npm - @velastack/cms - Versions diffs - 0.1.0 → 0.2.0 - Mend

@velastack/cms 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (95) hide show

package/README.md +1 -1
package/dist/backend/auth/editors.d.ts +51 -0
package/dist/backend/auth/editors.js +157 -0
package/dist/backend/auth/local-editors.d.ts +22 -0
package/dist/backend/auth/local-editors.js +44 -0
package/dist/backend/auth/scrypt.d.ts +20 -0
package/dist/backend/auth/scrypt.js +80 -0
package/dist/backend/factory.d.ts +25 -0
package/dist/backend/factory.js +202 -0
package/dist/backend/http.d.ts +34 -0
package/dist/backend/http.js +79 -0
package/dist/backend/index.d.ts +45 -0
package/dist/backend/index.js +39 -0
package/dist/backend/router.d.ts +52 -0
package/dist/backend/router.js +57 -0
package/dist/backend/routes/context.d.ts +46 -0
package/dist/backend/routes/context.js +30 -0
package/dist/backend/routes/docs.d.ts +2 -0
package/dist/backend/routes/docs.js +150 -0
package/dist/backend/routes/login.d.ts +19 -0
package/dist/backend/routes/login.js +155 -0
package/dist/backend/routes/media.d.ts +22 -0
package/dist/backend/routes/media.js +119 -0
package/dist/backend/routes/pages.d.ts +19 -0
package/dist/backend/routes/pages.js +221 -0
package/dist/backend/routes/release.d.ts +10 -0
package/dist/backend/routes/release.js +147 -0
package/dist/backend/routes/site.d.ts +2 -0
package/dist/backend/routes/site.js +40 -0
package/dist/backend/routes/table.d.ts +11 -0
package/dist/backend/routes/table.js +72 -0
package/dist/backend/routes/test-reset.d.ts +15 -0
package/dist/backend/routes/test-reset.js +112 -0
package/dist/backend/routes/user.d.ts +14 -0
package/dist/backend/routes/user.js +21 -0
package/dist/backend/storage.d.ts +18 -0
package/dist/backend/storage.js +45 -0
package/dist/backend/store/cache.d.ts +34 -0
package/dist/backend/store/cache.js +38 -0
package/dist/backend/store/db.d.ts +10 -0
package/dist/backend/store/db.js +29 -0
package/dist/backend/store/migrate.d.ts +10 -0
package/dist/backend/store/migrate.js +30 -0
package/dist/backend/store/migrations/0001-init.d.ts +1 -0
package/dist/backend/store/migrations/0001-init.js +129 -0
package/dist/backend/store/migrations/0002-site.d.ts +1 -0
package/dist/backend/store/migrations/0002-site.js +86 -0
package/dist/backend/store/migrations/0003-editors.d.ts +1 -0
package/dist/backend/store/migrations/0003-editors.js +44 -0
package/dist/backend/store/migrations/index.d.ts +15 -0
package/dist/backend/store/migrations/index.js +18 -0
package/dist/backend/store/queries.d.ts +67 -0
package/dist/backend/store/queries.js +1207 -0
package/dist/backend/store/sqlite.d.ts +22 -0
package/dist/backend/store/sqlite.js +29 -0
package/dist/backend/testing/fixtures.d.ts +39 -0
package/dist/backend/testing/fixtures.js +61 -0
package/dist/backend/testing/harness.d.ts +35 -0
package/dist/backend/testing/harness.js +149 -0
package/dist/backend/types.d.ts +102 -0
package/dist/cms.d.ts +3 -3
package/dist/cms.js +1 -1
package/dist/components/admin-bar/publish-dialog.svelte +1 -1
package/dist/components/cms/cms-image-editable.svelte +1 -1
package/dist/components/cms/cms-store.svelte.d.ts +3 -68
package/dist/components/cms/cms-store.svelte.js +25 -10
package/dist/components/cms/locale-merge.d.ts +1 -1
package/dist/components/cms/locale-merge.js +1 -1
package/dist/components/cms/scope.d.ts +1 -1
package/dist/core/page-entry.d.ts +43 -0
package/dist/core/page-entry.js +21 -0
package/dist/{components/cms → core}/path.d.ts +13 -0
package/dist/{components/cms → core}/path.js +36 -0
package/dist/core/wire.d.ts +182 -0
package/dist/core/wire.js +1 -0
package/dist/{srv → server}/api-adapter.js +2 -2
package/dist/{srv → server}/load-cms.js +1 -1
package/dist/{srv → server}/mock-adapter.d.ts +3 -24
package/dist/{srv → server}/mock-adapter.js +5 -22
package/dist/{srv → server}/types.d.ts +2 -6
package/dist/server/types.js +1 -0
package/package.json +13 -4
package/plugin/dist/index.js +7 -0
package/plugin/dist/index.js.map +1 -1
package/plugin/dist/media.d.ts +16 -7
package/plugin/dist/media.js +23 -10
package/plugin/dist/media.js.map +1 -1
/package/dist/{srv → backend}/types.js +0 -0
/package/dist/{srv → server}/README.md +0 -0
/package/dist/{srv → server}/api-adapter.d.ts +0 -0
/package/dist/{srv → server}/cms.d.ts +0 -0
/package/dist/{srv → server}/cms.js +0 -0
/package/dist/{srv → server}/index.d.ts +0 -0
/package/dist/{srv → server}/index.js +0 -0
/package/dist/{srv → server}/load-cms.d.ts +0 -0

package/dist/backend/routes/login.js ADDED Viewed

@@ -0,0 +1,155 @@
+const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+const STYLE = `
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+body {
+	margin: 0;
+	min-height: 100vh;
+	display: grid;
+	place-items: center;
+	padding: 1rem;
+	font: 14px/1.5 ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+	background: #fff;
+	color: #0a0a0a;
+}
+.card {
+	width: 100%;
+	max-width: 22rem;
+	border: 1px solid #e5e5e5;
+	border-radius: 0.75rem;
+	padding: 1.5rem;
+	background: #fff;
+}
+h1 { margin: 0 0 0.25rem; font-size: 1.125rem; font-weight: 600; text-align: center; }
+p.sub { margin: 0 0 1.25rem; color: #737373; text-align: center; }
+label { display: block; font-weight: 500; margin-bottom: 0.375rem; }
+input {
+	width: 100%;
+	padding: 0.5rem 0.75rem;
+	border: 1px solid #d4d4d4;
+	border-radius: 0.5rem;
+	background: #fff;
+	color: inherit;
+	font: inherit;
+}
+input:focus-visible { outline: 2px solid #0a0a0a; outline-offset: 1px; border-color: transparent; }
+.field { margin-bottom: 1rem; }
+button {
+	width: 100%;
+	padding: 0.5rem 0.75rem;
+	border: 0;
+	border-radius: 0.5rem;
+	background: #0a0a0a;
+	color: #fafafa;
+	font: inherit;
+	font-weight: 500;
+	cursor: pointer;
+}
+button:hover { background: #262626; }
+.error {
+	margin: 0 0 1rem;
+	padding: 0.5rem 0.75rem;
+	border-radius: 0.5rem;
+	background: #fef2f2;
+	color: #b91c1c;
+}
+@media (prefers-color-scheme: dark) {
+	body { background: #0a0a0a; color: #fafafa; }
+	.card { background: #0a0a0a; border-color: #262626; }
+	input { background: #0a0a0a; border-color: #404040; }
+	input:focus-visible { outline-color: #fafafa; }
+	button { background: #fafafa; color: #0a0a0a; }
+	button:hover { background: #e5e5e5; }
+	p.sub { color: #a3a3a3; }
+	.error { background: #2a1215; color: #fca5a5; }
+}
+`;
+const page = (title, body) => `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${escapeHtml(title)}</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main class="card">
+${body}
+</main>
+</body>
+</html>`;
+const loginForm = (error) => page('Sign in to edit', `<h1>Sign in to edit</h1>
+<p class="sub">Use your email and password</p>
+${error ? `<p class="error" role="alert">${escapeHtml(error)}</p>` : ''}
+<form method="POST">
+	<div class="field">
+		<label for="email">Email</label>
+		<input id="email" name="email" type="email" autocomplete="email" required autofocus>
+	</div>
+	<div class="field">
+		<label for="password">Password</label>
+		<input id="password" name="password" type="password" autocomplete="current-password" required>
+	</div>
+	<button type="submit">Sign in</button>
+</form>`);
+const successPage = () => page('Signed in', `<h1>Signed in</h1>
+<p class="sub">You can close this window.</p>
+<script>
+	// The admin bar listens for this and re-fetches /user. It checks the
+	// origin on receipt, which is why posting to "*" here is safe: the
+	// message carries nothing secret.
+	window.parent?.postMessage({ type: 'velastack-cms-login-success' }, '*');
+</script>`);
+const html = (body, ctx, status = 200) => new Response(body, {
+    status,
+    headers: {
+        'content-type': 'text/html; charset=utf-8',
+        // The bar embeds this cross-origin, so the host decides who may frame it.
+        'content-security-policy': `frame-ancestors ${ctx.frameAncestors}`,
+        'cache-control': 'no-store'
+    }
+});
+export const getLogin = (ctx) => {
+    if (!ctx.auth.login)
+        return new Response(null, { status: 404 });
+    // Already signed in and authorized for this project — skip straight to the
+    // success screen. A session bound to a project the caller can't reach leaves
+    // `user` null, so they land on the form and can sign in as someone else.
+    if (ctx.user)
+        return html(successPage(), ctx);
+    return html(loginForm(), ctx);
+};
+export const postLogin = async (ctx) => {
+    if (!ctx.auth.login)
+        return new Response(null, { status: 404 });
+    let form;
+    try {
+        form = await ctx.event.request.formData();
+    }
+    catch {
+        return html(loginForm('Could not read the submitted form.'), ctx, 400);
+    }
+    const email = form.get('email');
+    const password = form.get('password');
+    if (typeof email !== 'string' || typeof password !== 'string' || !email || !password) {
+        return html(loginForm('Enter both an email and a password.'), ctx, 400);
+    }
+    const grant = await ctx.auth.login(email, password, ctx.authCtx);
+    // One message either way — which half was wrong is not the caller's business.
+    if (!grant)
+        return html(loginForm('Invalid email or password.'), ctx, 400);
+    ctx.setSessionCookie(grant.token, grant.expiresAt);
+    return html(successPage(), ctx);
+};
+/** Kept so the admin bar's historical `/iframe/login/success` URL still
+ * resolves; the POST above renders the same screen inline. */
+export const getLoginSuccess = (ctx) => {
+    if (!ctx.user) {
+        return new Response(null, {
+            status: 303,
+            headers: { location: `${ctx.mountPath}/iframe/login` }
+        });
+    }
+    return html(successPage(), ctx);
+};

package/dist/backend/routes/media.d.ts ADDED Viewed

@@ -0,0 +1,22 @@
+import { type CmsStorage } from '../storage.js';
+import { type RouteCtx } from './context.js';
+export declare const getMedia: (ctx: RouteCtx) => Response;
+/**
+ * Multipart upload. Generates a random slug, preserves the original extension
+ * (or derives one from the MIME type), writes it into the configured upload
+ * directory, and records metadata.
+ */
+export declare const postMedia: (ctx: RouteCtx) => Promise<Response>;
+export declare const deleteMediaItem: (ctx: RouteCtx) => Promise<Response>;
+/**
+ * Serve an uploaded file's bytes. Public: these are referenced from published
+ * pages. `nosniff` plus the extension allowlist means an unrecognised type
+ * downloads rather than executing.
+ *
+ * Takes just a storage binding and a filename rather than a full `RouteCtx`, so
+ * a host can also mount it at its own `/uploads/[filename]` route — which is
+ * what keeps every absolute media URL already sitting in published content
+ * resolving after the migration.
+ */
+export declare const serveUploadBytes: (storage: CmsStorage, filename: string | undefined) => Promise<Response>;
+export declare const getUpload: (ctx: RouteCtx) => Promise<Response>;

package/dist/backend/routes/media.js ADDED Viewed

@@ -0,0 +1,119 @@
+/**
+ * The media library: list, upload, delete, and byte serving.
+ *
+ * The metadata index is editor-only — anonymous callers cannot enumerate what a
+ * project has uploaded — while the files themselves are public, since they are
+ * embedded in published pages.
+ */
+import { mkdir, writeFile, unlink, readFile } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { extname } from 'node:path';
+import { isSafeUploadFilename, uploadContentType } from '../storage.js';
+import { requireUser } from './context.js';
+const MAX_BYTES = 10 * 1024 * 1024;
+const ALLOWED_MIME = /^image\//;
+const MIME_TO_EXT = {
+    'image/jpeg': '.jpg',
+    'image/png': '.png',
+    'image/webp': '.webp',
+    'image/gif': '.gif',
+    'image/svg+xml': '.svg',
+    'image/avif': '.avif'
+};
+const sanitizeExt = (e) => (/^\.[a-z0-9]{1,8}$/i.test(e) ? e.toLowerCase() : '');
+export const getMedia = (ctx) => {
+    requireUser(ctx);
+    const url = ctx.event.url;
+    const offset = Math.max(0, Number(url.searchParams.get('offset') ?? 0) | 0);
+    const limitRaw = Number(url.searchParams.get('limit') ?? 50) | 0;
+    const limit = Math.min(200, Math.max(1, limitRaw));
+    return Response.json(ctx.store.listMediaItems(ctx.projectId, { offset, limit }));
+};
+/**
+ * Multipart upload. Generates a random slug, preserves the original extension
+ * (or derives one from the MIME type), writes it into the configured upload
+ * directory, and records metadata.
+ */
+export const postMedia = async (ctx) => {
+    const user = requireUser(ctx);
+    let formData;
+    try {
+        formData = await ctx.event.request.formData();
+    }
+    catch {
+        return new Response('expected multipart form-data', { status: 400 });
+    }
+    const file = formData.get('file');
+    if (!(file instanceof File))
+        return new Response('file field required', { status: 400 });
+    if (!ALLOWED_MIME.test(file.type)) {
+        return new Response('only images are supported', { status: 415 });
+    }
+    if (file.size > MAX_BYTES)
+        return new Response('file too large', { status: 413 });
+    const ext = sanitizeExt(extname(file.name)) || MIME_TO_EXT[file.type] || '';
+    const slug = randomBytes(8).toString('hex');
+    const filename = `${slug}${ext}`;
+    await mkdir(ctx.storage.dir(), { recursive: true });
+    await writeFile(ctx.storage.path(filename), Buffer.from(await file.arrayBuffer()));
+    const item = ctx.store.createMediaItem(ctx.projectId, {
+        filename,
+        originalName: file.name || filename,
+        mime: file.type,
+        size: file.size,
+        url: ctx.mediaUrl(filename),
+        uploadedBy: user.id
+    });
+    return Response.json(item, { status: 201 });
+};
+export const deleteMediaItem = async (ctx) => {
+    requireUser(ctx);
+    const id = ctx.params.id;
+    if (!id)
+        return new Response(null, { status: 404 });
+    const removed = ctx.store.deleteMediaItem(ctx.projectId, id);
+    if (!removed)
+        return new Response(null, { status: 404 });
+    // Tolerate filesystem drift — the database record is the source of truth.
+    await unlink(ctx.storage.path(removed.filename)).catch(() => { });
+    return new Response(null, { status: 204 });
+};
+/**
+ * Serve an uploaded file's bytes. Public: these are referenced from published
+ * pages. `nosniff` plus the extension allowlist means an unrecognised type
+ * downloads rather than executing.
+ *
+ * Takes just a storage binding and a filename rather than a full `RouteCtx`, so
+ * a host can also mount it at its own `/uploads/[filename]` route — which is
+ * what keeps every absolute media URL already sitting in published content
+ * resolving after the migration.
+ */
+export const serveUploadBytes = async (storage, filename) => {
+    if (!filename || !isSafeUploadFilename(filename)) {
+        return new Response(null, { status: 404 });
+    }
+    let bytes;
+    try {
+        bytes = await readFile(storage.path(filename));
+    }
+    catch {
+        return new Response(null, { status: 404 });
+    }
+    return new Response(new Uint8Array(bytes), {
+        status: 200,
+        headers: {
+            'content-type': uploadContentType(filename),
+            'content-length': String(bytes.byteLength),
+            // Names are random slugs whose content never changes, which is what
+            // lets the build plugin skip a file it has already downloaded.
+            'cache-control': 'public, max-age=31536000, immutable',
+            // An SVG is a document, and this one is served from the origin the
+            // editor signs in to. The sandbox stops an uploaded file running
+            // script against that origin; `nosniff` stops a browser deciding
+            // some other upload is one.
+            'content-security-policy': "default-src 'none'; sandbox",
+            'x-content-type-options': 'nosniff'
+        }
+    });
+};
+export const getUpload = (ctx) => serveUploadBytes(ctx.storage, ctx.params.filename);

package/dist/backend/routes/pages.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import { type RouteCtx } from './context.js';
+export declare const getPages: (ctx: RouteCtx) => Response;
+export declare const postPages: (ctx: RouteCtx) => Promise<Response>;
+/**
+ * Remove a page from the editor's view. A draft (a page item in the caller's
+ * open release with nothing published behind it) is dropped outright — it never
+ * reached publish, so no history is kept. A published page is staged instead;
+ * the deletion and its history entry happen at publish time.
+ */
+export declare const deletePages: (ctx: RouteCtx) => Promise<Response>;
+/**
+ * Change a page's params — a slug rename.
+ *
+ * The admin bar has called this since it shipped; there was never a handler
+ * behind it, so renaming silently failed. `toUrl` is the resolved path for the
+ * new params, used as the redirect target so the old URL keeps working once the
+ * release is published.
+ */
+export declare const postPagesRename: (ctx: RouteCtx) => Promise<Response>;

package/dist/backend/routes/pages.js ADDED Viewed

@@ -0,0 +1,221 @@
+import { DEFAULT_LOCALE } from '../store/queries.js';
+import { badRequest, isObjectRecord, isStringRecord, readJson, requireUser } from './context.js';
+const parseOutcome = (v) => {
+    if (v == null)
+        return undefined;
+    if (!isObjectRecord(v))
+        return 'invalid';
+    if (v.kind === 'gone')
+        return { kind: 'gone' };
+    if (v.kind === 'redirect') {
+        if (typeof v.to !== 'string' || v.to === '')
+            return 'invalid';
+        return { kind: 'redirect', to: v.to };
+    }
+    return 'invalid';
+};
+/**
+ * SvelteKit param segments: `[name]`, `[name=matcher]`, `[...rest]`,
+ * `[[optional]]`. Group folders like `(marketing)` use parens, not brackets,
+ * and contribute no params.
+ */
+const ownedParamsFromRouteId = (routeId) => {
+    const out = [];
+    const re = /\[(\.{3}|\[)?([^\]=]+?)(?:=[^\]]+)?\]?\]/g;
+    let m;
+    while ((m = re.exec(routeId)) !== null)
+        out.push(m[2]);
+    return out;
+};
+const paramsKey = (params) => {
+    const keys = Object.keys(params).sort();
+    return keys.map((k) => `${k}=${params[k]}`).join('&');
+};
+/**
+ * The page-route list, derived from published rows plus any routeIds the
+ * caller's open release references. There is no authoritative route registry —
+ * the backend never sees the app's route tree.
+ */
+const collectPageRoutes = (ctx, userId) => {
+    const ids = new Set(ctx.store.allPageRouteIds(ctx.projectId));
+    if (userId) {
+        const release = ctx.store.getOpenRelease(ctx.projectId, userId);
+        if (release) {
+            for (const item of release.items) {
+                if (item.kind === 'page' || item.kind === 'page-delete')
+                    ids.add(item.routeId);
+            }
+        }
+    }
+    return [...ids].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+};
+const buildRoutes = (ctx, userId, locale) => {
+    const fromUser = ctx.store.listAllPages(ctx.projectId, userId, locale);
+    const byRouteId = new Map();
+    for (const r of fromUser)
+        byRouteId.set(r.routeId, r.entries);
+    return collectPageRoutes(ctx, userId).map((routeId) => ({
+        routeId,
+        ownedParams: ownedParamsFromRouteId(routeId),
+        entries: byRouteId.get(routeId) ?? []
+    }));
+};
+export const getPages = (ctx) => {
+    const { event, projectId, store, respond } = ctx;
+    const locale = event.url.searchParams.get('locale') ?? DEFAULT_LOCALE;
+    const versionKey = event.url.searchParams.get('version');
+    if (versionKey) {
+        const release = store.findPublishedReleaseByPreviewKey(projectId, versionKey);
+        if (!release)
+            return new Response('release not found', { status: 404 });
+        const snap = store.buildStateAtRelease(projectId, release.id);
+        if (!snap)
+            return new Response('release not found', { status: 404 });
+        const localeBucket = snap.pageSnap[locale] ?? {};
+        const routes = Object.keys(localeBucket)
+            .sort()
+            .map((routeId) => {
+            const entries = (localeBucket[routeId] ?? [])
+                .map((e) => {
+                const meta = e.published?.metadata;
+                const metadata = meta && typeof meta === 'object' && !Array.isArray(meta)
+                    ? { ...meta }
+                    : {};
+                const entry = {
+                    params: { ...e.params },
+                    metadata,
+                    isDraft: false,
+                    isDeletePending: false
+                };
+                if (e.tombstone?.kind === 'redirect')
+                    entry.redirectTo = e.tombstone.to;
+                else if (e.tombstone?.kind === 'gone')
+                    entry.gone = true;
+                return entry;
+            })
+                .sort((a, b) => {
+                const ak = paramsKey(a.params);
+                const bk = paramsKey(b.params);
+                return ak < bk ? -1 : ak > bk ? 1 : 0;
+            });
+            return { routeId, ownedParams: ownedParamsFromRouteId(routeId), entries };
+        });
+        return respond.serveImmutableJson(event, { routes });
+    }
+    const userId = ctx.user?.id ?? '';
+    if (!userId) {
+        const cacheCheck = respond.tryPublicCache(event, projectId, `pages:${locale}`);
+        if (cacheCheck.hit)
+            return cacheCheck.response;
+        return respond.servePublicJson(event, projectId, `pages:${locale}`, cacheCheck, {
+            routes: buildRoutes(ctx, '', locale)
+        });
+    }
+    return Response.json({ routes: buildRoutes(ctx, userId, locale) });
+};
+export const postPages = async (ctx) => {
+    const user = requireUser(ctx);
+    const body = await readJson(ctx.event);
+    if (body === undefined)
+        return badRequest('invalid json');
+    if (!isObjectRecord(body))
+        return badRequest('object body required');
+    const { routeId, locale, params, metadata } = body;
+    if (typeof routeId !== 'string' || routeId === '')
+        return badRequest('routeId required');
+    if (typeof locale !== 'string' || locale === '')
+        return badRequest('locale required');
+    if (!isStringRecord(params)) {
+        return badRequest('params must be a string-keyed object of strings');
+    }
+    if (metadata != null && !isObjectRecord(metadata)) {
+        return badRequest('metadata must be an object');
+    }
+    const result = ctx.store.createPage(ctx.projectId, user.id, routeId, locale, params, metadata);
+    if (!result.ok)
+        return Response.json({ error: 'page-exists' }, { status: 409 });
+    return Response.json({ ok: true });
+};
+/**
+ * Remove a page from the editor's view. A draft (a page item in the caller's
+ * open release with nothing published behind it) is dropped outright — it never
+ * reached publish, so no history is kept. A published page is staged instead;
+ * the deletion and its history entry happen at publish time.
+ */
+export const deletePages = async (ctx) => {
+    const user = requireUser(ctx);
+    const body = await readJson(ctx.event);
+    if (body === undefined)
+        return badRequest('invalid json');
+    if (!isObjectRecord(body))
+        return badRequest('object body required');
+    const { routeId, locale, params, outcome: rawOutcome } = body;
+    if (typeof routeId !== 'string' || routeId === '')
+        return badRequest('routeId required');
+    if (typeof locale !== 'string' || locale === '')
+        return badRequest('locale required');
+    if (!isStringRecord(params)) {
+        return badRequest('params must be a string-keyed object of strings');
+    }
+    const outcome = parseOutcome(rawOutcome);
+    if (outcome === 'invalid') {
+        return badRequest('outcome must be { kind: "gone" } or { kind: "redirect", to: string }');
+    }
+    const draftRemoved = ctx.store.discardReleaseItem(ctx.projectId, user.id, {
+        kind: 'page',
+        routeId,
+        locale,
+        params
+    });
+    if (draftRemoved)
+        return Response.json({ ok: true, mode: 'draft-discarded' });
+    const staged = ctx.store.stagePageDelete(ctx.projectId, user.id, routeId, locale, params, outcome);
+    if (!staged.ok) {
+        if (staged.reason === 'not-published')
+            return new Response(null, { status: 404 });
+        return Response.json({ error: staged.reason }, { status: 409 });
+    }
+    return Response.json({ ok: true, mode: 'delete-staged' });
+};
+/**
+ * Change a page's params — a slug rename.
+ *
+ * The admin bar has called this since it shipped; there was never a handler
+ * behind it, so renaming silently failed. `toUrl` is the resolved path for the
+ * new params, used as the redirect target so the old URL keeps working once the
+ * release is published.
+ */
+export const postPagesRename = async (ctx) => {
+    const user = requireUser(ctx);
+    const body = await readJson(ctx.event);
+    if (body === undefined)
+        return badRequest('invalid json');
+    if (!isObjectRecord(body))
+        return badRequest('object body required');
+    const { routeId, fromParams, toParams, locale, toUrl } = body;
+    if (typeof routeId !== 'string' || routeId === '')
+        return badRequest('routeId required');
+    if (typeof locale !== 'string' || locale === '')
+        return badRequest('locale required');
+    if (!isStringRecord(fromParams))
+        return badRequest('fromParams must be a string-keyed object');
+    if (!isStringRecord(toParams))
+        return badRequest('toParams must be a string-keyed object');
+    if (typeof toUrl !== 'string' || toUrl === '')
+        return badRequest('toUrl required');
+    const result = ctx.store.renamePage(ctx.projectId, user.id, {
+        routeId,
+        locale,
+        fromParams,
+        toParams,
+        toUrl
+    });
+    if (!result.ok) {
+        if (result.reason === 'not-found')
+            return new Response(null, { status: 404 });
+        if (result.reason === 'same-params')
+            return badRequest('toParams matches fromParams');
+        return Response.json({ error: 'page-exists' }, { status: 409 });
+    }
+    return Response.json({ release: result.release });
+};

package/dist/backend/routes/release.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import { type RouteCtx } from './context.js';
+export declare const getRelease: (ctx: RouteCtx) => Response;
+export declare const postReleaseItems: (ctx: RouteCtx) => Promise<Response>;
+export declare const deleteReleaseItems: (ctx: RouteCtx) => Promise<Response>;
+export declare const postReleasePublish: (ctx: RouteCtx) => Promise<Response>;
+export declare const postReleaseDiscard: (ctx: RouteCtx) => Response;
+export declare const postReleasePreviewKey: (ctx: RouteCtx) => Response;
+export declare const getReleaseHistory: (ctx: RouteCtx) => Response;
+export declare const postReleaseRevert: (ctx: RouteCtx) => Response;
+export declare const postReleaseHistoryPreviewKey: (ctx: RouteCtx) => Response;