@cmssy/next 0.5.6 → 0.6.0

package/README.md

@@ -26,11 +26,10 @@ export default createCmssyPage(cmssy, blocks, { editor: CmssyEditor });
 import type { CmssyNextConfig } from "@cmssy/next";
 
 export const cmssy: CmssyNextConfig = {
-  apiUrl: process.env.CMSSY_API_URL ?? "", // public GraphQL delivery endpoint
   workspaceSlug: process.env.CMSSY_WORKSPACE_SLUG ?? "",
   draftSecret: process.env.CMSSY_DRAFT_SECRET ?? "", // edit-mode preview handshake
-  editorOrigin: process.env.CMSSY_EDITOR_ORIGIN ?? "", // only needed in edit mode
   defaultLocale: "en",
+  // apiUrl + editorOrigin default to cmssy cloud; set them only for self-host/staging.
 };
 ```
 

package/dist/index.cjs

@@ -71,14 +71,29 @@ function sessionCookieOptions() {
 }
 
 // src/config.ts
-var DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
+var DEFAULT_CMSSY_EDITOR_ORIGINS = [
+  "https://cmssy.io",
+  "https://www.cmssy.io"
+];
+function parseEditorOriginEnv(raw) {
+  if (!raw) return void 0;
+  const parts = raw.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+  if (parts.length === 0) return void 0;
+  return parts.length === 1 ? parts[0] : parts;
+}
+function isDevelopment() {
+  return typeof process !== "undefined" && process.env.NODE_ENV === "development";
+}
 function resolveEditorOrigin(editorOrigin) {
-  if (editorOrigin === void 0) return DEFAULT_CMSSY_EDITOR_ORIGIN;
-  if (Array.isArray(editorOrigin)) {
-    const cleaned = editorOrigin.filter((o) => o && o.trim().length > 0);
-    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGIN;
+  const value = editorOrigin ?? (typeof process !== "undefined" ? parseEditorOriginEnv(process.env.CMSSY_EDITOR_ORIGIN) : void 0);
+  if (value === void 0) {
+    return isDevelopment() ? "*" : DEFAULT_CMSSY_EDITOR_ORIGINS;
+  }
+  if (Array.isArray(value)) {
+    const cleaned = value.filter((o) => o && o.trim().length > 0);
+    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGINS;
   }
-  return editorOrigin.trim().length > 0 ? editorOrigin : DEFAULT_CMSSY_EDITOR_ORIGIN;
+  return value.trim().length > 0 ? value : DEFAULT_CMSSY_EDITOR_ORIGINS;
 }
 function assertAuthConfig(config) {
   const auth = config.auth;
@@ -286,9 +301,9 @@ function resolveBridgeOrigin(editorOrigin) {
     );
   }
   const origin = toCspOrigin(origins[0].trim());
-  if (origin === "*") {
+  if (origin === "*" && !isDevelopment()) {
     throw new Error(
-      "cmssy: editorOrigin '*' is not allowed for the live-edit bridge; set the concrete editor origin (e.g. https://www.cmssy.io)"
+      "cmssy: editorOrigin '*' is only allowed in development; set a concrete editor origin (e.g. https://cmssy.io) for production"
     );
   }
   return origin;
@@ -1631,7 +1646,7 @@ exports.CMSSY_EDIT_HEADER = CMSSY_EDIT_HEADER;
 exports.CMSSY_LOCALE_HEADER = CMSSY_LOCALE_HEADER;
 exports.CMSSY_SESSION_COOKIE = CMSSY_SESSION_COOKIE;
 exports.CmssyWebhookError = CmssyWebhookError;
-exports.DEFAULT_CMSSY_EDITOR_ORIGIN = DEFAULT_CMSSY_EDITOR_ORIGIN;
+exports.DEFAULT_CMSSY_EDITOR_ORIGINS = DEFAULT_CMSSY_EDITOR_ORIGINS;
 exports.SESSION_MAX_AGE_SECONDS = SESSION_MAX_AGE_SECONDS;
 exports.applyCmssyCsp = applyCmssyCsp;
 exports.assertAuthConfig = assertAuthConfig;

package/dist/index.d.cts

@@ -6,13 +6,7 @@ import { EditBridgeConfig } from '@cmssy/react/client';
 import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
 
-/**
- * Origin of the cmssy admin/editor that frames your site (postMessage source +
- * CSP `frame-ancestors`). Identical for every workspace on cmssy cloud, so
- * `editorOrigin` defaults to this. Self-hosted admins override it via config.
- */
-declare const DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
-/** Resolves `editorOrigin`, falling back to the cmssy cloud admin when unset. */
+declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
 interface CmssyAuthConfig {
     modelSlug: string;
@@ -28,7 +22,7 @@ interface CmssyNextConfig {
     draftSecret: string;
     /**
      * Origin allowed to frame your app in the editor. Defaults to
-     * {@link DEFAULT_CMSSY_EDITOR_ORIGIN}; set it only for self-hosted admins.
+     * {@link DEFAULT_CMSSY_EDITOR_ORIGINS}; set it only for self-hosted admins.
      */
     editorOrigin?: string | string[];
     /**
@@ -346,4 +340,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGIN, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.d.ts

@@ -6,13 +6,7 @@ import { EditBridgeConfig } from '@cmssy/react/client';
 import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
 
-/**
- * Origin of the cmssy admin/editor that frames your site (postMessage source +
- * CSP `frame-ancestors`). Identical for every workspace on cmssy cloud, so
- * `editorOrigin` defaults to this. Self-hosted admins override it via config.
- */
-declare const DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
-/** Resolves `editorOrigin`, falling back to the cmssy cloud admin when unset. */
+declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
 interface CmssyAuthConfig {
     modelSlug: string;
@@ -28,7 +22,7 @@ interface CmssyNextConfig {
     draftSecret: string;
     /**
      * Origin allowed to frame your app in the editor. Defaults to
-     * {@link DEFAULT_CMSSY_EDITOR_ORIGIN}; set it only for self-hosted admins.
+     * {@link DEFAULT_CMSSY_EDITOR_ORIGINS}; set it only for self-hosted admins.
      */
     editorOrigin?: string | string[];
     /**
@@ -346,4 +340,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGIN, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthConfig, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyNextConfig, type CmssyOrdersRouteHandlers, type CmssySessionPayload, type CmssySessionUser, CmssyWebhookError, type CmssyWebhookEvent, type CmssyWebhookOrder, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, type FetchProductOptions, type FetchProductsOptions, type MyOrdersResult, SESSION_MAX_AGE_SECONDS, type SessionCookieOptions, type VerifyCmssyWebhookOptions, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.js

@@ -70,14 +70,29 @@ function sessionCookieOptions() {
 }
 
 // src/config.ts
-var DEFAULT_CMSSY_EDITOR_ORIGIN = "https://www.cmssy.io";
+var DEFAULT_CMSSY_EDITOR_ORIGINS = [
+  "https://cmssy.io",
+  "https://www.cmssy.io"
+];
+function parseEditorOriginEnv(raw) {
+  if (!raw) return void 0;
+  const parts = raw.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+  if (parts.length === 0) return void 0;
+  return parts.length === 1 ? parts[0] : parts;
+}
+function isDevelopment() {
+  return typeof process !== "undefined" && process.env.NODE_ENV === "development";
+}
 function resolveEditorOrigin(editorOrigin) {
-  if (editorOrigin === void 0) return DEFAULT_CMSSY_EDITOR_ORIGIN;
-  if (Array.isArray(editorOrigin)) {
-    const cleaned = editorOrigin.filter((o) => o && o.trim().length > 0);
-    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGIN;
+  const value = editorOrigin ?? (typeof process !== "undefined" ? parseEditorOriginEnv(process.env.CMSSY_EDITOR_ORIGIN) : void 0);
+  if (value === void 0) {
+    return isDevelopment() ? "*" : DEFAULT_CMSSY_EDITOR_ORIGINS;
+  }
+  if (Array.isArray(value)) {
+    const cleaned = value.filter((o) => o && o.trim().length > 0);
+    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGINS;
   }
-  return editorOrigin.trim().length > 0 ? editorOrigin : DEFAULT_CMSSY_EDITOR_ORIGIN;
+  return value.trim().length > 0 ? value : DEFAULT_CMSSY_EDITOR_ORIGINS;
 }
 function assertAuthConfig(config) {
   const auth = config.auth;
@@ -285,9 +300,9 @@ function resolveBridgeOrigin(editorOrigin) {
     );
   }
   const origin = toCspOrigin(origins[0].trim());
-  if (origin === "*") {
+  if (origin === "*" && !isDevelopment()) {
     throw new Error(
-      "cmssy: editorOrigin '*' is not allowed for the live-edit bridge; set the concrete editor origin (e.g. https://www.cmssy.io)"
+      "cmssy: editorOrigin '*' is only allowed in development; set a concrete editor origin (e.g. https://cmssy.io) for production"
     );
   }
   return origin;
@@ -1617,4 +1632,4 @@ function verifyCmssyWebhook(options) {
   return parsed;
 }
 
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGIN, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/next",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "Next.js App Router bindings for cmssy headless sites (createCmssyPage + draft preview)",
   "keywords": [
     "cmssy",
@@ -54,7 +54,7 @@
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@cmssy/react": "0.5.6"
+    "@cmssy/react": "0.6.0"
   },
   "dependencies": {
     "jose": "^6.2.3"