blume 2.0.3 → 2.1.1

package/dist/types/captcha/turnstile.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import type { AdapterDescriptor } from "../core/adapter.ts";
+/** Options for {@link turnstile}. */
+export interface TurnstileOptions {
+    /** The widget's site key, from the Cloudflare dashboard. */
+    siteKey: string;
+}
+export declare const turnstileOptionsSchema: z.ZodObject<{
+    siteKey: z.ZodString;
+}, z.core.$strict>;
+export type TurnstileAdapter = AdapterDescriptor<"turnstile", TurnstileOptions>;
+export declare const turnstileAdapterSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"turnstile">;
+    options: z.ZodObject<{
+        siteKey: z.ZodString;
+    }, z.core.$strict>;
+    requiredSecrets: z.ZodArray<z.ZodString>;
+    runtimeDeps: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** Where the assistant's route checks a Turnstile token. */
+export declare const TURNSTILE_VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/**
+ * Cloudflare Turnstile. The site key is public and goes to the browser; the
+ * secret key the route checks tokens with comes from `TURNSTILE_SECRET_KEY`.
+ * Set the widget to Invisible or Managed in the Cloudflare dashboard: most
+ * readers never see a challenge.
+ */
+export declare const turnstile: (options: TurnstileOptions) => TurnstileAdapter;

package/dist/types/cli/init/scaffold.d.ts

@@ -126,7 +126,7 @@ export interface PlanEnvironment {
  * What the project still needs from a workspace it sits in, when `init` left
  * that workspace's config alone: a place in a pnpm workspace's `packages`
  * (pnpm skips a folder it doesn't list), pnpm's approval for esbuild's build
- * script (pnpm 10 and later fail the install without it), or Yarn Berry's
+ * script (pnpm 11 and later fail the install without it), or Yarn Berry's
  * `node_modules` linker. Undefined when the workspace already has it, or the
  * project doesn't sit in one.
  */

package/dist/types/components/content/api-field.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The props `<ParamField>` and `<ResponseField>` take, in Mintlify's shape: a
+ * parameter names its location with the attribute that carries its name
+ * (`<ParamField query="limit">`), and both take `type`, `required`,
+ * `deprecated`, and `default`; a response field adds `pre` and `post` labels
+ * around its name. Pure, so the Markdown downlevel and the playground can
+ * read fields the way the components render them.
+ */
+/** Where a `<ParamField>` parameter goes, in the order the attributes are checked. */
+export declare const PARAM_LOCATIONS: readonly ["path", "query", "header", "body"];
+/** A parameter's location. */
+export type ParamLocation = (typeof PARAM_LOCATIONS)[number];
+/** A literal value as MDX passes it: a string attribute, or an expression's data. */
+export type FieldValue = string | number | boolean | null | undefined | FieldValue[] | {
+    [key: string]: FieldValue;
+};
+/** A boolean prop: MDX shorthand (`required`) is `true`, `required="true"` a string. */
+export type FlagProp = boolean | string;
+/** What both field components take. */
+export interface FieldProps {
+    /** The value used when none is given. */
+    default?: FieldValue;
+    deprecated?: FlagProp;
+    required?: FlagProp;
+    /** Free text: `string`, `integer`, `string[]`, `object`. */
+    type?: string;
+}
+/** `<ParamField>`: a request parameter, named by its location attribute. */
+export interface ParamFieldProps extends FieldProps {
+    body?: string;
+    header?: string;
+    /** The name, for a field with no location attribute. */
+    name?: string;
+    path?: string;
+    /**
+     * An example value: the one the playground and request samples start
+     * with, not an input's placeholder hint (see `fieldSchema`).
+     */
+    placeholder?: string;
+    query?: string;
+}
+/** `<ResponseField>`: a field of the response. */
+export interface ResponseFieldProps extends FieldProps {
+    name: string;
+    /** Labels after the name. */
+    post?: string | string[];
+    /** Labels before the name. */
+    pre?: string | string[];
+}
+/** Whether a flag prop is on. */
+export declare const isOn: (value?: FlagProp) => boolean;
+/** Where a parameter goes, and what it's called. */
+export interface ParamFieldName {
+    location?: ParamLocation;
+    name?: string;
+}
+/** A parameter's location and name: the first location attribute set, else `name`. */
+export declare const paramField: (props: ParamFieldProps) => ParamFieldName;
+/** A default value as shown: text as written, anything else as JSON; `null` when there is none. */
+export declare const defaultLabel: (value?: FieldValue) => string | null;
+/** `pre`/`post` labels as a list, whether one was written or several. */
+export declare const fieldLabels: (value?: string | string[]) => string[];

package/dist/types/components/content/api-page.d.ts

@@ -0,0 +1,100 @@
+import type { ParameterLike, SchemaLike } from "../openapi/helpers.ts";
+import type { OperationSecurity } from "../openapi/security.ts";
+import type { FieldValue, ParamLocation } from "./api-field.ts";
+/**
+ * A hand-written API page's endpoint, as its `api` frontmatter and its
+ * `<ParamField>`s describe it, turned into the OpenAPI-shaped pieces the
+ * operation playground and code samples are built from: a page with
+ * `api: "POST /v1/users"` gets the same Try it panel and request samples as
+ * a spec'd operation, with no spec. Mintlify's frontmatter, so migrated pages
+ * keep it as written.
+ */
+/** How a hand-written endpoint authenticates (`authMethod`, `api.auth.method`). */
+export declare const AUTH_METHODS: readonly ["bearer", "basic", "key", "none"];
+export type AuthMethod = (typeof AUTH_METHODS)[number];
+/** What a page's playground shows: all of it, the samples only, or none. */
+export declare const PLAYGROUND_MODES: readonly ["interactive", "simple", "none"];
+export type PlaygroundMode = (typeof PLAYGROUND_MODES)[number];
+/** `api` frontmatter: an HTTP method, then a path or a full URL. */
+export declare const API_ENDPOINT: RegExp;
+/** The site's default auth for hand-written endpoints (`api.auth`). */
+export interface EndpointAuth {
+    method: AuthMethod;
+    /** The header an API key goes in. */
+    name?: string;
+}
+/** One `<ParamField>`, as the page's plugin collected it. */
+export interface EndpointField {
+    default?: FieldValue;
+    deprecated?: boolean;
+    /** Body fields nested in this one's `<Expandable>`. */
+    fields?: EndpointField[];
+    location: ParamLocation;
+    name: string;
+    placeholder?: string;
+    required?: boolean;
+    type?: string;
+}
+/** What the page's plugin hands the endpoint components. */
+export interface EndpointSpec {
+    authMethod?: AuthMethod;
+    fields: EndpointField[];
+    method: string;
+    playground?: PlaygroundMode;
+    /** The page has a `<RequestExample>`, which stands in for generated samples. */
+    requestExample: boolean;
+    /** The `api` target as written: a path, or a full URL. */
+    target: string;
+}
+/** The method and target of an `api` value, or `null` when it isn't one. */
+export declare const parseApiEndpoint: (value: string) => {
+    method: string;
+    target: string;
+} | null;
+/** An endpoint's target, split the way the operation model takes it. */
+export interface EndpointTarget {
+    path: string;
+    servers: {
+        url: string;
+    }[];
+}
+/**
+ * The target split into a server and a path: a full URL is its own server,
+ * and a path joins the site's `api.server`, or stays relative to the docs
+ * when there is none.
+ */
+export declare const endpointTarget: (target: string, server?: string) => EndpointTarget;
+/**
+ * A field's JSON schema from its `type`: `string[]` an array of strings, a
+ * field with nested fields an object with those properties, and anything
+ * that isn't a JSON type (`enum<string>`, `Date`) a string, which is what it
+ * goes over the wire as. A default and placeholder carry over, the
+ * placeholder as the example the samples show.
+ */
+export declare const fieldSchema: (field: EndpointField) => SchemaLike;
+/** The path, query, and header fields as OpenAPI parameters. */
+export declare const endpointParameters: (fields: EndpointField[]) => ParameterLike[];
+/**
+ * The body fields as a JSON request body, or `undefined` when there are none.
+ * Its example, which the playground and samples start from, holds only the
+ * {@link sentFields}.
+ */
+export declare const endpointBody: (fields: EndpointField[]) => {
+    content: {
+        "application/json": {
+            example: import("../openapi/helpers.ts").SpecValue;
+            schema: SchemaLike;
+        };
+    };
+} | undefined;
+/**
+ * The security an endpoint enforces: its page's `authMethod`, else the
+ * site's `api.auth`, else none. An API key goes in the configured header,
+ * `x-api-key` when none is named.
+ */
+export declare const endpointSecurity: (authMethod?: AuthMethod, siteAuth?: EndpointAuth) => OperationSecurity;
+/**
+ * The endpoint spec the page's plugin wrote into the `spec` attribute of
+ * `<ApiEndpoint>` and `<ApiPlayground>`.
+ */
+export declare const readEndpointSpec: (json: string) => EndpointSpec;

package/dist/types/components/layout/nav-utils.d.ts

@@ -69,6 +69,32 @@ export declare const getPagination: (flat: FlatPage[], route: string) => {
     next: FlatPage | null;
     prev: FlatPage | null;
 };
+/** A group node in the sidebar tree. */
+export type NavGroup = Extract<NavNode, {
+    kind: "group";
+}>;
+/**
+ * The group whose own page `route` is, when that page lists the group's
+ * pages: its `directory` (inherited when the group sets none) is `card` or
+ * `accordion`. `null` on every other page.
+ */
+export declare const directoryGroupForRoute: (nodes: NavNode[], route: string) => NavGroup | null;
+/** One entry in a group page's directory: a page, or a subgroup and its pages. */
+export interface DirectoryEntry {
+    description?: string;
+    /** The page, or the subgroup's own page (its first page when it has none). */
+    href: string;
+    icon?: string;
+    label: string;
+    /** A subgroup's pages in sidebar order, its own page first; absent for a page. */
+    pages?: FlatPage[];
+}
+/**
+ * What a group's page lists: the group's pages and subgroups, in sidebar
+ * order, without the page itself or external links. A subgroup is described
+ * by its own page, and one with no page to link to is left out.
+ */
+export declare const directoryEntries: (group: NavGroup) => DirectoryEntry[];
 /**
  * A stable id for every group in a sidebar — `g<n>` by pre-order position in
  * the full tree. The layout hands `NavTree` a scoped view of that tree (a

package/dist/types/components/openapi/code-samples.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Hand-written code samples from a spec: the `x-codeSamples` extension on an
+ * operation (Redocly's, which Mintlify, Speakeasy, and Stainless write too),
+ * or its older spelling `x-code-samples`. Each entry names a `lang`, holds
+ * the `source`, and may carry a `label`. They render as their own tabs ahead
+ * of the generated samples and, being fixed text, the playground leaves them
+ * as written.
+ */
+/** One hand-written sample, ready to render as a tab. */
+export interface CustomCodeSample {
+    /** A stable, unique tab key. */
+    key: string;
+    /** The tab label: the entry's own, else the language's name. */
+    label: string;
+    /** The Shiki language to highlight `source` with. */
+    lang: string;
+    source: string;
+}
+/** The two places an operation keeps them. */
+export interface CodeSamplesCarrier {
+    "x-code-samples"?: unknown;
+    "x-codeSamples"?: unknown;
+}
+/**
+ * The operation's hand-written samples, with a unique tab label each. A label
+ * two samples share gains its language (`List plants · JavaScript`), and one
+ * that still repeats gains a number. Malformed entries are skipped.
+ */
+export declare const customCodeSamples: (operation: CodeSamplesCarrier) => CustomCodeSample[];

package/dist/types/components/openapi/helpers.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Runtime helpers for the OpenAPI components. These operate on the parsed spec
+ * behind the `blume:openapi` alias — resolving `$ref`s (kept intact at parse
+ * time to avoid circular graphs), labelling types, and generating request
+ * examples and code samples. Browser-safe (no server-only imports); example
+ * values come from openapi-sampler, which is likewise browser-safe.
+ */
+/** Any value a parsed OpenAPI document can hold: JSON, nested schemas included. */
+export type SpecValue = string | number | boolean | null | undefined | SpecValue[] | {
+    [key: string]: SpecValue;
+};
+/** A permissive view of an OpenAPI 3.1 schema — only the fields we render. */
+export interface SchemaLike {
+    $ref?: string;
+    type?: string | string[];
+    format?: string;
+    title?: string;
+    description?: string;
+    properties?: Record<string, SchemaLike>;
+    required?: string[];
+    items?: SchemaLike;
+    enum?: SpecValue[];
+    const?: SpecValue;
+    default?: SpecValue;
+    example?: SpecValue;
+    examples?: SpecValue[];
+    allOf?: SchemaLike[];
+    oneOf?: SchemaLike[];
+    anyOf?: SchemaLike[];
+    additionalProperties?: boolean | SchemaLike;
+    nullable?: boolean;
+    deprecated?: boolean;
+    readOnly?: boolean;
+    writeOnly?: boolean;
+    minimum?: number;
+    maximum?: number;
+    minLength?: number;
+    maxLength?: number;
+    minItems?: number;
+    maxItems?: number;
+    pattern?: string;
+    [key: string]: SpecValue;
+}
+/** A permissive view of an operation parameter — only the fields we render. */
+export interface ParameterLike {
+    $ref?: string;
+    name?: string;
+    in?: string;
+    description?: string;
+    required?: boolean;
+    deprecated?: boolean;
+    schema?: SchemaLike;
+    example?: SpecValue;
+    [key: string]: SpecValue;
+}
+/** The `components` object of a parsed spec: section name → named-node table. */
+export type ComponentsLike = Record<string, Record<string, SpecValue> | undefined>;
+/**
+ * Resolve one level of `$ref` against a named `components` section
+ * (`parameters`, `requestBodies`, `responses`). Mirrors {@link resolveSchema}:
+ * an unknown ref — or one pointing into a different section — is returned
+ * as-is.
+ */
+export declare const resolveComponentRef: <T extends {
+    $ref?: string;
+}>(node: T, components: ComponentsLike | undefined, section: string) => T;
+/**
+ * Path-level and operation-level parameters merged into one render list.
+ * `$ref`s resolve against `components.parameters` first; then an operation
+ * parameter overrides a path-level one with the same `name` + `in` (the
+ * OpenAPI override rule), so a re-declared parameter appears once.
+ */
+export declare const mergeParameters: (pathParameters: ParameterLike[] | undefined, operationParameters: ParameterLike[] | undefined, components?: ComponentsLike) => ParameterLike[];
+/** The display name of a `$ref`, e.g. `#/components/schemas/Pet` -> `Pet`. */
+export declare const refName: (ref: string) => string;
+/**
+ * The one member of an `allOf` that only wraps it: `allOf: [{ $ref }]` beside
+ * a `description`, `readOnly`, or `default`, which is how drf-spectacular and
+ * other generators attach keywords a 3.0 `$ref` can't carry. `undefined` for
+ * a real composition: several members, or properties or branches of its own.
+ */
+export declare const soleAllOfMember: (schema: SchemaLike) => SchemaLike | undefined;
+/**
+ * Resolve one level of `$ref` against the document's component schemas. A
+ * single-member `allOf` wrapper resolves like its member, with the wrapper's
+ * own keywords on top: its `description` is about this field.
+ */
+export declare const resolveSchema: (schemas: Record<string, SchemaLike>, schema?: SchemaLike) => SchemaLike;
+/**
+ * A parameter's description: its own, else its schema's (resolved one `$ref`
+ * level), which is where generators like Elysia and oRPC write it.
+ */
+export declare const parameterDescription: (param: {
+    description?: string;
+    schema?: SchemaLike;
+}, schemas: Record<string, SchemaLike>) => string | undefined;
+/**
+ * A short, human-readable type label for a schema row. `$ref`s label by name
+ * (`Pet`, `Pet[]`) without resolving — which also means circular refs through
+ * array items can't recurse forever. A `null` member stays out of a union's
+ * label: rows mark it with {@link isNullable}, as they do `type: [T, "null"]`.
+ * A single-member `allOf` wrapper labels as its member; a real composition is
+ * an `object`.
+ */
+export declare const typeLabel: (schema: SchemaLike) => string;
+/**
+ * Whether this schema is nullable: 3.0 `nullable`, a 3.1 `"null"` in `type`,
+ * or a `{ type: "null" }` member of a `oneOf`/`anyOf` union.
+ */
+export declare const isNullable: (schema: SchemaLike) => boolean;
+/** Human-readable validation constraints for a schema, in display order. */
+export declare const constraints: (schema: SchemaLike) => string[];
+/** The merged property list and required set a schema exposes. */
+export interface ObjectPropertySet {
+    properties: [string, SchemaLike][];
+    required: Set<string>;
+}
+/**
+ * The object properties a schema exposes, merging `allOf` branches so an
+ * `allOf`-composed model still lists every field. Returns the properties plus
+ * the merged required set.
+ */
+export declare const objectProperties: (schema: SchemaLike, schemas: Record<string, SchemaLike>) => ObjectPropertySet;
+/**
+ * Build a representative example value for a schema via openapi-sampler
+ * (Redoc's generator): declared `example`/`const`/`default`/`enum` values
+ * win, formats produce realistic placeholders (`email`, `uuid`, `date-time`),
+ * and circular `$ref` chains — which keeping refs intact allows — terminate
+ * safely. A request sample skips `readOnly` fields (a server-generated field
+ * has no place in one); a response sample skips `writeOnly` fields (a
+ * password the client sends never comes back) and keeps the `readOnly` ones.
+ */
+export declare const exampleValue: (schema: SchemaLike | undefined, schemas: Record<string, SchemaLike>, direction?: "request" | "response") => SpecValue;
+/** Where an author can declare an example: a parameter or a media type. */
+export interface ExampleCarrier {
+    example?: SpecValue;
+    examples?: SpecValue;
+}
+/**
+ * The example a parameter or media type declares: its `example`, else the
+ * first `value` in its `examples` map — inline, or behind a `$ref` to
+ * `#/components/examples`, resolved against `components`. Scalar's upgrade
+ * moves every OpenAPI 3.0 and Swagger 2.0 `example` into
+ * `examples.default.value`, and 3.1 authors write that map directly, so
+ * reading `example` alone would drop them all. `undefined` when nothing is
+ * declared.
+ */
+export declare const declaredExample: (carrier: ExampleCarrier, components?: ComponentsLike) => SpecValue;
+/**
+ * A response media type's example for the Response panel: the declared one,
+ * else a sample built for the response direction (`readOnly` kept,
+ * `writeOnly` skipped).
+ */
+export declare const responseExample: (media: ExampleCarrier & {
+    schema?: SchemaLike;
+}, schemas: Record<string, SchemaLike>, components?: ComponentsLike) => SpecValue;
+/** Pretty-print a JSON value for an example/code block. */
+export declare const toJson: <T>(value: T) => string;

package/dist/types/components/openapi/security.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Security (authorization) resolution for the OpenAPI components. An operation
+ * enforces its own `security` when declared — an empty array explicitly makes
+ * it public — and inherits the document's root `security` otherwise. Within the
+ * resolved list, each requirement object is one way to authorize (OR between
+ * entries), and every scheme named inside a single requirement is needed
+ * together (AND). Pure and dependency-free like `helpers.ts`, so it runs in the
+ * browser build with no server-only imports.
+ */
+/** A permissive view of an OpenAPI security scheme — only the fields we render. */
+export interface SecuritySchemeLike {
+    type?: string;
+    description?: string;
+    /** `apiKey`: the parameter name the key is sent as. */
+    name?: string;
+    /** `apiKey`: where the key goes — `header`, `query`, or `cookie`. */
+    in?: string;
+    /** `http`: the HTTP auth scheme, e.g. `bearer` or `basic`. */
+    scheme?: string;
+    /** `http` bearer: a hint at the token format, e.g. `JWT`. */
+    bearerFormat?: string;
+}
+/** One security requirement: scheme name -> required scopes (empty outside OAuth). */
+export type SecurityRequirementLike = Record<string, string[]>;
+/** A scheme resolved out of `components.securitySchemes`, with its scopes. */
+export interface ResolvedScheme {
+    /** The scheme's component name, e.g. `bearerAuth`. */
+    key: string;
+    /** The scheme object; undefined when the requirement names an unknown one. */
+    scheme?: SecuritySchemeLike;
+    scopes: string[];
+    /**
+     * AsyncAPI: the servers that declare this scheme, set only when the
+     * channel's servers don't all declare the same ones.
+     */
+    servers?: string[];
+}
+/** The security state one operation renders. */
+export interface OperationSecurity {
+    /** Ways to authorize (OR); every scheme within one entry is required (AND). */
+    alternatives: ResolvedScheme[][];
+    /** True when an empty requirement also allows unauthenticated calls. */
+    optional: boolean;
+    /**
+     * AsyncAPI: the servers that declare no security while others do, so the
+     * schemes apply on the other servers only.
+     */
+    unauthenticatedServers?: string[];
+}
+/**
+ * The requirement list an operation actually enforces: its own `security` when
+ * declared — the OpenAPI override rule, where `[]` removes the default and
+ * makes the operation public — else the document's root `security`. A webhook
+ * takes only its own: the API sends it, so the root requirements, which guard
+ * calls to the API, say nothing about what the receiving endpoint checks.
+ */
+export declare const effectiveSecurity: (operation?: SecurityRequirementLike[], document?: SecurityRequirementLike[], webhook?: boolean) => SecurityRequirementLike[];
+/**
+ * Resolve requirement names against `components.securitySchemes`. A name with
+ * no matching component is kept (with `scheme` undefined) so an inconsistent
+ * spec still renders the requirement instead of silently dropping it. An empty
+ * requirement object — the spec idiom for "auth optional" — contributes no
+ * alternative and flips `optional` instead.
+ */
+export declare const resolveSecurity: (requirements: SecurityRequirementLike[], schemes: Record<string, SecuritySchemeLike> | undefined) => OperationSecurity;
+/**
+ * One AsyncAPI 3.x security entry: a `$ref` into
+ * `components.securitySchemes`, or an inline scheme object (the shape the
+ * official 2.x converter emits for scoped requirements, `scopes` on the
+ * scheme itself).
+ */
+export interface AsyncApiSecurityEntryLike {
+    $ref?: string;
+    type?: string;
+    scopes?: unknown;
+}
+/**
+ * Resolve an AsyncAPI 3.x security list. Unlike OpenAPI's requirement maps,
+ * each entry names a single scheme and any one entry satisfies the operation
+ * — so every entry becomes its own one-scheme "or" alternative. A `$ref`
+ * pointing at an undeclared scheme is kept (with `scheme` undefined),
+ * matching {@link resolveSecurity}'s render-don't-drop rule.
+ */
+export declare const resolveAsyncApiSecurity: (entries: AsyncApiSecurityEntryLike[], schemes: Record<string, SecuritySchemeLike> | undefined) => OperationSecurity;
+/** A short human label for a scheme row, e.g. `Bearer token` or `API key`. */
+export declare const schemeLabel: (resolved: ResolvedScheme) => string;
+/**
+ * Where the credential travels: the header/query/cookie parameter it occupies.
+ * Undefined for schemes with no request parameter (mutual TLS) and for unknown
+ * refs, where guessing a location would be misleading.
+ */
+export declare const schemeCarrier: (resolved: ResolvedScheme) => {
+    name: string;
+    in: string;
+} | undefined;

package/dist/types/components/openapi/snippets.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Code-sample generation for an operation. Deliberately dependency-free: the
+ * playground client renders samples live in the browser, so this module must
+ * stay out of the server-only dependency graph (no helpers.ts, no
+ * openapi-sampler). Requests are assembled once by `buildRequest` in
+ * `request.ts`; the builders here only render a finished `RequestSample` as
+ * simple, copy-pasteable starter code — not an exhaustive SDK.
+ */
+export interface RequestSample {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    /**
+     * The request body as sent, when the operation takes one: JSON text,
+     * form-urlencoded pairs, or a raw media type's text.
+     */
+    body?: string;
+    bodyValue?: unknown;
+    /**
+     * A `multipart/form-data` body's parts as `[name, value]` pairs, set
+     * instead of `body`. The request carries no Content-Type of its own for
+     * them: the client writes one with the parts' boundary.
+     */
+    formData?: [string, string][];
+}
+/**
+ * Whether fetch refuses to send `method` (an upper-case HTTP method). TRACE is
+ * one of the Fetch standard's forbidden methods, and the only one an OpenAPI
+ * spec can declare: browsers and Node's fetch alike throw a TypeError before
+ * any request goes out.
+ */
+export declare const fetchRefusesMethod: (method: string) => boolean;
+/** A code-sample language: config id -> label, Shiki lang, and builder. */
+export interface SampleLanguage {
+    id: string;
+    label: string;
+    lang: string;
+    build: (sample: RequestSample) => string;
+}
+/** Every id `codeSamples` accepts for a generated sample. */
+export declare const SAMPLE_LANGUAGE_IDS: string[];
+/** A configured id or alias, as the id it names (lowercased). */
+export declare const sampleLanguageId: (raw: string) => string;
+/** A language's display name and the Shiki language that highlights it. */
+export interface SampleLanguageInfo {
+    label: string;
+    lang: string;
+}
+/**
+ * The display name and Shiki language of a language id or alias, or `null`
+ * when Blume doesn't generate that language.
+ */
+export declare const sampleLanguageInfo: (raw: string) => SampleLanguageInfo | null;
+/** `openapi()`'s default `codeSamples`, which hand-written endpoint pages always use. */
+export declare const DEFAULT_SAMPLE_LANGUAGES: string[];
+/**
+ * The sample languages to render, resolved from config ids (unknown ids
+ * dropped), in order. `false` and an empty list both render none.
+ */
+export declare const sampleLanguages: (ids: string[] | false) => SampleLanguage[];

package/dist/types/consent/ethyca.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import type { HeadScript } from "../analytics/head.ts";
+import type { AdapterDescriptor } from "../core/adapter.ts";
+/** Options for {@link ethyca}. */
+export interface EthycaOptions {
+    /**
+     * The key of the privacy notice that covers analytics, as you named it in
+     * Fides. Defaults to `analytics`.
+     */
+    notice?: string;
+    /** Your Fides privacy center's origin, which serves `fides.js`. */
+    privacyCenter: string;
+    /** The Fides property to load, when you have more than one. */
+    propertyId?: string;
+}
+export declare const ethycaOptionsSchema: z.ZodObject<{
+    notice: z.ZodOptional<z.ZodString>;
+    privacyCenter: z.ZodURL;
+    propertyId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type EthycaAdapter = AdapterDescriptor<"ethyca", EthycaOptions>;
+export declare const ethycaAdapterSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"ethyca">;
+    options: z.ZodObject<{
+        notice: z.ZodOptional<z.ZodString>;
+        privacyCenter: z.ZodURL;
+        propertyId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    requiredSecrets: z.ZodArray<z.ZodString>;
+    runtimeDeps: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Ethyca's Fides consent manager, loaded from your privacy center. Fides
+ * shows its own banner and modal, set up in Fides, and Blume runs the
+ * analytics once the reader's analytics notice is on. Nothing here is
+ * secret.
+ */
+export declare const ethyca: (options: EthycaOptions) => EthycaAdapter;
+/**
+ * Reports the analytics notice to `window.blumeConsent` when Fides is ready
+ * and whenever the reader saves a change, and reopens Fides' modal from the
+ * Cookie settings link. The notice key rides in as `data-notice`. It counts
+ * as allowed when on (`true`), opted in, or a notice that only asks for
+ * acknowledgment.
+ */
+export declare const ETHYCA_BRIDGE = "(()=>{const c=window.blumeConsent;if(!c){return;}const k=document.currentScript?.dataset.notice??\"analytics\";const sync=(e)=>{const v=(e?.detail?.consent??window.Fides?.consent??{})[k];c.set({analytics:v===true||v===\"opt_in\"||v===\"acknowledge\"});};c.open=()=>window.Fides?.showModal();addEventListener(\"FidesReady\",sync);addEventListener(\"FidesUpdated\",sync);if(window.Fides?.initialized){sync();}})();";
+/** Fides' script from the privacy center, then the bridge. */
+export declare const ethycaHead: (options: EthycaOptions) => HeadScript[];

package/dist/types/consent/index.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Consent adapters for `blume.config.ts`:
+ *
+ * ```ts
+ * import { defineConfig } from "blume";
+ * import { googleAnalytics } from "blume/analytics";
+ * import { native } from "blume/consent";
+ *
+ * export default defineConfig({
+ *   analytics: [googleAnalytics({ id: "G-XXXXXXXXXX" })],
+ *   consent: native({ policy: "/privacy" }),
+ * });
+ * ```
+ *
+ * With `consent` set, analytics waits for the reader: every adapter's tags are
+ * held until the consent adapter reports that analytics is allowed. Each
+ * factory returns a plain descriptor (see `core/adapter.ts`).
+ *
+ * Adding a consent manager: a factory and option schema in its own module,
+ * and a member of `consentAdapterSchema` (`schema.ts`). Then connect it to
+ * `window.blumeConsent` (see `init.ts` for the contract): report the reader's
+ * choice with `set({ analytics })` on load and on every change, and set
+ * `open` to reopen the manager's preferences. A hosted manager does that
+ * with tags in `consentHead` (`head.ts`): its loader, then a constant bridge
+ * script (`osano.ts` is an example). A manager that ships as an npm package
+ * does it in a browser module instead, registered in `clients.ts`, with its
+ * packages in the factory's `runtimeDeps` (`native()`'s banner is the
+ * example).
+ */
+export type { AdapterDescriptor, JsonValue } from "../core/adapter.ts";
+export { ethyca } from "./ethyca.ts";
+export type { EthycaAdapter, EthycaOptions } from "./ethyca.ts";
+export { native } from "./native.ts";
+export type { NativeAdapter, NativeOptions } from "./native.ts";
+export { osano } from "./osano.ts";
+export type { OsanoAdapter, OsanoOptions } from "./osano.ts";
+export type { ConsentAdapter } from "./schema.ts";