@sandboxsonny/ace-kit 0.2.0 → 0.4.0

package/dist/cli.js

@@ -1,8 +1,249 @@
 #!/usr/bin/env node
 
-// src/generate/cli.ts
-import { mkdir, writeFile } from "fs/promises";
-import { dirname, resolve } from "path";
+// src/cli/environment.ts
+import { spawn } from "child_process";
+import { hostname } from "os";
+import { pathToFileURL } from "url";
+
+// src/auth/file-store.ts
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+
+// src/auth/login-store.ts
+function normaliseApiUrl(address) {
+  let parsed;
+  try {
+    parsed = new URL(address.trim());
+  } catch {
+    throw new Error(`"${address}" is not a web address. Write the API address like http://localhost:8080.`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`The API address must start with http:// or https:// (it was "${address}").`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error("The API address must not contain a username or password.");
+  }
+  return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+}
+function hasExpired(login, now) {
+  const endsAt = Date.parse(login.expiresAt);
+  return Number.isNaN(endsAt) || endsAt <= now;
+}
+function parseStoredLogin(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const { token, expiresAt, email } = value;
+  if (typeof token !== "string" || token === "" || typeof expiresAt !== "string" || typeof email !== "string")
+    return null;
+  return { token, expiresAt, email };
+}
+
+// src/auth/file-store.ts
+function defaultLoginFile(variables, platform) {
+  if (platform === "win32" && variables.APPDATA) return join(variables.APPDATA, "ace-kit", "credentials.json");
+  const configFolder = variables.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(configFolder, "ace-kit", "credentials.json");
+}
+function createFileStore(path) {
+  async function readAll() {
+    let text;
+    try {
+      text = await readFile(path, "utf8");
+    } catch {
+      return {};
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return {};
+    }
+    const found = {};
+    if (typeof parsed === "object" && parsed !== null) {
+      for (const [address, value] of Object.entries(parsed)) {
+        const login = parseStoredLogin(value);
+        if (login) found[address] = login;
+      }
+    }
+    return found;
+  }
+  async function writeAll(logins) {
+    await mkdir(dirname(path), { recursive: true, mode: 448 });
+    const temporary = `${path}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(logins, null, 2)}
+`, { mode: 384 });
+    await rename(temporary, path);
+  }
+  return {
+    description: path,
+    async read(apiUrl) {
+      return (await readAll())[normaliseApiUrl(apiUrl)] ?? null;
+    },
+    async write(apiUrl, login) {
+      const logins = await readAll();
+      logins[normaliseApiUrl(apiUrl)] = login;
+      await writeAll(logins);
+    },
+    async remove(apiUrl) {
+      const logins = await readAll();
+      delete logins[normaliseApiUrl(apiUrl)];
+      await writeAll(logins);
+    }
+  };
+}
+
+// src/auth/keychain-store.ts
+var keychainService = "ace-kit";
+function createKeychainStore(run) {
+  async function read(apiUrl) {
+    const found = await run("security", [
+      "find-generic-password",
+      "-s",
+      keychainService,
+      "-a",
+      normaliseApiUrl(apiUrl),
+      "-w"
+    ]);
+    if (found.exitCode !== 0) return null;
+    try {
+      return parseStoredLogin(JSON.parse(Buffer.from(found.stdout.trim(), "base64").toString("utf8")));
+    } catch {
+      return null;
+    }
+  }
+  return {
+    description: "the macOS Keychain",
+    read,
+    async write(apiUrl, login) {
+      const account = normaliseApiUrl(apiUrl);
+      if (/["\\\s]/.test(account)) throw new Error("That API address can't be kept in the Keychain.");
+      const secret = Buffer.from(JSON.stringify(login), "utf8").toString("base64");
+      await run(
+        "security",
+        ["-i"],
+        `add-generic-password -s "${keychainService}" -a "${account}" -l "Ace Kit login" -w "${secret}" -U
+`
+      );
+      const kept = await read(apiUrl);
+      if (kept?.token !== login.token) throw new Error("The login could not be saved in the macOS Keychain.");
+    },
+    async remove(apiUrl) {
+      await run("security", ["delete-generic-password", "-s", keychainService, "-a", normaliseApiUrl(apiUrl)]);
+    }
+  };
+}
+
+// src/auth/choose-store.ts
+async function chooseLoginStore(options) {
+  const file = createFileStore(defaultLoginFile(options.variables, options.platform));
+  if (options.platform !== "darwin" || options.variables.ACE_KIT_CREDENTIALS === "file") return file;
+  try {
+    await options.run("security", ["help"]);
+    return createKeychainStore(options.run);
+  } catch {
+    return file;
+  }
+}
+
+// src/auth/last-api-url.ts
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+function defaultLastApiUrlFile(variables, platform) {
+  return join2(dirname2(defaultLoginFile(variables, platform)), "last-api-url");
+}
+function createLastApiUrl(path) {
+  return {
+    async read() {
+      try {
+        return normaliseApiUrl((await readFile2(path, "utf8")).trim());
+      } catch {
+        return null;
+      }
+    },
+    async write(apiUrl) {
+      await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+      const temporary = `${path}.${process.pid}.tmp`;
+      await writeFile2(temporary, `${normaliseApiUrl(apiUrl)}
+`, { mode: 384 });
+      await rename2(temporary, path);
+    }
+  };
+}
+
+// src/cli/version.ts
+var aceKitVersion = true ? "0.4.0" : "development";
+
+// src/cli/environment.ts
+var runCommand = (command, commandArguments, input) => new Promise((resolve2, reject) => {
+  const child = spawn(command, commandArguments, { stdio: ["pipe", "pipe", "ignore"] });
+  let stdout = "";
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk.toString("utf8");
+  });
+  child.on("error", reject);
+  child.on("close", (exitCode) => resolve2({ exitCode: exitCode ?? 1, stdout }));
+  child.stdin.on("error", () => {
+  });
+  child.stdin.end(input ?? "");
+});
+function browserCommand(platform, address) {
+  if (platform === "darwin") return { command: "open", commandArguments: [address] };
+  if (platform === "win32") return { command: "rundll32", commandArguments: ["url.dll,FileProtocolHandler", address] };
+  return { command: "xdg-open", commandArguments: [address] };
+}
+async function openBrowser(platform, address) {
+  const { command, commandArguments } = browserCommand(platform, address);
+  await new Promise((resolve2) => {
+    const child = spawn(command, commandArguments, { stdio: "ignore", detached: true });
+    child.on("error", () => resolve2());
+    child.on("spawn", () => {
+      child.unref();
+      resolve2();
+    });
+  });
+}
+async function importModule(path) {
+  try {
+    return await import(pathToFileURL(path).href);
+  } catch (error) {
+    if (error.code === "ERR_UNKNOWN_FILE_EXTENSION") {
+      throw new Error(
+        "this version of Node can't run TypeScript files. Use Node 22.18 or newer, or write the schema in .js.",
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}
+async function createRealEnvironment() {
+  try {
+    process.loadEnvFile(".env");
+  } catch {
+  }
+  const variables = { ...process.env };
+  const platform = process.platform;
+  return {
+    variables,
+    platform,
+    hostname: hostname(),
+    version: aceKitVersion,
+    out: (text) => process.stdout.write(`${text}
+`),
+    error: (text) => console.error(text),
+    fetchImplementation: (input, init) => fetch(input, init),
+    sleep: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
+    now: Date.now,
+    workingDirectory: process.cwd(),
+    importModule,
+    openBrowser: (address) => openBrowser(platform, address),
+    store: await chooseLoginStore({ platform, variables, run: runCommand }),
+    lastApiUrl: createLastApiUrl(defaultLastApiUrlFile(variables, platform))
+  };
+}
+
+// src/cli/generate-command.ts
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, resolve } from "path";
 import { parseArgs } from "util";
 
 // src/client/errors.ts
@@ -123,6 +364,8 @@ function typeOfField(field) {
       return { type: "string" };
     case "link":
       return { type: "AceLinkData", uses: "AceLinkData" };
+    case "sections":
+      return { type: "AceSection[]", uses: "AceSection" };
     default:
       return { type: "unknown" };
   }
@@ -160,8 +403,8 @@ export {};
 // src/helpers/package-name.ts
 var packageName = "@sandboxsonny/ace-kit";
 
-// src/generate/cli.ts
-var usage = `ace-kit generate: write TypeScript types for your CMS Ace content types.
+// src/cli/generate-command.ts
+var generateUsage = `ace-kit generate: write TypeScript types for your CMS Ace content types.
 
 Usage:
   ace-kit generate [--api-url <address>] [--domain <domain>] [--out <file>]
@@ -172,13 +415,10 @@ Options:
   --out       Where to write the types (default: src/ace-kit.generated.d.ts).
   --help      Show this message.
 `;
-async function main() {
-  try {
-    process.loadEnvFile(".env");
-  } catch {
-  }
-  const { positionals, values } = parseArgs({
-    allowPositionals: true,
+async function generateCommand(commandArguments, environment) {
+  const { values } = parseArgs({
+    // eslint-disable-next-line id-denylist -- "args" is the name node's parseArgs gives this option.
+    args: commandArguments,
     options: {
       "api-url": { type: "string" },
       domain: { type: "string" },
@@ -186,27 +426,746 @@ async function main() {
       help: { type: "boolean" }
     }
   });
-  if (values.help || positionals[0] !== "generate") {
-    console.log(usage);
-    return values.help ? 0 : 1;
+  if (values.help) {
+    environment.out(generateUsage);
+    return 0;
   }
-  const apiUrl = values["api-url"] ?? process.env.ACE_API_URL;
-  const siteDomain = values.domain ?? process.env.ACE_SITE_DOMAIN;
+  const apiUrl = values["api-url"] ?? environment.variables.ACE_API_URL;
+  const siteDomain = values.domain ?? environment.variables.ACE_SITE_DOMAIN;
   if (!apiUrl || !siteDomain) {
-    console.error(
+    environment.error(
       "Give the API address and the site's domain: --api-url and --domain, or ACE_API_URL and ACE_SITE_DOMAIN."
     );
     return 1;
   }
-  const client = createAceClient({ apiUrl, siteDomain, cacheSeconds: 0 });
+  const client = createAceClient({
+    apiUrl,
+    siteDomain,
+    cacheSeconds: 0,
+    fetchImplementation: environment.fetchImplementation
+  });
   const contentTypes = await client.getContentTypes();
   const file = resolve(values.out ?? "src/ace-kit.generated.d.ts");
-  await mkdir(dirname(file), { recursive: true });
-  await writeFile(file, generateTypes(contentTypes, packageName, siteDomain));
-  console.log(`Wrote types for ${contentTypes.length} content type${contentTypes.length === 1 ? "" : "s"} to ${file}.`);
+  await mkdir3(dirname3(file), { recursive: true });
+  await writeFile3(file, generateTypes(contentTypes, packageName, siteDomain));
+  environment.out(
+    `Wrote types for ${contentTypes.length} content type${contentTypes.length === 1 ? "" : "s"} to ${file}.`
+  );
   return 0;
 }
-main().then(
+
+// src/cli/login-commands.ts
+import { parseArgs as parseArgs2 } from "util";
+
+// src/auth/device-login.ts
+var DeviceLoginError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "DeviceLoginError";
+    this.reason = reason;
+  }
+};
+var requestTimeoutMilliseconds2 = 15e3;
+var maximumFailures = 5;
+async function post(dependencies, apiUrl, path, body) {
+  return dependencies.fetchImplementation(`${apiUrl}${path}`, {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(requestTimeoutMilliseconds2)
+  });
+}
+async function readMessage(response) {
+  try {
+    const body = await response.json();
+    if (typeof body.error === "string") return body.error;
+  } catch {
+  }
+  return `The CMS answered with an error (${response.status}).`;
+}
+async function startDeviceLogin(dependencies) {
+  let response;
+  try {
+    response = await post(dependencies, dependencies.apiUrl, "/auth/device", { client_name: dependencies.clientName });
+  } catch {
+    throw new DeviceLoginError("unavailable", `Could not reach the CMS at ${dependencies.apiUrl}.`);
+  }
+  if (response.status === 503) throw new DeviceLoginError("unsupported", await readMessage(response));
+  if (response.status === 429)
+    throw new DeviceLoginError("unavailable", "Too many attempts. Wait a minute and try again.");
+  if (response.status === 404) {
+    throw new DeviceLoginError(
+      "unsupported",
+      `${dependencies.apiUrl} does not offer command-line sign-in. Is it a CMS Ace API, and is it up to date?`
+    );
+  }
+  if (!response.ok) throw new DeviceLoginError("unavailable", await readMessage(response));
+  const body = await response.json().catch(() => null);
+  const { device_code, user_code, verification_uri, expires_in, interval } = body ?? {};
+  if (typeof device_code !== "string" || typeof user_code !== "string" || typeof verification_uri !== "string" || typeof expires_in !== "number" || typeof interval !== "number") {
+    throw new DeviceLoginError(
+      "unavailable",
+      "The CMS sent a reply this version of ace-kit can't read. Update ace-kit."
+    );
+  }
+  return {
+    deviceCode: device_code,
+    userCode: user_code,
+    verificationUri: verification_uri,
+    expiresInSeconds: expires_in,
+    intervalSeconds: Math.max(1, interval)
+  };
+}
+async function waitForApproval(dependencies) {
+  const { apiUrl, request, sleep, now } = dependencies;
+  const deadline = now() + request.expiresInSeconds * 1e3;
+  let intervalSeconds = request.intervalSeconds;
+  let failures = 0;
+  for (; ; ) {
+    await sleep(intervalSeconds * 1e3);
+    if (now() > deadline)
+      throw new DeviceLoginError("expired", "The code ran out before it was approved. Run ace-kit login again.");
+    let response;
+    try {
+      response = await post(dependencies, apiUrl, "/auth/device/token", { device_code: request.deviceCode });
+    } catch {
+      failures += 1;
+      if (failures >= maximumFailures)
+        throw new DeviceLoginError("unavailable", `Lost contact with the CMS at ${apiUrl}.`);
+      continue;
+    }
+    if (response.status === 404) {
+      throw new DeviceLoginError("expired", "The CMS no longer knows this login. Run ace-kit login again.");
+    }
+    if (response.status === 429) {
+      intervalSeconds += 5;
+      continue;
+    }
+    if (!response.ok) {
+      failures += 1;
+      if (failures >= maximumFailures) throw new DeviceLoginError("unavailable", await readMessage(response));
+      continue;
+    }
+    failures = 0;
+    const body = await response.json().catch(() => null);
+    switch (body?.status) {
+      case "pending":
+        continue;
+      case "slow_down":
+        intervalSeconds += 5;
+        continue;
+      case "denied":
+        throw new DeviceLoginError("denied", "The login was turned down in the admin app.");
+      case "expired":
+        throw new DeviceLoginError("expired", "The code ran out before it was approved. Run ace-kit login again.");
+      case "approved": {
+        const user = body.user;
+        if (typeof body.token !== "string" || typeof body.expires_at !== "string" || typeof user?.email !== "string") {
+          throw new DeviceLoginError("unavailable", "The CMS approved the login but sent a reply that can't be read.");
+        }
+        return { token: body.token, expiresAt: body.expires_at, email: user.email };
+      }
+      default:
+        throw new DeviceLoginError(
+          "unavailable",
+          "The CMS sent a reply this version of ace-kit can't read. Update ace-kit."
+        );
+    }
+  }
+}
+
+// src/auth/resolve-login.ts
+async function resolveLogin(options) {
+  const fromEnvironment = options.variables.ACE_TOKEN?.trim();
+  if (fromEnvironment) return { token: fromEnvironment, source: "the ACE_TOKEN setting" };
+  const stored = await options.store.read(options.apiUrl);
+  if (!stored || hasExpired(stored, options.now())) return null;
+  return { token: stored.token, email: stored.email, source: options.store.description };
+}
+
+// src/cli/api-url.ts
+async function resolveApiUrl(fromOption, environment) {
+  const address = fromOption ?? environment.variables.ACE_API_URL ?? await environment.lastApiUrl.read();
+  if (!address) {
+    environment.error(
+      "Give the API address: --api-url, or ACE_API_URL in the environment or a .env file. (Once you have signed in, that address is remembered.)"
+    );
+    return null;
+  }
+  try {
+    return normaliseApiUrl(address);
+  } catch (error) {
+    environment.error(error instanceof Error ? error.message : String(error));
+    return null;
+  }
+}
+function isLocalApiUrl(apiUrl) {
+  return ["localhost", "127.0.0.1", "[::1]"].includes(new URL(apiUrl).hostname);
+}
+
+// src/cli/login-commands.ts
+var loginUsage = `ace-kit login: sign in to CMS Ace from the command line.
+
+Usage:
+  ace-kit login  [--api-url <address>]    Sign in. Opens the admin app, where you type the code shown here.
+  ace-kit logout [--api-url <address>]    Sign out, and forget the login kept on this machine.
+  ace-kit whoami [--api-url <address>]    Say who you are signed in as.
+
+Options:
+  --api-url   Where the CMS Ace API lives (or set ACE_API_URL, in the environment or a .env file).
+  --help      Show this message.
+
+The login is kept in the macOS Keychain, or in a file only you can read on other systems. On a build server,
+where nobody can approve a login in a browser, set ACE_TOKEN instead.
+`;
+var requestTimeoutMilliseconds3 = 15e3;
+async function readApiUrl(commandArguments, environment) {
+  const { values } = parseArgs2({
+    // eslint-disable-next-line id-denylist -- "args" is the name node's parseArgs gives this option.
+    args: commandArguments,
+    options: { "api-url": { type: "string" }, help: { type: "boolean" } }
+  });
+  if (values.help) return { help: true };
+  const apiUrl = await resolveApiUrl(values["api-url"], environment);
+  return apiUrl === null ? null : { apiUrl };
+}
+function webAddress(address) {
+  try {
+    const parsed = new URL(address);
+    return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.href : null;
+  } catch {
+    return null;
+  }
+}
+async function loginCommand(commandArguments, environment) {
+  const read = await readApiUrl(commandArguments, environment);
+  if (!read) return 1;
+  if ("help" in read) {
+    environment.out(loginUsage);
+    return 0;
+  }
+  const { apiUrl } = read;
+  if (apiUrl.startsWith("http://") && !isLocalApiUrl(apiUrl)) {
+    environment.error(
+      `Warning: ${apiUrl} is not encrypted (http://), so the login could be read on the way. Use https:// if you can.`
+    );
+  }
+  try {
+    const request = await startDeviceLogin({
+      fetchImplementation: environment.fetchImplementation,
+      apiUrl,
+      clientName: `ace-kit ${environment.version} on ${environment.hostname}`
+    });
+    const page = webAddress(request.verificationUri);
+    if (!page)
+      throw new DeviceLoginError(
+        "unsupported",
+        "The CMS sent an approval address that isn't a web address, so it was not opened."
+      );
+    environment.out(`Signing in to ${apiUrl}
+`);
+    environment.out(`  1. Go to   ${page}`);
+    environment.out(`  2. Type    ${request.userCode}
+`);
+    environment.out("Check the code on that page matches. Waiting for you to approve it (Ctrl-C to cancel)...");
+    await environment.openBrowser(page).catch(() => void 0);
+    const login = await waitForApproval({
+      fetchImplementation: environment.fetchImplementation,
+      apiUrl,
+      request,
+      sleep: environment.sleep,
+      now: environment.now
+    });
+    await environment.store.write(apiUrl, login);
+    await environment.lastApiUrl.write(apiUrl).catch(() => void 0);
+    environment.out(`
+Signed in as ${login.email}. The login is kept in ${environment.store.description}.`);
+    return 0;
+  } catch (error) {
+    environment.error(`
+${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+async function logoutCommand(commandArguments, environment) {
+  const read = await readApiUrl(commandArguments, environment);
+  if (!read) return 1;
+  if ("help" in read) {
+    environment.out(loginUsage);
+    return 0;
+  }
+  const { apiUrl } = read;
+  const stored = await environment.store.read(apiUrl);
+  if (!stored) {
+    environment.out(`Not signed in to ${apiUrl}.`);
+    return 0;
+  }
+  const ended = await environment.fetchImplementation(`${apiUrl}/auth/logout`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${stored.token}` },
+    signal: AbortSignal.timeout(requestTimeoutMilliseconds3)
+  }).then(
+    (response) => response.ok || response.status === 401,
+    () => false
+  );
+  await environment.store.remove(apiUrl);
+  environment.out(
+    ended ? `Signed out of ${apiUrl}.` : `Forgot the login for ${apiUrl} on this machine, but could not reach the CMS to end it there. It ends by itself after 30 days unused; a super admin can also end it from the Sessions screen.`
+  );
+  return 0;
+}
+async function whoamiCommand(commandArguments, environment) {
+  const read = await readApiUrl(commandArguments, environment);
+  if (!read) return 1;
+  if ("help" in read) {
+    environment.out(loginUsage);
+    return 0;
+  }
+  const { apiUrl } = read;
+  const login = await resolveLogin({
+    apiUrl,
+    variables: environment.variables,
+    store: environment.store,
+    now: environment.now
+  });
+  if (!login) {
+    environment.out(`Not signed in to ${apiUrl}. Run: ace-kit login`);
+    return 1;
+  }
+  try {
+    const response = await environment.fetchImplementation(`${apiUrl}/auth/me`, {
+      headers: { Accept: "application/json", Authorization: `Bearer ${login.token}` },
+      signal: AbortSignal.timeout(requestTimeoutMilliseconds3)
+    });
+    if (response.status === 401) {
+      environment.out(`The login from ${login.source} has ended. Run: ace-kit login`);
+      return 1;
+    }
+    if (!response.ok) {
+      environment.error(`The CMS answered with an error (${response.status}).`);
+      return 1;
+    }
+    const me = await response.json();
+    environment.out(`Signed in to ${apiUrl} as ${String(me.email)}, using the login in ${login.source}.`);
+    return 0;
+  } catch {
+    environment.error(`Could not reach the CMS at ${apiUrl}.`);
+    return 1;
+  }
+}
+
+// src/cli/sync-command.ts
+import { parseArgs as parseArgs3 } from "util";
+
+// src/sections/find-schemas.ts
+import { readdir } from "fs/promises";
+import { join as join3, relative } from "path";
+var schemaFilePattern = /\.schema\.(?:ts|mts|js|mjs)$/;
+var skippedFolders = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".astro",
+  ".react-router",
+  ".output",
+  "coverage"
+]);
+async function findSchemaFiles(root, folder = "src") {
+  const start = join3(root, folder);
+  const found = [];
+  async function walk(directory) {
+    let entries;
+    try {
+      entries = await readdir(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join3(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (!skippedFolders.has(entry.name)) await walk(path);
+      } else if (entry.isFile() && schemaFilePattern.test(entry.name) && !entry.name.endsWith(".d.ts")) {
+        found.push(path);
+      }
+    }
+  }
+  await walk(start);
+  return found.sort((first, second) => {
+    const [firstName, secondName] = [relative(root, first), relative(root, second)];
+    return firstName < secondName ? -1 : firstName > secondName ? 1 : 0;
+  });
+}
+
+// src/sections/load-schemas.ts
+import { relative as relative2 } from "path";
+
+// src/sections/payload.ts
+var handlePattern = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var maximumHandleLength = 64;
+var maximumNameLength = 200;
+var fieldTypes = [
+  "text",
+  "textarea",
+  "number",
+  "checkbox",
+  "select",
+  "image",
+  "richtext",
+  "date",
+  "link"
+];
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isHandle = (value) => typeof value === "string" && value.length <= maximumHandleLength && handlePattern.test(value);
+var handleRule = 'lowercase letters, numbers and hyphens (such as "call-to-action")';
+function checkFields(fields, where, problems) {
+  if (fields === void 0) return;
+  if (!Array.isArray(fields)) {
+    problems.push(`${where}: fields must be a list.`);
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  fields.forEach((field, index) => {
+    if (!isObject(field)) {
+      problems.push(`${where}: field ${index + 1} must be an object with a handle, a label and a type.`);
+      return;
+    }
+    const name = isHandle(field.handle) ? `field "${field.handle}"` : `field ${index + 1}`;
+    if (!isHandle(field.handle)) problems.push(`${where}: ${name} needs a handle of ${handleRule}.`);
+    else if (seen.has(field.handle)) problems.push(`${where}: ${name} is defined twice.`);
+    else seen.add(field.handle);
+    if (typeof field.label !== "string" || field.label.trim() === "" || field.label.length > maximumNameLength) {
+      problems.push(`${where}: ${name} needs a label.`);
+    }
+    if (typeof field.type !== "string" || !fieldTypes.includes(field.type)) {
+      const given = typeof field.type === "string" ? ` "${field.type}"` : "";
+      problems.push(`${where}: ${name} has a type${given} that isn't one of ${fieldTypes.join(", ")}.`);
+    } else if (field.type === "select") {
+      const { options } = field;
+      if (!Array.isArray(options) || options.length === 0 || options.some((option) => typeof option !== "string" || option === "")) {
+        problems.push(`${where}: ${name} is a select, so it needs options: a list of the choices, as text.`);
+      }
+    }
+    if (field.required !== void 0 && typeof field.required !== "boolean") {
+      problems.push(`${where}: ${name} has a required that isn't true or false.`);
+    }
+  });
+}
+function checkSectionDefinition(definition, where = "this section") {
+  const problems = [];
+  if (!isObject(definition)) {
+    return [`${where}: the default export must be the result of defineSection({ ... }).`];
+  }
+  if (!isHandle(definition.handle)) {
+    problems.push(`${where}: needs a handle of ${handleRule}.`);
+  }
+  if (typeof definition.name !== "string" || definition.name.trim() === "" || definition.name.length > maximumNameLength) {
+    problems.push(`${where}: needs a name.`);
+  }
+  checkFields(definition.fields, where, problems);
+  if (definition.blocks !== void 0) {
+    if (!isObject(definition.blocks)) {
+      problems.push(`${where}: blocks must be an object of the kinds of block, by handle.`);
+    } else {
+      for (const [handle, block] of Object.entries(definition.blocks)) {
+        const blockWhere = `${where}, block "${handle}"`;
+        if (!isHandle(handle)) problems.push(`${blockWhere}: the handle must be ${handleRule}.`);
+        if (!isObject(block)) {
+          problems.push(`${blockWhere}: must be an object with a name and fields.`);
+          continue;
+        }
+        if (typeof block.name !== "string" || block.name.trim() === "") problems.push(`${blockWhere}: needs a name.`);
+        checkFields(block.fields, blockWhere, problems);
+      }
+    }
+  }
+  return problems;
+}
+function apiFields(fields) {
+  return (fields ?? []).map((field) => ({
+    handle: field.handle,
+    label: field.label,
+    component_key: field.type,
+    config: {
+      ...field.required ? { required: true } : {},
+      ...field.type === "select" ? { options: [...field.options] } : {}
+    }
+  }));
+}
+function sectionTypesPayload(definitions) {
+  return {
+    sections: definitions.map((definition) => ({
+      handle: definition.handle,
+      name: definition.name,
+      fields: apiFields(definition.fields),
+      blocks: Object.entries(definition.blocks ?? {}).map(([handle, block]) => ({
+        handle,
+        name: block.name,
+        fields: apiFields(block.fields)
+      }))
+    }))
+  };
+}
+
+// src/sections/load-schemas.ts
+async function loadSchemas(files, root, importModule2) {
+  const definitions = [];
+  const problems = [];
+  const handleToFile = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const name = relative2(root, file);
+    let exported;
+    try {
+      const module = await importModule2(file);
+      exported = module.default;
+    } catch (error) {
+      problems.push(`${name}: could not be loaded: ${error instanceof Error ? error.message : String(error)}`);
+      continue;
+    }
+    const fileProblems = checkSectionDefinition(exported, name);
+    if (fileProblems.length > 0) {
+      problems.push(...fileProblems);
+      continue;
+    }
+    const definition = exported;
+    const earlier = handleToFile.get(definition.handle);
+    if (earlier) {
+      problems.push(`${name}: the handle "${definition.handle}" is already used by ${earlier}.`);
+      continue;
+    }
+    handleToFile.set(definition.handle, name);
+    definitions.push({ file, definition });
+  }
+  return { definitions, problems };
+}
+
+// src/sections/sync.ts
+var requestTimeoutMilliseconds4 = 2e4;
+async function readMessage2(response, fallback) {
+  try {
+    const body = await response.json();
+    if (typeof body.error === "string") return body.error;
+  } catch {
+  }
+  return fallback;
+}
+async function syncSectionTypes(options) {
+  const { apiUrl, siteDomain, token, payload, fetchImplementation } = options;
+  const headers = { Accept: "application/json", Authorization: `Bearer ${token}` };
+  let sitesResponse;
+  try {
+    sitesResponse = await fetchImplementation(`${apiUrl}/sites`, {
+      headers,
+      signal: AbortSignal.timeout(requestTimeoutMilliseconds4)
+    });
+  } catch {
+    return { kind: "unreachable" };
+  }
+  if (sitesResponse.status === 401) return { kind: "login-ended" };
+  if (!sitesResponse.ok)
+    return {
+      kind: "rejected",
+      message: await readMessage2(sitesResponse, `The CMS answered with an error (${sitesResponse.status}).`)
+    };
+  const sites = await sitesResponse.json().catch(() => []);
+  const wanted = siteDomain.trim().toLowerCase();
+  const site = sites.find((candidate) => candidate.domain.toLowerCase() === wanted);
+  if (!site)
+    return { kind: "site-not-found", domain: siteDomain, available: sites.map((candidate) => candidate.domain) };
+  let response;
+  try {
+    response = await fetchImplementation(`${apiUrl}/sites/${site.id}/section-types`, {
+      method: "PUT",
+      headers: { ...headers, "Content-Type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(requestTimeoutMilliseconds4)
+    });
+  } catch {
+    return { kind: "unreachable" };
+  }
+  if (response.status === 401) return { kind: "login-ended" };
+  if (response.status === 403) {
+    return {
+      kind: "forbidden",
+      message: "Your account can't change this site's sections: only a site's owners and super admins can."
+    };
+  }
+  if (!response.ok)
+    return {
+      kind: "rejected",
+      message: await readMessage2(response, `The CMS answered with an error (${response.status}).`)
+    };
+  const body = await response.json().catch(() => null);
+  return {
+    kind: "synced",
+    site: { id: site.id, domain: site.domain },
+    sections: (body?.sections ?? []).map((section) => ({
+      handle: section.handle,
+      name: section.name,
+      retired: section.retired_at !== void 0
+    })),
+    warnings: body?.warnings ?? []
+  };
+}
+
+// src/cli/sync-command.ts
+var syncUsage = `ace-kit sync: send the section types your code defines to CMS Ace.
+
+Usage:
+  ace-kit sync [--api-url <address>] [--domain <domain>] [--dir <folder>]
+
+It finds every *.schema.ts file in the folder (src by default), checks them, and makes the CMS's section types for your
+site match. The dev server does this for you whenever a schema file is saved; run it yourself for a one-off sync, or on a
+build server (with ACE_TOKEN set).
+
+Nothing is deleted: a section type, block or field you take out of your code is kept in the CMS, hidden, so the content
+written in it survives. If any schema file can't be loaded, nothing is synced.
+
+Options:
+  --api-url   Where the CMS Ace API lives (default: ACE_API_URL, else http://localhost:8080).
+  --domain    The domain your site has in the CMS (default: ACE_SITE_DOMAIN, else localhost).
+  --dir       The folder to look in (default: src).
+  --help      Show this message.
+`;
+var defaultApiUrl = "http://localhost:8080";
+var isSwitchedOff = (value) => ["false", "off", "no", "0"].includes((value ?? "").trim().toLowerCase());
+async function syncCommand(commandArguments, environment) {
+  const { values } = parseArgs3({
+    // eslint-disable-next-line id-denylist -- "args" is the name node's parseArgs gives this option.
+    args: commandArguments,
+    options: {
+      "api-url": { type: "string" },
+      domain: { type: "string" },
+      dir: { type: "string" },
+      // Set by the dev server, which syncs on its own: it stays quiet when there is nothing to do, and keeps to a
+      // local CMS unless told otherwise.
+      automatic: { type: "boolean" },
+      help: { type: "boolean" }
+    }
+  });
+  if (values.help) {
+    environment.out(syncUsage);
+    return 0;
+  }
+  const automatic = values.automatic === true;
+  if (automatic && isSwitchedOff(environment.variables.ACE_SYNC_SECTIONS)) return 0;
+  let apiUrl;
+  try {
+    apiUrl = normaliseApiUrl(values["api-url"] ?? environment.variables.ACE_API_URL ?? defaultApiUrl);
+  } catch (error) {
+    environment.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+  const siteDomain = values.domain ?? environment.variables.ACE_SITE_DOMAIN ?? "localhost";
+  const aimedAtDevSite = environment.variables.ACE_DEV_SITE_ACTIVE === "1";
+  if (automatic && !aimedAtDevSite && !isLocalApiUrl(apiUrl) && environment.variables.ACE_SYNC_SECTIONS?.trim().toLowerCase() !== "remote") {
+    environment.out(
+      `Section sync is off while ${apiUrl} is a hosted CMS, so a half-written change can't reach a live site. To sync on every save to it anyway, set ACE_SYNC_SECTIONS=remote. (npx ace-kit sync always works.)`
+    );
+    return 0;
+  }
+  const files = await findSchemaFiles(environment.workingDirectory, values.dir ?? "src");
+  if (files.length === 0) {
+    if (!automatic) {
+      environment.out(
+        `No *.schema.ts files found in ${values.dir ?? "src"}, so nothing was synced (syncing none would retire every section).`
+      );
+    }
+    return 0;
+  }
+  const login = await resolveLogin({
+    apiUrl,
+    variables: environment.variables,
+    store: environment.store,
+    now: environment.now
+  });
+  if (!login) {
+    environment.out(`Section sync is waiting for you to sign in. Run: npx ace-kit login --api-url ${apiUrl}`);
+    return automatic ? 0 : 1;
+  }
+  const loaded = await loadSchemas(files, environment.workingDirectory, environment.importModule);
+  if (loaded.problems.length > 0) {
+    for (const problem of loaded.problems) environment.error(problem);
+    environment.error("Nothing was synced, because syncing only some of your sections would retire the rest.");
+    return 1;
+  }
+  const outcome = await syncSectionTypes({
+    apiUrl,
+    siteDomain,
+    token: login.token,
+    payload: sectionTypesPayload(loaded.definitions.map((entry) => entry.definition)),
+    fetchImplementation: environment.fetchImplementation
+  });
+  switch (outcome.kind) {
+    case "synced": {
+      const defined = outcome.sections.filter((section) => !section.retired).map((section) => section.handle);
+      const retired = outcome.sections.filter((section) => section.retired).map((section) => section.handle);
+      environment.out(
+        `Synced ${defined.length} section type${defined.length === 1 ? "" : "s"} (${defined.join(", ")}) to ${outcome.site.domain} (${apiUrl}).` + (retired.length > 0 ? ` No longer in your code, kept but hidden: ${retired.join(", ")}.` : "")
+      );
+      for (const warning of outcome.warnings) environment.error(`Warning: ${warning}`);
+      return 0;
+    }
+    case "login-ended":
+      environment.out(`Your login has ended. Run: npx ace-kit login --api-url ${apiUrl}`);
+      return automatic ? 0 : 1;
+    case "site-not-found":
+      environment.error(
+        `The CMS at ${apiUrl} has no site with the domain "${outcome.domain}" that you can see` + (outcome.available.length > 0 ? ` (your sites: ${outcome.available.join(", ")})` : "") + ". Set ACE_SITE_DOMAIN or pass --domain."
+      );
+      return 1;
+    case "forbidden":
+    case "rejected":
+      environment.error(outcome.message);
+      return 1;
+    case "unreachable":
+      environment.error(`Could not reach the CMS at ${apiUrl}.`);
+      return 1;
+  }
+}
+
+// src/cli/main.ts
+var usage = `ace-kit: tools for sites built on CMS Ace.
+
+Commands:
+  ace-kit generate   Write TypeScript types for your content types.
+  ace-kit sync       Send the section types your code defines to the CMS.
+  ace-kit login      Sign in from the command line (opens the admin app).
+  ace-kit logout     Sign out.
+  ace-kit whoami     Say who you are signed in as.
+
+Run a command with --help for more.
+`;
+async function runCli(commandArguments, environment) {
+  const [command, ...rest] = commandArguments;
+  switch (command) {
+    case "generate":
+      return generateCommand(rest, environment);
+    case "sync":
+      return syncCommand(rest, environment);
+    case "login":
+      return loginCommand(rest, environment);
+    case "logout":
+      return logoutCommand(rest, environment);
+    case "whoami":
+      return whoamiCommand(rest, environment);
+    case "--help":
+    case "-h":
+    case "help":
+    case void 0:
+      environment.out(usage);
+      return command === void 0 ? 1 : 0;
+    default:
+      environment.error(`Unknown command "${command}".
+
+${usage}`);
+      return 1;
+  }
+}
+
+// src/cli/bin.ts
+createRealEnvironment().then((environment) => runCli(process.argv.slice(2), environment)).then(
   (code) => process.exit(code),
   (error) => {
     console.error(error instanceof Error ? error.message : error);