@sandboxsonny/ace-kit 0.5.0 → 0.6.0

package/dist/cli.js

@@ -1,1184 +1,19 @@
 #!/usr/bin/env node
 
-// src/cli/environment.ts
-import { spawn } from "child_process";
-import { hostname } from "os";
-import { pathToFileURL } from "url";
-
-// src/auth/file-store.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
-
-// src/auth/login-store.ts
-function normaliseApiUrl(address) {
-  let parsed;
-  try {
-    parsed = new URL(address.trim());
-  } catch {
-    throw new Error(`"${address}" is not a web address. Write the API address like http://localhost:8080.`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`The API address must start with http:// or https:// (it was "${address}").`);
-  }
-  if (parsed.username || parsed.password) {
-    throw new Error("The API address must not contain a username or password.");
-  }
-  return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
-}
-function hasExpired(login, now) {
-  const endsAt = Date.parse(login.expiresAt);
-  return Number.isNaN(endsAt) || endsAt <= now;
-}
-function parseStoredLogin(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const { token, expiresAt, email } = value;
-  if (typeof token !== "string" || token === "" || typeof expiresAt !== "string" || typeof email !== "string")
-    return null;
-  return { token, expiresAt, email };
-}
-
-// src/auth/file-store.ts
-function defaultLoginFile(variables, platform) {
-  if (platform === "win32" && variables.APPDATA) return join(variables.APPDATA, "ace-kit", "credentials.json");
-  const configFolder = variables.XDG_CONFIG_HOME || join(homedir(), ".config");
-  return join(configFolder, "ace-kit", "credentials.json");
-}
-function createFileStore(path) {
-  async function readAll() {
-    let text;
-    try {
-      text = await readFile(path, "utf8");
-    } catch {
-      return {};
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(text);
-    } catch {
-      return {};
-    }
-    const found = {};
-    if (typeof parsed === "object" && parsed !== null) {
-      for (const [address, value] of Object.entries(parsed)) {
-        const login = parseStoredLogin(value);
-        if (login) found[address] = login;
-      }
-    }
-    return found;
-  }
-  async function writeAll(logins) {
-    await mkdir(dirname(path), { recursive: true, mode: 448 });
-    const temporary = `${path}.${process.pid}.tmp`;
-    await writeFile(temporary, `${JSON.stringify(logins, null, 2)}
-`, { mode: 384 });
-    await rename(temporary, path);
-  }
-  return {
-    description: path,
-    async read(apiUrl) {
-      return (await readAll())[normaliseApiUrl(apiUrl)] ?? null;
-    },
-    async write(apiUrl, login) {
-      const logins = await readAll();
-      logins[normaliseApiUrl(apiUrl)] = login;
-      await writeAll(logins);
-    },
-    async remove(apiUrl) {
-      const logins = await readAll();
-      delete logins[normaliseApiUrl(apiUrl)];
-      await writeAll(logins);
-    }
-  };
-}
-
-// src/auth/keychain-store.ts
-var keychainService = "ace-kit";
-function createKeychainStore(run) {
-  async function read(apiUrl) {
-    const found = await run("security", [
-      "find-generic-password",
-      "-s",
-      keychainService,
-      "-a",
-      normaliseApiUrl(apiUrl),
-      "-w"
-    ]);
-    if (found.exitCode !== 0) return null;
-    try {
-      return parseStoredLogin(JSON.parse(Buffer.from(found.stdout.trim(), "base64").toString("utf8")));
-    } catch {
-      return null;
-    }
-  }
-  return {
-    description: "the macOS Keychain",
-    read,
-    async write(apiUrl, login) {
-      const account = normaliseApiUrl(apiUrl);
-      if (/["\\\s]/.test(account)) throw new Error("That API address can't be kept in the Keychain.");
-      const secret = Buffer.from(JSON.stringify(login), "utf8").toString("base64");
-      await run(
-        "security",
-        ["-i"],
-        `add-generic-password -s "${keychainService}" -a "${account}" -l "Ace Kit login" -w "${secret}" -U
-`
-      );
-      const kept = await read(apiUrl);
-      if (kept?.token !== login.token) throw new Error("The login could not be saved in the macOS Keychain.");
-    },
-    async remove(apiUrl) {
-      await run("security", ["delete-generic-password", "-s", keychainService, "-a", normaliseApiUrl(apiUrl)]);
-    }
-  };
-}
-
-// src/auth/choose-store.ts
-async function chooseLoginStore(options) {
-  const file = createFileStore(defaultLoginFile(options.variables, options.platform));
-  if (options.platform !== "darwin" || options.variables.ACE_KIT_CREDENTIALS === "file") return file;
-  try {
-    await options.run("security", ["help"]);
-    return createKeychainStore(options.run);
-  } catch {
-    return file;
-  }
-}
-
-// src/auth/last-api-url.ts
-import { mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join2 } from "path";
-function defaultLastApiUrlFile(variables, platform) {
-  return join2(dirname2(defaultLoginFile(variables, platform)), "last-api-url");
-}
-function createLastApiUrl(path) {
-  return {
-    async read() {
-      try {
-        return normaliseApiUrl((await readFile2(path, "utf8")).trim());
-      } catch {
-        return null;
-      }
-    },
-    async write(apiUrl) {
-      await mkdir2(dirname2(path), { recursive: true, mode: 448 });
-      const temporary = `${path}.${process.pid}.tmp`;
-      await writeFile2(temporary, `${normaliseApiUrl(apiUrl)}
-`, { mode: 384 });
-      await rename2(temporary, path);
-    }
-  };
-}
-
-// src/cli/version.ts
-var aceKitVersion = true ? "0.5.0" : "development";
-
-// src/cli/environment.ts
-var runCommand = (command, commandArguments, input) => new Promise((resolve2, reject) => {
-  const child = spawn(command, commandArguments, { stdio: ["pipe", "pipe", "ignore"] });
-  let stdout = "";
-  child.stdout.on("data", (chunk) => {
-    stdout += chunk.toString("utf8");
-  });
-  child.on("error", reject);
-  child.on("close", (exitCode) => resolve2({ exitCode: exitCode ?? 1, stdout }));
-  child.stdin.on("error", () => {
-  });
-  child.stdin.end(input ?? "");
-});
-function browserCommand(platform, address) {
-  if (platform === "darwin") return { command: "open", commandArguments: [address] };
-  if (platform === "win32") return { command: "rundll32", commandArguments: ["url.dll,FileProtocolHandler", address] };
-  return { command: "xdg-open", commandArguments: [address] };
-}
-async function openBrowser(platform, address) {
-  const { command, commandArguments } = browserCommand(platform, address);
-  await new Promise((resolve2) => {
-    const child = spawn(command, commandArguments, { stdio: "ignore", detached: true });
-    child.on("error", () => resolve2());
-    child.on("spawn", () => {
-      child.unref();
-      resolve2();
-    });
-  });
-}
-async function importModule(path) {
-  try {
-    return await import(pathToFileURL(path).href);
-  } catch (error) {
-    if (error.code === "ERR_UNKNOWN_FILE_EXTENSION") {
-      throw new Error(
-        "this version of Node can't run TypeScript files. Use Node 22.18 or newer, or write the schema in .js.",
-        { cause: error }
-      );
-    }
-    throw error;
-  }
-}
-async function createRealEnvironment() {
-  try {
-    process.loadEnvFile(".env");
-  } catch {
-  }
-  const variables = { ...process.env };
-  const platform = process.platform;
-  return {
-    variables,
-    platform,
-    hostname: hostname(),
-    version: aceKitVersion,
-    out: (text) => process.stdout.write(`${text}
-`),
-    error: (text) => console.error(text),
-    fetchImplementation: (input, init) => fetch(input, init),
-    sleep: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
-    now: Date.now,
-    workingDirectory: process.cwd(),
-    importModule,
-    openBrowser: (address) => openBrowser(platform, address),
-    store: await chooseLoginStore({ platform, variables, run: runCommand }),
-    lastApiUrl: createLastApiUrl(defaultLastApiUrlFile(variables, platform))
-  };
-}
-
-// src/cli/generate-command.ts
-import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3, resolve } from "path";
-import { parseArgs } from "util";
-
-// src/client/errors.ts
-var AcePreviewExpiredError = class extends Error {
-  constructor() {
-    super("The preview link has expired.");
-    this.name = "AcePreviewExpiredError";
-  }
-};
-var AceUnavailableError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AceUnavailableError";
-  }
-};
-
-// src/client/create-client.ts
-var requestTimeoutMilliseconds = 5e3;
-var maximumCachedAnswers = 500;
-function createAceClient({
-  apiUrl,
-  siteDomain,
-  cacheSeconds = 5,
-  fetchImplementation = (input, init) => fetch(input, init),
-  now = Date.now
-}) {
-  const cache = /* @__PURE__ */ new Map();
-  function forgetSomeAnswers() {
-    for (const [path, answer] of cache) if (answer.expiresAt <= now()) cache.delete(path);
-    for (const path of cache.keys()) {
-      if (cache.size < maximumCachedAnswers) break;
-      cache.delete(path);
-    }
-  }
-  async function get(path, options = { cached: true }) {
-    const cached = options.cached ? cache.get(path) : void 0;
-    if (cached && cached.expiresAt > now()) return cached.value;
-    let response;
-    try {
-      response = await fetchImplementation(`${apiUrl.replace(/\/+$/, "")}${path}`, {
-        headers: { Accept: "application/json", "X-Ace-Site-Domain": siteDomain, "X-Forwarded-Host": siteDomain },
-        signal: AbortSignal.timeout(requestTimeoutMilliseconds)
-      });
-    } catch {
-      throw new AceUnavailableError("Could not reach the CMS.");
-    }
-    let value = null;
-    if (response.status === 404) {
-      const reply = await response.json().catch(() => ({}));
-      if (reply.error === "no site for this domain") {
-        throw new AceUnavailableError(`The CMS has no site with the domain "${siteDomain}".`);
-      }
-    } else if (response.status === 403 && !options.cached) {
-      throw new AcePreviewExpiredError();
-    } else if (response.ok) {
-      value = await response.json().catch(() => {
-        throw new AceUnavailableError("The CMS sent a reply that could not be read.");
-      });
-    } else {
-      throw new AceUnavailableError(`The CMS answered with an error (${response.status}).`);
-    }
-    if (options.cached && cacheSeconds > 0) {
-      if (cache.size >= maximumCachedAnswers) forgetSomeAnswers();
-      cache.set(path, { expiresAt: now() + cacheSeconds * 1e3, value });
-    }
-    return value;
-  }
-  return {
-    /**
-     * One live entry of a content type, by its handle; null if the site has no such entry. With a preview token the
-     * entry the token was made for comes back with its draft applied (never cached); a token that has run out throws
-     * AcePreviewExpiredError.
-     */
-    async getEntry(contentTypeHandle, handle, options = {}) {
-      const path = `/public/entries/${encodeURIComponent(handle)}`;
-      const entry = options.previewToken ? await get(`${path}?preview=${encodeURIComponent(options.previewToken)}`, {
-        cached: false
-      }) : await get(path);
-      return entry && entry.content_type_handle === contentTypeHandle ? entry : null;
-    },
-    /** The live entries of a content type, newest first. */
-    async getEntries(contentTypeHandle, options = {}) {
-      const query = new URLSearchParams({ content_type: contentTypeHandle });
-      if (options.limit) query.set("limit", String(options.limit));
-      return await get(`/public/entries?${query}`) ?? [];
-    },
-    /** One of the site's navigation menus by its handle, with every link worked out; null if the site has none. */
-    getMenu(handle) {
-      return get(`/public/menus/${encodeURIComponent(handle)}`);
-    },
-    /** What the site's content types and fields are, which is what type generation reads. */
-    async getContentTypes() {
-      return await get("/public/content-types") ?? [];
-    }
-  };
-}
-
-// src/helpers/generate-types.ts
-var quote = (text) => JSON.stringify(text);
-function typeOfField(field) {
-  switch (field.component_key) {
-    case "text":
-    case "textarea":
-      return { type: "string" };
-    case "number":
-      return { type: "number" };
-    case "checkbox":
-      return { type: "boolean" };
-    case "select": {
-      const options = field.config?.options ?? [];
-      return { type: options.length > 0 ? options.map(quote).join(" | ") : "string" };
-    }
-    case "image":
-      return { type: "AceImageData", uses: "AceImageData" };
-    case "richtext":
-      return { type: "AceRichTextDocument", uses: "AceRichTextDocument" };
-    case "date":
-      return { type: "string" };
-    case "link":
-      return { type: "AceLinkData", uses: "AceLinkData" };
-    case "sections":
-      return { type: "AceSection[]", uses: "AceSection" };
-    default:
-      return { type: "unknown" };
-  }
-}
-function generateTypes(contentTypes, packageName2, source) {
-  const used = /* @__PURE__ */ new Set();
-  const blocks = contentTypes.map((contentType) => {
-    const lines = contentType.fields.map((field) => {
-      const { type, uses } = typeOfField(field);
-      if (uses) used.add(uses);
-      const optional = field.config?.required === true ? "" : "?";
-      return `      /** ${field.label.replace(/\*\//g, "* /")} */
-      ${quote(field.handle)}${optional}: ${type};`;
-    });
-    const body = lines.length > 0 ? `{
-${lines.join("\n")}
-    }` : "Record<string, never>";
-    return `    /** ${contentType.name.replace(/\*\//g, "* /")} */
-    ${quote(contentType.handle)}: ${body};`;
-  });
-  const imports = used.size > 0 ? `import type { ${[...used].sort().join(", ")} } from ${quote(packageName2)};
-
-` : "";
-  return `// Generated by ace-kit from ${source}. Do not edit: run \`ace-kit generate\` to update it.
-${imports}declare module ${quote(packageName2)} {
-  interface AceContentTypes {
-${blocks.join("\n")}
-  }
-}
-
-export {};
-`;
-}
-
-// src/helpers/package-name.ts
-var packageName = "@sandboxsonny/ace-kit";
-
-// src/helpers/platform.ts
-var hostedApiUrl = "https://api.ace-cms.co.uk";
-function domainFromSite(site) {
-  const trimmed = site.trim();
-  if (trimmed.includes("://")) {
-    try {
-      return new URL(trimmed).hostname.toLowerCase();
-    } catch {
-      return trimmed.toLowerCase();
-    }
-  }
-  return trimmed.replace(/\/.*$/, "").replace(/:\d+$/, "").toLowerCase();
-}
-
-// src/cli/generate-command.ts
-var generateUsage = `ace-kit generate: write TypeScript types for your CMS Ace content types.
-
-Usage:
-  ace-kit generate [--site <domain>] [--api-url <address>] [--out <file>]
-
-Options:
-  --site      The domain your site has in the CMS, e.g. example.com (or set ACE_SITE_DOMAIN). --domain means the same.
-  --api-url   Where the CMS Ace API lives (or set ACE_API_URL). Only for a CMS on your own machine.
-  --out       Where to write the types (default: src/ace-kit.generated.d.ts).
-  --help      Show this message.
-`;
-async function generateCommand(commandArguments, environment) {
-  const { values } = parseArgs({
-    // eslint-disable-next-line id-denylist -- "args" is the name node's parseArgs gives this option.
-    args: commandArguments,
-    options: {
-      "api-url": { type: "string" },
-      site: { type: "string" },
-      domain: { type: "string" },
-      out: { type: "string" },
-      help: { type: "boolean" }
-    }
-  });
-  if (values.help) {
-    environment.out(generateUsage);
-    return 0;
-  }
-  const apiUrl = values["api-url"] ?? environment.variables.ACE_API_URL ?? hostedApiUrl;
-  const given = values.site ?? values.domain ?? environment.variables.ACE_SITE_DOMAIN;
-  if (!given) {
-    environment.error("Give the site's domain: --site, or ACE_SITE_DOMAIN.");
-    return 1;
-  }
-  const siteDomain = domainFromSite(given);
-  const client = createAceClient({
-    apiUrl,
-    siteDomain,
-    cacheSeconds: 0,
-    fetchImplementation: environment.fetchImplementation
-  });
-  const contentTypes = await client.getContentTypes();
-  const file = resolve(values.out ?? "src/ace-kit.generated.d.ts");
-  await mkdir3(dirname3(file), { recursive: true });
-  await writeFile3(file, generateTypes(contentTypes, packageName, siteDomain));
-  environment.out(
-    `Wrote types for ${contentTypes.length} content type${contentTypes.length === 1 ? "" : "s"} to ${file}.`
-  );
-  return 0;
-}
-
-// src/cli/login-commands.ts
-import { parseArgs as parseArgs2 } from "util";
-
-// src/auth/device-login.ts
-var DeviceLoginError = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.name = "DeviceLoginError";
-    this.reason = reason;
-  }
-};
-var requestTimeoutMilliseconds2 = 15e3;
-var maximumFailures = 5;
-async function post(dependencies, apiUrl, path, body) {
-  return dependencies.fetchImplementation(`${apiUrl}${path}`, {
-    method: "POST",
-    headers: { Accept: "application/json", "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-    signal: AbortSignal.timeout(requestTimeoutMilliseconds2)
-  });
-}
-async function readMessage(response) {
-  try {
-    const body = await response.json();
-    if (typeof body.error === "string") return body.error;
-  } catch {
-  }
-  return `The CMS answered with an error (${response.status}).`;
-}
-async function startDeviceLogin(dependencies) {
-  let response;
-  try {
-    response = await post(dependencies, dependencies.apiUrl, "/auth/device", { client_name: dependencies.clientName });
-  } catch {
-    throw new DeviceLoginError("unavailable", `Could not reach the CMS at ${dependencies.apiUrl}.`);
-  }
-  if (response.status === 503) throw new DeviceLoginError("unsupported", await readMessage(response));
-  if (response.status === 429)
-    throw new DeviceLoginError("unavailable", "Too many attempts. Wait a minute and try again.");
-  if (response.status === 404) {
-    throw new DeviceLoginError(
-      "unsupported",
-      `${dependencies.apiUrl} does not offer command-line sign-in. Is it a CMS Ace API, and is it up to date?`
-    );
-  }
-  if (!response.ok) throw new DeviceLoginError("unavailable", await readMessage(response));
-  const body = await response.json().catch(() => null);
-  const { device_code, user_code, verification_uri, expires_in, interval } = body ?? {};
-  if (typeof device_code !== "string" || typeof user_code !== "string" || typeof verification_uri !== "string" || typeof expires_in !== "number" || typeof interval !== "number") {
-    throw new DeviceLoginError(
-      "unavailable",
-      "The CMS sent a reply this version of ace-kit can't read. Update ace-kit."
-    );
-  }
-  return {
-    deviceCode: device_code,
-    userCode: user_code,
-    verificationUri: verification_uri,
-    expiresInSeconds: expires_in,
-    intervalSeconds: Math.max(1, interval)
-  };
-}
-async function waitForApproval(dependencies) {
-  const { apiUrl, request, sleep, now } = dependencies;
-  const deadline = now() + request.expiresInSeconds * 1e3;
-  let intervalSeconds = request.intervalSeconds;
-  let failures = 0;
-  for (; ; ) {
-    await sleep(intervalSeconds * 1e3);
-    if (now() > deadline)
-      throw new DeviceLoginError("expired", "The code ran out before it was approved. Run ace-kit login again.");
-    let response;
-    try {
-      response = await post(dependencies, apiUrl, "/auth/device/token", { device_code: request.deviceCode });
-    } catch {
-      failures += 1;
-      if (failures >= maximumFailures)
-        throw new DeviceLoginError("unavailable", `Lost contact with the CMS at ${apiUrl}.`);
-      continue;
-    }
-    if (response.status === 404) {
-      throw new DeviceLoginError("expired", "The CMS no longer knows this login. Run ace-kit login again.");
-    }
-    if (response.status === 429) {
-      intervalSeconds += 5;
-      continue;
-    }
-    if (!response.ok) {
-      failures += 1;
-      if (failures >= maximumFailures) throw new DeviceLoginError("unavailable", await readMessage(response));
-      continue;
-    }
-    failures = 0;
-    const body = await response.json().catch(() => null);
-    switch (body?.status) {
-      case "pending":
-        continue;
-      case "slow_down":
-        intervalSeconds += 5;
-        continue;
-      case "denied":
-        throw new DeviceLoginError("denied", "The login was turned down in the admin app.");
-      case "expired":
-        throw new DeviceLoginError("expired", "The code ran out before it was approved. Run ace-kit login again.");
-      case "approved": {
-        const user = body.user;
-        if (typeof body.token !== "string" || typeof body.expires_at !== "string" || typeof user?.email !== "string") {
-          throw new DeviceLoginError("unavailable", "The CMS approved the login but sent a reply that can't be read.");
-        }
-        return { token: body.token, expiresAt: body.expires_at, email: user.email };
-      }
-      default:
-        throw new DeviceLoginError(
-          "unavailable",
-          "The CMS sent a reply this version of ace-kit can't read. Update ace-kit."
-        );
-    }
-  }
-}
-
-// src/auth/resolve-login.ts
-async function resolveLogin(options) {
-  const fromEnvironment = options.variables.ACE_TOKEN?.trim();
-  if (fromEnvironment) return { token: fromEnvironment, source: "the ACE_TOKEN setting" };
-  const stored = await options.store.read(options.apiUrl);
-  if (!stored || hasExpired(stored, options.now())) return null;
-  return { token: stored.token, email: stored.email, source: options.store.description };
-}
-
-// src/cli/api-url.ts
-async function resolveApiUrl(fromOption, environment) {
-  const address = fromOption ?? environment.variables.ACE_API_URL ?? await environment.lastApiUrl.read() ?? hostedApiUrl;
-  try {
-    return normaliseApiUrl(address);
-  } catch (error) {
-    environment.error(error instanceof Error ? error.message : String(error));
-    return null;
-  }
-}
-function isLocalApiUrl(apiUrl) {
-  return ["localhost", "127.0.0.1", "[::1]"].includes(new URL(apiUrl).hostname);
-}
-
-// src/cli/login-commands.ts
-var loginUsage = `ace-kit login: sign in to CMS Ace from the command line.
-
-Usage:
-  ace-kit login  [--api-url <address>]    Sign in. Opens the admin app, where you type the code shown here.
-  ace-kit logout [--api-url <address>]    Sign out, and forget the login kept on this machine.
-  ace-kit whoami [--api-url <address>]    Say who you are signed in as.
-
-Options:
-  --api-url   Where the CMS Ace API lives (or set ACE_API_URL, in the environment or a .env file).
-  --help      Show this message.
-
-The login is kept in the macOS Keychain, or in a file only you can read on other systems. On a build server,
-where nobody can approve a login in a browser, set ACE_TOKEN instead.
-`;
-var requestTimeoutMilliseconds3 = 15e3;
-async function readApiUrl(commandArguments, environment) {
-  const { values } = parseArgs2({
-    // eslint-disable-next-line id-denylist -- "args" is the name node's parseArgs gives this option.
-    args: commandArguments,
-    options: { "api-url": { type: "string" }, help: { type: "boolean" } }
-  });
-  if (values.help) return { help: true };
-  const apiUrl = await resolveApiUrl(values["api-url"], environment);
-  return apiUrl === null ? null : { apiUrl };
-}
-function webAddress(address) {
-  try {
-    const parsed = new URL(address);
-    return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.href : null;
-  } catch {
-    return null;
-  }
-}
-async function loginCommand(commandArguments, environment) {
-  const read = await readApiUrl(commandArguments, environment);
-  if (!read) return 1;
-  if ("help" in read) {
-    environment.out(loginUsage);
-    return 0;
-  }
-  const { apiUrl } = read;
-  if (apiUrl.startsWith("http://") && !isLocalApiUrl(apiUrl)) {
-    environment.error(
-      `Warning: ${apiUrl} is not encrypted (http://), so the login could be read on the way. Use https:// if you can.`
-    );
-  }
-  try {
-    const request = await startDeviceLogin({
-      fetchImplementation: environment.fetchImplementation,
-      apiUrl,
-      clientName: `ace-kit ${environment.version} on ${environment.hostname}`
-    });
-    const page = webAddress(request.verificationUri);
-    if (!page)
-      throw new DeviceLoginError(
-        "unsupported",
-        "The CMS sent an approval address that isn't a web address, so it was not opened."
-      );
-    environment.out(`Signing in to ${apiUrl}
-`);
-    environment.out(`  1. Go to   ${page}`);
-    environment.out(`  2. Type    ${request.userCode}
-`);
-    environment.out("Check the code on that page matches. Waiting for you to approve it (Ctrl-C to cancel)...");
-    await environment.openBrowser(page).catch(() => void 0);
-    const login = await waitForApproval({
-      fetchImplementation: environment.fetchImplementation,
-      apiUrl,
-      request,
-      sleep: environment.sleep,
-      now: environment.now
-    });
-    await environment.store.write(apiUrl, login);
-    await environment.lastApiUrl.write(apiUrl).catch(() => void 0);
-    environment.out(`
-Signed in as ${login.email}. The login is kept in ${environment.store.description}.`);
-    return 0;
-  } catch (error) {
-    environment.error(`
-${error instanceof Error ? error.message : String(error)}`);
-    return 1;
-  }
-}
-async function logoutCommand(commandArguments, environment) {
-  const read = await readApiUrl(commandArguments, environment);
-  if (!read) return 1;
-  if ("help" in read) {
-    environment.out(loginUsage);
-    return 0;
-  }
-  const { apiUrl } = read;
-  const stored = await environment.store.read(apiUrl);
-  if (!stored) {
-    environment.out(`Not signed in to ${apiUrl}.`);
-    return 0;
-  }
-  const ended = await environment.fetchImplementation(`${apiUrl}/auth/logout`, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${stored.token}` },
-    signal: AbortSignal.timeout(requestTimeoutMilliseconds3)
-  }).then(
-    (response) => response.ok || response.status === 401,
-    () => false
-  );
-  await environment.store.remove(apiUrl);
-  environment.out(
-    ended ? `Signed out of ${apiUrl}.` : `Forgot the login for ${apiUrl} on this machine, but could not reach the CMS to end it there. It ends by itself after 30 days unused; a super admin can also end it from the Sessions screen.`
+// src/cli/bin.ts
+var [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
+if (major < 22 || major === 22 && minor < 12) {
+  console.error(
+    `ace-kit needs Node 22.12 or newer, and this is Node ${process.versions.node}. If you use a version manager (mise, nvm, fnm), check which version it picks in this folder.`
   );
-  return 0;
-}
-async function whoamiCommand(commandArguments, environment) {
-  const read = await readApiUrl(commandArguments, environment);
-  if (!read) return 1;
-  if ("help" in read) {
-    environment.out(loginUsage);
-    return 0;
-  }
-  const { apiUrl } = read;
-  const login = await resolveLogin({
-    apiUrl,
-    variables: environment.variables,
-    store: environment.store,
-    now: environment.now
-  });
-  if (!login) {
-    environment.out(`Not signed in to ${apiUrl}. Run: ace-kit login`);
-    return 1;
-  }
-  try {
-    const response = await environment.fetchImplementation(`${apiUrl}/auth/me`, {
-      headers: { Accept: "application/json", Authorization: `Bearer ${login.token}` },
-      signal: AbortSignal.timeout(requestTimeoutMilliseconds3)
-    });
-    if (response.status === 401) {
-      environment.out(`The login from ${login.source} has ended. Run: ace-kit login`);
-      return 1;
-    }
-    if (!response.ok) {
-      environment.error(`The CMS answered with an error (${response.status}).`);
-      return 1;
-    }
-    const me = await response.json();
-    environment.out(`Signed in to ${apiUrl} as ${String(me.email)}, using the login in ${login.source}.`);
-    return 0;
-  } catch {
-    environment.error(`Could not reach the CMS at ${apiUrl}.`);
-    return 1;
-  }
+  process.exit(1);
 }
-
-// src/cli/sync-command.ts
-import { parseArgs as parseArgs3 } from "util";
-
-// src/sections/find-schemas.ts
-import { readdir } from "fs/promises";
-import { join as join3, relative } from "path";
-var schemaFilePattern = /\.schema\.(?:ts|mts|js|mjs)$/;
-var skippedFolders = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  ".astro",
-  ".react-router",
-  ".output",
-  "coverage"
-]);
-async function findSchemaFiles(root, folder = "src") {
-  const start = join3(root, folder);
-  const found = [];
-  async function walk(directory) {
-    let entries;
-    try {
-      entries = await readdir(directory, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const path = join3(directory, entry.name);
-      if (entry.isDirectory()) {
-        if (!skippedFolders.has(entry.name)) await walk(path);
-      } else if (entry.isFile() && schemaFilePattern.test(entry.name) && !entry.name.endsWith(".d.ts")) {
-        found.push(path);
-      }
-    }
-  }
-  await walk(start);
-  return found.sort((first, second) => {
-    const [firstName, secondName] = [relative(root, first), relative(root, second)];
-    return firstName < secondName ? -1 : firstName > secondName ? 1 : 0;
-  });
-}
-
-// src/sections/load-schemas.ts
-import { relative as relative2 } from "path";
-
-// src/sections/payload.ts
-var handlePattern = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var maximumHandleLength = 64;
-var maximumNameLength = 200;
-var fieldTypes = [
-  "text",
-  "textarea",
-  "number",
-  "checkbox",
-  "select",
-  "image",
-  "richtext",
-  "date",
-  "link"
-];
-var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isHandle = (value) => typeof value === "string" && value.length <= maximumHandleLength && handlePattern.test(value);
-var handleRule = 'lowercase letters, numbers and hyphens (such as "call-to-action")';
-function checkFields(fields, where, problems) {
-  if (fields === void 0) return;
-  if (!Array.isArray(fields)) {
-    problems.push(`${where}: fields must be a list.`);
-    return;
-  }
-  const seen = /* @__PURE__ */ new Set();
-  fields.forEach((field, index) => {
-    if (!isObject(field)) {
-      problems.push(`${where}: field ${index + 1} must be an object with a handle, a label and a type.`);
-      return;
-    }
-    const name = isHandle(field.handle) ? `field "${field.handle}"` : `field ${index + 1}`;
-    if (!isHandle(field.handle)) problems.push(`${where}: ${name} needs a handle of ${handleRule}.`);
-    else if (seen.has(field.handle)) problems.push(`${where}: ${name} is defined twice.`);
-    else seen.add(field.handle);
-    if (typeof field.label !== "string" || field.label.trim() === "" || field.label.length > maximumNameLength) {
-      problems.push(`${where}: ${name} needs a label.`);
-    }
-    if (typeof field.type !== "string" || !fieldTypes.includes(field.type)) {
-      const given = typeof field.type === "string" ? ` "${field.type}"` : "";
-      problems.push(`${where}: ${name} has a type${given} that isn't one of ${fieldTypes.join(", ")}.`);
-    } else if (field.type === "select") {
-      const { options } = field;
-      if (!Array.isArray(options) || options.length === 0 || options.some((option) => typeof option !== "string" || option === "")) {
-        problems.push(`${where}: ${name} is a select, so it needs options: a list of the choices, as text.`);
-      }
-    }
-    if (field.required !== void 0 && typeof field.required !== "boolean") {
-      problems.push(`${where}: ${name} has a required that isn't true or false.`);
-    }
-  });
+try {
+  const { createRealEnvironment } = await import("./environment-T5K5ZJ2M.js");
+  const { runCli } = await import("./main-YRQQWLHX.js");
+  const environment = await createRealEnvironment();
+  process.exit(await runCli(process.argv.slice(2), environment));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
 }
-function checkSectionDefinition(definition, where = "this section") {
-  const problems = [];
-  if (!isObject(definition)) {
-    return [`${where}: the default export must be the result of defineSection({ ... }).`];
-  }
-  if (!isHandle(definition.handle)) {
-    problems.push(`${where}: needs a handle of ${handleRule}.`);
-  }
-  if (typeof definition.name !== "string" || definition.name.trim() === "" || definition.name.length > maximumNameLength) {
-    problems.push(`${where}: needs a name.`);
-  }
-  checkFields(definition.fields, where, problems);
-  if (definition.blocks !== void 0) {
-    if (!isObject(definition.blocks)) {
-      problems.push(`${where}: blocks must be an object of the kinds of block, by handle.`);
-    } else {
-      for (const [handle, block] of Object.entries(definition.blocks)) {
-        const blockWhere = `${where}, block "${handle}"`;
-        if (!isHandle(handle)) problems.push(`${blockWhere}: the handle must be ${handleRule}.`);
-        if (!isObject(block)) {
-          problems.push(`${blockWhere}: must be an object with a name and fields.`);
-          continue;
-        }
-        if (typeof block.name !== "string" || block.name.trim() === "") problems.push(`${blockWhere}: needs a name.`);
-        checkFields(block.fields, blockWhere, problems);
-      }
-    }
-  }
-  return problems;
-}
-function apiFields(fields) {
-  return (fields ?? []).map((field) => ({
-    handle: field.handle,
-    label: field.label,
-    component_key: field.type,
-    config: {
-      ...field.required ? { required: true } : {},
-      ...field.type === "select" ? { options: [...field.options] } : {}
-    }
-  }));
-}
-function sectionTypesPayload(definitions) {
-  return {
-    sections: definitions.map((definition) => ({
-      handle: definition.handle,
-      name: definition.name,
-      fields: apiFields(definition.fields),
-      blocks: Object.entries(definition.blocks ?? {}).map(([handle, block]) => ({
-        handle,
-        name: block.name,
-        fields: apiFields(block.fields)
-      }))
-    }))
-  };
-}
-
-// src/sections/load-schemas.ts
-async function loadSchemas(files, root, importModule2) {
-  const definitions = [];
-  const problems = [];
-  const handleToFile = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    const name = relative2(root, file);
-    let exported;
-    try {
-      const module = await importModule2(file);
-      exported = module.default;
-    } catch (error) {
-      problems.push(`${name}: could not be loaded: ${error instanceof Error ? error.message : String(error)}`);
-      continue;
-    }
-    const fileProblems = checkSectionDefinition(exported, name);
-    if (fileProblems.length > 0) {
-      problems.push(...fileProblems);
-      continue;
-    }
-    const definition = exported;
-    const earlier = handleToFile.get(definition.handle);
-    if (earlier) {
-      problems.push(`${name}: the handle "${definition.handle}" is already used by ${earlier}.`);
-      continue;
-    }
-    handleToFile.set(definition.handle, name);
-    definitions.push({ file, definition });
-  }
-  return { definitions, problems };
-}
-
-// src/sections/sync.ts
-var requestTimeoutMilliseconds4 = 2e4;
-async function readMessage2(response, fallback) {
-  try {
-    const body = await response.json();
-    if (typeof body.error === "string") return body.error;
-  } catch {
-  }
-  return fallback;
-}
-async function syncSectionTypes(options) {
-  const { apiUrl, siteDomain, token, payload, fetchImplementation } = options;
-  const headers = { Accept: "application/json", Authorization: `Bearer ${token}` };
-  let sitesResponse;
-  try {
-    sitesResponse = await fetchImplementation(`${apiUrl}/sites`, {
-      headers,
-      signal: AbortSignal.timeout(requestTimeoutMilliseconds4)
-    });
-  } catch {
-    return { kind: "unreachable" };
-  }
-  if (sitesResponse.status === 401) return { kind: "login-ended" };
-  if (!sitesResponse.ok)
-    return {
-      kind: "rejected",
-      message: await readMessage2(sitesResponse, `The CMS answered with an error (${sitesResponse.status}).`)
-    };
-  const sites = await sitesResponse.json().catch(() => []);
-  const wanted = siteDomain.trim().toLowerCase();
-  const site = sites.find((candidate) => candidate.domain.toLowerCase() === wanted);
-  if (!site)
-    return { kind: "site-not-found", domain: siteDomain, available: sites.map((candidate) => candidate.domain) };
-  let response;
-  try {
-    response = await fetchImplementation(`${apiUrl}/sites/${site.id}/section-types`, {
-      method: "PUT",
-      headers: { ...headers, "Content-Type": "application/json" },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(requestTimeoutMilliseconds4)
-    });
-  } catch {
-    return { kind: "unreachable" };
-  }
-  if (response.status === 401) return { kind: "login-ended" };
-  if (response.status === 403) {
-    return {
-      kind: "forbidden",
-      message: "Your account can't change this site's sections: only a site's owners and super admins can."
-    };
-  }
-  if (!response.ok)
-    return {
-      kind: "rejected",
-      message: await readMessage2(response, `The CMS answered with an error (${response.status}).`)
-    };
-  const body = await response.json().catch(() => null);
-  return {
-    kind: "synced",
-    site: { id: site.id, domain: site.domain },
-    sections: (body?.sections ?? []).map((section) => ({
-      handle: section.handle,
-      name: section.name,
-      retired: section.retired_at !== void 0
-    })),
-    warnings: body?.warnings ?? []
-  };
-}
-
-// src/cli/sync-command.ts
-var syncUsage = `ace-kit sync: send the section types your code defines to CMS Ace.
-
-Usage:
-  ace-kit sync [--site <domain>] [--api-url <address>] [--dir <folder>]
-
-It finds every *.schema.ts file in the folder (src by default), checks them, and makes the CMS's section types for your
-site match. The dev server does this for you whenever a schema file is saved; run it yourself for a one-off sync, or on a
-build server (with ACE_TOKEN set).
-
-Nothing is deleted: a section type, block or field you take out of your code is kept in the CMS, hidden, so the content
-written in it survives. If any schema file can't be loaded, nothing is synced.
-
-Options:
-  --site      The domain your site has in the CMS, e.g. example.com (default: ACE_SITE_DOMAIN, else localhost).
-              (--domain means the same.)
-  --api-url   Where the CMS Ace API lives (default: ACE_API_URL, else the hosted CMS Ace). Only for a CMS on your own machine.
-  --dir       The folder to look in (default: src).
-  --help      Show this message.
-`;
-var isSwitchedOff = (value) => ["false", "off", "no", "0"].includes((value ?? "").trim().toLowerCase());
-async function syncCommand(commandArguments, environment) {
-  const { values } = parseArgs3({
-    // eslint-disable-next-line id-denylist -- "args" is the name node's parseArgs gives this option.
-    args: commandArguments,
-    options: {
-      "api-url": { type: "string" },
-      site: { type: "string" },
-      domain: { type: "string" },
-      dir: { type: "string" },
-      // Set by the dev server, which syncs on its own: it stays quiet when there is nothing to do, and keeps to a
-      // local CMS unless told otherwise.
-      automatic: { type: "boolean" },
-      help: { type: "boolean" }
-    }
-  });
-  if (values.help) {
-    environment.out(syncUsage);
-    return 0;
-  }
-  const automatic = values.automatic === true;
-  if (automatic && isSwitchedOff(environment.variables.ACE_SYNC_SECTIONS)) return 0;
-  let apiUrl;
-  try {
-    apiUrl = normaliseApiUrl(values["api-url"] ?? environment.variables.ACE_API_URL ?? hostedApiUrl);
-  } catch (error) {
-    environment.error(error instanceof Error ? error.message : String(error));
-    return 1;
-  }
-  const given = values.site ?? values.domain ?? environment.variables.ACE_SITE_DOMAIN;
-  const siteDomain = given ? domainFromSite(given) : "localhost";
-  const aimedAtDevSite = environment.variables.ACE_DEV_SITE_ACTIVE === "1";
-  if (automatic && !aimedAtDevSite && !isLocalApiUrl(apiUrl) && environment.variables.ACE_SYNC_SECTIONS?.trim().toLowerCase() !== "remote") {
-    environment.out(
-      `Section sync is off while ${apiUrl} is a hosted CMS, so a half-written change can't reach a live site. To sync on every save to it anyway, set ACE_SYNC_SECTIONS=remote. (npx ace-kit sync always works.)`
-    );
-    return 0;
-  }
-  const files = await findSchemaFiles(environment.workingDirectory, values.dir ?? "src");
-  if (files.length === 0) {
-    if (!automatic) {
-      environment.out(
-        `No *.schema.ts files found in ${values.dir ?? "src"}, so nothing was synced (syncing none would retire every section).`
-      );
-    }
-    return 0;
-  }
-  const login = await resolveLogin({
-    apiUrl,
-    variables: environment.variables,
-    store: environment.store,
-    now: environment.now
-  });
-  if (!login) {
-    environment.out(`Section sync is waiting for you to sign in. Run: npx ace-kit login --api-url ${apiUrl}`);
-    return automatic ? 0 : 1;
-  }
-  const loaded = await loadSchemas(files, environment.workingDirectory, environment.importModule);
-  if (loaded.problems.length > 0) {
-    for (const problem of loaded.problems) environment.error(problem);
-    environment.error("Nothing was synced, because syncing only some of your sections would retire the rest.");
-    return 1;
-  }
-  const outcome = await syncSectionTypes({
-    apiUrl,
-    siteDomain,
-    token: login.token,
-    payload: sectionTypesPayload(loaded.definitions.map((entry) => entry.definition)),
-    fetchImplementation: environment.fetchImplementation
-  });
-  switch (outcome.kind) {
-    case "synced": {
-      const defined = outcome.sections.filter((section) => !section.retired).map((section) => section.handle);
-      const retired = outcome.sections.filter((section) => section.retired).map((section) => section.handle);
-      environment.out(
-        `Synced ${defined.length} section type${defined.length === 1 ? "" : "s"} (${defined.join(", ")}) to ${outcome.site.domain} (${apiUrl}).` + (retired.length > 0 ? ` No longer in your code, kept but hidden: ${retired.join(", ")}.` : "")
-      );
-      for (const warning of outcome.warnings) environment.error(`Warning: ${warning}`);
-      return 0;
-    }
-    case "login-ended":
-      environment.out(`Your login has ended. Run: npx ace-kit login --api-url ${apiUrl}`);
-      return automatic ? 0 : 1;
-    case "site-not-found":
-      environment.error(
-        `The CMS at ${apiUrl} has no site with the domain "${outcome.domain}" that you can see` + (outcome.available.length > 0 ? ` (your sites: ${outcome.available.join(", ")})` : "") + ". Set ACE_SITE_DOMAIN or pass --site."
-      );
-      return 1;
-    case "forbidden":
-    case "rejected":
-      environment.error(outcome.message);
-      return 1;
-    case "unreachable":
-      environment.error(`Could not reach the CMS at ${apiUrl}.`);
-      return 1;
-  }
-}
-
-// src/cli/main.ts
-var usage = `ace-kit: tools for sites built on CMS Ace.
-
-Commands:
-  ace-kit generate   Write TypeScript types for your content types.
-  ace-kit sync       Send the section types your code defines to the CMS.
-  ace-kit login      Sign in from the command line (opens the admin app).
-  ace-kit logout     Sign out.
-  ace-kit whoami     Say who you are signed in as.
-
-Run a command with --help for more.
-`;
-async function runCli(commandArguments, environment) {
-  const [command, ...rest] = commandArguments;
-  switch (command) {
-    case "generate":
-      return generateCommand(rest, environment);
-    case "sync":
-      return syncCommand(rest, environment);
-    case "login":
-      return loginCommand(rest, environment);
-    case "logout":
-      return logoutCommand(rest, environment);
-    case "whoami":
-      return whoamiCommand(rest, environment);
-    case "--help":
-    case "-h":
-    case "help":
-    case void 0:
-      environment.out(usage);
-      return command === void 0 ? 1 : 0;
-    default:
-      environment.error(`Unknown command "${command}".
-
-${usage}`);
-      return 1;
-  }
-}
-
-// src/cli/bin.ts
-createRealEnvironment().then((environment) => runCli(process.argv.slice(2), environment)).then(
-  (code) => process.exit(code),
-  (error) => {
-    console.error(error instanceof Error ? error.message : error);
-    process.exit(1);
-  }
-);