@cmssy/core 5.0.0

package/dist/index.js

@@ -0,0 +1,1696 @@
+import { EncryptJWT, jwtDecrypt } from 'jose';
+export { evaluateFieldConditionGroup } from '@cmssy/types';
+import { createHmac, timingSafeEqual } from 'crypto';
+
+// src/session.ts
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+var DEFAULT_CMSSY_EDITOR_ORIGINS = [
+  "https://cmssy.io",
+  "https://www.cmssy.io"
+];
+function parseEditorOriginEnv(raw) {
+  if (!raw) return void 0;
+  const parts = raw.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+  if (parts.length === 0) return void 0;
+  return parts.length === 1 ? parts[0] : parts;
+}
+function isDevelopment() {
+  return typeof process !== "undefined" && process.env.NODE_ENV === "development";
+}
+function resolveEditorOrigin(editorOrigin) {
+  const value = editorOrigin ?? (typeof process !== "undefined" ? parseEditorOriginEnv(process.env.CMSSY_EDITOR_ORIGIN) : void 0);
+  if (value === void 0) {
+    return isDevelopment() ? "*" : DEFAULT_CMSSY_EDITOR_ORIGINS;
+  }
+  if (Array.isArray(value)) {
+    const cleaned = value.filter((o) => o && o.trim().length > 0);
+    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGINS;
+  }
+  return value.trim().length > 0 ? value : DEFAULT_CMSSY_EDITOR_ORIGINS;
+}
+var REQUIRED_CONFIG_ENV = [
+  ["org", "CMSSY_ORG_SLUG"],
+  ["workspaceSlug", "CMSSY_WORKSPACE_SLUG"],
+  ["draftSecret", "CMSSY_DRAFT_SECRET"]
+];
+function defineCmssyConfig(config) {
+  const resolved = { ...config };
+  const missing = [];
+  for (const [key, env] of REQUIRED_CONFIG_ENV) {
+    const value = config[key];
+    const trimmed = typeof value === "string" ? value.trim() : "";
+    if (trimmed) {
+      resolved[key] = trimmed;
+    } else {
+      missing.push(`${env} (config.${key})`);
+    }
+  }
+  if (missing.length > 0) {
+    if (typeof window !== "undefined") {
+      throw new Error(
+        "cmssy: the config was evaluated in the browser, so it cannot see the server's environment variables.\n\nThis is an import problem, not a config problem: client-side code imported a VALUE from a module that reads the cmssy config - directly, or through a helper sitting next to one.\n\nFix it by importing types only (they are erased at build time), or by moving the value into a module that does not touch the config."
+      );
+    }
+    throw new Error(
+      `cmssy: missing required configuration:
+  - ${missing.join(
+        "\n  - "
+      )}
+Set the listed environment variables (e.g. in .env.local) and restart the dev server.`
+    );
+  }
+  return resolved;
+}
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+
+// src/data/http.ts
+var CmssyRequestError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "CmssyRequestError";
+    this.status = status;
+  }
+};
+var DEFAULT_RETRY_STATUSES = [429, 503];
+function retryAfterMs(response) {
+  const raw = response.headers?.get("retry-after");
+  if (!raw) return null;
+  const seconds = Number(raw);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const date = Date.parse(raw);
+  if (Number.isFinite(date)) return Math.max(0, date - Date.now());
+  return null;
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("cmssy: request aborted"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timer);
+      reject(new Error("cmssy: request aborted"));
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function fetchWithRetry(doFetch, url, init, retry) {
+  if (retry === false || retry === void 0) {
+    return doFetch(url, init);
+  }
+  const maxRetries = retry.maxRetries ?? 3;
+  const baseDelayMs = retry.baseDelayMs ?? 300;
+  const maxDelayMs = retry.maxDelayMs ?? 3e3;
+  const retryStatuses = retry.retryStatuses ?? DEFAULT_RETRY_STATUSES;
+  let response = await doFetch(url, init);
+  for (let attempt = 0; attempt < maxRetries; attempt++) {
+    if (response.ok || !retryStatuses.includes(response.status)) {
+      return response;
+    }
+    const backoff = baseDelayMs * 2 ** attempt;
+    const wait = Math.min(retryAfterMs(response) ?? backoff, maxDelayMs);
+    await sleep(wait, init.signal);
+    response = await doFetch(url, init);
+  }
+  return response;
+}
+async function postGraphql(url, query, variables, options) {
+  const doFetch = options.fetch ?? globalThis.fetch;
+  if (typeof doFetch !== "function") {
+    throw new Error(
+      "cmssy: no fetch implementation available - pass options.fetch"
+    );
+  }
+  const response = await fetchWithRetry(
+    doFetch,
+    url,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json", ...options.headers },
+      body: JSON.stringify({ query, variables }),
+      signal: options.signal
+    },
+    options.retry
+  );
+  if (!response.ok) {
+    let detail = "";
+    try {
+      const body = await response.json();
+      if (body.errors && body.errors.length > 0) {
+        detail = ` - ${body.errors.map((error) => error.message ?? "GraphQL error").join("; ")}`;
+      }
+    } catch {
+      detail = "";
+    }
+    throw new CmssyRequestError(
+      `cmssy: ${options.label} failed (${response.status})${detail}`,
+      response.status
+    );
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch {
+    throw new Error(`cmssy: invalid JSON response from the ${options.label}`);
+  }
+  if (json.errors && json.errors.length > 0) {
+    const message = json.errors.map((error) => error.message ?? "GraphQL error").join("; ");
+    throw new Error(`cmssy: ${options.label} error - ${message}`);
+  }
+  return json.data;
+}
+
+// src/content/content-client.ts
+var DEFAULT_CMSSY_API_URL = "https://api.cmssy.io/graphql";
+function resolveApiUrl(apiUrl) {
+  const explicit = apiUrl?.trim();
+  if (explicit) return explicit;
+  const env = globalThis.process?.env;
+  const fromEnv = env?.CMSSY_API_URL?.trim() ?? "";
+  return fromEnv.length > 0 ? fromEnv : DEFAULT_CMSSY_API_URL;
+}
+function resolvePublicUrl(config) {
+  const base = resolveApiUrl(config.apiUrl).replace(/\/graphql\/?$/, "");
+  return `${base}/public/${config.org}/${config.workspaceSlug}/graphql`;
+}
+var PUBLIC_PAGE_QUERY = `query PublicPage($workspaceSlug: String!, $slug: String!, $previewSecret: String) {
+  public {
+    page {
+      get(workspaceSlug: $workspaceSlug, slug: $slug, previewSecret: $previewSecret) {
+        id
+        blocks { id type content style advanced }
+        publishedBlocks { id type content style advanced }
+      }
+    }
+  }
+}`;
+var PUBLIC_PAGE_DEV_QUERY = `query PublicPage($workspaceSlug: String!, $slug: String!, $previewSecret: String, $devPreview: Boolean) {
+  public {
+    page {
+      get(workspaceSlug: $workspaceSlug, slug: $slug, previewSecret: $previewSecret, devPreview: $devPreview) {
+        id
+        blocks { id type content style advanced }
+        publishedBlocks { id type content style advanced }
+      }
+    }
+  }
+}`;
+var PUBLIC_PAGE_BY_ID_QUERY = `query PublicPageById($workspaceSlug: String!, $pageId: ID!) {
+  public {
+    page {
+      getById(workspaceSlug: $workspaceSlug, pageId: $pageId) {
+        id
+        publishedBlocks { id type content style advanced }
+      }
+    }
+  }
+}`;
+var PUBLIC_PAGES_QUERY = `query PublicPages($workspaceSlug: String!) {
+  public {
+    page {
+      list(workspaceSlug: $workspaceSlug) {
+        id
+        slug
+        updatedAt
+        publishedAt
+      }
+    }
+  }
+}`;
+var PUBLIC_PAGE_META_QUERY = `query PublicPageMeta($workspaceSlug: String!, $slug: String!) {
+  public {
+    page {
+      get(workspaceSlug: $workspaceSlug, slug: $slug) {
+        id
+        seoTitle
+        seoDescription
+        seoKeywords
+        displayName
+      }
+    }
+  }
+}`;
+var PUBLIC_PAGE_LAYOUTS_QUERY = `query PublicPageLayouts($workspaceSlug: String!, $pageSlug: String!, $previewSecret: String) {
+  public {
+    page {
+      layouts(workspaceSlug: $workspaceSlug, pageSlug: $pageSlug, previewSecret: $previewSecret) {
+        position
+        blocks { id type content style advanced order isActive }
+        settings { desktopWidth mobileBehavior }
+      }
+    }
+  }
+}`;
+function normalizeSlug(path) {
+  if (Array.isArray(path)) {
+    const joined = path.filter(Boolean).join("/");
+    return joined ? `/${joined}` : "/";
+  }
+  if (!path || path === "/") return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+}
+async function fetchPage(config, path, options = {}) {
+  const slug = normalizeSlug(path);
+  const trimmedSecret = options.previewSecret?.trim();
+  const previewSecret = trimmedSecret ? trimmedSecret : null;
+  const devToken = options.devToken?.trim();
+  const devPreview = Boolean(options.devPreview && devToken);
+  const headers2 = {};
+  if (devPreview && devToken) {
+    headers2["authorization"] = `Bearer ${devToken}`;
+    if (options.workspaceId) {
+      headers2["x-workspace-id"] = options.workspaceId;
+    }
+  }
+  const data = await postGraphql(
+    resolvePublicUrl(config),
+    devPreview ? PUBLIC_PAGE_DEV_QUERY : PUBLIC_PAGE_QUERY,
+    {
+      workspaceSlug: config.workspaceSlug,
+      slug,
+      previewSecret,
+      ...devPreview ? { devPreview: true } : {}
+    },
+    {
+      fetch: options.fetch,
+      signal: options.signal,
+      headers: headers2,
+      retry: options.retry ?? {},
+      label: "page fetch"
+    }
+  );
+  const page = data?.public?.page?.get;
+  if (!page) return null;
+  const draft = previewSecret !== null || devPreview;
+  const blocks = (draft ? page.blocks : page.publishedBlocks) ?? [];
+  return { id: page.id, blocks };
+}
+async function fetchPageById(config, pageId, options = {}) {
+  const data = await postGraphql(
+    resolvePublicUrl(config),
+    PUBLIC_PAGE_BY_ID_QUERY,
+    { workspaceSlug: config.workspaceSlug, pageId },
+    {
+      fetch: options.fetch,
+      signal: options.signal,
+      retry: options.retry ?? {},
+      label: "page-by-id fetch"
+    }
+  );
+  const page = data?.public?.page?.getById;
+  if (!page) return null;
+  return { id: page.id, blocks: page.publishedBlocks ?? [] };
+}
+async function fetchPages(config, options = {}) {
+  const data = await postGraphql(
+    resolvePublicUrl(config),
+    PUBLIC_PAGES_QUERY,
+    { workspaceSlug: config.workspaceSlug },
+    {
+      fetch: options.fetch,
+      signal: options.signal,
+      retry: options.retry ?? {},
+      label: "pages fetch"
+    }
+  );
+  return data?.public?.page?.list ?? [];
+}
+async function fetchPageMeta(config, path, options = {}) {
+  const slug = normalizeSlug(path);
+  const data = await postGraphql(
+    resolvePublicUrl(config),
+    PUBLIC_PAGE_META_QUERY,
+    { workspaceSlug: config.workspaceSlug, slug },
+    {
+      fetch: options.fetch,
+      signal: options.signal,
+      retry: options.retry ?? {},
+      label: "page meta fetch"
+    }
+  );
+  return data?.public?.page?.get ?? null;
+}
+async function fetchLayouts(config, path, options = {}) {
+  const pageSlug = normalizeSlug(path);
+  const trimmedSecret = options.previewSecret?.trim();
+  const previewSecret = trimmedSecret ? trimmedSecret : null;
+  const data = await postGraphql(
+    resolvePublicUrl(config),
+    PUBLIC_PAGE_LAYOUTS_QUERY,
+    { workspaceSlug: config.workspaceSlug, pageSlug, previewSecret },
+    {
+      fetch: options.fetch,
+      signal: options.signal,
+      retry: options.retry ?? {},
+      label: "layouts fetch"
+    }
+  );
+  return data?.public?.page?.layouts ?? [];
+}
+
+// src/content/get-block-content.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function looksLikeLocaleKey(key) {
+  return /^[a-z]{2}(-[A-Za-z]{2})?$/.test(key);
+}
+function getBlockContentForLanguage(content, locale, defaultLocale = "en", availableLocales) {
+  if (!isPlainObject(content)) return {};
+  const isLocale = availableLocales ? (key) => availableLocales.includes(key) : looksLikeLocaleKey;
+  const localeEntries = Object.entries(content).filter(
+    ([key, value]) => isLocale(key) && isPlainObject(value)
+  );
+  if (localeEntries.length === 0) return { ...content };
+  const localeMap = Object.fromEntries(localeEntries);
+  const nonTranslatable = {};
+  for (const [key, value] of Object.entries(content)) {
+    if (!(isLocale(key) && isPlainObject(value))) nonTranslatable[key] = value;
+  }
+  const fallbackKey = Object.keys(localeMap)[0];
+  const chosen = localeMap[locale] ?? localeMap[defaultLocale] ?? localeMap[fallbackKey];
+  return { ...nonTranslatable, ...chosen };
+}
+function asBucket(value) {
+  return isPlainObject(value) ? value : {};
+}
+
+// src/data/graphql-request.ts
+async function graphqlRequest(config, query, variables, options = {}, label = "request") {
+  const url = options.public ? resolvePublicUrl(config) : resolveApiUrl(config.apiUrl);
+  return postGraphql(url, query, variables, {
+    fetch: options.fetch,
+    signal: options.signal,
+    headers: options.headers,
+    retry: options.retry,
+    label
+  });
+}
+
+// src/data/queries.ts
+var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
+  public {
+    siteConfig(workspaceSlug: $workspaceSlug) {
+      id
+      workspaceId
+      siteName
+      defaultLanguage
+      enabledLanguages
+      enabledFeatures
+      notFoundPageId
+      previewUrl
+      branding {
+        brandName
+        logoUrl
+        faviconUrl
+        ogImageUrl
+      }
+    }
+  }
+}`;
+var MODEL_DEFINITIONS_QUERY = `query PublicModelDefinitions($workspaceId: String!) {
+  public {
+    model {
+      definitions(workspaceId: $workspaceId) {
+        id name slug description icon color displayField recordCount
+      }
+    }
+  }
+}`;
+var MODEL_RECORDS_QUERY = `query PublicModelRecords($workspaceId: String!, $modelSlug: String!, $filter: JSON, $sort: String, $locale: String, $limit: Int, $offset: Int, $populate: [String!]) {
+  public {
+    model {
+      records(workspaceId: $workspaceId, modelSlug: $modelSlug, filter: $filter, sort: $sort, locale: $locale, limit: $limit, offset: $offset, populate: $populate) {
+        items { id modelId data status createdAt updatedAt }
+        total
+        hasMore
+      }
+    }
+  }
+}`;
+var FORM_QUERY = `query PublicForm($formId: ID!) {
+  public {
+    form {
+      get(formId: $formId) {
+        id
+        name
+        slug
+        description
+        fields {
+          id name fieldType label placeholder helpText
+          defaultValue width order showWhen requiredWhen
+          options { value label disabled }
+          validation { required minLength maxLength minValue maxValue pattern customMessage }
+        }
+        settings {
+          actionType submitButtonLabel successMessage errorMessage
+          redirectUrl requireLogin enableCaptcha
+        }
+      }
+    }
+  }
+}`;
+var SUBMIT_FORM_MUTATION = `mutation SubmitForm($formId: ID!, $input: SubmitFormInput!) {
+  public {
+    form {
+      submit(formId: $formId, input: $input) {
+        success message submissionId redirectUrl accessToken customer
+      }
+    }
+  }
+}`;
+
+// src/data/settings-client.ts
+async function fetchSiteConfig(config, options = {}) {
+  const data = await graphqlRequest(
+    config,
+    SITE_CONFIG_QUERY,
+    { workspaceSlug: config.workspaceSlug },
+    { ...options, public: true, retry: options.retry ?? {} },
+    "site config query"
+  );
+  return data.public?.siteConfig ?? null;
+}
+async function resolveWorkspaceId(config, options = {}) {
+  const siteConfig = await fetchSiteConfig(config, options);
+  if (!siteConfig?.workspaceId) {
+    throw new Error(
+      `cmssy: could not resolve workspaceId for "${config.workspaceSlug}"`
+    );
+  }
+  return siteConfig.workspaceId;
+}
+var workspaceIdCache = /* @__PURE__ */ new Map();
+function cachedWorkspaceId(config) {
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
+  const existing = workspaceIdCache.get(key);
+  if (existing) return existing;
+  const fresh = resolveWorkspaceId(config).catch((err) => {
+    workspaceIdCache.delete(key);
+    throw err;
+  });
+  workspaceIdCache.set(key, fresh);
+  return fresh;
+}
+function clearWorkspaceIdCache() {
+  workspaceIdCache.clear();
+}
+
+// src/data/client.ts
+function createCmssyClient(input) {
+  const config = {
+    ...input,
+    apiUrl: resolveApiUrl(input.apiUrl)
+  };
+  let cachedWorkspaceId2;
+  let inFlight;
+  function resolveWorkspaceId2(options) {
+    if (cachedWorkspaceId2) return Promise.resolve(cachedWorkspaceId2);
+    if (!inFlight) {
+      inFlight = resolveWorkspaceId(config, options).then((id) => {
+        cachedWorkspaceId2 = id;
+        return id;
+      }).finally(() => {
+        inFlight = void 0;
+      });
+    }
+    return inFlight;
+  }
+  return {
+    config,
+    resolveWorkspaceId: resolveWorkspaceId2,
+    query(document2, variables = {}, options) {
+      return graphqlRequest(
+        config,
+        document2,
+        variables,
+        options,
+        "graphql operation"
+      );
+    },
+    async queryScoped(document2, variables = {}, options = {}) {
+      const { workspaceId: provided, headers: headers2, ...rest } = options;
+      const workspaceId = provided ?? await resolveWorkspaceId2({ ...rest, headers: headers2 });
+      const hasWorkspaceId = variables.workspaceId !== void 0 && variables.workspaceId !== null;
+      const scopedVariables = /\$workspaceId\b/.test(document2) && !hasWorkspaceId ? { ...variables, workspaceId } : variables;
+      return graphqlRequest(
+        config,
+        document2,
+        scopedVariables,
+        { ...rest, headers: { ...headers2, "x-workspace-id": workspaceId } },
+        "graphql operation"
+      );
+    }
+  };
+}
+
+// src/data/resolve-forms.ts
+function collectFormIds(blocks, locale, defaultLocale) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const block of blocks) {
+    const content = getBlockContentForLanguage(
+      block.content,
+      locale,
+      defaultLocale
+    );
+    const formId = content.formId;
+    if (typeof formId === "string" && formId.trim()) ids.add(formId);
+  }
+  return [...ids];
+}
+async function resolveForms(config, blocks, locale, defaultLocale, options) {
+  const ids = collectFormIds(blocks, locale, defaultLocale);
+  if (ids.length === 0) return {};
+  const client = createCmssyClient(config);
+  const entries = await Promise.all(
+    ids.map(async (id) => {
+      try {
+        const data = await client.queryScoped(FORM_QUERY, { formId: id }, options);
+        return [id, data.public.form.get];
+      } catch (err) {
+        if (typeof console !== "undefined") {
+          console.warn(`[cmssy] failed to resolve form ${id}`, err);
+        }
+        return [id, null];
+      }
+    })
+  );
+  const forms = {};
+  for (const [id, def] of entries) {
+    if (def) forms[id] = def;
+  }
+  return forms;
+}
+
+// src/data/site-locales.ts
+var TTL_MS = 6e4;
+var MAX_ENTRIES = 64;
+var cache = /* @__PURE__ */ new Map();
+async function resolveSiteLocales(config, options) {
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.org}::${config.workspaceSlug}`;
+  const cached = cache.get(key);
+  if (cached && cached.expires > Date.now()) return cached.value;
+  cache.delete(key);
+  let value;
+  try {
+    const data = await graphqlRequest(
+      config,
+      SITE_CONFIG_QUERY,
+      { workspaceSlug: config.workspaceSlug },
+      { ...options, public: true, retry: options?.retry ?? {} },
+      "site config"
+    );
+    const siteConfig = data.public?.siteConfig ?? null;
+    const defaultLocale = siteConfig?.defaultLanguage || "en";
+    const enabled = siteConfig?.enabledLanguages ?? [];
+    value = {
+      defaultLocale,
+      locales: enabled.length > 0 ? enabled : [defaultLocale]
+    };
+  } catch {
+    value = { defaultLocale: "en", locales: ["en"] };
+  }
+  if (cache.size >= MAX_ENTRIES) cache.clear();
+  cache.set(key, { value, expires: Date.now() + TTL_MS });
+  return value;
+}
+function splitLocaleFromPath(path, siteLocales) {
+  const first = path?.[0];
+  if (first && first !== siteLocales.defaultLocale && siteLocales.locales.includes(first)) {
+    return { locale: first, path: path.slice(1) };
+  }
+  return { locale: siteLocales.defaultLocale, path };
+}
+
+// src/data/localize-href.ts
+var PROTOCOL_OR_RELATIVE = /^([a-z][a-z0-9+.-]*:|\/\/)/i;
+function isExternalHref(href) {
+  const value = href.trim();
+  if (!value) return true;
+  if (value.startsWith("#")) return true;
+  return PROTOCOL_OR_RELATIVE.test(value);
+}
+function stripLeadingLocale(path, locale) {
+  const segments = path.split("/");
+  const first = segments[1];
+  if (first && first !== locale.default && locale.enabled.includes(first)) {
+    segments.splice(1, 1);
+    const rest = segments.join("/");
+    return rest === "" ? "/" : rest;
+  }
+  return path;
+}
+function addLocalePrefix(path, target, locale) {
+  if (target === locale.default) return path;
+  if (path === "/") return `/${target}`;
+  return `/${target}${path}`;
+}
+function localizeHref(href, locale) {
+  const value = href.trim();
+  if (isExternalHref(value)) return href;
+  const boundary = value.search(/[?#]/);
+  const path = boundary === -1 ? value : value.slice(0, boundary);
+  const suffix = boundary === -1 ? "" : value.slice(boundary);
+  if (!path.startsWith("/")) return href;
+  const bare = stripLeadingLocale(path, locale);
+  return `${addLocalePrefix(bare, locale.current, locale)}${suffix}`;
+}
+function buildLocaleSwitchHref(target, pathname, locale) {
+  const path = pathname && pathname.startsWith("/") ? pathname : "/";
+  const bare = stripLeadingLocale(path, locale);
+  return addLocalePrefix(bare, target, locale);
+}
+var ANCHOR_HREF = /(<a\b(?:"[^"]*"|'[^']*'|[^>])*?\shref=)(["'])(.*?)\2/gi;
+function localizeHtmlLinks(html, locale) {
+  return html.replace(
+    ANCHOR_HREF,
+    (_match, prefix, quote, url) => `${prefix}${quote}${localizeHref(url, locale)}${quote}`
+  );
+}
+
+// src/locale.ts
+var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
+async function localeForPathname(config, pathname) {
+  const siteLocales = await resolveSiteLocales(config);
+  const segments = pathname.split("/").filter(Boolean);
+  return splitLocaleFromPath(segments, siteLocales).locale;
+}
+async function splitCmssyLocale(config, path) {
+  const siteLocales = await resolveSiteLocales(config);
+  return splitLocaleFromPath(path, siteLocales);
+}
+async function localeForPath(config, path) {
+  const siteLocales = await resolveSiteLocales(config);
+  const segments = Array.isArray(path) ? path.filter(Boolean) : path.split("/").filter(Boolean);
+  return splitLocaleFromPath(segments, siteLocales).locale;
+}
+
+// src/block-context.ts
+function buildBlockContext(locale, defaultLocale, enabledLocales, isPreview, forms, extra) {
+  return {
+    locale: {
+      current: locale,
+      default: defaultLocale,
+      enabled: enabledLocales && enabledLocales.length > 0 ? enabledLocales : Array.from(/* @__PURE__ */ new Set([defaultLocale, locale]))
+    },
+    isPreview: isPreview ?? false,
+    forms,
+    ...extra?.auth ? { auth: extra.auth } : {},
+    ...extra?.workspace ? { workspace: extra.workspace } : {}
+  };
+}
+
+// src/fields.ts
+function control(type) {
+  return (opts = {}) => ({
+    type,
+    label: opts.label ?? "",
+    ...opts
+  });
+}
+var fields = {
+  text: control("text"),
+  textarea: control("textarea"),
+  richText: control("richText"),
+  markdown: control("markdown"),
+  number: control("number"),
+  date: control("date"),
+  datetime: control("datetime"),
+  boolean: control("boolean"),
+  color: control("color"),
+  media: control("media"),
+  link: control("link"),
+  url: control("url"),
+  email: control("email"),
+  select: control("select"),
+  multiselect: control("multiselect"),
+  radio: control("radio"),
+  repeater: control("repeater"),
+  table: control("table"),
+  json: control("json"),
+  form: control("form"),
+  pageSelector: control("pageSelector")
+};
+
+// src/bridge/protocol.ts
+var PROTOCOL_VERSION = 2;
+function isProtocolCompatible(version) {
+  return version === PROTOCOL_VERSION;
+}
+
+// src/bridge/messages.ts
+function normalizeOrigin(origin) {
+  const trimmed = origin.trim();
+  if (trimmed === "*") return "*";
+  try {
+    return new URL(trimmed).origin;
+  } catch {
+    return trimmed;
+  }
+}
+function postToEditor(target, editorOrigin, message) {
+  target.postMessage(message, normalizeOrigin(editorOrigin));
+}
+function isOriginAllowed(origin, allowed) {
+  const list = Array.isArray(allowed) ? allowed : [allowed];
+  const actual = normalizeOrigin(origin);
+  return list.some((candidate) => {
+    const expected = normalizeOrigin(candidate);
+    return expected === "*" || expected === actual;
+  });
+}
+function resolveInitialTarget(editorOrigin) {
+  const list = (Array.isArray(editorOrigin) ? editorOrigin : [editorOrigin]).map((origin) => normalizeOrigin(origin));
+  if (list.includes("*")) return "*";
+  if (list.length === 1) return list[0];
+  const referrerOrigin = typeof document !== "undefined" && document.referrer ? normalizeOrigin(document.referrer) : "";
+  return list.find((origin) => origin === referrerOrigin) ?? list[0];
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseEditorMessage(data, origin, expectedOrigin) {
+  if (!isOriginAllowed(origin, expectedOrigin)) return null;
+  if (!isObject(data)) return null;
+  switch (data.type) {
+    case "cmssy:select":
+      return typeof data.blockId === "string" && data.protocolVersion === PROTOCOL_VERSION ? {
+        type: "cmssy:select",
+        protocolVersion: PROTOCOL_VERSION,
+        blockId: data.blockId
+      } : null;
+    case "cmssy:patch":
+      return typeof data.blockId === "string" && isObject(data.content) && data.protocolVersion === PROTOCOL_VERSION ? {
+        type: "cmssy:patch",
+        blockId: data.blockId,
+        content: data.content,
+        protocolVersion: PROTOCOL_VERSION,
+        ...isObject(data.style) ? { style: data.style } : {},
+        ...isObject(data.advanced) ? { advanced: data.advanced } : {},
+        ...typeof data.layoutPosition === "string" ? { layoutPosition: data.layoutPosition } : {}
+      } : null;
+    case "cmssy:parent-ready":
+      return data.protocolVersion === PROTOCOL_VERSION ? { type: "cmssy:parent-ready", protocolVersion: PROTOCOL_VERSION } : null;
+    case "cmssy:insert":
+      return typeof data.blockId === "string" && typeof data.blockType === "string" && isObject(data.content) && typeof data.index === "number" && data.protocolVersion === PROTOCOL_VERSION ? {
+        type: "cmssy:insert",
+        protocolVersion: PROTOCOL_VERSION,
+        blockId: data.blockId,
+        blockType: data.blockType,
+        content: data.content,
+        ...isObject(data.style) ? { style: data.style } : {},
+        ...isObject(data.advanced) ? { advanced: data.advanced } : {},
+        index: data.index
+      } : null;
+    case "cmssy:reorder":
+      return Array.isArray(data.blockIds) && data.blockIds.every((id) => typeof id === "string") && data.protocolVersion === PROTOCOL_VERSION ? {
+        type: "cmssy:reorder",
+        protocolVersion: PROTOCOL_VERSION,
+        blockIds: data.blockIds
+      } : null;
+    case "cmssy:remove":
+      return typeof data.blockId === "string" && data.protocolVersion === PROTOCOL_VERSION ? {
+        type: "cmssy:remove",
+        protocolVersion: PROTOCOL_VERSION,
+        blockId: data.blockId
+      } : null;
+    case "cmssy:drag-over":
+      return typeof data.y === "number" && data.protocolVersion === PROTOCOL_VERSION ? {
+        type: "cmssy:drag-over",
+        protocolVersion: PROTOCOL_VERSION,
+        y: data.y
+      } : null;
+    case "cmssy:drag-end":
+      return data.protocolVersion === PROTOCOL_VERSION ? { type: "cmssy:drag-end", protocolVersion: PROTOCOL_VERSION } : null;
+    default:
+      return null;
+  }
+}
+
+// src/secret-match.ts
+var MAX_SECRET_LENGTH = 256;
+async function cmssySecretsMatch(a, b) {
+  if (a.length > MAX_SECRET_LENGTH || b.length > MAX_SECRET_LENGTH) {
+    return false;
+  }
+  const encoder = new TextEncoder();
+  const [ha, hb] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder.encode(a)),
+    crypto.subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  const va = new Uint8Array(ha);
+  const vb = new Uint8Array(hb);
+  let diff = 0;
+  for (let i = 0; i < va.length; i += 1) {
+    diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/edit-request.ts
+var CMSSY_EDIT_HEADER = "x-cmssy-edit";
+var CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+var CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
+async function isVerifiedEditUrl(url, config) {
+  if (!url.searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) {
+    return false;
+  }
+  const provided = url.searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return false;
+  return cmssySecretsMatch(provided, config.draftSecret);
+}
+
+// src/csp.ts
+function toCspOrigin(origin) {
+  if (origin === "*") return "*";
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    throw new Error(`cmssy: invalid editorOrigin "${origin}"`);
+  }
+  if (parsed.origin === "null") {
+    throw new Error(`cmssy: editorOrigin "${origin}" has no usable origin`);
+  }
+  return parsed.origin;
+}
+function frameAncestors(editorOrigin) {
+  const resolved = resolveEditorOrigin(editorOrigin);
+  const origins = Array.isArray(resolved) ? resolved : [resolved];
+  if (origins.length === 0) {
+    throw new Error(
+      "cmssy: editorOrigin must contain at least one valid origin"
+    );
+  }
+  const normalized = origins.map((origin) => toCspOrigin(origin.trim()));
+  return `frame-ancestors ${normalized.join(" ")}`;
+}
+function cmssyCspHeaders(options) {
+  return {
+    "Content-Security-Policy": frameAncestors(options.editorOrigin)
+  };
+}
+function mergeFrameAncestors(existing, directive) {
+  if (!existing) return directive;
+  const kept = existing.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !/^frame-ancestors\b/i.test(part));
+  kept.push(directive);
+  return kept.join("; ");
+}
+function applyCmssyCsp(response, options) {
+  const merged = mergeFrameAncestors(
+    response.headers.get("Content-Security-Policy"),
+    frameAncestors(options.editorOrigin)
+  );
+  response.headers.set("Content-Security-Policy", merged);
+  response.headers.delete("X-Frame-Options");
+  return response;
+}
+
+// src/seo-paths.ts
+function resolveSeoLocales(config, siteConfig) {
+  const defaultLocale = config.defaultLocale ?? siteConfig?.defaultLanguage ?? "en";
+  const locales = config.enabledLocales && config.enabledLocales.length > 0 ? config.enabledLocales : siteConfig?.enabledLanguages && siteConfig.enabledLanguages.length > 0 ? siteConfig.enabledLanguages : [defaultLocale];
+  return { defaultLocale, locales };
+}
+function normalizeSlug2(slug) {
+  if (slug === "/" || slug === "") return "/";
+  return slug.startsWith("/") ? slug : `/${slug}`;
+}
+function localizedPath(slug, locale, defaultLocale) {
+  const normalized = normalizeSlug2(slug);
+  const base = normalized === "/" ? "" : normalized;
+  return locale === defaultLocale ? base || "/" : `/${locale}${base}`;
+}
+
+// src/auth-client.ts
+var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
+  siteMember {
+    login(input: $input) {
+      success message accessToken refreshToken accessTokenExpiresIn
+    }
+  }
+}`;
+var REGISTER_MUTATION = `mutation SiteMemberRegister($input: SiteMemberRegisterInput!) {
+  siteMember {
+    register(input: $input) { success message }
+  }
+}`;
+var REFRESH_MUTATION = `mutation SiteMemberRefresh($refreshToken: String!) {
+  siteMember {
+    refresh(refreshToken: $refreshToken) {
+      success message accessToken refreshToken accessTokenExpiresIn
+    }
+  }
+}`;
+var LOGOUT_MUTATION = `mutation SiteMemberLogout($refreshToken: String!) {
+  siteMember {
+    logout(refreshToken: $refreshToken) { success message }
+  }
+}`;
+var LOGOUT_EVERYWHERE_MUTATION = `mutation SiteMemberLogoutEverywhere {
+  siteMember {
+    logoutEverywhere { success message }
+  }
+}`;
+var FORGOT_MUTATION = `mutation SiteMemberForgotPassword($modelSlug: String!, $identity: String!) {
+  siteMember {
+    forgotPassword(modelSlug: $modelSlug, identity: $identity) { success message }
+  }
+}`;
+var RESET_MUTATION = `mutation SiteMemberResetPassword($token: String!, $newPassword: String!) {
+  siteMember {
+    resetPassword(token: $token, newPassword: $newPassword) { success message }
+  }
+}`;
+var VERIFY_MUTATION = `mutation SiteMemberVerifyEmail($token: String!) {
+  siteMember {
+    verifyEmail(token: $token) { success message }
+  }
+}`;
+async function authRequest(config, query, variables, label, accessToken) {
+  const workspaceId = await cachedWorkspaceId(config);
+  return graphqlRequest(
+    config,
+    query,
+    variables,
+    {
+      headers: {
+        "x-workspace-id": workspaceId,
+        ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
+      }
+    },
+    label
+  );
+}
+function decodeAccessClaims(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const bytes = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+    const json = JSON.parse(new TextDecoder().decode(bytes));
+    if (typeof json.recordId !== "string" || typeof json.email !== "string" || json.type !== "site_member") {
+      return null;
+    }
+    return { recordId: json.recordId, email: json.email };
+  } catch {
+    return null;
+  }
+}
+function toSessionPayload(result) {
+  if (!result.success || !result.accessToken || !result.refreshToken || !result.accessTokenExpiresIn) {
+    return null;
+  }
+  const user = decodeAccessClaims(result.accessToken);
+  if (!user) return null;
+  return {
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    accessExpiresAt: Date.now() + result.accessTokenExpiresIn * 1e3,
+    user
+  };
+}
+async function backendSignIn(config, modelSlug, identity, password) {
+  const data = await authRequest(
+    config,
+    LOGIN_MUTATION,
+    {
+      input: { modelSlug, identity, password }
+    },
+    "site member login"
+  );
+  return data.siteMember.login;
+}
+async function backendRegister(config, modelSlug, identity, password, fields2) {
+  const data = await authRequest(
+    config,
+    REGISTER_MUTATION,
+    {
+      input: { modelSlug, identity, password, fields: fields2 }
+    },
+    "site member register"
+  );
+  return data.siteMember.register;
+}
+async function backendRefresh(config, refreshToken) {
+  const data = await authRequest(
+    config,
+    REFRESH_MUTATION,
+    { refreshToken },
+    "site member refresh"
+  );
+  return data.siteMember.refresh;
+}
+async function backendSignOut(config, refreshToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_MUTATION,
+      { refreshToken },
+      "site member logout"
+    );
+  } catch {
+    return;
+  }
+}
+async function backendSignOutEverywhere(config, accessToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_EVERYWHERE_MUTATION,
+      {},
+      "site member logout everywhere",
+      accessToken
+    );
+  } catch {
+    return;
+  }
+}
+async function backendForgotPassword(config, modelSlug, identity) {
+  const data = await authRequest(
+    config,
+    FORGOT_MUTATION,
+    { modelSlug, identity },
+    "site member forgot password"
+  );
+  return data.siteMember.forgotPassword;
+}
+async function backendResetPassword(config, token, newPassword) {
+  const data = await authRequest(
+    config,
+    RESET_MUTATION,
+    { token, newPassword },
+    "site member reset password"
+  );
+  return data.siteMember.resetPassword;
+}
+async function backendVerifyEmail(config, token) {
+  const data = await authRequest(
+    config,
+    VERIFY_MUTATION,
+    { token },
+    "site member verify email"
+  );
+  return data.siteMember.verifyEmail;
+}
+
+// src/cart-client.ts
+var CART_FIELDS = `
+  id
+  status
+  itemCount
+  subtotal
+  currency
+  discountedTotal
+  tax
+  totalGross
+  pricesIncludeTax
+  shippingTotal
+  taxSummary { rateId name rate base amount }
+  shippingMethod { id label price etaLabel }
+  availableShippingMethods { id label price etaLabel }
+  appliedDiscount { code type value computedAmount }
+  items {
+    id
+    recordId
+    quantity
+    variantSelections
+    unitPrice
+    currentPrice
+    priceMismatch
+    snapshot { name price currency imageUrl sku tiers { minQty price } }
+  }
+`;
+var CART_QUERY = `query Cart($workspaceId: ID!) { cart { get(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
+var ADD_TO_CART = `mutation AddToCart($input: AddToCartInput!) { cart { addItem(input: $input) { ${CART_FIELDS} } } }`;
+var UPDATE_ITEM = `mutation UpdateCartItem($input: UpdateCartItemInput!) { cart { updateItem(input: $input) { ${CART_FIELDS} } } }`;
+var REMOVE_ITEM = `mutation RemoveCartItem($workspaceId: ID!, $itemId: ID!) { cart { removeItem(workspaceId: $workspaceId, itemId: $itemId) { ${CART_FIELDS} } } }`;
+var CLEAR_CART = `mutation ClearCart($workspaceId: ID!) { cart { clear(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
+var APPLY_DISCOUNT = `mutation ApplyDiscount($workspaceId: ID!, $code: String!) { cart { applyDiscount(workspaceId: $workspaceId, code: $code) { ${CART_FIELDS} } } }`;
+var REMOVE_DISCOUNT = `mutation RemoveDiscount($workspaceId: ID!) { cart { removeDiscount(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
+var SET_SHIPPING_METHOD = `mutation SetShippingMethod($workspaceId: ID!, $shippingMethodId: String) {
+  cart { setShippingMethod(workspaceId: $workspaceId, shippingMethodId: $shippingMethodId) { ${CART_FIELDS} } }
+}`;
+var MERGE_CART = `mutation MergeCart($workspaceId: ID!) { cart { merge(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
+var CHECKOUT = `mutation Checkout($input: CheckoutInput!) {
+  cart {
+    checkout(input: $input) {
+      id
+      orderNumber
+      status
+      subtotal
+      discount
+      appliedDiscount { code type value amount }
+      tax
+      total
+      currency
+      customerEmail
+      accessToken
+      poNumber
+      customerNote
+      shippingTotal
+      pricesIncludeTax
+      shippingMethod { id label price }
+      shippingAddress { name company line1 line2 postalCode city region country phone vatId }
+      taxSummary { rateId name rate base amount }
+      items { name sku quantity price listPrice tierMinQty currency taxRate taxAmount }
+    }
+  }
+}`;
+var PRODUCT = `query Product($workspaceId: String!, $modelSlug: String!, $filter: JSON) {
+  public {
+    model {
+      records(workspaceId: $workspaceId, modelSlug: $modelSlug, filter: $filter, limit: 1) {
+        items {
+          id
+          data
+          priceTiers { minQty price }
+          variants { id sku price inventory tiers { minQty price } selectedOptions { name value } }
+        }
+      }
+    }
+  }
+}`;
+async function request(config, ctx, workspaceId, query, variables, label) {
+  return graphqlRequest(
+    config,
+    query,
+    variables,
+    {
+      headers: {
+        "x-workspace-id": workspaceId,
+        "x-cart-session": ctx.cartToken,
+        ...ctx.accessToken ? { authorization: `Bearer ${ctx.accessToken}` } : {}
+      }
+    },
+    label
+  );
+}
+async function backendGetCart(config, ctx) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    CART_QUERY,
+    { workspaceId },
+    "cart query"
+  );
+  return data.cart.get;
+}
+async function backendAddToCart(config, ctx, input) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    ADD_TO_CART,
+    { input: { workspaceId, ...input } },
+    "add to cart"
+  );
+  return data.cart.addItem;
+}
+async function backendUpdateItem(config, ctx, input) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    UPDATE_ITEM,
+    { input: { workspaceId, ...input } },
+    "update cart item"
+  );
+  return data.cart.updateItem;
+}
+async function backendRemoveItem(config, ctx, itemId) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    REMOVE_ITEM,
+    { workspaceId, itemId },
+    "remove cart item"
+  );
+  return data.cart.removeItem;
+}
+async function backendClearCart(config, ctx) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    CLEAR_CART,
+    { workspaceId },
+    "clear cart"
+  );
+  return data.cart.clear;
+}
+async function backendApplyDiscount(config, ctx, code) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    APPLY_DISCOUNT,
+    { workspaceId, code },
+    "apply discount"
+  );
+  return data.cart.applyDiscount;
+}
+async function backendRemoveDiscount(config, ctx) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    REMOVE_DISCOUNT,
+    { workspaceId },
+    "remove discount"
+  );
+  return data.cart.removeDiscount;
+}
+async function backendSetShippingMethod(config, ctx, shippingMethodId) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    SET_SHIPPING_METHOD,
+    { workspaceId, shippingMethodId },
+    "set shipping method"
+  );
+  return data.cart.setShippingMethod;
+}
+async function backendMergeCart(config, ctx) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    MERGE_CART,
+    { workspaceId },
+    "merge cart"
+  );
+  return data.cart.merge;
+}
+async function backendCheckout(config, ctx, input) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    CHECKOUT,
+    { input: { workspaceId, ...input } },
+    "checkout"
+  );
+  return data.cart.checkout;
+}
+async function backendProduct(config, ctx, modelSlug, filter) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    PRODUCT,
+    { workspaceId, modelSlug, filter },
+    "product query"
+  );
+  return data.public.model.records.items[0] ?? null;
+}
+
+// src/orders-client.ts
+var ORDER_FIELDS = `
+  id
+  status
+  subtotal
+  discount
+  appliedDiscount { code type value amount }
+  tax
+  total
+  pricesIncludeTax
+  taxSummary { rateId name rate base amount }
+  currency
+  customerEmail
+  refundedAmount
+  paymentProvider
+  paymentStatus
+  fulfillmentStatus
+  amountPaid
+  balanceDue
+  paymentReference
+  trackingNumber
+  trackingCarrier
+  invoiceNumber
+  invoiceUrl
+  invoiceProvider
+  paidAt
+  fulfilledAt
+  createdAt
+  orderNumber
+  poNumber
+  customerNote
+  shippingTotal
+  shippingMethod { id label price }
+  shippingAddress { name company line1 line2 postalCode city region country phone vatId }
+  items { name price listPrice tierMinQty currency quantity sku }
+  payments { amount reference provider at }
+`;
+var PUBLIC_ORDER_FIELDS = `
+  id
+  orderNumber
+  status
+  paymentStatus
+  fulfillmentStatus
+  subtotal
+  discount
+  appliedDiscount { code type value amount }
+  tax
+  total
+  pricesIncludeTax
+  taxSummary { rateId name rate base amount }
+  currency
+  customerEmail
+  poNumber
+  customerNote
+  shippingTotal
+  shippingMethod { id label price }
+  shippingAddress { name company line1 line2 postalCode city region country phone vatId }
+  amountPaid
+  balanceDue
+  refundedAmount
+  trackingNumber
+  trackingCarrier
+  invoiceNumber
+  invoiceUrl
+  paidAt
+  fulfilledAt
+  createdAt
+  items { name price listPrice tierMinQty currency quantity sku taxRate taxAmount }
+`;
+var MY_ORDERS = `query MyOrders($workspaceId: ID!, $skip: Int, $limit: Int) {
+  account {
+    orders(workspaceId: $workspaceId, skip: $skip, limit: $limit) {
+      total
+      hasMore
+      items { ${ORDER_FIELDS} }
+    }
+  }
+}`;
+var MY_ORDER = `query MyOrder($workspaceId: ID!, $id: ID!) {
+  account {
+    order(workspaceId: $workspaceId, id: $id) { ${ORDER_FIELDS} }
+  }
+}`;
+var PUBLIC_ORDER_BY_TOKEN = `query PublicOrder($workspaceId: ID!, $orderId: ID!, $accessToken: String!) {
+  public {
+    order {
+      byToken(workspaceId: $workspaceId, orderId: $orderId, accessToken: $accessToken) {
+        ${PUBLIC_ORDER_FIELDS}
+      }
+    }
+  }
+}`;
+function headers(workspaceId, accessToken) {
+  return {
+    "x-workspace-id": workspaceId,
+    authorization: `Bearer ${accessToken}`
+  };
+}
+async function backendMyOrders(config, accessToken, options) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await graphqlRequest(
+    config,
+    MY_ORDERS,
+    { workspaceId, skip: options.skip, limit: options.limit },
+    { headers: headers(workspaceId, accessToken) },
+    "my orders"
+  );
+  return data.account.orders;
+}
+async function backendMyOrder(config, accessToken, id) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await graphqlRequest(
+    config,
+    MY_ORDER,
+    { workspaceId, id },
+    { headers: headers(workspaceId, accessToken) },
+    "my order"
+  );
+  return data.account.order;
+}
+async function backendOrderByToken(config, options) {
+  const workspaceId = await cachedWorkspaceId(config);
+  const data = await graphqlRequest(
+    config,
+    PUBLIC_ORDER_BY_TOKEN,
+    {
+      workspaceId,
+      orderId: options.orderId,
+      accessToken: options.accessToken
+    },
+    { headers: { "x-workspace-id": workspaceId } },
+    "public order lookup"
+  );
+  return data.public.order.byToken;
+}
+
+// src/commerce/product-client.ts
+var PRODUCTS_QUERY = `query Products($workspaceId: String!, $modelSlug: String!, $filter: JSON, $stockState: String, $locale: String, $limit: Int, $offset: Int, $sort: String) {
+  public {
+    model {
+      records(workspaceId: $workspaceId, modelSlug: $modelSlug, filter: $filter, stockState: $stockState, locale: $locale, limit: $limit, offset: $offset, sort: $sort) {
+        total
+        hasMore
+        items {
+          id
+          data
+          priceTiers { minQty price }
+          variants { id sku price inventory tiers { minQty price } selectedOptions { name value } }
+        }
+      }
+    }
+  }
+}`;
+async function fetchProducts(config, options) {
+  const workspaceId = await resolveWorkspaceId(config);
+  const locale = options.locale ?? null;
+  const data = await graphqlRequest(
+    config,
+    PRODUCTS_QUERY,
+    {
+      workspaceId,
+      modelSlug: options.modelSlug,
+      filter: options.filter ?? {},
+      stockState: options.stockState ?? null,
+      locale,
+      limit: options.limit ?? 50,
+      offset: options.offset ?? 0,
+      sort: options.sort ?? null
+    },
+    { headers: { "x-workspace-id": workspaceId } },
+    "products query"
+  );
+  return data.public.model.records;
+}
+async function fetchProduct(config, options) {
+  const page = await fetchProducts(config, {
+    modelSlug: options.modelSlug,
+    filter: { [options.slugField ?? "slug"]: options.slug },
+    locale: options.locale,
+    limit: 1
+  });
+  return page.items[0] ?? null;
+}
+
+// src/commerce/order-client.ts
+async function fetchOrderByToken(config, options) {
+  return backendOrderByToken(config, options);
+}
+
+// src/commerce/money.ts
+var ZERO_DECIMAL = /* @__PURE__ */ new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "UGX",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF"
+]);
+var THREE_DECIMAL = /* @__PURE__ */ new Set([
+  "BHD",
+  "IQD",
+  "JOD",
+  "KWD",
+  "LYD",
+  "OMR",
+  "TND"
+]);
+function fractionDigits(currency) {
+  const code = currency.toUpperCase();
+  if (ZERO_DECIMAL.has(code)) return 0;
+  if (THREE_DECIMAL.has(code)) return 3;
+  return 2;
+}
+function fromMinorUnits(minor, currency) {
+  return minor / 10 ** fractionDigits(currency);
+}
+function toMinorUnits(amount, currency) {
+  return Math.round(amount * 10 ** fractionDigits(currency));
+}
+function formatPrice(minor, currency) {
+  if (!Number.isFinite(minor)) return "";
+  const code = currency ?? "USD";
+  const amount = fromMinorUnits(minor, code);
+  try {
+    return new Intl.NumberFormat(void 0, {
+      style: "currency",
+      currency: code
+    }).format(amount);
+  } catch {
+    return `${amount.toFixed(fractionDigits(code))} ${code}`;
+  }
+}
+var CmssyWebhookError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CmssyWebhookError";
+  }
+};
+var DEFAULT_TOLERANCE_SECONDS = 300;
+function parseSignatureHeader(header) {
+  let timestamp = null;
+  let signature = null;
+  for (const part of header.split(",")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim();
+    if (key === "t") timestamp = Number(value);
+    else if (key === "v1") signature = value;
+  }
+  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
+    throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
+  }
+  return { timestamp, signature };
+}
+function timingSafeHexEqual(expectedHex, providedHex) {
+  const expected = Buffer.from(expectedHex, "hex");
+  const provided = Buffer.from(providedHex, "hex");
+  if (expected.length !== provided.length) return false;
+  return timingSafeEqual(expected, provided);
+}
+function verifyCmssyWebhook(options) {
+  const { body, signatureHeader, secret } = options;
+  if (!signatureHeader) {
+    throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
+  }
+  if (!secret) {
+    throw new CmssyWebhookError("Missing webhook secret");
+  }
+  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
+  const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
+  const now = options.now ?? Date.now();
+  if (Math.abs(now - timestamp) > toleranceMs) {
+    throw new CmssyWebhookError("Webhook timestamp outside tolerance");
+  }
+  const expected = createHmac("sha256", secret).update(`${timestamp}.${body}`).digest("hex");
+  if (!timingSafeHexEqual(expected, signature)) {
+    throw new CmssyWebhookError("Webhook signature mismatch");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    throw new CmssyWebhookError("Webhook body is not valid JSON");
+  }
+  return parsed;
+}
+
+export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, CmssyRequestError, CmssyWebhookError, DEFAULT_CMSSY_API_URL, DEFAULT_CMSSY_EDITOR_ORIGINS, FORM_QUERY, MIN_SESSION_SECRET_LENGTH, MODEL_DEFINITIONS_QUERY, MODEL_RECORDS_QUERY, PRODUCTS_QUERY, PROTOCOL_VERSION, SESSION_MAX_AGE_SECONDS, SITE_CONFIG_QUERY, SUBMIT_FORM_MUTATION, applyCmssyCsp, asBucket, assertAuthConfig, backendAddToCart, backendApplyDiscount, backendCheckout, backendClearCart, backendForgotPassword, backendGetCart, backendMergeCart, backendMyOrder, backendMyOrders, backendOrderByToken, backendProduct, backendRefresh, backendRegister, backendRemoveDiscount, backendRemoveItem, backendResetPassword, backendSetShippingMethod, backendSignIn, backendSignOut, backendSignOutEverywhere, backendUpdateItem, backendVerifyEmail, buildBlockContext, buildLocaleSwitchHref, cachedWorkspaceId, clearWorkspaceIdCache, cmssyCspHeaders, cmssySecretsMatch, collectFormIds, createCmssyClient, decodeAccessClaims, defineCmssyConfig, fetchLayouts, fetchOrderByToken, fetchPage, fetchPageById, fetchPageMeta, fetchPages, fetchProduct, fetchProducts, fetchSiteConfig, fields, formatPrice, fractionDigits, fromMinorUnits, getBlockContentForLanguage, graphqlRequest, isAccessExpired, isDevelopment, isProtocolCompatible, isVerifiedEditUrl, localeForPath, localeForPathname, localizeHref, localizeHtmlLinks, localizedPath, normalizeOrigin, normalizeSlug, openSession, parseEditorMessage, postToEditor, resolveApiUrl, resolveEditorOrigin, resolveForms, resolveInitialTarget, resolvePublicUrl, resolveSeoLocales, resolveSiteLocales, resolveWorkspaceId, sealSession, sessionCookieOptions, splitCmssyLocale, splitLocaleFromPath, toCspOrigin, toMinorUnits, toSessionPayload, verifyCmssyWebhook };