@avocadostudio-ai/site-sdk 0.10.0 → 0.11.0

package/dist/editor-routes.d.ts

@@ -27,6 +27,24 @@ export declare function createPagesHandler(getPages: () => PageDoc[] | Promise<P
     GET: (request: Request) => Promise<Response>;
     OPTIONS: (request: Request) => Response;
 };
+/**
+ * Why an unconfigured publish endpoint is refused in production rather than
+ * left open.
+ *
+ * `publishSecret` was optional, and every scaffold and example wired it as
+ * `process.env.PUBLISH_TOKEN?.trim() || undefined` — a variable none of them
+ * generated, mentioned in their `.env.local`, or required. So the value was
+ * always `undefined`, `if (secret)` was always false, and `POST
+ * /api/editor/publish` accepted any caller's `pages` array and overwrote the
+ * site's content with it. A deployment that had followed its own README to the
+ * letter, `ACCESS_PASSWORD_HASH` and all, was gated on `/api/avocado/*` and
+ * wide open here: the two route groups are different handlers, and only one of
+ * them had ever been asked about auth.
+ *
+ * An optional guard on a write endpoint is not a guard. This one now fails
+ * closed wherever it matters and says which variable opens it.
+ */
+export declare const OPEN_PUBLISH_HINT: string;
 export declare function createPublishHandler(onPublish: OnPublishFn, options?: {
     publishSecret?: string;
 }): {

package/dist/editor-routes.js

@@ -29,12 +29,45 @@ export function createPagesHandler(getPages, getSiteConfig) {
         }
     };
 }
+/**
+ * Why an unconfigured publish endpoint is refused in production rather than
+ * left open.
+ *
+ * `publishSecret` was optional, and every scaffold and example wired it as
+ * `process.env.PUBLISH_TOKEN?.trim() || undefined` — a variable none of them
+ * generated, mentioned in their `.env.local`, or required. So the value was
+ * always `undefined`, `if (secret)` was always false, and `POST
+ * /api/editor/publish` accepted any caller's `pages` array and overwrote the
+ * site's content with it. A deployment that had followed its own README to the
+ * letter, `ACCESS_PASSWORD_HASH` and all, was gated on `/api/avocado/*` and
+ * wide open here: the two route groups are different handlers, and only one of
+ * them had ever been asked about auth.
+ *
+ * An optional guard on a write endpoint is not a guard. This one now fails
+ * closed wherever it matters and says which variable opens it.
+ */
+export const OPEN_PUBLISH_HINT = "This publish endpoint overwrites the site's content and has no publishSecret configured, " +
+    "so it refuses every request under NODE_ENV=production. Set PUBLISH_TOKEN (the same value the " +
+    "orchestrator sends as x-publish-token), or pass publishSecret to createEditorApiHandler().";
+let warnedOpenPublish = false;
 export function createPublishHandler(onPublish, options) {
     return {
         OPTIONS: createEditorCorsOptionsHandler(),
         async POST(request) {
             // Verify publish token if configured
             const secret = options?.publishSecret;
+            if (!secret) {
+                if (process.env.NODE_ENV === "production") {
+                    const res = new Response(JSON.stringify({ ok: false, error: "unauthorized", reason: OPEN_PUBLISH_HINT }), { status: 401, headers: { "Content-Type": "application/json" } });
+                    return applyEditorCors(res, request.headers.get("origin"));
+                }
+                // Development: publishing to your own machine is the point, so this
+                // stays open — but it is the same code path that ships, so say so once.
+                if (!warnedOpenPublish) {
+                    warnedOpenPublish = true;
+                    console.warn(`[avocado] ${OPEN_PUBLISH_HINT}`);
+                }
+            }
             if (secret) {
                 const provided = request.headers.get("x-publish-token")?.trim();
                 if (!provided || provided !== secret) {

package/dist/publish-handlers/json-file.d.ts

@@ -2,6 +2,21 @@ import type { OnPublishFn } from "../editor-routes.ts";
 /**
  * Publish handler that writes PageDoc[] to a local JSON file.
  *
+ * `shape` decides what lands in the file, and it has to match whatever reads
+ * it back. It used to be neither a parameter nor a choice: the handler always
+ * wrote `{ pages, siteConfig }` while this docstring, three of the four call
+ * sites, and `jsonFileAdapter.onPublish` all said `PageDoc[]`. Publishing then
+ * broke the site that had just published — the scaffold's `lib/content.ts`
+ * does `JSON.parse(...) as PageDoc[]` and its `.find` threw on an object, so
+ * every page answered 500, and `examples/sample-site` reads a slug-keyed
+ * object and quietly lost all nine pages. Only `apps/site` survived, because
+ * its reader had already grown a branch for both shapes.
+ *
+ * So: `array` is the default, because it is what the readers and the adapter
+ * expect. Pass `wrapper` when the reader wants `siteConfig` in the same file —
+ * a plain array has nowhere to put it, so site-level settings (name, logo,
+ * nav) are dropped on publish.
+ *
  * When `publicDir` is provided, inline assets (base64 images from the
  * orchestrator) are written to disk and their localhost URLs are rewritten
  * to relative paths in the JSON output.
@@ -21,4 +36,6 @@ import type { OnPublishFn } from "../editor-routes.ts";
 export declare function createJsonFilePublishHandler(filePath: string, options?: {
     publicDir?: string;
     imagePathPrefix?: string;
+    /** `array` writes `PageDoc[]` (default). `wrapper` writes `{ pages, siteConfig }`. */
+    shape?: "array" | "wrapper";
 }): OnPublishFn;

package/dist/publish-handlers/json-file.js

@@ -3,6 +3,21 @@ import { resolve } from "node:path";
 /**
  * Publish handler that writes PageDoc[] to a local JSON file.
  *
+ * `shape` decides what lands in the file, and it has to match whatever reads
+ * it back. It used to be neither a parameter nor a choice: the handler always
+ * wrote `{ pages, siteConfig }` while this docstring, three of the four call
+ * sites, and `jsonFileAdapter.onPublish` all said `PageDoc[]`. Publishing then
+ * broke the site that had just published — the scaffold's `lib/content.ts`
+ * does `JSON.parse(...) as PageDoc[]` and its `.find` threw on an object, so
+ * every page answered 500, and `examples/sample-site` reads a slug-keyed
+ * object and quietly lost all nine pages. Only `apps/site` survived, because
+ * its reader had already grown a branch for both shapes.
+ *
+ * So: `array` is the default, because it is what the readers and the adapter
+ * expect. Pass `wrapper` when the reader wants `siteConfig` in the same file —
+ * a plain array has nowhere to put it, so site-level settings (name, logo,
+ * nav) are dropped on publish.
+ *
  * When `publicDir` is provided, inline assets (base64 images from the
  * orchestrator) are written to disk and their localhost URLs are rewritten
  * to relative paths in the JSON output.
@@ -33,8 +48,8 @@ export function createJsonFilePublishHandler(filePath, options) {
             }
             output = JSON.parse(json);
         }
-        const payload = JSON.stringify({ pages: output, siteConfig: config }, null, 2) + "\n";
-        await writeFile(filePath, payload, "utf8");
+        const body = options?.shape === "wrapper" ? { pages: output, siteConfig: config } : output;
+        await writeFile(filePath, JSON.stringify(body, null, 2) + "\n", "utf8");
         return { ok: true };
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avocadostudio-ai/site-sdk",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -147,17 +147,17 @@
   ],
   "dependencies": {
     "zod": "^4.3.6",
-    "@avocadostudio-ai/preview-adapter": "^0.10.0",
-    "@avocadostudio-ai/blocks": "^0.10.0",
-    "@avocadostudio-ai/richtext": "^0.10.0",
-    "@avocadostudio-ai/shared": "^0.10.0"
+    "@avocadostudio-ai/preview-adapter": "^0.11.0",
+    "@avocadostudio-ai/shared": "^0.11.0",
+    "@avocadostudio-ai/richtext": "^0.11.0",
+    "@avocadostudio-ai/blocks": "^0.11.0"
   },
   "peerDependencies": {
     "next": ">=15.0.0",
     "react": ">=19.0.0",
     "react-dom": ">=19.0.0",
     "better-sqlite3": ">=12.0.0",
-    "@avocadostudio-ai/orchestrator-core": "^0.10.0"
+    "@avocadostudio-ai/orchestrator-core": "^0.11.0"
   },
   "peerDependenciesMeta": {
     "@avocadostudio-ai/orchestrator-core": {