@avocadostudio-ai/orchestrator-core 0.26.0 → 0.27.0

package/dist/handler/create-orchestrator.js

@@ -65,7 +65,7 @@ import { resolveCapabilities } from "../cms/adapter.js";
 import { mediaSourceFromUnknown } from "../cms/media-sources.js";
 import { extractAccessToken, isAccessGateEnabled, isValidAccessToken, mintAccessToken, verifyAccessPassword } from "../http/access-tokens.js";
 import { editorCredentials } from "../http/editor-credentials.js";
-import { declareLibraryMount, observeLibraryMount } from "./library-mount.js";
+import { clearLibraryDispatch, declareLibraryMount, observeLibraryMount, registerLibraryDispatch } from "./library-mount.js";
 import { checkAuth, resolveAuth, CLOSED_HINT } from "./auth.js";
 import { setSiteAssetLister, invalidateSiteAssets } from "../state/site-assets.js";
 async function buildRuntime(config) {
@@ -538,9 +538,23 @@ export function createOrchestrator(config = {}) {
     // See `library-mount.ts` for why this is not simply a config value.
     if (config.previewUrl)
         declareLibraryMount(`${config.previewUrl.replace(/\/+$/, "")}${basePath}`);
+    /*
+     * Requests this process's own preview dispatches in-process (see
+     * `library-mount.ts`). Membership is the credential: a request that arrived
+     * over the network is a different object, so it can never be in the set, and
+     * nothing about it — no header, no URL — can put it there. The bypass covers
+     * the three GET draft reads the SDK makes and nothing else, so code that
+     * reaches the dispatcher can read the drafts the preview renders, but never
+     * edit or publish.
+     */
+    const inProcessRequests = new WeakSet();
+    const IN_PROCESS_READS = new Set(["/draft/pages", "/draft/slugs", "/draft/site-config"]);
     const handler = async function handler(request) {
         const url = new URL(request.url);
-        observeLibraryMount(`${url.origin}${basePath}`);
+        const inProcess = inProcessRequests.has(request);
+        // An in-process URL is synthetic; recording it would mislead every HTTP reader.
+        if (!inProcess)
+            observeLibraryMount(`${url.origin}${basePath}`);
         const path = stripBasePath(url.pathname, basePath);
         const cors = corsHeadersFor(request, config);
         if (request.method === "OPTIONS") {
@@ -566,9 +580,12 @@ export function createOrchestrator(config = {}) {
          * (the /auth exchange itself, and image reads an <img> tag cannot
          * authenticate) pass through inside checkAuth.
          */
-        const gate = await checkAuth({ request, path, auth: config.auth, cors, log: gateLogger });
-        if (gate.response)
-            return gate.response;
+        const trustedRead = inProcess && request.method === "GET" && IN_PROCESS_READS.has(path);
+        if (!trustedRead) {
+            const gate = await checkAuth({ request, path, auth: config.auth, cors, log: gateLogger });
+            if (gate.response)
+                return gate.response;
+        }
         if (request.method === "GET" && path === "/auth/status") {
             /*
              * `gateEnabled` answers one question for the editor's PasswordGate: "do I
@@ -2647,7 +2664,13 @@ export function createOrchestrator(config = {}) {
                 "Use the Fastify orchestrator at apps/orchestrator for the full surface (sites, the session directory, the agent surface, etc.)."
         }, { status: 405, cors });
     };
+    const dispatchInProcess = (request) => {
+        inProcessRequests.add(request);
+        return handler(request);
+    };
+    registerLibraryDispatch(basePath, dispatchInProcess);
     handler.dispose = async () => {
+        clearLibraryDispatch(dispatchInProcess);
         if (!runtimePromise)
             return;
         try {

package/dist/handler/library-mount.d.ts

@@ -1,6 +1,11 @@
 export declare const LIBRARY_MOUNT_KEY = "__avocado_library_mount__";
+export type LibraryDispatch = (request: Request) => Promise<Response>;
 /** Called at construction, from `previewUrl` + `basePath`. */
 export declare function declareLibraryMount(url: string): void;
 /** Called on each request, from the URL the runtime actually received. */
 export declare function observeLibraryMount(url: string): void;
 export declare function getLibraryMount(): string | null;
+/** Called at construction: this handler answers in-process draft reads. */
+export declare function registerLibraryDispatch(basePath: string, dispatch: LibraryDispatch): void;
+/** Called on dispose, and only clears the slot if it is still this handler's. */
+export declare function clearLibraryDispatch(dispatch: LibraryDispatch): void;

package/dist/handler/library-mount.js

@@ -43,3 +43,17 @@ export function getLibraryMount() {
     const s = slot();
     return s.observed ?? s.declared ?? null;
 }
+/** Called at construction: this handler answers in-process draft reads. */
+export function registerLibraryDispatch(basePath, dispatch) {
+    const s = slot();
+    s.basePath = basePath.replace(/\/+$/, "");
+    s.dispatch = dispatch;
+}
+/** Called on dispose, and only clears the slot if it is still this handler's. */
+export function clearLibraryDispatch(dispatch) {
+    const s = slot();
+    if (s.dispatch !== dispatch)
+        return;
+    delete s.dispatch;
+    delete s.basePath;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avocadostudio-ai/orchestrator-core",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",
@@ -22,8 +22,8 @@
     "openai": "^4.87.1",
     "sharp": "^0.35.4",
     "zod": "^4.3.6",
-    "@avocadostudio-ai/migration-sdk": "^0.26.0",
-    "@avocadostudio-ai/shared": "^0.26.0"
+    "@avocadostudio-ai/migration-sdk": "^0.27.0",
+    "@avocadostudio-ai/shared": "^0.27.0"
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.220",