@realiizlabs/admin 0.15.9 → 0.17.0

package/dist/studio/index.d.cts

@@ -1,7 +1,7 @@
 import { c as ImagePayload } from '../validate-C84Ll1cD.cjs';
 export { I as IMAGE_ERRORS, a as IMAGE_LIMITS, b as ImageLimits, V as ValidatedImages, d as decodedSize, v as validateImages } from '../validate-C84Ll1cD.cjs';
 import { a as IdentityUser, f as SiteRole, C as CookieStore, d as SiteMember, I as IdentityClient, c as SiteBranding } from '../members-nhbRSYyr.cjs';
-import { a as PullRequestStatus } from '../types-BP5G1myE.cjs';
+import { a as PullRequestStatus } from '../types-Cy9UDz--.cjs';
 import { C as ContentTypeEntry } from '../types-DeHdasdP.cjs';
 import * as zod from 'zod';
 import * as zod_v4_core from 'zod/v4/core';
@@ -15,10 +15,15 @@ import '@supabase/supabase-js';
  * arrives here, lazily, so `next build` with no env set still succeeds.
  */
 
+/** The site's repo and how Studio reaches it — the GitHub App (preferred) or a personal access token. */
 interface RepoConfig {
     owner: string;
     repo: string;
-    token: string;
+    app?: {
+        appId: string;
+        privateKey: string;
+    } | null;
+    token?: string | null;
 }
 interface IdentityConfig {
     url: string;
@@ -151,6 +156,12 @@ interface PublishInput {
     } | null;
     /** Pictures chosen in this session, already shrunk in the browser; committed with the MDX. */
     images?: ImagePayload[];
+    /**
+     * The slug this item was opened as (edits only). When the new frontmatter produces a
+     * different file name — a date-prefixed event whose date moved — the old file is removed
+     * in the same commit, so an edit never leaves a stale copy behind.
+     */
+    replaces?: string | null;
 }
 type PublishResult = {
     ok: false;
@@ -249,6 +260,7 @@ declare function createStudio(config: StudioConfig): {
         pendingFor: (path: string) => Promise<PendingChange | null>;
         pathOf: (typeId: string, slug: string) => Promise<string | null>;
         listItems: (typeId: string) => Promise<ListItem[]>;
+        listSlugs: (typeId: string) => Promise<string[]>;
         countItems: (typeId: string) => Promise<number>;
         readItem: (typeId: string, slug: string, opts?: {
             ref?: string;

package/dist/studio/index.d.ts

@@ -1,7 +1,7 @@
 import { c as ImagePayload } from '../validate-C84Ll1cD.js';
 export { I as IMAGE_ERRORS, a as IMAGE_LIMITS, b as ImageLimits, V as ValidatedImages, d as decodedSize, v as validateImages } from '../validate-C84Ll1cD.js';
 import { a as IdentityUser, f as SiteRole, C as CookieStore, d as SiteMember, I as IdentityClient, c as SiteBranding } from '../members-nhbRSYyr.js';
-import { a as PullRequestStatus } from '../types-BP5G1myE.js';
+import { a as PullRequestStatus } from '../types-Cy9UDz--.js';
 import { C as ContentTypeEntry } from '../types-DeHdasdP.js';
 import * as zod from 'zod';
 import * as zod_v4_core from 'zod/v4/core';
@@ -15,10 +15,15 @@ import '@supabase/supabase-js';
  * arrives here, lazily, so `next build` with no env set still succeeds.
  */
 
+/** The site's repo and how Studio reaches it — the GitHub App (preferred) or a personal access token. */
 interface RepoConfig {
     owner: string;
     repo: string;
-    token: string;
+    app?: {
+        appId: string;
+        privateKey: string;
+    } | null;
+    token?: string | null;
 }
 interface IdentityConfig {
     url: string;
@@ -151,6 +156,12 @@ interface PublishInput {
     } | null;
     /** Pictures chosen in this session, already shrunk in the browser; committed with the MDX. */
     images?: ImagePayload[];
+    /**
+     * The slug this item was opened as (edits only). When the new frontmatter produces a
+     * different file name — a date-prefixed event whose date moved — the old file is removed
+     * in the same commit, so an edit never leaves a stale copy behind.
+     */
+    replaces?: string | null;
 }
 type PublishResult = {
     ok: false;
@@ -249,6 +260,7 @@ declare function createStudio(config: StudioConfig): {
         pendingFor: (path: string) => Promise<PendingChange | null>;
         pathOf: (typeId: string, slug: string) => Promise<string | null>;
         listItems: (typeId: string) => Promise<ListItem[]>;
+        listSlugs: (typeId: string) => Promise<string[]>;
         countItems: (typeId: string) => Promise<number>;
         readItem: (typeId: string, slug: string, opts?: {
             ref?: string;

package/dist/studio/index.js

@@ -1,6 +1,7 @@
 import 'server-only';
 import { redirect } from 'next/navigation';
 import { createServerClient } from '@supabase/ssr';
+import { createSign } from 'crypto';
 import matter from 'gray-matter';
 import { unified } from 'unified';
 import remarkParse from 'remark-parse';
@@ -171,15 +172,15 @@ var ChecksFailedError = class extends Error {
   }
 };
 
-// src/git/client.ts
-var API = "https://api.github.com";
+// src/git/http.ts
+var GITHUB_API = "https://api.github.com";
 var GITHUB_TIMEOUT_MS = 1e4;
-async function ghFetch(ctx, method, path, body) {
-  const res = await fetch(API + path, {
+async function githubRequest(method, path, authorization, body, fetchImpl = fetch) {
+  const res = await fetchImpl(GITHUB_API + path, {
     method,
     signal: AbortSignal.timeout(GITHUB_TIMEOUT_MS),
     headers: {
-      Authorization: `Bearer ${ctx.token}`,
+      Authorization: authorization,
       Accept: "application/vnd.github+json",
       "X-GitHub-Api-Version": "2022-11-28",
       "User-Agent": "realiizlabs-admin",
@@ -198,6 +199,65 @@ async function ghFetch(ctx, method, path, body) {
   }
   return { ok: res.ok, status: res.status, json };
 }
+
+// src/git/app-auth.ts
+var JWT_TTL_S = 9 * 60;
+var REFRESH_BEFORE_MS = 5 * 6e4;
+var cache = /* @__PURE__ */ new Map();
+function b64url(input) {
+  return Buffer.from(input).toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function appJwt(creds, now = Math.floor(Date.now() / 1e3)) {
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = b64url(JSON.stringify({ iat: now - 60, exp: now + JWT_TTL_S, iss: creds.appId }));
+  const signer = createSign("RSA-SHA256");
+  signer.update(`${header}.${payload}`);
+  const signature = signer.sign(creds.privateKey.replace(/\\n/g, "\n"));
+  return `${header}.${payload}.${b64url(signature)}`;
+}
+function forgetInstallationToken(creds, owner, repo) {
+  cache.delete(`${creds.appId}:${owner}/${repo}`);
+}
+async function installationToken(creds, owner, repo, fetchImpl = fetch) {
+  const key = `${creds.appId}:${owner}/${repo}`;
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt - Date.now() > REFRESH_BEFORE_MS) return hit.token;
+  const bearer = `Bearer ${appJwt(creds)}`;
+  const repoPath2 = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+  const found = await githubRequest("GET", `${repoPath2}/installation`, bearer, void 0, fetchImpl);
+  if (found.status === 404) {
+    throw new GitHubError(
+      `The Realiiz Studio GitHub App isn't installed on ${owner}/${repo}. The repository's owner installs it once \u2014 ask your web team for the link.`,
+      { status: 404, path: `${repoPath2}/installation`, body: found.json }
+    );
+  }
+  if (!found.ok) throw new GitHubError(`GitHub ${found.status} looking up the app installation`, { status: found.status, path: `${repoPath2}/installation`, body: found.json });
+  const minted = await githubRequest(
+    "POST",
+    `/app/installations/${found.json.id}/access_tokens`,
+    bearer,
+    void 0,
+    fetchImpl
+  );
+  if (!minted.ok) throw new GitHubError(`GitHub ${minted.status} minting an installation token`, { status: minted.status, path: "/app/installations/\u2026/access_tokens", body: minted.json });
+  cache.set(key, { token: minted.json.token, expiresAt: Date.parse(minted.json.expires_at) });
+  return minted.json.token;
+}
+
+// src/git/client.ts
+async function credentialFor(ctx) {
+  if (ctx.app) return installationToken(ctx.app, ctx.owner, ctx.repo);
+  if (ctx.token) return ctx.token;
+  throw new GitHubError(`No GitHub credential for ${ctx.owner}/${ctx.repo}: set GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY, or GITHUB_CONTENT_TOKEN.`, { status: 0, path: "", body: null });
+}
+async function ghFetch(ctx, method, path, body) {
+  const res = await githubRequest(method, path, `Bearer ${await credentialFor(ctx)}`, body);
+  if (res.status === 401 && ctx.app) {
+    forgetInstallationToken(ctx.app, ctx.owner, ctx.repo);
+    return githubRequest(method, path, `Bearer ${await credentialFor(ctx)}`, body);
+  }
+  return res;
+}
 async function ghFetchOrThrow(ctx, method, path, body) {
   const res = await ghFetch(ctx, method, path, body);
   if (!res.ok) throw toError(res, path);
@@ -404,6 +464,10 @@ function makeReaders(config, registry, pending) {
     const entries = await listDirectory(repo(), e.folder);
     return entries.find((x) => registry.slugOf(e, x.name) === slug)?.path ?? null;
   };
+  const listSlugs = async (typeId) => {
+    const items = await listItems(typeId);
+    return items.filter((i) => !i.isNew).map((i) => i.slug).sort();
+  };
   const listItems = async (typeId) => {
     const e = need(typeId);
     const ctx = repo();
@@ -479,7 +543,7 @@ function makeReaders(config, registry, pending) {
     }
   };
   const prStatus = (number) => getPullRequestStatus(repo(), number);
-  return { pathOf, listItems, countItems, readItem, lastAuthor, getPullRequest: getPullRequest2, prStatus };
+  return { pathOf, listItems, listSlugs, countItems, readItem, lastAuthor, getPullRequest: getPullRequest2, prStatus };
 }
 
 // src/git/branch.ts
@@ -601,18 +665,22 @@ ${input.body.trim()}
     if (!pictures.ok) return { ok: false, error: pictures.error };
     const files = [{ path, content }, ...pictures.files];
     const repo = config.env().repo;
+    const oldPath = input.replaces ? await readers.pathOf(entry.id, input.replaces).catch(() => null) : null;
+    const remove = oldPath && oldPath !== path ? [oldPath] : [];
+    const renamed = remove.length ? `
+Renamed from \`${oldPath}\` to \`${path}\`` : "";
     if (input.existing && await stillOpen(input.existing.number)) {
-      await writeFiles(repo, input.existing.branch, files, `Update: ${title}`);
+      await writeFiles(repo, input.existing.branch, files, `Update: ${title}`, { remove });
       redirect(`/admin/pr/${input.existing.number}`);
     }
     const branch = `admin/${entry.id}/${fileName.replace(/\.mdx$/, "")}-${stamp()}`;
     await createBranch(repo, branch);
-    await writeFiles(repo, branch, files, `Publish: ${title}`);
+    await writeFiles(repo, branch, files, `Publish: ${title}`, { remove });
     const pr = await openPullRequest(repo, branch, {
       title: `Publish: ${title}`,
       body: `Published from the dashboard by ${user.email ?? user.id}.
 
-File: \`${path}\``
+File: \`${path}\`${renamed}`
     });
     redirect(`/admin/pr/${pr.number}`);
   };
@@ -1103,7 +1171,7 @@ function makeHandlers(ctx) {
 }
 
 // src/version.ts
-var ADMIN_VERSION = "0.15.9" ;
+var ADMIN_VERSION = "0.17.0" ;
 
 // src/studio/update.ts
 var PACKAGE_NAME = "@realiizlabs/admin";