alinea 1.7.0-preview.0 → 1.7.0-preview.10

package/dist/.init/content/pages/welcome.json

@@ -1,5 +1,5 @@
 {
-  "_id": "39tRiBmjfWV5beXQN98l81Ul4b1",
+  "_id": "3FfTjlrBhYodjHfM2I29mkaD2b0",
   "_type": "Page",
   "_index": "a0",
   "_seeded": "welcome.json",

package/dist/LICENSES.md

@@ -55,11 +55,11 @@ SOFTWARE.
 
 ===
 
-# @headlessui/react@2.2.0 (MIT)
+# react-query@3.39.3 (MIT)
 
 MIT License
 
-Copyright (c) 2020 Tailwind Labs
+Copyright (c) 2019 Tanner Linsley
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -79,13 +79,14 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+
 ===
 
-# react-query@3.39.3 (MIT)
+# @headlessui/react@2.2.0 (MIT)
 
 MIT License
 
-Copyright (c) 2019 Tanner Linsley
+Copyright (c) 2020 Tailwind Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -105,7 +106,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-
 ===
 
 # htmlparser2@9.1.0 (MIT)
@@ -157,7 +157,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ===
 
-# domutils@3.1.0 (BSD-2-Clause)
+# domhandler@5.0.3 (BSD-2-Clause)
 
 Copyright (c) Felix Böhm
 All rights reserved.
@@ -174,7 +174,7 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ===
 
-# domhandler@5.0.3 (BSD-2-Clause)
+# domutils@3.1.0 (BSD-2-Clause)
 
 Copyright (c) Felix Böhm
 All rights reserved.
@@ -233,6 +233,33 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 
+===
+
+# prop-types@15.8.1 (MIT)
+
+MIT License
+
+Copyright (c) 2013-present, Facebook, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ===
 
 # @juggle/resize-observer@3.4.0 (Apache-2.0)
@@ -440,33 +467,6 @@ SOFTWARE.
    limitations under the License.
 
 
-===
-
-# prop-types@15.8.1 (MIT)
-
-MIT License
-
-Copyright (c) 2013-present, Facebook, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
 ===
 
 # react-is@16.13.1 (MIT)
@@ -513,9 +513,31 @@ THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ===
 
-# @headless-tree/react@0.0.15 (MIT)
+# @babel/runtime@7.25.4 (MIT)
+
+MIT License
+
+Copyright (c) 2014-present Sebastian McKenzie and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-MIT
 
 ===
 
@@ -525,6 +547,12 @@ MIT
 
 ===
 
+# @headless-tree/react@0.0.15 (MIT)
+
+MIT
+
+===
+
 # y-prosemirror@1.2.15 (MIT)
 
 The MIT License (MIT)
@@ -552,35 +580,7 @@ SOFTWARE.
 
 ===
 
-# @babel/runtime@7.25.4 (MIT)
-
-MIT License
-
-Copyright (c) 2014-present Sebastian McKenzie and other contributors
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-
-===
-
-# @react-aria/interactions@3.23.0 (Apache-2.0)
+# @react-aria/focus@3.19.1 (Apache-2.0)
 
                                  Apache License
                            Version 2.0, January 2004
@@ -787,7 +787,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ===
 
-# @react-aria/focus@3.19.1 (Apache-2.0)
+# @react-aria/interactions@3.23.0 (Apache-2.0)
 
                                  Apache License
                            Version 2.0, January 2004

package/dist/adapter/next/cms.js

@@ -49,17 +49,16 @@ var NextCMS = class extends CMS {
       const payload = getPreviewPayloadFromCookies(cookie.getAll());
       if (payload) preview = { payload };
     }
-    const { PHASE_PRODUCTION_BUILD } = await import("next/constants");
+    const { PHASE_PRODUCTION_SERVER, PHASE_PRODUCTION_BUILD } = await import("next/constants");
     const isEdge = process.env.NEXT_RUNTIME === "edge";
+    const isServer = process.env.NEXT_PHASE === PHASE_PRODUCTION_SERVER;
     const isBuild = process.env.NEXT_PHASE === PHASE_PRODUCTION_BUILD;
     const request = { preview, ...query, status };
-    const useLocalDb = isBuild || !preview && !isEdge;
-    if (useLocalDb) {
-      const db = await this.bundledDb;
-      await this.throttle(() => db.syncWith(client), request.syncInterval);
-      return db.resolve(request);
-    }
-    return client.resolve(request);
+    const useLocalDb = !isEdge && (isServer || isBuild);
+    if (!useLocalDb) return client.resolve(request);
+    const db = await this.bundledDb;
+    await this.throttle(() => db.syncWith(client), request.syncInterval);
+    return db.resolve(request);
   }
   async #authenticatedClient() {
     const { handlerUrl, apiKey } = await requestContext(this.config);

package/dist/adapter/next/handler.js

@@ -19,7 +19,7 @@ import { requestContext } from "./context.js";
 var handlers = /* @__PURE__ */ new WeakMap();
 function createHandler(input) {
   const options = input instanceof NextCMS ? { cms: input } : input;
-  const remote = options.remote ?? (options.backend ? createBackend(options.cms.config, options.backend) : (context) => new CloudRemote(context, options.cms));
+  const remote = options.remote ?? (options.backend ? createBackend(options.cms.config, options.backend) : (context) => new CloudRemote(context, options.cms.config));
   if (handlers.has(options.cms)) return handlers.get(options.cms);
   const config = options.cms.config;
   const db = PLazy.from(async () => {

package/dist/adapter/next/with-alinea.js

@@ -1,13 +1,10 @@
-import {
-  version
-} from "../../chunks/chunk-VNF4OZAJ.js";
 import "../../chunks/chunk-NZLE2WMY.js";
 
 // src/adapter/next/with-alinea.ts
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { resolve } from "node:path";
-import { bold, cyan, gray } from "alinea/cli/util/Report";
+import { bold, cyan } from "alinea/cli/util/Report";
 function createCMS() {
   throw new Error(
     'Alinea was loaded in a CJS environment. Please ensure your project is marked as "type": "module" in package.json.'
@@ -98,12 +95,10 @@ function createRewrites(config, adminPath) {
     const nextHost = process.env.__NEXT_PRIVATE_HOST;
     const origin = nextOrigin ?? (nextHost ? `http://${nextHost}` : null);
     const location = origin ? new URL(adminPath, origin).href : adminPath;
-    if (isDev) {
-      const alineaVersion = gray(version);
-      const header = `
-   ${cyan(bold("\u0251 Alinea"))} ${alineaVersion}
-`;
-      console.log(`${header}   - Local CMS:    ${location}
+    if (isDev && !process.env.__NEXT_PRIVATE_ALINEA_REPORTED) {
+      process.env.__NEXT_PRIVATE_ALINEA_REPORTED = "true";
+      console.log(`
+${cyan(bold("\u0251 Alinea CMS"))}:    ${location}
 `);
     }
     const existing = config.rewrites ? await config.rewrites() : [];

package/dist/backend/Handler.js

@@ -215,13 +215,14 @@ function createHandler({
       return new Response("Bad Request", { status: 400 });
     } catch (error) {
       if (error instanceof Response) return error;
-      console.error(error);
+      const status = error instanceof HttpError ? error.code : 500;
+      if (!(error instanceof HttpError)) console.error(error);
       return Response.json(
         {
           success: false,
           error: error instanceof Error ? error.message : String(error)
         },
-        { status: error instanceof HttpError ? error.code : 500 }
+        { status }
       );
     }
   };

package/dist/backend/api/OAuth2.d.ts

@@ -1,6 +1,7 @@
 import { Request, Response } from '@alinea/iso';
 import { Config } from 'alinea/core/Config';
 import type { AuthApi, AuthedContext, RequestContext } from 'alinea/core/Connection';
+import { JWTPayload } from 'alinea/core/util/JWT';
 export interface OAuth2Options {
     /**
      * OAuth2 clientId
@@ -36,6 +37,11 @@ export interface OAuth2Options {
      * Required for revoking tokens. Not supported by all servers.
      */
     revocationEndpoint?: string;
+    /**
+     * Extra claims to validate, such as `iss` or `aud`,
+     * If the claims are invalid, an error should be thrown.
+     */
+    validateClaims?(claims: JWTPayload): void;
 }
 export declare class OAuth2 implements AuthApi {
     #private;

package/dist/backend/api/OAuth2.js

@@ -457,13 +457,15 @@ var OAuth2 = class {
   #config;
   #client;
   #jwks;
+  #validateClaims;
   constructor(context, config, options) {
     this.#context = context;
     this.#config = config;
+    this.#validateClaims = options.validateClaims;
     this.#client = new OAuth2Client({
       ...options,
       authenticationMethod: "client_secret_basic_interop",
-      async fetch(input, init) {
+      fetch: async (input, init) => {
         const request = new Request2(input, init);
         const response = await fetch(request);
         if (!response.ok) {
@@ -526,7 +528,8 @@ var OAuth2 = class {
                   value: codeVerifier,
                   path: redirectUri.pathname,
                   secure: redirectUri.protocol === "https:",
-                  httpOnly: true
+                  httpOnly: true,
+                  sameSite: "lax"
                 })
               }
             }
@@ -601,31 +604,29 @@ var OAuth2 = class {
         throw new MissingCredentialsError("Missing access token cookie");
       const key = selectKey(jwks, accessToken);
       const user = await verify(accessToken, key);
+      this.#validateClaims?.(user);
+      assert(user.exp, "Missing exp claim in access token");
       const expiresSoon = user.exp - Math.floor(Date.now() / 1e3) < 30;
       if (expiresSoon && refreshToken)
         throw new InvalidCredentialsError("Access token will expire soon");
       return { ...ctx, user, token: accessToken };
     } catch (error) {
       if (!refreshToken) throw error;
-      const key = selectKey(jwks, refreshToken);
-      const [, failed] = await outcome(verify(refreshToken, key));
-      if (failed)
-        throw new InvalidCredentialsError("Invalid refresh token", {
-          cause: [failed, error]
-        });
       const token = { accessToken, refreshToken, expiresAt: null };
       const newToken = await this.#client.refreshToken(token).catch((cause) => {
         throw new InvalidCredentialsError("Failed to refresh token", {
           cause: [cause, error]
         });
       });
-      await verify(newToken.accessToken, key, {
+      const key = selectKey(jwks, newToken.accessToken);
+      const user = await verify(newToken.accessToken, key, {
         clockTolerance: 30
       }).catch((cause) => {
         throw new InvalidCredentialsError("Failed to verify user", {
           cause: [cause, error]
         });
       });
+      this.#validateClaims?.(user);
       throw Response.json(
         { type: AuthResultType.NeedsRefresh },
         {
@@ -639,10 +640,29 @@ var OAuth2 = class {
   }
 };
 function selectKey(jwks, token) {
-  const kid = decode(token).header.kid;
-  if (!kid) return jwks[0];
+  const { header } = decode(token);
+  const kid = header.kid;
+  const alg = header.alg;
+  if (!kid) {
+    if (jwks.length === 1) {
+      const key2 = jwks[0];
+      if (key2.alg && alg && key2.alg !== alg) {
+        throw new Error(
+          `Algorithm mismatch: token uses ${alg}, but key specifies ${key2.alg}`
+        );
+      }
+      return key2;
+    }
+    throw new Error(
+      'Token is missing "kid" header, and JWKS contains multiple keys'
+    );
+  }
   const key = jwks.find((k) => k.kid === kid);
   if (!key) throw new Error(`No key found for kid: ${kid}`);
+  if (key.alg && alg && key.alg !== alg)
+    throw new Error(
+      `Algorithm mismatch: token uses ${alg}, but key specifies ${key.alg}`
+    );
   return key;
 }
 function clearCookies(redirectUri) {
@@ -653,7 +673,8 @@ function clearCookies(redirectUri) {
       expires: /* @__PURE__ */ new Date(0),
       path: "/",
       secure: redirectUri.protocol === "https:",
-      httpOnly: true
+      httpOnly: true,
+      sameSite: "lax"
     },
     {
       name: COOKIE_REFRESH_TOKEN,
@@ -675,7 +696,8 @@ function tokenToCookie(token, redirectUri) {
       expires: token.expiresAt ? new Date(token.expiresAt) : void 0,
       path: "/",
       secure: redirectUri.protocol === "https:",
-      httpOnly: true
+      httpOnly: true,
+      sameSite: "lax"
     },
     {
       name: COOKIE_REFRESH_TOKEN,

package/dist/backend/resolver/ParsePreview.d.ts

@@ -1,5 +1,5 @@
-import type { PreviewRequest } from 'alinea/core/Preview';
 import type { LocalDB } from 'alinea/core/db/LocalDB';
+import type { PreviewRequest } from 'alinea/core/Preview';
 export declare function createPreviewParser(local: LocalDB): {
     parse(preview: PreviewRequest, sync: () => Promise<unknown>): Promise<PreviewRequest | undefined>;
 };

package/dist/backend/resolver/ParsePreview.js

@@ -25,9 +25,17 @@ function createPreviewParser(local) {
       });
       if (!entry) return;
       const baseText = decoder.decode(
-        JsonLoader.format(local.config.schema, createRecord(entry, entry.status))
+        JsonLoader.format(
+          local.config.schema,
+          createRecord(entry, entry.status)
+        )
       );
-      const updatedText = await applyFilePatch(baseText, payload.patch);
+      let updatedText;
+      try {
+        updatedText = await applyFilePatch(baseText, payload.patch);
+      } catch {
+        return;
+      }
       const { data } = parseRecord(JSON.parse(updatedText));
       const { rowHash: _rowHash, fileHash: _fileHash, ...withoutHashes } = entry;
       const patched = await createEntryRow(

package/dist/backend/router/Router.d.ts

@@ -38,6 +38,11 @@ export declare namespace router {
             url: URL;
             params: Record<string, unknown>;
         }>;
+        options(path: string): Route<globalThis.Request, {
+            request: globalThis.Request;
+            url: URL;
+            params: Record<string, unknown>;
+        }>;
         all(path: string): Route<globalThis.Request, {
             request: globalThis.Request;
             url: URL;
@@ -65,6 +70,11 @@ export declare namespace router {
             url: URL;
             params: Record<string, unknown>;
         }>;
+        options(path: string): Route<globalThis.Request, {
+            request: globalThis.Request;
+            url: URL;
+            params: Record<string, unknown>;
+        }>;
         all(path: string): Route<globalThis.Request, {
             request: globalThis.Request;
             url: URL;
@@ -92,6 +102,11 @@ export declare namespace router {
             url: URL;
             params: Record<string, unknown>;
         }>;
+        options(path: string): Route<globalThis.Request, {
+            request: globalThis.Request;
+            url: URL;
+            params: Record<string, unknown>;
+        }>;
         all(path: string): Route<globalThis.Request, {
             request: globalThis.Request;
             url: URL;

package/dist/backend/router/Router.js

@@ -91,6 +91,9 @@ function callHandler(handler, input) {
       delete(path) {
         return withMethod("DELETE").map(withPath(path, getPathname));
       },
+      options(path) {
+        return withMethod("OPTIONS").map(withPath(path, getPathname));
+      },
       all(path) {
         return withPath(path, getPathname);
       }

package/dist/backend/util/ExecGit.d.ts

@@ -1,8 +1,8 @@
 import PLazy from 'p-lazy';
 export declare function execGit(cwd: string, args: string[]): Promise<string>;
 export declare function gitUser(cwd: string): PLazy<{
-    name: string;
-    email: string;
     sub: string;
     roles: string[];
+    name: string;
+    email: string;
 }>;