@setzkasten-cms/astro-admin 1.4.2 → 1.5.0

package/dist/api-routes/setup-github-app-credentials.js

@@ -0,0 +1,43 @@
+import {
+  requireAdmin
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
+import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
+import "../chunk-5PIMDP4N.js";
+import "../chunk-45ARVNT3.js";
+import "../chunk-DP6RTINQ.js";
+import "../chunk-TJNJKPUL.js";
+import "../chunk-KH22FJO5.js";
+
+// src/api-routes/setup-github-app-credentials.ts
+var COOKIE_NAME = "sk_app_setup";
+var GET = async ({ cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
+  const raw = cookies.get(COOKIE_NAME)?.value;
+  if (!raw) {
+    return Response.json({ available: false }, { status: 404 });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return Response.json({ available: false, error: "malformed" }, { status: 500 });
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return Response.json({ available: false }, { status: 404 });
+  }
+  return Response.json({ available: true, credentials: parsed });
+};
+var DELETE = async ({ cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
+  cookies.delete(COOKIE_NAME, { path: "/" });
+  return Response.json({ ok: true });
+};
+export {
+  DELETE,
+  GET
+};

package/dist/api-routes/setup-github-app-installed.js

@@ -1,11 +1,25 @@
 import {
   getPublicOrigin
 } from "../chunk-5ZFTG4BW.js";
+import {
+  requireAdmin
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
+import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
+import "../chunk-5PIMDP4N.js";
+import "../chunk-45ARVNT3.js";
+import "../chunk-DP6RTINQ.js";
+import "../chunk-TJNJKPUL.js";
+import "../chunk-KH22FJO5.js";
 
 // src/api-routes/setup-github-app-installed.ts
 var COOKIE_NAME = "sk_app_setup";
 var COOKIE_MAX_AGE = 600;
 var GET = async ({ url, request, cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
   const config = globalThis.__SETZKASTEN_CONFIG__;
   const adminPath = config?.adminPath ?? "/admin";
   const adminUrl = new URL(adminPath, getPublicOrigin(request));
@@ -20,7 +34,14 @@ var GET = async ({ url, request, cookies }) => {
     cookies.set(
       COOKIE_NAME,
       JSON.stringify({ ...data, installationId }),
-      { httpOnly: false, sameSite: "lax", maxAge: COOKIE_MAX_AGE, path: "/" }
+      // C6: same httpOnly hardening as the callback route.
+      {
+        httpOnly: true,
+        secure: import.meta.env.PROD,
+        sameSite: "lax",
+        maxAge: COOKIE_MAX_AGE,
+        path: "/"
+      }
     );
   } catch {
     adminUrl.searchParams.set("github-app-error", "invalid_session");

package/dist/api-routes/setup-github-app-repos.js

@@ -1,10 +1,13 @@
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
-import "../chunk-NKDATSPA.js";
+import "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 

package/dist/api-routes/setup-github-app.d.ts

@@ -8,6 +8,10 @@ import { APIRoute } from 'astro';
  *
  * Credentials werden NICHT persistiert – der Nutzer setzt die env vars manuell.
  * Der POST-Endpunkt validiert die Verbindung durch einen echten Token-Request.
+ *
+ * Both methods are admin-only. Pre-fix the GET let any unauthenticated
+ * visitor probe whether a deployment was configured (reconnaissance for
+ * targeting half-set-up instances).
  */
 declare const GET: APIRoute;
 declare const POST: APIRoute;

package/dist/api-routes/setup-github-app.js

@@ -1,13 +1,30 @@
+import {
+  requireAdmin
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
+import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
+import "../chunk-5PIMDP4N.js";
+import "../chunk-45ARVNT3.js";
+import "../chunk-DP6RTINQ.js";
+import "../chunk-TJNJKPUL.js";
+import "../chunk-KH22FJO5.js";
+
 // src/api-routes/setup-github-app.ts
 import { GitHubAppClient } from "@setzkasten-cms/github-adapter";
-var GET = async () => {
+var GET = async ({ cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
   const appId = process.env.GITHUB_APP_ID;
   const privateKey = process.env.GITHUB_APP_PRIVATE_KEY;
   const installationId = process.env.GITHUB_APP_INSTALLATION_ID;
   const configured = Boolean(appId && privateKey && installationId);
   return Response.json({ configured, ...configured ? { appId } : {} });
 };
-var POST = async ({ request }) => {
+var POST = async ({ request, cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
   let body;
   try {
     body = await request.json();

package/dist/api-routes/updater-register.js

@@ -1,3 +1,7 @@
+import {
+  listAllWebsites
+} from "../chunk-V6IMPVF3.js";
+
 // src/api-routes/updater-register.ts
 var POST = async ({ cookies, request }) => {
   const session = cookies.get("setzkasten_session")?.value;
@@ -34,6 +38,8 @@ var POST = async ({ cookies, request }) => {
     }
   } catch {
   }
+  const websitesResult = await listAllWebsites();
+  const managedWebsites = websitesResult.ok ? websitesResult.value.map((w) => w.id) : [];
   try {
     const response = await fetch(`${updaterUrl}/api/register`, {
       method: "POST",
@@ -45,7 +51,7 @@ var POST = async ({ cookies, request }) => {
         licenseEmail,
         licenseKey,
         telemetryEnabled: true,
-        managedWebsites: []
+        managedWebsites
       }),
       signal: AbortSignal.timeout(5e3)
     });

package/dist/api-routes/webhooks-status.js

@@ -3,11 +3,14 @@ import {
 } from "../chunk-W3QHY5GW.js";
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
-import "../chunk-NKDATSPA.js";
+import "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 

package/dist/api-routes/webhooks-test.js

@@ -1,30 +1,31 @@
-import {
-  signPayload
-} from "../chunk-737TIZRU.js";
 import {
   recordWebhookFire
 } from "../chunk-W3QHY5GW.js";
+import {
+  signPayload
+} from "../chunk-737TIZRU.js";
 import {
   parseSession,
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import {
   resolveStorageConfigForRequest
 } from "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import {
   gateFeature
 } from "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
 import {
   resolveGitHubTokenForRequest
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 
 // src/api-routes/webhooks-test.ts
-import {
-  parseWebhooksFile
-} from "@setzkasten-cms/core";
+import { parseWebhooksFile } from "@setzkasten-cms/core";
 var WEBHOOKS_FILE = (contentPath) => `${contentPath}/_webhooks.json`;
 var TEST_TIMEOUT_MS = 1e4;
 var POST = async ({ request, cookies }) => {

package/dist/api-routes/webhooks.js

@@ -1,10 +1,13 @@
 import {
   parseSession,
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import {
   resolveStorageConfigForRequest
 } from "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import {
   gateFeature
 } from "../chunk-5PIMDP4N.js";
@@ -14,17 +17,14 @@ import {
 } from "../chunk-45ARVNT3.js";
 import {
   resolveGitHubTokenForRequest
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import {
   withTrailers
 } from "../chunk-KH22FJO5.js";
 
 // src/api-routes/webhooks.ts
-import {
-  parseWebhooksFile,
-  validateWebhookConfig
-} from "@setzkasten-cms/core";
+import { parseWebhooksFile, validateWebhookConfig } from "@setzkasten-cms/core";
 var WEBHOOKS_FILE = (contentPath) => `${contentPath}/_webhooks.json`;
 var GET = async ({ request, cookies }) => {
   const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
@@ -82,10 +82,7 @@ var PUT = async ({ request, cookies }) => {
   for (let i = 0; i < body.webhooks.length; i++) {
     const result = validateWebhookConfig(body.webhooks[i]);
     if (!result.ok) {
-      return Response.json(
-        { error: result.error.message, index: i },
-        { status: 400 }
-      );
+      return Response.json({ error: result.error.message, index: i }, { status: 400 });
     }
     if (seenIds.has(result.value.id)) {
       return Response.json(
@@ -127,10 +124,11 @@ var PUT = async ({ request, cookies }) => {
     branch
   };
   if (currentSha) putBody.sha = currentSha;
-  const putRes = await fetch(
-    `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`,
-    { method: "PUT", headers, body: JSON.stringify(putBody) }
-  );
+  const putRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(putBody)
+  });
   if (!putRes.ok) {
     const text = await putRes.text();
     return Response.json({ error: `Webhook write failed: ${text}` }, { status: 502 });

package/dist/api-routes/websites-add.js

@@ -5,13 +5,16 @@ import {
 } from "../chunk-35S35OIV.js";
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
 import {
   resolveConfigRepoToken
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import {
   resolveLicenseTier
 } from "../chunk-TJNJKPUL.js";

package/dist/api-routes/websites-remove.js

@@ -5,13 +5,16 @@ import {
 } from "../chunk-35S35OIV.js";
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
 import {
   resolveConfigRepoToken
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 

package/dist/{chunk-ZQDGGWJP.js → chunk-5KMGSFCZ.js}

@@ -1,12 +1,12 @@
 import {
   readEditorsFileStatus
-} from "./chunk-INIWFKQ3.js";
+} from "./chunk-Q5HV47DW.js";
 import {
   resolveStorageConfig
 } from "./chunk-6UIKVKED.js";
 import {
   resolveConfigRepoToken
-} from "./chunk-NKDATSPA.js";
+} from "./chunk-DP6RTINQ.js";
 
 // src/api-routes/_role-resolver.ts
 import { resolveRoleForUser } from "@setzkasten-cms/core";

package/dist/{chunk-RHJONMLK.js → chunk-CDXCYYQR.js}

@@ -9,7 +9,8 @@ function findNormalizedText(haystack, needle, startFrom) {
   const escaped = normalized.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/ /g, "\\s+");
   const regex = new RegExp(escaped);
   const match = regex.exec(haystack.slice(startFrom));
-  if (match) return { start: startFrom + match.index, end: startFrom + match.index + match[0].length };
+  if (match)
+    return { start: startFrom + match.index, end: startFrom + match.index + match[0].length };
   return null;
 }
 async function patchTemplateForFields(source, sectionKey, fields, repeatedGroups = [], options) {
@@ -64,7 +65,13 @@ const { data: ${varName} } = Astro.props
         }
       }
     }
-    const patched2 = await patchTemplateForFields(modifiedSource, sectionKey, fields, repeatedGroups, options);
+    const patched2 = await patchTemplateForFields(
+      modifiedSource,
+      sectionKey,
+      fields,
+      repeatedGroups,
+      options
+    );
     return removeOldVarDeclarations(patched2, fields, repeatedGroups, varName);
   }
   const existingBindings = /* @__PURE__ */ new Set();
@@ -155,6 +162,9 @@ const { data: ${varName} } = Astro.props
       if (edits.length === editsBefore2) {
         patchStaticListField(source, sectionKey, field, varName, ast, edits);
       }
+      if (edits.length === editsBefore2) {
+        patchRepeatedComponentInstances(source, sectionKey, field, varName, ast, edits);
+      }
       continue;
     }
     const cmsExpr = cmsExpressions.find((e) => e.fieldKey === field.key);
@@ -576,7 +586,7 @@ function patchArrayField(source, sectionKey, field, varName, mapExpressions, edi
       insert: `(${varName}?.${field.key} ?? [])`
     });
   } else {
-    const varMapRegex = new RegExp(`(\\w+)\\.map\\s*\\(`);
+    const varMapRegex = /(\w+)\.map\s*\(/;
     const varMapMatch = exprSource.match(varMapRegex);
     if (varMapMatch) {
       const varRef = varMapMatch[1];
@@ -799,7 +809,7 @@ function collectDynamicClassEdits(innerEdits, source, instances, tmpl, group) {
     if (!tmplPos) continue;
     const fieldTag = field.tag;
     let bestAttrIdx = -1;
-    let bestDist = Infinity;
+    let bestDist = Number.POSITIVE_INFINITY;
     for (let ai = 0; ai < tmplAttrs.length; ai++) {
       const pathParts = tmplAttrs[ai].path.split("/");
       const leafTag = (pathParts[pathParts.length - 1] ?? "").replace(/:\d+$/, "");
@@ -856,6 +866,111 @@ function collectDynamicClassEdits(innerEdits, source, instances, tmpl, group) {
     });
   }
 }
+function patchRepeatedComponentInstances(source, sectionKey, field, varName, ast, edits) {
+  const compName = field.options?.sourceComponent;
+  if (!compName) return;
+  const instanceNodes = [];
+  walkAst(ast, (node) => {
+    if (node.type === "component" && node.name === compName) {
+      instanceNodes.push(node);
+    }
+  });
+  if (instanceNodes.length < 2) return;
+  const ranges = [];
+  for (const node of instanceNodes) {
+    const approxStart = node.position?.start?.offset;
+    if (approxStart == null) return;
+    const searchFrom = Math.max(0, approxStart - 2);
+    const tagStart = source.indexOf(`<${compName}`, searchFrom);
+    if (tagStart === -1 || tagStart > approxStart + 2) return;
+    const tagEnd = findComponentTagEnd(source, tagStart, compName);
+    if (tagEnd === -1) return;
+    ranges.push({ start: tagStart, end: tagEnd, attrs: node.attributes ?? [] });
+  }
+  if (ranges.length < 2) return;
+  const defaultItems = Array.isArray(field.defaultValue) ? field.defaultValue : [];
+  const defaultJson = JSON.stringify(defaultItems);
+  const innerFieldKeys = new Set(
+    (field.options?.arrayItem?.fields ?? []).map((f) => f.key)
+  );
+  const skipPropRegex = /^(class|className|id|style|type|role|aria-|data-)$/;
+  const firstAttrs = ranges[0].attrs;
+  const propLines = [];
+  for (const attr of firstAttrs) {
+    const name = attr.name;
+    if (skipPropRegex.test(name) || name.startsWith("aria-") || name.startsWith("data-")) {
+      const raw = attr.kind === "quoted" ? `${name}="${attr.value}"` : `${name}={${attr.value}}`;
+      propLines.push(raw);
+      continue;
+    }
+    if (innerFieldKeys.has(name)) {
+      propLines.push(`${name}={item.${name}}`);
+    } else {
+      const raw = attr.kind === "quoted" ? `${name}="${attr.value}"` : `${name}={${attr.value}}`;
+      propLines.push(raw);
+    }
+  }
+  propLines.push(`fieldPrefix={\`${sectionKey}.${field.key}.\${_i}\`}`);
+  const propsStr = propLines.map((p) => `    ${p}`).join("\n");
+  const mapExpr = `{(${varName}?.${field.key} ?? ${defaultJson}).map((item, _i) => (
+  <${compName}
+${propsStr}
+  />
+))}`;
+  edits.push({
+    offset: ranges[0].start,
+    deleteCount: ranges[0].end - ranges[0].start,
+    insert: mapExpr
+  });
+  for (let i = 1; i < ranges.length; i++) {
+    const r = ranges[i];
+    let deleteStart = r.start;
+    while (deleteStart > 0 && /[ \t]/.test(source[deleteStart - 1])) deleteStart--;
+    if (deleteStart > 0 && source[deleteStart - 1] === "\n") deleteStart--;
+    edits.push({ offset: deleteStart, deleteCount: r.end - deleteStart, insert: "" });
+  }
+}
+function findComponentTagEnd(source, tagStart, compName) {
+  let i = tagStart + 1;
+  let inQuote = null;
+  let inExpr = 0;
+  while (i < source.length) {
+    const ch = source[i];
+    if (inQuote) {
+      if (ch === inQuote && source[i - 1] !== "\\") inQuote = null;
+      i++;
+      continue;
+    }
+    if (ch === "{") {
+      inExpr++;
+      i++;
+      continue;
+    }
+    if (ch === "}" && inExpr > 0) {
+      inExpr--;
+      i++;
+      continue;
+    }
+    if (inExpr > 0) {
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      inQuote = ch;
+      i++;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === ">") return i + 2;
+    if (ch === ">") {
+      const closing = `</${compName}>`;
+      const closingIdx = source.indexOf(closing, i + 1);
+      if (closingIdx !== -1) return closingIdx + closing.length;
+      return i + 1;
+    }
+    i++;
+  }
+  return -1;
+}
 function patchRepeatedGroups(source, sectionKey, varName, groups) {
   const edits = [];
   for (const group of groups) {
@@ -983,7 +1098,7 @@ ${indent}))}`;
     for (let i = instances.length - 1; i >= 1; i--) {
       const inst = instances[i];
       let deleteStart = inst.start;
-      let deleteEnd = inst.end;
+      const deleteEnd = inst.end;
       while (deleteStart > 0 && /\s/.test(source[deleteStart - 1]) && source[deleteStart - 1] !== "\n") {
         deleteStart--;
       }
@@ -1173,6 +1288,15 @@ function removeOldVarDeclarations(source, fields, repeatedGroups, cmsVarName = "
       }
     }
   }
+  const templatePart0 = source.slice(fmEnd + 3);
+  const fmVarRegex2 = /(?:const|let)\s+(\w+)\s*=\s*\[/g;
+  let m;
+  while ((m = fmVarRegex2.exec(frontmatter)) !== null) {
+    const vName = m[1];
+    if (fieldKeys.has(vName)) continue;
+    const stillUsed = new RegExp(`\\b${vName}\\b`).test(templatePart0);
+    if (!stillUsed) fieldKeys.add(vName);
+  }
   const removals = [];
   const aliases = [];
   const templatePart = source.slice(fmEnd + 3);
@@ -1233,6 +1357,97 @@ function removeOldVarDeclarations(source, fields, repeatedGroups, cmsVarName = "
   frontmatter = frontmatter.replace(/\n{3,}/g, "\n\n");
   return source.slice(0, fmStart + 4) + frontmatter + source.slice(fmEnd);
 }
+function patchChildComponentForFieldPrefix(source, innerFields) {
+  if (source.includes("fieldPrefix?: string") || source.includes("fieldPrefix?:string"))
+    return source;
+  const fmStart = source.indexOf("---");
+  const fmEnd = source.indexOf("---", fmStart + 3);
+  if (fmStart === -1 || fmEnd === -1) return source;
+  let result = source;
+  const interfaceMatch = result.match(/export\s+interface\s+Props\s*\{([\s\S]*?)\}/);
+  if (interfaceMatch) {
+    const ifaceEnd = result.indexOf(interfaceMatch[0]) + interfaceMatch[0].length;
+    const lastPropLine = interfaceMatch[0].slice(0, -1).trimEnd();
+    result = result.slice(0, ifaceEnd - 1) + "\n  fieldPrefix?: string;\n}" + result.slice(ifaceEnd);
+  } else {
+    const closeFm = result.indexOf("---", result.indexOf("---") + 3);
+    result = result.slice(0, closeFm) + "interface Props { fieldPrefix?: string }\n" + result.slice(closeFm);
+  }
+  result = result.replace(/(\bconst\s*\{[^}]*)(}\s*=\s*Astro\.props)/, (_m, before, after) => {
+    if (before.includes("fieldPrefix")) return _m;
+    const trimmed = before.trimEnd();
+    const sep = trimmed.endsWith(",") ? " " : ",\n  ";
+    return `${trimmed}${sep}fieldPrefix${after}`;
+  });
+  const closingFm = result.indexOf("---", result.indexOf("---") + 3);
+  const frontmatterPart = result.slice(0, closingFm + 3);
+  let templatePart = result.slice(closingFm + 3);
+  const scalarFields = innerFields.filter((f) => f.type !== "array");
+  const arrayFields = innerFields.filter((f) => f.type === "array");
+  for (const field of scalarFields) {
+    const propExpr = `{${field.key}}`;
+    if (field.key.toLowerCase().includes("href") || field.key.toLowerCase().includes("link")) {
+      templatePart = templatePart.replace(
+        new RegExp(`href=\\{${field.key}\\}`, "g"),
+        `href={${field.key}} data-sk-field={fieldPrefix ? \`\${fieldPrefix}.${field.key}\` : undefined}`
+      );
+      continue;
+    }
+    const tagWithExprRegex = new RegExp(
+      `(<(?!/)(?:p|span|h[1-6]|div|li|td|th|dt|dd|label|button|a)\\b[^>]*?)(\\/?>)([^<]*\\{${field.key}\\})`,
+      "g"
+    );
+    templatePart = templatePart.replace(tagWithExprRegex, (_m, tagOpen, tagClose, rest) => {
+      if (tagOpen.includes("data-sk-field")) return _m;
+      const attr = ` data-sk-field={fieldPrefix ? \`\${fieldPrefix}.${field.key}\` : undefined}`;
+      return `${tagOpen}${attr}${tagClose}${rest}`;
+    });
+  }
+  for (const field of arrayFields) {
+    const mapParamRegex = new RegExp(`(${field.key}\\.map\\s*\\(\\s*\\(\\s*)(\\w+)(\\s*\\))`, "g");
+    templatePart = templatePart.replace(
+      new RegExp(`(<(?:ul|ol)[^>]*?)(\\/?>)([\\s\\S]*?${field.key}\\.map)`, "g"),
+      (_m, ulOpen, ulClose, rest) => {
+        if (ulOpen.includes("data-sk-field")) return _m;
+        const attr = ` data-sk-field={fieldPrefix ? \`\${fieldPrefix}.${field.key}\` : undefined}`;
+        return `${ulOpen}${attr}${ulClose}${rest}`;
+      }
+    );
+    templatePart = templatePart.replace(mapParamRegex, (_m, before, param, close) => {
+      if (close.trim().startsWith(",")) return _m;
+      return `${before}${param}, _fi${close}`;
+    });
+    const mapBlockRegex = new RegExp(
+      `(${field.key}\\.map\\s*\\([^)]*\\)\\s*=>\\s*\\([\\s\\S]*?)(<(?:span|li|td)\\b)([^>]*?>)([^<]*\\{\\w+\\})`,
+      "g"
+    );
+    templatePart = templatePart.replace(
+      mapBlockRegex,
+      (_m, mapHead, tagOpen, tagClose, content) => {
+        if (tagClose.includes("data-sk-field")) return _m;
+        const attr = ` data-sk-field={fieldPrefix ? \`\${fieldPrefix}.${field.key}.\${_fi}\` : undefined}`;
+        return `${mapHead}${tagOpen}${tagClose.slice(0, -1)}${attr}>${content}`;
+      }
+    );
+  }
+  return frontmatterPart + templatePart;
+}
+function detectChildImports(source, fields) {
+  const result = [];
+  for (const field of fields) {
+    const compName = field.options?.sourceComponent;
+    if (!compName) continue;
+    const innerFields = (field.options?.arrayItem?.fields ?? []).map((f) => ({
+      key: f.key,
+      type: f.type
+    }));
+    const importRegex = new RegExp(`import\\s+${compName}\\s+from\\s+['"]([^'"]+)['"]`);
+    const m = source.match(importRegex);
+    if (!m) continue;
+    result.push({ compName, importPath: m[1], innerFields });
+  }
+  return result;
+}
 function stripTemplateFallbacks(source) {
   const fallbacks = {};
   let result = source;
@@ -1263,5 +1478,7 @@ function stripTemplateFallbacks(source) {
 export {
   patchTemplateForFields,
   convertToSetHtml,
+  patchChildComponentForFieldPrefix,
+  detectChildImports,
   stripTemplateFallbacks
 };

package/dist/{chunk-NKDATSPA.js → chunk-DP6RTINQ.js}

@@ -1,5 +1,5 @@
 // src/api-routes/_github-token.ts
-import { err, authError } from "@setzkasten-cms/core";
+import { authError, err } from "@setzkasten-cms/core";
 import { GitHubAppClient } from "@setzkasten-cms/github-adapter";
 async function resolveConfigRepoToken() {
   const appId = process.env.GITHUB_APP_ID;