@cmssy/next 0.5.3 → 0.5.5

package/dist/index.cjs

@@ -4,12 +4,108 @@ var headers = require('next/headers');
 var navigation = require('next/navigation');
 var react = require('@cmssy/react');
 var client = require('@cmssy/react/client');
+var jose = require('jose');
 var jsxRuntime = require('react/jsx-runtime');
 var crypto$1 = require('crypto');
 var server = require('next/server');
-var jose = require('jose');
 
 // src/create-cmssy-page.tsx
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new jose.EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jose.jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+
+// src/auth-server.ts
+async function readValidSession(config) {
+  const auth = assertAuthConfig(config);
+  const jar = await headers.cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
 
 // src/csp.ts
 function toCspOrigin(origin) {
@@ -70,6 +166,7 @@ function createCmssyPage(config, blocks, options) {
     apiUrl: config.apiUrl,
     workspaceSlug: config.workspaceSlug
   };
+  const client$1 = react.createCmssyClient(clientConfig);
   return async function CmssyCatchAllPage({
     params,
     searchParams
@@ -131,6 +228,27 @@ function createCmssyPage(config, blocks, options) {
         }
       ) });
     }
+    let auth;
+    if (config.auth) {
+      try {
+        const user = await getCmssyUser(config);
+        auth = {
+          isAuthenticated: !!user,
+          member: user ? { recordId: user.recordId, email: user.email } : null
+        };
+      } catch {
+        auth = void 0;
+      }
+    }
+    let workspace;
+    try {
+      workspace = {
+        id: await client$1.resolveWorkspaceId(),
+        slug: config.workspaceSlug
+      };
+    } catch {
+      workspace = void 0;
+    }
     return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
       react.CmssyServerPage,
       {
@@ -139,7 +257,9 @@ function createCmssyPage(config, blocks, options) {
         locale,
         defaultLocale,
         enabledLocales,
-        forms
+        forms,
+        auth,
+        workspace
       }
     ) });
   };
@@ -288,14 +408,24 @@ function createCmssyRobots(config, options = {}) {
     };
   };
 }
+
+// src/seo-paths.ts
+function resolveSeoLocales(config, siteConfig) {
+  const defaultLocale = config.defaultLocale ?? siteConfig?.defaultLanguage ?? "en";
+  const locales = config.enabledLocales && config.enabledLocales.length > 0 ? config.enabledLocales : siteConfig?.enabledLanguages && siteConfig.enabledLanguages.length > 0 ? siteConfig.enabledLanguages : [defaultLocale];
+  return { defaultLocale, locales };
+}
 function normalizeSlug(slug) {
   if (slug === "/" || slug === "") return "/";
   return slug.startsWith("/") ? slug : `/${slug}`;
 }
 function localizedPath(slug, locale, defaultLocale) {
-  const normalized = slug === "/" ? "" : slug;
-  return locale === defaultLocale ? normalized || "/" : `/${locale}${normalized}`;
+  const normalized = normalizeSlug(slug);
+  const base = normalized === "/" ? "" : normalized;
+  return locale === defaultLocale ? base || "/" : `/${locale}${base}`;
 }
+
+// src/create-cmssy-sitemap.ts
 function createCmssySitemap(config, options = {}) {
   const clientConfig = {
     apiUrl: config.apiUrl,
@@ -311,15 +441,15 @@ function createCmssySitemap(config, options = {}) {
       }
       pages = [];
     }
-    let notFoundPageId = null;
+    let siteConfig = null;
     try {
-      notFoundPageId = (await react.fetchSiteConfig(clientConfig))?.notFoundPageId ?? null;
+      siteConfig = await react.fetchSiteConfig(clientConfig);
     } catch {
-      notFoundPageId = null;
+      siteConfig = null;
     }
+    const notFoundPageId = siteConfig?.notFoundPageId ?? null;
     const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
-    const defaultLocale = config.defaultLocale ?? "en";
-    const locales = config.enabledLocales && config.enabledLocales.length > 0 ? config.enabledLocales : [defaultLocale];
+    const { defaultLocale, locales } = resolveSeoLocales(config, siteConfig);
     const excluded = new Set((options.excludeSlugs ?? []).map(normalizeSlug));
     const entries = pages.map((page) => ({ ...page, slug: normalizeSlug(page.slug) })).filter((page) => page.id !== notFoundPageId && !excluded.has(page.slug)).map((page) => {
       const lastModified = page.updatedAt ?? page.publishedAt ?? void 0;
@@ -342,6 +472,67 @@ function createCmssySitemap(config, options = {}) {
     return options.extra ? [...entries, ...options.extra] : entries;
   };
 }
+function pick(value, locale, defaultLocale) {
+  if (!value) return "";
+  if (typeof value === "string") return value;
+  return value[locale] || value[defaultLocale] || Object.values(value)[0] || "";
+}
+async function buildCmssyMetadata(config, path, options = {}) {
+  const clientConfig = {
+    apiUrl: config.apiUrl,
+    workspaceSlug: config.workspaceSlug
+  };
+  const [meta, siteConfig, baseUrl] = await Promise.all([
+    react.fetchPageMeta(clientConfig, path).catch(() => null),
+    react.fetchSiteConfig(clientConfig).catch(() => null),
+    resolveSeoBaseUrl(config, options.baseUrl)
+  ]);
+  const { defaultLocale, locales: enabledLocales } = resolveSeoLocales(
+    config,
+    siteConfig
+  );
+  const locale = await config.resolveLocale?.() ?? defaultLocale;
+  const slug = react.normalizeSlug(path);
+  const siteName = pick(siteConfig?.siteName, locale, defaultLocale) || siteConfig?.branding?.brandName || void 0;
+  const title = pick(meta?.seoTitle, locale, defaultLocale) || pick(meta?.displayName, locale, defaultLocale) || siteName || "";
+  const description = pick(meta?.seoDescription, locale, defaultLocale);
+  const keywords = meta?.seoKeywords?.length ? meta.seoKeywords : void 0;
+  const image = options.image ?? siteConfig?.branding?.ogImageUrl ?? void 0;
+  const canonical = baseUrl ? `${baseUrl}${localizedPath(slug, locale, defaultLocale)}` : void 0;
+  const languages = baseUrl && enabledLocales.length > 1 ? Object.fromEntries(
+    enabledLocales.map((l) => [
+      l,
+      `${baseUrl}${localizedPath(slug, l, defaultLocale)}`
+    ])
+  ) : void 0;
+  return {
+    ...baseUrl ? { metadataBase: new URL(baseUrl) } : {},
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...keywords ? { keywords } : {},
+    ...canonical || languages ? {
+      alternates: {
+        ...canonical ? { canonical } : {},
+        ...languages ? { languages } : {}
+      }
+    } : {},
+    openGraph: {
+      ...title ? { title } : {},
+      ...description ? { description } : {},
+      ...canonical ? { url: canonical } : {},
+      ...siteName ? { siteName } : {},
+      type: options.ogType ?? "website",
+      locale,
+      ...image ? { images: [{ url: image }] } : {}
+    },
+    twitter: {
+      card: image ? options.twitterCard ?? "summary_large_image" : "summary",
+      ...title ? { title } : {},
+      ...description ? { description } : {},
+      ...image ? { images: [image] } : {}
+    }
+  };
+}
 var MIN_SECRET_LENGTH = 16;
 function secretsMatch(a, b) {
   const ha = crypto$1.createHash("sha256").update(a).digest();
@@ -438,79 +629,6 @@ function createCmssyLocaleMiddleware(config) {
     return server.NextResponse.next({ request: { headers: headers3 } });
   };
 }
-var CMSSY_SESSION_COOKIE = "cmssy_session";
-var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-var MIN_SESSION_SECRET_LENGTH = 32;
-var ACCESS_EXPIRY_SKEW_MS = 3e4;
-async function deriveSessionKey(secret) {
-  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(secret)
-  );
-  return new Uint8Array(digest);
-}
-async function sealSession(payload, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  const jwt = new jose.EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
-  if (audience) jwt.setAudience(audience);
-  return jwt.encrypt(key);
-}
-async function openSession(token, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  try {
-    const { payload } = await jose.jwtDecrypt(token, key, {
-      keyManagementAlgorithms: ["dir"],
-      contentEncryptionAlgorithms: ["A256GCM"],
-      ...audience ? { audience } : {}
-    });
-    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
-    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
-      return null;
-    }
-    return {
-      accessToken,
-      refreshToken,
-      accessExpiresAt,
-      user: {
-        recordId: user.recordId,
-        email: user.email
-      }
-    };
-  } catch {
-    return null;
-  }
-}
-function isAccessExpired(payload, now = Date.now()) {
-  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
-}
-function sessionCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: process.env.NODE_ENV !== "development",
-    sameSite: "lax",
-    path: "/",
-    maxAge: SESSION_MAX_AGE_SECONDS
-  };
-}
-
-// src/config.ts
-function assertAuthConfig(config) {
-  const auth = config.auth;
-  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
-    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
-  }
-  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  return auth;
-}
 var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
   siteMemberLogin(input: $input) {
     success message accessToken refreshToken accessTokenExpiresIn
@@ -1218,27 +1336,6 @@ function createCmssyCartRoute(config) {
     }
   };
 }
-async function readValidSession(config) {
-  const auth = assertAuthConfig(config);
-  const jar = await headers.cookies();
-  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  const session = await openSession(
-    raw,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  if (!session || isAccessExpired(session)) return null;
-  return session;
-}
-async function getCmssyUser(config) {
-  const session = await readValidSession(config);
-  return session?.user ?? null;
-}
-async function getCmssyAccessToken(config) {
-  const session = await readValidSession(config);
-  return session?.accessToken ?? null;
-}
 function isPrefetch(request2) {
   return request2.headers.get("next-router-prefetch") !== null || request2.headers.get("purpose") === "prefetch" || (request2.headers.get("sec-purpose") ?? "").includes("prefetch");
 }
@@ -1518,6 +1615,7 @@ exports.CmssyWebhookError = CmssyWebhookError;
 exports.SESSION_MAX_AGE_SECONDS = SESSION_MAX_AGE_SECONDS;
 exports.applyCmssyCsp = applyCmssyCsp;
 exports.assertAuthConfig = assertAuthConfig;
+exports.buildCmssyMetadata = buildCmssyMetadata;
 exports.cmssyCspHeaders = cmssyCspHeaders;
 exports.createCmssyAuthMiddleware = createCmssyAuthMiddleware;
 exports.createCmssyAuthRoute = createCmssyAuthRoute;

package/dist/index.d.cts

@@ -2,7 +2,7 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType, ReactNode } from 'react';
 import { CmssyPageData, CmssyFormDefinition, BlockDefinition, CmssyClientConfig, CmssyProduct, CmssyOrder } from '@cmssy/react';
 import { EditBridgeConfig } from '@cmssy/react/client';
-import { MetadataRoute } from 'next';
+import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
 
 interface CmssyAuthConfig {
@@ -114,6 +114,27 @@ interface CreateCmssySitemapOptions extends SeoBaseUrlOption {
  */
 declare function createCmssySitemap(config: CmssyNextConfig, options?: CreateCmssySitemapOptions): () => Promise<MetadataRoute.Sitemap>;
 
+interface BuildCmssyMetadataOptions extends SeoBaseUrlOption {
+    /** Override the Open Graph / Twitter image (defaults to workspace branding). */
+    image?: string;
+    /** Open Graph type. Defaults to "website". */
+    ogType?: string;
+    /** Twitter card. Defaults to "summary_large_image" when an image exists. */
+    twitterCard?: "summary" | "summary_large_image";
+}
+/**
+ * Builds complete Next.js `Metadata` for a cmssy page from its SEO fields and
+ * the workspace branding: title/description/keywords, canonical + per-locale
+ * `hreflang` alternates, and Open Graph / Twitter cards (with the branding OG
+ * image). Use in a route's `generateMetadata`:
+ *
+ *   export const generateMetadata = ({ params }) =>
+ *     buildCmssyMetadata(cmssy, (await params).path);
+ *
+ * `path` is the catch-all segments with the locale prefix already stripped.
+ */
+declare function buildCmssyMetadata(config: CmssyNextConfig, path?: string | string[], options?: BuildCmssyMetadataOptions): Promise<Metadata>;
+
 type CmssyDraftRouteConfig = Pick<CmssyNextConfig, "draftSecret"> & {
     defaultRedirect?: string;
 };
@@ -307,4 +328,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType, ReactNode } from 'react';
 import { CmssyPageData, CmssyFormDefinition, BlockDefinition, CmssyClientConfig, CmssyProduct, CmssyOrder } from '@cmssy/react';
 import { EditBridgeConfig } from '@cmssy/react/client';
-import { MetadataRoute } from 'next';
+import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
 
 interface CmssyAuthConfig {
@@ -114,6 +114,27 @@ interface CreateCmssySitemapOptions extends SeoBaseUrlOption {
  */
 declare function createCmssySitemap(config: CmssyNextConfig, options?: CreateCmssySitemapOptions): () => Promise<MetadataRoute.Sitemap>;
 
+interface BuildCmssyMetadataOptions extends SeoBaseUrlOption {
+    /** Override the Open Graph / Twitter image (defaults to workspace branding). */
+    image?: string;
+    /** Open Graph type. Defaults to "website". */
+    ogType?: string;
+    /** Twitter card. Defaults to "summary_large_image" when an image exists. */
+    twitterCard?: "summary" | "summary_large_image";
+}
+/**
+ * Builds complete Next.js `Metadata` for a cmssy page from its SEO fields and
+ * the workspace branding: title/description/keywords, canonical + per-locale
+ * `hreflang` alternates, and Open Graph / Twitter cards (with the branding OG
+ * image). Use in a route's `generateMetadata`:
+ *
+ *   export const generateMetadata = ({ params }) =>
+ *     buildCmssyMetadata(cmssy, (await params).path);
+ *
+ * `path` is the catch-all segments with the locale prefix already stripped.
+ */
+declare function buildCmssyMetadata(config: CmssyNextConfig, path?: string | string[], options?: BuildCmssyMetadataOptions): Promise<Metadata>;
+
 type CmssyDraftRouteConfig = Pick<CmssyNextConfig, "draftSecret"> & {
     defaultRedirect?: string;
 };
@@ -307,4 +328,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.js

@@ -1,13 +1,109 @@
 import { draftMode, headers, cookies } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
-import { resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, fetchSiteConfig, fetchPageById, fetchPages, resolveWorkspaceId, graphqlRequest } from '@cmssy/react';
+import { createCmssyClient, resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, fetchSiteConfig, fetchPageById, fetchPages, fetchPageMeta, normalizeSlug as normalizeSlug$1, resolveWorkspaceId, graphqlRequest } from '@cmssy/react';
 import { CmssyLocaleProvider } from '@cmssy/react/client';
+import { EncryptJWT, jwtDecrypt } from 'jose';
 import { jsx, jsxs } from 'react/jsx-runtime';
 import { createHmac, createHash, timingSafeEqual } from 'crypto';
 import { NextResponse } from 'next/server';
-import { EncryptJWT, jwtDecrypt } from 'jose';
 
 // src/create-cmssy-page.tsx
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+
+// src/auth-server.ts
+async function readValidSession(config) {
+  const auth = assertAuthConfig(config);
+  const jar = await cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
 
 // src/csp.ts
 function toCspOrigin(origin) {
@@ -68,6 +164,7 @@ function createCmssyPage(config, blocks, options) {
     apiUrl: config.apiUrl,
     workspaceSlug: config.workspaceSlug
   };
+  const client = createCmssyClient(clientConfig);
   return async function CmssyCatchAllPage({
     params,
     searchParams
@@ -129,6 +226,27 @@ function createCmssyPage(config, blocks, options) {
         }
       ) });
     }
+    let auth;
+    if (config.auth) {
+      try {
+        const user = await getCmssyUser(config);
+        auth = {
+          isAuthenticated: !!user,
+          member: user ? { recordId: user.recordId, email: user.email } : null
+        };
+      } catch {
+        auth = void 0;
+      }
+    }
+    let workspace;
+    try {
+      workspace = {
+        id: await client.resolveWorkspaceId(),
+        slug: config.workspaceSlug
+      };
+    } catch {
+      workspace = void 0;
+    }
     return /* @__PURE__ */ jsx(CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsx(
       CmssyServerPage,
       {
@@ -137,7 +255,9 @@ function createCmssyPage(config, blocks, options) {
         locale,
         defaultLocale,
         enabledLocales,
-        forms
+        forms,
+        auth,
+        workspace
       }
     ) });
   };
@@ -286,14 +406,24 @@ function createCmssyRobots(config, options = {}) {
     };
   };
 }
+
+// src/seo-paths.ts
+function resolveSeoLocales(config, siteConfig) {
+  const defaultLocale = config.defaultLocale ?? siteConfig?.defaultLanguage ?? "en";
+  const locales = config.enabledLocales && config.enabledLocales.length > 0 ? config.enabledLocales : siteConfig?.enabledLanguages && siteConfig.enabledLanguages.length > 0 ? siteConfig.enabledLanguages : [defaultLocale];
+  return { defaultLocale, locales };
+}
 function normalizeSlug(slug) {
   if (slug === "/" || slug === "") return "/";
   return slug.startsWith("/") ? slug : `/${slug}`;
 }
 function localizedPath(slug, locale, defaultLocale) {
-  const normalized = slug === "/" ? "" : slug;
-  return locale === defaultLocale ? normalized || "/" : `/${locale}${normalized}`;
+  const normalized = normalizeSlug(slug);
+  const base = normalized === "/" ? "" : normalized;
+  return locale === defaultLocale ? base || "/" : `/${locale}${base}`;
 }
+
+// src/create-cmssy-sitemap.ts
 function createCmssySitemap(config, options = {}) {
   const clientConfig = {
     apiUrl: config.apiUrl,
@@ -309,15 +439,15 @@ function createCmssySitemap(config, options = {}) {
       }
       pages = [];
     }
-    let notFoundPageId = null;
+    let siteConfig = null;
     try {
-      notFoundPageId = (await fetchSiteConfig(clientConfig))?.notFoundPageId ?? null;
+      siteConfig = await fetchSiteConfig(clientConfig);
     } catch {
-      notFoundPageId = null;
+      siteConfig = null;
     }
+    const notFoundPageId = siteConfig?.notFoundPageId ?? null;
     const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
-    const defaultLocale = config.defaultLocale ?? "en";
-    const locales = config.enabledLocales && config.enabledLocales.length > 0 ? config.enabledLocales : [defaultLocale];
+    const { defaultLocale, locales } = resolveSeoLocales(config, siteConfig);
     const excluded = new Set((options.excludeSlugs ?? []).map(normalizeSlug));
     const entries = pages.map((page) => ({ ...page, slug: normalizeSlug(page.slug) })).filter((page) => page.id !== notFoundPageId && !excluded.has(page.slug)).map((page) => {
       const lastModified = page.updatedAt ?? page.publishedAt ?? void 0;
@@ -340,6 +470,67 @@ function createCmssySitemap(config, options = {}) {
     return options.extra ? [...entries, ...options.extra] : entries;
   };
 }
+function pick(value, locale, defaultLocale) {
+  if (!value) return "";
+  if (typeof value === "string") return value;
+  return value[locale] || value[defaultLocale] || Object.values(value)[0] || "";
+}
+async function buildCmssyMetadata(config, path, options = {}) {
+  const clientConfig = {
+    apiUrl: config.apiUrl,
+    workspaceSlug: config.workspaceSlug
+  };
+  const [meta, siteConfig, baseUrl] = await Promise.all([
+    fetchPageMeta(clientConfig, path).catch(() => null),
+    fetchSiteConfig(clientConfig).catch(() => null),
+    resolveSeoBaseUrl(config, options.baseUrl)
+  ]);
+  const { defaultLocale, locales: enabledLocales } = resolveSeoLocales(
+    config,
+    siteConfig
+  );
+  const locale = await config.resolveLocale?.() ?? defaultLocale;
+  const slug = normalizeSlug$1(path);
+  const siteName = pick(siteConfig?.siteName, locale, defaultLocale) || siteConfig?.branding?.brandName || void 0;
+  const title = pick(meta?.seoTitle, locale, defaultLocale) || pick(meta?.displayName, locale, defaultLocale) || siteName || "";
+  const description = pick(meta?.seoDescription, locale, defaultLocale);
+  const keywords = meta?.seoKeywords?.length ? meta.seoKeywords : void 0;
+  const image = options.image ?? siteConfig?.branding?.ogImageUrl ?? void 0;
+  const canonical = baseUrl ? `${baseUrl}${localizedPath(slug, locale, defaultLocale)}` : void 0;
+  const languages = baseUrl && enabledLocales.length > 1 ? Object.fromEntries(
+    enabledLocales.map((l) => [
+      l,
+      `${baseUrl}${localizedPath(slug, l, defaultLocale)}`
+    ])
+  ) : void 0;
+  return {
+    ...baseUrl ? { metadataBase: new URL(baseUrl) } : {},
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...keywords ? { keywords } : {},
+    ...canonical || languages ? {
+      alternates: {
+        ...canonical ? { canonical } : {},
+        ...languages ? { languages } : {}
+      }
+    } : {},
+    openGraph: {
+      ...title ? { title } : {},
+      ...description ? { description } : {},
+      ...canonical ? { url: canonical } : {},
+      ...siteName ? { siteName } : {},
+      type: options.ogType ?? "website",
+      locale,
+      ...image ? { images: [{ url: image }] } : {}
+    },
+    twitter: {
+      card: image ? options.twitterCard ?? "summary_large_image" : "summary",
+      ...title ? { title } : {},
+      ...description ? { description } : {},
+      ...image ? { images: [image] } : {}
+    }
+  };
+}
 var MIN_SECRET_LENGTH = 16;
 function secretsMatch(a, b) {
   const ha = createHash("sha256").update(a).digest();
@@ -436,79 +627,6 @@ function createCmssyLocaleMiddleware(config) {
     return NextResponse.next({ request: { headers: headers3 } });
   };
 }
-var CMSSY_SESSION_COOKIE = "cmssy_session";
-var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-var MIN_SESSION_SECRET_LENGTH = 32;
-var ACCESS_EXPIRY_SKEW_MS = 3e4;
-async function deriveSessionKey(secret) {
-  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(secret)
-  );
-  return new Uint8Array(digest);
-}
-async function sealSession(payload, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  const jwt = new EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
-  if (audience) jwt.setAudience(audience);
-  return jwt.encrypt(key);
-}
-async function openSession(token, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  try {
-    const { payload } = await jwtDecrypt(token, key, {
-      keyManagementAlgorithms: ["dir"],
-      contentEncryptionAlgorithms: ["A256GCM"],
-      ...audience ? { audience } : {}
-    });
-    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
-    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
-      return null;
-    }
-    return {
-      accessToken,
-      refreshToken,
-      accessExpiresAt,
-      user: {
-        recordId: user.recordId,
-        email: user.email
-      }
-    };
-  } catch {
-    return null;
-  }
-}
-function isAccessExpired(payload, now = Date.now()) {
-  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
-}
-function sessionCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: process.env.NODE_ENV !== "development",
-    sameSite: "lax",
-    path: "/",
-    maxAge: SESSION_MAX_AGE_SECONDS
-  };
-}
-
-// src/config.ts
-function assertAuthConfig(config) {
-  const auth = config.auth;
-  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
-    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
-  }
-  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  return auth;
-}
 var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
   siteMemberLogin(input: $input) {
     success message accessToken refreshToken accessTokenExpiresIn
@@ -1216,27 +1334,6 @@ function createCmssyCartRoute(config) {
     }
   };
 }
-async function readValidSession(config) {
-  const auth = assertAuthConfig(config);
-  const jar = await cookies();
-  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  const session = await openSession(
-    raw,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  if (!session || isAccessExpired(session)) return null;
-  return session;
-}
-async function getCmssyUser(config) {
-  const session = await readValidSession(config);
-  return session?.user ?? null;
-}
-async function getCmssyAccessToken(config) {
-  const session = await readValidSession(config);
-  return session?.accessToken ?? null;
-}
 function isPrefetch(request2) {
   return request2.headers.get("next-router-prefetch") !== null || request2.headers.get("purpose") === "prefetch" || (request2.headers.get("sec-purpose") ?? "").includes("prefetch");
 }
@@ -1508,4 +1605,4 @@ function verifyCmssyWebhook(options) {
   return parsed;
 }
 
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/next",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Next.js App Router bindings for cmssy headless sites (createCmssyPage + draft preview)",
   "keywords": [
     "cmssy",
@@ -41,7 +41,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@cmssy/react": "^0.5.3",
+    "@cmssy/react": "^0.5.5",
     "next": ">=15",
     "react": "^18.2.0 || ^19.0.0",
     "react-dom": "^18.2.0 || ^19.0.0"
@@ -54,7 +54,7 @@
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@cmssy/react": "0.5.3"
+    "@cmssy/react": "0.5.5"
   },
   "dependencies": {
     "jose": "^6.2.3"