mechanica 2.1.0-beta.7 → 2.1.0

package/README.md

@@ -359,10 +359,11 @@ These drive a locally installed Chrome or Edge (or `--browser <path>`) and need
 | `mechanica shot <blockId \| /path>` | Screenshot a block or a page. Flags: `--width`, `--data`, `--out`, `--full`, `--server`, `--browser` |
 | `mechanica thumbs [--blocks]` | Regenerate page or block thumbnails for the editor |
 | `mechanica images` | Generate image dimensions and blur-up previews for `.mech/assets` (needs `sharp`; `--force` redoes all) |
-| `mechanica login` | Sign in to the Mechanica platform and save an access token for this machine (`--host`, `--token`) |
+| `mechanica login` | Sign in to the Mechanica platform: it prints a link to open and approve in the browser (signing in or registering on the way) and keeps the access token for this machine. In a terminal it waits for the approval; run from a coding agent, it prints the link and returns, and the next `link` or `push` finishes the sign-in (`--wait`, `--no-wait`, `--host`, or `--token` to store a token made in the dashboard) |
 | `mechanica link <slug>` | Point this repository at a site on the platform (`--create` makes the site); uploads are then kept by the platform, so `.mech/assets/` goes into `.gitignore` |
 | `mechanica push` | Publish the committed project to the platform: pull what was edited online, send the uploads it lacks, `git push`, build and upload the bundle when the code changed, wait for the deploy. It pushes the branch that is checked out, under its own name: the first branch a site is pushed is the site itself, any other is deployed to an address of its own (`<slug>--<branch>`) with its own online editor — a branch name is lowercase letters, digits and single hyphens |
 | `mechanica assets pull` | Download the uploads made in the platform's online editor that this project lacks (the dev server fetches them one by one on demand) |
+| `mechanica migrate` | Bring `.mech` content written by an older version up to the current format: uploads are addressed as `/media/<file>` (2.0 wrote `/@mechanica/assets/<file>`) |
 
 ## Plugin options
 
@@ -393,6 +394,12 @@ From `mechanica`:
 
 From `mechanica/plugin`: `mechanica` and the `PageProvider` type. From `mechanica/widgets`: `defineWidget` and `useWidgetServices` (uploads and the image picker inside widget editors). `mechanica/editor` and `mechanica/composer` are loaded by the plugin in development; you don't import them. From `mechanica/export`: `exportBuilt(projectDir, options)`, which statically renders an already built project (`dist/` + `.mech/`) without running a build and resolves to `{ pages, warnings }` — for render services that receive a prebuilt bundle; `options.outDir` sets where the site is written, and `options.fetchJson` replaces how `useFetch` requests are made.
 
+## Upgrading from 2.0
+
+- Uploaded files are addressed as `/media/<file>` in page files, shared data and rich text; 2.0 wrote `/@mechanica/assets/<file>`. The old address still works everywhere, so nothing breaks — run `npx mechanica migrate` once to rewrite it, and don't serve anything of your own under `/media/`.
+- A file uploaded through the editor now gets a short content hash in its name (`photo-9f2c1a7b.jpg`). Files already in `.mech/assets/` keep their names.
+- In the page browser, "Mark as draft" / "Publish" became "Hide from site" / "Show on site". `draft: true` in the page file means the same as before.
+
 ## Upgrading from 1.x
 
 Mechanica 2 is a rewrite, and a 1.x project has to be ported by hand; there is no automatic migration. What changes:

package/dist/chunks/{assets-nujjbCx8.js → assets-5a2WdmFg.js}

@@ -1,44 +1,8 @@
-import { G as isAssetName, J as readImageManifest, X as updateImageManifest } from "./rich-text-codec-BSD35k2U.js";
+import { G as isAssetName, J as readImageManifest, X as updateImageManifest } from "./rich-text-codec-DCv1X0eZ.js";
 import { join } from "node:path";
-import { chmod, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import { spawn } from "node:child_process";
-/** Normalize a host argument to an origin (`https://example.com`, no trailing slash or path). */
-function hostOrigin(host) {
-	const value = host ?? process.env.MECHANICA_HOST ?? "https://mechanica.jt3.ru";
-	return new URL(/^https?:\/\//.test(value) ? value : `https://${value}`).origin;
-}
-/** Where access tokens are kept: one file per user, outside any project. */
-function credentialsFile() {
-	return join(process.env.MECHANICA_CONFIG_DIR ?? join(os.homedir(), ".mechanica"), "credentials.json");
-}
-async function readAll() {
-	try {
-		const parsed = JSON.parse(await readFile(credentialsFile(), "utf-8"));
-		return parsed && typeof parsed === "object" ? parsed : {};
-	} catch {
-		return {};
-	}
-}
-/**
-* The access token for a platform origin: `MECHANICA_TOKEN` (CI) wins over the
-* one `mechanica login` saved.
-*/
-async function getToken(origin) {
-	if (process.env.MECHANICA_TOKEN) return process.env.MECHANICA_TOKEN;
-	return (await readAll())[origin] ?? null;
-}
-/** Remember the token for an origin, in a file only the user can read. */
-async function saveToken(origin, token) {
-	const file = credentialsFile();
-	const all = await readAll();
-	all[origin] = token;
-	await mkdir(join(file, ".."), { recursive: true });
-	await writeFile(file, JSON.stringify(all, null, 2) + "\n", { mode: 384 });
-	await chmod(file, 384).catch(() => {});
-	return file;
-}
-//#endregion
 //#region src/cli/platform/api.ts
 /** A failed platform request: the HTTP status plus the message the platform gave. */
 var PlatformError = class extends Error {
@@ -80,12 +44,6 @@ async function request(origin, method, path, options = {}) {
 	if (!response.ok) throw new PlatformError(response.status, errorMessage(response.status, text));
 	return text ? JSON.parse(text) : null;
 }
-/** The saved token for `origin`, or an error telling the user to log in. */
-async function requireToken(origin) {
-	const token = await getToken(origin);
-	if (!token) throw new Error(`Not logged in to ${origin} — run \`mechanica login\` first`);
-	return token;
-}
 /** The name of the git remote `mechanica link` manages. */
 var REMOTE_NAME = "mechanica";
 /**
@@ -105,6 +63,70 @@ function parseRemoteUrl(url) {
 		return null;
 	}
 }
+/** Normalize a host argument to an origin (`https://example.com`, no trailing slash or path). */
+function hostOrigin(host) {
+	const value = host ?? process.env.MECHANICA_HOST ?? "https://mechanica.jt3.ru";
+	return new URL(/^https?:\/\//.test(value) ? value : `https://${value}`).origin;
+}
+/** Where the CLI keeps what it knows about the user: one folder per user, outside any project. */
+function configDir() {
+	return process.env.MECHANICA_CONFIG_DIR ?? join(os.homedir(), ".mechanica");
+}
+/** Access tokens, by platform origin. */
+var credentialsFile = () => join(configDir(), "credentials.json");
+/** Sign-ins started by `mechanica login` that wait for their approval, by platform origin. */
+var pendingFile = () => join(configDir(), "pending-logins.json");
+async function readJson(file) {
+	try {
+		const parsed = JSON.parse(await readFile(file, "utf-8"));
+		return parsed && typeof parsed === "object" ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+/** Write one of the files, readable by the user alone. */
+async function writeJson(file, value) {
+	await mkdir(join(file, ".."), { recursive: true });
+	await writeFile(file, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+	await chmod(file, 384).catch(() => {});
+}
+/**
+* The access token for a platform origin: `MECHANICA_TOKEN` (CI) wins over the
+* one `mechanica login` saved.
+*/
+async function getToken(origin) {
+	if (process.env.MECHANICA_TOKEN) return process.env.MECHANICA_TOKEN;
+	return (await readJson(credentialsFile()))[origin] ?? null;
+}
+/** Remember the token for an origin, in a file only the user can read. */
+async function saveToken(origin, token) {
+	const file = credentialsFile();
+	const all = await readJson(file);
+	all[origin] = token;
+	await writeJson(file, all);
+	return file;
+}
+/** The sign-in waiting for an origin, or null. An expired one is reported too: whoever reads it says so. */
+async function getPendingLogin(origin) {
+	const entry = (await readJson(pendingFile()))[origin];
+	return entry && typeof entry.deviceCode === "string" && typeof entry.verificationUrl === "string" ? entry : null;
+}
+/** Keep a started sign-in for an origin (replacing an earlier one). */
+async function savePendingLogin(origin, login) {
+	const file = pendingFile();
+	const all = await readJson(file);
+	all[origin] = login;
+	await writeJson(file, all);
+}
+/** Forget the sign-in waiting for an origin — it was finished, denied or has expired. */
+async function clearPendingLogin(origin) {
+	const file = pendingFile();
+	const all = await readJson(file);
+	if (!(origin in all)) return;
+	delete all[origin];
+	if (Object.keys(all).length) await writeJson(file, all);
+	else await rm(file, { force: true });
+}
 //#endregion
 //#region src/cli/platform/git.ts
 /**
@@ -319,4 +341,4 @@ async function runAssetsPull(options = {}) {
 	return done;
 }
 //#endregion
-export { git as a, PlatformError as c, request as d, requireToken as f, uploadsIgnored as i, REMOTE_NAME as l, saveToken as m, remoteAssetsFor as n, gitAuthEnv as o, hostOrigin as p, runAssetsPull as r, gitOk as s, pushUploads as t, parseRemoteUrl as u };
+export { request as _, git as a, clearPendingLogin as c, hostOrigin as d, savePendingLogin as f, parseRemoteUrl as g, REMOTE_NAME as h, uploadsIgnored as i, getPendingLogin as l, PlatformError as m, remoteAssetsFor as n, gitAuthEnv as o, saveToken as p, runAssetsPull as r, gitOk as s, pushUploads as t, getToken as u };

package/dist/chunks/{node-adapter-CSkDXYGO.js → node-adapter-Bm_SloHQ.js}

@@ -1,5 +1,5 @@
-import { n as configureSite, r as indexGeneratedPages } from "./site-DfazSr3_.js";
-import { A as pageVersion, C as harvestPageImages, D as movePage, E as listPages, I as setPageDraft, L as translationsOf, M as renamePage, N as savePage, Q as uploadResponse, R as contentFilesOf, T as listFolders, U as contentTypeOf, W as fsAssetStore, Y as storeUpload, _ as deletePage, a as folderOf, b as fillContentDefaults, c as mergeLocaleSiteData, f as readSiteData, g as createTranslation, h as createPage, j as readPage, l as mergeSiteData, m as PageExistsError, o as mergeFolderData, q as listUploads, s as mergeLocaleFolderData, u as readFolderData, v as deleteTranslation, w as imageNamesOf, x as fillImageMeta, y as duplicatePage } from "./rich-text-codec-BSD35k2U.js";
+import { n as configureSite, r as indexGeneratedPages } from "./site-BVqx8iKj.js";
+import { A as pageVersion, C as harvestPageImages, D as movePage, E as listPages, I as setPageDraft, L as translationsOf, M as renamePage, N as savePage, Q as uploadResponse, R as contentFilesOf, T as listFolders, U as contentTypeOf, W as fsAssetStore, Y as storeUpload, _ as deletePage, a as folderOf, b as fillContentDefaults, c as mergeLocaleSiteData, f as readSiteData, g as createTranslation, h as createPage, j as readPage, l as mergeSiteData, m as PageExistsError, o as mergeFolderData, q as listUploads, s as mergeLocaleFolderData, u as readFolderData, v as deleteTranslation, w as imageNamesOf, x as fillImageMeta, y as duplicatePage } from "./rich-text-codec-DCv1X0eZ.js";
 import fs, { readFileSync, readdirSync } from "node:fs";
 import { basename, join, resolve, sep } from "node:path";
 import { EDITOR_DIST_DIR, mergeTranslation, parseLocalePath, passDataToHTML, resolveQueryKey, serializeState } from "mechanica-shared";

package/dist/chunks/{rich-text-codec-BSD35k2U.js → rich-text-codec-DCv1X0eZ.js}

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import { dirname, join, parse, relative, resolve, sep } from "node:path";
 import { UPLOADS_PREFIX as UPLOADS_PREFIX$1, diffTranslation, migrateContent, passDefaultValue, uploadNameOf, walkSchema, walkTree } from "mechanica-shared";
 import { createHash } from "node:crypto";
-import { parsePage, serializePage } from "mechanica-shared/page-format";
+import { PageParseError, parsePage, serializePage } from "mechanica-shared/page-format";
 import { Readable } from "node:stream";
 import { createRequire } from "node:module";
 import { unfoldSchema } from "compact-json-schema";
@@ -671,7 +671,13 @@ var emptyPage = () => ({
 var fileOf = (mech, urlPath, locale) => pageFile(contentFilesOf(mech), urlPath, locale);
 var has = (mech, file) => contentFilesOf(mech).has(file);
 var remove = (mech, file) => contentFilesOf(mech).remove(file);
-var readFile = (mech, file) => parsePage(contentFilesOf(mech).read(file) ?? "", codecOptions(mech));
+var readFile = (mech, file) => {
+	try {
+		return parsePage(contentFilesOf(mech).read(file) ?? "", codecOptions(mech));
+	} catch (error) {
+		throw error instanceof PageParseError ? error.inFile(file) : error;
+	}
+};
 var writeFile = (mech, file, page) => {
 	contentFilesOf(mech).write(file, serializePage(page, codecOptions(mech)));
 };

package/dist/chunks/{site-DfazSr3_.js → site-BVqx8iKj.js}

@@ -1,4 +1,4 @@
-import { F as setPageCodec, P as setPageBlocks, i as toBlockMeta, n as richTextCodecFromBlocks, r as composedBlockMeta } from "./rich-text-codec-BSD35k2U.js";
+import { F as setPageCodec, P as setPageBlocks, i as toBlockMeta, n as richTextCodecFromBlocks, r as composedBlockMeta } from "./rich-text-codec-DCv1X0eZ.js";
 import fs from "node:fs";
 import { join } from "node:path";
 import { SITE_MANIFEST_FILE, areFieldSchemasRegistered, localePath, registerFieldSchemas } from "mechanica-shared";

package/dist/cli.js

@@ -1,6 +1,6 @@
-import { t as buildSiteManifest } from "./chunks/site-DfazSr3_.js";
-import { J as readImageManifest, K as isDerivedAsset, W as fsAssetStore, X as updateImageManifest, et as withRemoteAssets, it as isRasterImage, nt as analyzeImageBuffer, rt as hasSharp } from "./chunks/rich-text-codec-BSD35k2U.js";
-import { a as git, c as PlatformError, d as request, f as requireToken, i as uploadsIgnored, l as REMOTE_NAME, m as saveToken, n as remoteAssetsFor, o as gitAuthEnv, p as hostOrigin, r as runAssetsPull, s as gitOk, t as pushUploads, u as parseRemoteUrl } from "./chunks/assets-nujjbCx8.js";
+import { t as buildSiteManifest } from "./chunks/site-BVqx8iKj.js";
+import { J as readImageManifest, K as isDerivedAsset, W as fsAssetStore, X as updateImageManifest, et as withRemoteAssets, it as isRasterImage, nt as analyzeImageBuffer, rt as hasSharp } from "./chunks/rich-text-codec-DCv1X0eZ.js";
+import { _ as request, a as git, c as clearPendingLogin, d as hostOrigin, f as savePendingLogin, g as parseRemoteUrl, h as REMOTE_NAME, i as uploadsIgnored, l as getPendingLogin, m as PlatformError, n as remoteAssetsFor, o as gitAuthEnv, p as saveToken, r as runAssetsPull, s as gitOk, t as pushUploads, u as getToken } from "./chunks/assets-5a2WdmFg.js";
 import { exportBuilt } from "./export.js";
 import fs, { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -10,7 +10,6 @@ import os from "node:os";
 import { spawn } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { build } from "vite";
-import readline from "node:readline";
 //#region src/cli/args.ts
 /** Parse `argv` (without node/script) into a command, positionals and a `--flag[=value]` map. */
 function parseArgs(argv) {
@@ -234,6 +233,89 @@ async function runMigrate(options = {}) {
 	return changed;
 }
 //#endregion
+//#region src/cli/platform/session.ts
+/** Start a sign-in: the platform makes a request, its codes are kept for this origin. */
+async function startDeviceLogin(origin) {
+	const started = await request(origin, "POST", "/api/account/device", { body: { name: `CLI on ${os.hostname()}` } });
+	const pending = {
+		deviceCode: started.deviceCode,
+		userCode: started.userCode,
+		verificationUrl: started.verificationUrl,
+		expiresAt: new Date(started.expiresAt).toISOString(),
+		interval: Math.max(1, Number(started.interval) || 3)
+	};
+	await savePendingLogin(origin, pending);
+	return pending;
+}
+/** What the user is shown: the link, and how long it stays open. */
+function describeDeviceLogin(origin, pending) {
+	const minutes = Math.max(1, Math.round((Date.parse(pending.expiresAt) - Date.now()) / 6e4));
+	return [
+		`To sign in to ${origin}, open this link and approve the request:`,
+		"",
+		`  ${pending.verificationUrl}`,
+		"",
+		`The link is valid for ${minutes} minute${minutes === 1 ? "" : "s"}.`
+	].join("\n");
+}
+/** Ask the platform once whether the request was answered. */
+async function checkDeviceLogin(origin, pending) {
+	try {
+		const answer = await request(origin, "POST", "/api/account/device/token", { body: { deviceCode: pending.deviceCode } });
+		if (answer?.status === "approved" && typeof answer.token === "string") return {
+			status: "approved",
+			token: answer.token
+		};
+		if (answer?.status === "denied") return { status: "denied" };
+		return { status: "pending" };
+	} catch (error) {
+		if (error instanceof PlatformError && error.status === 404) return { status: "expired" };
+		throw error;
+	}
+}
+/**
+* Finish a started sign-in if it was answered: save the token and say who
+* signed in. Null while the request still waits. A denied or expired request
+* is forgotten and reported — the user runs `mechanica login` for a new link.
+*/
+async function completeDeviceLogin(origin, pending) {
+	const outcome = await checkDeviceLogin(origin, pending);
+	if (outcome.status === "pending") return null;
+	await clearPendingLogin(origin);
+	if (outcome.status === "denied") throw new Error(`The sign-in request for ${origin} was denied in the browser. Run \`mechanica login\` for a new link.`);
+	if (outcome.status === "expired") throw new Error(`The sign-in link for ${origin} has expired (a link is valid for ten minutes). Run \`mechanica login\` for a new link.`);
+	const account = await request(origin, "GET", "/api/account", { token: outcome.token });
+	const file = await saveToken(origin, outcome.token);
+	console.info(`Signed in to ${origin} as ${account.email}`);
+	console.info(`Access token saved to ${file}`);
+	return outcome.token;
+}
+var sleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Wait for the approval, asking the platform every `interval` seconds until it comes or the link expires. */
+async function waitForDeviceLogin(origin, pending) {
+	for (;;) {
+		const token = await completeDeviceLogin(origin, pending);
+		if (token) return token;
+		await sleep$1(pending.interval * 1e3);
+	}
+}
+/**
+* The token for `origin`: the saved one, or — when `mechanica login` printed
+* a link that has been approved since — the one the platform now hands over.
+* Otherwise an error that says what to do next.
+*/
+async function requireToken(origin) {
+	const token = await getToken(origin);
+	if (token) return token;
+	const pending = await getPendingLogin(origin);
+	if (pending) {
+		const collected = await completeDeviceLogin(origin, pending);
+		if (collected) return collected;
+		throw new Error(`Not signed in to ${origin} yet — open ${pending.verificationUrl} and approve the request, then run this command again`);
+	}
+	throw new Error(`Not logged in to ${origin} — run \`mechanica login\` first`);
+}
+//#endregion
 //#region src/cli/platform/link.ts
 /**
 * `mechanica link <slug>`: attach this project to a site on the platform by
@@ -317,55 +399,35 @@ async function ignoreUploads(cwd) {
 }
 //#endregion
 //#region src/cli/platform/login.ts
-/** Ask one line on the terminal; with `hidden`, the typed characters are not echoed. */
-function prompt(question, hidden = false) {
-	return new Promise((resolve) => {
-		const rl = readline.createInterface({
-			input: process.stdin,
-			output: process.stdout,
-			terminal: true
-		});
-		if (hidden) {
-			const write = rl._writeToOutput.bind(rl);
-			let asked = false;
-			rl._writeToOutput = (text) => {
-				if (!asked) write(text);
-				asked = true;
-			};
-		}
-		rl.question(question, (answer) => {
-			rl.close();
-			if (hidden) process.stdout.write("\n");
-			resolve(answer.trim());
-		});
-	});
-}
 /**
 * `mechanica login`: sign in to the platform and keep an access token for this
 * machine. With `--token` the given token is stored as is (CI, or a token made
-* in the dashboard); otherwise it asks for email + password and creates one.
+* in the dashboard). Otherwise the sign-in happens in the browser (see
+* `session.ts`): a link is printed, and the token arrives once it is approved.
+*
+* In a terminal the command waits for the approval. Without one — a coding
+* agent runs it, and shows its output only once it has ended — it prints the
+* link and returns: the next `mechanica link` / `push` finishes the sign-in.
+* `--wait` / `--no-wait` decide either way.
 */
 async function runLogin(options) {
 	const origin = hostOrigin(options.host);
-	let token = options.token;
-	if (!token) {
-		if (!process.stdin.isTTY) throw new Error("No terminal to ask for credentials — pass --token <access token>");
-		console.info(`Signing in to ${origin}`);
-		const login = await prompt("Email: ");
-		const password = await prompt("Password: ", true);
-		const session = await request(origin, "POST", "/api/account/login", { body: {
-			login,
-			password
-		} });
-		token = (await request(origin, "POST", "/api/account/tokens", {
-			token: session.accessToken,
-			body: { name: `CLI on ${os.hostname()}` }
-		})).token;
+	if (options.token) {
+		const account = await request(origin, "GET", "/api/account", { token: options.token });
+		const file = await saveToken(origin, options.token);
+		console.info(`Logged in to ${origin} as ${account.email}`);
+		console.info(`Access token saved to ${file}`);
+		return;
 	}
-	const account = await request(origin, "GET", "/api/account", { token });
-	const file = await saveToken(origin, token);
-	console.info(`Logged in to ${origin} as ${account.email}`);
-	console.info(`Access token saved to ${file}`);
+	const pending = await startDeviceLogin(origin);
+	console.info(describeDeviceLogin(origin, pending));
+	console.info("");
+	if (!(options.wait ?? process.stdin.isTTY === true)) {
+		console.info("Once it is approved, run `mechanica link <slug>` or `mechanica push`: the next command finishes the sign-in.\nWorking through a coding agent? Show the link to the person you work for, and go on when they say it is approved.");
+		return;
+	}
+	console.info("Waiting for the approval in the browser… (Ctrl+C to stop; the next `mechanica` command would finish the sign-in)");
+	await waitForDeviceLogin(origin, pending);
 }
 //#endregion
 //#region src/cli/platform/bundle-format.ts
@@ -1237,8 +1299,12 @@ Usage:
                              --site-name <name> adds WebSite JSON-LD;
                              --assets-url <origin> serves /assets and /media from
                              a CDN base — files still land in export/)
-  mechanica login           Sign in to the Mechanica platform and save an access
-                            token for this machine (--host <url>, --token <token>)
+  mechanica login           Sign in to the Mechanica platform: prints a link to
+                            open and approve in the browser, and keeps the access
+                            token for this machine. In a terminal it waits for the
+                            approval; otherwise the next link/push finishes the
+                            sign-in (--wait, --no-wait, --host <url>, or
+                            --token <token> to store a token made in the dashboard)
   mechanica link <slug>     Point this repository at a site on the platform
                             (--create makes the site, --name "Site name")
   mechanica push            Publish the committed project: pull what was edited
@@ -1288,7 +1354,8 @@ async function run(argv) {
 			return;
 		case "login": return runLogin({
 			host: str(flags.host),
-			token: str(flags.token)
+			token: str(flags.token),
+			wait: flags.wait === true ? true : flags["no-wait"] === true ? false : void 0
 		});
 		case "link": return runLink(args[0], {
 			host: str(flags.host),

package/dist/editor.css

@@ -5027,7 +5027,7 @@ from {
   justify-content: flex-end;
   gap: 8px;
   margin-top: 4px;
-}.mech-pages[data-v-efe45d0e] {
+}.mech-pages[data-v-56e0f852] {
   display: flex;
   align-items: stretch;
   justify-content: center;
@@ -5036,7 +5036,7 @@ from {
   max-width: 1200px;
   height: min(620px, 82vh);
 }
-.mech-pages__card[data-v-efe45d0e] {
+.mech-pages__card[data-v-56e0f852] {
   display: flex;
   flex-direction: column;
   flex: 0 1 840px;
@@ -5046,20 +5046,20 @@ from {
   box-shadow: var(--mech-shadow-dialog);
   overflow: hidden;
 }
-.mech-pages__header[data-v-efe45d0e] {
+.mech-pages__header[data-v-56e0f852] {
   display: flex;
   align-items: center;
   gap: 10px;
   padding: 18px 14px 12px 24px;
   flex: none;
 }
-.mech-pages__title[data-v-efe45d0e] {
+.mech-pages__title[data-v-56e0f852] {
   margin: 0;
   font-size: 16px;
   font-weight: 600;
   letter-spacing: -0.01em;
 }
-.mech-pages__count[data-v-efe45d0e] {
+.mech-pages__count[data-v-56e0f852] {
   padding: 2px 8px;
   border-radius: var(--mech-radius-pill);
   background: var(--mech-active);
@@ -5067,7 +5067,7 @@ from {
   font-size: 11.5px;
   font-weight: 600;
 }
-.mech-pages__close[data-v-efe45d0e] {
+.mech-pages__close[data-v-56e0f852] {
   display: flex;
   align-items: center;
   justify-content: center;
@@ -5080,25 +5080,25 @@ from {
   border-radius: var(--mech-radius-pill);
   cursor: pointer;
 }
-.mech-pages__close .vicon[data-v-efe45d0e] {
+.mech-pages__close .vicon[data-v-56e0f852] {
   width: 18px;
   height: 18px;
 }
-.mech-pages__close[data-v-efe45d0e]:hover {
+.mech-pages__close[data-v-56e0f852]:hover {
   background: var(--mech-hover);
   color: var(--mech-fg);
 }
-.mech-pages__toolbar[data-v-efe45d0e] {
+.mech-pages__toolbar[data-v-56e0f852] {
   display: flex;
   gap: 8px;
   padding: 0 24px 12px;
   flex: none;
 }
-.mech-pages__search-wrap[data-v-efe45d0e] {
+.mech-pages__search-wrap[data-v-56e0f852] {
   position: relative;
   flex: 1;
 }
-.mech-pages__filters[data-v-efe45d0e] {
+.mech-pages__filters[data-v-56e0f852] {
   display: flex;
   align-items: center;
   justify-content: space-between;
@@ -5106,23 +5106,23 @@ from {
   padding: 0 24px 14px;
   flex: none;
 }
-.mech-pages__sort[data-v-efe45d0e] {
+.mech-pages__sort[data-v-56e0f852] {
   display: flex;
   align-items: center;
   gap: 9px;
 }
-.mech-pages__sort-label[data-v-efe45d0e] {
+.mech-pages__sort-label[data-v-56e0f852] {
   font-size: 10.5px;
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.05em;
   color: var(--mech-muted);
 }
-.mech-pages__toggle[data-v-efe45d0e] {
+.mech-pages__toggle[data-v-56e0f852] {
   flex: none;
   white-space: nowrap;
 }
-.mech-pages__search-icon[data-v-efe45d0e] {
+.mech-pages__search-icon[data-v-56e0f852] {
   position: absolute;
   left: 12px;
   top: 50%;
@@ -5132,18 +5132,18 @@ from {
   color: var(--mech-muted);
   pointer-events: none;
 }
-.mech-pages__search[data-v-efe45d0e] {
+.mech-pages__search[data-v-56e0f852] {
   width: 100%;
   padding-left: 36px;
 }
-.mech-pages__content[data-v-efe45d0e] {
+.mech-pages__content[data-v-56e0f852] {
   display: flex;
   gap: 14px;
   flex: 1;
   min-height: 0;
   padding: 0 24px 20px;
 }
-.mech-pages__rail[data-v-efe45d0e] {
+.mech-pages__rail[data-v-56e0f852] {
   flex: none;
   width: 172px;
   display: flex;
@@ -5152,7 +5152,7 @@ from {
   overflow-y: auto;
   padding-right: 2px;
 }
-.mech-pages__rail-item[data-v-efe45d0e] {
+.mech-pages__rail-item[data-v-56e0f852] {
   display: flex;
   align-items: center;
   gap: 8px;
@@ -5166,51 +5166,51 @@ from {
   color: var(--mech-fg-alt);
   cursor: pointer;
 }
-.mech-pages__rail-item .vicon[data-v-efe45d0e] {
+.mech-pages__rail-item .vicon[data-v-56e0f852] {
   flex: none;
   width: 15px;
   height: 15px;
   color: var(--mech-muted);
 }
-.mech-pages__rail-item[data-v-efe45d0e]:hover {
+.mech-pages__rail-item[data-v-56e0f852]:hover {
   background: var(--mech-hover);
 }
-.mech-pages__rail-item.is-active[data-v-efe45d0e] {
+.mech-pages__rail-item.is-active[data-v-56e0f852] {
   background: var(--mech-accent-soft);
   color: var(--mech-accent);
   font-weight: 500;
 }
-.mech-pages__rail-item.is-active .vicon[data-v-efe45d0e] {
+.mech-pages__rail-item.is-active .vicon[data-v-56e0f852] {
   color: var(--mech-accent);
 }
-.mech-pages__rail-name[data-v-efe45d0e] {
+.mech-pages__rail-name[data-v-56e0f852] {
   flex: 1;
   min-width: 0;
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
 }
-.mech-pages__rail-count[data-v-efe45d0e] {
+.mech-pages__rail-count[data-v-56e0f852] {
   flex: none;
   font-size: 11px;
   color: var(--mech-placeholder);
 }
-.mech-pages__rail-item.is-active .mech-pages__rail-count[data-v-efe45d0e] {
+.mech-pages__rail-item.is-active .mech-pages__rail-count[data-v-56e0f852] {
   color: var(--mech-accent);
   opacity: 0.7;
 }
-.mech-pages__list[data-v-efe45d0e] {
+.mech-pages__list[data-v-56e0f852] {
   flex: 1;
   min-width: 0;
   overflow-y: auto;
 }
-.mech-pages__row[data-v-efe45d0e], .mech-pages__thead[data-v-efe45d0e] {
+.mech-pages__row[data-v-56e0f852], .mech-pages__thead[data-v-56e0f852] {
   display: grid;
   grid-template-columns: minmax(0, 1.1fr) minmax(0, 1fr) 96px;
   align-items: center;
   column-gap: 12px;
 }
-.mech-pages__thead[data-v-efe45d0e] {
+.mech-pages__thead[data-v-56e0f852] {
   position: sticky;
   top: 0;
   z-index: 1;
@@ -5218,14 +5218,14 @@ from {
   background: var(--mech-bg);
   box-shadow: 0 1px 0 var(--mech-border);
 }
-.mech-pages__thead span[data-v-efe45d0e] {
+.mech-pages__thead span[data-v-56e0f852] {
   font-size: 10.5px;
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.05em;
   color: var(--mech-muted);
 }
-.mech-pages__group[data-v-efe45d0e] {
+.mech-pages__group[data-v-56e0f852] {
   display: flex;
   align-items: center;
   gap: 7px;
@@ -5244,36 +5244,36 @@ from {
   border-radius: var(--mech-radius-sm);
   cursor: pointer;
 }
-.mech-pages__group .vicon[data-v-efe45d0e] {
+.mech-pages__group .vicon[data-v-56e0f852] {
   width: 13px;
   height: 13px;
 }
-.mech-pages__group[data-v-efe45d0e]:hover {
+.mech-pages__group[data-v-56e0f852]:hover {
   color: var(--mech-fg);
 }
-.mech-pages__row[data-v-efe45d0e] {
+.mech-pages__row[data-v-56e0f852] {
   padding: 0 10px;
   height: 38px;
   border-radius: var(--mech-radius-sm);
   cursor: pointer;
 }
-.mech-pages__row.is-active[data-v-efe45d0e] {
+.mech-pages__row.is-active[data-v-56e0f852] {
   background: var(--mech-accent-soft);
 }
-.mech-pages__cell-name[data-v-efe45d0e] {
+.mech-pages__cell-name[data-v-56e0f852] {
   display: flex;
   align-items: center;
   gap: 8px;
   min-width: 0;
 }
-.mech-pages__name[data-v-efe45d0e] {
+.mech-pages__name[data-v-56e0f852] {
   font-size: 13.5px;
   font-weight: 500;
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
 }
-.mech-pages__badge[data-v-efe45d0e] {
+.mech-pages__badge[data-v-56e0f852] {
   flex: none;
   font-size: 10px;
   font-weight: 600;
@@ -5285,17 +5285,17 @@ from {
   border-radius: var(--mech-radius-pill);
   padding: 1px 7px;
 }
-.mech-pages__badge.is-draft[data-v-efe45d0e] {
+.mech-pages__badge.is-draft[data-v-56e0f852] {
   color: var(--mech-muted);
 }
-.mech-pages__locales[data-v-efe45d0e] {
+.mech-pages__locales[data-v-56e0f852] {
   flex: none;
   display: inline-flex;
   align-items: center;
   gap: 3px;
   margin-left: 2px;
 }
-.mech-pages__loc[data-v-efe45d0e] {
+.mech-pages__loc[data-v-56e0f852] {
   min-width: 15px;
   padding: 1px 4px;
   border-radius: var(--mech-radius-sm);
@@ -5309,12 +5309,12 @@ from {
   letter-spacing: 0.02em;
   opacity: 0.5;
 }
-.mech-pages__loc.is-on[data-v-efe45d0e] {
+.mech-pages__loc.is-on[data-v-56e0f852] {
   background: var(--mech-accent-soft);
   color: var(--mech-accent);
   opacity: 1;
 }
-.mech-pages__cell-path[data-v-efe45d0e] {
+.mech-pages__cell-path[data-v-56e0f852] {
   min-width: 0;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -5322,16 +5322,16 @@ from {
   font-size: 12.5px;
   color: var(--mech-muted);
 }
-.mech-pages__actions[data-v-efe45d0e] {
+.mech-pages__actions[data-v-56e0f852] {
   display: flex;
   justify-content: flex-end;
   gap: 1px;
   opacity: 0;
 }
-.mech-pages__row.is-active .mech-pages__actions[data-v-efe45d0e], .mech-pages__row:hover .mech-pages__actions[data-v-efe45d0e] {
+.mech-pages__row.is-active .mech-pages__actions[data-v-56e0f852], .mech-pages__row:hover .mech-pages__actions[data-v-56e0f852] {
   opacity: 1;
 }
-.mech-pages__actions button[data-v-efe45d0e] {
+.mech-pages__actions button[data-v-56e0f852] {
   display: flex;
   align-items: center;
   justify-content: center;
@@ -5344,24 +5344,24 @@ from {
   cursor: pointer;
   line-height: 1;
 }
-.mech-pages__actions button .vicon[data-v-efe45d0e] {
+.mech-pages__actions button .vicon[data-v-56e0f852] {
   width: 15px;
   height: 15px;
 }
-.mech-pages__actions button[data-v-efe45d0e]:hover {
+.mech-pages__actions button[data-v-56e0f852]:hover {
   background: var(--mech-active);
   color: var(--mech-fg);
 }
-.mech-pages__actions button.is-danger[data-v-efe45d0e]:hover {
+.mech-pages__actions button.is-danger[data-v-56e0f852]:hover {
   color: var(--mech-error);
 }
-.mech-pages__empty[data-v-efe45d0e] {
+.mech-pages__empty[data-v-56e0f852] {
   padding: 24px 10px;
   margin: 0;
   color: var(--mech-muted);
   font-size: 13px;
 }
-.mech-pages__preview[data-v-efe45d0e] {
+.mech-pages__preview[data-v-56e0f852] {
   flex: none;
   align-self: flex-start;
   max-height: 100%;
@@ -5373,18 +5373,18 @@ from {
   box-shadow: var(--mech-shadow-dialog);
   overflow: hidden;
 }
-.mech-pages__preview-frame[data-v-efe45d0e] {
+.mech-pages__preview-frame[data-v-56e0f852] {
   flex: 0 1 auto;
   min-height: 0;
   overflow: hidden;
   background: var(--mech-app-bg);
 }
-.mech-pages__preview-frame img[data-v-efe45d0e] {
+.mech-pages__preview-frame img[data-v-56e0f852] {
   display: block;
   width: 100%;
   height: auto;
 }
-.mech-pages__preview-empty[data-v-efe45d0e] {
+.mech-pages__preview-empty[data-v-56e0f852] {
   display: flex;
   flex-direction: column;
   align-items: center;
@@ -5393,16 +5393,16 @@ from {
   padding: 48px 16px;
   color: var(--mech-muted);
 }
-.mech-pages__preview-empty p[data-v-efe45d0e] {
+.mech-pages__preview-empty p[data-v-56e0f852] {
   margin: 8px 0 0;
   font-size: 13px;
   font-weight: 500;
 }
-.mech-pages__preview-empty code[data-v-efe45d0e] {
+.mech-pages__preview-empty code[data-v-56e0f852] {
   font-size: 11.5px;
   color: var(--mech-placeholder);
 }
-.mech-pages__preview-monogram[data-v-efe45d0e] {
+.mech-pages__preview-monogram[data-v-56e0f852] {
   display: flex;
   align-items: center;
   justify-content: center;
@@ -5413,7 +5413,7 @@ from {
   font-size: 22px;
   font-weight: 600;
 }
-.mech-pages__preview-caption[data-v-efe45d0e] {
+.mech-pages__preview-caption[data-v-56e0f852] {
   flex: none;
   display: flex;
   flex-direction: column;
@@ -5421,21 +5421,21 @@ from {
   padding: 12px 16px 14px;
   border-top: 1px solid var(--mech-border);
 }
-.mech-pages__preview-name[data-v-efe45d0e] {
+.mech-pages__preview-name[data-v-56e0f852] {
   font-size: 13px;
   font-weight: 600;
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
 }
-.mech-pages__preview-path[data-v-efe45d0e] {
+.mech-pages__preview-path[data-v-56e0f852] {
   font-size: 11.5px;
   color: var(--mech-muted);
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
 }
-.mech-pages__preview-tag[data-v-efe45d0e] {
+.mech-pages__preview-tag[data-v-56e0f852] {
   display: inline-flex;
   align-items: center;
   gap: 5px;
@@ -5449,13 +5449,13 @@ from {
   color: var(--mech-fg-alt);
   background: var(--mech-active);
 }
-.mech-pages__preview-tag .vicon[data-v-efe45d0e] {
+.mech-pages__preview-tag .vicon[data-v-56e0f852] {
   width: 12px;
   height: 12px;
   color: var(--mech-muted);
 }
 @media (max-width: 1160px) {
-.mech-pages__preview[data-v-efe45d0e] {
+.mech-pages__preview[data-v-56e0f852] {
     display: none;
 }
 }.mech-pagebar[data-v-43756991] {

package/dist/editor.js

@@ -2133,7 +2133,8 @@ var _hoisted_18 = { class: "mech-pages__cell-name" };
 var _hoisted_19 = { class: "mech-pages__name" };
 var _hoisted_20 = {
 	key: 0,
-	class: "mech-pages__badge is-draft"
+	class: "mech-pages__badge is-draft",
+	title: "Editable, but not on the site"
 };
 var _hoisted_21 = {
 	key: 1,
@@ -2318,7 +2319,7 @@ var PagesDialog_default = /*#__PURE__*/ _plugin_vue_export_helper_default(/* @__
 					onClick: () => startDuplicate(page)
 				},
 				{
-					label: page.draft ? "Publish" : "Mark as draft",
+					label: page.draft ? "Show on site" : "Hide from site",
 					separatorBefore: true,
 					onClick: () => void toggleDraft(page)
 				},
@@ -2467,7 +2468,7 @@ var PagesDialog_default = /*#__PURE__*/ _plugin_vue_export_helper_default(/* @__
 							}, [
 								createElementVNode("span", _hoisted_18, [
 									createElementVNode("span", _hoisted_19, toDisplayString(page.name || page.path), 1),
-									page.draft ? (openBlock(), createElementBlock("span", _hoisted_20, "Draft")) : createCommentVNode("", true),
+									page.draft ? (openBlock(), createElementBlock("span", _hoisted_20, "Hidden")) : createCommentVNode("", true),
 									page.generated ? (openBlock(), createElementBlock("span", _hoisted_21, "Generated")) : createCommentVNode("", true),
 									page.path === currentLogical.value ? (openBlock(), createElementBlock("span", _hoisted_22, "Current")) : createCommentVNode("", true),
 									unref(localeConfig) && page.locales ? (openBlock(), createElementBlock("span", _hoisted_23, [(openBlock(true), createElementBlock(Fragment, null, renderList(unref(localeCodes), (code) => {
@@ -2519,7 +2520,7 @@ var PagesDialog_default = /*#__PURE__*/ _plugin_vue_export_helper_default(/* @__
 			])) : createCommentVNode("", true)])]);
 		};
 	}
-}), [["__scopeId", "data-v-efe45d0e"]]);
+}), [["__scopeId", "data-v-56e0f852"]]);
 //#endregion
 //#region src/editor/components/PageBar.vue?vue&type=script&setup=true&lang.ts
 var _hoisted_1$3 = { class: "mech-pagebar__icon" };

package/dist/export.js

@@ -1,8 +1,8 @@
-import { $ as withHostedAssets, E as listPages, F as setPageCodec, H as assetFileOf, K as isDerivedAsset, S as getPagePath, V as UPLOADS_PREFIX$1, W as fsAssetStore, d as readFoldersData, f as readSiteData, i as toBlockMeta, nt as analyzeImageBuffer, p as readSiteLocaleOverride, r as composedBlockMeta, rt as hasSharp, t as buildRichTextCodec, u as readFolderData } from "./chunks/rich-text-codec-BSD35k2U.js";
+import { $ as withHostedAssets, E as listPages, F as setPageCodec, H as assetFileOf, K as isDerivedAsset, S as getPagePath, V as UPLOADS_PREFIX$1, W as fsAssetStore, d as readFoldersData, f as readSiteData, i as toBlockMeta, nt as analyzeImageBuffer, p as readSiteLocaleOverride, r as composedBlockMeta, rt as hasSharp, t as buildRichTextCodec, u as readFolderData } from "./chunks/rich-text-codec-DCv1X0eZ.js";
 import { n as blockAssetLinks, t as BLOCKS_MANIFEST_FILE } from "./chunks/page-assets-DsJXmoDs.js";
 import { dirname, join, parse, relative, resolve } from "node:path";
 import { EDITOR_DIST_DIR, SITE_MANIFEST_FILE, applySeoTags, auditPageHtml, buildRobotsTxt, buildSitemap, findUnknownBlocks, generateProject, isPaginatedQuery, localePath, mergeTranslation, migrateContent, paginationVariantPath, registerFieldSchemas, resolveQueryKey, templateBlockIds, validateLinks, walkSchema, walkTree } from "mechanica-shared";
-import { parsePage } from "mechanica-shared/page-format";
+import { PageParseError, parsePage } from "mechanica-shared/page-format";
 import { access, copyFile, cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 //#region src/cli/export.ts
@@ -13,6 +13,14 @@ function setHtmlLang(html, lang) {
 	if (/<html\b[^>]*\blang\s*=/i.test(html)) return html;
 	return html.replace(/<html\b([^>]*)>/i, `<html$1 lang="${lang}">`);
 }
+/** Parse a page file's text, naming the file (relative to `.mech`) in a parse error. */
+function parsePageFile(raw, file, richText) {
+	try {
+		return parsePage(raw, richText ? { richText } : void 0);
+	} catch (error) {
+		throw error instanceof PageParseError ? error.inFile(file) : error;
+	}
+}
 /** Read every page JSON under `<mech>/pages` as an exportable page. */
 async function readPages(pagesDir, foldersData = {}, richText) {
 	let entries;
@@ -30,7 +38,7 @@ async function readPages(pagesDir, foldersData = {}, richText) {
 		const base = parsed.base.slice(0, -8);
 		if (VARIANT_STEM_RE.test(base)) continue;
 		const filePath = join(pagesDir, relative);
-		const file = parsePage(await readFile(filePath, "utf-8"), richText ? { richText } : void 0);
+		const file = parsePageFile(await readFile(filePath, "utf-8"), `pages/${relative.replace(/\\/g, "/")}`, richText);
 		if (file.draft) continue;
 		const path = `/${dir}/${base === "index" ? "" : base}`.replace("//", "/").replace(/\/$/, "") || "/";
 		const data = {
@@ -71,9 +79,9 @@ async function readTranslation(mechDir, base, locale, config, richText) {
 	} catch {
 		return null;
 	}
-	const doc = parsePage(raw, richText ? { richText } : void 0);
-	if (doc.draft) return null;
 	const rel = relative(join(mechDir, "pages"), file).replace(/\\/g, "/");
+	const doc = parsePageFile(raw, `pages/${rel}`, richText);
+	if (doc.draft) return null;
 	const dir = dirname(rel) === "." ? "" : dirname(rel);
 	let content = doc.content ?? [];
 	let pageData = doc.data ?? {};

package/dist/plugin.js

@@ -1,7 +1,7 @@
-import { a as collectGeneratedPages, n as configureSite, r as indexGeneratedPages, t as buildSiteManifest } from "./chunks/site-DfazSr3_.js";
-import { a as renderEditablePage, c as fillStateImages, d as loadComposedDefinitions, n as toNodeMiddleware, o as buildGeneratedState, r as createEditorService, s as buildPageState, t as toAssetMiddleware, u as collectComposed } from "./chunks/node-adapter-CSkDXYGO.js";
-import { W as fsAssetStore, et as withRemoteAssets, k as pageUrlOf, tt as wasRecentlyMutated } from "./chunks/rich-text-codec-BSD35k2U.js";
-import { i as uploadsIgnored, n as remoteAssetsFor } from "./chunks/assets-nujjbCx8.js";
+import { a as collectGeneratedPages, n as configureSite, r as indexGeneratedPages, t as buildSiteManifest } from "./chunks/site-BVqx8iKj.js";
+import { a as renderEditablePage, c as fillStateImages, d as loadComposedDefinitions, n as toNodeMiddleware, o as buildGeneratedState, r as createEditorService, s as buildPageState, t as toAssetMiddleware, u as collectComposed } from "./chunks/node-adapter-Bm_SloHQ.js";
+import { W as fsAssetStore, et as withRemoteAssets, k as pageUrlOf, tt as wasRecentlyMutated } from "./chunks/rich-text-codec-DCv1X0eZ.js";
+import { i as uploadsIgnored, n as remoteAssetsFor } from "./chunks/assets-5a2WdmFg.js";
 import { t as BLOCKS_MANIFEST_FILE } from "./chunks/page-assets-DsJXmoDs.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, relative } from "node:path";

package/dist/server.js

@@ -1,5 +1,5 @@
-import { i as readSiteManifest, n as configureSite, t as buildSiteManifest } from "./chunks/site-DfazSr3_.js";
-import { a as renderEditablePage, i as readEditorTemplate, n as toNodeMiddleware, r as createEditorService, t as toAssetMiddleware } from "./chunks/node-adapter-CSkDXYGO.js";
-import { $ as withHostedAssets, B as memoryContentFiles, G as isAssetName, K as isDerivedAsset, O as pageOfFile, Q as uploadResponse, U as contentTypeOf, W as fsAssetStore, Z as uploadName, et as withRemoteAssets, z as fsContentFiles } from "./chunks/rich-text-codec-BSD35k2U.js";
+import { i as readSiteManifest, n as configureSite, t as buildSiteManifest } from "./chunks/site-BVqx8iKj.js";
+import { a as renderEditablePage, i as readEditorTemplate, n as toNodeMiddleware, r as createEditorService, t as toAssetMiddleware } from "./chunks/node-adapter-Bm_SloHQ.js";
+import { $ as withHostedAssets, B as memoryContentFiles, G as isAssetName, K as isDerivedAsset, O as pageOfFile, Q as uploadResponse, U as contentTypeOf, W as fsAssetStore, Z as uploadName, et as withRemoteAssets, z as fsContentFiles } from "./chunks/rich-text-codec-DCv1X0eZ.js";
 import { EDITOR_DIST_DIR, SITE_MANIFEST_FILE, UPLOADS_PREFIX, uploadNameOf } from "mechanica-shared";
 export { EDITOR_DIST_DIR, SITE_MANIFEST_FILE, UPLOADS_PREFIX, buildSiteManifest, configureSite, contentTypeOf, createEditorService, fsAssetStore, fsContentFiles, isAssetName, isDerivedAsset, memoryContentFiles, pageOfFile, readEditorTemplate, readSiteManifest, renderEditablePage, toAssetMiddleware, toNodeMiddleware, uploadName, uploadNameOf, uploadResponse, withHostedAssets, withRemoteAssets };

package/dist/types/cli/platform/api.d.ts

@@ -12,8 +12,6 @@ export interface RequestOptions {
 }
 /** One request to the platform API; resolves with the parsed JSON body (or null). */
 export declare function request<T = any>(origin: string, method: string, path: string, options?: RequestOptions): Promise<T>;
-/** The saved token for `origin`, or an error telling the user to log in. */
-export declare function requireToken(origin: string): Promise<string>;
 export interface PlatformSite {
     uuid: string;
     slug: string;

package/dist/types/cli/platform/credentials.d.ts

@@ -9,3 +9,25 @@ export declare function hostOrigin(host: string | undefined): string;
 export declare function getToken(origin: string): Promise<string | null>;
 /** Remember the token for an origin, in a file only the user can read. */
 export declare function saveToken(origin: string, token: string): Promise<string>;
+/**
+ * A sign-in started by `mechanica login` and not yet approved in the browser.
+ * The device code is the secret the platform hands the token to; the user
+ * code is what the link carries. Kept so that the next command can finish
+ * the sign-in once the link was approved — a coding agent runs `login`,
+ * shows the link, and goes on with `link` or `push` after the user's click.
+ */
+export interface PendingLogin {
+    deviceCode: string;
+    userCode: string;
+    verificationUrl: string;
+    /** ISO date: when the platform forgets the request. */
+    expiresAt: string;
+    /** How often the platform wants to be asked, in seconds. */
+    interval: number;
+}
+/** The sign-in waiting for an origin, or null. An expired one is reported too: whoever reads it says so. */
+export declare function getPendingLogin(origin: string): Promise<PendingLogin | null>;
+/** Keep a started sign-in for an origin (replacing an earlier one). */
+export declare function savePendingLogin(origin: string, login: PendingLogin): Promise<void>;
+/** Forget the sign-in waiting for an origin — it was finished, denied or has expired. */
+export declare function clearPendingLogin(origin: string): Promise<void>;

package/dist/types/cli/platform/login.d.ts

@@ -1,9 +1,16 @@
 /**
  * `mechanica login`: sign in to the platform and keep an access token for this
  * machine. With `--token` the given token is stored as is (CI, or a token made
- * in the dashboard); otherwise it asks for email + password and creates one.
+ * in the dashboard). Otherwise the sign-in happens in the browser (see
+ * `session.ts`): a link is printed, and the token arrives once it is approved.
+ *
+ * In a terminal the command waits for the approval. Without one — a coding
+ * agent runs it, and shows its output only once it has ended — it prints the
+ * link and returns: the next `mechanica link` / `push` finishes the sign-in.
+ * `--wait` / `--no-wait` decide either way.
  */
 export declare function runLogin(options: {
     host?: string;
     token?: string;
+    wait?: boolean;
 }): Promise<void>;

package/dist/types/cli/platform/session.d.ts

@@ -0,0 +1,31 @@
+import { type PendingLogin } from './credentials';
+/** Start a sign-in: the platform makes a request, its codes are kept for this origin. */
+export declare function startDeviceLogin(origin: string): Promise<PendingLogin>;
+/** What the user is shown: the link, and how long it stays open. */
+export declare function describeDeviceLogin(origin: string, pending: PendingLogin): string;
+export type DeviceLoginOutcome = {
+    status: 'pending';
+} | {
+    status: 'approved';
+    token: string;
+} | {
+    status: 'denied';
+} | {
+    status: 'expired';
+};
+/** Ask the platform once whether the request was answered. */
+export declare function checkDeviceLogin(origin: string, pending: PendingLogin): Promise<DeviceLoginOutcome>;
+/**
+ * Finish a started sign-in if it was answered: save the token and say who
+ * signed in. Null while the request still waits. A denied or expired request
+ * is forgotten and reported — the user runs `mechanica login` for a new link.
+ */
+export declare function completeDeviceLogin(origin: string, pending: PendingLogin): Promise<string | null>;
+/** Wait for the approval, asking the platform every `interval` seconds until it comes or the link expires. */
+export declare function waitForDeviceLogin(origin: string, pending: PendingLogin): Promise<string>;
+/**
+ * The token for `origin`: the saved one, or — when `mechanica login` printed
+ * a link that has been approved since — the one the platform now hands over.
+ * Otherwise an error that says what to do next.
+ */
+export declare function requireToken(origin: string): Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mechanica",
-  "version": "2.1.0-beta.7",
+  "version": "2.1.0",
   "description": "Build Vue 3 websites with a visual block editor",
   "license": "MIT",
   "repository": {
@@ -66,7 +66,7 @@
     "prepublishOnly": "bun ../../scripts/ensure-bun-publish.js && bun run build"
   },
   "dependencies": {
-    "mechanica-shared": "2.1.0-beta.7",
+    "mechanica-shared": "2.1.0",
     "@vue/compiler-sfc": "^3.5.38",
     "compact-json-schema": "^0.1.5",
     "estree-walker": "^3.0.3",