@avocadostudio-ai/astro 0.8.0

package/dist/runtime.js

@@ -0,0 +1,73 @@
+import { decideEditorRewrite } from "@avocadostudio-ai/site-sdk/proxy/core";
+import { ASTRO_DRAFT_COOKIE, draftSecret, verifyDraftCookie } from "./draft-cookie.js";
+/**
+ * Resolve what a request means, for Astro's middleware and for anything else
+ * holding a `Request`.
+ *
+ * Two things can mark a request as the editor's: the `__editor=1` parameter the
+ * editor puts on the iframe URL, and the signed draft cookie that keeps
+ * navigation *inside* the iframe in preview. The parameter alone authorizes
+ * nothing on its own — it is a routing hint with no secret in it — so a request
+ * carrying only the parameter is treated as an editor render but the session it
+ * reports comes from the URL, and the content it may see is decided by
+ * `/api/editor/draft` having minted a cookie or by a valid `secret`. This
+ * mirrors `resolveDraftContextCore`, deliberately.
+ */
+export function resolveEditorRequest(request, options) {
+    const url = new URL(request.url);
+    const cookies = parseCookies(request.headers.get("cookie"));
+    const decision = decideEditorRewrite({ pathname: url.pathname, searchParams: url.searchParams, hasCookie: (name) => name in cookies }, { draftCookie: ASTRO_DRAFT_COOKIE });
+    if (decision.kind === "pass")
+        return { isEditor: false };
+    const verified = verifyDraftCookie(cookies[ASTRO_DRAFT_COOKIE], options?.secret ?? draftSecret());
+    const session = url.searchParams.get("session")?.trim() || verified?.session || options?.session || "dev";
+    const siteId = url.searchParams.get("siteId")?.trim() || verified?.siteId || options?.siteId || process.env.AVOCADO_SITE_ID || "";
+    const editorOrigin = resolveEditorOrigin(url.searchParams.get("editorOrigin"), options?.editorOrigins);
+    const params = new URLSearchParams({ __editor: "1", session, siteId });
+    if (editorOrigin)
+        params.set("editorOrigin", editorOrigin);
+    const secret = url.searchParams.get("secret");
+    /*
+     * The secret is carried forward because it is what authorizes a render when
+     * the cookie cannot be: the editor renders the site in a cross-origin iframe,
+     * and third-party cookies are frequently blocked outright. Dropping it from
+     * in-preview links makes every navigation after the first one render the
+     * published page, in exactly the browsers where that is hardest to reproduce.
+     */
+    if (secret)
+        params.set("secret", secret);
+    return { isEditor: true, session, siteId, editorOrigin, editorQuery: `?${params.toString()}` };
+}
+/**
+ * The editor origin becomes a `postMessage` target and the frame allowed to
+ * drive inline edits, so it cannot be whatever the URL says. A candidate counts
+ * only when the operator listed it.
+ */
+function resolveEditorOrigin(candidate, allowed) {
+    const list = allowed?.map((o) => o.replace(/\/+$/, "")) ?? [];
+    const fallback = list[0] ?? (process.env.NODE_ENV !== "production" ? "http://localhost:4100" : "");
+    if (!candidate)
+        return fallback;
+    try {
+        const origin = new URL(decodeURIComponent(candidate)).origin;
+        if (list.length === 0)
+            return process.env.NODE_ENV !== "production" ? origin : fallback;
+        return list.includes(origin) ? origin : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq < 0)
+            continue;
+        out[part.slice(0, eq).trim()] = decodeURIComponent(part.slice(eq + 1).trim());
+    }
+    return out;
+}
+export { ASTRO_DRAFT_COOKIE } from "./draft-cookie.js";

package/package.json

@@ -0,0 +1,91 @@
+{
+  "name": "@avocadostudio-ai/astro",
+  "version": "0.8.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./middleware": {
+      "types": "./dist/middleware.d.ts",
+      "import": "./dist/middleware.js",
+      "default": "./dist/middleware.js"
+    },
+    "./middleware-entry": {
+      "types": "./dist/middleware-entry.d.ts",
+      "import": "./dist/middleware-entry.js",
+      "default": "./dist/middleware-entry.js"
+    },
+    "./editor-api": {
+      "types": "./dist/editor-api.d.ts",
+      "import": "./dist/editor-api.js",
+      "default": "./dist/editor-api.js"
+    },
+    "./editor-api-route": {
+      "types": "./dist/editor-api-route.d.ts",
+      "import": "./dist/editor-api-route.js",
+      "default": "./dist/editor-api-route.js"
+    },
+    "./runtime": {
+      "types": "./dist/runtime.d.ts",
+      "import": "./dist/runtime.js",
+      "default": "./dist/runtime.js"
+    },
+    "./markers": {
+      "types": "./dist/markers.d.ts",
+      "import": "./dist/markers.js",
+      "default": "./dist/markers.js"
+    },
+    "./bridge": {
+      "types": "./dist/bridge.d.ts",
+      "import": "./dist/bridge.js",
+      "default": "./dist/bridge.js"
+    }
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@avocadostudio-ai/shared": "^0.8.0",
+    "@avocadostudio-ai/preview-adapter": "^0.8.0",
+    "@avocadostudio-ai/site-sdk": "^0.8.0"
+  },
+  "peerDependencies": {
+    "astro": ">=5.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.10",
+    "astro": "^7.3.1",
+    "tsx": "^4.21.0",
+    "typescript": "^5.7.3"
+  },
+  "description": "Astro integration for Avocado Studio — editor API, draft preview, and the live-preview bridge, with no React",
+  "keywords": [
+    "avocado",
+    "avocado-studio",
+    "astro",
+    "astro-integration",
+    "visual-editing",
+    "live-preview",
+    "cms"
+  ],
+  "license": "Apache-2.0",
+  "homepage": "https://docs.avocadostudio.dev",
+  "bugs": {
+    "url": "https://docs.avocadostudio.dev"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "NODE_ENV=test node ../../scripts/run-tests.mjs"
+  }
+}