@cmssy/next 0.1.8 → 0.2.0

package/dist/index.cjs

@@ -4,7 +4,9 @@ var headers = require('next/headers');
 var navigation = require('next/navigation');
 var react = require('@cmssy/react');
 var jsxRuntime = require('react/jsx-runtime');
-var crypto = require('crypto');
+var crypto$1 = require('crypto');
+var jose = require('jose');
+var server = require('next/server');
 
 // src/create-cmssy-page.tsx
 
@@ -156,9 +158,9 @@ function resolveBridgeOrigin(editorOrigin) {
 }
 var MIN_SECRET_LENGTH = 16;
 function secretsMatch(a, b) {
-  const ha = crypto.createHash("sha256").update(a).digest();
-  const hb = crypto.createHash("sha256").update(b).digest();
-  return crypto.timingSafeEqual(ha, hb);
+  const ha = crypto$1.createHash("sha256").update(a).digest();
+  const hb = crypto$1.createHash("sha256").update(b).digest();
+  return crypto$1.timingSafeEqual(ha, hb);
 }
 function safeRedirect(redirect2, fallback) {
   if (!redirect2 || !redirect2.startsWith("/")) return fallback;
@@ -179,14 +181,14 @@ function createDraftRoute(config) {
       "cmssy: defaultRedirect must be a same-origin path starting with '/'"
     );
   }
-  return async function GET(request) {
+  return async function GET(request2) {
     if (config.draftSecret.length < MIN_SECRET_LENGTH) {
       return new Response(
         `cmssy: draftSecret must be at least ${MIN_SECRET_LENGTH} characters`,
         { status: 500 }
       );
     }
-    const url = new URL(request.url);
+    const url = new URL(request2.url);
     const secret = url.searchParams.get("secret");
     if (!secret || !secretsMatch(secret, config.draftSecret)) {
       return new Response("Invalid draft secret", { status: 401 });
@@ -201,8 +203,8 @@ function createDraftRoute(config) {
   };
 }
 var CMSSY_EDIT_HEADER = "x-cmssy-edit";
-function isCmssyEditRequest(request) {
-  return request.cookies.has("__prerender_bypass") || request.nextUrl.searchParams.getAll("cmssyEdit").includes("1");
+function isCmssyEditRequest(request2) {
+  return request2.cookies.has("__prerender_bypass") || request2.nextUrl.searchParams.getAll("cmssyEdit").includes("1");
 }
 async function isCmssyEditMode() {
   const h = await headers.headers();
@@ -226,15 +228,878 @@ async function getCmssyLocale(config) {
   const { defaultLocale } = await react.resolveSiteLocales(config);
   return defaultLocale;
 }
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new jose.EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jose.jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
+  siteMemberLogin(input: $input) {
+    success message accessToken refreshToken accessTokenExpiresIn
+  }
+}`;
+var REGISTER_MUTATION = `mutation SiteMemberRegister($input: SiteMemberRegisterInput!) {
+  siteMemberRegister(input: $input) { success message }
+}`;
+var REFRESH_MUTATION = `mutation SiteMemberRefresh($refreshToken: String!) {
+  siteMemberRefresh(refreshToken: $refreshToken) {
+    success message accessToken refreshToken accessTokenExpiresIn
+  }
+}`;
+var LOGOUT_MUTATION = `mutation SiteMemberLogout($refreshToken: String!) {
+  siteMemberLogout(refreshToken: $refreshToken) { success message }
+}`;
+var LOGOUT_EVERYWHERE_MUTATION = `mutation SiteMemberLogoutEverywhere {
+  siteMemberLogoutEverywhere { success message }
+}`;
+var FORGOT_MUTATION = `mutation SiteMemberForgotPassword($modelSlug: String!, $identity: String!) {
+  siteMemberForgotPassword(modelSlug: $modelSlug, identity: $identity) { success message }
+}`;
+var RESET_MUTATION = `mutation SiteMemberResetPassword($token: String!, $newPassword: String!) {
+  siteMemberResetPassword(token: $token, newPassword: $newPassword) { success message }
+}`;
+var VERIFY_MUTATION = `mutation SiteMemberVerifyEmail($token: String!) {
+  siteMemberVerifyEmail(token: $token) { success message }
+}`;
+var workspaceIdCache = /* @__PURE__ */ new Map();
+function workspaceIdFor(config) {
+  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const existing = workspaceIdCache.get(key);
+  if (existing) return existing;
+  const fresh = react.resolveWorkspaceId(config).catch((err) => {
+    workspaceIdCache.delete(key);
+    throw err;
+  });
+  workspaceIdCache.set(key, fresh);
+  return fresh;
+}
+async function authRequest(config, query, variables, label, accessToken) {
+  const workspaceId = await workspaceIdFor(config);
+  return react.graphqlRequest(
+    config,
+    query,
+    variables,
+    {
+      headers: {
+        "x-workspace-id": workspaceId,
+        ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
+      }
+    },
+    label
+  );
+}
+function decodeAccessClaims(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const bytes = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+    const json3 = JSON.parse(new TextDecoder().decode(bytes));
+    if (typeof json3.recordId !== "string" || typeof json3.email !== "string" || json3.type !== "site_member") {
+      return null;
+    }
+    return { recordId: json3.recordId, email: json3.email };
+  } catch {
+    return null;
+  }
+}
+function toSessionPayload(result) {
+  if (!result.success || !result.accessToken || !result.refreshToken || !result.accessTokenExpiresIn) {
+    return null;
+  }
+  const user = decodeAccessClaims(result.accessToken);
+  if (!user) return null;
+  return {
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    accessExpiresAt: Date.now() + result.accessTokenExpiresIn * 1e3,
+    user
+  };
+}
+async function backendSignIn(config, modelSlug, identity, password) {
+  const data = await authRequest(
+    config,
+    LOGIN_MUTATION,
+    {
+      input: { modelSlug, identity, password }
+    },
+    "site member login"
+  );
+  return data.siteMemberLogin;
+}
+async function backendRegister(config, modelSlug, identity, password, fields) {
+  const data = await authRequest(
+    config,
+    REGISTER_MUTATION,
+    {
+      input: { modelSlug, identity, password, fields }
+    },
+    "site member register"
+  );
+  return data.siteMemberRegister;
+}
+async function backendRefresh(config, refreshToken) {
+  const data = await authRequest(
+    config,
+    REFRESH_MUTATION,
+    { refreshToken },
+    "site member refresh"
+  );
+  return data.siteMemberRefresh;
+}
+async function backendSignOut(config, refreshToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_MUTATION,
+      { refreshToken },
+      "site member logout"
+    );
+  } catch {
+    return;
+  }
+}
+async function backendSignOutEverywhere(config, accessToken) {
+  try {
+    await authRequest(
+      config,
+      LOGOUT_EVERYWHERE_MUTATION,
+      {},
+      "site member logout everywhere",
+      accessToken
+    );
+  } catch {
+    return;
+  }
+}
+async function backendForgotPassword(config, modelSlug, identity) {
+  const data = await authRequest(
+    config,
+    FORGOT_MUTATION,
+    { modelSlug, identity },
+    "site member forgot password"
+  );
+  return data.siteMemberForgotPassword;
+}
+async function backendResetPassword(config, token, newPassword) {
+  const data = await authRequest(
+    config,
+    RESET_MUTATION,
+    { token, newPassword },
+    "site member reset password"
+  );
+  return data.siteMemberResetPassword;
+}
+async function backendVerifyEmail(config, token) {
+  const data = await authRequest(
+    config,
+    VERIFY_MUTATION,
+    { token },
+    "site member verify email"
+  );
+  return data.siteMemberVerifyEmail;
+}
+
+// src/create-auth-route.ts
+var MAX_BODY_CHARS = 16 * 1024;
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+async function readBody(request2) {
+  const contentType = request2.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new Error("content-type must be application/json");
+  }
+  const text = await request2.text();
+  if (text.length > MAX_BODY_CHARS) {
+    throw new Error("body too large");
+  }
+  if (!text) return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("body must be a JSON object");
+  }
+  return parsed;
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+function plainObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+async function readSession(config, auth) {
+  const jar = await headers.cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  return openSession(raw, auth.sessionSecret, config.workspaceSlug);
+}
+async function writeSession(config, auth, payload) {
+  const sealed = await sealSession(
+    payload,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  const jar = await headers.cookies();
+  jar.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
+}
+async function clearSession() {
+  const jar = await headers.cookies();
+  jar.set(CMSSY_SESSION_COOKIE, "", {
+    ...sessionCookieOptions(),
+    maxAge: 0
+  });
+}
+async function refreshSession(config, auth, session) {
+  const result = await backendRefresh(config, session.refreshToken);
+  const payload = toSessionPayload(result);
+  if (!payload) {
+    await clearSession();
+    return null;
+  }
+  await writeSession(config, auth, payload);
+  return payload;
+}
+function createCmssyAuthRoute(config) {
+  const auth = assertAuthConfig(config);
+  async function handleSignIn(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid credentials." }, 400);
+    }
+    const result = await backendSignIn(
+      config,
+      auth.modelSlug,
+      identity,
+      password
+    );
+    const payload = toSessionPayload(result);
+    if (!payload) {
+      return json({ ok: false, message: result.message }, 401);
+    }
+    await writeSession(config, auth, payload);
+    return json({ ok: true, user: payload.user });
+  }
+  async function handleRegister(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendRegister(
+      config,
+      auth.modelSlug,
+      identity,
+      password,
+      plainObject(body.fields)
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleSignOut() {
+    const session = await readSession(config, auth);
+    if (session) {
+      await backendSignOut(config, session.refreshToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleSignOutEverywhere() {
+    let session = await readSession(config, auth);
+    if (session && isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    if (session) {
+      await backendSignOutEverywhere(config, session.accessToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleRefresh() {
+    const session = await readSession(config, auth);
+    if (!session) {
+      return json({ ok: false, user: null }, 401);
+    }
+    const refreshed = await refreshSession(config, auth, session);
+    if (!refreshed) {
+      return json({ ok: false, user: null }, 401);
+    }
+    return json({ ok: true, user: refreshed.user });
+  }
+  async function handleMe() {
+    let session = await readSession(config, auth);
+    if (session && isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    return json({ user: session?.user ?? null });
+  }
+  async function handleForgotPassword(body) {
+    const identity = str(body.identity);
+    if (!identity) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendForgotPassword(
+      config,
+      auth.modelSlug,
+      identity
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleResetPassword(body) {
+    const token = str(body.token);
+    const newPassword = str(body.newPassword);
+    if (!token || !newPassword) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendResetPassword(config, token, newPassword);
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleVerifyEmail(body) {
+    const token = str(body.token);
+    if (!token) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await backendVerifyEmail(config, token);
+    return json({ ok: result.success, message: result.message });
+  }
+  return {
+    async POST(request2, context) {
+      const { action } = await context.params;
+      let body;
+      try {
+        body = await readBody(request2);
+      } catch {
+        return json({ ok: false, message: "Invalid request body." }, 400);
+      }
+      try {
+        switch (action) {
+          case "sign-in":
+            return await handleSignIn(body);
+          case "register":
+            return await handleRegister(body);
+          case "sign-out":
+            return await handleSignOut();
+          case "sign-out-everywhere":
+            return await handleSignOutEverywhere();
+          case "refresh":
+            return await handleRefresh();
+          case "forgot-password":
+            return await handleForgotPassword(body);
+          case "reset-password":
+            return await handleResetPassword(body);
+          case "verify-email":
+            return await handleVerifyEmail(body);
+          default:
+            return json({ ok: false, message: "Not found." }, 404);
+        }
+      } catch {
+        return json({ ok: false, message: "Something went wrong." }, 500);
+      }
+    },
+    async GET(_request, context) {
+      const { action } = await context.params;
+      if (action !== "me") {
+        return json({ ok: false, message: "Not found." }, 404);
+      }
+      try {
+        return await handleMe();
+      } catch {
+        return json({ user: null });
+      }
+    }
+  };
+}
+var CART_FIELDS = `
+  id
+  status
+  itemCount
+  subtotal
+  currency
+  discountedTotal
+  appliedDiscount { code type value computedAmount }
+  items {
+    id
+    recordId
+    quantity
+    variantSelections
+    currentPrice
+    priceMismatch
+    snapshot { name price currency imageUrl sku }
+  }
+`;
+var CART_QUERY = `query Cart($workspaceId: ID!) { cart(workspaceId: $workspaceId) { ${CART_FIELDS} } }`;
+var ADD_TO_CART = `mutation AddToCart($input: AddToCartInput!) { addToCart(input: $input) { ${CART_FIELDS} } }`;
+var UPDATE_ITEM = `mutation UpdateCartItem($input: UpdateCartItemInput!) { updateCartItem(input: $input) { ${CART_FIELDS} } }`;
+var REMOVE_ITEM = `mutation RemoveCartItem($workspaceId: ID!, $itemId: ID!) { removeCartItem(workspaceId: $workspaceId, itemId: $itemId) { ${CART_FIELDS} } }`;
+var CLEAR_CART = `mutation ClearCart($workspaceId: ID!) { clearCart(workspaceId: $workspaceId) { ${CART_FIELDS} } }`;
+var APPLY_DISCOUNT = `mutation ApplyDiscount($workspaceId: ID!, $code: String!) { applyDiscount(workspaceId: $workspaceId, code: $code) { ${CART_FIELDS} } }`;
+var REMOVE_DISCOUNT = `mutation RemoveDiscount($workspaceId: ID!) { removeDiscount(workspaceId: $workspaceId) { ${CART_FIELDS} } }`;
+var CHECKOUT = `mutation Checkout($input: CheckoutInput!) {
+  checkout(input: $input) { id status subtotal total currency customerEmail }
+}`;
+var PRODUCT = `query Product($workspaceId: String!, $modelSlug: String!, $filter: JSON) {
+  publicModelRecords(workspaceId: $workspaceId, modelSlug: $modelSlug, filter: $filter, limit: 1) {
+    items { id data variants { id sku price inventory selectedOptions { name value } } }
+  }
+}`;
+var workspaceIdCache2 = /* @__PURE__ */ new Map();
+function workspaceIdFor2(config) {
+  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const existing = workspaceIdCache2.get(key);
+  if (existing) return existing;
+  const fresh = react.resolveWorkspaceId(config).catch((err) => {
+    workspaceIdCache2.delete(key);
+    throw err;
+  });
+  workspaceIdCache2.set(key, fresh);
+  return fresh;
+}
+async function request(config, ctx, workspaceId, query, variables, label) {
+  return react.graphqlRequest(
+    config,
+    query,
+    variables,
+    {
+      headers: {
+        "x-workspace-id": workspaceId,
+        "x-cart-session": ctx.cartToken,
+        ...ctx.accessToken ? { authorization: `Bearer ${ctx.accessToken}` } : {}
+      }
+    },
+    label
+  );
+}
+async function backendGetCart(config, ctx) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    CART_QUERY,
+    { workspaceId },
+    "cart query"
+  );
+  return data.cart;
+}
+async function backendAddToCart(config, ctx, input) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    ADD_TO_CART,
+    { input: { workspaceId, ...input } },
+    "add to cart"
+  );
+  return data.addToCart;
+}
+async function backendUpdateItem(config, ctx, input) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    UPDATE_ITEM,
+    { input: { workspaceId, ...input } },
+    "update cart item"
+  );
+  return data.updateCartItem;
+}
+async function backendRemoveItem(config, ctx, itemId) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    REMOVE_ITEM,
+    { workspaceId, itemId },
+    "remove cart item"
+  );
+  return data.removeCartItem;
+}
+async function backendClearCart(config, ctx) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    CLEAR_CART,
+    { workspaceId },
+    "clear cart"
+  );
+  return data.clearCart;
+}
+async function backendApplyDiscount(config, ctx, code) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    APPLY_DISCOUNT,
+    { workspaceId, code },
+    "apply discount"
+  );
+  return data.applyDiscount;
+}
+async function backendRemoveDiscount(config, ctx) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    REMOVE_DISCOUNT,
+    { workspaceId },
+    "remove discount"
+  );
+  return data.removeDiscount;
+}
+async function backendCheckout(config, ctx, customerEmail) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    CHECKOUT,
+    { input: { workspaceId, customerEmail } },
+    "checkout"
+  );
+  return data.checkout;
+}
+async function backendProduct(config, ctx, modelSlug, filter) {
+  const workspaceId = await workspaceIdFor2(config);
+  const data = await request(
+    config,
+    ctx,
+    workspaceId,
+    PRODUCT,
+    { workspaceId, modelSlug, filter },
+    "product query"
+  );
+  return data.publicModelRecords.items[0] ?? null;
+}
+
+// src/create-cart-route.ts
+var CMSSY_CART_COOKIE = "cmssy_cart";
+var CART_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var CART_TOKEN_BYTES = 32;
+var MAX_BODY_CHARS2 = 16 * 1024;
+function json2(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+function cartCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: CART_MAX_AGE_SECONDS
+  };
+}
+function mintToken() {
+  const bytes = new Uint8Array(CART_TOKEN_BYTES);
+  crypto.getRandomValues(bytes);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function readBody2(request2) {
+  const contentType = request2.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new Error("content-type must be application/json");
+  }
+  const text = await request2.text();
+  if (text.length > MAX_BODY_CHARS2) throw new Error("body too large");
+  if (!text) return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("body must be a JSON object");
+  }
+  return parsed;
+}
+function str2(value) {
+  return typeof value === "string" ? value : "";
+}
+function plainObject2(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+function createCmssyCartRoute(config) {
+  async function ensureCartToken() {
+    const jar = await headers.cookies();
+    const existing = jar.get(CMSSY_CART_COOKIE)?.value;
+    if (existing) return existing;
+    const token = mintToken();
+    jar.set(CMSSY_CART_COOKIE, token, cartCookieOptions());
+    return token;
+  }
+  async function clearCartToken() {
+    const jar = await headers.cookies();
+    jar.set(CMSSY_CART_COOKIE, "", { ...cartCookieOptions(), maxAge: 0 });
+  }
+  async function memberAccessToken() {
+    if (!config.auth) return void 0;
+    const jar = await headers.cookies();
+    const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return void 0;
+    const session = await openSession(
+      raw,
+      config.auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session || isAccessExpired(session)) return void 0;
+    return session.accessToken;
+  }
+  async function buildContext() {
+    const cartToken = await ensureCartToken();
+    const accessToken = await memberAccessToken();
+    return accessToken ? { cartToken, accessToken } : { cartToken };
+  }
+  return {
+    async POST(request2, context) {
+      const { action } = await context.params;
+      let body;
+      try {
+        body = await readBody2(request2);
+      } catch {
+        return json2({ message: "Invalid request body." }, 400);
+      }
+      try {
+        const ctx = await buildContext();
+        switch (action) {
+          case "cart":
+            return json2({ cart: await backendGetCart(config, ctx) });
+          case "add":
+            return json2({
+              cart: await backendAddToCart(config, ctx, {
+                recordId: str2(body.recordId),
+                quantity: typeof body.quantity === "number" ? body.quantity : 1,
+                variantSelections: body.variantSelections,
+                notes: typeof body.notes === "string" ? body.notes : void 0
+              })
+            });
+          case "update":
+            return json2({
+              cart: await backendUpdateItem(config, ctx, {
+                itemId: str2(body.itemId),
+                quantity: typeof body.quantity === "number" ? body.quantity : 0
+              })
+            });
+          case "remove":
+            return json2({
+              cart: await backendRemoveItem(config, ctx, str2(body.itemId))
+            });
+          case "clear":
+            return json2({ cart: await backendClearCart(config, ctx) });
+          case "apply-discount":
+            return json2({
+              cart: await backendApplyDiscount(config, ctx, str2(body.code))
+            });
+          case "remove-discount":
+            return json2({ cart: await backendRemoveDiscount(config, ctx) });
+          case "checkout": {
+            const order = await backendCheckout(
+              config,
+              ctx,
+              str2(body.customerEmail)
+            );
+            await clearCartToken();
+            return json2({ order });
+          }
+          case "product":
+            return json2({
+              product: await backendProduct(
+                config,
+                ctx,
+                str2(body.modelSlug),
+                plainObject2(body.filter)
+              )
+            });
+          default:
+            return json2({ message: "Not found." }, 404);
+        }
+      } catch (err) {
+        return json2(
+          {
+            message: err instanceof Error ? err.message : "Commerce request failed"
+          },
+          502
+        );
+      }
+    }
+  };
+}
+async function readValidSession(config) {
+  const auth = assertAuthConfig(config);
+  const jar = await headers.cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
+function isPrefetch(request2) {
+  return request2.headers.get("next-router-prefetch") !== null || request2.headers.get("purpose") === "prefetch" || (request2.headers.get("sec-purpose") ?? "").includes("prefetch");
+}
+function createCmssyAuthMiddleware(config) {
+  const auth = assertAuthConfig(config);
+  return async function cmssyAuthMiddleware(request2) {
+    const raw = request2.cookies.get(CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return server.NextResponse.next();
+    const session = await openSession(
+      raw,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session) {
+      const response = server.NextResponse.next();
+      response.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return response;
+    }
+    if (!isAccessExpired(session)) return server.NextResponse.next();
+    if (isPrefetch(request2)) return server.NextResponse.next();
+    let payload = null;
+    try {
+      const result = await backendRefresh(config, session.refreshToken);
+      payload = toSessionPayload(result);
+    } catch {
+      return server.NextResponse.next();
+    }
+    if (!payload) {
+      const cleared = server.NextResponse.next();
+      cleared.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return cleared;
+    }
+    const sealed = await sealSession(
+      payload,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    request2.cookies.set(CMSSY_SESSION_COOKIE, sealed);
+    const refreshed = server.NextResponse.next({ request: request2 });
+    refreshed.cookies.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
+    return refreshed;
+  };
+}
 
+exports.CMSSY_CART_COOKIE = CMSSY_CART_COOKIE;
 exports.CMSSY_EDIT_HEADER = CMSSY_EDIT_HEADER;
 exports.CMSSY_LOCALE_HEADER = CMSSY_LOCALE_HEADER;
+exports.CMSSY_SESSION_COOKIE = CMSSY_SESSION_COOKIE;
+exports.SESSION_MAX_AGE_SECONDS = SESSION_MAX_AGE_SECONDS;
 exports.applyCmssyCsp = applyCmssyCsp;
+exports.assertAuthConfig = assertAuthConfig;
 exports.cmssyCspHeaders = cmssyCspHeaders;
+exports.createCmssyAuthMiddleware = createCmssyAuthMiddleware;
+exports.createCmssyAuthRoute = createCmssyAuthRoute;
+exports.createCmssyCartRoute = createCmssyCartRoute;
 exports.createCmssyPage = createCmssyPage;
 exports.createDraftRoute = createDraftRoute;
+exports.getCmssyAccessToken = getCmssyAccessToken;
 exports.getCmssyLocale = getCmssyLocale;
+exports.getCmssyUser = getCmssyUser;
+exports.isAccessExpired = isAccessExpired;
 exports.isCmssyEditMode = isCmssyEditMode;
 exports.isCmssyEditRequest = isCmssyEditRequest;
 exports.localeForPathname = localeForPathname;
+exports.openSession = openSession;
+exports.sealSession = sealSession;
+exports.sessionCookieOptions = sessionCookieOptions;
 exports.splitCmssyLocale = splitCmssyLocale;