blogwright-pds 0.1.0

package/LICENSE

@@ -0,0 +1,24 @@
+MIT License
+
+Copyright (c) 2026 Ant Stanley
+
+Portions of packages/cli/src/pds/rkey.ts are vendored from
+https://github.com/mastrojs/atproto (MIT License, © 2025 Mastro).
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,10 @@
+# blogwright-pds
+
+standard.site (AT Protocol) publishing for [blogwright](https://github.com/antstanley/blogwright):
+the atproto OAuth confidential client, the Secrets Manager-backed key/session store,
+the `site.standard.publication` / `site.standard.document` record sync, and the
+URL-derived rkey implementation (also exposed as the `blogwright/rkey` subpath of the CLI).
+
+Consumed by the `blogwright` CLI, which owns dispatch and wiring; this package owns the
+feature logic and depends only on `blogwright-core` (ports, config types, secrets client)
+and `@atproto/oauth-client-node`. See the repository README for the `pds` command surface.

package/dist/client-metadata.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Single source of truth for the atproto OAuth confidential-client documents.
+ * The site serves these from /oauth/ (see `blogwright pds keygen`, which writes
+ * the committed public/oauth/*.json files); `pds login` verifies the deployed
+ * copies match before authorizing, so the CLI and the PDS always agree.
+ */
+import type { OAuthClientMetadataInput } from '@atproto/oauth-client-node';
+import type { OpsConfig, PdsConfig } from 'blogwright-core';
+/**
+ * Repo-relative paths of the committed OAuth client documents. The segments
+ * under the public dir are protocol-fixed — they must mirror the URL paths in
+ * the client metadata — so only the public dir itself is configurable.
+ */
+export declare function clientDocumentPaths(cfg: Pick<OpsConfig, 'paths'>): {
+    clientMetadata: string;
+    jwks: string;
+};
+/** Per the atproto OAuth spec the client_id IS the metadata document URL. */
+export declare function clientMetadataUrl(domain: string): string;
+export declare function jwksUrl(domain: string): string;
+/** Static page (src/pages/oauth/callback.astro) that displays the redirect params. */
+export declare function callbackUrl(domain: string): string;
+/** The client metadata document served at clientMetadataUrl(domain). */
+export declare function clientMetadata(domain: string, pds: PdsConfig): OAuthClientMetadataInput;
+/** The JWKS document served at jwksUrl(domain) — public key material only. */
+export declare function jwksDocument(publicJwk: Record<string, unknown>): {
+    keys: [typeof publicJwk];
+};

package/dist/client-metadata.js

@@ -0,0 +1,52 @@
+/**
+ * Single source of truth for the atproto OAuth confidential-client documents.
+ * The site serves these from /oauth/ (see `blogwright pds keygen`, which writes
+ * the committed public/oauth/*.json files); `pds login` verifies the deployed
+ * copies match before authorizing, so the CLI and the PDS always agree.
+ */
+/**
+ * Repo-relative paths of the committed OAuth client documents. The segments
+ * under the public dir are protocol-fixed — they must mirror the URL paths in
+ * the client metadata — so only the public dir itself is configurable.
+ */
+export function clientDocumentPaths(cfg) {
+    return {
+        clientMetadata: `${cfg.paths.publicDir}/oauth/client-metadata.json`,
+        jwks: `${cfg.paths.publicDir}/oauth/jwks.json`,
+    };
+}
+/** Per the atproto OAuth spec the client_id IS the metadata document URL. */
+export function clientMetadataUrl(domain) {
+    return `https://${domain}/oauth/client-metadata.json`;
+}
+export function jwksUrl(domain) {
+    return `https://${domain}/oauth/jwks.json`;
+}
+/** Static page (src/pages/oauth/callback.astro) that displays the redirect params. */
+export function callbackUrl(domain) {
+    return `https://${domain}/oauth/callback`;
+}
+/** The client metadata document served at clientMetadataUrl(domain). */
+export function clientMetadata(domain, pds) {
+    return {
+        client_id: clientMetadataUrl(domain),
+        client_name: pds.name,
+        client_uri: `https://${domain}`,
+        application_type: 'web',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        redirect_uris: [callbackUrl(domain)],
+        scope: 'atproto transition:generic',
+        token_endpoint_auth_method: 'private_key_jwt',
+        token_endpoint_auth_signing_alg: 'ES256',
+        dpop_bound_access_tokens: true,
+        jwks_uri: jwksUrl(domain),
+    };
+}
+/** The JWKS document served at jwksUrl(domain) — public key material only. */
+export function jwksDocument(publicJwk) {
+    if (publicJwk.d !== undefined)
+        throw new Error('jwksDocument received a private JWK (has "d")');
+    return { keys: [publicJwk] };
+}
+//# sourceMappingURL=client-metadata.js.map

package/dist/client-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-metadata.js","sourceRoot":"","sources":["../src/client-metadata.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA6B;IAI/D,OAAO;QACL,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,6BAA6B;QACnE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,kBAAkB;KAC/C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,MAAM,6BAA6B,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,OAAO,WAAW,MAAM,kBAAkB,CAAC;AAC7C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,WAAW,MAAM,iBAAiB,CAAC;AAC5C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,GAAc;IAC3D,OAAO;QACL,SAAS,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACpC,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,UAAU,EAAE,WAAW,MAAM,EAAE;QAC/B,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,aAAa,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,KAAK,EAAE,4BAA4B;QACnC,0BAA0B,EAAE,iBAAiB;QAC7C,+BAA+B,EAAE,OAAO;QACxC,wBAAwB,EAAE,IAAI;QAC9B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,SAAkC;IAC7D,IAAI,SAAS,CAAC,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/B,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,33 @@
+import type { PdsContext } from './context.js';
+import { generateClientKey, login as oauthLogin, openPdsRepo, verifyClientAssets } from './oauth.js';
+import { type OpenRepo, type SyncSummary } from './sync.js';
+/**
+ * Generate the OAuth confidential-client key: private JWK into the secret
+ * (clearing any session — client auth is bound to the key), public half into
+ * the two committed /oauth/ documents the site serves.
+ */
+export declare function keygen(ctx: PdsContext, repoRoot?: string, generateKey?: typeof generateClientKey): Promise<void>;
+/** Interactive OAuth bootstrap; see oauth.ts#login for the flow. */
+export declare function login(ctx: PdsContext, opts: {
+    identifier?: string | undefined;
+}, runLogin?: typeof oauthLogin): Promise<void>;
+/** Show whether the secret exists and which parts it holds. Never prints values. */
+export declare function secretStatus(ctx: PdsContext): Promise<void>;
+/** Delete the secret (immediate, no recovery window). */
+export declare function secretDelete(ctx: PdsContext, opts: {
+    yes: boolean;
+}): Promise<void>;
+/**
+ * One-time (idempotent) publication setup: create the site.standard.publication
+ * record — or update it when the committed well-known file already names one — and
+ * write the two site files the user commits.
+ */
+export declare function init(ctx: PdsContext, repoRoot?: string, openRepo?: typeof openPdsRepo, verifyAssets?: typeof verifyClientAssets): Promise<void>;
+/** Reconcile PDS records against local content. Production only. */
+export declare function sync(ctx: PdsContext, repoRoot?: string, openRepo?: OpenRepo): Promise<void>;
+/**
+ * Post-deploy hook: reconcile the PDS after a successful production deploy.
+ * Never fatal — a PDS outage must not fail a good site deploy; the next deploy
+ * re-reconciles. No-op unless production, configured, and initialised.
+ */
+export declare function syncAfterDeploy(ctx: PdsContext, repoRoot?: string, doSync?: (ctx: PdsContext, repoRoot: string) => Promise<SyncSummary>): Promise<void>;

package/dist/commands.js

@@ -0,0 +1,159 @@
+import { join } from 'node:path';
+import { colors, findRepoRoot } from 'blogwright-core';
+import { clientDocumentPaths, clientMetadata, jwksDocument } from './client-metadata.js';
+import { generateClientKey, login as oauthLogin, openPdsRepo, publicClientJwk, verifyClientAssets, } from './oauth.js';
+import { loadPdsSecret, updatePdsSecret } from './secret.js';
+import { PUBLICATION_COLLECTION, publicationRecord, readWellKnownUri, requirePdsConfig, syncPds, wellKnownPath, } from './sync.js';
+import { rkeyFromUri } from './xrpc.js';
+/**
+ * Generate the OAuth confidential-client key: private JWK into the secret
+ * (clearing any session — client auth is bound to the key), public half into
+ * the two committed /oauth/ documents the site serves.
+ */
+export async function keygen(ctx, repoRoot, generateKey = generateClientKey) {
+    const pds = requirePdsConfig(ctx);
+    if (!ctx.domain)
+        throw new Error('pds keygen requires a configured domain');
+    const root = repoRoot ?? (await findRepoRoot(ctx.ports.fs));
+    const kid = `${ctx.config.siteName}-oauth-${new Date().toISOString().slice(0, 10)}`;
+    const clientKey = await generateKey(kid);
+    await updatePdsSecret(ctx.clients.secrets, pds.secretName, (secret) => ({ ...secret, clientKey, session: undefined }), 
+    // keygen is the migration entry point — a legacy app-password value is replaced
+    { replaceLegacy: true });
+    ctx.logger.ok(`stored private key "${kid}" in secret "${pds.secretName}"`);
+    const docPaths = clientDocumentPaths(ctx.config);
+    const documents = [
+        [docPaths.clientMetadata, clientMetadata(ctx.domain, pds)],
+        [docPaths.jwks, jwksDocument(await publicClientJwk(clientKey))],
+    ];
+    for (const [path, body] of documents) {
+        await ctx.ports.fs.writeText(join(root, path), `${JSON.stringify(body, null, 2)}\n`);
+        ctx.logger.info(`  wrote ${path}`);
+    }
+    ctx.logger.info(colors.bold(`Commit ${ctx.config.paths.publicDir}/oauth/* and release — then run \`blogwright pds login\`.`));
+}
+/** Interactive OAuth bootstrap; see oauth.ts#login for the flow. */
+export async function login(ctx, opts, runLogin = oauthLogin) {
+    if (!opts.identifier) {
+        throw new Error('pds login requires --identifier <handle-or-did>');
+    }
+    await runLogin(ctx, opts.identifier, {
+        promptLine: (question) => ctx.ports.terminal.question(question),
+    });
+}
+/** Show whether the secret exists and which parts it holds. Never prints values. */
+export async function secretStatus(ctx) {
+    const pds = requirePdsConfig(ctx);
+    const meta = await ctx.clients.secrets.describeSecret(pds.secretName);
+    if (!meta) {
+        ctx.logger.info(`no secret at "${pds.secretName}" — create it with \`blogwright pds keygen\``);
+        return;
+    }
+    ctx.logger.info(`  name          ${meta.name}`);
+    ctx.logger.info(`  arn           ${meta.arn}`);
+    if (meta.lastChangedDate !== undefined) {
+        ctx.logger.info(`  last changed  ${new Date(meta.lastChangedDate * 1000).toISOString()}`);
+    }
+    try {
+        const secret = await loadPdsSecret(ctx);
+        const kid = secret.clientKey?.kid;
+        ctx.logger.info(`  client key    ${secret.clientKey ? `yes (${kid ?? 'no kid'})` : 'no'}`);
+        ctx.logger.info(`  did           ${secret.did ?? 'no'}`);
+        ctx.logger.info(`  session       ${secret.session ? 'yes' : 'no'}`);
+    }
+    catch (err) {
+        ctx.logger.warn(err.message);
+    }
+}
+/** Delete the secret (immediate, no recovery window). */
+export async function secretDelete(ctx, opts) {
+    const pds = requirePdsConfig(ctx);
+    if (!opts.yes)
+        throw new Error(`refusing to delete secret "${pds.secretName}" without --yes`);
+    await ctx.clients.secrets.deleteSecret(pds.secretName);
+    ctx.logger.ok(`deleted secret "${pds.secretName}"`);
+}
+/**
+ * One-time (idempotent) publication setup: create the site.standard.publication
+ * record — or update it when the committed well-known file already names one — and
+ * write the two site files the user commits.
+ */
+export async function init(ctx, repoRoot, openRepo = openPdsRepo, verifyAssets = verifyClientAssets) {
+    const pds = requirePdsConfig(ctx);
+    if (!ctx.domain)
+        throw new Error('pds init requires a configured domain');
+    const root = repoRoot ?? (await findRepoRoot(ctx.ports.fs));
+    await verifyAssets(ctx);
+    const { did, repo } = await openRepo(ctx);
+    const record = publicationRecord(pds, `https://${ctx.domain}`);
+    const existingUri = await readWellKnownUri(ctx.ports.fs, root, ctx.config);
+    if (existingUri && !existingUri.startsWith(`at://${did}/`)) {
+        // A committed well-known from a fork or an account migration: adopting it
+        // would publish document records that point at a publication this account
+        // does not own, silently breaking standard.site verification.
+        throw new Error(`${wellKnownPath(ctx.config)} points at ${existingUri}, which belongs to a different ` +
+            `account than ${did} — delete the file to create a fresh publication, or log in ` +
+            `with the owning account`);
+    }
+    let publicationUri;
+    if (existingUri) {
+        await repo.putRecord(PUBLICATION_COLLECTION, rkeyFromUri(existingUri), record);
+        publicationUri = existingUri;
+        ctx.logger.ok(`updated publication ${publicationUri}`);
+    }
+    else {
+        const created = await repo.createRecord(PUBLICATION_COLLECTION, record);
+        publicationUri = created.uri;
+        ctx.logger.ok(`created publication ${publicationUri}`);
+    }
+    const wellKnown = wellKnownPath(ctx.config);
+    await ctx.ports.fs.writeText(join(root, wellKnown), `${publicationUri}\n`);
+    await ctx.ports.fs.writeText(join(root, ctx.config.paths.atprotoJson), `${JSON.stringify({ did, publicationUri }, null, 2)}\n`);
+    ctx.logger.info(`  wrote ${wellKnown}`);
+    ctx.logger.info(`  wrote ${ctx.config.paths.atprotoJson}`);
+    ctx.logger.info(colors.bold('Commit both files and deploy — they verify the publication and the post link tags.'));
+}
+/** Reconcile PDS records against local content. Production only. */
+export async function sync(ctx, repoRoot, openRepo = openPdsRepo) {
+    if (ctx.env !== 'production') {
+        throw new Error(`pds sync publishes canonical production URLs and refuses to run for "${ctx.env}"`);
+    }
+    const root = repoRoot ?? (await findRepoRoot(ctx.ports.fs));
+    const summary = await syncPds(ctx, root, openRepo);
+    logSummary(ctx, summary);
+}
+function logSummary(ctx, s) {
+    ctx.logger.ok(`publication ${s.publication}; documents: ${s.created.length} created, ` +
+        `${s.updated.length} updated, ${s.unchanged} unchanged`);
+    for (const slug of s.created)
+        ctx.logger.info(`  created  ${slug}`);
+    for (const slug of s.updated)
+        ctx.logger.info(`  updated  ${slug}`);
+    if (s.orphans.length > 0) {
+        ctx.logger.warn(`${s.orphans.length} PDS record(s) have no local post (rkeys: ${s.orphans.join(', ')}) — ` +
+            'not deleted; remove them manually if intended');
+    }
+}
+/**
+ * Post-deploy hook: reconcile the PDS after a successful production deploy.
+ * Never fatal — a PDS outage must not fail a good site deploy; the next deploy
+ * re-reconciles. No-op unless production, configured, and initialised.
+ */
+export async function syncAfterDeploy(ctx, repoRoot, doSync = (c, r) => syncPds(c, r, openPdsRepo)) {
+    if (ctx.env !== 'production' || !ctx.config.pds)
+        return;
+    const root = repoRoot ?? (await findRepoRoot(ctx.ports.fs));
+    const initialised = await readWellKnownUri(ctx.ports.fs, root, ctx.config).catch(() => undefined);
+    if (!initialised) {
+        ctx.logger.info('standard.site publishing not initialised (`blogwright pds init`) — skipping');
+        return;
+    }
+    try {
+        ctx.logger.step('syncing standard.site records to the PDS');
+        logSummary(ctx, await doSync(ctx, root));
+    }
+    catch (err) {
+        ctx.logger.warn(`pds sync failed (deploy unaffected): ${err.message}`);
+    }
+}
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzF,OAAO,EACL,iBAAiB,EACjB,KAAK,IAAI,UAAU,EACnB,WAAW,EACX,eAAe,EACf,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,OAAO,EACP,aAAa,GAGd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAe,EACf,QAAiB,EACjB,cAAwC,iBAAiB;IAEzD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,UAAU,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,eAAe,CACnB,GAAG,CAAC,OAAO,CAAC,OAAO,EACnB,GAAG,CAAC,UAAU,EACd,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC1D,gFAAgF;IAChF,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,GAAG,gBAAgB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,SAAS,GAAmC;QAChD,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;KAChE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CACT,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,2DAA2D,CAChG,CACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,GAAe,EACf,IAAyC,EACzC,WAA8B,UAAU;IAExC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE;QACnC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAe;IAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,UAAU,8CAA8C,CAAC,CAAC;QAC/F,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAI,MAAM,CAAC,SAA0C,EAAE,GAAG,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,IAAsB;IACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,UAAU,iBAAiB,CAAC,CAAC;IAC9F,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,mBAAmB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAe,EACf,QAAiB,EACjB,WAA+B,WAAW,EAC1C,eAA0C,kBAAkB;IAE5D,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;QAC3D,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CACb,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,WAAW,iCAAiC;YACpF,gBAAgB,GAAG,8DAA8D;YACjF,yBAAyB,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,cAAsB,CAAC;IAC3B,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/E,cAAc,GAAG,WAAW,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,cAAc,EAAE,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QACxE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,cAAc,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,cAAc,IAAI,CAAC,CAAC;IAC3E,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAC1B,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EACxC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACxD,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC;IACxC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CACT,oFAAoF,CACrF,CACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAe,EACf,QAAiB,EACjB,WAAqB,WAAW;IAEhC,IAAI,GAAG,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,wEAAwE,GAAG,CAAC,GAAG,GAAG,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,GAAe,EAAE,CAAc;IACjD,GAAG,CAAC,MAAM,CAAC,EAAE,CACX,eAAe,CAAC,CAAC,WAAW,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,YAAY;QACtE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC,SAAS,YAAY,CAC1D,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,6CAA6C,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACxF,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,QAAiB,EACjB,SAAsE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7E,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAE5B,IAAI,GAAG,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO;IACxD,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC/F,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC5D,UAAU,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAyC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/content.d.ts

@@ -0,0 +1,27 @@
+import type { FileSystem } from 'blogwright-core';
+/** A publishable blog post, as enumerated from the Astro content collection. */
+export interface PostMeta {
+    /**
+     * Content-collection id: frontmatter `slug` when set, else the file path
+     * under the content dir minus its `.md`/`.mdx` extension and any trailing
+     * `/index` segment — matching the id Astro's glob loader produces.
+     */
+    slug: string;
+    title: string;
+    description: string;
+    pubDate: Date;
+}
+/**
+ * Parse the flat frontmatter subset used by src/content.config.ts: scalar
+ * `key: value` lines where value is a bare token, a quoted string, a date, or a
+ * boolean. Deliberately not a YAML parser — the schema is flat by construction.
+ */
+export declare function parseFrontmatter(source: string, file: string): Record<string, string>;
+/**
+ * Enumerate publishable posts from the content collection, mirroring the Astro
+ * glob-loader ids: `.md`/`.mdx` files, a frontmatter `slug` wins outright, a
+ * trailing `/index` segment is dropped, drafts excluded. (Astro additionally
+ * github-slugifies unusual path segments — keep file names lowercase-kebab, as
+ * the rkey derived here must match the id the site builds its link tags from.)
+ */
+export declare function listPublishablePosts(fs: FileSystem, repoRoot: string, contentDir?: string): Promise<PostMeta[]>;

package/dist/content.js

@@ -0,0 +1,69 @@
+import { join } from 'node:path';
+/** Default content-collection directory; overridable via `config.paths.content`. */
+const DEFAULT_CONTENT_DIR = 'src/content/blog';
+const REQUIRED_FIELDS = ['title', 'description', 'pubDate'];
+/**
+ * Parse the flat frontmatter subset used by src/content.config.ts: scalar
+ * `key: value` lines where value is a bare token, a quoted string, a date, or a
+ * boolean. Deliberately not a YAML parser — the schema is flat by construction.
+ */
+export function parseFrontmatter(source, file) {
+    const match = source.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+    if (!match?.[1])
+        throw new Error(`${file}: no frontmatter block`);
+    const fields = {};
+    for (const line of match[1].split(/\r?\n/)) {
+        if (!line.trim() || line.trimStart().startsWith('#'))
+            continue;
+        const kv = line.match(/^([A-Za-z_][\w-]*):\s*(.*)$/);
+        if (!kv)
+            throw new Error(`${file}: unsupported frontmatter line "${line}"`);
+        const key = kv[1];
+        let value = (kv[2] ?? '').trim();
+        if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
+            value = value.slice(1, -1).replaceAll("''", "'");
+        }
+        else if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+            value = value.slice(1, -1).replaceAll('\\"', '"');
+        }
+        fields[key] = value;
+    }
+    return fields;
+}
+/**
+ * Enumerate publishable posts from the content collection, mirroring the Astro
+ * glob-loader ids: `.md`/`.mdx` files, a frontmatter `slug` wins outright, a
+ * trailing `/index` segment is dropped, drafts excluded. (Astro additionally
+ * github-slugifies unusual path segments — keep file names lowercase-kebab, as
+ * the rkey derived here must match the id the site builds its link tags from.)
+ */
+export async function listPublishablePosts(fs, repoRoot, contentDir = DEFAULT_CONTENT_DIR) {
+    const dir = join(repoRoot, contentDir);
+    const posts = [];
+    for (const file of await fs.listFiles(dir)) {
+        const rel = file.replaceAll('\\', '/');
+        if (!/\.mdx?$/.test(rel))
+            continue;
+        const base = rel.replace(/\.mdx?$/, '');
+        const pathId = base.endsWith('/index') ? base.slice(0, -'/index'.length) : base;
+        const fields = parseFrontmatter(await fs.readText(join(dir, file)), rel);
+        if (fields.draft === 'true')
+            continue;
+        for (const key of REQUIRED_FIELDS) {
+            if (!fields[key])
+                throw new Error(`${rel}: frontmatter is missing "${key}"`);
+        }
+        const pubDate = new Date(fields.pubDate);
+        if (Number.isNaN(pubDate.getTime())) {
+            throw new Error(`${rel}: invalid pubDate "${fields.pubDate}"`);
+        }
+        posts.push({
+            slug: fields.slug || pathId,
+            title: fields.title,
+            description: fields.description,
+            pubDate,
+        });
+    }
+    return posts.sort((a, b) => a.slug.localeCompare(b.slug));
+}
+//# sourceMappingURL=content.js.map

package/dist/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../src/content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiBjC,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAC/C,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAErE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAClE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mCAAmC,IAAI,GAAG,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAW,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7E,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAc,EACd,QAAgB,EAChB,aAAqB,mBAAmB;IAExC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QACtC,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,6BAA6B,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,OAAiB,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,sBAAsB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAe;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAqB;YACzC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The narrow slice of the host CLI's context this feature package depends on.
+ * The CLI's OpsContext satisfies it structurally, so the dispatch boundary is
+ * a plain assignment — this package never imports CLI types.
+ */
+import type { FileSystem, OpsConfig, SecretsManagerClient, Terminal } from 'blogwright-core';
+/** Leveled logger surface the pds commands report through. */
+export interface PdsLogger {
+    info(msg: string): void;
+    step(msg: string): void;
+    ok(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+}
+/** The ports the pds feature crosses: repo files and the operator's terminal. */
+export interface PdsPorts {
+    fs: FileSystem;
+    terminal: Terminal;
+}
+/** Everything a pds command needs from its host — config, secrets, ports, logging. */
+export interface PdsContext {
+    env: string;
+    domain: string | undefined;
+    config: OpsConfig;
+    clients: {
+        secrets: SecretsManagerClient;
+    };
+    ports: PdsPorts;
+    logger: PdsLogger;
+}

package/dist/context.js

@@ -0,0 +1,7 @@
+/**
+ * The narrow slice of the host CLI's context this feature package depends on.
+ * The CLI's OpsContext satisfies it structurally, so the dispatch boundary is
+ * a plain assignment — this package never imports CLI types.
+ */
+export {};
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Public surface of blogwright-pds: the pds command entry points the CLI
+ * dispatches to, plus the context types that name the dependency boundary.
+ * The rkey implementation is the separate `blogwright-pds/rkey` subpath.
+ */
+export * from './commands.js';
+export type { PdsContext, PdsLogger, PdsPorts } from './context.js';

package/dist/index.js

@@ -0,0 +1,7 @@
+/**
+ * Public surface of blogwright-pds: the pds command entry points the CLI
+ * dispatches to, plus the context types that name the dependency boundary.
+ * The rkey implementation is the separate `blogwright-pds/rkey` subpath.
+ */
+export * from './commands.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,eAAe,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,51 @@
+/**
+ * atproto OAuth (confidential client) for standard.site publishing — the only
+ * module that touches @atproto/oauth-client-node. The blog itself is the OAuth
+ * client: its metadata + JWKS are static files on the site (client-metadata.ts),
+ * the private key and session live in the Secrets Manager secret (secret.ts),
+ * and every token refresh persists the rotated refresh token back there.
+ */
+import { type Jwk } from '@atproto/oauth-client-node';
+import type { PdsContext } from './context.js';
+import { PdsClient } from './xrpc.js';
+/** A fresh ES256 private JWK for private_key_jwt client authentication. */
+export declare function generateClientKey(kid: string): Promise<Jwk>;
+/** Public half of the client key, for the served JWKS. */
+export declare function publicClientJwk(clientKey: Jwk): Promise<Record<string, unknown>>;
+/**
+ * Check that the deployed /oauth/ documents match what this CLI would send the
+ * authorization server. Run before login/init — a stale or missing deployment
+ * would otherwise fail deep inside the OAuth flow.
+ */
+export declare function verifyClientAssets(ctx: PdsContext, fetchImpl?: typeof fetch): Promise<void>;
+/** The authorize/callback surface of NodeOAuthClient — injectable for tests. */
+interface OauthFlow {
+    authorize(input: string): Promise<URL>;
+    callback(params: URLSearchParams): Promise<{
+        session: {
+            did: string;
+        };
+    }>;
+}
+export interface LoginDeps {
+    /** Ask the operator one question and return their answer. */
+    promptLine: (question: string) => Promise<string>;
+    flow?: OauthFlow | undefined;
+    verifyAssets?: typeof verifyClientAssets | undefined;
+}
+/**
+ * One-time interactive bootstrap: authorize in a browser, land on the site's
+ * /oauth/callback page, paste the redirect URL back. The client persists the
+ * session (and DID) into the secret through the session store.
+ */
+export declare function login(ctx: PdsContext, identifier: string, deps: LoginDeps): Promise<string>;
+/**
+ * Restore the stored OAuth session (transparently refreshing — the rotated
+ * refresh token lands back in the secret) and wrap it as a PdsClient. The
+ * session's fetchHandler adds DPoP + auth headers and handles nonce retries.
+ */
+export declare function openPdsRepo(ctx: PdsContext): Promise<{
+    did: string;
+    repo: PdsClient;
+}>;
+export {};