@cmssy/core 11.4.2 → 11.5.0

package/dist/{csp-CRixC_wl.d.cts → csp-0D9pcuDp.d.cts}

@@ -1,5 +1,5 @@
 import { CmssyClientConfig, BlockRect, BlockSchema, BlockMeta } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-C7sA46qu.cjs';
+import { G as GraphqlRequestOptions } from './locale-XMylB_kz.cjs';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function isDevelopment(): boolean;

package/dist/{csp-DpG1NcSd.d.ts → csp-CpiqfM03.d.ts}

@@ -1,5 +1,5 @@
 import { CmssyClientConfig, BlockRect, BlockSchema, BlockMeta } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-Ox_qVlNy.js';
+import { G as GraphqlRequestOptions } from './locale-Clouq4s4.js';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function isDevelopment(): boolean;

package/dist/index.cjs

@@ -540,6 +540,57 @@ function localizeHref(href, locale) {
   return `${addLocalePrefix(bare, locale.current, locale)}${suffix}`;
 }
 
+// src/data/site-locales.ts
+var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
+var MAX_ENTRIES = 64;
+var cache = /* @__PURE__ */ new Map();
+function localesFromSiteConfig(siteConfig) {
+  const defaultLocale = siteConfig?.defaultLanguage || "en";
+  const enabled = siteConfig?.enabledLanguages ?? [];
+  return {
+    defaultLocale,
+    locales: enabled.length > 0 ? enabled : [defaultLocale]
+  };
+}
+async function loadSiteLocales(config, options) {
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
+  const cached = cache.get(key);
+  if (cached && cached.expires > Date.now()) return cached.value;
+  cache.delete(key);
+  let value;
+  try {
+    const data = await graphqlRequest(
+      config,
+      SITE_CONFIG_QUERY,
+      { workspaceSlug: config.workspaceSlug },
+      { ...options, public: true, retry: options?.retry ?? {} },
+      "site config"
+    );
+    value = localesFromSiteConfig(data.public?.siteConfig ?? null);
+  } catch {
+    value = null;
+  }
+  if (cache.size >= MAX_ENTRIES) cache.clear();
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
+  return value;
+}
+async function resolveCmssyLocale(config, path, options) {
+  const siteLocales = await loadSiteLocales(config, options);
+  if (!siteLocales) return void 0;
+  return splitLocaleFromPath(path, siteLocales).locale;
+}
+function splitLocaleFromPath(path, siteLocales) {
+  const first = path?.[0];
+  if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {
+    return { locale: first, path: path.slice(1) };
+  }
+  return { locale: siteLocales.defaultLocale, path };
+}
+
 // src/locale.ts
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 
@@ -823,5 +874,6 @@ exports.localizeHref = localizeHref;
 exports.normalizeOrigin = normalizeOrigin;
 exports.parseEditorMessage = parseEditorMessage;
 exports.postToEditor = postToEditor;
+exports.resolveCmssyLocale = resolveCmssyLocale;
 exports.resolveEditorOrigin = resolveEditorOrigin;
 exports.verifyCmssyWebhook = verifyCmssyWebhook;

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-CRixC_wl.cjs';
-export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref } from './locale-C7sA46qu.cjs';
+export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-0D9pcuDp.cjs';
+export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-XMylB_kz.cjs';
 export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-CJQ-nafm.cjs';
 import * as _cmssy_types from '@cmssy/types';
 import { FieldOptions, TypedField, BlockPropsSchema, InferBlockContent, RelationMode, CmssyModelRecord, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-DpG1NcSd.js';
-export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref } from './locale-Ox_qVlNy.js';
+export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-CpiqfM03.js';
+export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-Clouq4s4.js';
 export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-CJQ-nafm.js';
 import * as _cmssy_types from '@cmssy/types';
 import { FieldOptions, TypedField, BlockPropsSchema, InferBlockContent, RelationMode, CmssyModelRecord, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';

package/dist/index.js

@@ -538,6 +538,57 @@ function localizeHref(href, locale) {
   return `${addLocalePrefix(bare, locale.current, locale)}${suffix}`;
 }
 
+// src/data/site-locales.ts
+var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
+var MAX_ENTRIES = 64;
+var cache = /* @__PURE__ */ new Map();
+function localesFromSiteConfig(siteConfig) {
+  const defaultLocale = siteConfig?.defaultLanguage || "en";
+  const enabled = siteConfig?.enabledLanguages ?? [];
+  return {
+    defaultLocale,
+    locales: enabled.length > 0 ? enabled : [defaultLocale]
+  };
+}
+async function loadSiteLocales(config, options) {
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
+  const cached = cache.get(key);
+  if (cached && cached.expires > Date.now()) return cached.value;
+  cache.delete(key);
+  let value;
+  try {
+    const data = await graphqlRequest(
+      config,
+      SITE_CONFIG_QUERY,
+      { workspaceSlug: config.workspaceSlug },
+      { ...options, public: true, retry: options?.retry ?? {} },
+      "site config"
+    );
+    value = localesFromSiteConfig(data.public?.siteConfig ?? null);
+  } catch {
+    value = null;
+  }
+  if (cache.size >= MAX_ENTRIES) cache.clear();
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
+  return value;
+}
+async function resolveCmssyLocale(config, path, options) {
+  const siteLocales = await loadSiteLocales(config, options);
+  if (!siteLocales) return void 0;
+  return splitLocaleFromPath(path, siteLocales).locale;
+}
+function splitLocaleFromPath(path, siteLocales) {
+  const first = path?.[0];
+  if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {
+    return { locale: first, path: path.slice(1) };
+  }
+  return { locale: siteLocales.defaultLocale, path };
+}
+
 // src/locale.ts
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 
@@ -793,4 +844,4 @@ async function verifyCmssyWebhook(options) {
   return parsed;
 }
 
-export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CmssyRequestError, CmssyWebhookError, DEFAULT_CMSSY_API_URL, DEFAULT_CMSSY_EDITOR_ORIGINS, PROTOCOL_VERSION, applyCmssyCsp, createCmssyClient, defineCmssyConfig, fields, graphqlRequest, isProtocolCompatible, isVerifiedEditUrl, localizeHref, normalizeOrigin, parseEditorMessage, postToEditor, resolveEditorOrigin, verifyCmssyWebhook };
+export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CmssyRequestError, CmssyWebhookError, DEFAULT_CMSSY_API_URL, DEFAULT_CMSSY_EDITOR_ORIGINS, PROTOCOL_VERSION, applyCmssyCsp, createCmssyClient, defineCmssyConfig, fields, graphqlRequest, isProtocolCompatible, isVerifiedEditUrl, localizeHref, normalizeOrigin, parseEditorMessage, postToEditor, resolveCmssyLocale, resolveEditorOrigin, verifyCmssyWebhook };

package/dist/internal/locale.cjs

@@ -166,6 +166,7 @@ var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -176,7 +177,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -192,12 +193,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/internal/locale.d.cts

@@ -1,28 +1,11 @@
-import { G as GraphqlRequestOptions } from '../locale-C7sA46qu.cjs';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from '../locale-C7sA46qu.cjs';
-import { CmssySiteLocales, CmssyClientConfig } from '@cmssy/types';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from '../locale-XMylB_kz.cjs';
 export { CmssySiteLocales } from '@cmssy/types';
 import '../content-client-CJQ-nafm.cjs';
 
-/**
- * Maps a workspace site config to its locale set. The single place that
- * decides the default and enabled languages - the router and the SEO helpers
- * must agree, so both go through here.
- */
-declare function localesFromSiteConfig(siteConfig: {
-    defaultLanguage?: string | null;
-    enabledLanguages?: string[];
-} | null): CmssySiteLocales;
-declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
-declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
-    locale: string;
-    path: string[] | undefined;
-};
-
 /**
  * Maps a page slug to its path for a locale: the default locale gets no
  * prefix, others get `/${locale}`. The homepage ("/") stays "/" (or "/${locale}").
  */
 declare function localizedPath(slug: string, locale: string, defaultLocale: string): string;
 
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath };
+export { localizedPath };

package/dist/internal/locale.d.ts

@@ -1,28 +1,11 @@
-import { G as GraphqlRequestOptions } from '../locale-Ox_qVlNy.js';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from '../locale-Ox_qVlNy.js';
-import { CmssySiteLocales, CmssyClientConfig } from '@cmssy/types';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from '../locale-Clouq4s4.js';
 export { CmssySiteLocales } from '@cmssy/types';
 import '../content-client-CJQ-nafm.js';
 
-/**
- * Maps a workspace site config to its locale set. The single place that
- * decides the default and enabled languages - the router and the SEO helpers
- * must agree, so both go through here.
- */
-declare function localesFromSiteConfig(siteConfig: {
-    defaultLanguage?: string | null;
-    enabledLanguages?: string[];
-} | null): CmssySiteLocales;
-declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
-declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
-    locale: string;
-    path: string[] | undefined;
-};
-
 /**
  * Maps a page slug to its path for a locale: the default locale gets no
  * prefix, others get `/${locale}`. The homepage ("/") stays "/" (or "/${locale}").
  */
 declare function localizedPath(slug: string, locale: string, defaultLocale: string): string;
 
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath };
+export { localizedPath };

package/dist/internal/locale.js

@@ -164,6 +164,7 @@ var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -174,7 +175,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -190,12 +191,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/internal.cjs

@@ -713,6 +713,7 @@ async function resolveForms(config, blocks, locale, defaultLocale, options) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -723,7 +724,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -739,12 +740,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/internal.d.cts

@@ -1,11 +1,11 @@
 export { f as fetchLayouts, c as fetchPage, d as fetchPageById, e as fetchPageMeta, g as fetchPages, n as normalizeSlug, r as resolveApiUrl, h as resolvePublicUrl } from './content-client-CJQ-nafm.cjs';
 import { CmssyFormDefinition, BuildBlockContextExtra, CmssyBlockContext, CmssyClientConfig, CmssySiteConfig, RawBlock, FieldDefinition } from '@cmssy/types';
 export { CmssySiteLocales } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-C7sA46qu.cjs';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from './locale-C7sA46qu.cjs';
-import { Q as QueryScopedOptions } from './csp-CRixC_wl.cjs';
-export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-CRixC_wl.cjs';
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath } from './internal/locale.cjs';
+import { G as GraphqlRequestOptions } from './locale-XMylB_kz.cjs';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from './locale-XMylB_kz.cjs';
+import { Q as QueryScopedOptions } from './csp-0D9pcuDp.cjs';
+export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-0D9pcuDp.cjs';
+export { localizedPath } from './internal/locale.cjs';
 
 declare const SITE_CONFIG_QUERY = "query PublicSiteConfig($workspaceSlug: String!) {\n  public {\n    siteConfig(workspaceSlug: $workspaceSlug) {\n      id\n      workspaceId\n      siteName\n      defaultLanguage\n      enabledLanguages\n      enabledFeatures\n      notFoundPageId\n      previewUrl\n      branding {\n        brandName\n        logoUrl\n        logoDarkUrl\n        faviconUrl\n        ogImageUrl\n      }\n    }\n  }\n}";
 declare const MODEL_DEFINITIONS_QUERY = "query PublicModelDefinitions($workspaceId: String!) {\n  public {\n    model {\n      definitions(workspaceId: $workspaceId) {\n        id name slug description icon color displayField recordCount\n      }\n    }\n  }\n}";

package/dist/internal.d.ts

@@ -1,11 +1,11 @@
 export { f as fetchLayouts, c as fetchPage, d as fetchPageById, e as fetchPageMeta, g as fetchPages, n as normalizeSlug, r as resolveApiUrl, h as resolvePublicUrl } from './content-client-CJQ-nafm.js';
 import { CmssyFormDefinition, BuildBlockContextExtra, CmssyBlockContext, CmssyClientConfig, CmssySiteConfig, RawBlock, FieldDefinition } from '@cmssy/types';
 export { CmssySiteLocales } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-Ox_qVlNy.js';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from './locale-Ox_qVlNy.js';
-import { Q as QueryScopedOptions } from './csp-DpG1NcSd.js';
-export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-DpG1NcSd.js';
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath } from './internal/locale.js';
+import { G as GraphqlRequestOptions } from './locale-Clouq4s4.js';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from './locale-Clouq4s4.js';
+import { Q as QueryScopedOptions } from './csp-CpiqfM03.js';
+export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-CpiqfM03.js';
+export { localizedPath } from './internal/locale.js';
 
 declare const SITE_CONFIG_QUERY = "query PublicSiteConfig($workspaceSlug: String!) {\n  public {\n    siteConfig(workspaceSlug: $workspaceSlug) {\n      id\n      workspaceId\n      siteName\n      defaultLanguage\n      enabledLanguages\n      enabledFeatures\n      notFoundPageId\n      previewUrl\n      branding {\n        brandName\n        logoUrl\n        logoDarkUrl\n        faviconUrl\n        ogImageUrl\n      }\n    }\n  }\n}";
 declare const MODEL_DEFINITIONS_QUERY = "query PublicModelDefinitions($workspaceId: String!) {\n  public {\n    model {\n      definitions(workspaceId: $workspaceId) {\n        id name slug description icon color displayField recordCount\n      }\n    }\n  }\n}";

package/dist/internal.js

@@ -711,6 +711,7 @@ async function resolveForms(config, blocks, locale, defaultLocale, options) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -721,7 +722,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -737,12 +738,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/{locale-Ox_qVlNy.d.ts → locale-Clouq4s4.d.ts}

@@ -1,5 +1,5 @@
+import { CmssyClientConfig, CmssyLocaleContext, CmssySiteLocales } from '@cmssy/types';
 import { F as FetchLike, R as RetryPolicy } from './content-client-CJQ-nafm.js';
-import { CmssyClientConfig, CmssyLocaleContext } from '@cmssy/types';
 
 interface GraphqlRequestOptions {
     fetch?: FetchLike;
@@ -37,6 +37,22 @@ declare function buildLocaleSwitchHref(target: string, pathname: string, locale:
  */
 declare function localizeHtmlLinks(html: string, locale: CmssyLocaleContext): string;
 
+/**
+ * Maps a workspace site config to its locale set. The single place that
+ * decides the default and enabled languages - the router and the SEO helpers
+ * must agree, so both go through here.
+ */
+declare function localesFromSiteConfig(siteConfig: {
+    defaultLanguage?: string | null;
+    enabledLanguages?: string[];
+} | null): CmssySiteLocales;
+declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
+declare function resolveCmssyLocale(config: CmssyClientConfig, path: string[] | undefined, options?: GraphqlRequestOptions): Promise<string | undefined>;
+declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
+    locale: string;
+    path: string[] | undefined;
+};
+
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 declare function localeForPathname(config: CmssyClientConfig, pathname: string): Promise<string>;
 declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | undefined): Promise<{
@@ -49,4 +65,4 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
  */
 declare function localeForPath(config: CmssyClientConfig, path: string | string[]): Promise<string>;
 
-export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localizeHtmlLinks as d, graphqlRequest as g, localizeHref as l, splitCmssyLocale as s };
+export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localesFromSiteConfig as d, localizeHtmlLinks as e, resolveSiteLocales as f, graphqlRequest as g, splitLocaleFromPath as h, localizeHref as l, resolveCmssyLocale as r, splitCmssyLocale as s };

package/dist/{locale-C7sA46qu.d.cts → locale-XMylB_kz.d.cts}

@@ -1,5 +1,5 @@
+import { CmssyClientConfig, CmssyLocaleContext, CmssySiteLocales } from '@cmssy/types';
 import { F as FetchLike, R as RetryPolicy } from './content-client-CJQ-nafm.cjs';
-import { CmssyClientConfig, CmssyLocaleContext } from '@cmssy/types';
 
 interface GraphqlRequestOptions {
     fetch?: FetchLike;
@@ -37,6 +37,22 @@ declare function buildLocaleSwitchHref(target: string, pathname: string, locale:
  */
 declare function localizeHtmlLinks(html: string, locale: CmssyLocaleContext): string;
 
+/**
+ * Maps a workspace site config to its locale set. The single place that
+ * decides the default and enabled languages - the router and the SEO helpers
+ * must agree, so both go through here.
+ */
+declare function localesFromSiteConfig(siteConfig: {
+    defaultLanguage?: string | null;
+    enabledLanguages?: string[];
+} | null): CmssySiteLocales;
+declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
+declare function resolveCmssyLocale(config: CmssyClientConfig, path: string[] | undefined, options?: GraphqlRequestOptions): Promise<string | undefined>;
+declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
+    locale: string;
+    path: string[] | undefined;
+};
+
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 declare function localeForPathname(config: CmssyClientConfig, pathname: string): Promise<string>;
 declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | undefined): Promise<{
@@ -49,4 +65,4 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
  */
 declare function localeForPath(config: CmssyClientConfig, path: string | string[]): Promise<string>;
 
-export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localizeHtmlLinks as d, graphqlRequest as g, localizeHref as l, splitCmssyLocale as s };
+export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localesFromSiteConfig as d, localizeHtmlLinks as e, resolveSiteLocales as f, graphqlRequest as g, splitLocaleFromPath as h, localizeHref as l, resolveCmssyLocale as r, splitCmssyLocale as s };

package/dist/testing.cjs

@@ -141,6 +141,80 @@ async function graphqlRequest(config, query, variables, options = {}, label = "r
   });
 }
 
+// src/data/queries.ts
+var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
+  public {
+    siteConfig(workspaceSlug: $workspaceSlug) {
+      id
+      workspaceId
+      siteName
+      defaultLanguage
+      enabledLanguages
+      enabledFeatures
+      notFoundPageId
+      previewUrl
+      branding {
+        brandName
+        logoUrl
+        logoDarkUrl
+        faviconUrl
+        ogImageUrl
+      }
+    }
+  }
+}`;
+
+// src/data/site-locales.ts
+function localesFromSiteConfig(siteConfig) {
+  const defaultLocale = siteConfig?.defaultLanguage || "en";
+  const enabled = siteConfig?.enabledLanguages ?? [];
+  return {
+    defaultLocale,
+    locales: enabled.length > 0 ? enabled : [defaultLocale]
+  };
+}
+
+// src/preflight.ts
+var ALLOWED_FRAME_HOSTS = ["cmssy.io", "www.cmssy.io"];
+function frameAncestorSources(cspHeaderValue) {
+  const directive = cspHeaderValue.split(";").map((part) => part.trim()).find((part) => /^frame-ancestors\b/i.test(part));
+  if (!directive) return null;
+  return directive.split(/\s+/).slice(1).map((source) => source.toLowerCase().replace(/^'|'$/g, ""));
+}
+function allowsCmssyAdmin(source) {
+  if (source === "*" || source === "https:") return true;
+  const host = source.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").split("/")[0];
+  if (!host) return false;
+  if (host === "*.cmssy.io") return true;
+  return ALLOWED_FRAME_HOSTS.includes(host);
+}
+function checkFrameAncestors(cspHeaderValue) {
+  if (!cspHeaderValue || cspHeaderValue.trim().length === 0) {
+    return {
+      status: "ok",
+      message: "no Content-Security-Policy restricts framing"
+    };
+  }
+  const sources = frameAncestorSources(cspHeaderValue);
+  if (sources === null) {
+    return {
+      status: "ok",
+      message: "the Content-Security-Policy has no frame-ancestors directive"
+    };
+  }
+  if (sources.some(allowsCmssyAdmin)) {
+    return {
+      status: "ok",
+      message: "frame-ancestors allows the cmssy editor"
+    };
+  }
+  return {
+    status: "fail",
+    message: `frame-ancestors (${sources.join(" ") || "'none'"}) blocks the cmssy editor`,
+    fix: "add https://cmssy.io https://www.cmssy.io to the frame-ancestors directive (applyCmssyCsp does this for you)"
+  };
+}
+
 // src/testing/edit-smoke.ts
 var EDITOR_MARKER = /data-cmssy-editor/;
 var SERVER_LAYOUT_BLOCKS = /<header|<footer/;
@@ -151,7 +225,22 @@ function resolvedContentCounts(body) {
 }
 async function html(url) {
   const response = await fetch(url, { redirect: "manual" });
-  return { status: response.status, body: await response.text() };
+  return {
+    status: response.status,
+    body: await response.text(),
+    headers: response.headers
+  };
+}
+var EDIT_PATH_PREFIX = "/cmssy-edit";
+function withoutEditPrefix(path) {
+  if (path === EDIT_PATH_PREFIX) return "/";
+  return path.startsWith(`${EDIT_PATH_PREFIX}/`) ? path.slice(EDIT_PATH_PREFIX.length) : path;
+}
+function localeOf(path) {
+  return withoutEditPrefix(path).split("/").filter(Boolean)[0];
+}
+function langOf(body) {
+  return /<html[^>]*\slang=["']([^"']+)["']/i.exec(body)?.[1];
 }
 var LAYOUT_BLOCKS_QUERY = `query CmssySmokeLayouts($workspaceSlug: String!, $pageSlug: String!) {
   public {
@@ -180,6 +269,29 @@ async function workspaceHasLayoutBlocks(workspace, pageSlug) {
     return null;
   }
 }
+async function derivedLocalizedPath(workspace, path) {
+  try {
+    const data = await graphqlRequest(
+      workspace,
+      SITE_CONFIG_QUERY,
+      { workspaceSlug: workspace.workspaceSlug },
+      { public: true, retry: {} },
+      "edit smoke: site locales"
+    );
+    const { defaultLocale, locales } = localesFromSiteConfig(
+      data.public?.siteConfig ?? null
+    );
+    const locale = locales.find((candidate) => candidate !== defaultLocale);
+    if (!locale) return { kind: "none" };
+    const routed = withoutEditPrefix(path);
+    const [first] = routed.split("/").filter(Boolean);
+    if (first && locales.includes(first)) return { kind: "none" };
+    const suffix = routed === "/" || routed === "" ? "" : routed.replace(/\/+$/, "");
+    return { kind: "derived", locale, localizedPath: `/${locale}${suffix}` };
+  } catch {
+    return { kind: "unavailable" };
+  }
+}
 async function checkCmssyEditMode(options) {
   const { baseUrl, secret, path = "/" } = options;
   const failures = [];
@@ -232,25 +344,62 @@ async function checkCmssyEditMode(options) {
       );
     }
   }
-  const { localizedPath } = options;
-  if (localizedPath) {
-    const locale = options.localizedLocale ?? localizedPath.split("/").filter(Boolean)[0];
-    const localized = await html(
-      url(
-        `${localizedPath}?cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`
-      )
+  const query = `cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`;
+  const asked = options.localizedPath;
+  const derived = !asked && options.workspace ? await derivedLocalizedPath(options.workspace, path) : { kind: "none" };
+  if (derived.kind === "unavailable") {
+    failures.push(
+      `the delivery API would not say which languages ${options.workspace?.workspaceSlug} enables, so the preview's language went unchecked. That is the check three releases shipped a wrong-language preview past - a green run here does not mean it works.`
     );
-    if (!EDITOR_MARKER.test(localized.body)) {
-      failures.push(`edit ${localizedPath}: no editor in the response`);
-    }
-    const served = /<html[^>]*\slang=["']([^"']+)["']/i.exec(localized.body)?.[1];
-    if (locale && served !== locale) {
+  }
+  const localizedPath = asked ?? (derived.kind === "derived" ? derived.localizedPath : void 0);
+  if (localizedPath) {
+    const locale = options.localizedLocale ?? (derived.kind === "derived" ? derived.locale : localeOf(localizedPath));
+    const localized = await html(url(`${localizedPath}?${query}`));
+    if (localized.status !== 200) {
       failures.push(
-        `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        derived.kind === "derived" ? `edit ${localizedPath}: expected 200, got ${localized.status}. The workspace enables "${locale}", so the language went unchecked - pass localizedPath if this site spells the language some other way.` : `edit ${localizedPath}: expected 200, got ${localized.status}`
       );
+    } else {
+      if (!EDITOR_MARKER.test(localized.body)) {
+        failures.push(`edit ${localizedPath}: no editor in the response`);
+      }
+      const served = langOf(localized.body);
+      if (locale && served !== locale) {
+        failures.push(
+          `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        );
+      }
+      if (options.editRoute !== false) {
+        await checkDirectEditRoute(url, localizedPath, query, locale, failures);
+      }
     }
   }
+  if (options.editRoute !== false) {
+    await checkDirectEditRoute(url, path, query, void 0, failures);
+  }
   return { ok: failures.length === 0, failures };
 }
+async function checkDirectEditRoute(url, routedPath, query, locale, failures) {
+  const withoutPrefix = withoutEditPrefix(routedPath);
+  const directPath = `${EDIT_PATH_PREFIX}${withoutPrefix === "/" ? "" : withoutPrefix}`;
+  if (directPath === routedPath) return;
+  const direct = await html(url(`${directPath}?${query}`));
+  if (direct.status !== 200 || !EDITOR_MARKER.test(direct.body)) return;
+  const directLang = langOf(direct.body);
+  if (locale && directLang !== locale) {
+    failures.push(
+      `edit ${directPath}: reached directly the page reports lang="${directLang ?? "?"}", through the rewrite it reports "${locale}" - the same page renders in two languages depending on how the editor arrives`
+    );
+  }
+  const framing = checkFrameAncestors(
+    direct.headers.get("content-security-policy")
+  );
+  if (framing.status === "fail") {
+    failures.push(
+      `edit ${directPath}: ${framing.message} - the editor shows a blank panel for a route that renders fine on its own. ${framing.fix ?? ""}`.trim()
+    );
+  }
+}
 
 exports.checkCmssyEditMode = checkCmssyEditMode;

package/dist/testing.d.cts

@@ -33,6 +33,7 @@ interface EditSmokeOptions {
         workspaceSlug: string;
         apiUrl?: string;
     };
+    editRoute?: boolean;
 }
 interface EditSmokeResult {
     ok: boolean;

package/dist/testing.d.ts

@@ -33,6 +33,7 @@ interface EditSmokeOptions {
         workspaceSlug: string;
         apiUrl?: string;
     };
+    editRoute?: boolean;
 }
 interface EditSmokeResult {
     ok: boolean;

package/dist/testing.js

@@ -139,6 +139,80 @@ async function graphqlRequest(config, query, variables, options = {}, label = "r
   });
 }
 
+// src/data/queries.ts
+var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
+  public {
+    siteConfig(workspaceSlug: $workspaceSlug) {
+      id
+      workspaceId
+      siteName
+      defaultLanguage
+      enabledLanguages
+      enabledFeatures
+      notFoundPageId
+      previewUrl
+      branding {
+        brandName
+        logoUrl
+        logoDarkUrl
+        faviconUrl
+        ogImageUrl
+      }
+    }
+  }
+}`;
+
+// src/data/site-locales.ts
+function localesFromSiteConfig(siteConfig) {
+  const defaultLocale = siteConfig?.defaultLanguage || "en";
+  const enabled = siteConfig?.enabledLanguages ?? [];
+  return {
+    defaultLocale,
+    locales: enabled.length > 0 ? enabled : [defaultLocale]
+  };
+}
+
+// src/preflight.ts
+var ALLOWED_FRAME_HOSTS = ["cmssy.io", "www.cmssy.io"];
+function frameAncestorSources(cspHeaderValue) {
+  const directive = cspHeaderValue.split(";").map((part) => part.trim()).find((part) => /^frame-ancestors\b/i.test(part));
+  if (!directive) return null;
+  return directive.split(/\s+/).slice(1).map((source) => source.toLowerCase().replace(/^'|'$/g, ""));
+}
+function allowsCmssyAdmin(source) {
+  if (source === "*" || source === "https:") return true;
+  const host = source.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").split("/")[0];
+  if (!host) return false;
+  if (host === "*.cmssy.io") return true;
+  return ALLOWED_FRAME_HOSTS.includes(host);
+}
+function checkFrameAncestors(cspHeaderValue) {
+  if (!cspHeaderValue || cspHeaderValue.trim().length === 0) {
+    return {
+      status: "ok",
+      message: "no Content-Security-Policy restricts framing"
+    };
+  }
+  const sources = frameAncestorSources(cspHeaderValue);
+  if (sources === null) {
+    return {
+      status: "ok",
+      message: "the Content-Security-Policy has no frame-ancestors directive"
+    };
+  }
+  if (sources.some(allowsCmssyAdmin)) {
+    return {
+      status: "ok",
+      message: "frame-ancestors allows the cmssy editor"
+    };
+  }
+  return {
+    status: "fail",
+    message: `frame-ancestors (${sources.join(" ") || "'none'"}) blocks the cmssy editor`,
+    fix: "add https://cmssy.io https://www.cmssy.io to the frame-ancestors directive (applyCmssyCsp does this for you)"
+  };
+}
+
 // src/testing/edit-smoke.ts
 var EDITOR_MARKER = /data-cmssy-editor/;
 var SERVER_LAYOUT_BLOCKS = /<header|<footer/;
@@ -149,7 +223,22 @@ function resolvedContentCounts(body) {
 }
 async function html(url) {
   const response = await fetch(url, { redirect: "manual" });
-  return { status: response.status, body: await response.text() };
+  return {
+    status: response.status,
+    body: await response.text(),
+    headers: response.headers
+  };
+}
+var EDIT_PATH_PREFIX = "/cmssy-edit";
+function withoutEditPrefix(path) {
+  if (path === EDIT_PATH_PREFIX) return "/";
+  return path.startsWith(`${EDIT_PATH_PREFIX}/`) ? path.slice(EDIT_PATH_PREFIX.length) : path;
+}
+function localeOf(path) {
+  return withoutEditPrefix(path).split("/").filter(Boolean)[0];
+}
+function langOf(body) {
+  return /<html[^>]*\slang=["']([^"']+)["']/i.exec(body)?.[1];
 }
 var LAYOUT_BLOCKS_QUERY = `query CmssySmokeLayouts($workspaceSlug: String!, $pageSlug: String!) {
   public {
@@ -178,6 +267,29 @@ async function workspaceHasLayoutBlocks(workspace, pageSlug) {
     return null;
   }
 }
+async function derivedLocalizedPath(workspace, path) {
+  try {
+    const data = await graphqlRequest(
+      workspace,
+      SITE_CONFIG_QUERY,
+      { workspaceSlug: workspace.workspaceSlug },
+      { public: true, retry: {} },
+      "edit smoke: site locales"
+    );
+    const { defaultLocale, locales } = localesFromSiteConfig(
+      data.public?.siteConfig ?? null
+    );
+    const locale = locales.find((candidate) => candidate !== defaultLocale);
+    if (!locale) return { kind: "none" };
+    const routed = withoutEditPrefix(path);
+    const [first] = routed.split("/").filter(Boolean);
+    if (first && locales.includes(first)) return { kind: "none" };
+    const suffix = routed === "/" || routed === "" ? "" : routed.replace(/\/+$/, "");
+    return { kind: "derived", locale, localizedPath: `/${locale}${suffix}` };
+  } catch {
+    return { kind: "unavailable" };
+  }
+}
 async function checkCmssyEditMode(options) {
   const { baseUrl, secret, path = "/" } = options;
   const failures = [];
@@ -230,25 +342,62 @@ async function checkCmssyEditMode(options) {
       );
     }
   }
-  const { localizedPath } = options;
-  if (localizedPath) {
-    const locale = options.localizedLocale ?? localizedPath.split("/").filter(Boolean)[0];
-    const localized = await html(
-      url(
-        `${localizedPath}?cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`
-      )
+  const query = `cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`;
+  const asked = options.localizedPath;
+  const derived = !asked && options.workspace ? await derivedLocalizedPath(options.workspace, path) : { kind: "none" };
+  if (derived.kind === "unavailable") {
+    failures.push(
+      `the delivery API would not say which languages ${options.workspace?.workspaceSlug} enables, so the preview's language went unchecked. That is the check three releases shipped a wrong-language preview past - a green run here does not mean it works.`
     );
-    if (!EDITOR_MARKER.test(localized.body)) {
-      failures.push(`edit ${localizedPath}: no editor in the response`);
-    }
-    const served = /<html[^>]*\slang=["']([^"']+)["']/i.exec(localized.body)?.[1];
-    if (locale && served !== locale) {
+  }
+  const localizedPath = asked ?? (derived.kind === "derived" ? derived.localizedPath : void 0);
+  if (localizedPath) {
+    const locale = options.localizedLocale ?? (derived.kind === "derived" ? derived.locale : localeOf(localizedPath));
+    const localized = await html(url(`${localizedPath}?${query}`));
+    if (localized.status !== 200) {
       failures.push(
-        `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        derived.kind === "derived" ? `edit ${localizedPath}: expected 200, got ${localized.status}. The workspace enables "${locale}", so the language went unchecked - pass localizedPath if this site spells the language some other way.` : `edit ${localizedPath}: expected 200, got ${localized.status}`
       );
+    } else {
+      if (!EDITOR_MARKER.test(localized.body)) {
+        failures.push(`edit ${localizedPath}: no editor in the response`);
+      }
+      const served = langOf(localized.body);
+      if (locale && served !== locale) {
+        failures.push(
+          `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        );
+      }
+      if (options.editRoute !== false) {
+        await checkDirectEditRoute(url, localizedPath, query, locale, failures);
+      }
     }
   }
+  if (options.editRoute !== false) {
+    await checkDirectEditRoute(url, path, query, void 0, failures);
+  }
   return { ok: failures.length === 0, failures };
 }
+async function checkDirectEditRoute(url, routedPath, query, locale, failures) {
+  const withoutPrefix = withoutEditPrefix(routedPath);
+  const directPath = `${EDIT_PATH_PREFIX}${withoutPrefix === "/" ? "" : withoutPrefix}`;
+  if (directPath === routedPath) return;
+  const direct = await html(url(`${directPath}?${query}`));
+  if (direct.status !== 200 || !EDITOR_MARKER.test(direct.body)) return;
+  const directLang = langOf(direct.body);
+  if (locale && directLang !== locale) {
+    failures.push(
+      `edit ${directPath}: reached directly the page reports lang="${directLang ?? "?"}", through the rewrite it reports "${locale}" - the same page renders in two languages depending on how the editor arrives`
+    );
+  }
+  const framing = checkFrameAncestors(
+    direct.headers.get("content-security-policy")
+  );
+  if (framing.status === "fail") {
+    failures.push(
+      `edit ${directPath}: ${framing.message} - the editor shows a blank panel for a route that renders fine on its own. ${framing.fix ?? ""}`.trim()
+    );
+  }
+}
 
 export { checkCmssyEditMode };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/core",
-  "version": "11.4.2",
+  "version": "11.5.0",
   "description": "Framework-agnostic cmssy gateway: GraphQL client, block/field system, editor protocol. No React, no Next.",
   "keywords": [
     "cmssy",