@weatherboard/cms 0.0.0-stage → 0.2.0

package/dist/portable/webhook.d.cts

@@ -0,0 +1,133 @@
+/**
+ * Verifying a Sanity webhook (A-590 step 1, A-592's `SANITY_WEBHOOK_SECRET`).
+ *
+ * -------------------------------------------------------------------------
+ * WHY THIS ENDPOINT NEEDS A SIGNATURE AT ALL
+ * -------------------------------------------------------------------------
+ *
+ * `/revalidate` throws away cache entries. A-590: "An unauthenticated
+ * revalidation endpoint is a free cache-purge and rebuild trigger for anyone
+ * who finds the URL." On a plan whose API request allowance is a HARD cap that
+ * returns 402 rather than a bill, an attacker who can empty the cache at will
+ * can take a client's site content-offline for the rest of the month. So the
+ * signature is not hygiene here; it is the availability control.
+ *
+ * -------------------------------------------------------------------------
+ * THE WIRE FORMAT IS MEASURED, NOT REMEMBERED
+ * -------------------------------------------------------------------------
+ *
+ * Read on 2026-09-16 from Sanity's own toolkit,
+ * `https://raw.githubusercontent.com/sanity-io/webhook-toolkit/main/src/signature.ts`:
+ *
+ *   header            `sanity-webhook-signature`
+ *   value             `t=<millis>,v1=<signature>`  (regex `/^t=(\d+)[, ]+v1=([^, ]+)$/`)
+ *   signed payload    `` `${timestamp}.${body}` ``
+ *   algorithm         HMAC-SHA256
+ *   digest encoding   base64url — standard base64 with `+`→`-`, `/`→`_`, padding stripped
+ *   MINIMUM_TIMESTAMP 1609459200000 (2021-01-01Z), below which a value is nonsense
+ *
+ * `signature.test.ts` does not take that paragraph's word for it either: it
+ * signs a payload with `@sanity/webhook`'s own `encodeSignatureHeader` and
+ * asserts this verifier accepts it. If Sanity changes the format, that test
+ * goes red rather than production quietly rejecting every webhook.
+ *
+ * -------------------------------------------------------------------------
+ * WHAT THIS ADDS TO THE TOOLKIT, AND WHY IT IS NOT JUST IMPORTED
+ * -------------------------------------------------------------------------
+ *
+ * Two things, both of which are `CLAUDE.md`'s "take the safer construction".
+ *
+ * First, a REPLAY WINDOW. The toolkit enforces only that the timestamp is after
+ * 2021; a captured webhook is otherwise replayable forever. A replayed purge is
+ * the attack in the first paragraph, executed with a request somebody was
+ * legitimately sent. `verifySanityWebhook` takes a symmetric tolerance — the
+ * window is symmetric for A-44's reason, since a far-future timestamp is
+ * precisely how you mint a request that stays replayable for a year.
+ *
+ * Second, a MISSING SECRET IS A REJECTION, never a bypass. A-590 says it in as
+ * many words: "reject on absence rather than skipping the check when the secret
+ * is unset." The degraded mode of "no secret configured, so allow it" is
+ * produced by a deploy that forgot `wrangler secret put`, announces itself
+ * nowhere, and grants strangers the purge endpoint.
+ *
+ * The comparison is `crypto.subtle.verify`, which compares raw digests in
+ * constant time. A `===` on the base64 strings short-circuits at the first
+ * differing character, which turns one 2^256 search into a few dozen sequential
+ * 64-way ones against an endpoint that answers in milliseconds.
+ *
+ * -------------------------------------------------------------------------
+ * `encodeSignatureHeader` IS ASYNC. AWAIT IT. (A-651)
+ * -------------------------------------------------------------------------
+ *
+ * `@sanity/webhook@4.0.4` declares
+ *
+ *   encodeSignatureHeader(payload: string, timestamp: number, secret: string):
+ *     Promise<string>
+ *
+ * and nothing forces you to await it. Drop the `await` and the Promise is
+ * stringified into the header as the literal `[object Promise]`, which arrives
+ * here, fails `SIGNATURE_VALUE`, and is rejected as `malformed-signature`. The
+ * rejection is correct and the message is about the wire format, so it sends
+ * you to read Sanity's header spec — the one place the bug is not. TypeScript
+ * does not save you either: the value usually lands in a `Record<string,
+ * string>` built by a helper, or inside a template literal, both of which take
+ * a Promise without complaint.
+ *
+ * The rule: every call to `encodeSignatureHeader` is awaited, and the helper
+ * that wraps it is `async` rather than returning the Promise for someone else
+ * to forget. The content-client compatibility tests and CMS signer tests await every
+ * encoder call; this note exists so the next one
+ * is too, because the symptom will not tell you.
+ */
+/** Sanity's header. Lower-cased; `Headers.get` is case-insensitive either way. */
+export declare const SANITY_SIGNATURE_HEADER = "sanity-webhook-signature";
+/** 2021-01-01T00:00:00.000Z. Sanity's `MINIMUM_TIMESTAMP`; anything earlier is not a timestamp. */
+export declare const MINIMUM_TIMESTAMP = 1609459200000;
+/**
+ * How far from `now` a webhook timestamp may be, in milliseconds.
+ *
+ * Five minutes rather than A-44's sixty seconds: this one crosses Sanity's
+ * delivery queue rather than two NTP-synced clouds, and a retried delivery is a
+ * normal event. It is still a window rather than "forever", which is the whole
+ * difference from the toolkit.
+ */
+export declare const DEFAULT_TOLERANCE_MS = 300000;
+export type WebhookRejection = 
+/** `SANITY_WEBHOOK_SECRET` is unset or empty. Fail closed. */
+"no-secret"
+/** No `sanity-webhook-signature` header. */
+ | "no-signature"
+/** Header present but not `t=…,v1=…`, or `v1` is not decodable base64url. */
+ | "malformed-signature"
+/** Before 2021, or outside the tolerance in either direction. */
+ | "stale-timestamp"
+/** Well-formed, in window, wrong. */
+ | "bad-signature";
+export type WebhookVerification = {
+    ok: true;
+} | {
+    ok: false;
+    reason: WebhookRejection;
+};
+/**
+ * Verify a Sanity webhook delivery.
+ *
+ * `rawBody` must be the bytes as received — `await request.text()`, never
+ * `JSON.stringify(await request.json())`. A parse-and-restringify is not a
+ * byte-for-byte round trip (key order, number formatting, whitespace) and one
+ * byte changes the whole digest, so the symptom is every webhook failing after
+ * a refactor that looked like tidying.
+ *
+ * The `reason` is for our logs and our tests. It is never returned to the
+ * caller: "your signature was fine but your clock is stale" is the next step in
+ * an attack, handed over free.
+ */
+export declare function verifySanityWebhook(options: {
+    secret: string | undefined;
+    rawBody: string;
+    headers: {
+        get(name: string): string | null;
+    };
+    now?: number;
+    toleranceMs?: number;
+}): Promise<WebhookVerification>;

package/dist/portable/webhook.d.mts

@@ -0,0 +1,133 @@
+/**
+ * Verifying a Sanity webhook (A-590 step 1, A-592's `SANITY_WEBHOOK_SECRET`).
+ *
+ * -------------------------------------------------------------------------
+ * WHY THIS ENDPOINT NEEDS A SIGNATURE AT ALL
+ * -------------------------------------------------------------------------
+ *
+ * `/revalidate` throws away cache entries. A-590: "An unauthenticated
+ * revalidation endpoint is a free cache-purge and rebuild trigger for anyone
+ * who finds the URL." On a plan whose API request allowance is a HARD cap that
+ * returns 402 rather than a bill, an attacker who can empty the cache at will
+ * can take a client's site content-offline for the rest of the month. So the
+ * signature is not hygiene here; it is the availability control.
+ *
+ * -------------------------------------------------------------------------
+ * THE WIRE FORMAT IS MEASURED, NOT REMEMBERED
+ * -------------------------------------------------------------------------
+ *
+ * Read on 2026-09-16 from Sanity's own toolkit,
+ * `https://raw.githubusercontent.com/sanity-io/webhook-toolkit/main/src/signature.ts`:
+ *
+ *   header            `sanity-webhook-signature`
+ *   value             `t=<millis>,v1=<signature>`  (regex `/^t=(\d+)[, ]+v1=([^, ]+)$/`)
+ *   signed payload    `` `${timestamp}.${body}` ``
+ *   algorithm         HMAC-SHA256
+ *   digest encoding   base64url — standard base64 with `+`→`-`, `/`→`_`, padding stripped
+ *   MINIMUM_TIMESTAMP 1609459200000 (2021-01-01Z), below which a value is nonsense
+ *
+ * `signature.test.ts` does not take that paragraph's word for it either: it
+ * signs a payload with `@sanity/webhook`'s own `encodeSignatureHeader` and
+ * asserts this verifier accepts it. If Sanity changes the format, that test
+ * goes red rather than production quietly rejecting every webhook.
+ *
+ * -------------------------------------------------------------------------
+ * WHAT THIS ADDS TO THE TOOLKIT, AND WHY IT IS NOT JUST IMPORTED
+ * -------------------------------------------------------------------------
+ *
+ * Two things, both of which are `CLAUDE.md`'s "take the safer construction".
+ *
+ * First, a REPLAY WINDOW. The toolkit enforces only that the timestamp is after
+ * 2021; a captured webhook is otherwise replayable forever. A replayed purge is
+ * the attack in the first paragraph, executed with a request somebody was
+ * legitimately sent. `verifySanityWebhook` takes a symmetric tolerance — the
+ * window is symmetric for A-44's reason, since a far-future timestamp is
+ * precisely how you mint a request that stays replayable for a year.
+ *
+ * Second, a MISSING SECRET IS A REJECTION, never a bypass. A-590 says it in as
+ * many words: "reject on absence rather than skipping the check when the secret
+ * is unset." The degraded mode of "no secret configured, so allow it" is
+ * produced by a deploy that forgot `wrangler secret put`, announces itself
+ * nowhere, and grants strangers the purge endpoint.
+ *
+ * The comparison is `crypto.subtle.verify`, which compares raw digests in
+ * constant time. A `===` on the base64 strings short-circuits at the first
+ * differing character, which turns one 2^256 search into a few dozen sequential
+ * 64-way ones against an endpoint that answers in milliseconds.
+ *
+ * -------------------------------------------------------------------------
+ * `encodeSignatureHeader` IS ASYNC. AWAIT IT. (A-651)
+ * -------------------------------------------------------------------------
+ *
+ * `@sanity/webhook@4.0.4` declares
+ *
+ *   encodeSignatureHeader(payload: string, timestamp: number, secret: string):
+ *     Promise<string>
+ *
+ * and nothing forces you to await it. Drop the `await` and the Promise is
+ * stringified into the header as the literal `[object Promise]`, which arrives
+ * here, fails `SIGNATURE_VALUE`, and is rejected as `malformed-signature`. The
+ * rejection is correct and the message is about the wire format, so it sends
+ * you to read Sanity's header spec — the one place the bug is not. TypeScript
+ * does not save you either: the value usually lands in a `Record<string,
+ * string>` built by a helper, or inside a template literal, both of which take
+ * a Promise without complaint.
+ *
+ * The rule: every call to `encodeSignatureHeader` is awaited, and the helper
+ * that wraps it is `async` rather than returning the Promise for someone else
+ * to forget. The content-client compatibility tests and CMS signer tests await every
+ * encoder call; this note exists so the next one
+ * is too, because the symptom will not tell you.
+ */
+/** Sanity's header. Lower-cased; `Headers.get` is case-insensitive either way. */
+export declare const SANITY_SIGNATURE_HEADER = "sanity-webhook-signature";
+/** 2021-01-01T00:00:00.000Z. Sanity's `MINIMUM_TIMESTAMP`; anything earlier is not a timestamp. */
+export declare const MINIMUM_TIMESTAMP = 1609459200000;
+/**
+ * How far from `now` a webhook timestamp may be, in milliseconds.
+ *
+ * Five minutes rather than A-44's sixty seconds: this one crosses Sanity's
+ * delivery queue rather than two NTP-synced clouds, and a retried delivery is a
+ * normal event. It is still a window rather than "forever", which is the whole
+ * difference from the toolkit.
+ */
+export declare const DEFAULT_TOLERANCE_MS = 300000;
+export type WebhookRejection = 
+/** `SANITY_WEBHOOK_SECRET` is unset or empty. Fail closed. */
+"no-secret"
+/** No `sanity-webhook-signature` header. */
+ | "no-signature"
+/** Header present but not `t=…,v1=…`, or `v1` is not decodable base64url. */
+ | "malformed-signature"
+/** Before 2021, or outside the tolerance in either direction. */
+ | "stale-timestamp"
+/** Well-formed, in window, wrong. */
+ | "bad-signature";
+export type WebhookVerification = {
+    ok: true;
+} | {
+    ok: false;
+    reason: WebhookRejection;
+};
+/**
+ * Verify a Sanity webhook delivery.
+ *
+ * `rawBody` must be the bytes as received — `await request.text()`, never
+ * `JSON.stringify(await request.json())`. A parse-and-restringify is not a
+ * byte-for-byte round trip (key order, number formatting, whitespace) and one
+ * byte changes the whole digest, so the symptom is every webhook failing after
+ * a refactor that looked like tidying.
+ *
+ * The `reason` is for our logs and our tests. It is never returned to the
+ * caller: "your signature was fine but your clock is stale" is the next step in
+ * an attack, handed over free.
+ */
+export declare function verifySanityWebhook(options: {
+    secret: string | undefined;
+    rawBody: string;
+    headers: {
+        get(name: string): string | null;
+    };
+    now?: number;
+    toleranceMs?: number;
+}): Promise<WebhookVerification>;

package/dist/portable/webhook.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Verifying a Sanity webhook (A-590 step 1, A-592's `SANITY_WEBHOOK_SECRET`).
+ *
+ * -------------------------------------------------------------------------
+ * WHY THIS ENDPOINT NEEDS A SIGNATURE AT ALL
+ * -------------------------------------------------------------------------
+ *
+ * `/revalidate` throws away cache entries. A-590: "An unauthenticated
+ * revalidation endpoint is a free cache-purge and rebuild trigger for anyone
+ * who finds the URL." On a plan whose API request allowance is a HARD cap that
+ * returns 402 rather than a bill, an attacker who can empty the cache at will
+ * can take a client's site content-offline for the rest of the month. So the
+ * signature is not hygiene here; it is the availability control.
+ *
+ * -------------------------------------------------------------------------
+ * THE WIRE FORMAT IS MEASURED, NOT REMEMBERED
+ * -------------------------------------------------------------------------
+ *
+ * Read on 2026-09-16 from Sanity's own toolkit,
+ * `https://raw.githubusercontent.com/sanity-io/webhook-toolkit/main/src/signature.ts`:
+ *
+ *   header            `sanity-webhook-signature`
+ *   value             `t=<millis>,v1=<signature>`  (regex `/^t=(\d+)[, ]+v1=([^, ]+)$/`)
+ *   signed payload    `` `${timestamp}.${body}` ``
+ *   algorithm         HMAC-SHA256
+ *   digest encoding   base64url — standard base64 with `+`→`-`, `/`→`_`, padding stripped
+ *   MINIMUM_TIMESTAMP 1609459200000 (2021-01-01Z), below which a value is nonsense
+ *
+ * `signature.test.ts` does not take that paragraph's word for it either: it
+ * signs a payload with `@sanity/webhook`'s own `encodeSignatureHeader` and
+ * asserts this verifier accepts it. If Sanity changes the format, that test
+ * goes red rather than production quietly rejecting every webhook.
+ *
+ * -------------------------------------------------------------------------
+ * WHAT THIS ADDS TO THE TOOLKIT, AND WHY IT IS NOT JUST IMPORTED
+ * -------------------------------------------------------------------------
+ *
+ * Two things, both of which are `CLAUDE.md`'s "take the safer construction".
+ *
+ * First, a REPLAY WINDOW. The toolkit enforces only that the timestamp is after
+ * 2021; a captured webhook is otherwise replayable forever. A replayed purge is
+ * the attack in the first paragraph, executed with a request somebody was
+ * legitimately sent. `verifySanityWebhook` takes a symmetric tolerance — the
+ * window is symmetric for A-44's reason, since a far-future timestamp is
+ * precisely how you mint a request that stays replayable for a year.
+ *
+ * Second, a MISSING SECRET IS A REJECTION, never a bypass. A-590 says it in as
+ * many words: "reject on absence rather than skipping the check when the secret
+ * is unset." The degraded mode of "no secret configured, so allow it" is
+ * produced by a deploy that forgot `wrangler secret put`, announces itself
+ * nowhere, and grants strangers the purge endpoint.
+ *
+ * The comparison is `crypto.subtle.verify`, which compares raw digests in
+ * constant time. A `===` on the base64 strings short-circuits at the first
+ * differing character, which turns one 2^256 search into a few dozen sequential
+ * 64-way ones against an endpoint that answers in milliseconds.
+ *
+ * -------------------------------------------------------------------------
+ * `encodeSignatureHeader` IS ASYNC. AWAIT IT. (A-651)
+ * -------------------------------------------------------------------------
+ *
+ * `@sanity/webhook@4.0.4` declares
+ *
+ *   encodeSignatureHeader(payload: string, timestamp: number, secret: string):
+ *     Promise<string>
+ *
+ * and nothing forces you to await it. Drop the `await` and the Promise is
+ * stringified into the header as the literal `[object Promise]`, which arrives
+ * here, fails `SIGNATURE_VALUE`, and is rejected as `malformed-signature`. The
+ * rejection is correct and the message is about the wire format, so it sends
+ * you to read Sanity's header spec — the one place the bug is not. TypeScript
+ * does not save you either: the value usually lands in a `Record<string,
+ * string>` built by a helper, or inside a template literal, both of which take
+ * a Promise without complaint.
+ *
+ * The rule: every call to `encodeSignatureHeader` is awaited, and the helper
+ * that wraps it is `async` rather than returning the Promise for someone else
+ * to forget. The content-client compatibility tests and CMS signer tests await every
+ * encoder call; this note exists so the next one
+ * is too, because the symptom will not tell you.
+ */
+/** Sanity's header. Lower-cased; `Headers.get` is case-insensitive either way. */
+export declare const SANITY_SIGNATURE_HEADER = "sanity-webhook-signature";
+/** 2021-01-01T00:00:00.000Z. Sanity's `MINIMUM_TIMESTAMP`; anything earlier is not a timestamp. */
+export declare const MINIMUM_TIMESTAMP = 1609459200000;
+/**
+ * How far from `now` a webhook timestamp may be, in milliseconds.
+ *
+ * Five minutes rather than A-44's sixty seconds: this one crosses Sanity's
+ * delivery queue rather than two NTP-synced clouds, and a retried delivery is a
+ * normal event. It is still a window rather than "forever", which is the whole
+ * difference from the toolkit.
+ */
+export declare const DEFAULT_TOLERANCE_MS = 300000;
+export type WebhookRejection = 
+/** `SANITY_WEBHOOK_SECRET` is unset or empty. Fail closed. */
+"no-secret"
+/** No `sanity-webhook-signature` header. */
+ | "no-signature"
+/** Header present but not `t=…,v1=…`, or `v1` is not decodable base64url. */
+ | "malformed-signature"
+/** Before 2021, or outside the tolerance in either direction. */
+ | "stale-timestamp"
+/** Well-formed, in window, wrong. */
+ | "bad-signature";
+export type WebhookVerification = {
+    ok: true;
+} | {
+    ok: false;
+    reason: WebhookRejection;
+};
+/**
+ * Verify a Sanity webhook delivery.
+ *
+ * `rawBody` must be the bytes as received — `await request.text()`, never
+ * `JSON.stringify(await request.json())`. A parse-and-restringify is not a
+ * byte-for-byte round trip (key order, number formatting, whitespace) and one
+ * byte changes the whole digest, so the symptom is every webhook failing after
+ * a refactor that looked like tidying.
+ *
+ * The `reason` is for our logs and our tests. It is never returned to the
+ * caller: "your signature was fine but your clock is stale" is the next step in
+ * an attack, handed over free.
+ */
+export declare function verifySanityWebhook(options: {
+    secret: string | undefined;
+    rawBody: string;
+    headers: {
+        get(name: string): string | null;
+    };
+    now?: number;
+    toleranceMs?: number;
+}): Promise<WebhookVerification>;

package/dist/runtime/reader.d.cts

@@ -0,0 +1,51 @@
+import { type CmsQuery, type CmsResolution } from "../contracts/query.cjs";
+export type CmsFailure = "configuration" | "network" | "timeout" | "rate-limit" | "upstream" | "plan-limit" | "permission" | "malformed";
+export type CmsDiagnostic = {
+    readonly event: "cms.fallback" | "cms.partial-fallback" | "cms.refused";
+    readonly query: string;
+    readonly reason: CmsFailure | "missing" | "invalid-field";
+    readonly status?: number;
+    readonly fields: readonly string[];
+    readonly warnings?: CmsResolution<unknown>["warnings"];
+};
+export type CmsFetch = (url: string, init: RequestInit & {
+    next?: {
+        revalidate: number;
+        tags: string[];
+    };
+}) => Promise<Response>;
+export type CmsReadPolicy = {
+    readonly tags: readonly string[];
+    readonly revalidateSeconds: number;
+};
+export type CmsAdapterResult = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: CmsFailure;
+    readonly status?: number;
+};
+export type CmsAdapter = {
+    readonly scope: string;
+    read(query: Pick<CmsQuery<unknown>, "name" | "query" | "params">, policy: CmsReadPolicy): Promise<CmsAdapterResult>;
+};
+export type CmsReadResult<T> = {
+    readonly data: T;
+    readonly source: "cms" | "mixed" | "fallback";
+    readonly fallbackFields: readonly string[];
+    readonly reason?: CmsFailure | "missing" | "invalid-field";
+    readonly warnings?: CmsResolution<unknown>["warnings"];
+};
+export type CmsReaderOptions = {
+    readonly adapter: CmsAdapter;
+    readonly revalidateSeconds?: number;
+    readonly onDiagnostic?: (event: CmsDiagnostic) => void;
+};
+export type CmsReader = {
+    read<T>(query: CmsQuery<T>, options: {
+        readonly fallback: T;
+    }): Promise<CmsReadResult<T>>;
+};
+/** Forwards cache policy; persistence and rendered-output invalidation belong to the host. */
+export declare function createCmsReader(options: CmsReaderOptions): CmsReader;

package/dist/runtime/reader.d.mts

@@ -0,0 +1,51 @@
+import { type CmsQuery, type CmsResolution } from "../contracts/query.mjs";
+export type CmsFailure = "configuration" | "network" | "timeout" | "rate-limit" | "upstream" | "plan-limit" | "permission" | "malformed";
+export type CmsDiagnostic = {
+    readonly event: "cms.fallback" | "cms.partial-fallback" | "cms.refused";
+    readonly query: string;
+    readonly reason: CmsFailure | "missing" | "invalid-field";
+    readonly status?: number;
+    readonly fields: readonly string[];
+    readonly warnings?: CmsResolution<unknown>["warnings"];
+};
+export type CmsFetch = (url: string, init: RequestInit & {
+    next?: {
+        revalidate: number;
+        tags: string[];
+    };
+}) => Promise<Response>;
+export type CmsReadPolicy = {
+    readonly tags: readonly string[];
+    readonly revalidateSeconds: number;
+};
+export type CmsAdapterResult = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: CmsFailure;
+    readonly status?: number;
+};
+export type CmsAdapter = {
+    readonly scope: string;
+    read(query: Pick<CmsQuery<unknown>, "name" | "query" | "params">, policy: CmsReadPolicy): Promise<CmsAdapterResult>;
+};
+export type CmsReadResult<T> = {
+    readonly data: T;
+    readonly source: "cms" | "mixed" | "fallback";
+    readonly fallbackFields: readonly string[];
+    readonly reason?: CmsFailure | "missing" | "invalid-field";
+    readonly warnings?: CmsResolution<unknown>["warnings"];
+};
+export type CmsReaderOptions = {
+    readonly adapter: CmsAdapter;
+    readonly revalidateSeconds?: number;
+    readonly onDiagnostic?: (event: CmsDiagnostic) => void;
+};
+export type CmsReader = {
+    read<T>(query: CmsQuery<T>, options: {
+        readonly fallback: T;
+    }): Promise<CmsReadResult<T>>;
+};
+/** Forwards cache policy; persistence and rendered-output invalidation belong to the host. */
+export declare function createCmsReader(options: CmsReaderOptions): CmsReader;

package/dist/runtime/reader.d.ts

@@ -0,0 +1,51 @@
+import { type CmsQuery, type CmsResolution } from "../contracts/query.js";
+export type CmsFailure = "configuration" | "network" | "timeout" | "rate-limit" | "upstream" | "plan-limit" | "permission" | "malformed";
+export type CmsDiagnostic = {
+    readonly event: "cms.fallback" | "cms.partial-fallback" | "cms.refused";
+    readonly query: string;
+    readonly reason: CmsFailure | "missing" | "invalid-field";
+    readonly status?: number;
+    readonly fields: readonly string[];
+    readonly warnings?: CmsResolution<unknown>["warnings"];
+};
+export type CmsFetch = (url: string, init: RequestInit & {
+    next?: {
+        revalidate: number;
+        tags: string[];
+    };
+}) => Promise<Response>;
+export type CmsReadPolicy = {
+    readonly tags: readonly string[];
+    readonly revalidateSeconds: number;
+};
+export type CmsAdapterResult = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: CmsFailure;
+    readonly status?: number;
+};
+export type CmsAdapter = {
+    readonly scope: string;
+    read(query: Pick<CmsQuery<unknown>, "name" | "query" | "params">, policy: CmsReadPolicy): Promise<CmsAdapterResult>;
+};
+export type CmsReadResult<T> = {
+    readonly data: T;
+    readonly source: "cms" | "mixed" | "fallback";
+    readonly fallbackFields: readonly string[];
+    readonly reason?: CmsFailure | "missing" | "invalid-field";
+    readonly warnings?: CmsResolution<unknown>["warnings"];
+};
+export type CmsReaderOptions = {
+    readonly adapter: CmsAdapter;
+    readonly revalidateSeconds?: number;
+    readonly onDiagnostic?: (event: CmsDiagnostic) => void;
+};
+export type CmsReader = {
+    read<T>(query: CmsQuery<T>, options: {
+        readonly fallback: T;
+    }): Promise<CmsReadResult<T>>;
+};
+/** Forwards cache policy; persistence and rendered-output invalidation belong to the host. */
+export declare function createCmsReader(options: CmsReaderOptions): CmsReader;

package/dist/sanity.cjs

@@ -0,0 +1,2 @@
+"use strict";var w=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var z=Object.getOwnPropertyNames;var $=Object.prototype.hasOwnProperty;var R=(e,t)=>{for(var n in t)w(e,n,{get:t[n],enumerable:!0})},x=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of z(t))!$.call(e,s)&&s!==n&&w(e,s,{get:()=>t[s],enumerable:!(r=E(t,s))||r.enumerable});return e};var P=e=>x(w({},"__esModule",{value:!0}),e);var B={};R(B,{createSanityAdapter:()=>v,sanityBindingFromEnv:()=>I});module.exports=P(B);var Y=require("server-only");var M=/^[A-Za-z][A-Za-z0-9_]{0,63}$/,D=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,N=/^[a-z0-9]{6,12}\.[a-z][a-z0-9_-]{0,63}$/;function T(e){if(!e||!Array.isArray(e.types)||e.types.length===0)throw new TypeError("CMS dependencies require document types");let t=[...e.types];for(let r of t)if(typeof r!="string"||!M.test(r))throw new TypeError("Invalid CMS document type");if(e.ids!==void 0&&!Array.isArray(e.ids))throw new TypeError("Invalid CMS document IDs");let n=e.ids===void 0?void 0:[...e.ids];for(let r of n??[])if(typeof r!="string"||!D.test(r)||/^(drafts|versions)\./.test(r))throw new TypeError("Invalid CMS document ID");if(new Set(t).size+new Set(n).size>128)throw new TypeError("Too many CMS tags");return Object.freeze({types:Object.freeze(t),...n===void 0?{}:{ids:Object.freeze(n)}})}function b(e){if(!e||typeof e.name!="string"||!/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(e.name)||typeof e.query!="string"||e.query.trim()===""||typeof e.resolve!="function")throw new TypeError("Invalid CMS query configuration");let t=e.params;if(!t||typeof t!="object"||Object.getPrototypeOf(t)!==Object.prototype&&Object.getPrototypeOf(t)!==null)throw new TypeError("CMS params must be plain JSON scalars");let n={};for(let r of Reflect.ownKeys(t)){let s=Object.getOwnPropertyDescriptor(t,r);if(typeof r!="string"||!s||!Object.hasOwn(s,"value")||!s.enumerable)throw new TypeError("CMS params must be plain JSON scalars");let i=s.value;if(!(i===null||typeof i=="string"||typeof i=="boolean"||typeof i=="number"&&Number.isFinite(i)))throw new TypeError("CMS params must be plain JSON scalars");Object.defineProperty(n,r,{value:i,enumerable:!0})}return Object.freeze({name:e.name,query:e.query,params:Object.freeze(n),dependencies:T(e.dependencies),resolve:e.resolve})}function C(e,t){if(typeof e!="string"||e.length>77||!N.test(e))throw new TypeError("Invalid CMS scope");let n=T(t),r=[...[...new Set(n.types)].sort().map(s=>`cms:${e}:type:${s}`),...[...new Set(n.ids??[])].sort().map(s=>`cms:${e}:id:${s}`)];return Object.freeze(r)}var _=2*1024*1024;function A(e){if(!e||typeof e.projectId!="string"||!/^[a-z0-9]{6,12}$/.test(e.projectId)||typeof e.dataset!="string"||!/^[a-z][a-z0-9_-]{0,63}$/.test(e.dataset)||typeof e.apiVersion!="string"||!/^v?\d{4}-\d{2}-\d{2}$/.test(e.apiVersion))throw new TypeError("Invalid Sanity binding configuration");return Object.freeze({projectId:e.projectId,dataset:e.dataset,apiVersion:e.apiVersion.replace(/^v/,"")})}function v(e){let t=A(e?.binding),n=e.timeoutMs??1500,r=e.readToken;if(!Number.isSafeInteger(n)||n<=0||n>2147483647||e.fetchImpl!==void 0&&typeof e.fetchImpl!="function"||r!==void 0&&(typeof r!="string"||r.trim()===""||/[\r\n]/.test(r)))throw new TypeError("Invalid Sanity adapter configuration");let s=e.fetchImpl,i=`${t.projectId}.${t.dataset}`;return Object.freeze({scope:i,async read(O,c){let y;try{if(!c||!Number.isSafeInteger(c.revalidateSeconds)||c.revalidateSeconds<3600||!Array.isArray(c.tags))throw new TypeError;let o=[],p=[];for(let d of c.tags){if(typeof d!="string")throw new TypeError;if(d.startsWith(`cms:${i}:type:`))o.push(d.slice(`cms:${i}:type:`.length));else if(d.startsWith(`cms:${i}:id:`))p.push(d.slice(`cms:${i}:id:`.length));else throw new TypeError}let l=C(i,{types:o,ids:p});if(l.length!==c.tags.length||l.some((d,a)=>d!==c.tags[a]))throw new TypeError;y=b({...O,dependencies:{types:o,ids:p},resolve:d=>({data:d,fallbackFields:[]})})}catch{throw new TypeError("Invalid Sanity read configuration")}let f=new URL(`https://${t.projectId}.api.sanity.io/v${t.apiVersion}/data/query/${t.dataset}`);f.searchParams.set("query",y.query),f.searchParams.set("perspective","published");for(let o of Object.keys(y.params).sort())f.searchParams.set(`$${o}`,JSON.stringify(y.params[o]));let h=new AbortController,m,u=!1,g=()=>{h.abort(),m&&m.cancel().catch(()=>{})},S,k=new Promise(o=>{S=setTimeout(()=>{u=!0,g(),o({ok:!1,reason:"timeout"})},n)}),j=async()=>{try{let o=await(s??globalThis.fetch)(f.href,{method:"GET",redirect:"error",signal:h.signal,headers:r===void 0?{}:{Authorization:`Bearer ${r}`},next:{revalidate:c.revalidateSeconds,tags:[...c.tags]}});if(u)return o.body?.cancel().catch(()=>{}),{ok:!1,reason:"timeout"};if(!o.ok){o.body?.cancel().catch(()=>{});let a=o.status;return{ok:!1,reason:a===402?"plan-limit":a===401||a===403?"permission":a===429?"rate-limit":"upstream",status:a}}if(!o.body)return{ok:!1,reason:"malformed"};m=o.body.getReader();let p=0,l="",d=new TextDecoder("utf-8",{fatal:!0});for(;;){let a=await m.read();if(u)return{ok:!1,reason:"timeout"};if(a.done)break;if(p+=a.value.byteLength,p>_)return g(),{ok:!1,reason:"malformed"};try{l+=d.decode(a.value,{stream:!0})}catch{return g(),{ok:!1,reason:"malformed"}}}try{l+=d.decode();let a=JSON.parse(l);return!a||typeof a!="object"||Array.isArray(a)||!Object.hasOwn(a,"result")?{ok:!1,reason:"malformed"}:{ok:!0,value:a.result}}catch{return{ok:!1,reason:"malformed"}}}catch{return{ok:!1,reason:u?"timeout":"network"}}};try{return await Promise.race([j(),k])}finally{clearTimeout(S)}}})}function I(e){return A({projectId:e.SANITY_PROJECT_ID,dataset:e.SANITY_DATASET,apiVersion:e.SANITY_API_VERSION})}0&&(module.exports={createSanityAdapter,sanityBindingFromEnv});
+//# sourceMappingURL=sanity.cjs.map

package/dist/sanity.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/sanity.ts", "../src/contracts/query.ts", "../src/adapters/sanity/adapter.ts"],
+  "sourcesContent": ["import \"server-only\";\nexport { createSanityAdapter, sanityBindingFromEnv } from \"./adapters/sanity/adapter.js\";\nexport type { SanityBinding, SanityAdapterOptions } from \"./adapters/sanity/adapter.js\";\n", "/** A-1822 S1 owns this implementation. S0 registers the public signatures. */\nexport type CmsParams = Readonly<Record<string, string | number | boolean | null>>;\nexport type CmsDependencies = {\n  readonly types: readonly string[];\n  readonly ids?: readonly string[];\n};\nexport type CmsResolution<T> = {\n  readonly data: T;\n  readonly fallbackFields: readonly string[];\n  readonly warnings?: readonly \"siteHero.layout.defaulted\"[];\n};\nexport type CmsQuery<T> = {\n  readonly name: string;\n  readonly query: string;\n  readonly params: CmsParams;\n  readonly dependencies: CmsDependencies;\n  readonly resolve: (raw: unknown, fallback: T) => CmsResolution<T>;\n};\n\nconst TYPE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;\nconst ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;\nconst SCOPE = /^[a-z0-9]{6,12}\\.[a-z][a-z0-9_-]{0,63}$/;\n\nfunction dependenciesCopy(dependencies: CmsDependencies): CmsDependencies {\n  if (!dependencies || !Array.isArray(dependencies.types) || dependencies.types.length === 0) {\n    throw new TypeError(\"CMS dependencies require document types\");\n  }\n  const types = [...dependencies.types];\n  for (const type of types) {\n    if (typeof type !== \"string\" || !TYPE.test(type)) throw new TypeError(\"Invalid CMS document type\");\n  }\n  if (dependencies.ids !== undefined && !Array.isArray(dependencies.ids)) throw new TypeError(\"Invalid CMS document IDs\");\n  const ids = dependencies.ids === undefined ? undefined : [...dependencies.ids];\n  for (const id of ids ?? []) {\n    if (typeof id !== \"string\" || !ID.test(id) || /^(drafts|versions)\\./.test(id)) {\n      throw new TypeError(\"Invalid CMS document ID\");\n    }\n  }\n  if (new Set(types).size + new Set(ids).size > 128) throw new TypeError(\"Too many CMS tags\");\n  return Object.freeze({ types: Object.freeze(types), ...(ids === undefined ? {} : { ids: Object.freeze(ids) }) });\n}\n\nexport function defineCmsQuery<T>(query: CmsQuery<T>): CmsQuery<T> {\n  if (!query || typeof query.name !== \"string\" || !/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(query.name)\n    || typeof query.query !== \"string\" || query.query.trim() === \"\" || typeof query.resolve !== \"function\") {\n    throw new TypeError(\"Invalid CMS query configuration\");\n  }\n  const params = query.params;\n  if (!params || typeof params !== \"object\" || (Object.getPrototypeOf(params) !== Object.prototype && Object.getPrototypeOf(params) !== null)) {\n    throw new TypeError(\"CMS params must be plain JSON scalars\");\n  }\n  const copied: Record<string, string | number | boolean | null> = {};\n  for (const key of Reflect.ownKeys(params)) {\n    const descriptor = Object.getOwnPropertyDescriptor(params, key);\n    if (typeof key !== \"string\" || !descriptor || !Object.hasOwn(descriptor, \"value\") || !descriptor.enumerable) {\n      throw new TypeError(\"CMS params must be plain JSON scalars\");\n    }\n    const value: unknown = descriptor.value;\n    if (!(value === null || typeof value === \"string\" || typeof value === \"boolean\" || (typeof value === \"number\" && Number.isFinite(value)))) {\n      throw new TypeError(\"CMS params must be plain JSON scalars\");\n    }\n    Object.defineProperty(copied, key, { value, enumerable: true });\n  }\n  return Object.freeze({ name: query.name, query: query.query, params: Object.freeze(copied), dependencies: dependenciesCopy(query.dependencies), resolve: query.resolve });\n}\n\nexport function cmsTags(scope: string, dependencies: CmsDependencies): readonly string[] {\n  if (typeof scope !== \"string\" || scope.length > 77 || !SCOPE.test(scope)) throw new TypeError(\"Invalid CMS scope\");\n  const copied = dependenciesCopy(dependencies);\n  const tags = [\n    ...[...new Set(copied.types)].sort().map((type) => `cms:${scope}:type:${type}`),\n    ...[...new Set(copied.ids ?? [])].sort().map((id) => `cms:${scope}:id:${id}`),\n  ];\n  return Object.freeze(tags);\n}\n", "import type { CmsAdapter, CmsFetch } from \"../../runtime/reader.js\";\nimport { cmsTags, defineCmsQuery } from \"../../contracts/query.js\";\n\nexport type SanityBinding = {\n  readonly projectId: string;\n  readonly dataset: string;\n  readonly apiVersion: string;\n};\nexport type SanityAdapterOptions = {\n  readonly binding: SanityBinding;\n  readonly readToken?: string;\n  readonly fetchImpl?: CmsFetch;\n  readonly timeoutMs?: number;\n};\n\nconst RESPONSE_LIMIT = 2 * 1024 * 1024;\n\nfunction bindingCopy(binding: SanityBinding): SanityBinding {\n  if (!binding || typeof binding.projectId !== \"string\" || !/^[a-z0-9]{6,12}$/.test(binding.projectId)\n    || typeof binding.dataset !== \"string\" || !/^[a-z][a-z0-9_-]{0,63}$/.test(binding.dataset)\n    || typeof binding.apiVersion !== \"string\" || !/^v?\\d{4}-\\d{2}-\\d{2}$/.test(binding.apiVersion)) {\n    throw new TypeError(\"Invalid Sanity binding configuration\");\n  }\n  return Object.freeze({ projectId: binding.projectId, dataset: binding.dataset, apiVersion: binding.apiVersion.replace(/^v/, \"\") });\n}\n\n/** Applies policy via fetch's Next metadata. Standard fetch has no persistent cache or HTML invalidation. */\nexport function createSanityAdapter(options: SanityAdapterOptions): CmsAdapter {\n  const binding = bindingCopy(options?.binding);\n  const timeoutMs = options.timeoutMs ?? 1500;\n  const token = options.readToken;\n  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647\n    || (options.fetchImpl !== undefined && typeof options.fetchImpl !== \"function\")\n    || (token !== undefined && (typeof token !== \"string\" || token.trim() === \"\" || /[\\r\\n]/.test(token)))) {\n    throw new TypeError(\"Invalid Sanity adapter configuration\");\n  }\n  const fetchImpl = options.fetchImpl;\n  const scope = `${binding.projectId}.${binding.dataset}`;\n  return Object.freeze({\n    scope,\n    async read(query, policy) {\n      // Direct structural callers receive the same configuration refusals.\n      let validated;\n      try {\n        if (!policy || !Number.isSafeInteger(policy.revalidateSeconds) || policy.revalidateSeconds < 3600 || !Array.isArray(policy.tags)) throw new TypeError();\n        const types: string[] = [];\n        const ids: string[] = [];\n        for (const tag of policy.tags) {\n          if (typeof tag !== \"string\") throw new TypeError();\n          if (tag.startsWith(`cms:${scope}:type:`)) types.push(tag.slice(`cms:${scope}:type:`.length));\n          else if (tag.startsWith(`cms:${scope}:id:`)) ids.push(tag.slice(`cms:${scope}:id:`.length));\n          else throw new TypeError();\n        }\n        const expected = cmsTags(scope, { types, ids });\n        if (expected.length !== policy.tags.length || expected.some((tag, i) => tag !== policy.tags[i])) throw new TypeError();\n        validated = defineCmsQuery({ ...query, dependencies: { types, ids }, resolve: (raw: unknown) => ({ data: raw, fallbackFields: [] }) });\n      } catch { throw new TypeError(\"Invalid Sanity read configuration\"); }\n      const url = new URL(`https://${binding.projectId}.api.sanity.io/v${binding.apiVersion}/data/query/${binding.dataset}`);\n      url.searchParams.set(\"query\", validated.query);\n      url.searchParams.set(\"perspective\", \"published\");\n      for (const key of Object.keys(validated.params).sort()) url.searchParams.set(`$${key}`, JSON.stringify(validated.params[key]));\n      const controller = new AbortController();\n      let bodyReader: ReadableStreamDefaultReader<Uint8Array> | undefined;\n      let expired = false;\n      const cancel = (): void => {\n        controller.abort();\n        if (bodyReader) void bodyReader.cancel().catch(() => {});\n      };\n      let timer: ReturnType<typeof setTimeout> | undefined;\n      const deadline = new Promise<Awaited<ReturnType<CmsAdapter[\"read\"]>>>((resolve) => {\n        timer = setTimeout(() => {\n          expired = true;\n          cancel();\n          resolve({ ok: false, reason: \"timeout\" });\n        }, timeoutMs);\n      });\n      const work = async (): Promise<Awaited<ReturnType<CmsAdapter[\"read\"]>>> => {\n        try {\n          // Look up global fetch at read time so Next's patched fetch is retained.\n          const response = await (fetchImpl ?? globalThis.fetch)(url.href, {\n            method: \"GET\", redirect: \"error\", signal: controller.signal,\n            headers: token === undefined ? {} : { Authorization: `Bearer ${token}` },\n            next: { revalidate: policy.revalidateSeconds, tags: [...policy.tags] },\n          });\n          if (expired) { void response.body?.cancel().catch(() => {}); return { ok: false, reason: \"timeout\" }; }\n          if (!response.ok) {\n            void response.body?.cancel().catch(() => {});\n            const status = response.status;\n            const reason = status === 402 ? \"plan-limit\" : status === 401 || status === 403 ? \"permission\"\n              : status === 429 ? \"rate-limit\" : \"upstream\";\n            return { ok: false, reason, status };\n          }\n          if (!response.body) return { ok: false, reason: \"malformed\" };\n          bodyReader = response.body.getReader();\n          let bytes = 0;\n          let text = \"\";\n          const decoder = new TextDecoder(\"utf-8\", { fatal: true });\n          while (true) {\n            const chunk = await bodyReader.read();\n            if (expired) return { ok: false, reason: \"timeout\" };\n            if (chunk.done) break;\n            bytes += chunk.value.byteLength;\n            if (bytes > RESPONSE_LIMIT) { cancel(); return { ok: false, reason: \"malformed\" }; }\n            try { text += decoder.decode(chunk.value, { stream: true }); }\n            catch { cancel(); return { ok: false, reason: \"malformed\" }; }\n          }\n          try {\n            text += decoder.decode();\n            const envelope: unknown = JSON.parse(text);\n            if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope) || !Object.hasOwn(envelope, \"result\")) return { ok: false, reason: \"malformed\" };\n            return { ok: true, value: (envelope as Record<string, unknown>).result };\n          } catch { return { ok: false, reason: \"malformed\" }; }\n        } catch { return { ok: false, reason: expired ? \"timeout\" : \"network\" }; }\n      };\n      try { return await Promise.race([work(), deadline]); }\n      finally { clearTimeout(timer); }\n    },\n  } satisfies CmsAdapter);\n}\n\nexport function sanityBindingFromEnv(env: Readonly<Record<string, string | undefined>>): SanityBinding {\n  return bindingCopy({ projectId: env.SANITY_PROJECT_ID, dataset: env.SANITY_DATASET, apiVersion: env.SANITY_API_VERSION } as SanityBinding);\n}\n"],
+  "mappings": "yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,yBAAAE,EAAA,yBAAAC,IAAA,eAAAC,EAAAJ,GAAA,IAAAK,EAAO,uBCmBP,IAAMC,EAAO,+BACPC,EAAK,qCACLC,EAAQ,0CAEd,SAASC,EAAiBC,EAAgD,CACxE,GAAI,CAACA,GAAgB,CAAC,MAAM,QAAQA,EAAa,KAAK,GAAKA,EAAa,MAAM,SAAW,EACvF,MAAM,IAAI,UAAU,yCAAyC,EAE/D,IAAMC,EAAQ,CAAC,GAAGD,EAAa,KAAK,EACpC,QAAWE,KAAQD,EACjB,GAAI,OAAOC,GAAS,UAAY,CAACN,EAAK,KAAKM,CAAI,EAAG,MAAM,IAAI,UAAU,2BAA2B,EAEnG,GAAIF,EAAa,MAAQ,QAAa,CAAC,MAAM,QAAQA,EAAa,GAAG,EAAG,MAAM,IAAI,UAAU,0BAA0B,EACtH,IAAMG,EAAMH,EAAa,MAAQ,OAAY,OAAY,CAAC,GAAGA,EAAa,GAAG,EAC7E,QAAWI,KAAMD,GAAO,CAAC,EACvB,GAAI,OAAOC,GAAO,UAAY,CAACP,EAAG,KAAKO,CAAE,GAAK,uBAAuB,KAAKA,CAAE,EAC1E,MAAM,IAAI,UAAU,yBAAyB,EAGjD,GAAI,IAAI,IAAIH,CAAK,EAAE,KAAO,IAAI,IAAIE,CAAG,EAAE,KAAO,IAAK,MAAM,IAAI,UAAU,mBAAmB,EAC1F,OAAO,OAAO,OAAO,CAAE,MAAO,OAAO,OAAOF,CAAK,EAAG,GAAIE,IAAQ,OAAY,CAAC,EAAI,CAAE,IAAK,OAAO,OAAOA,CAAG,CAAE,CAAG,CAAC,CACjH,CAEO,SAASE,EAAkBC,EAAiC,CACjE,GAAI,CAACA,GAAS,OAAOA,EAAM,MAAS,UAAY,CAAC,kCAAkC,KAAKA,EAAM,IAAI,GAC7F,OAAOA,EAAM,OAAU,UAAYA,EAAM,MAAM,KAAK,IAAM,IAAM,OAAOA,EAAM,SAAY,WAC5F,MAAM,IAAI,UAAU,iCAAiC,EAEvD,IAAMC,EAASD,EAAM,OACrB,GAAI,CAACC,GAAU,OAAOA,GAAW,UAAa,OAAO,eAAeA,CAAM,IAAM,OAAO,WAAa,OAAO,eAAeA,CAAM,IAAM,KACpI,MAAM,IAAI,UAAU,uCAAuC,EAE7D,IAAMC,EAA2D,CAAC,EAClE,QAAWC,KAAO,QAAQ,QAAQF,CAAM,EAAG,CACzC,IAAMG,EAAa,OAAO,yBAAyBH,EAAQE,CAAG,EAC9D,GAAI,OAAOA,GAAQ,UAAY,CAACC,GAAc,CAAC,OAAO,OAAOA,EAAY,OAAO,GAAK,CAACA,EAAW,WAC/F,MAAM,IAAI,UAAU,uCAAuC,EAE7D,IAAMC,EAAiBD,EAAW,MAClC,GAAI,EAAEC,IAAU,MAAQ,OAAOA,GAAU,UAAY,OAAOA,GAAU,WAAc,OAAOA,GAAU,UAAY,OAAO,SAASA,CAAK,GACpI,MAAM,IAAI,UAAU,uCAAuC,EAE7D,OAAO,eAAeH,EAAQC,EAAK,CAAE,MAAAE,EAAO,WAAY,EAAK,CAAC,CAChE,CACA,OAAO,OAAO,OAAO,CAAE,KAAML,EAAM,KAAM,MAAOA,EAAM,MAAO,OAAQ,OAAO,OAAOE,CAAM,EAAG,aAAcT,EAAiBO,EAAM,YAAY,EAAG,QAASA,EAAM,OAAQ,CAAC,CAC1K,CAEO,SAASM,EAAQC,EAAeb,EAAkD,CACvF,GAAI,OAAOa,GAAU,UAAYA,EAAM,OAAS,IAAM,CAACf,EAAM,KAAKe,CAAK,EAAG,MAAM,IAAI,UAAU,mBAAmB,EACjH,IAAML,EAAST,EAAiBC,CAAY,EACtCc,EAAO,CACX,GAAG,CAAC,GAAG,IAAI,IAAIN,EAAO,KAAK,CAAC,EAAE,KAAK,EAAE,IAAKN,GAAS,OAAOW,CAAK,SAASX,CAAI,EAAE,EAC9E,GAAG,CAAC,GAAG,IAAI,IAAIM,EAAO,KAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAKJ,GAAO,OAAOS,CAAK,OAAOT,CAAE,EAAE,CAC9E,EACA,OAAO,OAAO,OAAOU,CAAI,CAC3B,CC3DA,IAAMC,EAAiB,EAAI,KAAO,KAElC,SAASC,EAAYC,EAAuC,CAC1D,GAAI,CAACA,GAAW,OAAOA,EAAQ,WAAc,UAAY,CAAC,mBAAmB,KAAKA,EAAQ,SAAS,GAC9F,OAAOA,EAAQ,SAAY,UAAY,CAAC,0BAA0B,KAAKA,EAAQ,OAAO,GACtF,OAAOA,EAAQ,YAAe,UAAY,CAAC,wBAAwB,KAAKA,EAAQ,UAAU,EAC7F,MAAM,IAAI,UAAU,sCAAsC,EAE5D,OAAO,OAAO,OAAO,CAAE,UAAWA,EAAQ,UAAW,QAASA,EAAQ,QAAS,WAAYA,EAAQ,WAAW,QAAQ,KAAM,EAAE,CAAE,CAAC,CACnI,CAGO,SAASC,EAAoBC,EAA2C,CAC7E,IAAMF,EAAUD,EAAYG,GAAS,OAAO,EACtCC,EAAYD,EAAQ,WAAa,KACjCE,EAAQF,EAAQ,UACtB,GAAI,CAAC,OAAO,cAAcC,CAAS,GAAKA,GAAa,GAAKA,EAAY,YAChED,EAAQ,YAAc,QAAa,OAAOA,EAAQ,WAAc,YAChEE,IAAU,SAAc,OAAOA,GAAU,UAAYA,EAAM,KAAK,IAAM,IAAM,SAAS,KAAKA,CAAK,GACnG,MAAM,IAAI,UAAU,sCAAsC,EAE5D,IAAMC,EAAYH,EAAQ,UACpBI,EAAQ,GAAGN,EAAQ,SAAS,IAAIA,EAAQ,OAAO,GACrD,OAAO,OAAO,OAAO,CACnB,MAAAM,EACA,MAAM,KAAKC,EAAOC,EAAQ,CAExB,IAAIC,EACJ,GAAI,CACF,GAAI,CAACD,GAAU,CAAC,OAAO,cAAcA,EAAO,iBAAiB,GAAKA,EAAO,kBAAoB,MAAQ,CAAC,MAAM,QAAQA,EAAO,IAAI,EAAG,MAAM,IAAI,UAC5I,IAAME,EAAkB,CAAC,EACnBC,EAAgB,CAAC,EACvB,QAAWC,KAAOJ,EAAO,KAAM,CAC7B,GAAI,OAAOI,GAAQ,SAAU,MAAM,IAAI,UACvC,GAAIA,EAAI,WAAW,OAAON,CAAK,QAAQ,EAAGI,EAAM,KAAKE,EAAI,MAAM,OAAON,CAAK,SAAS,MAAM,CAAC,UAClFM,EAAI,WAAW,OAAON,CAAK,MAAM,EAAGK,EAAI,KAAKC,EAAI,MAAM,OAAON,CAAK,OAAO,MAAM,CAAC,MACrF,OAAM,IAAI,SACjB,CACA,IAAMO,EAAWC,EAAQR,EAAO,CAAE,MAAAI,EAAO,IAAAC,CAAI,CAAC,EAC9C,GAAIE,EAAS,SAAWL,EAAO,KAAK,QAAUK,EAAS,KAAK,CAACD,EAAKG,IAAMH,IAAQJ,EAAO,KAAKO,CAAC,CAAC,EAAG,MAAM,IAAI,UAC3GN,EAAYO,EAAe,CAAE,GAAGT,EAAO,aAAc,CAAE,MAAAG,EAAO,IAAAC,CAAI,EAAG,QAAUM,IAAkB,CAAE,KAAMA,EAAK,eAAgB,CAAC,CAAE,EAAG,CAAC,CACvI,MAAQ,CAAE,MAAM,IAAI,UAAU,mCAAmC,CAAG,CACpE,IAAMC,EAAM,IAAI,IAAI,WAAWlB,EAAQ,SAAS,mBAAmBA,EAAQ,UAAU,eAAeA,EAAQ,OAAO,EAAE,EACrHkB,EAAI,aAAa,IAAI,QAAST,EAAU,KAAK,EAC7CS,EAAI,aAAa,IAAI,cAAe,WAAW,EAC/C,QAAWC,KAAO,OAAO,KAAKV,EAAU,MAAM,EAAE,KAAK,EAAGS,EAAI,aAAa,IAAI,IAAIC,CAAG,GAAI,KAAK,UAAUV,EAAU,OAAOU,CAAG,CAAC,CAAC,EAC7H,IAAMC,EAAa,IAAI,gBACnBC,EACAC,EAAU,GACRC,EAAS,IAAY,CACzBH,EAAW,MAAM,EACbC,GAAiBA,EAAW,OAAO,EAAE,MAAM,IAAM,CAAC,CAAC,CACzD,EACIG,EACEC,EAAW,IAAI,QAAkDC,GAAY,CACjFF,EAAQ,WAAW,IAAM,CACvBF,EAAU,GACVC,EAAO,EACPG,EAAQ,CAAE,GAAI,GAAO,OAAQ,SAAU,CAAC,CAC1C,EAAGvB,CAAS,CACd,CAAC,EACKwB,EAAO,SAA8D,CACzE,GAAI,CAEF,IAAMC,EAAW,MAAOvB,GAAa,WAAW,OAAOa,EAAI,KAAM,CAC/D,OAAQ,MAAO,SAAU,QAAS,OAAQE,EAAW,OACrD,QAAShB,IAAU,OAAY,CAAC,EAAI,CAAE,cAAe,UAAUA,CAAK,EAAG,EACvE,KAAM,CAAE,WAAYI,EAAO,kBAAmB,KAAM,CAAC,GAAGA,EAAO,IAAI,CAAE,CACvE,CAAC,EACD,GAAIc,EAAW,OAAKM,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,CAAC,CAAC,EAAU,CAAE,GAAI,GAAO,OAAQ,SAAU,EACnG,GAAI,CAACA,EAAS,GAAI,CACXA,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,CAAC,CAAC,EAC3C,IAAMC,EAASD,EAAS,OAGxB,MAAO,CAAE,GAAI,GAAO,OAFLC,IAAW,IAAM,aAAeA,IAAW,KAAOA,IAAW,IAAM,aAC9EA,IAAW,IAAM,aAAe,WACR,OAAAA,CAAO,CACrC,CACA,GAAI,CAACD,EAAS,KAAM,MAAO,CAAE,GAAI,GAAO,OAAQ,WAAY,EAC5DP,EAAaO,EAAS,KAAK,UAAU,EACrC,IAAIE,EAAQ,EACRC,EAAO,GACLC,EAAU,IAAI,YAAY,QAAS,CAAE,MAAO,EAAK,CAAC,EACxD,OAAa,CACX,IAAMC,EAAQ,MAAMZ,EAAW,KAAK,EACpC,GAAIC,EAAS,MAAO,CAAE,GAAI,GAAO,OAAQ,SAAU,EACnD,GAAIW,EAAM,KAAM,MAEhB,GADAH,GAASG,EAAM,MAAM,WACjBH,EAAQhC,EAAkB,OAAAyB,EAAO,EAAU,CAAE,GAAI,GAAO,OAAQ,WAAY,EAChF,GAAI,CAAEQ,GAAQC,EAAQ,OAAOC,EAAM,MAAO,CAAE,OAAQ,EAAK,CAAC,CAAG,MACvD,CAAE,OAAAV,EAAO,EAAU,CAAE,GAAI,GAAO,OAAQ,WAAY,CAAG,CAC/D,CACA,GAAI,CACFQ,GAAQC,EAAQ,OAAO,EACvB,IAAME,EAAoB,KAAK,MAAMH,CAAI,EACzC,MAAI,CAACG,GAAY,OAAOA,GAAa,UAAY,MAAM,QAAQA,CAAQ,GAAK,CAAC,OAAO,OAAOA,EAAU,QAAQ,EAAU,CAAE,GAAI,GAAO,OAAQ,WAAY,EACjJ,CAAE,GAAI,GAAM,MAAQA,EAAqC,MAAO,CACzE,MAAQ,CAAE,MAAO,CAAE,GAAI,GAAO,OAAQ,WAAY,CAAG,CACvD,MAAQ,CAAE,MAAO,CAAE,GAAI,GAAO,OAAQZ,EAAU,UAAY,SAAU,CAAG,CAC3E,EACA,GAAI,CAAE,OAAO,MAAM,QAAQ,KAAK,CAACK,EAAK,EAAGF,CAAQ,CAAC,CAAG,QACrD,CAAU,aAAaD,CAAK,CAAG,CACjC,CACF,CAAsB,CACxB,CAEO,SAASW,EAAqBC,EAAkE,CACrG,OAAOrC,EAAY,CAAE,UAAWqC,EAAI,kBAAmB,QAASA,EAAI,eAAgB,WAAYA,EAAI,kBAAmB,CAAkB,CAC3I",
+  "names": ["sanity_exports", "__export", "createSanityAdapter", "sanityBindingFromEnv", "__toCommonJS", "import_server_only", "TYPE", "ID", "SCOPE", "dependenciesCopy", "dependencies", "types", "type", "ids", "id", "defineCmsQuery", "query", "params", "copied", "key", "descriptor", "value", "cmsTags", "scope", "tags", "RESPONSE_LIMIT", "bindingCopy", "binding", "createSanityAdapter", "options", "timeoutMs", "token", "fetchImpl", "scope", "query", "policy", "validated", "types", "ids", "tag", "expected", "cmsTags", "i", "defineCmsQuery", "raw", "url", "key", "controller", "bodyReader", "expired", "cancel", "timer", "deadline", "resolve", "work", "response", "status", "bytes", "text", "decoder", "chunk", "envelope", "sanityBindingFromEnv", "env"]
+}

package/dist/sanity.d.cts

@@ -0,0 +1,3 @@
+import "server-only";
+export { createSanityAdapter, sanityBindingFromEnv } from "./adapters/sanity/adapter.cjs";
+export type { SanityBinding, SanityAdapterOptions } from "./adapters/sanity/adapter.cjs";

package/dist/sanity.d.mts

@@ -0,0 +1,3 @@
+import "server-only";
+export { createSanityAdapter, sanityBindingFromEnv } from "./adapters/sanity/adapter.mjs";
+export type { SanityBinding, SanityAdapterOptions } from "./adapters/sanity/adapter.mjs";

package/dist/sanity.d.ts

@@ -0,0 +1,3 @@
+import "server-only";
+export { createSanityAdapter, sanityBindingFromEnv } from "./adapters/sanity/adapter.js";
+export type { SanityBinding, SanityAdapterOptions } from "./adapters/sanity/adapter.js";

package/dist/sanity.mjs

@@ -0,0 +1,2 @@
+import"server-only";var O=/^[A-Za-z][A-Za-z0-9_]{0,63}$/,k=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,j=/^[a-z0-9]{6,12}\.[a-z][a-z0-9_-]{0,63}$/;function S(e){if(!e||!Array.isArray(e.types)||e.types.length===0)throw new TypeError("CMS dependencies require document types");let r=[...e.types];for(let t of r)if(typeof t!="string"||!O.test(t))throw new TypeError("Invalid CMS document type");if(e.ids!==void 0&&!Array.isArray(e.ids))throw new TypeError("Invalid CMS document IDs");let a=e.ids===void 0?void 0:[...e.ids];for(let t of a??[])if(typeof t!="string"||!k.test(t)||/^(drafts|versions)\./.test(t))throw new TypeError("Invalid CMS document ID");if(new Set(r).size+new Set(a).size>128)throw new TypeError("Too many CMS tags");return Object.freeze({types:Object.freeze(r),...a===void 0?{}:{ids:Object.freeze(a)}})}function T(e){if(!e||typeof e.name!="string"||!/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(e.name)||typeof e.query!="string"||e.query.trim()===""||typeof e.resolve!="function")throw new TypeError("Invalid CMS query configuration");let r=e.params;if(!r||typeof r!="object"||Object.getPrototypeOf(r)!==Object.prototype&&Object.getPrototypeOf(r)!==null)throw new TypeError("CMS params must be plain JSON scalars");let a={};for(let t of Reflect.ownKeys(r)){let d=Object.getOwnPropertyDescriptor(r,t);if(typeof t!="string"||!d||!Object.hasOwn(d,"value")||!d.enumerable)throw new TypeError("CMS params must be plain JSON scalars");let o=d.value;if(!(o===null||typeof o=="string"||typeof o=="boolean"||typeof o=="number"&&Number.isFinite(o)))throw new TypeError("CMS params must be plain JSON scalars");Object.defineProperty(a,t,{value:o,enumerable:!0})}return Object.freeze({name:e.name,query:e.query,params:Object.freeze(a),dependencies:S(e.dependencies),resolve:e.resolve})}function b(e,r){if(typeof e!="string"||e.length>77||!j.test(e))throw new TypeError("Invalid CMS scope");let a=S(r),t=[...[...new Set(a.types)].sort().map(d=>`cms:${e}:type:${d}`),...[...new Set(a.ids??[])].sort().map(d=>`cms:${e}:id:${d}`)];return Object.freeze(t)}var E=2*1024*1024;function C(e){if(!e||typeof e.projectId!="string"||!/^[a-z0-9]{6,12}$/.test(e.projectId)||typeof e.dataset!="string"||!/^[a-z][a-z0-9_-]{0,63}$/.test(e.dataset)||typeof e.apiVersion!="string"||!/^v?\d{4}-\d{2}-\d{2}$/.test(e.apiVersion))throw new TypeError("Invalid Sanity binding configuration");return Object.freeze({projectId:e.projectId,dataset:e.dataset,apiVersion:e.apiVersion.replace(/^v/,"")})}function z(e){let r=C(e?.binding),a=e.timeoutMs??1500,t=e.readToken;if(!Number.isSafeInteger(a)||a<=0||a>2147483647||e.fetchImpl!==void 0&&typeof e.fetchImpl!="function"||t!==void 0&&(typeof t!="string"||t.trim()===""||/[\r\n]/.test(t)))throw new TypeError("Invalid Sanity adapter configuration");let d=e.fetchImpl,o=`${r.projectId}.${r.dataset}`;return Object.freeze({scope:o,async read(A,c){let y;try{if(!c||!Number.isSafeInteger(c.revalidateSeconds)||c.revalidateSeconds<3600||!Array.isArray(c.tags))throw new TypeError;let s=[],p=[];for(let i of c.tags){if(typeof i!="string")throw new TypeError;if(i.startsWith(`cms:${o}:type:`))s.push(i.slice(`cms:${o}:type:`.length));else if(i.startsWith(`cms:${o}:id:`))p.push(i.slice(`cms:${o}:id:`.length));else throw new TypeError}let l=b(o,{types:s,ids:p});if(l.length!==c.tags.length||l.some((i,n)=>i!==c.tags[n]))throw new TypeError;y=T({...A,dependencies:{types:s,ids:p},resolve:i=>({data:i,fallbackFields:[]})})}catch{throw new TypeError("Invalid Sanity read configuration")}let f=new URL(`https://${r.projectId}.api.sanity.io/v${r.apiVersion}/data/query/${r.dataset}`);f.searchParams.set("query",y.query),f.searchParams.set("perspective","published");for(let s of Object.keys(y.params).sort())f.searchParams.set(`$${s}`,JSON.stringify(y.params[s]));let w=new AbortController,m,u=!1,g=()=>{w.abort(),m&&m.cancel().catch(()=>{})},h,v=new Promise(s=>{h=setTimeout(()=>{u=!0,g(),s({ok:!1,reason:"timeout"})},a)}),I=async()=>{try{let s=await(d??globalThis.fetch)(f.href,{method:"GET",redirect:"error",signal:w.signal,headers:t===void 0?{}:{Authorization:`Bearer ${t}`},next:{revalidate:c.revalidateSeconds,tags:[...c.tags]}});if(u)return s.body?.cancel().catch(()=>{}),{ok:!1,reason:"timeout"};if(!s.ok){s.body?.cancel().catch(()=>{});let n=s.status;return{ok:!1,reason:n===402?"plan-limit":n===401||n===403?"permission":n===429?"rate-limit":"upstream",status:n}}if(!s.body)return{ok:!1,reason:"malformed"};m=s.body.getReader();let p=0,l="",i=new TextDecoder("utf-8",{fatal:!0});for(;;){let n=await m.read();if(u)return{ok:!1,reason:"timeout"};if(n.done)break;if(p+=n.value.byteLength,p>E)return g(),{ok:!1,reason:"malformed"};try{l+=i.decode(n.value,{stream:!0})}catch{return g(),{ok:!1,reason:"malformed"}}}try{l+=i.decode();let n=JSON.parse(l);return!n||typeof n!="object"||Array.isArray(n)||!Object.hasOwn(n,"result")?{ok:!1,reason:"malformed"}:{ok:!0,value:n.result}}catch{return{ok:!1,reason:"malformed"}}}catch{return{ok:!1,reason:u?"timeout":"network"}}};try{return await Promise.race([I(),v])}finally{clearTimeout(h)}}})}function $(e){return C({projectId:e.SANITY_PROJECT_ID,dataset:e.SANITY_DATASET,apiVersion:e.SANITY_API_VERSION})}export{z as createSanityAdapter,$ as sanityBindingFromEnv};
+//# sourceMappingURL=sanity.mjs.map