includio-cms 0.15.4 → 0.16.0

package/dist/core/server/generator/generator.js

@@ -1,4 +1,4 @@
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { generateTsTypeFromFields, generateFlatTsTypeFromFields, generateInlineBlockTypeString, setGeneratorCustomFields } from './fields.js';
 import { generateTsTypeFromFormFields } from './formFields.js';
@@ -9,6 +9,22 @@ function createCmsRuntimeDir() {
     const cmsDir = join(process.cwd(), 'src/lib/cms/runtime');
     mkdirSync(cmsDir, { recursive: true });
 }
+// Avoids touching mtime when content is unchanged — otherwise Vite's file
+// watcher triggers an SSR reload, which re-runs the generator, which rewrites
+// the same content, looping forever in dev.
+function writeIfChanged(filePath, content) {
+    if (existsSync(filePath)) {
+        try {
+            const current = readFileSync(filePath, 'utf8');
+            if (current === content)
+                return;
+        }
+        catch {
+            // fall through and write
+        }
+    }
+    writeFileSync(filePath, content);
+}
 function generateTypesStringForRecords(type, records) {
     const recordTypeString = type.charAt(0).toUpperCase() + type.slice(1);
     const singleSlugs = records.map((s) => s.slug) || [];
@@ -156,7 +172,7 @@ function generateTypes(config) {
         }
     }
     code += `\n export type SiteLanguage =  ${config.languages.map((lang) => JSON.stringify(lang)).join(' | ')};\n\n`;
-    writeFileSync(filePath, code);
+    writeIfChanged(filePath, code);
 }
 function generateAPI(config) {
     const cmsDir = join(process.cwd(), 'src/lib/cms/runtime');
@@ -232,7 +248,7 @@ function generateAPI(config) {
         : ''}
 
 	`;
-    writeFileSync(filePath, code);
+    writeIfChanged(filePath, code);
 }
 function generateSchemas(config) {
     const cmsDir = join(process.cwd(), 'src/lib/cms/runtime');
@@ -247,7 +263,7 @@ function generateSchemas(config) {
 			export const ${varName}FormSchema = ${generateZodSchemaStringFromFormFieldsAsString(form.fields)} \n
 		`;
     });
-    writeFileSync(filePath, code);
+    writeIfChanged(filePath, code);
 }
 function generateDrizzleSchema(config) {
     const cmsDir = join(process.cwd(), 'src/lib/cms/runtime');
@@ -259,7 +275,7 @@ function generateDrizzleSchema(config) {
     if (config.shop) {
         code += `export * from 'includio-cms/db-postgres/schema-shop';\n`;
     }
-    writeFileSync(filePath, code);
+    writeIfChanged(filePath, code);
 }
 function generateRemote(config) {
     if (!config.forms || config.forms.length === 0)
@@ -282,7 +298,7 @@ function generateRemote(config) {
         code += `\t}\n`;
         code += `);\n\n`;
     });
-    writeFileSync(filePath, code);
+    writeIfChanged(filePath, code);
 }
 export function generateRuntime(config) {
     // Build custom fields map from plugins for type generation

package/dist/core/server/media/operations/backgroundMaintenance.js

@@ -1,22 +1,36 @@
 import { getCMS } from '../../../cms.js';
-let running = false;
-let timer = null;
-let lastResult = null;
-let nextRunAt = null;
+// State held on globalThis so it survives Vite HMR module re-evaluation in dev;
+// without this, each re-eval would leak a new timer while the old one kept ticking.
+const STATE_KEY = Symbol.for('includio.maintenance.state');
+function getState() {
+    const g = globalThis;
+    if (!g[STATE_KEY]) {
+        g[STATE_KEY] = {
+            running: false,
+            pendingTimeout: null,
+            timer: null,
+            lastResult: null,
+            nextRunAt: null
+        };
+    }
+    return g[STATE_KEY];
+}
 export function getMaintenanceStatus() {
+    const state = getState();
     return {
-        running,
-        lastRun: lastResult?.ranAt ?? null,
-        nextRun: nextRunAt,
-        lastResult
+        running: state.running,
+        lastRun: state.lastResult?.ranAt ?? null,
+        nextRun: state.nextRunAt,
+        lastResult: state.lastResult
     };
 }
 async function runMaintenance() {
-    if (running) {
+    const state = getState();
+    if (state.running) {
         console.info('[maintenance] Skipping — previous run still active');
         return;
     }
-    running = true;
+    state.running = true;
     console.info('[maintenance] Starting background maintenance...');
     const result = {
         stylesCreated: 0,
@@ -59,8 +73,8 @@ async function runMaintenance() {
         console.warn('[maintenance] Error during background maintenance:', err);
     }
     finally {
-        running = false;
-        lastResult = result;
+        state.running = false;
+        state.lastResult = result;
         const parts = [];
         if (result.stylesCreated > 0)
             parts.push(`${result.stylesCreated} styles`);
@@ -79,27 +93,44 @@ async function runMaintenance() {
     }
 }
 export function startBackgroundMaintenance() {
+    const state = getState();
+    if (state.pendingTimeout || state.timer) {
+        console.info('[maintenance] Already scheduled, skipping');
+        return;
+    }
     const config = getCMS().mediaConfig?.maintenance;
     if (config?.autoRun === false)
         return;
     const intervalHours = config?.intervalHours ?? 6;
     const intervalMs = intervalHours * 60 * 60 * 1000;
     // First run after 30s delay
-    setTimeout(() => {
+    state.pendingTimeout = setTimeout(() => {
+        state.pendingTimeout = null;
         runMaintenance();
         // Then repeat on interval
-        nextRunAt = new Date(Date.now() + intervalMs);
-        timer = setInterval(() => {
-            nextRunAt = new Date(Date.now() + intervalMs);
+        state.nextRunAt = new Date(Date.now() + intervalMs);
+        state.timer = setInterval(() => {
+            state.nextRunAt = new Date(Date.now() + intervalMs);
             runMaintenance();
         }, intervalMs);
     }, 30_000);
     console.info(`[maintenance] Scheduled: first run in 30s, then every ${intervalHours}h`);
 }
 export function stopBackgroundMaintenance() {
-    if (timer) {
-        clearInterval(timer);
-        timer = null;
-        nextRunAt = null;
+    const state = getState();
+    if (state.pendingTimeout) {
+        clearTimeout(state.pendingTimeout);
+        state.pendingTimeout = null;
+    }
+    if (state.timer) {
+        clearInterval(state.timer);
+        state.timer = null;
     }
+    state.nextRunAt = null;
+}
+// Clean up on Vite HMR so timers don't accumulate across module re-evaluations.
+if (import.meta.hot) {
+    import.meta.hot.dispose(() => {
+        stopBackgroundMaintenance();
+    });
 }

package/dist/core/server/media/operations/findMediaReferences.d.ts

@@ -0,0 +1,16 @@
+export interface MediaReferenceBreakdown {
+    collection: string;
+    label: string;
+    count: number;
+    kind: 'collection' | 'single';
+}
+export interface MediaReferenceResult {
+    total: number;
+    byCollection: MediaReferenceBreakdown[];
+}
+/**
+ * Find how many entries (across all collections + singles) reference a given media file.
+ * Scans only the latest version per entry per language (MVP — history is not inspected).
+ * Grouping is by collection/single slug with a human-readable label.
+ */
+export declare function findMediaReferences(fileId: string): Promise<MediaReferenceResult>;

package/dist/core/server/media/operations/findMediaReferences.js

@@ -0,0 +1,60 @@
+import { getCMS } from '../../../cms.js';
+import { getFieldsFromConfig } from '../../../fields/layoutUtils.js';
+import { extractMediaIdsFromData } from '../../fields/resolveImageFields.js';
+function pickLabel(lang, localized, fallback) {
+    if (!localized)
+        return fallback ?? '';
+    return localized[lang] ?? Object.values(localized)[0] ?? fallback ?? '';
+}
+/**
+ * Find how many entries (across all collections + singles) reference a given media file.
+ * Scans only the latest version per entry per language (MVP — history is not inspected).
+ * Grouping is by collection/single slug with a human-readable label.
+ */
+export async function findMediaReferences(fileId) {
+    const cms = getCMS();
+    const lang = cms.languages[0];
+    const db = cms.databaseAdapter;
+    const breakdown = [];
+    let total = 0;
+    const scanSlug = async (slug, label, fields, kind) => {
+        const entries = await db.getEntries({ slug });
+        if (entries.length === 0)
+            return;
+        const alive = entries.filter((e) => e.archivedAt == null);
+        if (alive.length === 0)
+            return;
+        const versions = await db.getEntryVersions({
+            entryIds: alive.map((e) => e.id),
+            lang
+        });
+        // Pick the latest version per entryId.
+        const latestByEntry = new Map();
+        for (const v of versions) {
+            const prev = latestByEntry.get(v.entryId);
+            if (!prev || v.versionNumber > prev.versionNumber) {
+                latestByEntry.set(v.entryId, v);
+            }
+        }
+        let count = 0;
+        for (const v of latestByEntry.values()) {
+            const ids = extractMediaIdsFromData(v.data, fields);
+            if (ids.includes(fileId))
+                count += 1;
+        }
+        if (count > 0) {
+            breakdown.push({ collection: slug, label, count, kind });
+            total += count;
+        }
+    };
+    for (const col of Object.values(cms.collections)) {
+        const label = pickLabel(lang, col.labels?.plural, col.slug);
+        await scanSlug(col.slug, label, getFieldsFromConfig(col), 'collection');
+    }
+    for (const single of Object.values(cms.singles)) {
+        const label = pickLabel(lang, single.label, single.slug);
+        await scanSlug(single.slug, label, getFieldsFromConfig(single), 'single');
+    }
+    breakdown.sort((a, b) => b.count - a.count);
+    return { total, byCollection: breakdown };
+}

package/dist/db-postgres/index.js

@@ -1,7 +1,7 @@
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
 import * as schema from './schema/index.js';
-import { eq, and, inArray, sql, isNull, desc, asc, SQL, ilike, or, count } from 'drizzle-orm';
+import { eq, and, inArray, sql, isNull, desc, asc, SQL, ilike, or, count, gte, lte } from 'drizzle-orm';
 const SAFE_JSON_KEY = /^[a-zA-Z0-9_]+$/;
 function validateJsonPathKeys(path) {
     for (const key of path) {
@@ -527,6 +527,51 @@ export function pg(config) {
         createConsentLog: async (data) => {
             await db.insert(schema.consentLogsTable).values(data);
         },
+        getConsentLogs: async (filters) => {
+            const conditions = [];
+            if (filters.startDate) {
+                conditions.push(gte(schema.consentLogsTable.timestamp, filters.startDate));
+            }
+            if (filters.endDate) {
+                conditions.push(lte(schema.consentLogsTable.timestamp, filters.endDate));
+            }
+            if (filters.country) {
+                conditions.push(eq(schema.consentLogsTable.countryCode, filters.country.toUpperCase()));
+            }
+            const rows = await db
+                .select()
+                .from(schema.consentLogsTable)
+                .where(conditions.length ? and(...conditions) : undefined)
+                .orderBy(desc(schema.consentLogsTable.timestamp))
+                .limit(filters.limit ?? 50)
+                .offset(filters.offset ?? 0);
+            return rows;
+        },
+        countConsentLogs: async (filters) => {
+            const conditions = [];
+            if (filters.startDate) {
+                conditions.push(gte(schema.consentLogsTable.timestamp, filters.startDate));
+            }
+            if (filters.endDate) {
+                conditions.push(lte(schema.consentLogsTable.timestamp, filters.endDate));
+            }
+            if (filters.country) {
+                conditions.push(eq(schema.consentLogsTable.countryCode, filters.country.toUpperCase()));
+            }
+            const [row] = await db
+                .select({ value: count() })
+                .from(schema.consentLogsTable)
+                .where(conditions.length ? and(...conditions) : undefined);
+            return row?.value ?? 0;
+        },
+        getConsentLog: async (id) => {
+            const [row] = await db
+                .select()
+                .from(schema.consentLogsTable)
+                .where(eq(schema.consentLogsTable.id, id))
+                .limit(1);
+            return row ?? null;
+        },
         // --- Media Tags ---
         getMediaTags: async () => {
             return db.select().from(schema.mediaTagsTable).orderBy(schema.mediaTagsTable.name);

package/dist/db-postgres/schema/consentLog.d.ts

@@ -189,6 +189,23 @@ export declare const consentLogsTable: import("drizzle-orm/pg-core/table", { wit
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        parentLogId: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "parent_log_id";
+            tableName: "consent_logs";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;

package/dist/db-postgres/schema/consentLog.js

@@ -10,5 +10,8 @@ export const consentLogsTable = pgTable('consent_logs', {
     consents: jsonb('consents').notNull(),
     consentModeStatus: jsonb('consent_mode_status').notNull(),
     cmpVersion: text('cmp_version').notNull(),
-    policyVersion: text('policy_version').notNull()
+    policyVersion: text('policy_version').notNull(),
+    parentLogId: uuid('parent_log_id').references(() => consentLogsTable.id, {
+        onDelete: 'set null'
+    })
 });

package/dist/paraglide/messages/_index.d.ts

@@ -1,3 +1,36 @@
-export * from "./hello_world.js";
-export * from "./login_hello.js";
-export * from "./login_please_login.js";
+export function hello_world(inputs: {
+    name: NonNullable<unknown>;
+}, options?: {
+    locale?: "en" | "pl";
+}): string;
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+*
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+declare function login_hello(inputs?: {}, options?: {
+    locale?: "en" | "pl";
+}): string;
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+*
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+declare function login_please_login(inputs?: {}, options?: {
+    locale?: "en" | "pl";
+}): string;
+export { login_hello as login.hello, login_please_login as login.please_login };

package/dist/paraglide/messages/_index.js

@@ -1,4 +1,72 @@
 /* eslint-disable */
-export * from './hello_world.js'
-export * from './login_hello.js'
-export * from './login_please_login.js'
+import { getLocale, trackMessageCall, experimentalMiddlewareLocaleSplitting, isServer } from "../runtime.js"
+import * as en from "./en.js"
+import * as pl from "./pl.js"
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{ name: NonNullable<unknown> }} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+export const hello_world = (inputs, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.hello_world(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("hello_world", locale)
+	if (locale === "en") return en.hello_world(inputs)
+	return pl.hello_world(inputs)
+};
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+const login_hello = (inputs = {}, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.login_hello(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("login_hello", locale)
+	if (locale === "en") return en.login_hello(inputs)
+	return pl.login_hello(inputs)
+};
+export { login_hello as "login.hello" }
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+const login_please_login = (inputs = {}, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.login_please_login(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("login_please_login", locale)
+	if (locale === "en") return en.login_please_login(inputs)
+	return pl.login_please_login(inputs)
+};
+export { login_please_login as "login.please_login" }

package/dist/paraglide/messages/en.d.ts

@@ -0,0 +1,5 @@
+export const hello_world: (inputs: {
+    name: NonNullable<unknown>;
+}) => string;
+export const login_hello: (inputs: {}) => string;
+export const login_please_login: (inputs: {}) => string;

package/dist/paraglide/messages/en.js

@@ -0,0 +1,14 @@
+/* eslint-disable */
+
+
+export const hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
+	return `Hello, ${i.name} from en!`
+};
+
+export const login_hello = /** @type {(inputs: {}) => string} */ () => {
+	return `Welcome back`
+};
+
+export const login_please_login = /** @type {(inputs: {}) => string} */ () => {
+	return `Login to your account`
+};

package/dist/paraglide/messages/pl.d.ts

@@ -0,0 +1,5 @@
+export const hello_world: (inputs: {
+    name: NonNullable<unknown>;
+}) => string;
+export const login_hello: (inputs: {}) => string;
+export const login_please_login: (inputs: {}) => string;

package/dist/paraglide/messages/pl.js

@@ -0,0 +1,14 @@
+/* eslint-disable */
+
+
+export const hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
+	return `Hello, ${i.name} from pl!`
+};
+
+export const login_hello = /** @type {(inputs: {}) => string} */ () => {
+	return `Witaj ponownie`
+};
+
+export const login_please_login = /** @type {(inputs: {}) => string} */ () => {
+	return `Zaloguj się na swoje konto`
+};

package/dist/sveltekit/server/handle.js

@@ -80,7 +80,7 @@ export function includioCMS(cmsConfig) {
 const securityHeaders = async ({ event, resolve }) => {
     const response = await resolve(event);
     response.headers.set('X-Content-Type-Options', 'nosniff');
-    response.headers.set('X-Frame-Options', 'DENY');
+    response.headers.set('X-Frame-Options', 'SAMEORIGIN');
     response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
     return response;
 };

package/dist/types/adapters/db.d.ts

@@ -1,4 +1,4 @@
-import type { ConsentLogData } from '../consent.js';
+import type { ConsentLogData, ConsentLogRecord, GetConsentLogsFilters } from '../consent.js';
 import type { DbEntry, DbEntryInsert, DbEntryVersion, DbEntryVersionInsert, GetDbEntriesOptions, GetDbEntryVersionsOptions, GetPaginatedEntriesOptions, PaginatedEntryRow, PaginationOptions } from '../entries.js';
 import type { ImageFieldStyle } from '../fields.js';
 import type { FormSubmission } from '../forms.js';
@@ -23,6 +23,9 @@ export interface DatabaseAdapter {
     getPaginatedEntries?: GetPaginatedEntries;
     countPaginatedEntries?: CountPaginatedEntries;
     createConsentLog: CreateConsentLog;
+    getConsentLogs?: GetConsentLogs;
+    countConsentLogs?: CountConsentLogs;
+    getConsentLog?: GetConsentLog;
     getMediaTags: GetMediaTags;
     createMediaTag: CreateMediaTag;
     updateMediaTag: UpdateMediaTag;
@@ -86,6 +89,9 @@ export type GetFormSubmission = (id: string) => Promise<FormSubmission | null>;
 export type UpdateFormSubmission = (id: string, data: Partial<FormSubmission>) => Promise<FormSubmission>;
 export type DeleteFormSubmission = (id: string) => Promise<void>;
 export type CreateConsentLog = (data: ConsentLogData) => Promise<void>;
+export type GetConsentLogs = (filters: GetConsentLogsFilters) => Promise<ConsentLogRecord[]>;
+export type CountConsentLogs = (filters: Omit<GetConsentLogsFilters, 'limit' | 'offset'>) => Promise<number>;
+export type GetConsentLog = (id: string) => Promise<ConsentLogRecord | null>;
 export interface GetMediaFilesOptions {
     data: {
         tagIds?: string[];

package/dist/types/cms.d.ts

@@ -8,6 +8,7 @@ import type { FormConfig } from './forms.js';
 import type { AIAdapter } from './adapters/ai.js';
 import type { EmailAdapter } from './adapters/email.js';
 import type { ResolvedShopConfig } from '../shop/types.js';
+import type { ResolvedCmpConfig } from '../cmp/types.js';
 export interface VideoTranscodeConfig {
     /** Enable/disable auto-transcoding on upload (default: true) */
     transcode?: boolean;
@@ -79,6 +80,7 @@ export interface CMSConfig {
     typography?: TypographyConfig;
     sidebarHelp?: boolean;
     shop?: ResolvedShopConfig;
+    cmp?: ResolvedCmpConfig;
 }
 export interface ICMS {
     collections: Record<string, CollectionConfigWithType>;
@@ -96,4 +98,5 @@ export interface ICMS {
     apiKeys: ApiKeyConfig[];
     typographyConfig: TypographyConfig;
     shopConfig: ResolvedShopConfig | null;
+    cmpConfig: ResolvedCmpConfig | null;
 }

package/dist/types/consent.d.ts

@@ -19,4 +19,15 @@ export interface ConsentLogData {
     };
     cmpVersion: string;
     policyVersion: string;
+    parentLogId?: string | null;
+}
+export interface ConsentLogRecord extends ConsentLogData {
+    timestamp: Date;
+}
+export interface GetConsentLogsFilters {
+    startDate?: Date;
+    endDate?: Date;
+    country?: string;
+    limit?: number;
+    offset?: number;
 }

package/dist/updates/0.15.5/index.d.ts

@@ -0,0 +1,2 @@
+import type { CmsUpdate } from '../index.js';
+export declare const update: CmsUpdate;

package/dist/updates/0.15.5/index.js

@@ -0,0 +1,15 @@
+export const update = {
+    version: '0.15.5',
+    date: '2026-04-23',
+    description: 'Media field recovers from orphan references; delete dialog shows usage breakdown + replace hint. X-Frame-Options relaxed to SAMEORIGIN. Background maintenance no longer duplicates on Vite HMR. Runtime generator no longer triggers an infinite SSR reload loop in dev.',
+    features: [
+        'Admin media library: delete dialog (`FileDetails`) teraz pokazuje breakdown użyć pliku per kolekcja/single ("Plik jest używany w: Strony: 1") oraz hint wskazujący na funkcję **Zamień plik** (która zachowuje ID → wszystkie referencje). Dane ładowane asynchronicznie przez nowy remote query `findMediaReferences(id)` uruchamiany w momencie otwarcia dialogu. Scope (MVP): tylko najnowsza wersja per entry; historia poza zakresem. Walker po schematach (`media`, `file`, `seo.ogImage`, `object`, `blocks`, `content` z inline blocks) wyekstrahowany z `resolveImageFields.ts` jako reużywalne `extractMediaIdsFromData(data, fields)`.'
+    ],
+    fixes: [
+        '`media-field.svelte` nie blokuje już edycji entry gdy pole media wskazuje na usunięty plik (orphan reference). Wcześniej render wchodził w `{:else if singleFile}` z `singleFile=null` po nieudanym `getFileById`, co wyrzucało UI do pustego diva bez przycisków Zmień/Usuń — user zablokowany, nie mógł wstawić nowego obrazu. Nowa gałąź `{:else}` renderuje dashed warning placeholder ("Brakujący plik" / "Missing file") z zachowanymi kontrolkami. Analogicznie dla multi-media: per-item fallback pozwala usunąć pojedynczy orphan z tablicy bez czyszczenia pozostałych.',
+        '`X-Frame-Options` zmieniony z `DENY` na `SAMEORIGIN` w middleware `securityHeaders`. Wcześniej `DENY` blokował nawet same-origin framing, przez co admin CMS nie mógł załadować preview entry w iframe (`previewUrl` w konfiguracji kolekcji/single). Safari egzekwuje to rygorystycznie ("Refused to display ... in a frame because it set X-Frame-Options to DENY"). `SAMEORIGIN` dalej chroni przed clickjackingiem z obcych domen.',
+        '`startBackgroundMaintenance()` jest teraz idempotentne. Wcześniej każde wywołanie tworzyło nowy `setTimeout`/`setInterval` bez czyszczenia poprzedniego — w `pnpm dev` Vite HMR re-executuje `hooks.server.ts` (i tym samym `initCMS()`) przy każdej zmianie, więc po kilku edycjach działało N równoległych przebiegów maintenance. Stan timerów (`pendingTimeout`, `timer`, `running`, `lastResult`, `nextRunAt`) przeniesiony na `globalThis[Symbol.for("includio.maintenance.state")]`, żeby przeżył re-eval modułu w dev. Dodany guard: gdy timer już zaplanowany, kolejne `start()` loguje `already scheduled, skipping` i wychodzi. `stopBackgroundMaintenance()` teraz czyści również initial 30s `setTimeout`, nie tylko interval. Dodany `import.meta.hot.dispose()` czyszczący timery gdy Vite unlinkuje moduł.',
+        '`generateRuntime()` (`generator.ts`) nie zapisuje już plików gdy treść się nie zmieniła. Wcześniej każdy wywołanie `includioCMS()` (a więc każdy SSR reload Vite) bezwarunkowo `writeFileSync` na 5 plikach w `src/lib/cms/runtime/` (`api.ts`, `types.ts`, `schemas.ts`, `schema.ts`, `remote.ts`) — co aktualizowało mtime, Vite wykrywał zmianę, robił `(ssr) page reload`, znów wołał `includioCMS()` → znów zapis → nieskończona pętla reload w `pnpm dev`, blokująca pracę. Nowy helper `writeIfChanged(filePath, content)` najpierw czyta plik i zapisuje wyłącznie gdy treść się różni.'
+    ],
+    breakingChanges: []
+};

package/dist/updates/0.16.0/index.d.ts

@@ -0,0 +1,2 @@
+import type { CmsUpdate } from '../index.js';
+export declare const update: CmsUpdate;

package/dist/updates/0.16.0/index.js

@@ -0,0 +1,14 @@
+export const update = {
+    version: '0.16.0',
+    date: '2026-04-29',
+    description: 'Hard reset martwego kodu — start drogi do v1.0.0. Wycięte: prototyp inline-edit, demo seed, demo routes. Zostają: cmp/ (backend działa), mockups/ (designy), isomorphic-dompurify (Faza 5), tippy.js (slash-command).',
+    features: [],
+    fixes: [],
+    breakingChanges: [
+        '`src/lib/inline-edit-proto/` — usunięty. Prototyp hybrid editor (`HybridEditor`, `EditableInline`, `EditablePanel`, `BlockWrapper`, `ModeToggle` itd.) skasowany w całości. Inline edit zostanie zaprojektowany od zera w v1.x z innym podejściem. Pełen kod zarchiwizowany lokalnie na branchu `archive/inline-edit-proto` (niepublikowany na origin). Projekty importujące cokolwiek z `$lib/inline-edit-proto/*` lub `includio-cms/inline-edit-proto` muszą wyciąć te wywołania — moduł nigdy nie był publikowany w `package.json` exports, więc realnie żadna external integracja się nie zerwie.',
+        '`src/lib/demo/seed.ts` — usunięte. Funkcja `seedDemoData()` (wpisywanie demo użytkownika `demo@includio.dev`) skasowana. Demo content zostanie zaprojektowany od zera w v1.x.',
+        '`src/routes/(site)/demo/` i `src/routes/admin/(afterLogin)/demo/` — usunięte. Demo pages (`/demo`, `/demo/inline-edit-test`, `/admin/demo/hybrid-editor`) skasowane razem z modułami. Live preview demo trzeba odbudować od zera.',
+        '`ROADMAP-EDITOR.md` — usunięty. Plan unified editora (Faza 0.2.0–0.5.0) zarchiwizowany razem z prototypem na branchu `archive/inline-edit-proto`.'
+    ],
+    notes: 'Brak SQL migration. Brak zmian publicznego API w `package.json` exports — `inline-edit-proto`, `demo`, ani `cmp` nigdy nie były tam wymienione, więc `pnpm i` w projekcie konsumującym przejdzie clean. `cmp/` ZOSTAJE: backend CMP (operations, `consent_logs` schema, public `createConsentLog`) i typy publiczne (`ResolvedCmpConfig`, `CmpStrings` w `CMSConfig.cmp`) działają bez zmian. Frontend banner dla CMP wróci jako feature w v1.x. Backlog `ideas/*.md` przeniesiony do `ideas/post-v1/` (lokalnie, katalog w `.gitignore`); `select-field-defaultvalue-bug.md` promowany do ROADMAP jako fix do v1.0. Bundle delta: `dist/` 8.8M → 8.5M (−0.3 MB) — mniej niż meta-plan szacował (−1.5 MB+), bo `inline-edit-proto/` był w `.gitignore` i nigdy nie trafiał do `dist/`. Realny zysk to czystsza struktura repo + zero martwego kodu w gałęzi roboczej.'
+};

package/dist/updates/index.js

@@ -49,7 +49,9 @@ import { update as update0151 } from './0.15.1/index.js';
 import { update as update0152 } from './0.15.2/index.js';
 import { update as update0153 } from './0.15.3/index.js';
 import { update as update0154 } from './0.15.4/index.js';
-export const updates = [update0065, update0066, update0067, update0068, update0069, update010, update011, update012, update013, update014, update015, update020, update022, update050, update051, update052, update053, update054, update055, update056, update057, update058, update060, update061, update062, update070, update071, update072, update073, update080, update090, update0100, update0110, update0120, update0130, update0131, update0132, update0133, update0134, update0140, update0141, update0142, update0143, update0144, update0145, update0146, update0150, update0151, update0152, update0153, update0154];
+import { update as update0155 } from './0.15.5/index.js';
+import { update as update0160 } from './0.16.0/index.js';
+export const updates = [update0065, update0066, update0067, update0068, update0069, update010, update011, update012, update013, update014, update015, update020, update022, update050, update051, update052, update053, update054, update055, update056, update057, update058, update060, update061, update062, update070, update071, update072, update073, update080, update090, update0100, update0110, update0120, update0130, update0131, update0132, update0133, update0134, update0140, update0141, update0142, update0143, update0144, update0145, update0146, update0150, update0151, update0152, update0153, update0154, update0155, update0160];
 export const getUpdatesFrom = (fromVersion) => {
     const fromParts = fromVersion.split('.').map(Number);
     return updates.filter((update) => {