@bettercms-ai/astro 0.5.0 → 0.6.1

package/README.md

@@ -109,7 +109,7 @@ or on-demand-revalidation hook.
 
 | Component | Purpose |
 | --- | --- |
-| `@bettercms-ai/astro/components/BcmsBlocks.astro` | Render a page's `blockJson` (all 8 block types). |
+| `@bettercms-ai/astro/components/BcmsBlocks.astro` | Render a page's `blockJson` — every block type the builder can author (heading, text/richtext, image, button, spacer, video, columns, form, section, navbar, footer, slider, tabs, component), with block style tokens applied. |
 | `@bettercms-ai/astro/components/BcmsForm.astro` | Render + submit a form (conditional fields, honeypot, Turnstile). |
 | `@bettercms-ai/astro/components/BcmsImage.astro` | Optimized image with a 1x/2x srcset via the media transform endpoint. |
 

package/components/BcmsBlocks.astro

@@ -1,18 +1,32 @@
 ---
 /**
- * <BcmsBlocks> — renders a page's blockJson tree natively in Astro. Covers
- * heading, text, image, button, spacer, video, columns, form and `component`,
- * with `columns` and `component` recursing via Astro.self and `form`/`component`
- * resolving from the `forms`/`components` props. Class names mirror the
- * server-side renderer.
+ * <BcmsBlocks> — renders a page's blockJson tree natively in Astro, at parity with
+ * the React twin in @bettercms-ai/next and with the hosted renderer
+ * (src/lib/sites/render-page.ts). Every block type the Visual Editor can produce is
+ * covered: heading, text/richtext, image, button, spacer, video, columns, form,
+ * section, navbar, footer, slider, tabs and component.
  *
- * `component` was previously absent, so every placed component instance hit
- * `default: return null` — a silently blank section on Astro sites while the
- * dashboard canvas and the Next adapter both rendered it. Resolution mirrors
- * render-page.ts: the same shared `applyOverrides`, the same depth/cycle guard,
- * the same fail-soft on a missing definition.
+ * Anything NOT in the switch fell through to `default: null` — a silently blank
+ * region on an Astro site for a page that looked correct on the builder canvas and
+ * on a Next site. `section`, `navbar`, `footer`, `slider`, `tabs` and `richtext`
+ * were all in that hole.
+ *
+ * Style tokens (FLO-264) are applied through the SAME `blockStyleToCss` the Next
+ * adapter and the builder canvas use, so a block's padding/colour/alignment lands
+ * identically on all three surfaces instead of being dropped on Astro only.
+ *
+ * Class names mirror the hosted renderer (`bcms-text`, `bcms-btn-*`, `bcms-cols`,
+ * `bcms-section`, `bcms-slider`, …) — that has been this component's convention
+ * since it was written, and the starters' CSS is keyed off it (it `:is()`-covers
+ * both the Astro and the Next spellings).
+ *
+ * `slider` and `tabs` carry runtime behaviour. Astro has no client component model
+ * to lean on here, so they ship the same vanilla, zero-dependency scripts the hosted
+ * renderer ships — inlined once per top-level <BcmsBlocks>, and only when the tree
+ * actually contains that block (mirrors render-page.ts's `ctx.flags` gating).
  */
 import type { ContentBlock } from "@bettercms-ai/types";
+import { blockStyleToCss } from "@bettercms-ai/types";
 import type { DeliveryComponent, DeliveryForm } from "@bettercms-ai/sdk";
 import { applyOverrides } from "@bettercms-ai/ui/resolve";
 import BcmsImage from "./BcmsImage.astro";
@@ -29,6 +43,9 @@ interface Props {
   depth?: number;
   /** Component ids already on this branch — cycle guard. Internal; do not pass. */
   seen?: string[];
+  /** Set on every self-recursion so only the outermost instance emits the runtime
+   *  scripts. Internal; do not pass. */
+  nested?: boolean;
   class?: string;
 }
 
@@ -42,6 +59,7 @@ const {
   turnstileSiteKey,
   depth = 0,
   seen = [],
+  nested = false,
   class: className,
 } = Astro.props;
 const formMap = new Map(forms.map((f) => [f.id, f]));
@@ -49,17 +67,90 @@ const componentMap = new Map(components.map((c) => [c.id, c]));
 
 const clamp = (n: number, min: number, max: number) => Math.min(max, Math.max(min, n));
 const anyProps = (b: ContentBlock) => (b as { props?: Record<string, any> }).props ?? {};
+const arr = (v: unknown): any[] => (Array.isArray(v) ? v : []);
+
+/**
+ * `blockStyleToCss` returns a React-style declaration object (camelCase keys); Astro's
+ * `style` attribute wants a string. Same token set in ⇒ same pixels out as Next.
+ */
+function styleAttr(block: ContentBlock): string | undefined {
+  const css = blockStyleToCss((block as { style?: any }).style);
+  if (!css) return undefined;
+  return Object.entries(css)
+    .map(([k, v]) => `${k.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`)}:${v}`)
+    .join(";");
+}
+
+/**
+ * Resolve a `component` block to the blocks it stands for. Returns null to fail soft on a
+ * deleted/unknown definition (exactly like the server renderer — a dangling reference must
+ * never break the build), and on the depth/cycle guard: a component's blockJson can embed
+ * other components and nothing validates against a cycle at write time.
+ *
+ * Lives in the frontmatter, not the template, because the Astro compiler parses `<T>` in a
+ * template expression as JSX — `applyOverrides<ContentBlock>(…)` inline emitted a bogus
+ * `<ContentBlock>` element and the file failed to compile at all.
+ */
+function resolveComponent(p: Record<string, any>): { id: string; blocks: ContentBlock[] } | null {
+  const def = componentMap.get(String(p.componentId ?? ""));
+  if (!def) return null;
+  if (depth >= MAX_COMPONENT_DEPTH || seen.includes(def.id)) return null;
+  const resolved = applyOverrides<ContentBlock>(
+    def.blockJson,
+    def.props ?? [],
+    (p.overrides as Record<string, unknown>) ?? {},
+  );
+  return { id: def.id, blocks: resolved };
+}
+
+/**
+ * Depth-limited scan for a block type anywhere in the tree, components included, so the
+ * slider/tabs runtimes only ship on pages that use them — the same gating render-page.ts
+ * does with `ctx.flags`.
+ */
+function containsType(list: unknown, type: string, d = 0, chain: string[] = []): boolean {
+  if (d > MAX_COMPONENT_DEPTH) return false;
+  for (const b of arr(list)) {
+    if (!b || typeof b !== "object") continue;
+    if (b.type === type) return true;
+    const p = b.props ?? {};
+    if (b.type === "component") {
+      const def = componentMap.get(String(p.componentId ?? ""));
+      if (def && !chain.includes(def.id) && containsType(def.blockJson, type, d + 1, [...chain, def.id])) return true;
+      continue;
+    }
+    const kids = [
+      ...arr(p.children),
+      ...arr(p.columns).flatMap((c: unknown) => arr(c)),
+      ...arr(p.slides).flatMap((s: any) => arr(s?.children)),
+      ...arr(p.tabs).flatMap((t: any) => arr(t?.children)),
+    ];
+    if (containsType(kids, type, d, chain)) return true;
+  }
+  return false;
+}
+
+const needsSlider = !nested && containsType(blocks, "slider");
+const needsTabs = !nested && containsType(blocks, "tabs");
+
+/** Props every self-recursion forwards unchanged. */
+const pass = { forms, components, turnstileSiteKey, nested: true };
 ---
 
 <div class={className}>
   {blocks.map((block) => {
     const p = anyProps(block);
+    const style = styleAttr(block);
+    const node = (() => {
     switch (block.type) {
       case "heading": {
         const Tag = `h${clamp(Number(p.level) || 2, 1, 6)}` as keyof HTMLElementTagNameMap;
         return <Tag data-bcms-field={`${block.id}__text`}>{p.text}</Tag>;
       }
+      // `richtext` and `text` carry the same payload and differ only in the authoring
+      // surface, so delivery renders them identically — the hosted renderer does the same.
       case "text":
+      case "richtext":
         return <div class="bcms-text" data-bcms-field={`${block.id}__html`} data-bcms-kind="richtext" set:html={p.html ?? ""} />;
       case "image": {
         // Matches the Next adapter: the image block is click-to-select on the Visual Editor
@@ -96,14 +187,7 @@ const anyProps = (b: ContentBlock) => (b as { props?: Record<string, any> }).pro
           >
             {cols.map((col) => (
               <div class="bcms-col">
-                <Astro.self
-                  blocks={col}
-                  forms={forms}
-                  components={components}
-                  turnstileSiteKey={turnstileSiteKey}
-                  depth={depth}
-                  seen={seen}
-                />
+                <Astro.self blocks={col} depth={depth} seen={seen} {...pass} />
               </div>
             ))}
           </div>
@@ -113,32 +197,150 @@ const anyProps = (b: ContentBlock) => (b as { props?: Record<string, any> }).pro
         const form = formMap.get(p.formId);
         return form ? <BcmsForm form={form} turnstileSiteKey={turnstileSiteKey} /> : null;
       }
-      case "component": {
-        const def = componentMap.get(String(p.componentId ?? ""));
-        // Fail soft on a deleted/unknown component, exactly like the server renderer —
-        // a dangling reference must never break the build or the page.
-        if (!def) return null;
-        // A component's blockJson can embed other components, and nothing validates
-        // against a cycle at write time, so the guard has to live at render.
-        if (depth >= MAX_COMPONENT_DEPTH || seen.includes(def.id)) return null;
-        const resolved = applyOverrides<ContentBlock>(
-          def.blockJson,
-          def.props ?? [],
-          (p.overrides as Record<string, unknown>) ?? {},
+      case "section": {
+        const inner = <Astro.self blocks={arr(p.children)} depth={depth} seen={seen} {...pass} />;
+        const mw = Number(p.maxWidth) || 0;
+        return (
+          <section
+            class="bcms-section"
+            style={[
+              p.background ? `background:${p.background}` : "",
+              p.paddingY != null ? `padding:${Number(p.paddingY) || 0}px 0` : "",
+            ].filter(Boolean).join(";") || undefined}
+          >
+            {mw ? <div class="bcms-section-inner" style={`max-width:${mw}px;margin:0 auto`}>{inner}</div> : inner}
+          </section>
+        );
+      }
+      case "navbar": {
+        const logo = p.logo && typeof p.logo === "object" ? p.logo : null;
+        return (
+          <nav class="bcms-navbar">
+            {logo?.src ? (
+              <a class="bcms-navbar-logo" href={logo.href ?? "/"}>
+                <img src={logo.src} alt={logo.alt ?? ""} />
+              </a>
+            ) : null}
+            <div class="bcms-navbar-links">
+              {arr(p.links).map((l: any) => <a href={l?.href ?? "#"}>{l?.label ?? ""}</a>)}
+            </div>
+            {p.cta?.text ? <a class="bcms-btn bcms-btn-primary" href={p.cta.href ?? "#"}>{p.cta.text}</a> : null}
+          </nav>
+        );
+      }
+      case "footer":
+        return (
+          <footer class="bcms-footer">
+            <div class="bcms-footer-cols">
+              {arr(p.columns).map((col: any) => (
+                <div class="bcms-footer-col">
+                  {col?.heading ? <h4>{col.heading}</h4> : null}
+                  <ul>
+                    {arr(col?.links).map((l: any) => <li><a href={l?.href ?? "#"}>{l?.label ?? ""}</a></li>)}
+                  </ul>
+                </div>
+              ))}
+            </div>
+            {p.copyright ? <p class="bcms-footer-copy">{p.copyright}</p> : null}
+          </footer>
+        );
+      case "slider":
+        // `hidden` on the inactive slides — NOT just the `data-active` hook the hosted
+        // renderer uses — because that renderer ships BASE_CSS with it and this package
+        // ships no CSS at all. Without it every slide would stack on an unstyled host.
+        // The script keeps both in sync so `.bcms-slide[data-active]` CSS still works.
+        return (
+          <div
+            class="bcms-slider"
+            data-bcms-slider
+            data-autoplay={p.autoplay ? String(Number(p.interval) || 5000) : undefined}
+            data-loop={p.loop ? "" : undefined}
+          >
+            <div class="bcms-slides">
+              {arr(p.slides).map((s: any, i: number) => (
+                <div class="bcms-slide" data-active={i === 0 ? "" : undefined} hidden={i !== 0}>
+                  <Astro.self blocks={arr(s?.children)} depth={depth} seen={seen} {...pass} />
+                </div>
+              ))}
+            </div>
+            <button class="bcms-slider-prev" data-prev aria-label="Previous">&#8249;</button>
+            <button class="bcms-slider-next" data-next aria-label="Next">&#8250;</button>
+          </div>
         );
+      case "tabs":
         return (
-          <Astro.self
-            blocks={resolved}
-            forms={forms}
-            components={components}
-            turnstileSiteKey={turnstileSiteKey}
-            depth={depth + 1}
-            seen={[...seen, def.id]}
-          />
+          <div class="bcms-tabs" data-bcms-tabs>
+            <div class="bcms-tablist" role="tablist">
+              {arr(p.tabs).map((t: any, i: number) => (
+                <button role="tab" class="bcms-tab" aria-selected={i === 0 ? "true" : "false"} data-tab={String(i)}>
+                  {t?.label ?? ""}
+                </button>
+              ))}
+            </div>
+            {arr(p.tabs).map((t: any, i: number) => (
+              <div role="tabpanel" class="bcms-tabpanel" data-panel={String(i)} hidden={i !== 0}>
+                <Astro.self blocks={arr(t?.children)} depth={depth} seen={seen} {...pass} />
+              </div>
+            ))}
+          </div>
         );
+      case "component": {
+        const resolved = resolveComponent(p);
+        if (!resolved) return null;
+        return <Astro.self blocks={resolved.blocks} depth={depth + 1} seen={[...seen, resolved.id]} {...pass} />;
       }
       default:
         return null;
     }
+    })();
+    // FLO-264: honour the block's bounded style tokens here too, so Astro output matches
+    // the builder canvas, the Next adapter and the hosted site.
+    return style && node != null ? <div style={style}>{node}</div> : node;
   })}
 </div>
+
+{needsSlider && (
+  <script is:inline>
+    // Vanilla prev/next + optional autoplay, mirroring render-page.ts's SLIDER_SCRIPT.
+    // `bcmsSliderBound` makes binding idempotent: two top-level <BcmsBlocks> on one page
+    // each inline a copy, and every copy sees every slider (the same footgun that had
+    // <BcmsForm> submitting twice).
+    document.querySelectorAll("[data-bcms-slider]").forEach(function (root) {
+      if (root.dataset.bcmsSliderBound) return;
+      root.dataset.bcmsSliderBound = "1";
+      var slides = root.querySelectorAll(".bcms-slide");
+      if (!slides.length) return;
+      var i = 0;
+      function show(n) {
+        i = (n + slides.length) % slides.length;
+        slides.forEach(function (s, k) {
+          if (k === i) { s.setAttribute("data-active", ""); s.removeAttribute("hidden"); }
+          else { s.removeAttribute("data-active"); s.setAttribute("hidden", ""); }
+        });
+      }
+      var prev = root.querySelector("[data-prev]"), next = root.querySelector("[data-next]");
+      if (prev) prev.addEventListener("click", function () { show(i - 1); });
+      if (next) next.addEventListener("click", function () { show(i + 1); });
+      var ms = parseInt(root.getAttribute("data-autoplay") || "0", 10);
+      if (ms > 0) setInterval(function () { show(i + 1); }, ms);
+    });
+  </script>
+)}
+
+{needsTabs && (
+  <script is:inline>
+    // Toggles aria-selected + panel visibility, mirroring render-page.ts's TABS_SCRIPT.
+    // Idempotent for the same reason as the slider runtime above.
+    document.querySelectorAll("[data-bcms-tabs]").forEach(function (root) {
+      if (root.dataset.bcmsTabsBound) return;
+      root.dataset.bcmsTabsBound = "1";
+      var tabs = root.querySelectorAll("[role=tab]"), panels = root.querySelectorAll("[role=tabpanel]");
+      tabs.forEach(function (tab, idx) {
+        tab.addEventListener("click", function () {
+          tabs.forEach(function (t, k) { t.setAttribute("aria-selected", k === idx ? "true" : "false"); });
+          panels.forEach(function (pan, k) { if (k === idx) { pan.removeAttribute("hidden"); } else { pan.setAttribute("hidden", ""); } });
+        });
+      });
+    });
+  </script>
+)}

package/components/BcmsForm.astro

@@ -30,27 +30,67 @@ const INPUT_TYPE: Partial<Record<DeliveryFormField["type"], string>> = {
 const showTurnstile = Boolean(form.turnstileEnabled && turnstileSiteKey);
 ---
 
-<form class={`bcms-form${className ? ` ${className}` : ""}`} method="post" action={action} data-bcms-form>
+<form
+  class={`bcms-form${className ? ` ${className}` : ""}`}
+  method="post"
+  action={action}
+  data-bcms-form={form.id}
+  data-bcms-form-success={form.successMessage ?? "Thanks!"}
+  data-bcms-form-redirect={form.redirectUrl ?? ""}
+>
   {form.fields?.map((f) => {
-    const wrapAttrs = f.showIf ? { "data-bcms-showif": JSON.stringify(f.showIf) } : {};
+    const wrapAttrs = {
+      "data-bcms-form-field": f.key,
+      ...(f.showIf ? { "data-bcms-showif": JSON.stringify(f.showIf) } : {}),
+    };
+    // Every author-editable string carries a `data-bcms-form-part` so the Visual Editor can
+    // repaint it live. A string the dock can edit but cannot mark shows stale on the canvas.
+    const help = f.helpText
+      ? <span class="bcms-field-help" data-bcms-form-part="help">{f.helpText}</span>
+      : null;
     if (f.type === "hidden") return <input type="hidden" name={f.key} value={f.defaultValue ?? ""} />;
     if (f.type === "checkbox" || f.type === "consent")
       return (
         <label class="bcms-check" {...wrapAttrs}>
           <input type="checkbox" name={f.key} required={f.required} />
-          <span>{f.label}</span>
+          {/* The ` *` marker is emitted for EVERY field type, by every renderer — the
+              Visual Editor's live patch rewrites this span as `label + marker`, so a
+              renderer that omitted it would drop the star on edit and grow one back on
+              the next reload. */}
+          <span data-bcms-form-part="label">{f.label}{f.required ? " *" : ""}</span>
+          {help}
         </label>
       );
+    // Pick-one / pick-many are option GROUPS. Without this branch both fell through
+    // to the `<input type={INPUT_TYPE[f.type] ?? "text"}>` below and shipped as a
+    // single-line text box on every Astro site.
+    if (f.type === "radio" || f.type === "checkboxes") {
+      const multi = f.type === "checkboxes";
+      return (
+        <fieldset class={`bcms-field bcms-field--${multi ? "checkboxes" : "radio"}`} {...wrapAttrs}>
+          <legend data-bcms-form-part="label">{f.label}{f.required ? " *" : ""}</legend>
+          {(f.options ?? []).map((o) => (
+            <label class="bcms-option">
+              {/* `required` on each radio is the native "pick one"; on checkboxes it
+                  would demand every box, so the API enforces non-empty instead. */}
+              <input type={multi ? "checkbox" : "radio"} name={f.key} value={o} required={!multi && f.required} />
+              <span data-bcms-form-part="option">{o}</span>
+            </label>
+          ))}
+          {help}
+        </fieldset>
+      );
+    }
     return (
       <div class="bcms-field" {...wrapAttrs}>
-        <label for={`bcms-f-${f.key}`}>{f.label}{f.required ? " *" : ""}</label>
+        <label for={`bcms-f-${f.key}`} data-bcms-form-part="label">{f.label}{f.required ? " *" : ""}</label>
         {f.type === "textarea" ? (
           <textarea id={`bcms-f-${f.key}`} name={f.key} placeholder={f.placeholder} required={f.required}>
             {f.defaultValue ?? ""}
           </textarea>
         ) : f.type === "select" ? (
           <select id={`bcms-f-${f.key}`} name={f.key} required={f.required}>
-            {(f.options ?? []).map((o) => <option value={o}>{o}</option>)}
+            {(f.options ?? []).map((o) => <option value={o} data-bcms-form-part="option">{o}</option>)}
           </select>
         ) : (
           <input
@@ -62,6 +102,7 @@ const showTurnstile = Boolean(form.turnstileEnabled && turnstileSiteKey);
             required={f.required}
           />
         )}
+        {help}
       </div>
     );
   })}
@@ -78,12 +119,19 @@ const showTurnstile = Boolean(form.turnstileEnabled && turnstileSiteKey);
 
 {showTurnstile && <script is:inline src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>}
 
-<script is:inline data-bcms-form-success={form.successMessage ?? "Thanks!"} data-bcms-form-redirect={form.redirectUrl ?? ""}>
+<script is:inline>
+  // One copy of this script ships per <BcmsForm> instance, and each copy sees EVERY
+  // form on the page — so two forms meant four bindings and a double submit. The
+  // `bcmsFormBound` flag makes binding idempotent no matter how many copies run,
+  // and the success/redirect config now lives on the FORM rather than on the script
+  // element, so form A's script can no longer apply form B's success message.
   document.querySelectorAll("form[data-bcms-form]").forEach((form) => {
+    if (form.dataset.bcmsFormBound) return;
+    form.dataset.bcmsFormBound = "1";
+
     const msg = form.querySelector(".bcms-form-msg");
-    const cfg = document.currentScript;
-    const successMsg = cfg?.getAttribute("data-bcms-form-success") || "Thanks!";
-    const redirect = cfg?.getAttribute("data-bcms-form-redirect") || "";
+    const successMsg = form.getAttribute("data-bcms-form-success") || "Thanks!";
+    const redirect = form.getAttribute("data-bcms-form-redirect") || "";
 
     // Conditional fields: show/hide based on another field's value.
     const conds = form.querySelectorAll("[data-bcms-showif]");
@@ -92,7 +140,17 @@ const showTurnstile = Boolean(form.turnstileEnabled && turnstileSiteKey);
         try {
           const { field, equals } = JSON.parse(el.getAttribute("data-bcms-showif"));
           const input = form.elements[field];
-          const val = input && input.type === "checkbox" ? (input.checked ? "true" : "false") : input?.value;
+          // A radio/checkboxes group resolves to a RadioNodeList, which has no `.type`
+          // and whose `.value` is "" for checkbox groups — read the checked members.
+          let val;
+          if (input instanceof RadioNodeList) {
+            const checked = Array.from(input).filter((el) => el.checked).map((el) => el.value);
+            val = checked.includes(equals) ? equals : checked[0];
+          } else if (input && input.type === "checkbox") {
+            val = input.checked ? "true" : "false";
+          } else {
+            val = input?.value;
+          }
           el.style.display = val === equals ? "" : "none";
         } catch {}
       });
@@ -102,8 +160,17 @@ const showTurnstile = Boolean(form.turnstileEnabled && turnstileSiteKey);
 
     form.addEventListener("submit", async (e) => {
       e.preventDefault();
+      // A `checkboxes` group posts one FormData entry PER checked box under the same
+      // name; assigning them one at a time kept only the last. Collect repeats into
+      // an array, which is the shape the API and every other renderer expect.
       const data = {};
-      new FormData(form).forEach((v, k) => { data[k] = v; });
+      new FormData(form).forEach((v, k) => {
+        // Turnstile's token is a protocol field, not a form answer — the API reads it
+        // from the envelope. Leaving it inside `data` stored it as a submission column.
+        if (k === "cf-turnstile-response") return;
+        if (k in data) data[k] = Array.isArray(data[k]) ? [...data[k], v] : [data[k], v];
+        else data[k] = v;
+      });
       const tsEl = form.querySelector('[name="cf-turnstile-response"]');
       const body = { data };
       if (tsEl?.value) body["cf-turnstile-response"] = tsEl.value;
@@ -116,6 +183,7 @@ const showTurnstile = Boolean(form.turnstileEnabled && turnstileSiteKey);
         if (!res.ok) throw new Error(String(res.status));
         if (redirect) { window.location.href = redirect; return; }
         form.reset();
+        applyConds();
         if (msg) { msg.textContent = successMsg; msg.hidden = false; }
       } catch {
         if (msg) { msg.textContent = "Something went wrong. Please try again."; msg.hidden = false; }

package/components/BcmsImage.astro

@@ -5,6 +5,7 @@
  */
 import config from "bettercms:config";
 import imageUrlBuilder, {
+  objectPosition,
   type ImageSource,
   type ImageFormat,
   type ImageFit,
@@ -21,6 +22,13 @@ interface Props {
   sizes?: string;
   loading?: "lazy" | "eager";
   class?: string;
+  /**
+   * Focal point override, 0–1. Normally omitted — the asset carries its own and the
+   * server applies it. Pass a MediaAsset with focalX/focalY as `src` and it is picked
+   * up automatically.
+   */
+  focalX?: number | null;
+  focalY?: number | null;
   /** Any other attribute (e.g. `data-bcms-field`) is forwarded to the <img>. */
   [attr: string]: unknown;
 }
@@ -36,9 +44,18 @@ const {
   sizes,
   loading = "lazy",
   class: className,
+  focalX,
+  focalY,
+  style,
   ...rest
 } = Astro.props;
 
+// An explicit prop wins; otherwise take whatever the asset object carries.
+const asset = (typeof src === "object" && src !== null ? src : {}) as Record<string, unknown>;
+const fx = focalX ?? (asset.focalX as number | null | undefined);
+const fy = focalY ?? (asset.focalY as number | null | undefined);
+const hasFocal = fx != null || fy != null;
+
 const builder = imageUrlBuilder({ baseUrl: config.mediaUrl });
 const make = () => {
   let b = builder(src);
@@ -47,11 +64,19 @@ const make = () => {
   if (format) b = b.format(format);
   if (quality) b = b.quality(quality);
   if (fit) b = b.fit(fit);
+  if (hasFocal) b = b.focal(fx ?? 0.5, fy ?? 0.5);
   return b;
 };
 
 const src1x = make().url();
 const src2x = make().dpr(2).url();
+
+// The CSS half of the same idea, and it is free. When only one dimension is pinned the
+// server does not crop, so the browser does — and `object-position` keeps the subject in
+// frame there too, but only if the stylesheet actually set `object-fit: cover`. Emitting
+// it unconditionally is harmless: `object-position` is inert without `object-fit`.
+const focalStyle = hasFocal ? `object-position:${objectPosition({ x: fx, y: fy })}` : "";
+const mergedStyle = [focalStyle, typeof style === "string" ? style : ""].filter(Boolean).join(";");
 ---
 
 <img
@@ -63,5 +88,6 @@ const src2x = make().dpr(2).url();
   sizes={sizes}
   loading={loading}
   class={className}
+  style={mergedStyle || undefined}
   {...rest}
 />

package/components/BcmsLive.astro

@@ -1,20 +1,51 @@
 ---
 /**
  * <BcmsLive> — opens the BetterCMS delivery live SSE stream in the browser and
- * reloads the page on every content change (dev + draft preview). Drop it once,
- * e.g. in your layout. Build `src` with `liveSrc({ apiUrl, workspace, apiKey })`
- * from `@bettercms-ai/astro` (use a content:read key — it is browser-exposed).
+ * keeps the page current. Drop it once, e.g. in your layout. Build `src` with
+ * `liveSrc({ apiUrl, workspace, apiKey })` from `@bettercms-ai/astro` (use a
+ * content:read key — it is browser-exposed).
+ *
+ * Every change frame is dispatched on `window` as a cancelable `bcms:change`
+ * CustomEvent whose `detail` is the frame — including `detail.doc`, the finished
+ * delivery document the server already hydrated for you. Patch the DOM from it
+ * and call `preventDefault()` to keep the page as it is:
+ *
+ *   window.addEventListener("bcms:change", (e) => {
+ *     if (e.detail.slug !== "home") return;
+ *     document.querySelector("h1").textContent = e.detail.doc.data.title;
+ *     e.preventDefault();          // handled — skip the reload
+ *   });
+ *
+ * Nothing handles it → the page reloads, as it always did. That fallback is why
+ * this is safe to drop into an existing site unchanged.
+ *
+ * `tags` narrows which changes count at all. Without it a publish anywhere in the
+ * workspace reloads every open tab, including pages that render none of it.
  */
 interface Props {
   src: string;
+  /** Only react to changes carrying one of these tags. Omit = react to all. */
+  tags?: string[];
 }
-const { src } = Astro.props;
+const { src, tags } = Astro.props;
 ---
 
-<script is:inline define:vars={{ src }}>
+<script is:inline define:vars={{ src, tags }}>
   try {
     const es = new EventSource(src);
-    es.addEventListener("change", () => window.location.reload());
+    es.addEventListener("change", (e) => {
+      let detail;
+      try {
+        detail = JSON.parse(e.data);
+      } catch {
+        return;
+      }
+      if (tags?.length && !detail.tags?.some((t) => tags.includes(t))) return;
+      const handled = !window.dispatchEvent(
+        new CustomEvent("bcms:change", { detail, cancelable: true }),
+      );
+      if (!handled) window.location.reload();
+    });
   } catch (e) {
     /* EventSource unsupported — no live refresh */
   }

package/dist/index.d.ts

@@ -8,6 +8,11 @@ export { DeliveryForm, DeliveryFormField, ResolvedSeo, SeoInput, resolveSeo } fr
  * Resolved configuration shared by the integration, runtime, middleware and
  * draft routes. Public values are safe to ship to the browser; the API key and
  * draft secret are read from server env at runtime and never live here.
+ *
+ * Resolution order is options → `PUBLIC_BCMS_*` env → the build snapshot. Config-time
+ * only: this module is reached exclusively through `dist/index.js`, which only an
+ * `astro.config.*` imports, so the `node:fs` read below never enters a client bundle.
+ * Browser code gets the `bettercms:config` virtual module instead.
  */
 declare const DRAFT_COOKIE = "bcms-draft";
 interface BetterCMSAstroOptions {
@@ -36,8 +41,11 @@ interface PublicConfig {
 interface ResolvedConfig extends PublicConfig {
     draft: boolean;
 }
-/** Merge integration options with `PUBLIC_BCMS_*` env, validating the essentials. */
-declare function resolveConfig(options: BetterCMSAstroOptions, env?: Record<string, string | undefined>): ResolvedConfig;
+/**
+ * Merge integration options with `PUBLIC_BCMS_*` env and the build snapshot, validating the
+ * essentials. Precedence: explicit options → env → snapshot.
+ */
+declare function resolveConfig(options: BetterCMSAstroOptions, env?: Record<string, string | undefined>, cwd?: string): ResolvedConfig;
 
 /**
  * `bettercms()` — the Astro integration.

package/dist/index.js

@@ -1,15 +1,36 @@
 // src/config.ts
+import { readFileSync } from "fs";
+import { resolve } from "path";
 var DEFAULT_MEDIA_URL = "https://media.bettercms.ai";
+var SNAPSHOT_FILE = "bcms-content.json";
 var DRAFT_COOKIE = "bcms-draft";
-function resolveConfig(options, env = process.env) {
-  const apiUrl = (options.apiUrl ?? env.PUBLIC_BCMS_API_URL ?? "").replace(/\/+$/, "");
-  const workspace = options.workspace ?? env.PUBLIC_BCMS_WORKSPACE ?? "";
-  if (!apiUrl) throw new Error("[@bettercms-ai/astro] `apiUrl` (or PUBLIC_BCMS_API_URL) is required");
-  if (!workspace) throw new Error("[@bettercms-ai/astro] `workspace` (or PUBLIC_BCMS_WORKSPACE) is required");
+var snapshotCache;
+function snapshot(cwd) {
+  if (snapshotCache === void 0) {
+    try {
+      snapshotCache = JSON.parse(readFileSync(resolve(cwd, SNAPSHOT_FILE), "utf8"));
+    } catch {
+      snapshotCache = {};
+    }
+  }
+  return snapshotCache;
+}
+var required = (name, envVar, extra) => new Error(
+  `[@bettercms-ai/astro] \`${name}\` is required. Pass \`bettercms({ ${name} })\`, set ${envVar}, or ${extra}
+On BetterCMS hosting these are injected automatically \u2014 if this failed in a hosted build, the repository is running an outdated deploy workflow: publish once, or save Hosting settings, to refresh it.`
+);
+function resolveConfig(options, env = process.env, cwd = process.cwd()) {
+  const snap = () => snapshot(cwd);
+  const apiUrl = (options.apiUrl ?? env.PUBLIC_BCMS_API_URL ?? snap().apiUrl ?? "").replace(/\/+$/, "");
+  const workspace = options.workspace ?? env.PUBLIC_BCMS_WORKSPACE ?? snap().workspace ?? "";
+  if (!apiUrl) throw required("apiUrl", "PUBLIC_BCMS_API_URL", `run the content fetch so ${SNAPSHOT_FILE} is present.`);
+  if (!workspace) {
+    throw required("workspace", "PUBLIC_BCMS_WORKSPACE", `run the content fetch so ${SNAPSHOT_FILE} is present.`);
+  }
   return {
     apiUrl,
     workspace,
-    projectId: options.projectId ?? env.PUBLIC_BCMS_PROJECT_ID,
+    projectId: options.projectId ?? env.PUBLIC_BCMS_PROJECT_ID ?? snap().projectId,
     mediaUrl: (options.mediaUrl ?? env.PUBLIC_BCMS_MEDIA_URL ?? DEFAULT_MEDIA_URL).replace(/\/+$/, ""),
     studioUrl: options.studioUrl ?? env.PUBLIC_BCMS_STUDIO_URL,
     draftCookie: DRAFT_COOKIE,
@@ -93,7 +114,10 @@ var integration_default = bettercms;
 import { createClient } from "@bettercms-ai/sdk";
 function liveSrc(opts) {
   const base = opts.apiUrl.replace(/\/+$/, "");
-  return `${base}/api/v1/delivery/${opts.workspace}/live?key=${encodeURIComponent(opts.apiKey)}`;
+  const q = new URLSearchParams({ key: opts.apiKey });
+  if (opts.depth !== void 0) q.set("depth", String(opts.depth));
+  if (opts.drafts) q.set("drafts", "1");
+  return `${base}/api/v1/delivery/${opts.workspace}/live?${q}`;
 }
 var enc = new TextEncoder();
 

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts","../src/integration.ts","../src/runtime.ts","../src/index.ts"],"sourcesContent":["/**\n * Resolved configuration shared by the integration, runtime, middleware and\n * draft routes. Public values are safe to ship to the browser; the API key and\n * draft secret are read from server env at runtime and never live here.\n */\n\nconst DEFAULT_MEDIA_URL = \"https://media.bettercms.ai\";\nexport const DRAFT_COOKIE = \"bcms-draft\";\n\nexport interface BetterCMSAstroOptions {\n  /** Backend base, e.g. `https://api.bettercms.ai`. Falls back to `PUBLIC_BCMS_API_URL`. */\n  apiUrl?: string;\n  /** Workspace slug. Falls back to `PUBLIC_BCMS_WORKSPACE`. */\n  workspace?: string;\n  /** Optional project scope for forms. Falls back to `PUBLIC_BCMS_PROJECT_ID`. */\n  projectId?: string;\n  /** Media host for the image-url builder. Defaults to the prod media host. */\n  mediaUrl?: string;\n  /** Dashboard base for visual-editing deep links. */\n  studioUrl?: string;\n  /** Enable the draft-mode middleware + injected draft routes. Default true. */\n  draft?: boolean;\n}\n\n/** Browser-safe config — exposed via the `bettercms:config` virtual module. */\nexport interface PublicConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  mediaUrl: string;\n  studioUrl?: string;\n  draftCookie: string;\n}\n\nexport interface ResolvedConfig extends PublicConfig {\n  draft: boolean;\n}\n\n/** Merge integration options with `PUBLIC_BCMS_*` env, validating the essentials. */\nexport function resolveConfig(\n  options: BetterCMSAstroOptions,\n  env: Record<string, string | undefined> = process.env,\n): ResolvedConfig {\n  const apiUrl = (options.apiUrl ?? env.PUBLIC_BCMS_API_URL ?? \"\").replace(/\\/+$/, \"\");\n  const workspace = options.workspace ?? env.PUBLIC_BCMS_WORKSPACE ?? \"\";\n  if (!apiUrl) throw new Error(\"[@bettercms-ai/astro] `apiUrl` (or PUBLIC_BCMS_API_URL) is required\");\n  if (!workspace) throw new Error(\"[@bettercms-ai/astro] `workspace` (or PUBLIC_BCMS_WORKSPACE) is required\");\n\n  return {\n    apiUrl,\n    workspace,\n    projectId: options.projectId ?? env.PUBLIC_BCMS_PROJECT_ID,\n    mediaUrl: (options.mediaUrl ?? env.PUBLIC_BCMS_MEDIA_URL ?? DEFAULT_MEDIA_URL).replace(/\\/+$/, \"\"),\n    studioUrl: options.studioUrl ?? env.PUBLIC_BCMS_STUDIO_URL,\n    draftCookie: DRAFT_COOKIE,\n    draft: options.draft ?? true,\n  };\n}\n\nexport function toPublicConfig(c: ResolvedConfig): PublicConfig {\n  const { draft: _draft, ...pub } = c;\n  return pub;\n}\n","/**\n * `bettercms()` — the Astro integration.\n *\n * - Registers two virtual modules:\n *     `bettercms:client`  → server runtime (client + typed loaders) — has the key.\n *     `bettercms:config`  → browser-safe public config — no secrets.\n * - Adds the draft-mode middleware and injects the draft enable/disable routes.\n */\nimport type { AstroIntegration } from \"astro\";\nimport {\n  resolveConfig,\n  toPublicConfig,\n  type BetterCMSAstroOptions,\n  type ResolvedConfig,\n} from \"./config.js\";\n\nconst CLIENT_ID = \"bettercms:client\";\nconst CONFIG_ID = \"bettercms:config\";\nconst RESOLVED = (id: string) => `\\0${id}`;\n\nfunction configModule(cfg: ResolvedConfig): string {\n  return `export const config = ${JSON.stringify(toPublicConfig(cfg))};\\nexport default config;\\n`;\n}\n\nfunction clientModule(cfg: ResolvedConfig): string {\n  // The key is read from server env at runtime so it never lands in a client\n  // bundle. Public values are inlined.\n  return [\n    `import { createRuntime } from \"@bettercms-ai/astro/runtime\";`,\n    `const runtime = createRuntime({`,\n    `  apiUrl: ${JSON.stringify(cfg.apiUrl)},`,\n    `  workspace: ${JSON.stringify(cfg.workspace)},`,\n    `  projectId: ${JSON.stringify(cfg.projectId)},`,\n    `  apiKey: import.meta.env.BCMS_API_KEY,`,\n    `});`,\n    `export const client = runtime.client;`,\n    `export const getClient = runtime.getClient;`,\n    `export const loadEntry = runtime.loadEntry;`,\n    `export const loadEntries = runtime.loadEntries;`,\n    `export const loadPage = runtime.loadPage;`,\n    `export const loadForms = runtime.loadForms;`,\n    `export default runtime;`,\n  ].join(\"\\n\");\n}\n\nfunction virtualPlugin(cfg: ResolvedConfig) {\n  return {\n    name: \"@bettercms-ai/astro:virtual\",\n    resolveId(id: string) {\n      if (id === CLIENT_ID || id === CONFIG_ID) return RESOLVED(id);\n      return null;\n    },\n    load(id: string) {\n      if (id === RESOLVED(CONFIG_ID)) return configModule(cfg);\n      if (id === RESOLVED(CLIENT_ID)) return clientModule(cfg);\n      return null;\n    },\n  };\n}\n\nexport function bettercms(options: BetterCMSAstroOptions = {}): AstroIntegration {\n  return {\n    name: \"@bettercms-ai/astro\",\n    hooks: {\n      \"astro:config:setup\": ({ updateConfig, addMiddleware, injectRoute, logger }) => {\n        const cfg = resolveConfig(options);\n\n        updateConfig({ vite: { plugins: [virtualPlugin(cfg)] } });\n\n        if (cfg.draft) {\n          addMiddleware({ entrypoint: \"@bettercms-ai/astro/middleware\", order: \"pre\" });\n          injectRoute({\n            pattern: \"/api/bcms/draft/enable\",\n            entrypoint: \"@bettercms-ai/astro/draft-enable\",\n            prerender: false,\n          });\n          injectRoute({\n            pattern: \"/api/bcms/draft/disable\",\n            entrypoint: \"@bettercms-ai/astro/draft-disable\",\n            prerender: false,\n          });\n          logger.info(\"draft mode enabled — /api/bcms/draft/{enable,disable} injected\");\n        }\n      },\n    },\n  };\n}\n\nexport default bettercms;\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n */\nexport function liveSrc(opts: { apiUrl: string; workspace: string; apiKey: string }): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?key=${encodeURIComponent(opts.apiKey)}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n","/**\n * @bettercms-ai/astro — the BetterCMS adapter for Astro.\n *\n *   import { defineConfig } from \"astro/config\";\n *   import bettercms from \"@bettercms-ai/astro\";\n *\n *   export default defineConfig({\n *     integrations: [bettercms({ apiUrl, workspace })],\n *     output: \"server\",\n *   });\n *\n * Then in any page: `import { loadPage } from \"bettercms:client\"`.\n */\nexport { bettercms, default } from \"./integration.js\";\nexport {\n  resolveConfig,\n  DRAFT_COOKIE,\n  type BetterCMSAstroOptions,\n  type PublicConfig,\n  type ResolvedConfig,\n} from \"./config.js\";\nexport { liveSrc } from \"./runtime.js\";\nexport type { BcmsLocals, BetterCMSRuntime, RuntimeConfig } from \"./runtime.js\";\n\n// Image URL builder, re-exported for `<BcmsImage>` and host code.\nexport { default as imageUrlBuilder, imageUrl } from \"@bettercms-ai/image-url\";\nexport type {\n  ImageUrlBuilder,\n  ImageSource,\n  ImageFormat,\n  ImageFit,\n} from \"@bettercms-ai/image-url\";\n\n// Delivery read types, re-exported for typing page/entry data.\nexport type {\n  Perspective,\n  DeliveryEntry,\n  DeliveryPage,\n  DeliveryList,\n  PageMetaJson,\n  SiteSeoDefaults,\n  ContentBlock,\n} from \"@bettercms-ai/types\";\nexport type { DeliveryForm, DeliveryFormField } from \"@bettercms-ai/sdk\";\n\n// SEO (FLO-302): page-over-site meta resolver. In a page's frontmatter,\n// `const seo = resolveSeo(page, siteDefaults)`, then map `seo.*` into `<head>`.\nexport { resolveSeo } from \"@bettercms-ai/sdk\";\nexport type { SeoInput, ResolvedSeo } from \"@bettercms-ai/sdk\";\n"],"mappings":";AAMA,IAAM,oBAAoB;AACnB,IAAM,eAAe;AAgCrB,SAAS,cACd,SACA,MAA0C,QAAQ,KAClC;AAChB,QAAM,UAAU,QAAQ,UAAU,IAAI,uBAAuB,IAAI,QAAQ,QAAQ,EAAE;AACnF,QAAM,YAAY,QAAQ,aAAa,IAAI,yBAAyB;AACpE,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qEAAqE;AAClG,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,0EAA0E;AAE1G,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,QAAQ,aAAa,IAAI;AAAA,IACpC,WAAW,QAAQ,YAAY,IAAI,yBAAyB,mBAAmB,QAAQ,QAAQ,EAAE;AAAA,IACjG,WAAW,QAAQ,aAAa,IAAI;AAAA,IACpC,aAAa;AAAA,IACb,OAAO,QAAQ,SAAS;AAAA,EAC1B;AACF;AAEO,SAAS,eAAe,GAAiC;AAC9D,QAAM,EAAE,OAAO,QAAQ,GAAG,IAAI,IAAI;AAClC,SAAO;AACT;;;AC9CA,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,WAAW,CAAC,OAAe,KAAK,EAAE;AAExC,SAAS,aAAa,KAA6B;AACjD,SAAO,yBAAyB,KAAK,UAAU,eAAe,GAAG,CAAC,CAAC;AAAA;AAAA;AACrE;AAEA,SAAS,aAAa,KAA6B;AAGjD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa,KAAK,UAAU,IAAI,MAAM,CAAC;AAAA,IACvC,gBAAgB,KAAK,UAAU,IAAI,SAAS,CAAC;AAAA,IAC7C,gBAAgB,KAAK,UAAU,IAAI,SAAS,CAAC;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,cAAc,KAAqB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,IAAY;AACpB,UAAI,OAAO,aAAa,OAAO,UAAW,QAAO,SAAS,EAAE;AAC5D,aAAO;AAAA,IACT;AAAA,IACA,KAAK,IAAY;AACf,UAAI,OAAO,SAAS,SAAS,EAAG,QAAO,aAAa,GAAG;AACvD,UAAI,OAAO,SAAS,SAAS,EAAG,QAAO,aAAa,GAAG;AACvD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEO,SAAS,UAAU,UAAiC,CAAC,GAAqB;AAC/E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,sBAAsB,CAAC,EAAE,cAAc,eAAe,aAAa,OAAO,MAAM;AAC9E,cAAM,MAAM,cAAc,OAAO;AAEjC,qBAAa,EAAE,MAAM,EAAE,SAAS,CAAC,cAAc,GAAG,CAAC,EAAE,EAAE,CAAC;AAExD,YAAI,IAAI,OAAO;AACb,wBAAc,EAAE,YAAY,kCAAkC,OAAO,MAAM,CAAC;AAC5E,sBAAY;AAAA,YACV,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,WAAW;AAAA,UACb,CAAC;AACD,sBAAY;AAAA,YACV,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,KAAK,qEAAgE;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,sBAAQ;;;AChFf,SAAS,oBAA8C;AAmEhD,SAAS,QAAQ,MAAqE;AAC3F,QAAM,OAAO,KAAK,OAAO,QAAQ,QAAQ,EAAE;AAC3C,SAAO,GAAG,IAAI,oBAAoB,KAAK,SAAS,aAAa,mBAAmB,KAAK,MAAM,CAAC;AAC9F;AAIA,IAAM,MAAM,IAAI,YAAY;;;ACzD5B,SAAoB,WAAXA,UAA4B,gBAAgB;AAsBrD,SAAS,kBAAkB;","names":["default"]}
+{"version":3,"sources":["../src/config.ts","../src/integration.ts","../src/runtime.ts","../src/index.ts"],"sourcesContent":["/**\n * Resolved configuration shared by the integration, runtime, middleware and\n * draft routes. Public values are safe to ship to the browser; the API key and\n * draft secret are read from server env at runtime and never live here.\n *\n * Resolution order is options → `PUBLIC_BCMS_*` env → the build snapshot. Config-time\n * only: this module is reached exclusively through `dist/index.js`, which only an\n * `astro.config.*` imports, so the `node:fs` read below never enters a client bundle.\n * Browser code gets the `bettercms:config` virtual module instead.\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\n\nconst DEFAULT_MEDIA_URL = \"https://media.bettercms.ai\";\nconst SNAPSHOT_FILE = \"bcms-content.json\";\nexport const DRAFT_COOKIE = \"bcms-draft\";\n\nexport interface BetterCMSAstroOptions {\n  /** Backend base, e.g. `https://api.bettercms.ai`. Falls back to `PUBLIC_BCMS_API_URL`. */\n  apiUrl?: string;\n  /** Workspace slug. Falls back to `PUBLIC_BCMS_WORKSPACE`. */\n  workspace?: string;\n  /** Optional project scope for forms. Falls back to `PUBLIC_BCMS_PROJECT_ID`. */\n  projectId?: string;\n  /** Media host for the image-url builder. Defaults to the prod media host. */\n  mediaUrl?: string;\n  /** Dashboard base for visual-editing deep links. */\n  studioUrl?: string;\n  /** Enable the draft-mode middleware + injected draft routes. Default true. */\n  draft?: boolean;\n}\n\n/** Browser-safe config — exposed via the `bettercms:config` virtual module. */\nexport interface PublicConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  mediaUrl: string;\n  studioUrl?: string;\n  draftCookie: string;\n}\n\nexport interface ResolvedConfig extends PublicConfig {\n  draft: boolean;\n}\n\n/** The fields of the deploy Action's content snapshot that identify the site. */\ninterface Snapshot {\n  apiUrl?: string;\n  workspace?: string;\n  projectId?: string;\n}\n\n/**\n * Read `bcms-content.json` — the snapshot the deploy Action writes next to the build,\n * BEFORE `astro build` runs — which already carries the workspace this site belongs to.\n *\n * This is what lets `bettercms()` work with no arguments and no env at all. Not reading it\n * was the whole bug: a hosted build had the answer sitting in its own working directory and\n * threw anyway, and every starter template had to reimplement this by hand to survive.\n *\n * Lazy: only consulted when options and env both miss, so the configured path does no I/O.\n * Absent/corrupt file ⇒ `{}`, and the caller raises the actionable error below.\n */\nlet snapshotCache: Snapshot | undefined;\nfunction snapshot(cwd: string): Snapshot {\n  if (snapshotCache === undefined) {\n    try {\n      snapshotCache = JSON.parse(readFileSync(resolve(cwd, SNAPSHOT_FILE), \"utf8\")) as Snapshot;\n    } catch {\n      snapshotCache = {};\n    }\n  }\n  return snapshotCache;\n}\n\n/** Test seam — the snapshot is memoised for the life of the process. */\nexport function resetSnapshotCache(): void {\n  snapshotCache = undefined;\n}\n\nconst required = (name: string, envVar: string, extra: string) =>\n  new Error(\n    `[@bettercms-ai/astro] \\`${name}\\` is required. Pass \\`bettercms({ ${name} })\\`, set ` +\n      `${envVar}, or ${extra}\\n` +\n      `On BetterCMS hosting these are injected automatically — if this failed in a hosted ` +\n      `build, the repository is running an outdated deploy workflow: publish once, or save ` +\n      `Hosting settings, to refresh it.`,\n  );\n\n/**\n * Merge integration options with `PUBLIC_BCMS_*` env and the build snapshot, validating the\n * essentials. Precedence: explicit options → env → snapshot.\n */\nexport function resolveConfig(\n  options: BetterCMSAstroOptions,\n  env: Record<string, string | undefined> = process.env,\n  cwd: string = process.cwd(),\n): ResolvedConfig {\n  const snap = (): Snapshot => snapshot(cwd);\n\n  const apiUrl = (options.apiUrl ?? env.PUBLIC_BCMS_API_URL ?? snap().apiUrl ?? \"\").replace(/\\/+$/, \"\");\n  const workspace = options.workspace ?? env.PUBLIC_BCMS_WORKSPACE ?? snap().workspace ?? \"\";\n  // No default origin on purpose: guessing one produces a site that builds cleanly against\n  // the wrong backend, which is far harder to notice than this error.\n  if (!apiUrl) throw required(\"apiUrl\", \"PUBLIC_BCMS_API_URL\", `run the content fetch so ${SNAPSHOT_FILE} is present.`);\n  if (!workspace) {\n    throw required(\"workspace\", \"PUBLIC_BCMS_WORKSPACE\", `run the content fetch so ${SNAPSHOT_FILE} is present.`);\n  }\n\n  return {\n    apiUrl,\n    workspace,\n    projectId: options.projectId ?? env.PUBLIC_BCMS_PROJECT_ID ?? snap().projectId,\n    mediaUrl: (options.mediaUrl ?? env.PUBLIC_BCMS_MEDIA_URL ?? DEFAULT_MEDIA_URL).replace(/\\/+$/, \"\"),\n    studioUrl: options.studioUrl ?? env.PUBLIC_BCMS_STUDIO_URL,\n    draftCookie: DRAFT_COOKIE,\n    draft: options.draft ?? true,\n  };\n}\n\nexport function toPublicConfig(c: ResolvedConfig): PublicConfig {\n  const { draft: _draft, ...pub } = c;\n  return pub;\n}\n","/**\n * `bettercms()` — the Astro integration.\n *\n * - Registers two virtual modules:\n *     `bettercms:client`  → server runtime (client + typed loaders) — has the key.\n *     `bettercms:config`  → browser-safe public config — no secrets.\n * - Adds the draft-mode middleware and injects the draft enable/disable routes.\n */\nimport type { AstroIntegration } from \"astro\";\nimport {\n  resolveConfig,\n  toPublicConfig,\n  type BetterCMSAstroOptions,\n  type ResolvedConfig,\n} from \"./config.js\";\n\nconst CLIENT_ID = \"bettercms:client\";\nconst CONFIG_ID = \"bettercms:config\";\nconst RESOLVED = (id: string) => `\\0${id}`;\n\nfunction configModule(cfg: ResolvedConfig): string {\n  return `export const config = ${JSON.stringify(toPublicConfig(cfg))};\\nexport default config;\\n`;\n}\n\nfunction clientModule(cfg: ResolvedConfig): string {\n  // The key is read from server env at runtime so it never lands in a client\n  // bundle. Public values are inlined.\n  return [\n    `import { createRuntime } from \"@bettercms-ai/astro/runtime\";`,\n    `const runtime = createRuntime({`,\n    `  apiUrl: ${JSON.stringify(cfg.apiUrl)},`,\n    `  workspace: ${JSON.stringify(cfg.workspace)},`,\n    `  projectId: ${JSON.stringify(cfg.projectId)},`,\n    `  apiKey: import.meta.env.BCMS_API_KEY,`,\n    `});`,\n    `export const client = runtime.client;`,\n    `export const getClient = runtime.getClient;`,\n    `export const loadEntry = runtime.loadEntry;`,\n    `export const loadEntries = runtime.loadEntries;`,\n    `export const loadPage = runtime.loadPage;`,\n    `export const loadForms = runtime.loadForms;`,\n    `export default runtime;`,\n  ].join(\"\\n\");\n}\n\nfunction virtualPlugin(cfg: ResolvedConfig) {\n  return {\n    name: \"@bettercms-ai/astro:virtual\",\n    resolveId(id: string) {\n      if (id === CLIENT_ID || id === CONFIG_ID) return RESOLVED(id);\n      return null;\n    },\n    load(id: string) {\n      if (id === RESOLVED(CONFIG_ID)) return configModule(cfg);\n      if (id === RESOLVED(CLIENT_ID)) return clientModule(cfg);\n      return null;\n    },\n  };\n}\n\nexport function bettercms(options: BetterCMSAstroOptions = {}): AstroIntegration {\n  return {\n    name: \"@bettercms-ai/astro\",\n    hooks: {\n      \"astro:config:setup\": ({ updateConfig, addMiddleware, injectRoute, logger }) => {\n        const cfg = resolveConfig(options);\n\n        updateConfig({ vite: { plugins: [virtualPlugin(cfg)] } });\n\n        if (cfg.draft) {\n          addMiddleware({ entrypoint: \"@bettercms-ai/astro/middleware\", order: \"pre\" });\n          injectRoute({\n            pattern: \"/api/bcms/draft/enable\",\n            entrypoint: \"@bettercms-ai/astro/draft-enable\",\n            prerender: false,\n          });\n          injectRoute({\n            pattern: \"/api/bcms/draft/disable\",\n            entrypoint: \"@bettercms-ai/astro/draft-disable\",\n            prerender: false,\n          });\n          logger.info(\"draft mode enabled — /api/bcms/draft/{enable,disable} injected\");\n        }\n      },\n    },\n  };\n}\n\nexport default bettercms;\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n *\n * `depth` sets the hydration depth of the document the stream pushes (default 1,\n * matching the delivery API). `drafts` streams autosaves so a preview surface\n * repaints as the editor types — it needs a `content:read:draft` key, and the\n * server ignores the flag for any other key rather than failing the connection.\n * Never enable it on a public site.\n */\nexport function liveSrc(opts: {\n  apiUrl: string;\n  workspace: string;\n  apiKey: string;\n  depth?: 0 | 1 | 2;\n  drafts?: boolean;\n}): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  const q = new URLSearchParams({ key: opts.apiKey });\n  if (opts.depth !== undefined) q.set(\"depth\", String(opts.depth));\n  if (opts.drafts) q.set(\"drafts\", \"1\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?${q}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n","/**\n * @bettercms-ai/astro — the BetterCMS adapter for Astro.\n *\n *   import { defineConfig } from \"astro/config\";\n *   import bettercms from \"@bettercms-ai/astro\";\n *\n *   export default defineConfig({\n *     integrations: [bettercms({ apiUrl, workspace })],\n *     output: \"server\",\n *   });\n *\n * Then in any page: `import { loadPage } from \"bettercms:client\"`.\n */\nexport { bettercms, default } from \"./integration.js\";\nexport {\n  resolveConfig,\n  DRAFT_COOKIE,\n  type BetterCMSAstroOptions,\n  type PublicConfig,\n  type ResolvedConfig,\n} from \"./config.js\";\nexport { liveSrc } from \"./runtime.js\";\nexport type { BcmsLocals, BetterCMSRuntime, RuntimeConfig } from \"./runtime.js\";\n\n// Image URL builder, re-exported for `<BcmsImage>` and host code.\nexport { default as imageUrlBuilder, imageUrl } from \"@bettercms-ai/image-url\";\nexport type {\n  ImageUrlBuilder,\n  ImageSource,\n  ImageFormat,\n  ImageFit,\n} from \"@bettercms-ai/image-url\";\n\n// Delivery read types, re-exported for typing page/entry data.\nexport type {\n  Perspective,\n  DeliveryEntry,\n  DeliveryPage,\n  DeliveryList,\n  PageMetaJson,\n  SiteSeoDefaults,\n  ContentBlock,\n} from \"@bettercms-ai/types\";\nexport type { DeliveryForm, DeliveryFormField } from \"@bettercms-ai/sdk\";\n\n// SEO (FLO-302): page-over-site meta resolver. In a page's frontmatter,\n// `const seo = resolveSeo(page, siteDefaults)`, then map `seo.*` into `<head>`.\nexport { resolveSeo } from \"@bettercms-ai/sdk\";\nexport type { SeoInput, ResolvedSeo } from \"@bettercms-ai/sdk\";\n"],"mappings":";AAWA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AAExB,IAAM,oBAAoB;AAC1B,IAAM,gBAAgB;AACf,IAAM,eAAe;AAiD5B,IAAI;AACJ,SAAS,SAAS,KAAuB;AACvC,MAAI,kBAAkB,QAAW;AAC/B,QAAI;AACF,sBAAgB,KAAK,MAAM,aAAa,QAAQ,KAAK,aAAa,GAAG,MAAM,CAAC;AAAA,IAC9E,QAAQ;AACN,sBAAgB,CAAC;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAOA,IAAM,WAAW,CAAC,MAAc,QAAgB,UAC9C,IAAI;AAAA,EACF,2BAA2B,IAAI,sCAAsC,IAAI,cACpE,MAAM,QAAQ,KAAK;AAAA;AAI1B;AAMK,SAAS,cACd,SACA,MAA0C,QAAQ,KAClD,MAAc,QAAQ,IAAI,GACV;AAChB,QAAM,OAAO,MAAgB,SAAS,GAAG;AAEzC,QAAM,UAAU,QAAQ,UAAU,IAAI,uBAAuB,KAAK,EAAE,UAAU,IAAI,QAAQ,QAAQ,EAAE;AACpG,QAAM,YAAY,QAAQ,aAAa,IAAI,yBAAyB,KAAK,EAAE,aAAa;AAGxF,MAAI,CAAC,OAAQ,OAAM,SAAS,UAAU,uBAAuB,4BAA4B,aAAa,cAAc;AACpH,MAAI,CAAC,WAAW;AACd,UAAM,SAAS,aAAa,yBAAyB,4BAA4B,aAAa,cAAc;AAAA,EAC9G;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,QAAQ,aAAa,IAAI,0BAA0B,KAAK,EAAE;AAAA,IACrE,WAAW,QAAQ,YAAY,IAAI,yBAAyB,mBAAmB,QAAQ,QAAQ,EAAE;AAAA,IACjG,WAAW,QAAQ,aAAa,IAAI;AAAA,IACpC,aAAa;AAAA,IACb,OAAO,QAAQ,SAAS;AAAA,EAC1B;AACF;AAEO,SAAS,eAAe,GAAiC;AAC9D,QAAM,EAAE,OAAO,QAAQ,GAAG,IAAI,IAAI;AAClC,SAAO;AACT;;;AC7GA,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,WAAW,CAAC,OAAe,KAAK,EAAE;AAExC,SAAS,aAAa,KAA6B;AACjD,SAAO,yBAAyB,KAAK,UAAU,eAAe,GAAG,CAAC,CAAC;AAAA;AAAA;AACrE;AAEA,SAAS,aAAa,KAA6B;AAGjD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa,KAAK,UAAU,IAAI,MAAM,CAAC;AAAA,IACvC,gBAAgB,KAAK,UAAU,IAAI,SAAS,CAAC;AAAA,IAC7C,gBAAgB,KAAK,UAAU,IAAI,SAAS,CAAC;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,cAAc,KAAqB;AAC1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,IAAY;AACpB,UAAI,OAAO,aAAa,OAAO,UAAW,QAAO,SAAS,EAAE;AAC5D,aAAO;AAAA,IACT;AAAA,IACA,KAAK,IAAY;AACf,UAAI,OAAO,SAAS,SAAS,EAAG,QAAO,aAAa,GAAG;AACvD,UAAI,OAAO,SAAS,SAAS,EAAG,QAAO,aAAa,GAAG;AACvD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEO,SAAS,UAAU,UAAiC,CAAC,GAAqB;AAC/E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,sBAAsB,CAAC,EAAE,cAAc,eAAe,aAAa,OAAO,MAAM;AAC9E,cAAM,MAAM,cAAc,OAAO;AAEjC,qBAAa,EAAE,MAAM,EAAE,SAAS,CAAC,cAAc,GAAG,CAAC,EAAE,EAAE,CAAC;AAExD,YAAI,IAAI,OAAO;AACb,wBAAc,EAAE,YAAY,kCAAkC,OAAO,MAAM,CAAC;AAC5E,sBAAY;AAAA,YACV,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,WAAW;AAAA,UACb,CAAC;AACD,sBAAY;AAAA,YACV,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,WAAW;AAAA,UACb,CAAC;AACD,iBAAO,KAAK,qEAAgE;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,sBAAQ;;;AChFf,SAAS,oBAA8C;AAyEhD,SAAS,QAAQ,MAMb;AACT,QAAM,OAAO,KAAK,OAAO,QAAQ,QAAQ,EAAE;AAC3C,QAAM,IAAI,IAAI,gBAAgB,EAAE,KAAK,KAAK,OAAO,CAAC;AAClD,MAAI,KAAK,UAAU,OAAW,GAAE,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,MAAI,KAAK,OAAQ,GAAE,IAAI,UAAU,GAAG;AACpC,SAAO,GAAG,IAAI,oBAAoB,KAAK,SAAS,SAAS,CAAC;AAC5D;AAIA,IAAM,MAAM,IAAI,YAAY;;;ACxE5B,SAAoB,WAAXA,UAA4B,gBAAgB;AAsBrD,SAAS,kBAAkB;","names":["default"]}

package/dist/middleware-entry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware-entry.ts","../src/runtime.ts"],"sourcesContent":["/**\n * Draft-mode middleware (registered via `addMiddleware`).\n *\n * Reads the signed draft cookie, verifies it with `BCMS_DRAFT_SECRET`, and\n * publishes the result on `Astro.locals.bcms` so loaders pick the draft client.\n */\nimport type { MiddlewareHandler } from \"astro\";\nimport config from \"bettercms:config\";\nimport { verifyValue, type BcmsLocals } from \"./runtime.js\";\n\nexport const onRequest: MiddlewareHandler = async (context, next) => {\n  const cookie = context.cookies.get(config.draftCookie)?.value;\n  const secret = import.meta.env.BCMS_DRAFT_SECRET as string | undefined;\n\n  let locals: BcmsLocals = { draft: false };\n  if (cookie && secret) {\n    const token = await verifyValue(cookie, secret);\n    if (token) locals = { draft: true, token };\n  }\n  context.locals.bcms = locals;\n\n  return next();\n};\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n */\nexport function liveSrc(opts: { apiUrl: string; workspace: string; apiKey: string }): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?key=${encodeURIComponent(opts.apiKey)}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAOA,OAAO,YAAY;;;ACCnB,SAAS,oBAA8C;AA0EvD,IAAM,MAAM,IAAI,YAAY;AAE5B,SAAS,UAAU,OAA4B;AAC7C,QAAM,IAAI,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC;AAC5D,SAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACpE;AAEA,eAAe,KAAK,OAAe,QAAiC;AAClE,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,UAAU,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC;AAC3E;AAQA,eAAsB,YAAY,QAAgB,QAAwC;AACxF,QAAM,MAAM,OAAO,YAAY,GAAG;AAClC,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;AACjC,QAAM,MAAM,OAAO,MAAM,MAAM,CAAC;AAChC,QAAM,WAAW,MAAM,KAAK,OAAO,MAAM;AAEzC,MAAI,IAAI,WAAW,SAAS,OAAQ,QAAO;AAC3C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,SAAQ,IAAI,WAAW,CAAC,IAAI,SAAS,WAAW,CAAC;AACtF,SAAO,SAAS,IAAI,QAAQ;AAC9B;;;AD3GO,IAAM,YAA+B,OAAO,SAAS,SAAS;AACnE,QAAM,SAAS,QAAQ,QAAQ,IAAI,OAAO,WAAW,GAAG;AACxD,QAAM,SAAS,YAAY,IAAI;AAE/B,MAAI,SAAqB,EAAE,OAAO,MAAM;AACxC,MAAI,UAAU,QAAQ;AACpB,UAAM,QAAQ,MAAM,YAAY,QAAQ,MAAM;AAC9C,QAAI,MAAO,UAAS,EAAE,OAAO,MAAM,MAAM;AAAA,EAC3C;AACA,UAAQ,OAAO,OAAO;AAEtB,SAAO,KAAK;AACd;","names":[]}
+{"version":3,"sources":["../src/middleware-entry.ts","../src/runtime.ts"],"sourcesContent":["/**\n * Draft-mode middleware (registered via `addMiddleware`).\n *\n * Reads the signed draft cookie, verifies it with `BCMS_DRAFT_SECRET`, and\n * publishes the result on `Astro.locals.bcms` so loaders pick the draft client.\n */\nimport type { MiddlewareHandler } from \"astro\";\nimport config from \"bettercms:config\";\nimport { verifyValue, type BcmsLocals } from \"./runtime.js\";\n\nexport const onRequest: MiddlewareHandler = async (context, next) => {\n  const cookie = context.cookies.get(config.draftCookie)?.value;\n  const secret = import.meta.env.BCMS_DRAFT_SECRET as string | undefined;\n\n  let locals: BcmsLocals = { draft: false };\n  if (cookie && secret) {\n    const token = await verifyValue(cookie, secret);\n    if (token) locals = { draft: true, token };\n  }\n  context.locals.bcms = locals;\n\n  return next();\n};\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n *\n * `depth` sets the hydration depth of the document the stream pushes (default 1,\n * matching the delivery API). `drafts` streams autosaves so a preview surface\n * repaints as the editor types — it needs a `content:read:draft` key, and the\n * server ignores the flag for any other key rather than failing the connection.\n * Never enable it on a public site.\n */\nexport function liveSrc(opts: {\n  apiUrl: string;\n  workspace: string;\n  apiKey: string;\n  depth?: 0 | 1 | 2;\n  drafts?: boolean;\n}): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  const q = new URLSearchParams({ key: opts.apiKey });\n  if (opts.depth !== undefined) q.set(\"depth\", String(opts.depth));\n  if (opts.drafts) q.set(\"drafts\", \"1\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?${q}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAOA,OAAO,YAAY;;;ACCnB,SAAS,oBAA8C;AAyFvD,IAAM,MAAM,IAAI,YAAY;AAE5B,SAAS,UAAU,OAA4B;AAC7C,QAAM,IAAI,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC;AAC5D,SAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACpE;AAEA,eAAe,KAAK,OAAe,QAAiC;AAClE,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,UAAU,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC;AAC3E;AAQA,eAAsB,YAAY,QAAgB,QAAwC;AACxF,QAAM,MAAM,OAAO,YAAY,GAAG;AAClC,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;AACjC,QAAM,MAAM,OAAO,MAAM,MAAM,CAAC;AAChC,QAAM,WAAW,MAAM,KAAK,OAAO,MAAM;AAEzC,MAAI,IAAI,WAAW,SAAS,OAAQ,QAAO;AAC3C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,SAAQ,IAAI,WAAW,CAAC,IAAI,SAAS,WAAW,CAAC;AACtF,SAAO,SAAS,IAAI,QAAQ;AAC9B;;;AD1HO,IAAM,YAA+B,OAAO,SAAS,SAAS;AACnE,QAAM,SAAS,QAAQ,QAAQ,IAAI,OAAO,WAAW,GAAG;AACxD,QAAM,SAAS,YAAY,IAAI;AAE/B,MAAI,SAAqB,EAAE,OAAO,MAAM;AACxC,MAAI,UAAU,QAAQ;AACpB,UAAM,QAAQ,MAAM,YAAY,QAAQ,MAAM;AAC9C,QAAI,MAAO,UAAS,EAAE,OAAO,MAAM,MAAM;AAAA,EAC3C;AACA,UAAQ,OAAO,OAAO;AAEtB,SAAO,KAAK;AACd;","names":[]}

package/dist/routes/draft-disable.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/draft-disable.ts","../../src/runtime.ts"],"sourcesContent":["/**\n * GET /api/bcms/draft/disable?redirect=/path — clear the draft cookie.\n */\nimport type { APIRoute } from \"astro\";\nimport config from \"bettercms:config\";\nimport { safeRedirectPath } from \"../runtime.js\";\n\nexport const GET: APIRoute = async (context) => {\n  const redirectTo = new URL(context.request.url).searchParams.get(\"redirect\") ?? \"/\";\n  context.cookies.delete(config.draftCookie, { path: \"/\" });\n  return context.redirect(safeRedirectPath(redirectTo), 302);\n};\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n */\nexport function liveSrc(opts: { apiUrl: string; workspace: string; apiKey: string }): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?key=${encodeURIComponent(opts.apiKey)}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAIA,OAAO,YAAY;;;ACInB,SAAS,oBAA8C;AA0EvD,IAAM,MAAM,IAAI,YAAY;AAsCrB,SAAS,iBAAiB,IAAoB;AACnD,SAAO,GAAG,WAAW,GAAG,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,KAAK;AAC3D;;;ADnHO,IAAM,MAAgB,OAAO,YAAY;AAC9C,QAAM,aAAa,IAAI,IAAI,QAAQ,QAAQ,GAAG,EAAE,aAAa,IAAI,UAAU,KAAK;AAChF,UAAQ,QAAQ,OAAO,OAAO,aAAa,EAAE,MAAM,IAAI,CAAC;AACxD,SAAO,QAAQ,SAAS,iBAAiB,UAAU,GAAG,GAAG;AAC3D;","names":[]}
+{"version":3,"sources":["../../src/routes/draft-disable.ts","../../src/runtime.ts"],"sourcesContent":["/**\n * GET /api/bcms/draft/disable?redirect=/path — clear the draft cookie.\n */\nimport type { APIRoute } from \"astro\";\nimport config from \"bettercms:config\";\nimport { safeRedirectPath } from \"../runtime.js\";\n\nexport const GET: APIRoute = async (context) => {\n  const redirectTo = new URL(context.request.url).searchParams.get(\"redirect\") ?? \"/\";\n  context.cookies.delete(config.draftCookie, { path: \"/\" });\n  return context.redirect(safeRedirectPath(redirectTo), 302);\n};\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n *\n * `depth` sets the hydration depth of the document the stream pushes (default 1,\n * matching the delivery API). `drafts` streams autosaves so a preview surface\n * repaints as the editor types — it needs a `content:read:draft` key, and the\n * server ignores the flag for any other key rather than failing the connection.\n * Never enable it on a public site.\n */\nexport function liveSrc(opts: {\n  apiUrl: string;\n  workspace: string;\n  apiKey: string;\n  depth?: 0 | 1 | 2;\n  drafts?: boolean;\n}): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  const q = new URLSearchParams({ key: opts.apiKey });\n  if (opts.depth !== undefined) q.set(\"depth\", String(opts.depth));\n  if (opts.drafts) q.set(\"drafts\", \"1\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?${q}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAIA,OAAO,YAAY;;;ACInB,SAAS,oBAA8C;AAyFvD,IAAM,MAAM,IAAI,YAAY;AAsCrB,SAAS,iBAAiB,IAAoB;AACnD,SAAO,GAAG,WAAW,GAAG,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,KAAK;AAC3D;;;ADlIO,IAAM,MAAgB,OAAO,YAAY;AAC9C,QAAM,aAAa,IAAI,IAAI,QAAQ,QAAQ,GAAG,EAAE,aAAa,IAAI,UAAU,KAAK;AAChF,UAAQ,QAAQ,OAAO,OAAO,aAAa,EAAE,MAAM,IAAI,CAAC;AACxD,SAAO,QAAQ,SAAS,iBAAiB,UAAU,GAAG,GAAG;AAC3D;","names":[]}

package/dist/routes/draft-enable.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/draft-enable.ts","../../src/runtime.ts"],"sourcesContent":["/**\n * GET /api/bcms/draft/enable?token=<jwt>&redirect=/path\n *\n * Validates the preview token against the backend `/preview/:slug` endpoint\n * (the backend is the signature authority), then sets a signed draft cookie and\n * redirects. Requires `BCMS_DRAFT_SECRET` in the server env.\n */\nimport type { APIRoute } from \"astro\";\nimport config from \"bettercms:config\";\nimport { decodeTokenSlug, safeRedirectPath, signValue } from \"../runtime.js\";\n\nexport const GET: APIRoute = async (context) => {\n  const url = new URL(context.request.url);\n  const token = url.searchParams.get(\"token\");\n  const redirectTo = url.searchParams.get(\"redirect\") ?? \"/\";\n  const secret = import.meta.env.BCMS_DRAFT_SECRET as string | undefined;\n\n  if (!secret) return new Response(\"BCMS_DRAFT_SECRET is not configured\", { status: 500 });\n  if (!token) return new Response(\"Missing token\", { status: 400 });\n\n  const slug = decodeTokenSlug(token);\n  if (!slug) return new Response(\"Malformed token\", { status: 400 });\n\n  const res = await fetch(\n    `${config.apiUrl}/api/v1/preview/${encodeURIComponent(slug)}?token=${encodeURIComponent(token)}`,\n  );\n  if (!res.ok) return new Response(\"Invalid or expired token\", { status: 401 });\n\n  context.cookies.set(config.draftCookie, await signValue(token, secret), {\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: url.protocol === \"https:\",\n    path: \"/\",\n    maxAge: 60 * 60 * 24, // 24h, matching the preview-token lifetime\n  });\n\n  return context.redirect(safeRedirectPath(redirectTo), 302);\n};\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n */\nexport function liveSrc(opts: { apiUrl: string; workspace: string; apiKey: string }): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?key=${encodeURIComponent(opts.apiKey)}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAQA,OAAO,YAAY;;;ACAnB,SAAS,oBAA8C;AA0EvD,IAAM,MAAM,IAAI,YAAY;AAE5B,SAAS,UAAU,OAA4B;AAC7C,QAAM,IAAI,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC;AAC5D,SAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACpE;AAEA,eAAe,KAAK,OAAe,QAAiC;AAClE,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,UAAU,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC;AAC3E;AAGA,eAAsB,UAAU,OAAe,QAAiC;AAC9E,SAAO,GAAG,KAAK,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC;AAC9C;AAiBO,SAAS,iBAAiB,IAAoB;AACnD,SAAO,GAAG,WAAW,GAAG,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,KAAK;AAC3D;AAGO,SAAS,gBAAgB,OAA8B;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC;AAC/B,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,OAAO,KAAK;AAAA,MAChB,KAAK,KAAK,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAAA,IACjD;AACA,WAAO,KAAK,aAAa;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AD7HO,IAAM,MAAgB,OAAO,YAAY;AAC9C,QAAM,MAAM,IAAI,IAAI,QAAQ,QAAQ,GAAG;AACvC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU,KAAK;AACvD,QAAM,SAAS,YAAY,IAAI;AAE/B,MAAI,CAAC,OAAQ,QAAO,IAAI,SAAS,uCAAuC,EAAE,QAAQ,IAAI,CAAC;AACvF,MAAI,CAAC,MAAO,QAAO,IAAI,SAAS,iBAAiB,EAAE,QAAQ,IAAI,CAAC;AAEhE,QAAM,OAAO,gBAAgB,KAAK;AAClC,MAAI,CAAC,KAAM,QAAO,IAAI,SAAS,mBAAmB,EAAE,QAAQ,IAAI,CAAC;AAEjE,QAAM,MAAM,MAAM;AAAA,IAChB,GAAG,OAAO,MAAM,mBAAmB,mBAAmB,IAAI,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAAA,EAChG;AACA,MAAI,CAAC,IAAI,GAAI,QAAO,IAAI,SAAS,4BAA4B,EAAE,QAAQ,IAAI,CAAC;AAE5E,UAAQ,QAAQ,IAAI,OAAO,aAAa,MAAM,UAAU,OAAO,MAAM,GAAG;AAAA,IACtE,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,IAAI,aAAa;AAAA,IACzB,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK;AAAA;AAAA,EACpB,CAAC;AAED,SAAO,QAAQ,SAAS,iBAAiB,UAAU,GAAG,GAAG;AAC3D;","names":[]}
+{"version":3,"sources":["../../src/routes/draft-enable.ts","../../src/runtime.ts"],"sourcesContent":["/**\n * GET /api/bcms/draft/enable?token=<jwt>&redirect=/path\n *\n * Validates the preview token against the backend `/preview/:slug` endpoint\n * (the backend is the signature authority), then sets a signed draft cookie and\n * redirects. Requires `BCMS_DRAFT_SECRET` in the server env.\n */\nimport type { APIRoute } from \"astro\";\nimport config from \"bettercms:config\";\nimport { decodeTokenSlug, safeRedirectPath, signValue } from \"../runtime.js\";\n\nexport const GET: APIRoute = async (context) => {\n  const url = new URL(context.request.url);\n  const token = url.searchParams.get(\"token\");\n  const redirectTo = url.searchParams.get(\"redirect\") ?? \"/\";\n  const secret = import.meta.env.BCMS_DRAFT_SECRET as string | undefined;\n\n  if (!secret) return new Response(\"BCMS_DRAFT_SECRET is not configured\", { status: 500 });\n  if (!token) return new Response(\"Missing token\", { status: 400 });\n\n  const slug = decodeTokenSlug(token);\n  if (!slug) return new Response(\"Malformed token\", { status: 400 });\n\n  const res = await fetch(\n    `${config.apiUrl}/api/v1/preview/${encodeURIComponent(slug)}?token=${encodeURIComponent(token)}`,\n  );\n  if (!res.ok) return new Response(\"Invalid or expired token\", { status: 401 });\n\n  context.cookies.set(config.draftCookie, await signValue(token, secret), {\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: url.protocol === \"https:\",\n    path: \"/\",\n    maxAge: 60 * 60 * 24, // 24h, matching the preview-token lifetime\n  });\n\n  return context.redirect(safeRedirectPath(redirectTo), 302);\n};\n","/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n *\n * `depth` sets the hydration depth of the document the stream pushes (default 1,\n * matching the delivery API). `drafts` streams autosaves so a preview surface\n * repaints as the editor types — it needs a `content:read:draft` key, and the\n * server ignores the flag for any other key rather than failing the connection.\n * Never enable it on a public site.\n */\nexport function liveSrc(opts: {\n  apiUrl: string;\n  workspace: string;\n  apiKey: string;\n  depth?: 0 | 1 | 2;\n  drafts?: boolean;\n}): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  const q = new URLSearchParams({ key: opts.apiKey });\n  if (opts.depth !== undefined) q.set(\"depth\", String(opts.depth));\n  if (opts.drafts) q.set(\"drafts\", \"1\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?${q}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAQA,OAAO,YAAY;;;ACAnB,SAAS,oBAA8C;AAyFvD,IAAM,MAAM,IAAI,YAAY;AAE5B,SAAS,UAAU,OAA4B;AAC7C,QAAM,IAAI,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC;AAC5D,SAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACpE;AAEA,eAAe,KAAK,OAAe,QAAiC;AAClE,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,UAAU,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC;AAC3E;AAGA,eAAsB,UAAU,OAAe,QAAiC;AAC9E,SAAO,GAAG,KAAK,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC;AAC9C;AAiBO,SAAS,iBAAiB,IAAoB;AACnD,SAAO,GAAG,WAAW,GAAG,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,KAAK;AAC3D;AAGO,SAAS,gBAAgB,OAA8B;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC;AAC/B,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,OAAO,KAAK;AAAA,MAChB,KAAK,KAAK,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAAA,IACjD;AACA,WAAO,KAAK,aAAa;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AD5IO,IAAM,MAAgB,OAAO,YAAY;AAC9C,QAAM,MAAM,IAAI,IAAI,QAAQ,QAAQ,GAAG;AACvC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU,KAAK;AACvD,QAAM,SAAS,YAAY,IAAI;AAE/B,MAAI,CAAC,OAAQ,QAAO,IAAI,SAAS,uCAAuC,EAAE,QAAQ,IAAI,CAAC;AACvF,MAAI,CAAC,MAAO,QAAO,IAAI,SAAS,iBAAiB,EAAE,QAAQ,IAAI,CAAC;AAEhE,QAAM,OAAO,gBAAgB,KAAK;AAClC,MAAI,CAAC,KAAM,QAAO,IAAI,SAAS,mBAAmB,EAAE,QAAQ,IAAI,CAAC;AAEjE,QAAM,MAAM,MAAM;AAAA,IAChB,GAAG,OAAO,MAAM,mBAAmB,mBAAmB,IAAI,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAAA,EAChG;AACA,MAAI,CAAC,IAAI,GAAI,QAAO,IAAI,SAAS,4BAA4B,EAAE,QAAQ,IAAI,CAAC;AAE5E,UAAQ,QAAQ,IAAI,OAAO,aAAa,MAAM,UAAU,OAAO,MAAM,GAAG;AAAA,IACtE,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,IAAI,aAAa;AAAA,IACzB,MAAM;AAAA,IACN,QAAQ,KAAK,KAAK;AAAA;AAAA,EACpB,CAAC;AAED,SAAO,QAAQ,SAAS,iBAAiB,UAAU,GAAG,GAAG;AAC3D;","names":[]}

package/dist/runtime.d.ts

@@ -41,11 +41,19 @@ declare function createRuntime(config: RuntimeConfig): BetterCMSRuntime;
 /**
  * Build the live SSE URL for `<BcmsLive>`. The key is a query param because
  * browser EventSource cannot send headers — use a content:read key.
+ *
+ * `depth` sets the hydration depth of the document the stream pushes (default 1,
+ * matching the delivery API). `drafts` streams autosaves so a preview surface
+ * repaints as the editor types — it needs a `content:read:draft` key, and the
+ * server ignores the flag for any other key rather than failing the connection.
+ * Never enable it on a public site.
  */
 declare function liveSrc(opts: {
     apiUrl: string;
     workspace: string;
     apiKey: string;
+    depth?: 0 | 1 | 2;
+    drafts?: boolean;
 }): string;
 /** Sign a value as `value.sig` for tamper-evident cookie storage. */
 declare function signValue(value: string, secret: string): Promise<string>;

package/dist/runtime.js

@@ -20,7 +20,10 @@ function createRuntime(config) {
 }
 function liveSrc(opts) {
   const base = opts.apiUrl.replace(/\/+$/, "");
-  return `${base}/api/v1/delivery/${opts.workspace}/live?key=${encodeURIComponent(opts.apiKey)}`;
+  const q = new URLSearchParams({ key: opts.apiKey });
+  if (opts.depth !== void 0) q.set("depth", String(opts.depth));
+  if (opts.drafts) q.set("drafts", "1");
+  return `${base}/api/v1/delivery/${opts.workspace}/live?${q}`;
 }
 var enc = new TextEncoder();
 function base64url(bytes) {

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime.ts"],"sourcesContent":["/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n */\nexport function liveSrc(opts: { apiUrl: string; workspace: string; apiKey: string }): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?key=${encodeURIComponent(opts.apiKey)}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAQA,SAAS,oBAA8C;AA0ChD,SAAS,cAAc,QAAyC;AACrE,QAAM,YAAY,aAAa,EAAE,GAAG,QAAQ,aAAa,YAAY,CAAC;AAEtE,QAAM,YAAY,CAAC,UAA2C;AAC5D,UAAM,OAAO,OAAO,QAAQ;AAC5B,QAAI,MAAM,OAAO;AACf,aAAO,aAAa,EAAE,GAAG,QAAQ,aAAa,UAAU,cAAc,KAAK,MAAM,CAAC;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,WAAW,CAAC,OAAO,MAAM,SAAS,UAAU,KAAK,EAAE,SAAS,MAAM,IAAI;AAAA,IACtE,aAAa,CAAC,OAAO,SAAS,UAAU,KAAK,EAAE,YAAY,IAAI;AAAA,IAC/D,UAAU,CAAC,OAAO,SAAS,UAAU,KAAK,EAAE,QAAQ,IAAI;AAAA,IACxD,WAAW,CAAC,OAAO,SAAS,UAAU,KAAK,EAAE,UAAU,IAAI;AAAA,EAC7D;AACF;AAMO,SAAS,QAAQ,MAAqE;AAC3F,QAAM,OAAO,KAAK,OAAO,QAAQ,QAAQ,EAAE;AAC3C,SAAO,GAAG,IAAI,oBAAoB,KAAK,SAAS,aAAa,mBAAmB,KAAK,MAAM,CAAC;AAC9F;AAIA,IAAM,MAAM,IAAI,YAAY;AAE5B,SAAS,UAAU,OAA4B;AAC7C,QAAM,IAAI,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC;AAC5D,SAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACpE;AAEA,eAAe,KAAK,OAAe,QAAiC;AAClE,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,UAAU,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC;AAC3E;AAGA,eAAsB,UAAU,OAAe,QAAiC;AAC9E,SAAO,GAAG,KAAK,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC;AAC9C;AAGA,eAAsB,YAAY,QAAgB,QAAwC;AACxF,QAAM,MAAM,OAAO,YAAY,GAAG;AAClC,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;AACjC,QAAM,MAAM,OAAO,MAAM,MAAM,CAAC;AAChC,QAAM,WAAW,MAAM,KAAK,OAAO,MAAM;AAEzC,MAAI,IAAI,WAAW,SAAS,OAAQ,QAAO;AAC3C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,SAAQ,IAAI,WAAW,CAAC,IAAI,SAAS,WAAW,CAAC;AACtF,SAAO,SAAS,IAAI,QAAQ;AAC9B;AAGO,SAAS,iBAAiB,IAAoB;AACnD,SAAO,GAAG,WAAW,GAAG,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,KAAK;AAC3D;AAGO,SAAS,gBAAgB,OAA8B;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC;AAC/B,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,OAAO,KAAK;AAAA,MAChB,KAAK,KAAK,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAAA,IACjD;AACA,WAAO,KAAK,aAAa;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/runtime.ts"],"sourcesContent":["/**\n * Runtime for @bettercms-ai/astro — the code the `bettercms:client` virtual\n * module binds to. Provides a published client, per-request draft client\n * selection, typed loaders, and signed-cookie helpers for draft mode.\n *\n * Read-only; no I/O at import time. Safe in Node and edge runtimes (uses Web\n * Crypto + global fetch only).\n */\nimport { createClient, type BetterCMSReadClient } from \"@bettercms-ai/sdk\";\nimport type { DeliveryEntry, DeliveryList, DeliveryPage } from \"@bettercms-ai/types\";\n\nexport interface RuntimeConfig {\n  apiUrl: string;\n  workspace: string;\n  projectId?: string;\n  /** Server-only delivery key (a `content:read:draft` key for drafts). */\n  apiKey?: string;\n}\n\n/** Per-request draft state, set on `Astro.locals.bcms` by the middleware. */\nexport interface BcmsLocals {\n  draft: boolean;\n  token?: string;\n}\n\ninterface HasLocals {\n  locals: { bcms?: BcmsLocals };\n}\n\nexport interface BetterCMSRuntime {\n  /** Published-perspective client (use for SSG / non-draft reads). */\n  client: BetterCMSReadClient;\n  /** Pick the right client for a request (draft client when draft mode is on). */\n  getClient(astro?: HasLocals): BetterCMSReadClient;\n  loadEntry<T = Record<string, unknown>>(\n    astro: HasLocals,\n    slug: string,\n    opts?: Parameters<BetterCMSReadClient[\"getEntry\"]>[1],\n  ): Promise<DeliveryEntry<T>>;\n  loadEntries<T = Record<string, unknown>>(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listEntries\"]>[0],\n  ): Promise<DeliveryList<DeliveryEntry<T>>>;\n  loadPage(astro: HasLocals, slug: string): Promise<DeliveryPage | null>;\n  loadForms(\n    astro: HasLocals,\n    opts?: Parameters<BetterCMSReadClient[\"listForms\"]>[0],\n  ): Promise<Awaited<ReturnType<BetterCMSReadClient[\"listForms\"]>>>;\n}\n\nexport function createRuntime(config: RuntimeConfig): BetterCMSRuntime {\n  const published = createClient({ ...config, perspective: \"published\" });\n\n  const getClient = (astro?: HasLocals): BetterCMSReadClient => {\n    const bcms = astro?.locals?.bcms;\n    if (bcms?.draft) {\n      return createClient({ ...config, perspective: \"drafts\", previewToken: bcms.token });\n    }\n    return published;\n  };\n\n  return {\n    client: published,\n    getClient,\n    loadEntry: (astro, slug, opts) => getClient(astro).getEntry(slug, opts),\n    loadEntries: (astro, opts) => getClient(astro).listEntries(opts),\n    loadPage: (astro, slug) => getClient(astro).getPage(slug),\n    loadForms: (astro, opts) => getClient(astro).listForms(opts),\n  };\n}\n\n/**\n * Build the live SSE URL for `<BcmsLive>`. The key is a query param because\n * browser EventSource cannot send headers — use a content:read key.\n *\n * `depth` sets the hydration depth of the document the stream pushes (default 1,\n * matching the delivery API). `drafts` streams autosaves so a preview surface\n * repaints as the editor types — it needs a `content:read:draft` key, and the\n * server ignores the flag for any other key rather than failing the connection.\n * Never enable it on a public site.\n */\nexport function liveSrc(opts: {\n  apiUrl: string;\n  workspace: string;\n  apiKey: string;\n  depth?: 0 | 1 | 2;\n  drafts?: boolean;\n}): string {\n  const base = opts.apiUrl.replace(/\\/+$/, \"\");\n  const q = new URLSearchParams({ key: opts.apiKey });\n  if (opts.depth !== undefined) q.set(\"depth\", String(opts.depth));\n  if (opts.drafts) q.set(\"drafts\", \"1\");\n  return `${base}/api/v1/delivery/${opts.workspace}/live?${q}`;\n}\n\n// ── Signed-cookie helpers (HMAC-SHA256, base64url) ──────────────────────────\n\nconst enc = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  const b = btoa(String.fromCharCode(...new Uint8Array(bytes)));\n  return b.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return base64url(await crypto.subtle.sign(\"HMAC\", key, enc.encode(value)));\n}\n\n/** Sign a value as `value.sig` for tamper-evident cookie storage. */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  return `${value}.${await hmac(value, secret)}`;\n}\n\n/** Verify a signed value, returning the original value or null if tampered. */\nexport async function verifyValue(signed: string, secret: string): Promise<string | null> {\n  const idx = signed.lastIndexOf(\".\");\n  if (idx < 0) return null;\n  const value = signed.slice(0, idx);\n  const sig = signed.slice(idx + 1);\n  const expected = await hmac(value, secret);\n  // Constant-time-ish compare via length + char accumulation.\n  if (sig.length !== expected.length) return null;\n  let diff = 0;\n  for (let i = 0; i < sig.length; i++) diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n  return diff === 0 ? value : null;\n}\n\n/** Only same-origin relative paths. Blocks \"//evil.com\", \"https://evil.com\", etc. */\nexport function safeRedirectPath(to: string): string {\n  return to.startsWith(\"/\") && !to.startsWith(\"//\") ? to : \"/\";\n}\n\n/** Decode a preview-token JWT payload (UNVERIFIED) to read its `entrySlug`. */\nexport function decodeTokenSlug(token: string): string | null {\n  try {\n    const part = token.split(\".\")[1];\n    if (!part) return null;\n    const json = JSON.parse(\n      atob(part.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { entrySlug?: string };\n    return json.entrySlug ?? null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAQA,SAAS,oBAA8C;AA0ChD,SAAS,cAAc,QAAyC;AACrE,QAAM,YAAY,aAAa,EAAE,GAAG,QAAQ,aAAa,YAAY,CAAC;AAEtE,QAAM,YAAY,CAAC,UAA2C;AAC5D,UAAM,OAAO,OAAO,QAAQ;AAC5B,QAAI,MAAM,OAAO;AACf,aAAO,aAAa,EAAE,GAAG,QAAQ,aAAa,UAAU,cAAc,KAAK,MAAM,CAAC;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,WAAW,CAAC,OAAO,MAAM,SAAS,UAAU,KAAK,EAAE,SAAS,MAAM,IAAI;AAAA,IACtE,aAAa,CAAC,OAAO,SAAS,UAAU,KAAK,EAAE,YAAY,IAAI;AAAA,IAC/D,UAAU,CAAC,OAAO,SAAS,UAAU,KAAK,EAAE,QAAQ,IAAI;AAAA,IACxD,WAAW,CAAC,OAAO,SAAS,UAAU,KAAK,EAAE,UAAU,IAAI;AAAA,EAC7D;AACF;AAYO,SAAS,QAAQ,MAMb;AACT,QAAM,OAAO,KAAK,OAAO,QAAQ,QAAQ,EAAE;AAC3C,QAAM,IAAI,IAAI,gBAAgB,EAAE,KAAK,KAAK,OAAO,CAAC;AAClD,MAAI,KAAK,UAAU,OAAW,GAAE,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,MAAI,KAAK,OAAQ,GAAE,IAAI,UAAU,GAAG;AACpC,SAAO,GAAG,IAAI,oBAAoB,KAAK,SAAS,SAAS,CAAC;AAC5D;AAIA,IAAM,MAAM,IAAI,YAAY;AAE5B,SAAS,UAAU,OAA4B;AAC7C,QAAM,IAAI,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC;AAC5D,SAAO,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACpE;AAEA,eAAe,KAAK,OAAe,QAAiC;AAClE,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,UAAU,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC;AAC3E;AAGA,eAAsB,UAAU,OAAe,QAAiC;AAC9E,SAAO,GAAG,KAAK,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC;AAC9C;AAGA,eAAsB,YAAY,QAAgB,QAAwC;AACxF,QAAM,MAAM,OAAO,YAAY,GAAG;AAClC,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;AACjC,QAAM,MAAM,OAAO,MAAM,MAAM,CAAC;AAChC,QAAM,WAAW,MAAM,KAAK,OAAO,MAAM;AAEzC,MAAI,IAAI,WAAW,SAAS,OAAQ,QAAO;AAC3C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,SAAQ,IAAI,WAAW,CAAC,IAAI,SAAS,WAAW,CAAC;AACtF,SAAO,SAAS,IAAI,QAAQ;AAC9B;AAGO,SAAS,iBAAiB,IAAoB;AACnD,SAAO,GAAG,WAAW,GAAG,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,KAAK;AAC3D;AAGO,SAAS,gBAAgB,OAA8B;AAC5D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC;AAC/B,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,OAAO,KAAK;AAAA,MAChB,KAAK,KAAK,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAAA,IACjD;AACA,WAAO,KAAK,aAAa;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bettercms-ai/astro",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "type": "module",
   "description": "The BetterCMS adapter for Astro — a `bettercms()` integration, a `bettercms:client` virtual module, typed content loaders, draft preview, and native .astro rendering components.",
   "main": "./dist/index.js",
@@ -48,8 +48,8 @@
   },
   "dependencies": {
     "@bettercms-ai/image-url": "^0.1.0",
-    "@bettercms-ai/sdk": "^1.5.0",
-    "@bettercms-ai/types": "^1.4.0",
+    "@bettercms-ai/sdk": "^1.10.0",
+    "@bettercms-ai/types": "^1.5.0",
     "@bettercms-ai/ui": "^0.4.0"
   },
   "peerDependencies": {