+  const s = (v ?? "").trim();
+  return s === "" ? null : s;
+}
+
+// src/auth/profile.ts
+var MIN_PASSWORD_LENGTH = 10;
+var PASSWORD_TOO_SHORT = "Use at least 10 characters.";
+function profileOf(user) {
+  const m = user?.user_metadata ?? {};
+  const str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+  const name = str(m.name);
+  const displayName = str(m.display_name) ?? name;
+  const avatarUrl = typeof m.avatar_url === "string" && m.avatar_url ? m.avatar_url : null;
+  return { name, displayName, avatarUrl };
+}
+async function updateProfile(client, patch) {
+  const data = {};
+  if (patch.name !== void 0) data.name = (patch.name ?? "").trim().slice(0, 80);
+  if (patch.displayName !== void 0) data.display_name = (patch.displayName ?? "").trim().slice(0, 80);
+  if (patch.avatarUrl !== void 0) data.avatar_url = patch.avatarUrl ?? "";
+  const { data: res, error } = await client.auth.updateUser({ data });
+  if (error) throw new IdentityError(error.message);
+  return profileOf(res.user);
+}
+async function setPassword(client, password) {
+  if (typeof password !== "string" || password.length < MIN_PASSWORD_LENGTH) throw new IdentityError(PASSWORD_TOO_SHORT);
+  const { error } = await client.auth.updateUser({ password });
+  if (error) throw new IdentityError(error.message);
+}
+
+// src/studio/account.ts
+var MAX_UPLOAD = 800 * 1024;
+function makeAccount(config, ctx) {
+  const revalidate = config.revalidate ?? (() => {
+  });
+  const siteId = () => config.env().siteId;
+  const fail = (err) => ({ ok: false, error: err instanceof Error ? err.message : "Something went wrong. Try again." });
+  const upload = async (client, bucket, path, base64) => {
+    const bytes = Buffer.from(base64.replace(/\s+/g, ""), "base64");
+    if (bytes.length === 0 || bytes.length > MAX_UPLOAD) throw new IdentityError("That picture is too large to send \u2014 try a smaller one.");
+    const { error } = await client.storage.from(bucket).upload(path, bytes, { contentType: "image/webp", upsert: true, cacheControl: "60" });
+    if (error) throw new IdentityError(error.message);
+    const { data } = client.storage.from(bucket).getPublicUrl(path);
+    return `${data.publicUrl}?v=${Date.now()}`;
+  };
+  const saveProfile = async (input) => {
+    await ctx.requireAdmin();
+    try {
+      await updateProfile(await ctx.identityClient(), { name: input.name, displayName: input.displayName });
+      revalidate("/admin", "layout");
+      return { ok: true, message: "Saved." };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const saveAvatar = async (input) => {
+    const { user } = await ctx.requireAdmin();
+    const client = await ctx.identityClient();
+    try {
+      if (!input) {
+        await updateProfile(client, { avatarUrl: null });
+        revalidate("/admin", "layout");
+        return { ok: true, message: "Photo removed." };
+      }
+      const url = await upload(client, "avatars", `${user.id}/avatar.webp`, input.base64);
+      await updateProfile(client, { avatarUrl: url });
+      revalidate("/admin", "layout");
+      return { ok: true, message: "Photo saved." };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const changePassword = async (input) => {
+    await ctx.requireAdmin();
+    if (input.password !== input.confirm) return { ok: false, error: "Those passwords don\u2019t match." };
+    try {
+      await setPassword(await ctx.identityClient(), input.password);
+      return { ok: true, message: "Password saved. You can sign in with it next time, or keep using email links." };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const loadBranding = async () => {
+    await ctx.requireAdmin();
+    return getSiteBranding(await ctx.identityClient(), siteId());
+  };
+  const saveBranding = async (input) => {
+    await ctx.requireAdmin({ minimumRole: "owner" });
+    const client = await ctx.identityClient();
+    if (!input.name.trim()) return { ok: false, error: "Give your business a name." };
+    try {
+      const current = await getSiteBranding(client, siteId());
+      await updateSiteBranding(client, siteId(), { name: input.name, businessEmail: input.businessEmail, businessPhone: input.businessPhone, logoUrl: current?.logoUrl ?? null, faviconUrl: current?.faviconUrl ?? null });
+      revalidate("/admin", "layout");
+      return { ok: true, message: "Saved. Your name now shows at the top of Studio." };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const saveBrandingPicture = async (input) => {
+    await ctx.requireAdmin({ minimumRole: "owner" });
+    const client = await ctx.identityClient();
+    try {
+      const current = await getSiteBranding(client, siteId());
+      if (!current) return { ok: false, error: "Save your business name first, then add the pictures." };
+      const url = input.base64 ? await upload(client, "branding", `${siteId()}/${input.kind}.webp`, input.base64) : null;
+      await updateSiteBranding(client, siteId(), { ...current, [input.kind === "logo" ? "logoUrl" : "faviconUrl"]: url });
+      revalidate("/admin", "layout");
+      return { ok: true, message: input.base64 ? `${input.kind === "logo" ? "Logo" : "Favicon"} saved.` : "Removed." };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const loadMe = async () => {
+    const { user, role } = await ctx.requireAdmin();
+    const { data } = await (await ctx.identityClient()).auth.getUser();
+    return { email: user.email ?? "", role, ...profileOf(data.user) };
+  };
+  return { saveProfile, saveAvatar, changePassword, loadBranding, saveBranding, saveBrandingPicture, loadMe };
+}
+
+// src/auth/members.ts
+async function listSiteMembers(client, siteId) {
+  const { data, error } = await client.rpc("site_members", { p_site_id: siteId });
+  if (error) {
+    if (error.code === "42501" || /not allowed/i.test(error.message)) throw new ForbiddenError(siteId, "owner", null);
+    throw error;
+  }
+  return (data ?? []).map((r) => ({
+    userId: r.user_id,
+    email: r.email,
+    name: r.name,
+    avatarUrl: r.avatar_url,
+    role: r.role === "owner" ? "owner" : "editor",
+    status: r.status === "active" ? "active" : "invited",
+    invitedAt: r.invited_at
+  }));
+}
+function createServiceClient(ctx) {
+  return supabaseJs.createClient(ctx.url, ctx.serviceRoleKey, {
+    auth: { persistSession: false, autoRefreshToken: false }
+  });
+}
+async function resolveActorRole(svc, actorId, siteId) {
+  const staff = await svc.from("staff").select("user_id").eq("user_id", actorId).maybeSingle();
+  if (staff.error) throw staff.error;
+  if (staff.data) return "staff";
+  const m = await svc.from("site_users").select("role").eq("user_id", actorId).eq("site_id", siteId).maybeSingle();
+  if (m.error) throw m.error;
+  const role = m.data?.role;
+  return role === "owner" || role === "editor" ? role : null;
+}
+function assertMayGrant(actorRole, siteId, granting) {
+  if (actorRole === "staff") return;
+  if (actorRole === "owner" && granting === "editor") return;
+  throw new ForbiddenError(siteId, granting === "owner" ? "staff" : "owner", actorRole);
+}
+async function inviteUser(ctx, input) {
+  const svc = createServiceClient(ctx);
+  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);
+  assertMayGrant(actorRole, input.siteId, input.role);
+  const email = input.email.trim().toLowerCase();
+  let userId;
+  let invitedByEmail = false;
+  const invite = await svc.auth.admin.inviteUserByEmail(email, {
+    redirectTo: input.redirectTo,
+    data: { site_id: input.siteId, role: input.role }
+  });
+  if (!invite.error) {
+    userId = invite.data.user.id;
+    invitedByEmail = true;
+  } else if (/already|exists|registered/i.test(invite.error.message)) {
+    userId = await findUserIdByEmail(svc, email);
+    if (!userId) throw new IdentityError(`Could not find existing user ${email}`);
+  } else {
+    throw new IdentityError(`Invite failed: ${invite.error.message}`);
+  }
+  const upsert = await svc.from("site_users").upsert({ user_id: userId, site_id: input.siteId, role: input.role, invited_by: input.actor.id }, { onConflict: "user_id,site_id" });
+  if (upsert.error) throw upsert.error;
+  return { userId, siteId: input.siteId, role: input.role, invitedByEmail };
+}
+async function findUserIdByEmail(svc, email) {
+  for (let page = 1; page <= 20; page++) {
+    const { data, error } = await svc.auth.admin.listUsers({ page, perPage: 200 });
+    if (error) throw error;
+    const hit = data.users.find((u) => u.email?.toLowerCase() === email);
+    if (hit) return hit.id;
+    if (data.users.length < 200) break;
+  }
+  return void 0;
+}
+async function removeSiteUser(ctx, input) {
+  const svc = createServiceClient(ctx);
+  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);
+  const target = await svc.from("site_users").select("role").eq("user_id", input.userId).eq("site_id", input.siteId).maybeSingle();
+  if (target.error) throw target.error;
+  const targetRole = target.data?.role ?? "editor";
+  assertMayGrant(actorRole, input.siteId, targetRole);
+  if (targetRole === "owner") await assertNotLastOwner(svc, input.siteId);
+  const del = await svc.from("site_users").delete().eq("user_id", input.userId).eq("site_id", input.siteId);
+  if (del.error) throw del.error;
+}
+async function updateSiteRole(ctx, input) {
+  const svc = createServiceClient(ctx);
+  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);
+  assertMayGrant(actorRole, input.siteId, input.role);
+  const target = await svc.from("site_users").select("role").eq("user_id", input.userId).eq("site_id", input.siteId).maybeSingle();
+  if (target.error) throw target.error;
+  const current = target.data?.role;
+  if (!current) throw new IdentityError("That person isn't a member of this site.");
+  if (current === "owner") assertMayGrant(actorRole, input.siteId, "owner");
+  if (current === "owner" && input.role === "editor") await assertNotLastOwner(svc, input.siteId);
+  const upd = await svc.from("site_users").update({ role: input.role }).eq("user_id", input.userId).eq("site_id", input.siteId);
+  if (upd.error) throw upd.error;
+}
+async function assertNotLastOwner(svc, siteId) {
+  const owners = await svc.from("site_users").select("user_id").eq("site_id", siteId).eq("role", "owner");
+  if (owners.error) throw owners.error;
+  if ((owners.data ?? []).length <= 1) throw new IdentityError("A site needs at least one owner \u2014 make someone else an owner first.");
+}
+async function resendInvite(ctx, input) {
+  const svc = createServiceClient(ctx);
+  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);
+  assertMayGrant(actorRole, input.siteId, "editor");
+  const email = input.email.trim().toLowerCase();
+  const again = await svc.auth.admin.inviteUserByEmail(email, { redirectTo: input.redirectTo, data: { site_id: input.siteId } });
+  if (!again.error) return { resent: true, message: `Invitation sent again to ${email}.` };
+  if (/already|exists|registered|confirmed/i.test(again.error.message)) {
+    return { resent: false, message: `${email} has already accepted \u2014 they can sign in with an email link any time.` };
+  }
+  throw new IdentityError(`Resend failed: ${again.error.message}`);
+}
+
+// src/studio/team.ts
+var TEAM_NOT_CONFIGURED = "Inviting people isn\u2019t set up on this deployment yet.";
+var OWNER_ONLY = "Only the site's owner can manage the team.";
+function makeTeam(config, ctx) {
+  const revalidate = config.revalidate ?? (() => {
+  });
+  const fail = (err) => err instanceof ForbiddenError ? { ok: false, error: "You don\u2019t have permission to do that here." } : { ok: false, error: err instanceof Error ? err.message : "Something went wrong. Try again." };
+  const acceptUrl = async () => `${await config.baseUrl()}/admin/auth/accept`;
+  const loadTeam = async () => {
+    const { role } = await ctx.requireAdmin();
+    if (role === "editor") return { ok: false, error: OWNER_ONLY };
+    try {
+      const members = await listSiteMembers(await ctx.identityClient(), config.env().siteId);
+      return { ok: true, members, canInvite: config.env().service !== null };
+    } catch (err) {
+      if (err instanceof ForbiddenError) return { ok: false, error: OWNER_ONLY };
+      throw err;
+    }
+  };
+  const invite = async (input) => {
+    const { user } = await ctx.requireAdmin({ minimumRole: "owner" });
+    const env = config.env();
+    if (!env.service) return { ok: false, error: TEAM_NOT_CONFIGURED };
+    const email = input.email.trim().toLowerCase();
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return { ok: false, error: "That doesn\u2019t look like an email address." };
+    try {
+      await inviteUser(env.service, { email, siteId: env.siteId, role: input.role, actor: { id: user.id }, redirectTo: await acceptUrl() });
+      revalidate("/admin/account");
+      return { ok: true, message: `Invitation sent to ${email}.` };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const changeRole = async (input) => {
+    const { user } = await ctx.requireAdmin({ minimumRole: "owner" });
+    const env = config.env();
+    if (!env.service) return { ok: false, error: TEAM_NOT_CONFIGURED };
+    try {
+      await updateSiteRole(env.service, { userId: input.userId, siteId: env.siteId, role: input.role, actor: { id: user.id } });
+      revalidate("/admin/account");
+      return { ok: true, message: "Role updated." };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const resend = async (input) => {
+    const { user } = await ctx.requireAdmin({ minimumRole: "owner" });
+    const env = config.env();
+    if (!env.service) return { ok: false, error: TEAM_NOT_CONFIGURED };
+    try {
+      const r = await resendInvite(env.service, { email: input.email, siteId: env.siteId, actor: { id: user.id }, redirectTo: await acceptUrl() });
+      return { ok: true, message: r.message };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  const remove = async (input) => {
+    const { user } = await ctx.requireAdmin({ minimumRole: "owner" });
+    const env = config.env();
+    if (!env.service) return { ok: false, error: TEAM_NOT_CONFIGURED };
+    if (input.userId === user.id) return { ok: false, error: "You can\u2019t remove yourself. Ask another owner to do it." };
+    try {
+      await removeSiteUser(env.service, { userId: input.userId, siteId: env.siteId, actor: { id: user.id } });
+      revalidate("/admin/account");
+      return { ok: true, message: "Removed." };
+    } catch (err) {
+      return fail(err);
+    }
+  };
+  return { loadTeam, invite, changeRole, resend, remove };
+}
+
+// src/auth/callback.ts
+function safeNextPath(next, fallback) {
+  if (!next) return fallback;
+  if (!/^\/(?![/\\])/.test(next)) return fallback;
+  if (/[\r\n]/.test(next) || /^\/[^?#]*:\/\//.test(next)) return fallback;
+  return next;
+}
+async function handleAuthCallback(client, requestUrl, opts = {}) {
+  const fallback = opts.fallbackPath ?? "/admin";
+  const url = typeof requestUrl === "string" ? new URL(requestUrl, "http://placeholder.invalid") : requestUrl;
+  const code = url.searchParams.get("code");
+  if (!code) return { ok: false, reason: "missing_code" };
+  const { error } = await client.auth.exchangeCodeForSession(code);
+  if (error) return { ok: false, reason: "exchange_failed", message: error.message };
+  return { ok: true, redirectTo: safeNextPath(url.searchParams.get("next"), fallback) };
+}
+
+// src/auth/signout.ts
+async function signOut(client) {
+  const { error } = await client.auth.signOut({ scope: "local" });
+  if (error) throw error;
+}
+
+// src/studio/handlers.ts
+function makeHandlers(ctx) {
+  const callback = async (request) => {
+    const result = await handleAuthCallback(await ctx.identityClient(), request.url, { fallbackPath: "/admin" });
+    const target = result.ok ? result.redirectTo : "/admin/sign-in?error=link";
+    return Response.redirect(new URL(target, request.url), 307);
+  };
+  const signout = async (request) => {
+    try {
+      await signOut(await ctx.identityClient());
+    } catch {
+    }
+    return Response.redirect(new URL("/admin/sign-in", request.url), 303);
+  };
+  return { callback, signout };
+}
+
+// src/studio/index.ts
+function createStudio(config) {
+  const ctx = makeContext(config);
+  const registry = makeRegistry(config);
+  const pending = makePending(config, registry);
+  const readers = makeReaders(config, registry, pending);
+  const actions = {
+    ...makePublish(config, registry, ctx, readers),
+    ...makeMerge(config, ctx, readers),
+    ...makePreview(ctx),
+    ...makeAccount(config, ctx),
+    ...makeTeam(config, ctx)
+  };
+  return {
+    config,
+    isConfigured: config.isConfigured,
+    entry: registry.entry,
+    entries: registry.entries,
+    requireAdmin: ctx.requireAdmin,
+    identityClient: ctx.identityClient,
+    readers: { ...readers, ...pending, locate: registry.locate, publicUrlFor: registry.publicUrlFor, publicDirFor: registry.publicDirFor },
+    actions,
+    authHandlers: makeHandlers(ctx)
+  };
+}
+
+exports.IMAGE_ERRORS = IMAGE_ERRORS;
+exports.IMAGE_LIMITS = IMAGE_LIMITS;
+exports.NotHere = NotHere;
+exports.createStudio = createStudio;
+exports.decodedSize = decodedSize;
+exports.pendingLabel = pendingLabel;
+exports.pendingText = pendingText;
+exports.validateImages = validateImages;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map