@shapio/cms 0.5.6 → 0.5.8

package/dist/config.d.ts

@@ -1,2 +1,2 @@
-import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, I as isHookError, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices } from "./public-BO_wneBL.js";
+import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, I as isHookError, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices } from "./public-COKbHR-N.js";
 export { AfterHook, AfterHookContext, AfterHookEvent, BeforeHook, BeforeHookContext, BeforeHookEvent, ContentReadEntry, ContentReadOptions, ContentReadService, CustomServices, EXTENSION_CONTRACT_VERSION, EnqueueOptions, EntryData, ExtensionHostConfig, ExtensionJobHandler, ExtensionJobService, ExtensionRoute, ExtensionRouteOptions, ExtensionServices, ExtensionSite, HookEntry, HookError, HookEvent, HookModel, JobHandlerContext, MediaReferenceService, MediaUsage, ModelHooks, ServiceFactory, ServiceFactoryContext, ShapioConfig, ShapioServices, ThemeDefinition, ThemeTokens, defineConfig, isHookError };

package/dist/config.js

@@ -1,39 +1,2 @@
-//#region src/extensions/public.ts
-/**
-* The project extension contract (ADR 0009), imported by project authors from `@shapio/cms/config`:
-*
-* ```ts
-* import { defineConfig } from '@shapio/cms/config';
-* export const config = defineConfig({ hooks: { article: { beforePublish: (ctx) => { ... } } } });
-* ```
-*
-* Extensions are code: changing them needs a restart of Shapio (never a rebuild). Content models are never
-* configured here; they change live in the admin. This file has no runtime imports from the server, so a
-* config that imports it stays cheap to load.
-*
-* Stability: everything exported here follows semver with `EXTENSION_CONTRACT_VERSION`; Shapio's database
-* tables (reachable through `trx`) are internal and may change in any release.
-*/
-const EXTENSION_CONTRACT_VERSION = 1;
-/** Identity helper for completion and type checking in `shapio.config.ts`. */
-const defineConfig = (config) => config;
-const HOOK_ERROR_BRAND = Symbol.for("shapio.HookError");
-/**
-* Thrown by a `before*` hook to reject a write: the API answers 422 with code `HOOK_REJECTED`, this message
-* and the details. Recognised by a brand, not `instanceof`, so a copy of this class loaded from another
-* path (a project's own `node_modules`) works the same.
-*/
-var HookError = class extends Error {
-	details;
-	[HOOK_ERROR_BRAND] = true;
-	constructor(message, details) {
-		super(message);
-		this.name = "HookError";
-		this.details = details;
-	}
-};
-const isHookError = (error) => typeof error === "object" && error !== null && error[HOOK_ERROR_BRAND] === true;
-//#endregion
+import { i as isHookError, n as HookError, r as defineConfig, t as EXTENSION_CONTRACT_VERSION } from "./public-B57h4F7Y.js";
 export { EXTENSION_CONTRACT_VERSION, HookError, defineConfig, isHookError };
-
-//# sourceMappingURL=config.js.map

package/dist/contentDisposition-DOL2Xt0l.js

@@ -0,0 +1,90 @@
+import { randomBytes } from "node:crypto";
+//#region src/media/keys.ts
+const MAX_FILENAME_LENGTH = 200;
+const MAX_SLUG_LENGTH = 80;
+/** Characters Windows, macOS or shells treat specially, plus every control character. */
+const UNSAFE_FILENAME_CHARACTERS = /[\u0000-\u001f\u007f<>:"/\\|?*]+/g;
+const STORAGE_KEY_PATTERN = new RegExp(`^(public|private)(/[A-Za-z0-9][A-Za-z0-9._-]{0,127}){2,5}$`);
+const splitExtension = (name) => {
+	const dot = name.lastIndexOf(".");
+	return dot > 0 && name.length - dot <= 16 ? {
+		stem: name.slice(0, dot),
+		extension: name.slice(dot)
+	} : {
+		stem: name,
+		extension: ""
+	};
+};
+/**
+* The display name kept for an upload: the last path segment, NFC-normalised, without control or
+* path characters, at most 200 characters with the extension preserved. Never used as a storage path.
+*/
+const sanitizeFilename = (input) => {
+	const cleaned = (input.split(/[/\\]/).pop() ?? "").normalize("NFC").replace(UNSAFE_FILENAME_CHARACTERS, "-").replace(/\s+/g, " ").replace(/^[\s.-]+|[\s.]+$/g, "");
+	if (cleaned === "") return "file";
+	if (cleaned.length <= MAX_FILENAME_LENGTH) return cleaned;
+	const { stem, extension } = splitExtension(cleaned);
+	return `${stem.slice(0, MAX_FILENAME_LENGTH - extension.length)}${extension}`;
+};
+/** An ASCII, lower-case, URL-safe version of a file name for storage keys: `Été 2026.JPG` → `ete-2026.jpg`. */
+const toStorageSlug = (filename) => {
+	const { stem, extension } = splitExtension(filename);
+	const slugify = (value) => value.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	const slugStem = slugify(stem).slice(0, MAX_SLUG_LENGTH) || "file";
+	const slugExtension = slugify(extension).slice(0, 15);
+	return slugExtension ? `${slugStem}.${slugExtension}` : slugStem;
+};
+/** Relative keys only, made of safe segments under a visibility prefix: no `..`, no absolute paths. */
+const isValidStorageKey = (key) => STORAGE_KEY_PATTERN.test(key);
+/**
+* `public/<assetId>/<token>/<slug>`. The visibility prefix lets an operator expose only `public/` through a
+* CDN or bucket policy; the random token gives every upload (and replacement) a new, cacheable URL.
+*/
+const buildAssetKey = (visibility, assetId, filename) => `${visibility}/${assetId}/${randomBytes(12).toString("hex")}/${toStorageSlug(filename)}`;
+/** Variants sit beside their original: `public/<assetId>/<token>/v/<name>.<extension>`. */
+const buildVariantKey = (assetKey, name, extension) => `${assetKey.slice(0, assetKey.lastIndexOf("/"))}/v/${name}.${extension}`;
+/** The same key under the other visibility prefix (visibility changes move objects). */
+const withVisibility = (key, visibility) => `${visibility}${key.slice(key.indexOf("/"))}`;
+const visibilityOfKey = (key) => {
+	const prefix = key.slice(0, key.indexOf("/"));
+	return prefix === "public" || prefix === "private" ? prefix : void 0;
+};
+/** Percent-encodes each segment for use in a URL path. */
+const encodeKeyPath = (key) => key.split("/").map(encodeURIComponent).join("/");
+//#endregion
+//#region src/media/errors.ts
+/** Thrown by adapters when a key has no object, so callers can tell "missing" from "storage is down". */
+var ObjectNotFoundError = class extends Error {
+	constructor(key, options) {
+		super(`No stored object at ${key}`, options);
+		this.name = "ObjectNotFoundError";
+	}
+};
+var InvalidStorageKeyError = class extends Error {
+	constructor(key) {
+		super(`Not a valid media storage key: ${JSON.stringify(key)}`);
+		this.name = "InvalidStorageKeyError";
+	}
+};
+//#endregion
+//#region src/media/contentDisposition.ts
+/**
+* A Content-Disposition value that names the file safely: an ASCII fallback plus the RFC 5987 UTF-8 form,
+* so quotes, semicolons or line breaks in a filename can never inject header parameters.
+*/
+const contentDisposition = (filename, type = "inline") => {
+	return `${type}; filename="${filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+};
+/** Types a browser only ever displays passively: opening one directly cannot run script. */
+const PASSIVE_INLINE_TYPE = /^(image\/(png|jpeg|gif|webp|avif|bmp|tiff|x-icon|vnd\.microsoft\.icon)|video\/.+|audio\/.+)$/;
+/**
+* Content-Disposition to store on an object in a bucket. Public objects can be served straight from the
+* bucket or a CDN, where Shapio's sandboxing headers are absent; anything that could run as a page there
+* (SVG, HTML, XML, PDF...) is stored as an attachment, so opening it downloads it. `<img>` tags still show
+* an SVG, since embedding ignores Content-Disposition.
+*/
+const bucketContentDisposition = (contentType) => PASSIVE_INLINE_TYPE.test(contentType.toLowerCase()) ? void 0 : "attachment";
+//#endregion
+export { buildAssetKey as a, isValidStorageKey as c, withVisibility as d, ObjectNotFoundError as i, sanitizeFilename as l, contentDisposition as n, buildVariantKey as o, InvalidStorageKeyError as r, encodeKeyPath as s, bucketContentDisposition as t, visibilityOfKey as u };
+
+//# sourceMappingURL=contentDisposition-DOL2Xt0l.js.map

package/dist/contentDisposition-DOL2Xt0l.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentDisposition-DOL2Xt0l.js","names":[],"sources":["../src/media/keys.ts","../src/media/errors.ts","../src/media/contentDisposition.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\n\nexport type MediaVisibility = 'public' | 'private';\n\nconst MAX_FILENAME_LENGTH = 200;\nconst MAX_SLUG_LENGTH = 80;\n/** Characters Windows, macOS or shells treat specially, plus every control character. */\n// eslint-disable-next-line no-control-regex\nconst UNSAFE_FILENAME_CHARACTERS = /[\\u0000-\\u001f\\u007f<>:\"/\\\\|?*]+/g;\nconst SEGMENT = '[A-Za-z0-9][A-Za-z0-9._-]{0,127}';\nconst STORAGE_KEY_PATTERN = new RegExp(`^(public|private)(/${SEGMENT}){2,5}$`);\n\nconst splitExtension = (name: string): { stem: string; extension: string } => {\n  const dot = name.lastIndexOf('.');\n  return dot > 0 && name.length - dot <= 16\n    ? { stem: name.slice(0, dot), extension: name.slice(dot) }\n    : { stem: name, extension: '' };\n};\n\n/**\n * The display name kept for an upload: the last path segment, NFC-normalised, without control or\n * path characters, at most 200 characters with the extension preserved. Never used as a storage path.\n */\nexport const sanitizeFilename = (input: string): string => {\n  const base = input.split(/[/\\\\]/).pop() ?? '';\n  const cleaned = base\n    .normalize('NFC')\n    .replace(UNSAFE_FILENAME_CHARACTERS, '-')\n    .replace(/\\s+/g, ' ')\n    .replace(/^[\\s.-]+|[\\s.]+$/g, '');\n  if (cleaned === '') {\n    return 'file';\n  }\n  if (cleaned.length <= MAX_FILENAME_LENGTH) {\n    return cleaned;\n  }\n  const { stem, extension } = splitExtension(cleaned);\n  return `${stem.slice(0, MAX_FILENAME_LENGTH - extension.length)}${extension}`;\n};\n\n/** An ASCII, lower-case, URL-safe version of a file name for storage keys: `Été 2026.JPG` → `ete-2026.jpg`. */\nexport const toStorageSlug = (filename: string): string => {\n  const { stem, extension } = splitExtension(filename);\n  const slugify = (value: string) =>\n    value\n      .normalize('NFKD')\n      .replace(/[̀-ͯ]/g, '')\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, '-')\n      .replace(/^-+|-+$/g, '');\n  const slugStem = slugify(stem).slice(0, MAX_SLUG_LENGTH) || 'file';\n  const slugExtension = slugify(extension).slice(0, 15);\n  return slugExtension ? `${slugStem}.${slugExtension}` : slugStem;\n};\n\n/** Relative keys only, made of safe segments under a visibility prefix: no `..`, no absolute paths. */\nexport const isValidStorageKey = (key: string): boolean => STORAGE_KEY_PATTERN.test(key);\n\n/**\n * `public/<assetId>/<token>/<slug>`. The visibility prefix lets an operator expose only `public/` through a\n * CDN or bucket policy; the random token gives every upload (and replacement) a new, cacheable URL.\n */\nexport const buildAssetKey = (visibility: MediaVisibility, assetId: string, filename: string): string =>\n  `${visibility}/${assetId}/${randomBytes(12).toString('hex')}/${toStorageSlug(filename)}`;\n\n/** Variants sit beside their original: `public/<assetId>/<token>/v/<name>.<extension>`. */\nexport const buildVariantKey = (assetKey: string, name: string, extension: string): string =>\n  `${assetKey.slice(0, assetKey.lastIndexOf('/'))}/v/${name}.${extension}`;\n\n/** The same key under the other visibility prefix (visibility changes move objects). */\nexport const withVisibility = (key: string, visibility: MediaVisibility): string =>\n  `${visibility}${key.slice(key.indexOf('/'))}`;\n\nexport const visibilityOfKey = (key: string): MediaVisibility | undefined => {\n  const prefix = key.slice(0, key.indexOf('/'));\n  return prefix === 'public' || prefix === 'private' ? prefix : undefined;\n};\n\n/** Percent-encodes each segment for use in a URL path. */\nexport const encodeKeyPath = (key: string): string => key.split('/').map(encodeURIComponent).join('/');\n","/** Thrown by adapters when a key has no object, so callers can tell \"missing\" from \"storage is down\". */\nexport class ObjectNotFoundError extends Error {\n  constructor(key: string, options?: ErrorOptions) {\n    super(`No stored object at ${key}`, options);\n    this.name = 'ObjectNotFoundError';\n  }\n}\n\nexport class InvalidStorageKeyError extends Error {\n  constructor(key: string) {\n    super(`Not a valid media storage key: ${JSON.stringify(key)}`);\n    this.name = 'InvalidStorageKeyError';\n  }\n}\n","/**\n * A Content-Disposition value that names the file safely: an ASCII fallback plus the RFC 5987 UTF-8 form,\n * so quotes, semicolons or line breaks in a filename can never inject header parameters.\n */\nexport const contentDisposition = (filename: string, type: 'inline' | 'attachment' = 'inline'): string => {\n  const ascii = filename.replace(/[^\\x20-\\x7e]/g, '_').replace(/[\"\\\\]/g, '_');\n  return `${type}; filename=\"${ascii}\"; filename*=UTF-8''${encodeURIComponent(filename)}`;\n};\n\n/** Types a browser only ever displays passively: opening one directly cannot run script. */\nconst PASSIVE_INLINE_TYPE =\n  /^(image\\/(png|jpeg|gif|webp|avif|bmp|tiff|x-icon|vnd\\.microsoft\\.icon)|video\\/.+|audio\\/.+)$/;\n\n/**\n * Content-Disposition to store on an object in a bucket. Public objects can be served straight from the\n * bucket or a CDN, where Shapio's sandboxing headers are absent; anything that could run as a page there\n * (SVG, HTML, XML, PDF...) is stored as an attachment, so opening it downloads it. `<img>` tags still show\n * an SVG, since embedding ignores Content-Disposition.\n */\nexport const bucketContentDisposition = (contentType: string): string | undefined =>\n  PASSIVE_INLINE_TYPE.test(contentType.toLowerCase()) ? undefined : 'attachment';\n"],"mappings":";;AAIA,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;;AAGxB,MAAM,6BAA6B;AAEnC,MAAM,sBAAsB,IAAI,OAAO,4DAAsC;AAE7E,MAAM,kBAAkB,SAAsD;CAC5E,MAAM,MAAM,KAAK,YAAY,GAAG;CAChC,OAAO,MAAM,KAAK,KAAK,SAAS,OAAO,KACnC;EAAE,MAAM,KAAK,MAAM,GAAG,GAAG;EAAG,WAAW,KAAK,MAAM,GAAG;CAAE,IACvD;EAAE,MAAM;EAAM,WAAW;CAAG;AAClC;;;;;AAMA,MAAa,oBAAoB,UAA0B;CAEzD,MAAM,WADO,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,KAAK,GAAA,CAExC,UAAU,KAAK,CAAC,CAChB,QAAQ,4BAA4B,GAAG,CAAC,CACxC,QAAQ,QAAQ,GAAG,CAAC,CACpB,QAAQ,qBAAqB,EAAE;CAClC,IAAI,YAAY,IACd,OAAO;CAET,IAAI,QAAQ,UAAU,qBACpB,OAAO;CAET,MAAM,EAAE,MAAM,cAAc,eAAe,OAAO;CAClD,OAAO,GAAG,KAAK,MAAM,GAAG,sBAAsB,UAAU,MAAM,IAAI;AACpE;;AAGA,MAAa,iBAAiB,aAA6B;CACzD,MAAM,EAAE,MAAM,cAAc,eAAe,QAAQ;CACnD,MAAM,WAAW,UACf,MACG,UAAU,MAAM,CAAC,CACjB,QAAQ,UAAU,EAAE,CAAC,CACrB,YAAY,CAAC,CACb,QAAQ,eAAe,GAAG,CAAC,CAC3B,QAAQ,YAAY,EAAE;CAC3B,MAAM,WAAW,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,eAAe,KAAK;CAC5D,MAAM,gBAAgB,QAAQ,SAAS,CAAC,CAAC,MAAM,GAAG,EAAE;CACpD,OAAO,gBAAgB,GAAG,SAAS,GAAG,kBAAkB;AAC1D;;AAGA,MAAa,qBAAqB,QAAyB,oBAAoB,KAAK,GAAG;;;;;AAMvF,MAAa,iBAAiB,YAA6B,SAAiB,aAC1E,GAAG,WAAW,GAAG,QAAQ,GAAG,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK,EAAE,GAAG,cAAc,QAAQ;;AAGvF,MAAa,mBAAmB,UAAkB,MAAc,cAC9D,GAAG,SAAS,MAAM,GAAG,SAAS,YAAY,GAAG,CAAC,EAAE,KAAK,KAAK,GAAG;;AAG/D,MAAa,kBAAkB,KAAa,eAC1C,GAAG,aAAa,IAAI,MAAM,IAAI,QAAQ,GAAG,CAAC;AAE5C,MAAa,mBAAmB,QAA6C;CAC3E,MAAM,SAAS,IAAI,MAAM,GAAG,IAAI,QAAQ,GAAG,CAAC;CAC5C,OAAO,WAAW,YAAY,WAAW,YAAY,SAAS,KAAA;AAChE;;AAGA,MAAa,iBAAiB,QAAwB,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;;;;AC9ErG,IAAa,sBAAb,cAAyC,MAAM;CAC7C,YAAY,KAAa,SAAwB;EAC/C,MAAM,uBAAuB,OAAO,OAAO;EAC3C,KAAK,OAAO;CACd;AACF;AAEA,IAAa,yBAAb,cAA4C,MAAM;CAChD,YAAY,KAAa;EACvB,MAAM,kCAAkC,KAAK,UAAU,GAAG,GAAG;EAC7D,KAAK,OAAO;CACd;AACF;;;;;;;ACTA,MAAa,sBAAsB,UAAkB,OAAgC,aAAqB;CAExG,OAAO,GAAG,KAAK,cADD,SAAS,QAAQ,iBAAiB,GAAG,CAAC,CAAC,QAAQ,UAAU,GACtC,EAAE,sBAAsB,mBAAmB,QAAQ;AACtF;;AAGA,MAAM,sBACJ;;;;;;;AAQF,MAAa,4BAA4B,gBACvC,oBAAoB,KAAK,YAAY,YAAY,CAAC,IAAI,KAAA,IAAY"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as ServiceFactoryContext, B as Principal, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, G as ComponentDefinition, H as DB, I as isHookError, J as ModelDefinition, K as DataType, L as KnownVersions, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, R as PermissionEvaluator, S as HookError, T as JobHandlerContext, U as OutboxEvents, V as Database, W as ContentData, Y as SchemaChange, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, q as JsonValue, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices, z as PermissionExecutor } from "./public-BO_wneBL.js";
+import { A as ServiceFactoryContext, B as Principal, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, G as ComponentDefinition, H as DB, I as isHookError, J as ModelDefinition, K as DataType, L as KnownVersions, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, R as PermissionEvaluator, S as HookError, T as JobHandlerContext, U as OutboxEvents, V as Database, W as ContentData, Y as PlannedChange, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, q as JsonValue, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices, z as PermissionExecutor } from "./public-COKbHR-N.js";
 import { FastifyBaseLogger, FastifyInstance } from "fastify";
 import { Kysely, Selectable, Transaction } from "kysely";
 import { Static, Type } from "typebox";
@@ -66,7 +66,10 @@ declare const configSchema: Type.TObject<{
   SHUTDOWN_TIMEOUT_MS: Type.TInteger;
   /**
    * Days to keep finished bookkeeping: succeeded jobs, dispatched outbox events, after-hook run records,
-   * resolved content health findings.
+   * resolved content health findings, finished webhook deliveries and deployment runs (each webhook's newest
+   * delivery and each connection's newest and live run are always kept), and credentials after they expire
+   * (admin sessions, invitations, password resets, app-user refresh tokens, login codes, email confirmations,
+   * preview tokens) or setup tokens after they are used.
    */
   RETENTION_DAYS: Type.TInteger;
   /** Days after which an untouched draft (or unpublished changes) shows up in the Inbox. */
@@ -645,7 +648,7 @@ type ContentStep = {
 } | {
   kind: 'convert';
   ownerId: string;
-  change: SchemaChange;
+  change: PlannedChange;
   locations: ValueLocation[];
 };
 type IndexStep = {
@@ -665,7 +668,10 @@ type FollowUpStep = IndexStep | {
   kind: 'releaseUnique';
   fieldId: string;
 } |
-/** Deletes a removed locale's heads, revisions and unique-registry rows (content ports). */
+/**
+ * Deletes a removed locale's heads, revisions and unique-registry rows, and moves non-localized entries stored
+ * in it to the default locale (content ports).
+ */
 {
   kind: 'purgeLocale';
   code: string;
@@ -734,6 +740,8 @@ type ContentMigrationPort = {
 type StepImpact = {
   affectedHeads: number;
   invalidHeads?: number;
+  /** The distinct entries those failing heads belong to (a person counts entries; the check counts heads). */
+  invalidEntries?: number;
   /** A type change Shapio cannot convert: live entries holding a value it drops (absent inside components). */
   droppedEntries?: number;
 };
@@ -745,8 +753,17 @@ type ContentImpactSource = {
    * `steps` are the plan's content steps (a check's outcome can depend on another step, e.g. a dropped value).
    */
   assess: (step: ContentStep, steps: readonly ContentStep[]) => Promise<StepImpact>;
-  /** Heads stored in one locale (impact of deleting it). */
-  countLocaleHeads: (code: string) => Promise<number>;
+  /** What deleting a locale would do to content. */
+  countLocaleRemoval: (code: string) => Promise<LocaleRemovalImpact>;
+};
+/** The content impact of deleting a locale (shown before acknowledging, and on the result). */
+type LocaleRemovalImpact = {
+  /** Heads of localized models stored in the locale: purged. */
+  affectedHeads: number;
+  /** Entries that exist only in the locale: deleted. */
+  deletedEntries: number;
+  /** Entries of non-localized models stored in the locale: moved to the default locale, not deleted. */
+  movedEntries: number;
 };
 type SchemaContentPorts = {
   migration: ContentMigrationPort;

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as loadConfig, f as SHAPIO_VERSION, n as startServer, s as buildApp, t as startDedicatedWorker } from "./worker-DRCCGGjl.js";
-import { EXTENSION_CONTRACT_VERSION, HookError, defineConfig, isHookError } from "./config.js";
+import { a as loadConfig, n as startServer, s as buildApp, t as startDedicatedWorker, u as SHAPIO_VERSION } from "./worker-B-sC-eY2.js";
+import { i as isHookError, n as HookError, r as defineConfig, t as EXTENSION_CONTRACT_VERSION } from "./public-B57h4F7Y.js";
 export { EXTENSION_CONTRACT_VERSION, HookError, SHAPIO_VERSION, buildApp, defineConfig, isHookError, loadConfig, startDedicatedWorker, startServer };

package/dist/public-B57h4F7Y.js

@@ -0,0 +1,39 @@
+//#region src/extensions/public.ts
+/**
+* The project extension contract (ADR 0009), imported by project authors from `@shapio/cms/config`:
+*
+* ```ts
+* import { defineConfig } from '@shapio/cms/config';
+* export const config = defineConfig({ hooks: { article: { beforePublish: (ctx) => { ... } } } });
+* ```
+*
+* Extensions are code: changing them needs a restart of Shapio (never a rebuild). Content models are never
+* configured here; they change live in the admin. This file has no runtime imports from the server, so a
+* config that imports it stays cheap to load.
+*
+* Stability: everything exported here follows semver with `EXTENSION_CONTRACT_VERSION`; Shapio's database
+* tables (reachable through `trx`) are internal and may change in any release.
+*/
+const EXTENSION_CONTRACT_VERSION = 1;
+/** Identity helper for completion and type checking in `shapio.config.ts`. */
+const defineConfig = (config) => config;
+const HOOK_ERROR_BRAND = Symbol.for("shapio.HookError");
+/**
+* Thrown by a `before*` hook to reject a write: the API answers 422 with code `HOOK_REJECTED`, this message
+* and the details. Recognised by a brand, not `instanceof`, so a copy of this class loaded from another
+* path (a project's own `node_modules`) works the same.
+*/
+var HookError = class extends Error {
+	details;
+	[HOOK_ERROR_BRAND] = true;
+	constructor(message, details) {
+		super(message);
+		this.name = "HookError";
+		this.details = details;
+	}
+};
+const isHookError = (error) => typeof error === "object" && error !== null && error[HOOK_ERROR_BRAND] === true;
+//#endregion
+export { isHookError as i, HookError as n, defineConfig as r, EXTENSION_CONTRACT_VERSION as t };
+
+//# sourceMappingURL=public-B57h4F7Y.js.map

package/dist/public-B57h4F7Y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-B57h4F7Y.js","names":[],"sources":["../src/extensions/public.ts"],"sourcesContent":["import type { ThemeToken } from '@shapio/schema';\nimport type { FastifyBaseLogger, FastifyPluginAsync, preHandlerAsyncHookHandler } from 'fastify';\nimport type { Kysely, Transaction } from 'kysely';\nimport type { DB } from '../db/types.js';\nimport type { PermissionEvaluator, Principal } from '../permissions/types.js';\nimport type { RouteAuditConfig } from '../plugins/auditDeclaration.js';\n\n// What Shapio adds to Fastify, repeated here so custom route code is typed without the server's internals.\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is calling. Anonymous unless a session cookie or API token resolved. Never null after onRequest. */\n    principal: Principal;\n    /**\n     * The request's site on a site route (custom routes are site routes): the credential's site, else the\n     * `Shapio-Site` header or `?site=`, else the primary site. Undefined on a route declaring\n     * `config.site = 'network'`.\n     */\n    site: { id: string; key: string } | undefined;\n  }\n  interface FastifyContextConfig {\n    /** Required on every mutating route: the audit action recorded on success, or `{ exempt: '<why>' }`. */\n    audit?: RouteAuditConfig;\n    /** `'network'` for a custom route that is about the whole instance rather than one site. */\n    site?: 'site' | 'network';\n  }\n}\n\n/**\n * The project extension contract (ADR 0009), imported by project authors from `@shapio/cms/config`:\n *\n * ```ts\n * import { defineConfig } from '@shapio/cms/config';\n * export const config = defineConfig({ hooks: { article: { beforePublish: (ctx) => { ... } } } });\n * ```\n *\n * Extensions are code: changing them needs a restart of Shapio (never a rebuild). Content models are never\n * configured here; they change live in the admin. This file has no runtime imports from the server, so a\n * config that imports it stays cheap to load.\n *\n * Stability: everything exported here follows semver with `EXTENSION_CONTRACT_VERSION`; Shapio's database\n * tables (reachable through `trx`) are internal and may change in any release.\n */\nexport const EXTENSION_CONTRACT_VERSION = 1;\n\nexport type BeforeHookEvent = 'beforeCreate' | 'beforeUpdate' | 'beforePublish' | 'beforeDelete';\nexport type AfterHookEvent = 'afterCreate' | 'afterUpdate' | 'afterPublish' | 'afterDelete';\nexport type HookEvent = BeforeHookEvent | AfterHookEvent;\n\n/** A site of a multi-site instance: its stable ID and its key (sites share the schema, not content). */\nexport type ExtensionSite = { id: string; key: string };\n\n/** Entry data keyed by field API key (the admin API's shape; media and relations are IDs). */\nexport type EntryData = Readonly<Record<string, unknown>>;\n\nexport type HookModel = {\n  /** Stable model ID (never changes). */\n  id: string;\n  apiKey: string;\n  label: string;\n  kind: 'collection' | 'singleton';\n  localized: boolean;\n  draftAndPublish: boolean;\n};\n\nexport type HookEntry = {\n  id: string;\n  locale: string | null;\n  /** Which head the change is about: the draft (create/update), the live version (publish), or a delete. */\n  state: 'draft' | 'published' | 'deleted';\n};\n\nexport type ContentReadOptions = {\n  locale?: string;\n  /** Read as this principal (its permissions apply). Default: Shapio itself (everything). */\n  principal?: Principal;\n};\n\nexport type ContentReadEntry = {\n  id: string;\n  locale: string;\n  status: string;\n  data: Record<string, unknown>;\n};\n\n/** Read-only access to content (drafts, as the admin API shows them). Reads committed data. */\nexport type ContentReadService = {\n  get: (modelKey: string, id: string, options?: ContentReadOptions) => Promise<ContentReadEntry>;\n  /** `query` is a delivery-style querystring, e.g. `filters[title][$contains]=a&pageSize=10`. */\n  list: (\n    modelKey: string,\n    query?: string,\n    options?: Omit<ContentReadOptions, 'locale'>,\n  ) => Promise<{ items: ContentReadEntry[]; total: number }>;\n  /** Number of (non-deleted) entries of a model. */\n  count: (modelKey: string) => Promise<number>;\n  /** The active content models (collections and singletons) of this site: shared ones and its own. */\n  models: () => Promise<HookModel[]>;\n};\n\nexport type MediaUsage = {\n  entryId: string;\n  modelId: string;\n  fieldId: string;\n  locale: string;\n  state: string;\n};\n\nexport type MediaReferenceService = {\n  /** Where an asset is used (up to 100 references, plus the total). */\n  usages: (assetId: string) => Promise<{ items: MediaUsage[]; total: number }>;\n};\n\nexport type EnqueueOptions = {\n  runAt?: Date;\n  /** Enqueueing the same key twice creates one job. */\n  idempotencyKey?: string;\n  maxAttempts?: number;\n};\n\nexport type ExtensionJobService = {\n  /** Enqueues one of the project's own jobs (`jobs` in the config), by its name without the `ext.` prefix. */\n  enqueue: (\n    name: string,\n    payload?: Record<string, unknown>,\n    options?: EnqueueOptions,\n  ) => Promise<{ id: string; created: boolean }>;\n};\n\n/**\n * What Shapio offers extensions. Deliberately small; everything else goes through `trx` or HTTP.\n *\n * Content and media are per site. The services handed to a hook read the hook's site; the services given to\n * routes, jobs and service factories read the primary site. Use `forSite` for another one (in a custom\n * route: `services.forSite(request.site)`).\n */\nexport type ShapioServices = {\n  /** The site `content` and `media` read. */\n  site: ExtensionSite;\n  /** The same services reading another site. */\n  forSite: (site: ExtensionSite) => ShapioServices;\n  content: ContentReadService;\n  media: MediaReferenceService;\n  jobs: ExtensionJobService;\n  logger: FastifyBaseLogger;\n};\n\n/**\n * Your own services, by name. Augment it for typed access everywhere services appear:\n *\n * ```ts\n * declare module '@shapio/cms/config' {\n *   interface CustomServices { stats: StatsService }\n * }\n * ```\n */\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type -- augmented by projects\nexport interface CustomServices {}\n\nexport type ExtensionServices = ShapioServices & CustomServices;\n\ntype HookContextBase = {\n  /** The site the entry belongs to; `services` read this site. */\n  site: ExtensionSite;\n  model: HookModel;\n  entry: HookEntry;\n  locale: string | null;\n  /** The document after the change (absent for deletes). */\n  data: EntryData | undefined;\n  /** The document before the change: the previous draft (update) or the live version (publish). */\n  before: EntryData | undefined;\n  /** Who made the change (an admin, an API token, an app user, or Shapio itself for scheduled work). */\n  principal: Principal;\n  services: ExtensionServices;\n  logger: FastifyBaseLogger;\n  /** Aborted when Shapio shuts down. */\n  signal: AbortSignal;\n};\n\n/**\n * `before*` hooks run INSIDE the write's transaction, before it commits. Throw `HookError` (or call\n * `reject`) to abort the write with 422 `HOOK_REJECTED`; nothing of the write is kept. Other errors abort it\n * too, as a 500. Database work through `trx` commits or rolls back with the write.\n */\nexport type BeforeHookContext = HookContextBase & {\n  event: BeforeHookEvent;\n  trx: Transaction<DB>;\n  reject: (message: string, details?: Record<string, unknown>) => never;\n};\n\n/**\n * `after*` hooks run AFTER the write committed, as a job (retried with backoff on error, never rolling the\n * write back). Database work through `trx` is exactly once: it commits together with the record that the\n * hook ran. Other side effects (HTTP calls) are at least once: make them idempotent with `idempotencyKey`.\n */\nexport type AfterHookContext = HookContextBase & {\n  event: AfterHookEvent;\n  trx: Transaction<DB>;\n  /** The outbox event the hook runs for. */\n  eventId: string;\n  /** `<eventId>:<hook name>`: stable across retries. */\n  idempotencyKey: string;\n  attempt: number;\n};\n\nexport type BeforeHook = (context: BeforeHookContext) => Promise<void> | void;\nexport type AfterHook = (context: AfterHookContext) => Promise<void> | void;\n\nexport type ModelHooks = { [E in BeforeHookEvent]?: BeforeHook } & { [E in AfterHookEvent]?: AfterHook };\n\nexport type ServiceFactoryContext = {\n  /** Kysely on Shapio's database. Shapio's own tables are internal and may change between releases. */\n  db: Kysely<DB>;\n  config: ExtensionHostConfig;\n  logger: FastifyBaseLogger;\n  /** Shapio's services plus the custom services declared before this one. */\n  services: ExtensionServices;\n};\n\nexport type ExtensionHostConfig = {\n  nodeEnv: 'development' | 'production' | 'test';\n  /** PUBLIC_URL origin, without a trailing slash. */\n  publicUrl: string;\n  basePath: string;\n  /** The directory holding shapio.config and extensions/. */\n  projectDir: string;\n};\n\nexport type ServiceFactory = (context: ServiceFactoryContext) => unknown;\n\n/** Options every custom route plugin receives (also available as `app.ext`). */\nexport type ExtensionRouteOptions = {\n  services: ExtensionServices;\n  /** Shapio's permission evaluator: `permissions.evaluate(request.principal, { action, modelId })`. */\n  permissions: PermissionEvaluator;\n  logger: FastifyBaseLogger;\n  /** preHandler: 401/403 unless the caller is an admin user or an admin API token. */\n  requireAdmin: preHandlerAsyncHookHandler;\n};\n\nexport type ExtensionRoute = {\n  /** Mounted at `/api/ext/<prefix>` (under BASE_PATH). Lower-case letters, digits and dashes. */\n  prefix: string;\n  plugin: FastifyPluginAsync<ExtensionRouteOptions>;\n};\n\nexport type JobHandlerContext = {\n  jobId: string;\n  payload: Record<string, unknown>;\n  attempt: number;\n  maxAttempts: number;\n  idempotencyKey: string | null;\n  services: ExtensionServices;\n  logger: FastifyBaseLogger;\n  signal: AbortSignal;\n};\n\n/** Throw to retry with backoff; the return value (JSON) is stored as the job result. */\nexport type ExtensionJobHandler = (context: JobHandlerContext) => Promise<unknown>;\n\n/**\n * A colour theme for the admin: token values for a light variant, a dark variant, or both. Every UI token is\n * required in a variant; the `brand-*` tokens may be left out (Shapio's are used). Values are `#rrggbb`\n * (contrast is checked by `shapio extensions check`), `#rgb`, `#rrggbbaa`, or `rgb()`, `hsl()`, `oklch()`,\n * `oklab()` with plain arguments.\n */\nexport type ThemeTokens = Partial<Record<ThemeToken, string>>;\n\nexport type ThemeDefinition = {\n  /** Lower-case letters, digits and dashes; not a built-in theme's key. Saved in each browser's setting. */\n  key: string;\n  /** Shown in the theme menu (not translated). */\n  name: string;\n  description?: string;\n  light?: ThemeTokens;\n  dark?: ThemeTokens;\n};\n\nexport type ShapioConfig = {\n  /** Lifecycle hooks by model API ID (or stable model UUID); `*` runs for every model. */\n  hooks?: Record<string, ModelHooks>;\n  routes?: ExtensionRoute[];\n  /** Constructed once at startup, in order, and shared by hooks, routes and jobs. */\n  services?: Record<string, ServiceFactory>;\n  /** Custom field editor modules: file names inside `extensions/editors/` (built ES modules). */\n  editors?: string[];\n  /** Job handlers by name; registered as `ext.<name>`. */\n  jobs?: Record<string, ExtensionJobHandler>;\n  /** Admin colour themes, listed after the built-in ones in the theme menu. */\n  themes?: ThemeDefinition[];\n};\n\n/** Identity helper for completion and type checking in `shapio.config.ts`. */\nexport const defineConfig = (config: ShapioConfig): ShapioConfig => config;\n\nconst HOOK_ERROR_BRAND = Symbol.for('shapio.HookError');\n\n/**\n * Thrown by a `before*` hook to reject a write: the API answers 422 with code `HOOK_REJECTED`, this message\n * and the details. Recognised by a brand, not `instanceof`, so a copy of this class loaded from another\n * path (a project's own `node_modules`) works the same.\n */\nexport class HookError extends Error {\n  readonly details: Record<string, unknown> | undefined;\n  readonly [HOOK_ERROR_BRAND] = true;\n\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message);\n    this.name = 'HookError';\n    this.details = details;\n  }\n}\n\nexport const isHookError = (error: unknown): error is HookError =>\n  typeof error === 'object' &&\n  error !== null &&\n  (error as Record<symbol, unknown>)[HOOK_ERROR_BRAND] === true;\n"],"mappings":";;;;;;;;;;;;;;;;AA0CA,MAAa,6BAA6B;;AA0P1C,MAAa,gBAAgB,WAAuC;AAEpE,MAAM,mBAAmB,OAAO,IAAI,kBAAkB;;;;;;AAOtD,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA,CAAU,oBAAoB;CAE9B,YAAY,SAAiB,SAAmC;EAC9D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,UAAU;CACjB;AACF;AAEA,MAAa,eAAe,UAC1B,OAAO,UAAU,YACjB,UAAU,QACT,MAAkC,sBAAsB"}

package/dist/{public-BO_wneBL.d.ts → public-COKbHR-N.d.ts}

@@ -246,6 +246,12 @@ type SchemaChange = {
   from?: JsonValue$1;
   to?: JsonValue$1;
 };
+/**
+ * A change as a stored plan step carries it: classified since 0.5.6, plain before (no drops existed then).
+ */
+type PlannedChange = SchemaChange & {
+  dropsValues?: boolean;
+};
 declare const THEME_TOKENS: readonly ["background", "foreground", "card", "card-foreground", "popover", "popover-foreground", "primary", "primary-foreground", "primary-hover", "secondary", "secondary-foreground", "muted", "muted-foreground", "accent", "accent-foreground", "destructive", "destructive-foreground", "destructive-muted", "success", "success-muted", "warning", "warning-muted", "info", "info-muted", "border", "input", "ring", "link", "overlay", "sidebar", "sidebar-foreground", "sidebar-primary", "sidebar-primary-foreground", "sidebar-accent", "sidebar-accent-foreground", "sidebar-border", "sidebar-ring", "brand-logo", "brand-logo-foreground", "brand-letters", "brand-panel-from", "brand-panel-to", "brand-panel-foreground", "brand-panel-mark"];
 type ThemeToken = (typeof THEME_TOKENS)[number];
 //#endregion
@@ -1134,12 +1140,22 @@ type DeliveryAction = (typeof DELIVERY_ACTIONS)[number];
 type ModelAction = ContentAction | DeliveryAction;
 declare const GLOBAL_ACTIONS: readonly ["schema.create", "users.manage", "roles.manage", "audit.read", "sites.manage", "tokens.manage", "media.read", "media.write", "media.manage", "publishing.manage", "webhooks.manage", "deployments.manage", "deployments.trigger", "changes.manage", "changes.ship", "site.settings"];
 type GlobalAction = (typeof GLOBAL_ACTIONS)[number];
-/** Field visibility by stable field ID. `all` means every field the schema exposes to this principal kind. */
+/**
+ * Which fields of a component (at any depth) a principal sees: `all`, or only those with `public: true`. Grants
+ * name model field IDs only, never a component's fields, so delivery audiences see a component's
+ * `public: false` fields under no grant.
+ */
+type ComponentFieldVisibility = 'all' | 'public';
+/**
+ * Field visibility by stable field ID. `all` means every field the schema exposes to this principal kind,
+ * a component's fields included. `only`: these top-level fields, and `componentFields` inside components.
+ */
 type FieldMask = {
   mode: 'all';
 } | {
   mode: 'only';
   fieldIds: readonly string[];
+  componentFields: ComponentFieldVisibility;
 };
 /** Enumerated row conditions; compiled to SQL only by content/compiler. Never free-form expressions. */
 type RowCondition = {
@@ -1152,12 +1168,40 @@ type RowFilter = RowCondition | {
   kind: 'or';
   filters: readonly RowFilter[];
 };
+/**
+ * Field masks that differ by row: `everyRow` applies to every row the principal may act on, and each `when`
+ * entry adds its mask on the rows matching its condition (a grant limited to the principal's own entries
+ * that names more fields than the grants reaching every row).
+ */
+type RowFieldMasks = {
+  everyRow: FieldMask;
+  when: ReadonlyArray<{
+    condition: RowCondition;
+    mask: FieldMask;
+  }>;
+};
+/** Read masks per row (issue #75). */
+type RowReadMasks = RowFieldMasks;
+/** Write masks per row (issue #80). */
+type RowWriteMasks = RowFieldMasks;
 type Policy = {
   allowed: boolean;
   /** Extra restriction on which rows the principal may act on. `null` means no restriction. */
   rowFilter: RowFilter | null;
+  /**
+   * Every field the principal may read on some row (the shape of what it can see, e.g. a GraphQL schema).
+   * Values are shown per row: see `rowReadMasks`.
+   */
   readMask: FieldMask;
+  /** null: `readMask` applies to every row. Otherwise readers apply these per row (never `readMask`). */
+  rowReadMasks: RowReadMasks | null;
+  /**
+   * Every field the principal may write on some row (the shape of what it can send, e.g. GraphQL inputs).
+   * Writes are checked per row: see `rowWriteMasks`.
+   */
   writeMask: FieldMask;
+  /** null: `writeMask` applies to every row. Otherwise writes check these per row (never `writeMask`). */
+  rowWriteMasks: RowWriteMasks | null;
 };
 type PolicyRequest = {
   action: ModelAction;
@@ -1485,5 +1529,5 @@ declare class HookError extends Error {
 }
 declare const isHookError: (error: unknown) => error is HookError;
 //#endregion
-export { ServiceFactoryContext as A, Principal as B, HookEvent as C, MediaUsage as D, MediaReferenceService as E, defineConfig as F, ComponentDefinition as G, DB as H, isHookError as I, ModelDefinition as J, DataType as K, KnownVersions as L, ShapioServices as M, ThemeDefinition as N, ModelHooks as O, ThemeTokens as P, PermissionEvaluator as R, HookError as S, JobHandlerContext as T, OutboxEvents as U, Database as V, ContentData as W, SchemaChange as Y, ExtensionRoute as _, BeforeHookContext as a, ExtensionSite as b, ContentReadOptions as c, EXTENSION_CONTRACT_VERSION as d, EnqueueOptions as f, ExtensionJobService as g, ExtensionJobHandler as h, BeforeHook as i, ShapioConfig as j, ServiceFactory as k, ContentReadService as l, ExtensionHostConfig as m, AfterHookContext as n, BeforeHookEvent as o, EntryData as p, JsonValue$1 as q, AfterHookEvent as r, ContentReadEntry as s, AfterHook as t, CustomServices as u, ExtensionRouteOptions as v, HookModel as w, HookEntry as x, ExtensionServices as y, PermissionExecutor as z };
-//# sourceMappingURL=public-BO_wneBL.d.ts.map
+export { ServiceFactoryContext as A, Principal as B, HookEvent as C, MediaUsage as D, MediaReferenceService as E, defineConfig as F, ComponentDefinition as G, DB as H, isHookError as I, ModelDefinition as J, DataType as K, KnownVersions as L, ShapioServices as M, ThemeDefinition as N, ModelHooks as O, ThemeTokens as P, PermissionEvaluator as R, HookError as S, JobHandlerContext as T, OutboxEvents as U, Database as V, ContentData as W, PlannedChange as Y, ExtensionRoute as _, BeforeHookContext as a, ExtensionSite as b, ContentReadOptions as c, EXTENSION_CONTRACT_VERSION as d, EnqueueOptions as f, ExtensionJobService as g, ExtensionJobHandler as h, BeforeHook as i, ShapioConfig as j, ServiceFactory as k, ContentReadService as l, ExtensionHostConfig as m, AfterHookContext as n, BeforeHookEvent as o, EntryData as p, JsonValue$1 as q, AfterHookEvent as r, ContentReadEntry as s, AfterHook as t, CustomServices as u, ExtensionRouteOptions as v, HookModel as w, HookEntry as x, ExtensionServices as y, PermissionExecutor as z };
+//# sourceMappingURL=public-COKbHR-N.d.ts.map

package/dist/{s3Adapter-CtPzkzf0.js → s3Adapter-U01iEAcK.js}

@@ -1,4 +1,4 @@
-import { M as isValidStorageKey, c as bucketContentDisposition, h as ObjectNotFoundError, j as encodeKeyPath, l as contentDisposition, m as InvalidStorageKeyError } from "./worker-DRCCGGjl.js";
+import { c as isValidStorageKey, i as ObjectNotFoundError, n as contentDisposition, r as InvalidStorageKeyError, s as encodeKeyPath, t as bucketContentDisposition } from "./contentDisposition-DOL2Xt0l.js";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -122,4 +122,4 @@ const createS3Adapter = ({ config, publicBaseUrl, client }) => {
 //#endregion
 export { createS3Adapter };
 
-//# sourceMappingURL=s3Adapter-CtPzkzf0.js.map
+//# sourceMappingURL=s3Adapter-U01iEAcK.js.map

package/dist/{s3Adapter-CtPzkzf0.js.map → s3Adapter-U01iEAcK.js.map}

@@ -1 +1 @@
-{"version":3,"file":"s3Adapter-CtPzkzf0.js","names":[],"sources":["../src/media/s3Adapter.ts"],"sourcesContent":["import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  S3ServiceException,\n} from '@aws-sdk/client-s3';\nimport { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport type { S3StorageConfig } from '../config/index.js';\nimport { bucketContentDisposition, contentDisposition } from './contentDisposition.js';\nimport { InvalidStorageKeyError, ObjectNotFoundError } from './errors.js';\nimport { encodeKeyPath, isValidStorageKey } from './keys.js';\nimport type { StorageAdapter } from './types.js';\n\n/** R2 accepts any region name (\"auto\" by convention); AWS needs the bucket's real region. */\nconst DEFAULT_REGION = 'us-east-1';\n\nconst isNotFound = (error: unknown): boolean =>\n  error instanceof S3ServiceException &&\n  (error.$metadata.httpStatusCode === 404 || error.name === 'NotFound' || error.name === 'NoSuchKey');\n\nexport const createS3Client = (config: S3StorageConfig): S3Client =>\n  new S3Client({\n    region: config.region ?? DEFAULT_REGION,\n    ...(config.endpoint ? { endpoint: config.endpoint } : {}),\n    forcePathStyle: config.forcePathStyle,\n    ...(config.accessKeyId && config.secretAccessKey\n      ? { credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } }\n      : {}),\n    // Only send/validate checksums when an operation requires them: several S3-compatible services\n    // (R2, B2 and other gateways) reject the SDK's default streaming CRC32 trailers.\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n    responseChecksumValidation: 'WHEN_REQUIRED',\n  });\n\nexport type S3AdapterOptions = {\n  config: S3StorageConfig;\n  publicBaseUrl: string | undefined;\n  /** Injected in tests; created from `config` otherwise. */\n  client?: S3Client;\n};\n\n/**\n * Any S3-compatible service (AWS S3, Cloudflare R2, B2, Spaces, Wasabi, versitygw). Private objects are read\n * through presigned GET URLs; browsers upload straight to the bucket with a presigned POST whose policy\n * limits size and content type, so Shapio never streams upload bytes.\n */\nexport const createS3Adapter = ({ config, publicBaseUrl, client }: S3AdapterOptions): StorageAdapter => {\n  const s3 = client ?? createS3Client(config);\n  const Bucket = config.bucket;\n  const checkKey = (key: string) => {\n    if (!isValidStorageKey(key)) {\n      throw new InvalidStorageKeyError(key);\n    }\n    return key;\n  };\n\n  const head = async (key: string) => {\n    try {\n      const result = await s3.send(new HeadObjectCommand({ Bucket, Key: checkKey(key) }));\n      return { size: result.ContentLength ?? 0, contentType: result.ContentType };\n    } catch (error) {\n      if (isNotFound(error)) {\n        return undefined;\n      }\n      throw error;\n    }\n  };\n\n  return {\n    driver: 's3',\n    put: async (key, body, { contentType, contentLength }) => {\n      await s3.send(\n        new PutObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          Body: body,\n          ContentType: contentType,\n          ContentLength: Buffer.isBuffer(body) ? body.length : contentLength,\n          ContentDisposition: bucketContentDisposition(contentType),\n        }),\n      );\n    },\n    getStream: async (key, range) => {\n      try {\n        const result = await s3.send(\n          new GetObjectCommand({\n            Bucket,\n            Key: checkKey(key),\n            ...(range ? { Range: `bytes=${range.start}-${range.end}` } : {}),\n          }),\n        );\n        if (!result.Body) {\n          throw new ObjectNotFoundError(key);\n        }\n        return result.Body as Readable;\n      } catch (error) {\n        throw isNotFound(error) ? new ObjectNotFoundError(key, { cause: error }) : error;\n      }\n    },\n    head,\n    exists: async (key) => (await head(key)) !== undefined,\n    delete: async (key) => {\n      await s3.send(new DeleteObjectCommand({ Bucket, Key: checkKey(key) }));\n    },\n    signedGetUrl: async (key, { expiresInSeconds, filename, contentType }) =>\n      getSignedUrl(\n        s3,\n        new GetObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          ResponseContentType: contentType,\n          ResponseContentDisposition: contentDisposition(filename),\n        }),\n        { expiresIn: expiresInSeconds },\n      ),\n    publicUrl: (key) => (publicBaseUrl ? `${publicBaseUrl}/${encodeKeyPath(checkKey(key))}` : undefined),\n    presignedUpload: async ({ key, contentType, maxSizeBytes, expiresInSeconds }) => {\n      const disposition = bucketContentDisposition(contentType);\n      const { url, fields } = await createPresignedPost(s3, {\n        Bucket,\n        Key: checkKey(key),\n        Conditions: [\n          ['content-length-range', 1, maxSizeBytes],\n          ['eq', '$Content-Type', contentType],\n          ...(disposition ? [['eq', '$Content-Disposition', disposition] as ['eq', string, string]] : []),\n        ],\n        Fields: {\n          'Content-Type': contentType,\n          ...(disposition ? { 'Content-Disposition': disposition } : {}),\n        },\n        Expires: expiresInSeconds,\n      });\n      return { url, fields };\n    },\n  };\n};\n"],"mappings":";;;;;;AAkBA,MAAM,iBAAiB;AAEvB,MAAM,cAAc,UAClB,iBAAiB,uBAChB,MAAM,UAAU,mBAAmB,OAAO,MAAM,SAAS,cAAc,MAAM,SAAS;AAEzF,MAAa,kBAAkB,WAC7B,IAAI,SAAS;CACX,QAAQ,OAAO,UAAU;CACzB,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;CACvD,gBAAgB,OAAO;CACvB,GAAI,OAAO,eAAe,OAAO,kBAC7B,EAAE,aAAa;EAAE,aAAa,OAAO;EAAa,iBAAiB,OAAO;CAAgB,EAAE,IAC5F,CAAC;CAGL,4BAA4B;CAC5B,4BAA4B;AAC9B,CAAC;;;;;;AAcH,MAAa,mBAAmB,EAAE,QAAQ,eAAe,aAA+C;CACtG,MAAM,KAAK,UAAU,eAAe,MAAM;CAC1C,MAAM,SAAS,OAAO;CACtB,MAAM,YAAY,QAAgB;EAChC,IAAI,CAAC,kBAAkB,GAAG,GACxB,MAAM,IAAI,uBAAuB,GAAG;EAEtC,OAAO;CACT;CAEA,MAAM,OAAO,OAAO,QAAgB;EAClC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;GAClF,OAAO;IAAE,MAAM,OAAO,iBAAiB;IAAG,aAAa,OAAO;GAAY;EAC5E,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,GAClB;GAEF,MAAM;EACR;CACF;CAEA,OAAO;EACL,QAAQ;EACR,KAAK,OAAO,KAAK,MAAM,EAAE,aAAa,oBAAoB;GACxD,MAAM,GAAG,KACP,IAAI,iBAAiB;IACnB;IACA,KAAK,SAAS,GAAG;IACjB,MAAM;IACN,aAAa;IACb,eAAe,OAAO,SAAS,IAAI,IAAI,KAAK,SAAS;IACrD,oBAAoB,yBAAyB,WAAW;GAC1D,CAAC,CACH;EACF;EACA,WAAW,OAAO,KAAK,UAAU;GAC/B,IAAI;IACF,MAAM,SAAS,MAAM,GAAG,KACtB,IAAI,iBAAiB;KACnB;KACA,KAAK,SAAS,GAAG;KACjB,GAAI,QAAQ,EAAE,OAAO,SAAS,MAAM,MAAM,GAAG,MAAM,MAAM,IAAI,CAAC;IAChE,CAAC,CACH;IACA,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,oBAAoB,GAAG;IAEnC,OAAO,OAAO;GAChB,SAAS,OAAO;IACd,MAAM,WAAW,KAAK,IAAI,IAAI,oBAAoB,KAAK,EAAE,OAAO,MAAM,CAAC,IAAI;GAC7E;EACF;EACA;EACA,QAAQ,OAAO,QAAS,MAAM,KAAK,GAAG,MAAO,KAAA;EAC7C,QAAQ,OAAO,QAAQ;GACrB,MAAM,GAAG,KAAK,IAAI,oBAAoB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;EACvE;EACA,cAAc,OAAO,KAAK,EAAE,kBAAkB,UAAU,kBACtD,aACE,IACA,IAAI,iBAAiB;GACnB;GACA,KAAK,SAAS,GAAG;GACjB,qBAAqB;GACrB,4BAA4B,mBAAmB,QAAQ;EACzD,CAAC,GACD,EAAE,WAAW,iBAAiB,CAChC;EACF,YAAY,QAAS,gBAAgB,GAAG,cAAc,GAAG,cAAc,SAAS,GAAG,CAAC,MAAM,KAAA;EAC1F,iBAAiB,OAAO,EAAE,KAAK,aAAa,cAAc,uBAAuB;GAC/E,MAAM,cAAc,yBAAyB,WAAW;GACxD,MAAM,EAAE,KAAK,WAAW,MAAM,oBAAoB,IAAI;IACpD;IACA,KAAK,SAAS,GAAG;IACjB,YAAY;KACV;MAAC;MAAwB;MAAG;KAAY;KACxC;MAAC;MAAM;MAAiB;KAAW;KACnC,GAAI,cAAc,CAAC;MAAC;MAAM;MAAwB;KAAW,CAA2B,IAAI,CAAC;IAC/F;IACA,QAAQ;KACN,gBAAgB;KAChB,GAAI,cAAc,EAAE,uBAAuB,YAAY,IAAI,CAAC;IAC9D;IACA,SAAS;GACX,CAAC;GACD,OAAO;IAAE;IAAK;GAAO;EACvB;CACF;AACF"}
+{"version":3,"file":"s3Adapter-U01iEAcK.js","names":[],"sources":["../src/media/s3Adapter.ts"],"sourcesContent":["import type { Readable } from 'node:stream';\nimport {\n  DeleteObjectCommand,\n  GetObjectCommand,\n  HeadObjectCommand,\n  PutObjectCommand,\n  S3Client,\n  S3ServiceException,\n} from '@aws-sdk/client-s3';\nimport { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\nimport type { S3StorageConfig } from '../config/index.js';\nimport { bucketContentDisposition, contentDisposition } from './contentDisposition.js';\nimport { InvalidStorageKeyError, ObjectNotFoundError } from './errors.js';\nimport { encodeKeyPath, isValidStorageKey } from './keys.js';\nimport type { StorageAdapter } from './types.js';\n\n/** R2 accepts any region name (\"auto\" by convention); AWS needs the bucket's real region. */\nconst DEFAULT_REGION = 'us-east-1';\n\nconst isNotFound = (error: unknown): boolean =>\n  error instanceof S3ServiceException &&\n  (error.$metadata.httpStatusCode === 404 || error.name === 'NotFound' || error.name === 'NoSuchKey');\n\nexport const createS3Client = (config: S3StorageConfig): S3Client =>\n  new S3Client({\n    region: config.region ?? DEFAULT_REGION,\n    ...(config.endpoint ? { endpoint: config.endpoint } : {}),\n    forcePathStyle: config.forcePathStyle,\n    ...(config.accessKeyId && config.secretAccessKey\n      ? { credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } }\n      : {}),\n    // Only send/validate checksums when an operation requires them: several S3-compatible services\n    // (R2, B2 and other gateways) reject the SDK's default streaming CRC32 trailers.\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n    responseChecksumValidation: 'WHEN_REQUIRED',\n  });\n\nexport type S3AdapterOptions = {\n  config: S3StorageConfig;\n  publicBaseUrl: string | undefined;\n  /** Injected in tests; created from `config` otherwise. */\n  client?: S3Client;\n};\n\n/**\n * Any S3-compatible service (AWS S3, Cloudflare R2, B2, Spaces, Wasabi, versitygw). Private objects are read\n * through presigned GET URLs; browsers upload straight to the bucket with a presigned POST whose policy\n * limits size and content type, so Shapio never streams upload bytes.\n */\nexport const createS3Adapter = ({ config, publicBaseUrl, client }: S3AdapterOptions): StorageAdapter => {\n  const s3 = client ?? createS3Client(config);\n  const Bucket = config.bucket;\n  const checkKey = (key: string) => {\n    if (!isValidStorageKey(key)) {\n      throw new InvalidStorageKeyError(key);\n    }\n    return key;\n  };\n\n  const head = async (key: string) => {\n    try {\n      const result = await s3.send(new HeadObjectCommand({ Bucket, Key: checkKey(key) }));\n      return { size: result.ContentLength ?? 0, contentType: result.ContentType };\n    } catch (error) {\n      if (isNotFound(error)) {\n        return undefined;\n      }\n      throw error;\n    }\n  };\n\n  return {\n    driver: 's3',\n    put: async (key, body, { contentType, contentLength }) => {\n      await s3.send(\n        new PutObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          Body: body,\n          ContentType: contentType,\n          ContentLength: Buffer.isBuffer(body) ? body.length : contentLength,\n          ContentDisposition: bucketContentDisposition(contentType),\n        }),\n      );\n    },\n    getStream: async (key, range) => {\n      try {\n        const result = await s3.send(\n          new GetObjectCommand({\n            Bucket,\n            Key: checkKey(key),\n            ...(range ? { Range: `bytes=${range.start}-${range.end}` } : {}),\n          }),\n        );\n        if (!result.Body) {\n          throw new ObjectNotFoundError(key);\n        }\n        return result.Body as Readable;\n      } catch (error) {\n        throw isNotFound(error) ? new ObjectNotFoundError(key, { cause: error }) : error;\n      }\n    },\n    head,\n    exists: async (key) => (await head(key)) !== undefined,\n    delete: async (key) => {\n      await s3.send(new DeleteObjectCommand({ Bucket, Key: checkKey(key) }));\n    },\n    signedGetUrl: async (key, { expiresInSeconds, filename, contentType }) =>\n      getSignedUrl(\n        s3,\n        new GetObjectCommand({\n          Bucket,\n          Key: checkKey(key),\n          ResponseContentType: contentType,\n          ResponseContentDisposition: contentDisposition(filename),\n        }),\n        { expiresIn: expiresInSeconds },\n      ),\n    publicUrl: (key) => (publicBaseUrl ? `${publicBaseUrl}/${encodeKeyPath(checkKey(key))}` : undefined),\n    presignedUpload: async ({ key, contentType, maxSizeBytes, expiresInSeconds }) => {\n      const disposition = bucketContentDisposition(contentType);\n      const { url, fields } = await createPresignedPost(s3, {\n        Bucket,\n        Key: checkKey(key),\n        Conditions: [\n          ['content-length-range', 1, maxSizeBytes],\n          ['eq', '$Content-Type', contentType],\n          ...(disposition ? [['eq', '$Content-Disposition', disposition] as ['eq', string, string]] : []),\n        ],\n        Fields: {\n          'Content-Type': contentType,\n          ...(disposition ? { 'Content-Disposition': disposition } : {}),\n        },\n        Expires: expiresInSeconds,\n      });\n      return { url, fields };\n    },\n  };\n};\n"],"mappings":";;;;;;AAkBA,MAAM,iBAAiB;AAEvB,MAAM,cAAc,UAClB,iBAAiB,uBAChB,MAAM,UAAU,mBAAmB,OAAO,MAAM,SAAS,cAAc,MAAM,SAAS;AAEzF,MAAa,kBAAkB,WAC7B,IAAI,SAAS;CACX,QAAQ,OAAO,UAAU;CACzB,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;CACvD,gBAAgB,OAAO;CACvB,GAAI,OAAO,eAAe,OAAO,kBAC7B,EAAE,aAAa;EAAE,aAAa,OAAO;EAAa,iBAAiB,OAAO;CAAgB,EAAE,IAC5F,CAAC;CAGL,4BAA4B;CAC5B,4BAA4B;AAC9B,CAAC;;;;;;AAcH,MAAa,mBAAmB,EAAE,QAAQ,eAAe,aAA+C;CACtG,MAAM,KAAK,UAAU,eAAe,MAAM;CAC1C,MAAM,SAAS,OAAO;CACtB,MAAM,YAAY,QAAgB;EAChC,IAAI,CAAC,kBAAkB,GAAG,GACxB,MAAM,IAAI,uBAAuB,GAAG;EAEtC,OAAO;CACT;CAEA,MAAM,OAAO,OAAO,QAAgB;EAClC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;GAClF,OAAO;IAAE,MAAM,OAAO,iBAAiB;IAAG,aAAa,OAAO;GAAY;EAC5E,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,GAClB;GAEF,MAAM;EACR;CACF;CAEA,OAAO;EACL,QAAQ;EACR,KAAK,OAAO,KAAK,MAAM,EAAE,aAAa,oBAAoB;GACxD,MAAM,GAAG,KACP,IAAI,iBAAiB;IACnB;IACA,KAAK,SAAS,GAAG;IACjB,MAAM;IACN,aAAa;IACb,eAAe,OAAO,SAAS,IAAI,IAAI,KAAK,SAAS;IACrD,oBAAoB,yBAAyB,WAAW;GAC1D,CAAC,CACH;EACF;EACA,WAAW,OAAO,KAAK,UAAU;GAC/B,IAAI;IACF,MAAM,SAAS,MAAM,GAAG,KACtB,IAAI,iBAAiB;KACnB;KACA,KAAK,SAAS,GAAG;KACjB,GAAI,QAAQ,EAAE,OAAO,SAAS,MAAM,MAAM,GAAG,MAAM,MAAM,IAAI,CAAC;IAChE,CAAC,CACH;IACA,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,oBAAoB,GAAG;IAEnC,OAAO,OAAO;GAChB,SAAS,OAAO;IACd,MAAM,WAAW,KAAK,IAAI,IAAI,oBAAoB,KAAK,EAAE,OAAO,MAAM,CAAC,IAAI;GAC7E;EACF;EACA;EACA,QAAQ,OAAO,QAAS,MAAM,KAAK,GAAG,MAAO,KAAA;EAC7C,QAAQ,OAAO,QAAQ;GACrB,MAAM,GAAG,KAAK,IAAI,oBAAoB;IAAE;IAAQ,KAAK,SAAS,GAAG;GAAE,CAAC,CAAC;EACvE;EACA,cAAc,OAAO,KAAK,EAAE,kBAAkB,UAAU,kBACtD,aACE,IACA,IAAI,iBAAiB;GACnB;GACA,KAAK,SAAS,GAAG;GACjB,qBAAqB;GACrB,4BAA4B,mBAAmB,QAAQ;EACzD,CAAC,GACD,EAAE,WAAW,iBAAiB,CAChC;EACF,YAAY,QAAS,gBAAgB,GAAG,cAAc,GAAG,cAAc,SAAS,GAAG,CAAC,MAAM,KAAA;EAC1F,iBAAiB,OAAO,EAAE,KAAK,aAAa,cAAc,uBAAuB;GAC/E,MAAM,cAAc,yBAAyB,WAAW;GACxD,MAAM,EAAE,KAAK,WAAW,MAAM,oBAAoB,IAAI;IACpD;IACA,KAAK,SAAS,GAAG;IACjB,YAAY;KACV;MAAC;MAAwB;MAAG;KAAY;KACxC;MAAC;MAAM;MAAiB;KAAW;KACnC,GAAI,cAAc,CAAC;MAAC;MAAM;MAAwB;KAAW,CAA2B,IAAI,CAAC;IAC/F;IACA,QAAQ;KACN,gBAAgB;KAChB,GAAI,cAAc,EAAE,uBAAuB,YAAY,IAAI,CAAC;IAC9D;IACA,SAAS;GACX,CAAC;GACD,OAAO;IAAE;IAAK;GAAO;EACvB;CACF;AACF"}