@velora-cms/server 0.11.0 → 0.12.1

package/README.md

@@ -63,3 +63,9 @@ endpoint — `S3_ENDPOINT` (defaults to `http://localhost:9000`),
 
 Full documentation, guides, and the API reference live at
 [docs.velora-cms.com](https://docs.velora-cms.com).
+
+## Source & support
+
+Velora's source is not public. Questions and bug reports:
+[velora-starter](https://github.com/velora-cms/velora-starter).
+Docs at https://docs.velora-cms.com. Licensed Apache-2.0.

package/dist/admin/sync-admin-bundle.d.ts

@@ -0,0 +1,9 @@
+export declare function serverVersion(): string;
+export declare function readBundleStamp(dir: string): string | null;
+export declare function syncAdminBundle(targetDir: string, opts?: {
+    sourceDir?: string;
+    force?: boolean;
+}): Promise<{
+    copied: number;
+    version: string;
+}>;

package/dist/admin/sync-admin-bundle.js

@@ -0,0 +1,120 @@
+import { cpSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+// S186b (visible scaffold): a scaffolded site copies the installed admin
+// bundle out to its own public/velora/admin instead of serving it straight
+// out of node_modules, so it needs a way to re-copy after
+// `npm update @velora-cms/server`. This is that machinery — wrapped by the
+// velora-sync-admin bin (../bin-sync-admin.ts) and consulted (read-only, via
+// readBundleStamp + serverVersion) by admin-static.ts's boot drift warning.
+// Both callers run with cwd set to the USER's project, never this package,
+// so every path here is resolved relative to this module (dirname-based),
+// same as copy-admin-bundle.ts, never relative to cwd.
+const STAMP_FILE = ".velora-version";
+function packageJsonPath() {
+    const here = dirname(fileURLToPath(import.meta.url)); // <server>/dist/admin or src/admin
+    return join(here, "..", "..", "package.json");
+}
+// Exported so bin-sync-admin.ts and admin-static.ts's boot warning read the
+// exact same version copy-admin-bundle.ts stamped the installed bundle
+// with, resolved the same dirname-relative way.
+export function serverVersion() {
+    const pkg = JSON.parse(readFileSync(packageJsonPath(), "utf8"));
+    return pkg.version;
+}
+// The stamp a copied-out bundle carries, or null when there isn't one —
+// pre-S186b copies and the packaged/dev fallback candidates never have a
+// stamp, and that must stay a quiet, non-throwing case, not an error.
+export function readBundleStamp(dir) {
+    try {
+        return readFileSync(join(dir, STAMP_FILE), "utf8").trim();
+    }
+    catch {
+        return null;
+    }
+}
+function countFiles(dir) {
+    let count = 0;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const full = join(dir, entry.name);
+        count += entry.isDirectory() ? countFiles(full) : 1;
+    }
+    return count;
+}
+// Review finding C1 (demonstrated data loss): syncAdminBundle used to
+// rm-rf whatever targetDir resolved to, no questions asked. A reviewer
+// pointed VELORA_ADMIN_DIR at a user's `public/` and it wiped it. This is
+// the guard that runs before ANY destructive step: a target is safe to
+// replace only when it doesn't exist yet, is empty, or already looks like
+// an admin bundle (carries our own stamp, or an index.html — the two
+// things an admin bundle always has). Anything else — a directory with
+// unrelated content — is refused unless the caller explicitly overrides
+// with --force (bin-sync-admin.ts) / { force: true } (this function).
+function looksLikeAdminTarget(dir) {
+    if (!existsSync(dir))
+        return true;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        // Exists but isn't a readable directory (e.g. a plain file sitting at
+        // that path) — never safe to treat as an admin bundle.
+        return false;
+    }
+    if (entries.length === 0)
+        return true;
+    return entries.includes(STAMP_FILE) || entries.includes("index.html");
+}
+// Replaces targetDir (resolved against cwd — the caller's project, not this
+// package) with a fresh copy of the installed admin bundle. Nothing outside
+// targetDir is ever touched, and — per review finding M4 — targetDir itself
+// is never left in a half-replaced state: the new bundle is fully staged
+// in a sibling directory first, and only once that staging copy is
+// complete (files copied, stamp written) does the old target get removed
+// and the staging directory renamed into place. A crash or throw before
+// the rename leaves the OLD target untouched and the new bundle sitting,
+// intact, in the staging directory — never a target that is neither the
+// old bundle nor the new one.
+export async function syncAdminBundle(targetDir, opts) {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const sourceDir = opts?.sourceDir ?? join(here, "..", "admin-bundle");
+    const resolvedTarget = resolve(targetDir);
+    if (!existsSync(sourceDir)) {
+        throw new Error(`No admin bundle found at ${sourceDir} — is @velora-cms/server installed correctly? ` +
+            "Reinstall the package, or rebuild it, and try again.");
+    }
+    if (!opts?.force && !looksLikeAdminTarget(resolvedTarget)) {
+        throw new Error(`${resolvedTarget} doesn't look like an admin bundle — refusing to replace it (pass --force to override)`);
+    }
+    // Sibling of the target, never inside it — same directory so the final
+    // rename is same-volume (atomic-ish) rather than a cross-device move.
+    const stagingDir = `${resolvedTarget}.staging-${process.pid}`;
+    // Clear out any leftover from a previous run that crashed before renaming
+    // (see the throw below) — this run's staging copy must start clean.
+    rmSync(stagingDir, { recursive: true, force: true });
+    cpSync(sourceDir, stagingDir, { recursive: true });
+    const version = serverVersion();
+    // Counted BEFORE the stamp is written (review finding M6): the reported
+    // count is the asset count copied from the source bundle, not inflated
+    // by our own bookkeeping file.
+    const copied = countFiles(stagingDir);
+    writeFileSync(join(stagingDir, STAMP_FILE), version);
+    // maxRetries/retryDelay: Windows can hold a brief EBUSY/EPERM lock on a
+    // just-closed file handle (AV scanners, indexers) — retrying beats
+    // failing a sync that would otherwise succeed a moment later.
+    rmSync(resolvedTarget, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+    try {
+        renameSync(stagingDir, resolvedTarget);
+    }
+    catch (err) {
+        // The old target is already gone (removed above) and the rename
+        // failed, so there's no "restore the old copy" move available. Nothing
+        // is lost, though: the fully-synced new bundle is still sitting at
+        // stagingDir. Name both paths so the caller can recover by hand.
+        throw new Error(`Synced the admin UI into ${stagingDir} but could not move it into place at ${resolvedTarget}: ` +
+            `${err instanceof Error ? err.message : String(err)}. The new bundle is intact at ${stagingDir} — ` +
+            "move it to the target path manually, or re-run the sync.");
+    }
+    return { copied, version };
+}

package/dist/admin-bundle/.velora-version

@@ -0,0 +1 @@
+0.12.1

package/dist/admin-bundle/assets/{_virtual_mf-localSharedImportMap___mfe_internal__velora_admin__mf_owner__1-DOKdWYyj.js → _virtual_mf-localSharedImportMap___mfe_internal__velora_admin__mf_owner__1-DlIgIuFP.js}

@@ -1 +1 @@
-import{_ as a}from"./vite-preload-helper-Cgledu0r.js";import"./index-Do71v6NZ.js";const n={react:async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react__loadShare__.js-BuUBskgj.js").then(t=>t.x),[]),"react/jsx-runtime":async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-DMaku-HC.js").then(t=>t.c),[]),"react-dom":async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react_mf_2_dom__loadShare__.js-DYfqn12F.js").then(t=>t.d),[]),"react-dom/client":async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react_mf_2_dom_mf_1_client__loadShare__.js-BPoj3DC9.js").then(t=>t.a),[]),"@velora-cms/plugin-sdk":async()=>await a(()=>import("./index-DhMY-0sC.js"),[])},o={react:{name:"react",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o.react.loaded=!0;const{react:r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"react/jsx-runtime":{name:"react/jsx-runtime",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["react/jsx-runtime"].loaded=!0;const{"react/jsx-runtime":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"react-dom":{name:"react-dom",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["react-dom"].loaded=!0;const{"react-dom":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"react-dom/client":{name:"react-dom/client",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["react-dom/client"].loaded=!0;const{"react-dom/client":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"@velora-cms/plugin-sdk":{name:"@velora-cms/plugin-sdk",version:"0.11.0",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["@velora-cms/plugin-sdk"].loaded=!0;const{"@velora-cms/plugin-sdk":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"*",strictVersion:!1,eager:!1}}},u=[];export{u as usedRemotes,o as usedShared};
+import{_ as a}from"./vite-preload-helper-Cgledu0r.js";import"./index-Do71v6NZ.js";const n={react:async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react__loadShare__.js-BuUBskgj.js").then(t=>t.x),[]),"react/jsx-runtime":async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-DMaku-HC.js").then(t=>t.c),[]),"react-dom":async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react_mf_2_dom__loadShare__.js-DYfqn12F.js").then(t=>t.d),[]),"react-dom/client":async()=>await a(()=>import("./_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare__react_mf_2_dom_mf_1_client__loadShare__.js-BPoj3DC9.js").then(t=>t.a),[]),"@velora-cms/plugin-sdk":async()=>await a(()=>import("./index-CHCGuSbb.js"),[])},o={react:{name:"react",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o.react.loaded=!0;const{react:r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"react/jsx-runtime":{name:"react/jsx-runtime",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["react/jsx-runtime"].loaded=!0;const{"react/jsx-runtime":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"react-dom":{name:"react-dom",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["react-dom"].loaded=!0;const{"react-dom":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"react-dom/client":{name:"react-dom/client",version:"19.2.7",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["react-dom/client"].loaded=!0;const{"react-dom/client":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"^19.2.7",strictVersion:!1,eager:!1}},"@velora-cms/plugin-sdk":{name:"@velora-cms/plugin-sdk",version:"0.11.0",scope:["default"],loaded:!1,materialize:!0,eager:!1,from:"velora_admin",canLiveRebind:!0,async get(){o["@velora-cms/plugin-sdk"].loaded=!0;const{"@velora-cms/plugin-sdk":r}=n,e={...await r()};return e.__esModule!==!0&&Object.defineProperty(e,"__esModule",{value:!0,enumerable:!1}),function(){return e}},shareConfig:{singleton:!0,requiredVersion:"*",strictVersion:!1,eager:!1}}},u=[];export{u as usedRemotes,o as usedShared};

package/dist/admin-bundle/assets/{_virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare___mf_0_velora_mf_2_cms_mf_1_plugin_mf_2_sdk__loadShare__.js-C1-ZAxwO.js → _virtual_mf___mfe_internal__velora_admin__mf_owner__1__loadShare___mf_0_velora_mf_2_cms_mf_1_plugin_mf_2_sdk__loadShare__.js-Bm9EahCG.js}

@@ -1,2 +1,2 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index-DhMY-0sC.js","assets/content-trash.schema-DfXHkC-w.js"])))=>i.map(i=>d[i]);
-import{_ as b}from"./vite-preload-helper-Cgledu0r.js";const g="__mf_init__virtual:mf:__mfe_internal__velora_admin__mf_owner__1__mf_v__runtimeInit__mf_v__.js__";let c=globalThis[g];if(!c){let e,a;const t=new Promise((i,s)=>{e=i,a=s});c=globalThis[g]={initPromise:t,initResolve:e,initReject:a}}const P=c.initPromise,_="__mf_module_cache__";globalThis[_]||={share:{},remote:{}};globalThis[_].share||={};globalThis[_].remote||={};const l=globalThis[_];for(const e of Object.keys(l.share))if(e.startsWith("default:")){const a=e.slice(8);l.share[a]===void 0&&(l.share[a]=l.share[e])}else if(!e.includes(":")){const a="default:"+e;l.share[a]===void 0&&(l.share[a]=l.share[e])}const d=(e,a)=>{const t=e[a.canonical];if(t!==void 0)return t;const i=a.aliases||[];for(const s of i){if(!Object.prototype.hasOwnProperty.call(e,s))continue;const n=e[s];if(n!==void 0)return e[a.canonical]=n,n}},u=Symbol.for("module-federation.shared-cache-listeners"),p=e=>{let a=e[u];return a===void 0&&(a=Object.create(null),Object.defineProperty(e,u,{value:a,enumerable:!1,configurable:!1,writable:!1})),a},v=(e,a,t)=>{const i=p(e);(i[a.canonical]||=new Set).add(t)},h=Symbol.for("module-federation.shared-cache-owners"),S=e=>{let a=e[h];return a===void 0&&(a=Object.create(null),Object.defineProperty(e,h,{value:a,enumerable:!1,configurable:!1,writable:!1})),a},y=(e,a,t,i)=>{var r;e[a.canonical]=t;const s=a.aliases||[];for(const f of s)Object.defineProperty(e,f,{value:t,enumerable:!0,configurable:!0,writable:!0});e[h],S(e)[a.canonical]=i;const n=(r=e[u])==null?void 0:r[a.canonical];if(n)for(const f of n)f(t);return t},O=e=>{const a=(()=>{let t=e;for(let i=0;i<5;i++){const s=t==null?void 0:t.default;if(!s||typeof s!="object")break;const n=Object.keys(t).filter(r=>r!=="default").map(r=>t[r]);if(n.length>0&&n.some(r=>r!==void 0))break;t=s}return t})();return a&&Object.getPrototypeOf(a)===null?Object.assign({},a):a};let j,w,C,T,k,A,D,K,V,E;const m=e=>{e.CMSPluginSchema,e.DataTypePluginSchema,e.validatePluginManifest,j=e.definePlugin,e.PluginDefinitionError,w=e.registerDataType,C=e.getDataType,T=e.listDataTypes,k=e.registerAdminSection,A=e.getAdminSection,D=e.listAdminSections,K=e.PluginValueProvider,V=e.PluginSettingsProvider,E=e.PluginApiProvider,e.usePluginValue,e.usePluginSettings,e.usePluginSettingsValue,e.usePluginApi,e.SimpleStorageValueProvider,e.Panel,e.PropertyField,e.COMPONENT,e.usePropertyFieldControl,e.Input,e.Button,e.Switch,e.Badge,e.cn,e.default};v(l.share,{canonical:"default:@velora-cms/plugin-sdk"},m);let o=d(l.share,{canonical:"default:@velora-cms/plugin-sdk",aliases:["@velora-cms/plugin-sdk"]});o===void 0?(l.pendingShareLoads||=[]).push(P.then(()=>{if(o=d(l.share,{canonical:"default:@velora-cms/plugin-sdk",aliases:["@velora-cms/plugin-sdk"]}),o!==void 0){m(o);return}return b(()=>import("./index-DhMY-0sC.js"),__vite__mapDeps([0,1])).then(e=>{o=O(e),y(l.share,{canonical:"default:@velora-cms/plugin-sdk",aliases:["@velora-cms/plugin-sdk"]},o,"velora_admin")})})):m(o);export{j as _,C as a,w as b,A as c,k as d,E as e,K as f,V as g,D as h,T as i};
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index-CHCGuSbb.js","assets/content-trash.schema-tvJ4Lbos.js"])))=>i.map(i=>d[i]);
+import{_ as b}from"./vite-preload-helper-Cgledu0r.js";const g="__mf_init__virtual:mf:__mfe_internal__velora_admin__mf_owner__1__mf_v__runtimeInit__mf_v__.js__";let c=globalThis[g];if(!c){let e,a;const t=new Promise((i,s)=>{e=i,a=s});c=globalThis[g]={initPromise:t,initResolve:e,initReject:a}}const P=c.initPromise,_="__mf_module_cache__";globalThis[_]||={share:{},remote:{}};globalThis[_].share||={};globalThis[_].remote||={};const l=globalThis[_];for(const e of Object.keys(l.share))if(e.startsWith("default:")){const a=e.slice(8);l.share[a]===void 0&&(l.share[a]=l.share[e])}else if(!e.includes(":")){const a="default:"+e;l.share[a]===void 0&&(l.share[a]=l.share[e])}const d=(e,a)=>{const t=e[a.canonical];if(t!==void 0)return t;const i=a.aliases||[];for(const s of i){if(!Object.prototype.hasOwnProperty.call(e,s))continue;const n=e[s];if(n!==void 0)return e[a.canonical]=n,n}},u=Symbol.for("module-federation.shared-cache-listeners"),p=e=>{let a=e[u];return a===void 0&&(a=Object.create(null),Object.defineProperty(e,u,{value:a,enumerable:!1,configurable:!1,writable:!1})),a},v=(e,a,t)=>{const i=p(e);(i[a.canonical]||=new Set).add(t)},h=Symbol.for("module-federation.shared-cache-owners"),S=e=>{let a=e[h];return a===void 0&&(a=Object.create(null),Object.defineProperty(e,h,{value:a,enumerable:!1,configurable:!1,writable:!1})),a},y=(e,a,t,i)=>{var r;e[a.canonical]=t;const s=a.aliases||[];for(const f of s)Object.defineProperty(e,f,{value:t,enumerable:!0,configurable:!0,writable:!0});e[h],S(e)[a.canonical]=i;const n=(r=e[u])==null?void 0:r[a.canonical];if(n)for(const f of n)f(t);return t},O=e=>{const a=(()=>{let t=e;for(let i=0;i<5;i++){const s=t==null?void 0:t.default;if(!s||typeof s!="object")break;const n=Object.keys(t).filter(r=>r!=="default").map(r=>t[r]);if(n.length>0&&n.some(r=>r!==void 0))break;t=s}return t})();return a&&Object.getPrototypeOf(a)===null?Object.assign({},a):a};let j,w,C,T,k,A,D,K,V,E;const m=e=>{e.CMSPluginSchema,e.DataTypePluginSchema,e.validatePluginManifest,j=e.definePlugin,e.PluginDefinitionError,w=e.registerDataType,C=e.getDataType,T=e.listDataTypes,k=e.registerAdminSection,A=e.getAdminSection,D=e.listAdminSections,K=e.PluginValueProvider,V=e.PluginSettingsProvider,E=e.PluginApiProvider,e.usePluginValue,e.usePluginSettings,e.usePluginSettingsValue,e.usePluginApi,e.SimpleStorageValueProvider,e.Panel,e.PropertyField,e.COMPONENT,e.usePropertyFieldControl,e.Input,e.Button,e.Switch,e.Badge,e.cn,e.default};v(l.share,{canonical:"default:@velora-cms/plugin-sdk"},m);let o=d(l.share,{canonical:"default:@velora-cms/plugin-sdk",aliases:["@velora-cms/plugin-sdk"]});o===void 0?(l.pendingShareLoads||=[]).push(P.then(()=>{if(o=d(l.share,{canonical:"default:@velora-cms/plugin-sdk",aliases:["@velora-cms/plugin-sdk"]}),o!==void 0){m(o);return}return b(()=>import("./index-CHCGuSbb.js"),__vite__mapDeps([0,1])).then(e=>{o=O(e),y(l.share,{canonical:"default:@velora-cms/plugin-sdk",aliases:["@velora-cms/plugin-sdk"]},o,"velora_admin")})})):m(o);export{j as _,C as a,w as b,A as c,k as d,E as e,K as f,V as g,D as h,T as i};