@cmssy/next 0.5.4 → 0.5.6

package/dist/index.cjs

@@ -4,12 +4,117 @@ var headers = require('next/headers');
 var navigation = require('next/navigation');
 var react = require('@cmssy/react');
 var client = require('@cmssy/react/client');
+var jose = require('jose');
 var jsxRuntime = require('react/jsx-runtime');
 var crypto$1 = require('crypto');
 var server = require('next/server');
-var jose = require('jose');
 
 // src/create-cmssy-page.tsx
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new jose.EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jose.jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+var DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
+function resolveEditorOrigin(editorOrigin) {
+  if (editorOrigin === void 0) return DEFAULT_CMSSY_EDITOR_ORIGIN;
+  if (Array.isArray(editorOrigin)) {
+    const cleaned = editorOrigin.filter((o) => o && o.trim().length > 0);
+    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGIN;
+  }
+  return editorOrigin.trim().length > 0 ? editorOrigin : DEFAULT_CMSSY_EDITOR_ORIGIN;
+}
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+
+// src/auth-server.ts
+async function readValidSession(config) {
+  const auth = assertAuthConfig(config);
+  const jar = await headers.cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
 
 // src/csp.ts
 function toCspOrigin(origin) {
@@ -26,7 +131,8 @@ function toCspOrigin(origin) {
   return parsed.origin;
 }
 function frameAncestors(editorOrigin) {
-  const origins = Array.isArray(editorOrigin) ? editorOrigin : [editorOrigin];
+  const resolved = resolveEditorOrigin(editorOrigin);
+  const origins = Array.isArray(resolved) ? resolved : [resolved];
   if (origins.length === 0) {
     throw new Error(
       "cmssy: editorOrigin must contain at least one valid origin"
@@ -70,6 +176,7 @@ function createCmssyPage(config, blocks, options) {
     apiUrl: config.apiUrl,
     workspaceSlug: config.workspaceSlug
   };
+  const client$1 = react.createCmssyClient(clientConfig);
   return async function CmssyCatchAllPage({
     params,
     searchParams
@@ -131,6 +238,27 @@ function createCmssyPage(config, blocks, options) {
         }
       ) });
     }
+    let auth;
+    if (config.auth) {
+      try {
+        const user = await getCmssyUser(config);
+        auth = {
+          isAuthenticated: !!user,
+          member: user ? { recordId: user.recordId, email: user.email } : null
+        };
+      } catch {
+        auth = void 0;
+      }
+    }
+    let workspace;
+    try {
+      workspace = {
+        id: await client$1.resolveWorkspaceId(),
+        slug: config.workspaceSlug
+      };
+    } catch {
+      workspace = void 0;
+    }
     return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
       react.CmssyServerPage,
       {
@@ -139,13 +267,16 @@ function createCmssyPage(config, blocks, options) {
         locale,
         defaultLocale,
         enabledLocales,
-        forms
+        forms,
+        auth,
+        workspace
       }
     ) });
   };
 }
 function resolveBridgeOrigin(editorOrigin) {
-  const origins = Array.isArray(editorOrigin) ? editorOrigin : [editorOrigin];
+  const resolved = resolveEditorOrigin(editorOrigin);
+  const origins = Array.isArray(resolved) ? resolved : [resolved];
   if (origins.length === 0) {
     throw new Error("cmssy: editorOrigin must be set to frame the editor");
   }
@@ -157,7 +288,7 @@ function resolveBridgeOrigin(editorOrigin) {
   const origin = toCspOrigin(origins[0].trim());
   if (origin === "*") {
     throw new Error(
-      "cmssy: editorOrigin '*' is not allowed for the live-edit bridge; set the concrete editor origin (e.g. https://app.cmssy.io)"
+      "cmssy: editorOrigin '*' is not allowed for the live-edit bridge; set the concrete editor origin (e.g. https://www.cmssy.io)"
     );
   }
   return origin;
@@ -509,79 +640,6 @@ function createCmssyLocaleMiddleware(config) {
     return server.NextResponse.next({ request: { headers: headers3 } });
   };
 }
-var CMSSY_SESSION_COOKIE = "cmssy_session";
-var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-var MIN_SESSION_SECRET_LENGTH = 32;
-var ACCESS_EXPIRY_SKEW_MS = 3e4;
-async function deriveSessionKey(secret) {
-  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(secret)
-  );
-  return new Uint8Array(digest);
-}
-async function sealSession(payload, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  const jwt = new jose.EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
-  if (audience) jwt.setAudience(audience);
-  return jwt.encrypt(key);
-}
-async function openSession(token, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  try {
-    const { payload } = await jose.jwtDecrypt(token, key, {
-      keyManagementAlgorithms: ["dir"],
-      contentEncryptionAlgorithms: ["A256GCM"],
-      ...audience ? { audience } : {}
-    });
-    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
-    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
-      return null;
-    }
-    return {
-      accessToken,
-      refreshToken,
-      accessExpiresAt,
-      user: {
-        recordId: user.recordId,
-        email: user.email
-      }
-    };
-  } catch {
-    return null;
-  }
-}
-function isAccessExpired(payload, now = Date.now()) {
-  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
-}
-function sessionCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: process.env.NODE_ENV !== "development",
-    sameSite: "lax",
-    path: "/",
-    maxAge: SESSION_MAX_AGE_SECONDS
-  };
-}
-
-// src/config.ts
-function assertAuthConfig(config) {
-  const auth = config.auth;
-  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
-    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
-  }
-  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  return auth;
-}
 var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
   siteMemberLogin(input: $input) {
     success message accessToken refreshToken accessTokenExpiresIn
@@ -612,7 +670,7 @@ var VERIFY_MUTATION = `mutation SiteMemberVerifyEmail($token: String!) {
 }`;
 var workspaceIdCache = /* @__PURE__ */ new Map();
 function workspaceIdFor(config) {
-  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const key = `${react.resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
   const existing = workspaceIdCache.get(key);
   if (existing) return existing;
   const fresh = react.resolveWorkspaceId(config).catch((err) => {
@@ -999,7 +1057,7 @@ var PRODUCT = `query Product($workspaceId: String!, $modelSlug: String!, $filter
 }`;
 var workspaceIdCache2 = /* @__PURE__ */ new Map();
 function workspaceIdFor2(config) {
-  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const key = `${react.resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
   const existing = workspaceIdCache2.get(key);
   if (existing) return existing;
   const fresh = react.resolveWorkspaceId(config).catch((err) => {
@@ -1289,27 +1347,6 @@ function createCmssyCartRoute(config) {
     }
   };
 }
-async function readValidSession(config) {
-  const auth = assertAuthConfig(config);
-  const jar = await headers.cookies();
-  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  const session = await openSession(
-    raw,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  if (!session || isAccessExpired(session)) return null;
-  return session;
-}
-async function getCmssyUser(config) {
-  const session = await readValidSession(config);
-  return session?.user ?? null;
-}
-async function getCmssyAccessToken(config) {
-  const session = await readValidSession(config);
-  return session?.accessToken ?? null;
-}
 function isPrefetch(request2) {
   return request2.headers.get("next-router-prefetch") !== null || request2.headers.get("purpose") === "prefetch" || (request2.headers.get("sec-purpose") ?? "").includes("prefetch");
 }
@@ -1428,7 +1465,7 @@ var MY_ORDER = `query MyOrder($workspaceId: ID!, $id: ID!) {
 }`;
 var workspaceIdCache3 = /* @__PURE__ */ new Map();
 function workspaceIdFor3(config) {
-  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const key = `${react.resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
   const existing = workspaceIdCache3.get(key);
   if (existing) return existing;
   const fresh = react.resolveWorkspaceId(config).catch((err) => {
@@ -1581,11 +1618,20 @@ function verifyCmssyWebhook(options) {
   return parsed;
 }
 
+Object.defineProperty(exports, "DEFAULT_CMSSY_API_URL", {
+  enumerable: true,
+  get: function () { return react.DEFAULT_CMSSY_API_URL; }
+});
+Object.defineProperty(exports, "resolveApiUrl", {
+  enumerable: true,
+  get: function () { return react.resolveApiUrl; }
+});
 exports.CMSSY_CART_COOKIE = CMSSY_CART_COOKIE;
 exports.CMSSY_EDIT_HEADER = CMSSY_EDIT_HEADER;
 exports.CMSSY_LOCALE_HEADER = CMSSY_LOCALE_HEADER;
 exports.CMSSY_SESSION_COOKIE = CMSSY_SESSION_COOKIE;
 exports.CmssyWebhookError = CmssyWebhookError;
+exports.DEFAULT_CMSSY_EDITOR_ORIGIN = DEFAULT_CMSSY_EDITOR_ORIGIN;
 exports.SESSION_MAX_AGE_SECONDS = SESSION_MAX_AGE_SECONDS;
 exports.applyCmssyCsp = applyCmssyCsp;
 exports.assertAuthConfig = assertAuthConfig;
@@ -1611,6 +1657,7 @@ exports.isCmssyEditMode = isCmssyEditMode;
 exports.isCmssyEditRequest = isCmssyEditRequest;
 exports.localeForPathname = localeForPathname;
 exports.openSession = openSession;
+exports.resolveEditorOrigin = resolveEditorOrigin;
 exports.resolveLocaleFromPathname = resolveLocaleFromPathname;
 exports.sealSession = sealSession;
 exports.sessionCookieOptions = sessionCookieOptions;

package/dist/index.d.cts

@@ -1,19 +1,36 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType, ReactNode } from 'react';
 import { CmssyPageData, CmssyFormDefinition, BlockDefinition, CmssyClientConfig, CmssyProduct, CmssyOrder } from '@cmssy/react';
+export { DEFAULT_CMSSY_API_URL, resolveApiUrl } from '@cmssy/react';
 import { EditBridgeConfig } from '@cmssy/react/client';
 import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
 
+/**
+ * Origin of the cmssy admin/editor that frames your site (postMessage source +
+ * CSP `frame-ancestors`). Identical for every workspace on cmssy cloud, so
+ * `editorOrigin` defaults to this. Self-hosted admins override it via config.
+ */
+declare const DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
+/** Resolves `editorOrigin`, falling back to the cmssy cloud admin when unset. */
+declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
 interface CmssyAuthConfig {
     modelSlug: string;
     sessionSecret: string;
 }
 interface CmssyNextConfig {
-    apiUrl: string;
+    /**
+     * Full GraphQL delivery endpoint. Defaults to the cmssy cloud endpoint
+     * (`https://api.cmssy.io/graphql`); set it only for self-hosted / staging.
+     */
+    apiUrl?: string;
     workspaceSlug: string;
     draftSecret: string;
-    editorOrigin: string | string[];
+    /**
+     * Origin allowed to frame your app in the editor. Defaults to
+     * {@link DEFAULT_CMSSY_EDITOR_ORIGIN}; set it only for self-hosted admins.
+     */
+    editorOrigin?: string | string[];
     /**
      * Canonical absolute site URL (e.g. https://cmssy.com), used by
      * createCmssyRobots / createCmssySitemap. When omitted the helpers derive the
@@ -141,7 +158,8 @@ type CmssyDraftRouteConfig = Pick<CmssyNextConfig, "draftSecret"> & {
 declare function createDraftRoute(config: CmssyDraftRouteConfig): (request: Request) => Promise<Response>;
 
 interface CmssyCspOptions {
-    editorOrigin: string | string[];
+    /** Defaults to the cmssy cloud admin origin when unset. */
+    editorOrigin?: string | string[];
 }
 interface MutableHeaders {
     headers: {
@@ -328,4 +346,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGIN, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.d.ts

@@ -1,19 +1,36 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ComponentType, ReactNode } from 'react';
 import { CmssyPageData, CmssyFormDefinition, BlockDefinition, CmssyClientConfig, CmssyProduct, CmssyOrder } from '@cmssy/react';
+export { DEFAULT_CMSSY_API_URL, resolveApiUrl } from '@cmssy/react';
 import { EditBridgeConfig } from '@cmssy/react/client';
 import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
 
+/**
+ * Origin of the cmssy admin/editor that frames your site (postMessage source +
+ * CSP `frame-ancestors`). Identical for every workspace on cmssy cloud, so
+ * `editorOrigin` defaults to this. Self-hosted admins override it via config.
+ */
+declare const DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
+/** Resolves `editorOrigin`, falling back to the cmssy cloud admin when unset. */
+declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
 interface CmssyAuthConfig {
     modelSlug: string;
     sessionSecret: string;
 }
 interface CmssyNextConfig {
-    apiUrl: string;
+    /**
+     * Full GraphQL delivery endpoint. Defaults to the cmssy cloud endpoint
+     * (`https://api.cmssy.io/graphql`); set it only for self-hosted / staging.
+     */
+    apiUrl?: string;
     workspaceSlug: string;
     draftSecret: string;
-    editorOrigin: string | string[];
+    /**
+     * Origin allowed to frame your app in the editor. Defaults to
+     * {@link DEFAULT_CMSSY_EDITOR_ORIGIN}; set it only for self-hosted admins.
+     */
+    editorOrigin?: string | string[];
     /**
      * Canonical absolute site URL (e.g. https://cmssy.com), used by
      * createCmssyRobots / createCmssySitemap. When omitted the helpers derive the
@@ -141,7 +158,8 @@ type CmssyDraftRouteConfig = Pick<CmssyNextConfig, "draftSecret"> & {
 declare function createDraftRoute(config: CmssyDraftRouteConfig): (request: Request) => Promise<Response>;
 
 interface CmssyCspOptions {
-    editorOrigin: string | string[];
+    /** Defaults to the cmssy cloud admin origin when unset. */
+    editorOrigin?: string | string[];
 }
 interface MutableHeaders {
     headers: {
@@ -328,4 +346,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGIN, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.js

@@ -1,13 +1,119 @@
 import { draftMode, headers, cookies } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
-import { resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, fetchSiteConfig, fetchPageById, fetchPages, fetchPageMeta, normalizeSlug as normalizeSlug$1, resolveWorkspaceId, graphqlRequest } from '@cmssy/react';
+import { createCmssyClient, resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, fetchSiteConfig, fetchPageById, fetchPages, fetchPageMeta, normalizeSlug as normalizeSlug$1, resolveWorkspaceId, graphqlRequest, resolveApiUrl } from '@cmssy/react';
+export { DEFAULT_CMSSY_API_URL, resolveApiUrl } from '@cmssy/react';
 import { CmssyLocaleProvider } from '@cmssy/react/client';
+import { EncryptJWT, jwtDecrypt } from 'jose';
 import { jsx, jsxs } from 'react/jsx-runtime';
 import { createHmac, createHash, timingSafeEqual } from 'crypto';
 import { NextResponse } from 'next/server';
-import { EncryptJWT, jwtDecrypt } from 'jose';
 
 // src/create-cmssy-page.tsx
+var CMSSY_SESSION_COOKIE = "cmssy_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var MIN_SESSION_SECRET_LENGTH = 32;
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
+async function deriveSessionKey(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(secret)
+  );
+  return new Uint8Array(digest);
+}
+async function sealSession(payload, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  const jwt = new EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
+  if (audience) jwt.setAudience(audience);
+  return jwt.encrypt(key);
+}
+async function openSession(token, secret, audience) {
+  const key = await deriveSessionKey(secret);
+  try {
+    const { payload } = await jwtDecrypt(token, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"],
+      ...audience ? { audience } : {}
+    });
+    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
+    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken,
+      accessExpiresAt,
+      user: {
+        recordId: user.recordId,
+        email: user.email
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function isAccessExpired(payload, now = Date.now()) {
+  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
+}
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+
+// src/config.ts
+var DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
+function resolveEditorOrigin(editorOrigin) {
+  if (editorOrigin === void 0) return DEFAULT_CMSSY_EDITOR_ORIGIN;
+  if (Array.isArray(editorOrigin)) {
+    const cleaned = editorOrigin.filter((o) => o && o.trim().length > 0);
+    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGIN;
+  }
+  return editorOrigin.trim().length > 0 ? editorOrigin : DEFAULT_CMSSY_EDITOR_ORIGIN;
+}
+function assertAuthConfig(config) {
+  const auth = config.auth;
+  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
+    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
+  }
+  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error(
+      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
+    );
+  }
+  return auth;
+}
+
+// src/auth-server.ts
+async function readValidSession(config) {
+  const auth = assertAuthConfig(config);
+  const jar = await cookies();
+  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
 
 // src/csp.ts
 function toCspOrigin(origin) {
@@ -24,7 +130,8 @@ function toCspOrigin(origin) {
   return parsed.origin;
 }
 function frameAncestors(editorOrigin) {
-  const origins = Array.isArray(editorOrigin) ? editorOrigin : [editorOrigin];
+  const resolved = resolveEditorOrigin(editorOrigin);
+  const origins = Array.isArray(resolved) ? resolved : [resolved];
   if (origins.length === 0) {
     throw new Error(
       "cmssy: editorOrigin must contain at least one valid origin"
@@ -68,6 +175,7 @@ function createCmssyPage(config, blocks, options) {
     apiUrl: config.apiUrl,
     workspaceSlug: config.workspaceSlug
   };
+  const client = createCmssyClient(clientConfig);
   return async function CmssyCatchAllPage({
     params,
     searchParams
@@ -129,6 +237,27 @@ function createCmssyPage(config, blocks, options) {
         }
       ) });
     }
+    let auth;
+    if (config.auth) {
+      try {
+        const user = await getCmssyUser(config);
+        auth = {
+          isAuthenticated: !!user,
+          member: user ? { recordId: user.recordId, email: user.email } : null
+        };
+      } catch {
+        auth = void 0;
+      }
+    }
+    let workspace;
+    try {
+      workspace = {
+        id: await client.resolveWorkspaceId(),
+        slug: config.workspaceSlug
+      };
+    } catch {
+      workspace = void 0;
+    }
     return /* @__PURE__ */ jsx(CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsx(
       CmssyServerPage,
       {
@@ -137,13 +266,16 @@ function createCmssyPage(config, blocks, options) {
         locale,
         defaultLocale,
         enabledLocales,
-        forms
+        forms,
+        auth,
+        workspace
       }
     ) });
   };
 }
 function resolveBridgeOrigin(editorOrigin) {
-  const origins = Array.isArray(editorOrigin) ? editorOrigin : [editorOrigin];
+  const resolved = resolveEditorOrigin(editorOrigin);
+  const origins = Array.isArray(resolved) ? resolved : [resolved];
   if (origins.length === 0) {
     throw new Error("cmssy: editorOrigin must be set to frame the editor");
   }
@@ -155,7 +287,7 @@ function resolveBridgeOrigin(editorOrigin) {
   const origin = toCspOrigin(origins[0].trim());
   if (origin === "*") {
     throw new Error(
-      "cmssy: editorOrigin '*' is not allowed for the live-edit bridge; set the concrete editor origin (e.g. https://app.cmssy.io)"
+      "cmssy: editorOrigin '*' is not allowed for the live-edit bridge; set the concrete editor origin (e.g. https://www.cmssy.io)"
     );
   }
   return origin;
@@ -507,79 +639,6 @@ function createCmssyLocaleMiddleware(config) {
     return NextResponse.next({ request: { headers: headers3 } });
   };
 }
-var CMSSY_SESSION_COOKIE = "cmssy_session";
-var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-var MIN_SESSION_SECRET_LENGTH = 32;
-var ACCESS_EXPIRY_SKEW_MS = 3e4;
-async function deriveSessionKey(secret) {
-  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(secret)
-  );
-  return new Uint8Array(digest);
-}
-async function sealSession(payload, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  const jwt = new EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
-  if (audience) jwt.setAudience(audience);
-  return jwt.encrypt(key);
-}
-async function openSession(token, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  try {
-    const { payload } = await jwtDecrypt(token, key, {
-      keyManagementAlgorithms: ["dir"],
-      contentEncryptionAlgorithms: ["A256GCM"],
-      ...audience ? { audience } : {}
-    });
-    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
-    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
-      return null;
-    }
-    return {
-      accessToken,
-      refreshToken,
-      accessExpiresAt,
-      user: {
-        recordId: user.recordId,
-        email: user.email
-      }
-    };
-  } catch {
-    return null;
-  }
-}
-function isAccessExpired(payload, now = Date.now()) {
-  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
-}
-function sessionCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: process.env.NODE_ENV !== "development",
-    sameSite: "lax",
-    path: "/",
-    maxAge: SESSION_MAX_AGE_SECONDS
-  };
-}
-
-// src/config.ts
-function assertAuthConfig(config) {
-  const auth = config.auth;
-  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
-    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
-  }
-  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  return auth;
-}
 var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
   siteMemberLogin(input: $input) {
     success message accessToken refreshToken accessTokenExpiresIn
@@ -610,7 +669,7 @@ var VERIFY_MUTATION = `mutation SiteMemberVerifyEmail($token: String!) {
 }`;
 var workspaceIdCache = /* @__PURE__ */ new Map();
 function workspaceIdFor(config) {
-  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
   const existing = workspaceIdCache.get(key);
   if (existing) return existing;
   const fresh = resolveWorkspaceId(config).catch((err) => {
@@ -997,7 +1056,7 @@ var PRODUCT = `query Product($workspaceId: String!, $modelSlug: String!, $filter
 }`;
 var workspaceIdCache2 = /* @__PURE__ */ new Map();
 function workspaceIdFor2(config) {
-  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
   const existing = workspaceIdCache2.get(key);
   if (existing) return existing;
   const fresh = resolveWorkspaceId(config).catch((err) => {
@@ -1287,27 +1346,6 @@ function createCmssyCartRoute(config) {
     }
   };
 }
-async function readValidSession(config) {
-  const auth = assertAuthConfig(config);
-  const jar = await cookies();
-  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  const session = await openSession(
-    raw,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  if (!session || isAccessExpired(session)) return null;
-  return session;
-}
-async function getCmssyUser(config) {
-  const session = await readValidSession(config);
-  return session?.user ?? null;
-}
-async function getCmssyAccessToken(config) {
-  const session = await readValidSession(config);
-  return session?.accessToken ?? null;
-}
 function isPrefetch(request2) {
   return request2.headers.get("next-router-prefetch") !== null || request2.headers.get("purpose") === "prefetch" || (request2.headers.get("sec-purpose") ?? "").includes("prefetch");
 }
@@ -1426,7 +1464,7 @@ var MY_ORDER = `query MyOrder($workspaceId: ID!, $id: ID!) {
 }`;
 var workspaceIdCache3 = /* @__PURE__ */ new Map();
 function workspaceIdFor3(config) {
-  const key = `${config.apiUrl}::${config.workspaceSlug}`;
+  const key = `${resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
   const existing = workspaceIdCache3.get(key);
   if (existing) return existing;
   const fresh = resolveWorkspaceId(config).catch((err) => {
@@ -1579,4 +1617,4 @@ function verifyCmssyWebhook(options) {
   return parsed;
 }
 
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGIN, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/next",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Next.js App Router bindings for cmssy headless sites (createCmssyPage + draft preview)",
   "keywords": [
     "cmssy",
@@ -41,7 +41,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@cmssy/react": "^0.5.4",
+    "@cmssy/react": "^0.5.6",
     "next": ">=15",
     "react": "^18.2.0 || ^19.0.0",
     "react-dom": "^18.2.0 || ^19.0.0"
@@ -54,7 +54,7 @@
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@cmssy/react": "0.5.4"
+    "@cmssy/react": "0.5.6"
   },
   "dependencies": {
     "jose": "^6.2.3"