@cmssy/core 11.4.2 → 11.5.1

package/dist/{csp-CRixC_wl.d.cts → csp-0D9pcuDp.d.cts}

@@ -1,5 +1,5 @@
 import { CmssyClientConfig, BlockRect, BlockSchema, BlockMeta } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-C7sA46qu.cjs';
+import { G as GraphqlRequestOptions } from './locale-XMylB_kz.cjs';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function isDevelopment(): boolean;

package/dist/{csp-DpG1NcSd.d.ts → csp-CpiqfM03.d.ts}

@@ -1,5 +1,5 @@
 import { CmssyClientConfig, BlockRect, BlockSchema, BlockMeta } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-Ox_qVlNy.js';
+import { G as GraphqlRequestOptions } from './locale-Clouq4s4.js';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function isDevelopment(): boolean;

package/dist/index.cjs

@@ -540,6 +540,57 @@ function localizeHref(href, locale) {
   return `${addLocalePrefix(bare, locale.current, locale)}${suffix}`;
 }
 
+// src/data/site-locales.ts
+var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
+var MAX_ENTRIES = 64;
+var cache = /* @__PURE__ */ new Map();
+function localesFromSiteConfig(siteConfig) {
+  const defaultLocale = siteConfig?.defaultLanguage || "en";
+  const enabled = siteConfig?.enabledLanguages ?? [];
+  return {
+    defaultLocale,
+    locales: enabled.length > 0 ? enabled : [defaultLocale]
+  };
+}
+async function loadSiteLocales(config, options) {
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
+  const cached = cache.get(key);
+  if (cached && cached.expires > Date.now()) return cached.value;
+  cache.delete(key);
+  let value;
+  try {
+    const data = await graphqlRequest(
+      config,
+      SITE_CONFIG_QUERY,
+      { workspaceSlug: config.workspaceSlug },
+      { ...options, public: true, retry: options?.retry ?? {} },
+      "site config"
+    );
+    value = localesFromSiteConfig(data.public?.siteConfig ?? null);
+  } catch {
+    value = null;
+  }
+  if (cache.size >= MAX_ENTRIES) cache.clear();
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
+  return value;
+}
+async function resolveCmssyLocale(config, path, options) {
+  const siteLocales = await loadSiteLocales(config, options);
+  if (!siteLocales) return void 0;
+  return splitLocaleFromPath(path, siteLocales).locale;
+}
+function splitLocaleFromPath(path, siteLocales) {
+  const first = path?.[0];
+  if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {
+    return { locale: first, path: path.slice(1) };
+  }
+  return { locale: siteLocales.defaultLocale, path };
+}
+
 // src/locale.ts
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 
@@ -823,5 +874,6 @@ exports.localizeHref = localizeHref;
 exports.normalizeOrigin = normalizeOrigin;
 exports.parseEditorMessage = parseEditorMessage;
 exports.postToEditor = postToEditor;
+exports.resolveCmssyLocale = resolveCmssyLocale;
 exports.resolveEditorOrigin = resolveEditorOrigin;
 exports.verifyCmssyWebhook = verifyCmssyWebhook;

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-CRixC_wl.cjs';
-export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref } from './locale-C7sA46qu.cjs';
+export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-0D9pcuDp.cjs';
+export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-XMylB_kz.cjs';
 export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-CJQ-nafm.cjs';
 import * as _cmssy_types from '@cmssy/types';
 import { FieldOptions, TypedField, BlockPropsSchema, InferBlockContent, RelationMode, CmssyModelRecord, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-DpG1NcSd.js';
-export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref } from './locale-Ox_qVlNy.js';
+export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-CpiqfM03.js';
+export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-Clouq4s4.js';
 export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-CJQ-nafm.js';
 import * as _cmssy_types from '@cmssy/types';
 import { FieldOptions, TypedField, BlockPropsSchema, InferBlockContent, RelationMode, CmssyModelRecord, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';

package/dist/index.js

@@ -538,6 +538,57 @@ function localizeHref(href, locale) {
   return `${addLocalePrefix(bare, locale.current, locale)}${suffix}`;
 }
 
+// src/data/site-locales.ts
+var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
+var MAX_ENTRIES = 64;
+var cache = /* @__PURE__ */ new Map();
+function localesFromSiteConfig(siteConfig) {
+  const defaultLocale = siteConfig?.defaultLanguage || "en";
+  const enabled = siteConfig?.enabledLanguages ?? [];
+  return {
+    defaultLocale,
+    locales: enabled.length > 0 ? enabled : [defaultLocale]
+  };
+}
+async function loadSiteLocales(config, options) {
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
+  const cached = cache.get(key);
+  if (cached && cached.expires > Date.now()) return cached.value;
+  cache.delete(key);
+  let value;
+  try {
+    const data = await graphqlRequest(
+      config,
+      SITE_CONFIG_QUERY,
+      { workspaceSlug: config.workspaceSlug },
+      { ...options, public: true, retry: options?.retry ?? {} },
+      "site config"
+    );
+    value = localesFromSiteConfig(data.public?.siteConfig ?? null);
+  } catch {
+    value = null;
+  }
+  if (cache.size >= MAX_ENTRIES) cache.clear();
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
+  return value;
+}
+async function resolveCmssyLocale(config, path, options) {
+  const siteLocales = await loadSiteLocales(config, options);
+  if (!siteLocales) return void 0;
+  return splitLocaleFromPath(path, siteLocales).locale;
+}
+function splitLocaleFromPath(path, siteLocales) {
+  const first = path?.[0];
+  if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {
+    return { locale: first, path: path.slice(1) };
+  }
+  return { locale: siteLocales.defaultLocale, path };
+}
+
 // src/locale.ts
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 
@@ -793,4 +844,4 @@ async function verifyCmssyWebhook(options) {
   return parsed;
 }
 
-export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CmssyRequestError, CmssyWebhookError, DEFAULT_CMSSY_API_URL, DEFAULT_CMSSY_EDITOR_ORIGINS, PROTOCOL_VERSION, applyCmssyCsp, createCmssyClient, defineCmssyConfig, fields, graphqlRequest, isProtocolCompatible, isVerifiedEditUrl, localizeHref, normalizeOrigin, parseEditorMessage, postToEditor, resolveEditorOrigin, verifyCmssyWebhook };
+export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CmssyRequestError, CmssyWebhookError, DEFAULT_CMSSY_API_URL, DEFAULT_CMSSY_EDITOR_ORIGINS, PROTOCOL_VERSION, applyCmssyCsp, createCmssyClient, defineCmssyConfig, fields, graphqlRequest, isProtocolCompatible, isVerifiedEditUrl, localizeHref, normalizeOrigin, parseEditorMessage, postToEditor, resolveCmssyLocale, resolveEditorOrigin, verifyCmssyWebhook };

package/dist/internal/locale.cjs

@@ -166,6 +166,7 @@ var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -176,7 +177,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -192,12 +193,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/internal/locale.d.cts

@@ -1,28 +1,11 @@
-import { G as GraphqlRequestOptions } from '../locale-C7sA46qu.cjs';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from '../locale-C7sA46qu.cjs';
-import { CmssySiteLocales, CmssyClientConfig } from '@cmssy/types';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from '../locale-XMylB_kz.cjs';
 export { CmssySiteLocales } from '@cmssy/types';
 import '../content-client-CJQ-nafm.cjs';
 
-/**
- * Maps a workspace site config to its locale set. The single place that
- * decides the default and enabled languages - the router and the SEO helpers
- * must agree, so both go through here.
- */
-declare function localesFromSiteConfig(siteConfig: {
-    defaultLanguage?: string | null;
-    enabledLanguages?: string[];
-} | null): CmssySiteLocales;
-declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
-declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
-    locale: string;
-    path: string[] | undefined;
-};
-
 /**
  * Maps a page slug to its path for a locale: the default locale gets no
  * prefix, others get `/${locale}`. The homepage ("/") stays "/" (or "/${locale}").
  */
 declare function localizedPath(slug: string, locale: string, defaultLocale: string): string;
 
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath };
+export { localizedPath };

package/dist/internal/locale.d.ts

@@ -1,28 +1,11 @@
-import { G as GraphqlRequestOptions } from '../locale-Ox_qVlNy.js';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from '../locale-Ox_qVlNy.js';
-import { CmssySiteLocales, CmssyClientConfig } from '@cmssy/types';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from '../locale-Clouq4s4.js';
 export { CmssySiteLocales } from '@cmssy/types';
 import '../content-client-CJQ-nafm.js';
 
-/**
- * Maps a workspace site config to its locale set. The single place that
- * decides the default and enabled languages - the router and the SEO helpers
- * must agree, so both go through here.
- */
-declare function localesFromSiteConfig(siteConfig: {
-    defaultLanguage?: string | null;
-    enabledLanguages?: string[];
-} | null): CmssySiteLocales;
-declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
-declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
-    locale: string;
-    path: string[] | undefined;
-};
-
 /**
  * Maps a page slug to its path for a locale: the default locale gets no
  * prefix, others get `/${locale}`. The homepage ("/") stays "/" (or "/${locale}").
  */
 declare function localizedPath(slug: string, locale: string, defaultLocale: string): string;
 
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath };
+export { localizedPath };

package/dist/internal/locale.js

@@ -164,6 +164,7 @@ var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -174,7 +175,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -190,12 +191,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/internal.cjs

@@ -713,6 +713,7 @@ async function resolveForms(config, blocks, locale, defaultLocale, options) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -723,7 +724,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -739,12 +740,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/internal.d.cts

@@ -1,11 +1,11 @@
 export { f as fetchLayouts, c as fetchPage, d as fetchPageById, e as fetchPageMeta, g as fetchPages, n as normalizeSlug, r as resolveApiUrl, h as resolvePublicUrl } from './content-client-CJQ-nafm.cjs';
 import { CmssyFormDefinition, BuildBlockContextExtra, CmssyBlockContext, CmssyClientConfig, CmssySiteConfig, RawBlock, FieldDefinition } from '@cmssy/types';
 export { CmssySiteLocales } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-C7sA46qu.cjs';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from './locale-C7sA46qu.cjs';
-import { Q as QueryScopedOptions } from './csp-CRixC_wl.cjs';
-export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-CRixC_wl.cjs';
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath } from './internal/locale.cjs';
+import { G as GraphqlRequestOptions } from './locale-XMylB_kz.cjs';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from './locale-XMylB_kz.cjs';
+import { Q as QueryScopedOptions } from './csp-0D9pcuDp.cjs';
+export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-0D9pcuDp.cjs';
+export { localizedPath } from './internal/locale.cjs';
 
 declare const SITE_CONFIG_QUERY = "query PublicSiteConfig($workspaceSlug: String!) {\n  public {\n    siteConfig(workspaceSlug: $workspaceSlug) {\n      id\n      workspaceId\n      siteName\n      defaultLanguage\n      enabledLanguages\n      enabledFeatures\n      notFoundPageId\n      previewUrl\n      branding {\n        brandName\n        logoUrl\n        logoDarkUrl\n        faviconUrl\n        ogImageUrl\n      }\n    }\n  }\n}";
 declare const MODEL_DEFINITIONS_QUERY = "query PublicModelDefinitions($workspaceId: String!) {\n  public {\n    model {\n      definitions(workspaceId: $workspaceId) {\n        id name slug description icon color displayField recordCount\n      }\n    }\n  }\n}";

package/dist/internal.d.ts

@@ -1,11 +1,11 @@
 export { f as fetchLayouts, c as fetchPage, d as fetchPageById, e as fetchPageMeta, g as fetchPages, n as normalizeSlug, r as resolveApiUrl, h as resolvePublicUrl } from './content-client-CJQ-nafm.js';
 import { CmssyFormDefinition, BuildBlockContextExtra, CmssyBlockContext, CmssyClientConfig, CmssySiteConfig, RawBlock, FieldDefinition } from '@cmssy/types';
 export { CmssySiteLocales } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-Ox_qVlNy.js';
-export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, l as localizeHref, d as localizeHtmlLinks, s as splitCmssyLocale } from './locale-Ox_qVlNy.js';
-import { Q as QueryScopedOptions } from './csp-DpG1NcSd.js';
-export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-DpG1NcSd.js';
-export { localesFromSiteConfig, localizedPath, resolveSiteLocales, splitLocaleFromPath } from './internal/locale.js';
+import { G as GraphqlRequestOptions } from './locale-Clouq4s4.js';
+export { C as CMSSY_LOCALE_HEADER, b as buildLocaleSwitchHref, a as localeForPath, c as localeForPathname, d as localesFromSiteConfig, l as localizeHref, e as localizeHtmlLinks, f as resolveSiteLocales, s as splitCmssyLocale, h as splitLocaleFromPath } from './locale-Clouq4s4.js';
+import { Q as QueryScopedOptions } from './csp-CpiqfM03.js';
+export { o as cmssyCspHeaders, q as isDevelopment, s as resolveInitialTarget, t as toCspOrigin } from './csp-CpiqfM03.js';
+export { localizedPath } from './internal/locale.js';
 
 declare const SITE_CONFIG_QUERY = "query PublicSiteConfig($workspaceSlug: String!) {\n  public {\n    siteConfig(workspaceSlug: $workspaceSlug) {\n      id\n      workspaceId\n      siteName\n      defaultLanguage\n      enabledLanguages\n      enabledFeatures\n      notFoundPageId\n      previewUrl\n      branding {\n        brandName\n        logoUrl\n        logoDarkUrl\n        faviconUrl\n        ogImageUrl\n      }\n    }\n  }\n}";
 declare const MODEL_DEFINITIONS_QUERY = "query PublicModelDefinitions($workspaceId: String!) {\n  public {\n    model {\n      definitions(workspaceId: $workspaceId) {\n        id name slug description icon color displayField recordCount\n      }\n    }\n  }\n}";

package/dist/internal.js

@@ -711,6 +711,7 @@ async function resolveForms(config, blocks, locale, defaultLocale, options) {
 
 // src/data/site-locales.ts
 var TTL_MS = 6e4;
+var FAILURE_TTL_MS = 5e3;
 var MAX_ENTRIES = 64;
 var cache = /* @__PURE__ */ new Map();
 function localesFromSiteConfig(siteConfig) {
@@ -721,7 +722,7 @@ function localesFromSiteConfig(siteConfig) {
     locales: enabled.length > 0 ? enabled : [defaultLocale]
   };
 }
-async function resolveSiteLocales(config, options) {
+async function loadSiteLocales(config, options) {
   const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
   const cached = cache.get(key);
   if (cached && cached.expires > Date.now()) return cached.value;
@@ -737,12 +738,21 @@ async function resolveSiteLocales(config, options) {
     );
     value = localesFromSiteConfig(data.public?.siteConfig ?? null);
   } catch {
-    value = { defaultLocale: "en", locales: ["en"] };
+    value = null;
   }
   if (cache.size >= MAX_ENTRIES) cache.clear();
-  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  cache.set(key, {
+    value,
+    expires: Date.now() + (value ? TTL_MS : FAILURE_TTL_MS)
+  });
   return value;
 }
+async function resolveSiteLocales(config, options) {
+  return await loadSiteLocales(config, options) ?? {
+    defaultLocale: "en",
+    locales: ["en"]
+  };
+}
 function splitLocaleFromPath(path, siteLocales) {
   const first = path?.[0];
   if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {

package/dist/{locale-Ox_qVlNy.d.ts → locale-Clouq4s4.d.ts}

@@ -1,5 +1,5 @@
+import { CmssyClientConfig, CmssyLocaleContext, CmssySiteLocales } from '@cmssy/types';
 import { F as FetchLike, R as RetryPolicy } from './content-client-CJQ-nafm.js';
-import { CmssyClientConfig, CmssyLocaleContext } from '@cmssy/types';
 
 interface GraphqlRequestOptions {
     fetch?: FetchLike;
@@ -37,6 +37,22 @@ declare function buildLocaleSwitchHref(target: string, pathname: string, locale:
  */
 declare function localizeHtmlLinks(html: string, locale: CmssyLocaleContext): string;
 
+/**
+ * Maps a workspace site config to its locale set. The single place that
+ * decides the default and enabled languages - the router and the SEO helpers
+ * must agree, so both go through here.
+ */
+declare function localesFromSiteConfig(siteConfig: {
+    defaultLanguage?: string | null;
+    enabledLanguages?: string[];
+} | null): CmssySiteLocales;
+declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
+declare function resolveCmssyLocale(config: CmssyClientConfig, path: string[] | undefined, options?: GraphqlRequestOptions): Promise<string | undefined>;
+declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
+    locale: string;
+    path: string[] | undefined;
+};
+
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 declare function localeForPathname(config: CmssyClientConfig, pathname: string): Promise<string>;
 declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | undefined): Promise<{
@@ -49,4 +65,4 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
  */
 declare function localeForPath(config: CmssyClientConfig, path: string | string[]): Promise<string>;
 
-export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localizeHtmlLinks as d, graphqlRequest as g, localizeHref as l, splitCmssyLocale as s };
+export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localesFromSiteConfig as d, localizeHtmlLinks as e, resolveSiteLocales as f, graphqlRequest as g, splitLocaleFromPath as h, localizeHref as l, resolveCmssyLocale as r, splitCmssyLocale as s };

package/dist/{locale-C7sA46qu.d.cts → locale-XMylB_kz.d.cts}

@@ -1,5 +1,5 @@
+import { CmssyClientConfig, CmssyLocaleContext, CmssySiteLocales } from '@cmssy/types';
 import { F as FetchLike, R as RetryPolicy } from './content-client-CJQ-nafm.cjs';
-import { CmssyClientConfig, CmssyLocaleContext } from '@cmssy/types';
 
 interface GraphqlRequestOptions {
     fetch?: FetchLike;
@@ -37,6 +37,22 @@ declare function buildLocaleSwitchHref(target: string, pathname: string, locale:
  */
 declare function localizeHtmlLinks(html: string, locale: CmssyLocaleContext): string;
 
+/**
+ * Maps a workspace site config to its locale set. The single place that
+ * decides the default and enabled languages - the router and the SEO helpers
+ * must agree, so both go through here.
+ */
+declare function localesFromSiteConfig(siteConfig: {
+    defaultLanguage?: string | null;
+    enabledLanguages?: string[];
+} | null): CmssySiteLocales;
+declare function resolveSiteLocales(config: CmssyClientConfig, options?: GraphqlRequestOptions): Promise<CmssySiteLocales>;
+declare function resolveCmssyLocale(config: CmssyClientConfig, path: string[] | undefined, options?: GraphqlRequestOptions): Promise<string | undefined>;
+declare function splitLocaleFromPath(path: string[] | undefined, siteLocales: CmssySiteLocales): {
+    locale: string;
+    path: string[] | undefined;
+};
+
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 declare function localeForPathname(config: CmssyClientConfig, pathname: string): Promise<string>;
 declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | undefined): Promise<{
@@ -49,4 +65,4 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
  */
 declare function localeForPath(config: CmssyClientConfig, path: string | string[]): Promise<string>;
 
-export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localizeHtmlLinks as d, graphqlRequest as g, localizeHref as l, splitCmssyLocale as s };
+export { CMSSY_LOCALE_HEADER as C, type GraphqlRequestOptions as G, localeForPath as a, buildLocaleSwitchHref as b, localeForPathname as c, localesFromSiteConfig as d, localizeHtmlLinks as e, resolveSiteLocales as f, graphqlRequest as g, splitLocaleFromPath as h, localizeHref as l, resolveCmssyLocale as r, splitCmssyLocale as s };

package/dist/testing.cjs

@@ -141,6 +141,47 @@ async function graphqlRequest(config, query, variables, options = {}, label = "r
   });
 }
 
+// src/preflight.ts
+var ALLOWED_FRAME_HOSTS = ["cmssy.io", "www.cmssy.io"];
+function frameAncestorSources(cspHeaderValue) {
+  const directive = cspHeaderValue.split(";").map((part) => part.trim()).find((part) => /^frame-ancestors\b/i.test(part));
+  if (!directive) return null;
+  return directive.split(/\s+/).slice(1).map((source) => source.toLowerCase().replace(/^'|'$/g, ""));
+}
+function allowsCmssyAdmin(source) {
+  if (source === "*" || source === "https:") return true;
+  const host = source.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").split("/")[0];
+  if (!host) return false;
+  if (host === "*.cmssy.io") return true;
+  return ALLOWED_FRAME_HOSTS.includes(host);
+}
+function checkFrameAncestors(cspHeaderValue) {
+  if (!cspHeaderValue || cspHeaderValue.trim().length === 0) {
+    return {
+      status: "ok",
+      message: "no Content-Security-Policy restricts framing"
+    };
+  }
+  const sources = frameAncestorSources(cspHeaderValue);
+  if (sources === null) {
+    return {
+      status: "ok",
+      message: "the Content-Security-Policy has no frame-ancestors directive"
+    };
+  }
+  if (sources.some(allowsCmssyAdmin)) {
+    return {
+      status: "ok",
+      message: "frame-ancestors allows the cmssy editor"
+    };
+  }
+  return {
+    status: "fail",
+    message: `frame-ancestors (${sources.join(" ") || "'none'"}) blocks the cmssy editor`,
+    fix: "add https://cmssy.io https://www.cmssy.io to the frame-ancestors directive (applyCmssyCsp does this for you)"
+  };
+}
+
 // src/testing/edit-smoke.ts
 var EDITOR_MARKER = /data-cmssy-editor/;
 var SERVER_LAYOUT_BLOCKS = /<header|<footer/;
@@ -151,7 +192,22 @@ function resolvedContentCounts(body) {
 }
 async function html(url) {
   const response = await fetch(url, { redirect: "manual" });
-  return { status: response.status, body: await response.text() };
+  return {
+    status: response.status,
+    body: await response.text(),
+    headers: response.headers
+  };
+}
+var EDIT_PATH_PREFIX = "/cmssy-edit";
+function withoutEditPrefix(path) {
+  if (path === EDIT_PATH_PREFIX) return "/";
+  return path.startsWith(`${EDIT_PATH_PREFIX}/`) ? path.slice(EDIT_PATH_PREFIX.length) : path;
+}
+function localeOf(path) {
+  return withoutEditPrefix(path).split("/").filter(Boolean)[0];
+}
+function langOf(body) {
+  return /<html[^>]*\slang=["']([^"']+)["']/i.exec(body)?.[1];
 }
 var LAYOUT_BLOCKS_QUERY = `query CmssySmokeLayouts($workspaceSlug: String!, $pageSlug: String!) {
   public {
@@ -232,25 +288,55 @@ async function checkCmssyEditMode(options) {
       );
     }
   }
+  const query = `cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`;
   const { localizedPath } = options;
   if (localizedPath) {
-    const locale = options.localizedLocale ?? localizedPath.split("/").filter(Boolean)[0];
-    const localized = await html(
-      url(
-        `${localizedPath}?cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`
-      )
-    );
-    if (!EDITOR_MARKER.test(localized.body)) {
-      failures.push(`edit ${localizedPath}: no editor in the response`);
-    }
-    const served = /<html[^>]*\slang=["']([^"']+)["']/i.exec(localized.body)?.[1];
-    if (locale && served !== locale) {
+    const locale = options.localizedLocale ?? localeOf(localizedPath);
+    const localized = await html(url(`${localizedPath}?${query}`));
+    if (localized.status !== 200) {
       failures.push(
-        `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        `edit ${localizedPath}: expected 200, got ${localized.status}`
       );
+    } else {
+      if (!EDITOR_MARKER.test(localized.body)) {
+        failures.push(`edit ${localizedPath}: no editor in the response`);
+      }
+      const served = langOf(localized.body);
+      if (locale && served !== locale) {
+        failures.push(
+          `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        );
+      }
+      if (options.editRoute !== false) {
+        await checkDirectEditRoute(url, localizedPath, query, locale, failures);
+      }
     }
   }
+  if (options.editRoute !== false) {
+    await checkDirectEditRoute(url, path, query, void 0, failures);
+  }
   return { ok: failures.length === 0, failures };
 }
+async function checkDirectEditRoute(url, routedPath, query, locale, failures) {
+  const withoutPrefix = withoutEditPrefix(routedPath);
+  const directPath = `${EDIT_PATH_PREFIX}${withoutPrefix === "/" ? "" : withoutPrefix}`;
+  if (directPath === routedPath) return;
+  const direct = await html(url(`${directPath}?${query}`));
+  if (direct.status !== 200 || !EDITOR_MARKER.test(direct.body)) return;
+  const directLang = langOf(direct.body);
+  if (locale && directLang !== locale) {
+    failures.push(
+      `edit ${directPath}: reached directly the page reports lang="${directLang ?? "?"}", through the rewrite it reports "${locale}" - the same page renders in two languages depending on how the editor arrives`
+    );
+  }
+  const framing = checkFrameAncestors(
+    direct.headers.get("content-security-policy")
+  );
+  if (framing.status === "fail") {
+    failures.push(
+      `edit ${directPath}: ${framing.message} - the editor shows a blank panel for a route that renders fine on its own. ${framing.fix ?? ""}`.trim()
+    );
+  }
+}
 
 exports.checkCmssyEditMode = checkCmssyEditMode;

package/dist/testing.d.cts

@@ -6,11 +6,13 @@ interface EditSmokeOptions {
     /** A published page to exercise. Defaults to "/". */
     path?: string;
     /**
-     * The same page under a language prefix, e.g. "/no". Pass it on a site whose
-     * URLs carry the language, and the check also proves the preview renders in
-     * THAT language rather than the default one - by reading `<html lang>`, which
-     * is a contract, unlike a word from the page's copy that an editor can change
-     * at any time.
+     * The same page under a language prefix, e.g. "/no". The caller states it
+     * because only the caller knows how its site spells a language; asking a
+     * workspace would tie this check to content that can change or be deleted.
+     *
+     * Given it, the check also proves the preview renders in THAT language rather
+     * than the default one - by reading `<html lang>`, which is a contract,
+     * unlike a word from the page's copy that an editor can change at any time.
      */
     localizedPath?: string;
     /**
@@ -33,6 +35,7 @@ interface EditSmokeOptions {
         workspaceSlug: string;
         apiUrl?: string;
     };
+    editRoute?: boolean;
 }
 interface EditSmokeResult {
     ok: boolean;

package/dist/testing.d.ts

@@ -6,11 +6,13 @@ interface EditSmokeOptions {
     /** A published page to exercise. Defaults to "/". */
     path?: string;
     /**
-     * The same page under a language prefix, e.g. "/no". Pass it on a site whose
-     * URLs carry the language, and the check also proves the preview renders in
-     * THAT language rather than the default one - by reading `<html lang>`, which
-     * is a contract, unlike a word from the page's copy that an editor can change
-     * at any time.
+     * The same page under a language prefix, e.g. "/no". The caller states it
+     * because only the caller knows how its site spells a language; asking a
+     * workspace would tie this check to content that can change or be deleted.
+     *
+     * Given it, the check also proves the preview renders in THAT language rather
+     * than the default one - by reading `<html lang>`, which is a contract,
+     * unlike a word from the page's copy that an editor can change at any time.
      */
     localizedPath?: string;
     /**
@@ -33,6 +35,7 @@ interface EditSmokeOptions {
         workspaceSlug: string;
         apiUrl?: string;
     };
+    editRoute?: boolean;
 }
 interface EditSmokeResult {
     ok: boolean;

package/dist/testing.js

@@ -139,6 +139,47 @@ async function graphqlRequest(config, query, variables, options = {}, label = "r
   });
 }
 
+// src/preflight.ts
+var ALLOWED_FRAME_HOSTS = ["cmssy.io", "www.cmssy.io"];
+function frameAncestorSources(cspHeaderValue) {
+  const directive = cspHeaderValue.split(";").map((part) => part.trim()).find((part) => /^frame-ancestors\b/i.test(part));
+  if (!directive) return null;
+  return directive.split(/\s+/).slice(1).map((source) => source.toLowerCase().replace(/^'|'$/g, ""));
+}
+function allowsCmssyAdmin(source) {
+  if (source === "*" || source === "https:") return true;
+  const host = source.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").split("/")[0];
+  if (!host) return false;
+  if (host === "*.cmssy.io") return true;
+  return ALLOWED_FRAME_HOSTS.includes(host);
+}
+function checkFrameAncestors(cspHeaderValue) {
+  if (!cspHeaderValue || cspHeaderValue.trim().length === 0) {
+    return {
+      status: "ok",
+      message: "no Content-Security-Policy restricts framing"
+    };
+  }
+  const sources = frameAncestorSources(cspHeaderValue);
+  if (sources === null) {
+    return {
+      status: "ok",
+      message: "the Content-Security-Policy has no frame-ancestors directive"
+    };
+  }
+  if (sources.some(allowsCmssyAdmin)) {
+    return {
+      status: "ok",
+      message: "frame-ancestors allows the cmssy editor"
+    };
+  }
+  return {
+    status: "fail",
+    message: `frame-ancestors (${sources.join(" ") || "'none'"}) blocks the cmssy editor`,
+    fix: "add https://cmssy.io https://www.cmssy.io to the frame-ancestors directive (applyCmssyCsp does this for you)"
+  };
+}
+
 // src/testing/edit-smoke.ts
 var EDITOR_MARKER = /data-cmssy-editor/;
 var SERVER_LAYOUT_BLOCKS = /<header|<footer/;
@@ -149,7 +190,22 @@ function resolvedContentCounts(body) {
 }
 async function html(url) {
   const response = await fetch(url, { redirect: "manual" });
-  return { status: response.status, body: await response.text() };
+  return {
+    status: response.status,
+    body: await response.text(),
+    headers: response.headers
+  };
+}
+var EDIT_PATH_PREFIX = "/cmssy-edit";
+function withoutEditPrefix(path) {
+  if (path === EDIT_PATH_PREFIX) return "/";
+  return path.startsWith(`${EDIT_PATH_PREFIX}/`) ? path.slice(EDIT_PATH_PREFIX.length) : path;
+}
+function localeOf(path) {
+  return withoutEditPrefix(path).split("/").filter(Boolean)[0];
+}
+function langOf(body) {
+  return /<html[^>]*\slang=["']([^"']+)["']/i.exec(body)?.[1];
 }
 var LAYOUT_BLOCKS_QUERY = `query CmssySmokeLayouts($workspaceSlug: String!, $pageSlug: String!) {
   public {
@@ -230,25 +286,55 @@ async function checkCmssyEditMode(options) {
       );
     }
   }
+  const query = `cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`;
   const { localizedPath } = options;
   if (localizedPath) {
-    const locale = options.localizedLocale ?? localizedPath.split("/").filter(Boolean)[0];
-    const localized = await html(
-      url(
-        `${localizedPath}?cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`
-      )
-    );
-    if (!EDITOR_MARKER.test(localized.body)) {
-      failures.push(`edit ${localizedPath}: no editor in the response`);
-    }
-    const served = /<html[^>]*\slang=["']([^"']+)["']/i.exec(localized.body)?.[1];
-    if (locale && served !== locale) {
+    const locale = options.localizedLocale ?? localeOf(localizedPath);
+    const localized = await html(url(`${localizedPath}?${query}`));
+    if (localized.status !== 200) {
       failures.push(
-        `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        `edit ${localizedPath}: expected 200, got ${localized.status}`
       );
+    } else {
+      if (!EDITOR_MARKER.test(localized.body)) {
+        failures.push(`edit ${localizedPath}: no editor in the response`);
+      }
+      const served = langOf(localized.body);
+      if (locale && served !== locale) {
+        failures.push(
+          `edit ${localizedPath}: the page reports lang="${served ?? "?"}" but the URL asks for "${locale}" - the preview renders in the wrong language`
+        );
+      }
+      if (options.editRoute !== false) {
+        await checkDirectEditRoute(url, localizedPath, query, locale, failures);
+      }
     }
   }
+  if (options.editRoute !== false) {
+    await checkDirectEditRoute(url, path, query, void 0, failures);
+  }
   return { ok: failures.length === 0, failures };
 }
+async function checkDirectEditRoute(url, routedPath, query, locale, failures) {
+  const withoutPrefix = withoutEditPrefix(routedPath);
+  const directPath = `${EDIT_PATH_PREFIX}${withoutPrefix === "/" ? "" : withoutPrefix}`;
+  if (directPath === routedPath) return;
+  const direct = await html(url(`${directPath}?${query}`));
+  if (direct.status !== 200 || !EDITOR_MARKER.test(direct.body)) return;
+  const directLang = langOf(direct.body);
+  if (locale && directLang !== locale) {
+    failures.push(
+      `edit ${directPath}: reached directly the page reports lang="${directLang ?? "?"}", through the rewrite it reports "${locale}" - the same page renders in two languages depending on how the editor arrives`
+    );
+  }
+  const framing = checkFrameAncestors(
+    direct.headers.get("content-security-policy")
+  );
+  if (framing.status === "fail") {
+    failures.push(
+      `edit ${directPath}: ${framing.message} - the editor shows a blank panel for a route that renders fine on its own. ${framing.fix ?? ""}`.trim()
+    );
+  }
+}
 
 export { checkCmssyEditMode };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/core",
-  "version": "11.4.2",
+  "version": "11.5.1",
   "description": "Framework-agnostic cmssy gateway: GraphQL client, block/field system, editor protocol. No React, no Next.",
   "keywords": [
     "cmssy",