ampless 0.2.0-alpha.7 → 1.0.0-alpha.10

package/dist/index.d.ts

@@ -4,7 +4,6 @@ type SiteSettingsEventType = 'site.settings.updated';
 type EventType = ContentEventType | MediaEventType | SiteSettingsEventType;
 /** Minimal projection of a Post item carried in events (no body, to keep payloads small). */
 interface ContentEventPayload {
-    siteId: string;
     postId: string;
     slug: string;
     title: string;
@@ -13,18 +12,16 @@ interface ContentEventPayload {
     tags?: string[];
 }
 interface MediaEventPayload {
-    siteId: string;
     mediaId: string;
     src: string;
     mimeType: string;
 }
 /**
- * Emitted whenever any setting under `siteconfig:{siteId}` in KvStore
- * is created, updated, or removed. Subscribers (built-in or user
- * plugins) can rebuild caches, theme assets, etc.
+ * Emitted whenever any setting under the `siteconfig:` PK in KvStore is
+ * created, updated, or removed. Subscribers (built-in or user plugins)
+ * can rebuild caches, theme assets, etc.
  */
 interface SiteSettingsEventPayload {
-    siteId: string;
 }
 type EventPayloadOf<T extends EventType> = T extends ContentEventType ? ContentEventPayload : T extends MediaEventType ? MediaEventPayload : T extends SiteSettingsEventType ? SiteSettingsEventPayload : never;
 interface AmplessEvent<T extends EventType = EventType> {
@@ -89,13 +86,12 @@ type PluginEventHandler<T extends EventType = EventType> = (event: AmplessEvent<
  * (sandbox, tests) without touching plugin code.
  */
 interface PluginRuntimeContext {
-    siteId: string;
     /** Read-only view of the cms.config site block (name, url, description). */
     site: Config['site'];
-    /** Read all published posts for the site (used by sitemap/RSS). */
+    /** Read all published posts (used by sitemap/RSS). */
     listPublishedPosts(): Promise<Post[]>;
     /**
-     * Persist a file under `public/plugins/{pluginName}/{key}` in the site's
+     * Persist a file under `public/plugins/{pluginName}/{key}` in the
      * S3 bucket. Returns the public URL.
      */
     writePublicAsset(key: string, body: string | Uint8Array, contentType: string): Promise<string>;
@@ -157,9 +153,9 @@ interface AmplessPlugin {
     siteMetadata?(site: Config['site']): PluginMetadata;
     /**
      * Dynamic OG image renderer. The dispatcher route (e.g.
-     * `app/site/[siteId]/og/[slug]/route.ts`) reads this and feeds the
-     * element into Next.js `ImageResponse`. Only one plugin should set this
-     * — the route resolves the first plugin in `cms.config.plugins` that
+     * `app/og/[slug]/route.ts`) reads this and feeds the element into
+     * Next.js `ImageResponse`. Only one plugin should set this — the
+     * route resolves the first plugin in `cms.config.plugins` that
      * declares `ogImage`.
      */
     ogImage?: OgImageConfig;
@@ -169,9 +165,9 @@ declare function definePlugin(p: AmplessPlugin): AmplessPlugin;
 type ContentFormat = 'tiptap' | 'markdown' | 'html' | 'static';
 /**
  * Body shape for `format: 'static'` posts. The actual asset bytes
- * live under S3 at `public/static/<siteId>/<slug>/<files...>` — the
- * body here is the manifest describing which entrypoint to serve and
- * which files are part of the bundle.
+ * live under S3 at `public/static/<slug>/<files...>` — the body here
+ * is the manifest describing which entrypoint to serve and which files
+ * are part of the bundle.
  *
  * Stored as JSON in the `body` column (same encoding pattern as the
  * tiptap doc / html string / markdown string for the other formats).
@@ -192,6 +188,22 @@ interface StaticPostBody {
     uploadedAt: string;
 }
 type PostStatus = 'draft' | 'published';
+/**
+ * Per-post cache strategy. Middleware computes the response's
+ * Cache-Control header from this value (plus `post.updatedAt` for the
+ * `auto` case and the project's `cms.config.cache.*` knobs).
+ *
+ *   - `'auto'` (default): cooldown by edit time. Posts updated within
+ *     the cooldown window (`cms.config.cache.cooldownMs`, default 1h)
+ *     emit a no-store header so editors see fresh content immediately.
+ *     Older posts emit a long s-maxage so the CDN serves them cheaply.
+ *   - `'deep'`: always long-cache (`cms.config.cache.deepTtlSeconds`,
+ *     default 1h). Use for posts whose content is fixed for the
+ *     foreseeable future.
+ *   - `'hot'`: always no-store. Use for posts whose content is rapidly
+ *     evolving or computed per request.
+ */
+type CacheStrategy = 'auto' | 'deep' | 'hot';
 /**
  * Free-form per-post metadata. The `metadata` JSON column carries
  * arbitrary key/value pairs; the runtime / themes / plugins each pick
@@ -200,8 +212,13 @@ type PostStatus = 'draft' | 'published';
  *
  * Well-known keys:
  *   - `no_layout`: when true, the public page is served as bare HTML
- *     (no theme chrome). The runtime's post dispatcher checks this
- *     before rendering and redirects to the raw route handler.
+ *     (no theme chrome). Middleware rewrites the request to the
+ *     unified internal route handler (`/r/<slug>`) for such posts
+ *     and renders the body verbatim — no Next.js root layout, no
+ *     theme chrome.
+ *   - `cache`: see `CacheStrategy`. Overrides the default 'auto'
+ *     cache strategy for this post. Independent of `no_layout` —
+ *     applies uniformly to themed, no_layout, and static posts.
  *
  * Additional keys are passed through unchanged — themes and plugins
  * are free to store their own per-post state here (e.g. SEO overrides,
@@ -209,11 +226,11 @@ type PostStatus = 'draft' | 'published';
  */
 interface PostMetadata {
     no_layout?: boolean;
+    cache?: CacheStrategy;
     [key: string]: unknown;
 }
 interface Post {
     postId: string;
-    siteId: string;
     slug: string;
     title: string;
     excerpt?: string;
@@ -223,10 +240,18 @@ interface Post {
     publishedAt?: string;
     tags?: string[];
     metadata?: PostMetadata;
+    /**
+     * DynamoDB auto-managed timestamp (ISO 8601). Surfaced through the
+     * `PublicPost` projection so middleware can compute the
+     * `metadata.cache='auto'` cooldown without re-fetching the model
+     * row. Absent on optimistically-constructed posts (e.g. test
+     * fixtures); the cache strategy treats absent values as "very old"
+     * and emits a long s-maxage.
+     */
+    updatedAt?: string;
 }
 interface Page {
     pageId: string;
-    siteId: string;
     slug: string;
     title: string;
     format: ContentFormat;
@@ -236,7 +261,6 @@ interface Page {
 }
 interface Media {
     mediaId: string;
-    siteId: string;
     src: string;
     mimeType: string;
     size: number;
@@ -261,21 +285,6 @@ interface MediaProcessingDefaults {
     /** Use lossless WebP for PNG inputs (default true). */
     losslessForPng?: boolean;
 }
-/**
- * Per-site override. The top-level `Config.site` provides defaults that
- * fall through when these are unset. `domains` is required because it's
- * how the middleware maps incoming requests to a siteId.
- */
-interface SiteConfig {
-    /** Hostnames this site responds to (subdomains, separate apex domains, both fine). */
-    domains: string[];
-    /** Override `Config.site.name` for this site. */
-    name?: string;
-    /** Override `Config.site.url` (canonical) for this site. */
-    url?: string;
-    /** Override `Config.site.description` for this site. */
-    description?: string;
-}
 interface Config {
     site: {
         name: string;
@@ -304,16 +313,9 @@ interface Config {
      * UI locale for the admin app. The scaffolded project ships
      * `locales/<code>.json` dictionaries; defaults are `en` and `ja`.
      * Add a new language by dropping `locales/<code>.json` in and
-     * updating the dictionary map in `lib/i18n.ts`. Per-site override is
-     * possible via the `locale` site setting.
+     * updating the dictionary map in `lib/i18n.ts`.
      */
     locale?: string;
-    /**
-     * Multi-site configuration. When 2+ entries are declared, the runtime
-     * switches to multi-site mode (host-based routing + Cache-Control:
-     * private). When 0 or 1 entries, single-site mode is used.
-     */
-    sites?: Record<string, SiteConfig>;
     /**
      * Active plugins. Each entry is the result of a plugin factory call
      * (e.g. `seoPlugin({ ... })`) or a raw AmplessPlugin object. Strings are
@@ -321,6 +323,36 @@ interface Config {
      * ignored by the runtime.
      */
     plugins?: Array<AmplessPlugin | string>;
+    /**
+     * Cache strategy knobs read by the runtime's middleware when
+     * computing `Cache-Control` for post responses. Each field is
+     * optional — middleware applies the documented defaults when a
+     * field is absent.
+     */
+    cache?: CacheConfig;
+}
+/**
+ * Tunables for middleware-computed `Cache-Control`. See
+ * `PostMetadata.cache` / `CacheStrategy` for how the per-post override
+ * interacts with these defaults.
+ */
+interface CacheConfig {
+    /**
+     * `cache: 'auto'` cooldown. Posts whose `updatedAt` is younger than
+     * this many milliseconds emit a no-store header so editors see
+     * fresh content immediately after a save. Default 3,600,000 (1h).
+     */
+    cooldownMs?: number;
+    /**
+     * `cache: 'auto'` post-cooldown TTL, in seconds. Applied as both
+     * `max-age` and `s-maxage` on the response. Default 300 (5 minutes).
+     */
+    freshTtlSeconds?: number;
+    /**
+     * `cache: 'deep'` TTL, in seconds. Applied as both `max-age` and
+     * `s-maxage`. Default 3600 (1 hour).
+     */
+    deepTtlSeconds?: number;
 }
 type Role = 'reader' | 'editor' | 'admin';
 interface AuthContext {
@@ -346,7 +378,6 @@ interface ContentTypeDefinition {
 declare function defineSchema<T extends Record<string, ContentTypeDefinition>>(schema: T): T;
 
 interface ListOptions {
-    siteId?: string;
     limit?: number;
     status?: 'draft' | 'published' | 'all';
 }
@@ -355,85 +386,20 @@ type CreatePostInput = Omit<Post, 'postId'> & {
 };
 interface PostsProvider {
     list(opts?: ListOptions): Promise<Post[]>;
-    get(slug: string, opts?: {
-        siteId?: string;
-    }): Promise<Post | null>;
-    getById(postId: string, opts?: {
-        siteId?: string;
-    }): Promise<Post | null>;
+    get(slug: string): Promise<Post | null>;
+    getById(postId: string): Promise<Post | null>;
     create(data: CreatePostInput): Promise<Post>;
-    update(postId: string, data: Partial<Post>, opts?: {
-        siteId?: string;
-    }): Promise<Post>;
-    remove(postId: string, opts?: {
-        siteId?: string;
-    }): Promise<void>;
+    update(postId: string, data: Partial<Post>): Promise<Post>;
+    remove(postId: string): Promise<void>;
 }
 declare function setPostsProvider(p: PostsProvider): void;
 declare function hasPostsProvider(): boolean;
 declare function listPosts(opts?: ListOptions): Promise<Post[]>;
-declare function getPost(slug: string, opts?: {
-    siteId?: string;
-}): Promise<Post | null>;
-declare function getPostById(postId: string, opts?: {
-    siteId?: string;
-}): Promise<Post | null>;
+declare function getPost(slug: string): Promise<Post | null>;
+declare function getPostById(postId: string): Promise<Post | null>;
 declare function createPost(data: CreatePostInput): Promise<Post>;
-declare function updatePost(postId: string, data: Partial<Post>, opts?: {
-    siteId?: string;
-}): Promise<Post>;
-declare function deletePost(postId: string, opts?: {
-    siteId?: string;
-}): Promise<void>;
-
-/**
- * Single-site fallback identifier. Used when `cms.config.sites` is unset
- * or empty — keeps existing single-site code paths working without
- * special-casing.
- */
-declare const DEFAULT_SITE_ID = "default";
-/**
- * Resolve a hostname to a configured siteId.
- *
- * - Single-site mode (no `sites` defined / empty / exactly one entry):
- *   returns that site's id regardless of host. The single site catches
- *   every request. Matches `isMultiSite` (≥2 entries = multi).
- * - Multi-site mode (2+ entries): looks up the host in each site's
- *   `domains` list. Returns `null` if the host is not registered
- *   (caller should 404).
- *
- * The host comparison is case-insensitive; ports are not stripped here
- * — pass the bare hostname (e.g. `'site-a.example.com'`).
- */
-declare function resolveSiteId(host: string, config: Config): string | null;
-/**
- * Multi-site mode iff two or more sites are declared. A single declared
- * site is treated as single-site mode (the explicit declaration just lets
- * the operator name the site, but no host disambiguation is needed).
- */
-declare function isMultiSite(config: Config): boolean;
-/**
- * Site-effective name / url / description for a given siteId. Per-site
- * `sites.{id}.{name|url|description}` overrides the top-level `site.*`
- * defaults; otherwise falls through.
- */
-declare function siteFor(siteId: string, config: Config): {
-    name: string;
-    url: string;
-    description?: string;
-};
-/**
- * Build the denormalized GSI key for `bySiteIdStatus`. All Post writes
- * (admin client, MCP tools) must set this so the public-read resolvers
- * can do a single Query without table-level filtering.
- */
-declare function composeSiteIdStatus(siteId: string, status: PostStatus): string;
-/**
- * Build the denormalized GSI key for `bySiteIdSlug`. The public
- * `getPublishedPost(slug)` resolver does an O(1) PK lookup against
- * this index, so every Post write must set it alongside the slug.
- */
-declare function composeSiteIdSlug(siteId: string, slug: string): string;
+declare function updatePost(postId: string, data: Partial<Post>): Promise<Post>;
+declare function deletePost(postId: string): Promise<void>;
 
 interface KvItem<T = unknown> {
     pk: string;
@@ -459,15 +425,15 @@ declare function hasKvStore(): boolean;
  * namespace (e.g. `mcp-tokens`).
  */
 declare function getKvStore(): KvStore;
-declare const SITE_CONFIG_PK: (siteId: string) => string;
-declare function getSiteSetting<T = unknown>(siteId: string, key: string): Promise<T | null>;
-declare function setSiteSetting(siteId: string, key: string, value: unknown): Promise<void>;
-declare function deleteSiteSetting(siteId: string, key: string): Promise<void>;
+declare const SITE_CONFIG_PK = "siteconfig";
+declare function getSiteSetting<T = unknown>(key: string): Promise<T | null>;
+declare function setSiteSetting(key: string, value: unknown): Promise<void>;
+declare function deleteSiteSetting(key: string): Promise<void>;
 /**
- * Fetch every setting for a site as a flat map (`{ 'site.name': 'My Blog', ... }`).
+ * Fetch every site setting as a flat map (`{ 'site.name': 'My Blog', ... }`).
  * Use `unflattenSettings` to convert to the nested shape if needed.
  */
-declare function listSiteSettings(siteId?: string): Promise<Record<string, unknown>>;
+declare function listSiteSettings(): Promise<Record<string, unknown>>;
 declare function flattenSettings(obj: Record<string, unknown>, prefix?: string): Record<string, unknown>;
 declare function unflattenSettings(flat: Record<string, unknown>): Record<string, unknown>;
 
@@ -551,6 +517,94 @@ declare function formatPublicAssetUrl(bucket: string, region: string, key: strin
  */
 declare function extractFirstImageUrl(post: Post): string | null;
 
+/**
+ * Pure helpers for `format: 'static'` post bundles. Kept platform-free
+ * (no `File`, no Amplify Storage, no AWS SDK) so both the browser admin
+ * uploader and the MCP tools (running in stdio CLI + Lambda HTTP
+ * transport) can share the validation / picker / mime logic.
+ *
+ * The `extractZip(File)` / `uploadBundle` / `deleteBundle` browser
+ * helpers stay in `@ampless/admin/lib/static-bundle.js` — they pull in
+ * JSZip and `aws-amplify/storage`, neither of which we want in Lambda.
+ * The MCP Lambda implements its own zip extractor (`fflate`) on top of
+ * the helpers here.
+ */
+declare const DEFAULT_ENTRYPOINT = "index.html";
+/**
+ * Maximum bundle size (uncompressed) for the browser-side admin
+ * pipeline. Above this the in-tab extract / multi-PUT pipeline gets
+ * sluggish. The Lambda / MCP side enforces its own limit (Function URL
+ * payload cap, around 6 MB base64-inflated per call) — this constant
+ * is exported as a reasonable upper bound for any caller that wants
+ * a sanity check, not a hard contract for non-browser paths.
+ */
+declare const MAX_BUNDLE_BYTES: number;
+declare const TEXT_EXTENSIONS: ReadonlySet<string>;
+declare function mimeTypeFor(path: string): string;
+interface ValidationIssue {
+    path: string;
+    line?: number;
+    reason: string;
+}
+/**
+ * Reject paths that would either escape the bundle root (`..`), confuse
+ * S3 (`null bytes`), or carry OS-specific cruft from zip tools
+ * (`__MACOSX/`, `.DS_Store`). Returns `null` when the path is OK,
+ * otherwise the reason to surface to the user.
+ */
+declare function validateBundlePath(path: string): string | null;
+/**
+ * Scan text files for **absolute** path references. The static-bundle
+ * contract is that every reference resolves inside the bundle via
+ * relative paths, so any `href="/foo"` would either escape to the
+ * Next.js root or break under arbitrary URL prefixes. Protocol-prefixed
+ * URLs (`https://…`) and `mailto:` / `tel:` are fine.
+ *
+ * `data:` and `blob:` URIs also pass (they don't traverse the network).
+ * Hash-only (`#anchor`) and empty values pass too.
+ */
+declare function findAbsolutePathRefs(path: string, content: string): ValidationIssue[];
+interface ExtractedFile {
+    /** Relative path inside the bundle (slash-separated). */
+    path: string;
+    data: Uint8Array;
+}
+interface BundleExtractResult {
+    files: ExtractedFile[];
+    issues: ValidationIssue[];
+    totalBytes: number;
+}
+/**
+ * Scan every text file in the bundle for absolute URL refs. Returns
+ * the union of issues across files so the admin UI / MCP tool can
+ * render a single list of problems before saving.
+ */
+declare function validateBundle(files: ExtractedFile[]): ValidationIssue[];
+declare function bundlePrefix(slug: string): string;
+/**
+ * If every file shares the same top-level directory (e.g. macOS Finder
+ * zipping wraps the contents in a `MyBundle/` folder), strip that
+ * prefix so the bundle's logical root is the entrypoint's parent.
+ * Bundles already at root pass through unchanged.
+ */
+declare function stripCommonPrefix(files: ExtractedFile[]): ExtractedFile[];
+/**
+ * Heuristic for the default entrypoint when the caller didn't override:
+ *   1. exact `index.html` at root
+ *   2. exact `index.htm` at root
+ *   3. the first .html / .htm file at root (alphabetical)
+ *   4. the first .html / .htm anywhere
+ *   5. fall back to the literal 'index.html' so the validator surfaces
+ *      a meaningful error to the user ("entrypoint not in bundle")
+ *
+ * Accepts either extracted files (with `data`) or a plain list of
+ * relative paths — the MCP `commit_static_post` flow only has the
+ * S3 ListObjects result to work with, no bytes.
+ */
+declare function pickDefaultEntrypoint(files: readonly {
+    path: string;
+}[]): string;
+
 type ThemeFieldType = 'color' | 'text' | 'select' | 'image' | 'length' | 'fontFamily' | 'linkList';
 /**
  * Single entry in a `linkList` field. Stored as part of a JSON array
@@ -653,9 +707,7 @@ declare function defineTheme(m: ThemeManifest): ThemeManifest;
  */
 declare function resolveLocalized(value: LocalizedString | undefined, locale: string, fallback?: string): string;
 interface ThemeRouteContext<P = Record<string, string>> {
-    params: Promise<P & {
-        siteId: string;
-    }>;
+    params: Promise<P>;
 }
 interface ThemeModule {
     /** Stable identifier — must match the directory name and the value
@@ -663,9 +715,10 @@ interface ThemeModule {
     name: string;
     manifest: ThemeManifest;
     /**
-     * Server components rendered by the dispatcher routes under
-     * `app/site/[siteId]/`. Each theme MUST provide Home; Post / Tag are
-     * recommended but optional (dispatcher 404s when missing).
+     * Server components rendered by the dispatcher routes
+     * (`app/page.tsx`, `app/[slug]/page.tsx`, `app/tag/[tag]/page.tsx`).
+     * Each theme MUST provide Home; Post / Tag are recommended but
+     * optional (dispatcher 404s when missing).
      */
     components: {
         Home: (ctx: ThemeRouteContext) => Promise<unknown> | unknown;
@@ -695,11 +748,9 @@ interface ThemeModule {
      */
     routes?: {
         feed?: (ctx: {
-            siteId: string;
             request: Request;
         }) => Promise<Response>;
         sitemap?: (ctx: {
-            siteId: string;
             request: Request;
         }) => Promise<Response>;
     };
@@ -757,11 +808,11 @@ declare function isTagListUrl(url: string): {
 /**
  * Resolve effective values for every manifest field, merging stored
  * overrides on top of defaults. `stored` is the flat settings map keyed
- * by `theme.{key}` — typically the output of `listSiteSettings(siteId)`
+ * by `theme.{key}` — typically the output of `listSiteSettings()`
  * filtered to theme entries.
  */
 declare function resolveThemeValues(manifest: ThemeManifest, stored: Record<string, unknown>): Record<string, string>;
 
 declare const VERSION = "0.0.1";
 
-export { type AmplessEvent, type AmplessPlugin, type AuthContext, type Config, type ContentEventPayload, type ContentEventType, type ContentFormat, type ContentTypeDefinition, type CreatePostInput, DEFAULT_SITE_ID, type DateFormat, type EventPayloadOf, type EventType, type FieldDefinition, type FieldType, type ImageDisplay, type KvItem, type KvStore, type LinkListItem, type ListOptions, type LocalizedString, type Media, type MediaEventPayload, type MediaEventType, type MediaProcessingDefaults, type OgImageConfig, type OgImageFont, type OgImageRenderContext, type Page, type PluginEventHandler, type PluginMetadata, type PluginRuntimeContext, type Post, type PostMetadata, type PostStatus, type PostsProvider, type Role, SITE_CONFIG_PK, type SiteConfig, type SiteSettingsEventPayload, type SiteSettingsEventType, type StaticPostBody, type StreamEventName, type ThemeColorField, type ThemeField, type ThemeFieldType, type ThemeFontFamilyField, type ThemeImageField, type ThemeLengthField, type ThemeLinkListField, type ThemeManifest, type ThemeModule, type ThemeRouteContext, type ThemeSelectField, type ThemeTextField, type TrustLevel, VERSION, composeSiteIdSlug, composeSiteIdStatus, createPost, decodeAwsJson, defineConfig, definePlugin, defineSchema, defineTheme, defineThemeModule, deletePost, deleteSiteSetting, detectContentEvents, encodeAwsJson, escapeXml, extractFirstImageUrl, flattenSettings, formatColorPair, formatDate, formatPublicAssetUrl, getKvStore, getPost, getPostById, getSiteSetting, hasKvStore, hasPostsProvider, isMultiSite, isTagListUrl, listPosts, listSiteSettings, parseColorPair, parseLinkList, resolveLocalized, resolveSiteId, resolveThemeValues, setKvStore, setPostsProvider, setSiteSetting, siteFor, stringifyLinkList, themeSettingKey, unflattenSettings, updatePost, validateThemeValue };
+export { type AmplessEvent, type AmplessPlugin, type AuthContext, type BundleExtractResult, type CacheConfig, type CacheStrategy, type Config, type ContentEventPayload, type ContentEventType, type ContentFormat, type ContentTypeDefinition, type CreatePostInput, DEFAULT_ENTRYPOINT, type DateFormat, type EventPayloadOf, type EventType, type ExtractedFile, type FieldDefinition, type FieldType, type ImageDisplay, type KvItem, type KvStore, type LinkListItem, type ListOptions, type LocalizedString, MAX_BUNDLE_BYTES, type Media, type MediaEventPayload, type MediaEventType, type MediaProcessingDefaults, type OgImageConfig, type OgImageFont, type OgImageRenderContext, type Page, type PluginEventHandler, type PluginMetadata, type PluginRuntimeContext, type Post, type PostMetadata, type PostStatus, type PostsProvider, type Role, SITE_CONFIG_PK, type SiteSettingsEventPayload, type SiteSettingsEventType, type StaticPostBody, type StreamEventName, TEXT_EXTENSIONS, type ThemeColorField, type ThemeField, type ThemeFieldType, type ThemeFontFamilyField, type ThemeImageField, type ThemeLengthField, type ThemeLinkListField, type ThemeManifest, type ThemeModule, type ThemeRouteContext, type ThemeSelectField, type ThemeTextField, type TrustLevel, VERSION, type ValidationIssue, bundlePrefix, createPost, decodeAwsJson, defineConfig, definePlugin, defineSchema, defineTheme, defineThemeModule, deletePost, deleteSiteSetting, detectContentEvents, encodeAwsJson, escapeXml, extractFirstImageUrl, findAbsolutePathRefs, flattenSettings, formatColorPair, formatDate, formatPublicAssetUrl, getKvStore, getPost, getPostById, getSiteSetting, hasKvStore, hasPostsProvider, isTagListUrl, listPosts, listSiteSettings, mimeTypeFor, parseColorPair, parseLinkList, pickDefaultEntrypoint, resolveLocalized, resolveThemeValues, setKvStore, setPostsProvider, setSiteSetting, stringifyLinkList, stripCommonPrefix, themeSettingKey, unflattenSettings, updatePost, validateBundle, validateBundlePath, validateThemeValue };

package/dist/index.js

@@ -12,7 +12,6 @@ function defineSchema(schema) {
 var DUMMY_POSTS = [
   {
     postId: "post-001",
-    siteId: "default",
     slug: "hello-world",
     title: "Hello, ampless",
     excerpt: "Welcome to your new ampless-powered blog. This is the first post.",
@@ -24,7 +23,6 @@ var DUMMY_POSTS = [
   },
   {
     postId: "post-002",
-    siteId: "default",
     slug: "about-ampless",
     title: "About ampless",
     excerpt: "Why ampless exists, and what makes it different from other CMS options.",
@@ -36,7 +34,6 @@ var DUMMY_POSTS = [
   },
   {
     postId: "post-003",
-    siteId: "default",
     slug: "getting-started",
     title: "Getting started",
     excerpt: "How to set up your ampless site and deploy it to AWS.",
@@ -57,8 +54,8 @@ function hasPostsProvider() {
   return provider !== null;
 }
 function dummyList(opts = {}) {
-  const { siteId = "default", limit, status = "published" } = opts;
-  let posts = DUMMY_POSTS.filter((p) => p.siteId === siteId);
+  const { limit, status = "published" } = opts;
+  let posts = DUMMY_POSTS;
   if (status !== "all") posts = posts.filter((p) => p.status === status);
   return limit ? posts.slice(0, limit) : posts;
 }
@@ -66,60 +63,25 @@ async function listPosts(opts = {}) {
   if (provider) return provider.list(opts);
   return dummyList(opts);
 }
-async function getPost(slug, opts = {}) {
-  if (provider) return provider.get(slug, opts);
-  const { siteId = "default" } = opts;
-  return DUMMY_POSTS.find((p) => p.siteId === siteId && p.slug === slug) ?? null;
+async function getPost(slug) {
+  if (provider) return provider.get(slug);
+  return DUMMY_POSTS.find((p) => p.slug === slug) ?? null;
 }
-async function getPostById(postId, opts = {}) {
-  if (provider) return provider.getById(postId, opts);
-  const { siteId = "default" } = opts;
-  return DUMMY_POSTS.find((p) => p.siteId === siteId && p.postId === postId) ?? null;
+async function getPostById(postId) {
+  if (provider) return provider.getById(postId);
+  return DUMMY_POSTS.find((p) => p.postId === postId) ?? null;
 }
 async function createPost(data) {
   if (!provider) throw new Error("No posts provider configured. Call setPostsProvider() first.");
   return provider.create(data);
 }
-async function updatePost(postId, data, opts = {}) {
+async function updatePost(postId, data) {
   if (!provider) throw new Error("No posts provider configured. Call setPostsProvider() first.");
-  return provider.update(postId, data, opts);
+  return provider.update(postId, data);
 }
-async function deletePost(postId, opts = {}) {
+async function deletePost(postId) {
   if (!provider) throw new Error("No posts provider configured. Call setPostsProvider() first.");
-  return provider.remove(postId, opts);
-}
-
-// src/sites.ts
-var DEFAULT_SITE_ID = "default";
-function resolveSiteId(host, config) {
-  const sites = config.sites;
-  if (!sites || Object.keys(sites).length === 0) {
-    return DEFAULT_SITE_ID;
-  }
-  const ids = Object.keys(sites);
-  if (ids.length === 1) return ids[0];
-  const lower = host.toLowerCase();
-  for (const [id, site] of Object.entries(sites)) {
-    if (site.domains.some((d) => d.toLowerCase() === lower)) return id;
-  }
-  return null;
-}
-function isMultiSite(config) {
-  return !!config.sites && Object.keys(config.sites).length >= 2;
-}
-function siteFor(siteId, config) {
-  const override = config.sites?.[siteId];
-  return {
-    name: override?.name ?? config.site.name,
-    url: override?.url ?? config.site.url,
-    description: override?.description ?? config.site.description
-  };
-}
-function composeSiteIdStatus(siteId, status) {
-  return `${siteId}#${status}`;
-}
-function composeSiteIdSlug(siteId, slug) {
-  return `${siteId}#${slug}`;
+  return provider.remove(postId);
 }
 
 // src/kv.ts
@@ -139,18 +101,18 @@ function requireStore() {
 function getKvStore() {
   return requireStore();
 }
-var SITE_CONFIG_PK = (siteId) => `siteconfig:${siteId}`;
-async function getSiteSetting(siteId, key) {
-  return requireStore().get(SITE_CONFIG_PK(siteId), key);
+var SITE_CONFIG_PK = "siteconfig";
+async function getSiteSetting(key) {
+  return requireStore().get(SITE_CONFIG_PK, key);
 }
-async function setSiteSetting(siteId, key, value) {
-  return requireStore().put(SITE_CONFIG_PK(siteId), key, value);
+async function setSiteSetting(key, value) {
+  return requireStore().put(SITE_CONFIG_PK, key, value);
 }
-async function deleteSiteSetting(siteId, key) {
-  return requireStore().remove(SITE_CONFIG_PK(siteId), key);
+async function deleteSiteSetting(key) {
+  return requireStore().remove(SITE_CONFIG_PK, key);
 }
-async function listSiteSettings(siteId = DEFAULT_SITE_ID) {
-  const items = await requireStore().query(SITE_CONFIG_PK(siteId));
+async function listSiteSettings() {
+  const items = await requireStore().query(SITE_CONFIG_PK);
   const out = {};
   for (const item of items) {
     out[item.sk] = item.value;
@@ -296,6 +258,135 @@ function findHtmlImage(body) {
   return m ? m[1] : null;
 }
 
+// src/static-bundle.ts
+var DEFAULT_ENTRYPOINT = "index.html";
+var MAX_BUNDLE_BYTES = 50 * 1024 * 1024;
+var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".html",
+  ".htm",
+  ".css",
+  ".svg"
+]);
+var MIME_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".htm": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".txt": "text/plain; charset=utf-8",
+  ".xml": "application/xml; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".pdf": "application/pdf"
+};
+function mimeTypeFor(path) {
+  const lower = path.toLowerCase();
+  const dot = lower.lastIndexOf(".");
+  if (dot < 0) return "application/octet-stream";
+  return MIME_TYPES[lower.slice(dot)] ?? "application/octet-stream";
+}
+function validateBundlePath(path) {
+  if (path === "" || path.endsWith("/")) return "directory entry";
+  if (path.includes("\0")) return "contains null byte";
+  if (path.startsWith("/") || path.startsWith("\\")) return "absolute path";
+  if (path.split(/[/\\]/).some((seg) => seg === "..")) return "parent-directory traversal";
+  if (path.startsWith("__MACOSX/") || /(^|\/)\._/.test(path)) return "macOS resource fork";
+  if (/(^|\/)\.DS_Store$/.test(path)) return ".DS_Store junk";
+  if (/(^|\/)Thumbs\.db$/i.test(path)) return "Thumbs.db junk";
+  return null;
+}
+var HTML_URL_ATTR_RE = /\b(?:href|src|action|data|poster|cite|formaction|manifest|srcset)\s*=\s*["']([^"']+)["']/gi;
+var CSS_URL_RE = /url\(\s*["']?([^"')\s]+)["']?\s*\)|@import\s+["']([^"']+)["']/gi;
+function findAbsolutePathRefs(path, content) {
+  const ext = path.toLowerCase().slice(path.lastIndexOf("."));
+  if (!TEXT_EXTENSIONS.has(ext)) return [];
+  const issues = [];
+  function check(url, lineHint) {
+    const trimmed = url.trim();
+    if (!trimmed) return;
+    if (trimmed.startsWith("#")) return;
+    if (/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) return;
+    if (trimmed.startsWith("//")) {
+      issues.push({ path, reason: `protocol-relative URL: ${lineHint}` });
+      return;
+    }
+    if (trimmed.startsWith("/")) {
+      issues.push({ path, reason: `absolute path: ${lineHint}` });
+      return;
+    }
+  }
+  if (ext === ".html" || ext === ".htm" || ext === ".svg") {
+    HTML_URL_ATTR_RE.lastIndex = 0;
+    let m;
+    while ((m = HTML_URL_ATTR_RE.exec(content)) !== null) {
+      const val = m[1] ?? "";
+      if (/\bsrcset\s*=/i.test(m[0])) {
+        for (const candidate of val.split(",")) {
+          const urlPart = candidate.trim().split(/\s+/)[0];
+          if (urlPart) check(urlPart, candidate.trim());
+        }
+      } else {
+        check(val, m[0]);
+      }
+    }
+  }
+  if (ext === ".css" || ext === ".svg") {
+    CSS_URL_RE.lastIndex = 0;
+    let m;
+    while ((m = CSS_URL_RE.exec(content)) !== null) {
+      const val = (m[1] ?? m[2] ?? "").trim();
+      check(val, m[0]);
+    }
+  }
+  return issues;
+}
+function validateBundle(files) {
+  const issues = [];
+  const decoder = new TextDecoder("utf-8", { fatal: false });
+  for (const f of files) {
+    const ext = f.path.toLowerCase().slice(f.path.lastIndexOf("."));
+    if (!TEXT_EXTENSIONS.has(ext)) continue;
+    const text = decoder.decode(f.data);
+    issues.push(...findAbsolutePathRefs(f.path, text));
+  }
+  return issues;
+}
+function bundlePrefix(slug) {
+  return `public/static/${slug}/`;
+}
+function stripCommonPrefix(files) {
+  if (files.length === 0) return files;
+  const firstSlash = files[0].path.indexOf("/");
+  if (firstSlash < 0) return files;
+  const prefix = files[0].path.slice(0, firstSlash + 1);
+  if (!files.every((f) => f.path.startsWith(prefix))) return files;
+  return files.map((f) => ({ ...f, path: f.path.slice(prefix.length) }));
+}
+function pickDefaultEntrypoint(files) {
+  const exact = files.find((f) => f.path === DEFAULT_ENTRYPOINT);
+  if (exact) return exact.path;
+  const altRoot = files.find((f) => f.path === "index.htm");
+  if (altRoot) return altRoot.path;
+  const htmlRoot = files.filter((f) => /^[^/]+\.html?$/.test(f.path)).sort((a, b) => a.path.localeCompare(b.path));
+  if (htmlRoot.length > 0) return htmlRoot[0].path;
+  const htmlAny = files.filter((f) => /\.html?$/.test(f.path)).sort((a, b) => a.path.localeCompare(b.path));
+  if (htmlAny.length > 0) return htmlAny[0].path;
+  return DEFAULT_ENTRYPOINT;
+}
+
 // src/events.ts
 function detectContentEvents(input) {
   switch (input.eventName) {
@@ -471,11 +562,12 @@ function defaultValueAsString(field) {
 // src/index.ts
 var VERSION = "0.0.1";
 export {
-  DEFAULT_SITE_ID,
+  DEFAULT_ENTRYPOINT,
+  MAX_BUNDLE_BYTES,
   SITE_CONFIG_PK,
+  TEXT_EXTENSIONS,
   VERSION,
-  composeSiteIdSlug,
-  composeSiteIdStatus,
+  bundlePrefix,
   createPost,
   decodeAwsJson,
   defineConfig,
@@ -489,6 +581,7 @@ export {
   encodeAwsJson,
   escapeXml,
   extractFirstImageUrl,
+  findAbsolutePathRefs,
   flattenSettings,
   formatColorPair,
   formatDate,
@@ -499,22 +592,24 @@ export {
   getSiteSetting,
   hasKvStore,
   hasPostsProvider,
-  isMultiSite,
   isTagListUrl,
   listPosts,
   listSiteSettings,
+  mimeTypeFor,
   parseColorPair,
   parseLinkList,
+  pickDefaultEntrypoint,
   resolveLocalized,
-  resolveSiteId,
   resolveThemeValues,
   setKvStore,
   setPostsProvider,
   setSiteSetting,
-  siteFor,
   stringifyLinkList,
+  stripCommonPrefix,
   themeSettingKey,
   unflattenSettings,
   updatePost,
+  validateBundle,
+  validateBundlePath,
   validateThemeValue
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ampless",
-  "version": "0.2.0-alpha.7",
+  "version": "1.0.0-alpha.10",
   "description": "Serverless CMS for AWS Amplify",
   "license": "MIT",
   "type": "module",