alinea 2.0.0-preview.3 → 2.0.0-preview.4

package/dist/.init/content/pages/welcome.json

@@ -1,5 +1,5 @@
 {
-  "_id": "3J5B7YiszA6gly0Vumu4zjLeUNP",
+  "_id": "3JJbJ2F3Dep25BJMlZoVBBFy25h",
   "_type": "Page",
   "_index": "a0",
   "_seeded": "welcome.json",

package/dist/LICENSES.md

@@ -28,11 +28,11 @@ SOFTWARE.
 
 ===
 
-# microcbor@1.2.1 (MIT)
+# jotai@3.0.0 (MIT)
 
 MIT License
 
-Copyright (c) 2021 Joel Gustafson
+Copyright (c) 2020 Poimandres
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -55,7 +55,7 @@ SOFTWARE.
 
 ===
 
-# react-aria-components@1.17.0 (Apache-2.0)
+# @internationalized/date@3.12.1 (Apache-2.0)
 
                                  Apache License
                            Version 2.0, January 2004
@@ -262,7 +262,34 @@ SOFTWARE.
 
 ===
 
-# @internationalized/date@3.12.1 (Apache-2.0)
+# jotai-family@1.1.0 (MIT)
+
+MIT License
+
+Copyright (c) 2025 Poimandres
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+===
+
+# react-stately@3.46.0 (Apache-2.0)
 
                                  Apache License
                            Version 2.0, January 2004
@@ -467,6 +494,33 @@ SOFTWARE.
    limitations under the License.
 
 
+===
+
+# microcbor@1.2.1 (MIT)
+
+MIT License
+
+Copyright (c) 2021 Joel Gustafson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ===
 
 # @tiptap/core@3.30.5 (MIT)
@@ -496,7 +550,7 @@ SOFTWARE.
 
 ===
 
-# react-stately@3.46.0 (Apache-2.0)
+# react-aria-components@1.17.0 (Apache-2.0)
 
                                  Apache License
                            Version 2.0, January 2004
@@ -728,33 +782,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
 
-===
-
-# @badgateway/oauth2-client@3.3.1 (MIT)
-
-MIT License
-
-Copyright (c) 2019-2025 Evert Pot
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
 ===
 
 # react-aria@3.48.0 (Apache-2.0)
@@ -962,60 +989,6 @@ SOFTWARE.
    limitations under the License.
 
 
-===
-
-# @tiptap/extension-list@3.30.5 (MIT)
-
-MIT License
-
-Copyright (c) 2025, Tiptap GmbH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
-===
-
-# use-sync-external-store@1.6.0 (MIT)
-
-MIT License
-
-Copyright (c) Meta Platforms, Inc. and affiliates.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
 ===
 
 # htmlparser2@9.1.0 (MIT)
@@ -1041,11 +1014,11 @@ IN THE SOFTWARE.
 
 ===
 
-# fp16@1.0.0 (MIT)
+# @badgateway/oauth2-client@3.3.1 (MIT)
 
 MIT License
 
-Copyright (c) 2021 Joel Gustafson
+Copyright (c) 2019-2025 Evert Pot
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1117,6 +1090,87 @@ THIS IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRE
 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
+===
+
+# @tiptap/extension-list@3.30.5 (MIT)
+
+MIT License
+
+Copyright (c) 2025, Tiptap GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+===
+
+# fp16@1.0.0 (MIT)
+
+MIT License
+
+Copyright (c) 2021 Joel Gustafson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+===
+
+# use-sync-external-store@1.6.0 (MIT)
+
+MIT License
+
+Copyright (c) Meta Platforms, Inc. and affiliates.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ===
 
 # dom-serializer@2.0.0 (MIT)
@@ -1136,7 +1190,7 @@ THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ===
 
-# @internationalized/string@3.2.8 (Apache-2.0)
+# @internationalized/number@3.6.6 (Apache-2.0)
 
                                  Apache License
                            Version 2.0, January 2004
@@ -1343,7 +1397,7 @@ THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ===
 
-# @internationalized/number@3.6.6 (Apache-2.0)
+# @internationalized/string@3.2.8 (Apache-2.0)
 
                                  Apache License
                            Version 2.0, January 2004

package/dist/adapter/next/DevRemote.js

@@ -12,8 +12,16 @@ function createDevRemote(context, config) {
     applyAuth: context.applyAuth
   });
   const auth = {
-    async authenticate() {
-      return Response.json({ type: AuthResultType.Authenticated });
+    async authenticate(_request, options) {
+      const user = await client.user();
+      if (!user)
+        throw new MissingCredentialsError(
+          "Missing forwarded development authentication"
+        );
+      return Response.json({
+        type: AuthResultType.Authenticated,
+        ...await options.authenticated(user)
+      });
     },
     async verify() {
       const user = await client.user();

package/dist/adapter/next/previews.js

@@ -24,6 +24,7 @@ function NextPreviews({
   if (root) entryParams.set("root", root);
   const editUrl = new URL(`#/edit?${entryParams}`, adminUrl);
   const { isPreviewing } = usePreview({
+    hostOrigin: adminUrl.origin,
     async preview(update) {
       if (!update) return;
       const success = await setPreviewCookies(update.payload);

package/dist/backend/Handler.js

@@ -59,9 +59,19 @@ function createHandler({
       let cnx = remote(context);
       let userCtx;
       if (auth) {
-        return cnx.authenticate(request, {
-          enrichUser(user) {
-            return cnx.enrichUser(user);
+        return await cnx.authenticate(request, {
+          async authenticated(user) {
+            try {
+              return {
+                user: await cnx.enrichUser(user),
+                capabilities: await cnx.capabilities()
+              };
+            } catch (cause) {
+              if (cause instanceof HttpError) throw cause;
+              throw new HttpError(500, "Failed to complete authentication", {
+                cause
+              });
+            }
           }
         });
       }
@@ -72,10 +82,7 @@ function createHandler({
       };
       if (action === HandleAction.Capabilities && request.method === "GET") {
         expectJson();
-        const capabilities = cnx.capabilities;
-        return Response.json(
-          capabilities ? await capabilities() : { users: typeof cnx.listUsers === "function" }
-        );
+        return Response.json(await cnx.capabilities());
       }
       if (action === HandleAction.Upload && request.method === "GET") {
         const entryId = url.searchParams.get("entryId");

package/dist/backend/api/BasicAuth.d.ts

@@ -7,6 +7,6 @@ export interface Verifier {
 export declare class BasicAuth implements AuthApi {
     #private;
     constructor(context: RequestContext, verify: Verifier);
-    authenticate(request: Request, options?: AuthOptions): Promise<Response>;
+    authenticate(request: Request, options: AuthOptions): Promise<Response>;
     verify(request: Request): Promise<AuthedContext>;
 }

package/dist/backend/api/BasicAuth.js

@@ -16,24 +16,24 @@ var BasicAuth = class {
     this.#verify = verify;
   }
   async authenticate(request, options) {
+    let verified;
     try {
-      const verified = await this.verify(request);
-      const url = new URL(request.url);
-      const action = url.searchParams.get("auth");
-      switch (action) {
-        case AuthAction.Status: {
-          const user = options?.enrichUser ? await options.enrichUser(verified.user) : verified.user;
-          return Response.json({
-            type: AuthResultType.Authenticated,
-            user
-          });
-        }
-        default:
-          return new Response("Bad request", { status: 400 });
-      }
+      verified = await this.verify(request);
     } catch {
       return unauthorized();
     }
+    const url = new URL(request.url);
+    const action = url.searchParams.get("auth");
+    switch (action) {
+      case AuthAction.Status: {
+        return Response.json({
+          type: AuthResultType.Authenticated,
+          ...await options.authenticated(verified.user)
+        });
+      }
+      default:
+        return new Response("Bad request", { status: 400 });
+    }
   }
   async verify(request) {
     const ctx = this.#context;

package/dist/backend/api/OAuth2.d.ts

@@ -38,14 +38,14 @@ export interface OAuth2Options {
      */
     revocationEndpoint?: string;
     /**
-     * Extra claims to validate, such as `iss` or `aud`,
+     * Validate provider-specific claims, including `iss` and `aud`.
      * If the claims are invalid, an error should be thrown.
      */
-    validateClaims?(claims: JWTPayload): void;
+    validateClaims(claims: JWTPayload): void | Promise<void>;
 }
 export declare class OAuth2 implements AuthApi {
     #private;
     constructor(context: RequestContext, config: Config, options: OAuth2Options);
-    authenticate(request: Request, options?: AuthOptions): Promise<Response>;
+    authenticate(request: Request, options: AuthOptions): Promise<Response>;
     verify(request: Request): Promise<AuthedContext>;
 }

package/dist/backend/api/OAuth2.js

@@ -469,6 +469,10 @@ var OAuth2 = class {
   #jwks;
   #validateClaims;
   constructor(context, config, options) {
+    assert(
+      typeof options.validateClaims === "function",
+      "OAuth2 validateClaims is required"
+    );
     this.#context = context;
     this.#config = config;
     this.#validateClaims = options.validateClaims;
@@ -514,10 +518,9 @@ var OAuth2 = class {
           const [ctx, err] = await outcome(this.verify(request));
           if (err instanceof Response) return err;
           if (ctx) {
-            const user = options?.enrichUser ? await options.enrichUser(ctx.user) : ctx.user;
             return Response.json({
               type: AuthResultType.Authenticated,
-              user
+              ...await options.authenticated(ctx.user)
             });
           }
           const codeVerifier = await generateCodeVerifier();
@@ -615,7 +618,7 @@ var OAuth2 = class {
         throw new MissingCredentialsError("Missing access token cookie");
       const key = selectKey(jwks, accessToken);
       const user = await verify(accessToken, key);
-      this.#validateClaims?.(user);
+      await this.#validateClaims(user);
       assert(user.exp, "Missing exp claim in access token");
       const expiresSoon = user.exp - Math.floor(Date.now() / 1e3) < 30;
       if (expiresSoon && refreshToken)
@@ -637,7 +640,7 @@ var OAuth2 = class {
           cause: [cause, error]
         });
       });
-      this.#validateClaims?.(user);
+      await this.#validateClaims(user);
       throw Response.json(
         { type: AuthResultType.NeedsRefresh },
         {