@cmssy/next 2.7.0 → 3.0.0

package/dist/index.cjs

@@ -6,8 +6,8 @@ var react = require('@cmssy/react');
 var client = require('@cmssy/react/client');
 var jose = require('jose');
 var jsxRuntime = require('react/jsx-runtime');
-var crypto$1 = require('crypto');
 var server = require('next/server');
+var crypto$1 = require('crypto');
 
 // src/create-cmssy-page.tsx
 var CMSSY_SESSION_COOKIE = "cmssy_session";
@@ -204,10 +204,56 @@ function applyCmssyCsp(response, options) {
   response.headers.delete("X-Frame-Options");
   return response;
 }
-var EDIT_QUERY_PARAM = "cmssyEdit";
+
+// src/secret-match.ts
+var MAX_SECRET_LENGTH = 256;
+async function cmssySecretsMatch(a, b) {
+  if (a.length > MAX_SECRET_LENGTH || b.length > MAX_SECRET_LENGTH) {
+    return false;
+  }
+  const encoder = new TextEncoder();
+  const [ha, hb] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder.encode(a)),
+    crypto.subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  const va = new Uint8Array(ha);
+  const vb = new Uint8Array(hb);
+  let diff = 0;
+  for (let i = 0; i < va.length; i += 1) {
+    diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/edit-mode.ts
+var CMSSY_EDIT_HEADER = "x-cmssy-edit";
+var CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+var CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
+async function isCmssyEditRequest(request2, config) {
+  if (request2.cookies.has("__prerender_bypass")) return true;
+  if (!request2.nextUrl.searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) {
+    return false;
+  }
+  const provided = request2.nextUrl.searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return false;
+  return cmssySecretsMatch(provided, config.draftSecret);
+}
+async function isCmssyEditMode() {
+  const h = await headers.headers();
+  return h.get(CMSSY_EDIT_HEADER) === "1";
+}
 function hasEditFlag(value) {
   return Array.isArray(value) ? value.includes("1") : value === "1";
 }
+function firstValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+async function resolveEditorRequest(query, draftSecret) {
+  if (!hasEditFlag(query[CMSSY_EDIT_QUERY_PARAM])) return false;
+  const provided = firstValue(query[CMSSY_SECRET_QUERY_PARAM]);
+  if (!provided || !draftSecret) return false;
+  return cmssySecretsMatch(provided, draftSecret);
+}
 function createCmssyPage(config, blocks, options) {
   if (!Array.isArray(blocks)) {
     throw new Error(
@@ -229,9 +275,9 @@ function createCmssyPage(config, blocks, options) {
     const path = fixedPath ?? (params ? (await params).path ?? void 0 : void 0);
     const { isEnabled } = await headers.draftMode();
     const query = searchParams ? await searchParams : {};
-    const editMode = isEnabled || hasEditFlag(query[EDIT_QUERY_PARAM]);
+    const editorActive = await resolveEditorRequest(query, config.draftSecret);
+    const editMode = isEnabled || editorActive;
     const devAllowed = isDevelopment() && Boolean(config.devToken?.trim());
-    const editorActive = editMode;
     let locale;
     let pagePath = path;
     let defaultLocale;
@@ -595,11 +641,6 @@ async function buildCmssyMetadata(config, path, options = {}) {
   };
 }
 var MIN_SECRET_LENGTH = 16;
-function secretsMatch(a, b) {
-  const ha = crypto$1.createHash("sha256").update(a).digest();
-  const hb = crypto$1.createHash("sha256").update(b).digest();
-  return crypto$1.timingSafeEqual(ha, hb);
-}
 function safeRedirect(redirect2, fallback) {
   if (!redirect2 || !redirect2.startsWith("/")) return fallback;
   if (redirect2.startsWith("//") || redirect2.includes("\\")) return fallback;
@@ -620,15 +661,22 @@ function createDraftRoute(config) {
     );
   }
   return async function GET(request2) {
+    const url = new URL(request2.url);
+    if (url.searchParams.get("disable") === "1") {
+      const draft2 = await headers.draftMode();
+      draft2.disable();
+      navigation.redirect(
+        safeRedirect(url.searchParams.get("redirect"), fallbackRedirect)
+      );
+    }
     if (config.draftSecret.length < MIN_SECRET_LENGTH) {
       return new Response(
         `cmssy: draftSecret must be at least ${MIN_SECRET_LENGTH} characters`,
         { status: 500 }
       );
     }
-    const url = new URL(request2.url);
     const secret = url.searchParams.get("secret");
-    if (!secret || !secretsMatch(secret, config.draftSecret)) {
+    if (!secret || !await cmssySecretsMatch(secret, config.draftSecret)) {
       return new Response("Invalid draft secret", { status: 401 });
     }
     const location = safeRedirect(
@@ -640,14 +688,6 @@ function createDraftRoute(config) {
     navigation.redirect(location);
   };
 }
-var CMSSY_EDIT_HEADER = "x-cmssy-edit";
-function isCmssyEditRequest(request2) {
-  return request2.cookies.has("__prerender_bypass") || request2.nextUrl.searchParams.getAll("cmssyEdit").includes("1");
-}
-async function isCmssyEditMode() {
-  const h = await headers.headers();
-  return h.get(CMSSY_EDIT_HEADER) === "1";
-}
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 async function localeForPathname(config, pathname) {
   const siteLocales = await react.resolveSiteLocales(config);
@@ -1918,7 +1958,9 @@ Object.defineProperty(exports, "resolveApiUrl", {
 });
 exports.CMSSY_CART_COOKIE = CMSSY_CART_COOKIE;
 exports.CMSSY_EDIT_HEADER = CMSSY_EDIT_HEADER;
+exports.CMSSY_EDIT_QUERY_PARAM = CMSSY_EDIT_QUERY_PARAM;
 exports.CMSSY_LOCALE_HEADER = CMSSY_LOCALE_HEADER;
+exports.CMSSY_SECRET_QUERY_PARAM = CMSSY_SECRET_QUERY_PARAM;
 exports.CMSSY_SESSION_COOKIE = CMSSY_SESSION_COOKIE;
 exports.CmssyWebhookError = CmssyWebhookError;
 exports.DEFAULT_CMSSY_EDITOR_ORIGINS = DEFAULT_CMSSY_EDITOR_ORIGINS;

package/dist/index.d.cts

@@ -196,6 +196,8 @@ declare function cmssyCspHeaders(options: CmssyCspOptions): Record<string, strin
 declare function applyCmssyCsp<T extends MutableHeaders>(response: T, options: CmssyCspOptions): T;
 
 declare const CMSSY_EDIT_HEADER = "x-cmssy-edit";
+declare const CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+declare const CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
 interface EditRequestLike {
     cookies: {
         has: (name: string) => boolean;
@@ -203,10 +205,13 @@ interface EditRequestLike {
     nextUrl: {
         searchParams: {
             getAll: (name: string) => string[];
+            get: (name: string) => string | null;
         };
     };
 }
-declare function isCmssyEditRequest(request: EditRequestLike): boolean;
+declare function isCmssyEditRequest(request: EditRequestLike, config: {
+    draftSecret: string;
+}): Promise<boolean>;
 declare function isCmssyEditMode(): Promise<boolean>;
 
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
@@ -299,4 +304,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.d.ts

@@ -196,6 +196,8 @@ declare function cmssyCspHeaders(options: CmssyCspOptions): Record<string, strin
 declare function applyCmssyCsp<T extends MutableHeaders>(response: T, options: CmssyCspOptions): T;
 
 declare const CMSSY_EDIT_HEADER = "x-cmssy-edit";
+declare const CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+declare const CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
 interface EditRequestLike {
     cookies: {
         has: (name: string) => boolean;
@@ -203,10 +205,13 @@ interface EditRequestLike {
     nextUrl: {
         searchParams: {
             getAll: (name: string) => string[];
+            get: (name: string) => string | null;
         };
     };
 }
-declare function isCmssyEditRequest(request: EditRequestLike): boolean;
+declare function isCmssyEditRequest(request: EditRequestLike, config: {
+    draftSecret: string;
+}): Promise<boolean>;
 declare function isCmssyEditMode(): Promise<boolean>;
 
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
@@ -299,4 +304,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.js

@@ -1,12 +1,12 @@
-import { draftMode, headers, cookies } from 'next/headers';
+import { headers, draftMode, cookies } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
 import { createCmssyClient, resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, fetchSiteConfig, fetchPageById, fetchPages, fetchPageMeta, normalizeSlug as normalizeSlug$1, resolveWorkspaceId, graphqlRequest, resolveApiUrl } from '@cmssy/react';
 export { DEFAULT_CMSSY_API_URL, evaluateFieldConditionGroup, resolveApiUrl } from '@cmssy/react';
 import { CmssyLocaleProvider } from '@cmssy/react/client';
 import { EncryptJWT, jwtDecrypt } from 'jose';
 import { jsx, jsxs } from 'react/jsx-runtime';
-import { createHmac, createHash, timingSafeEqual } from 'crypto';
 import { NextResponse } from 'next/server';
+import { createHmac, timingSafeEqual } from 'crypto';
 
 // src/create-cmssy-page.tsx
 var CMSSY_SESSION_COOKIE = "cmssy_session";
@@ -203,10 +203,56 @@ function applyCmssyCsp(response, options) {
   response.headers.delete("X-Frame-Options");
   return response;
 }
-var EDIT_QUERY_PARAM = "cmssyEdit";
+
+// src/secret-match.ts
+var MAX_SECRET_LENGTH = 256;
+async function cmssySecretsMatch(a, b) {
+  if (a.length > MAX_SECRET_LENGTH || b.length > MAX_SECRET_LENGTH) {
+    return false;
+  }
+  const encoder = new TextEncoder();
+  const [ha, hb] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder.encode(a)),
+    crypto.subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  const va = new Uint8Array(ha);
+  const vb = new Uint8Array(hb);
+  let diff = 0;
+  for (let i = 0; i < va.length; i += 1) {
+    diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/edit-mode.ts
+var CMSSY_EDIT_HEADER = "x-cmssy-edit";
+var CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+var CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
+async function isCmssyEditRequest(request2, config) {
+  if (request2.cookies.has("__prerender_bypass")) return true;
+  if (!request2.nextUrl.searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) {
+    return false;
+  }
+  const provided = request2.nextUrl.searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return false;
+  return cmssySecretsMatch(provided, config.draftSecret);
+}
+async function isCmssyEditMode() {
+  const h = await headers();
+  return h.get(CMSSY_EDIT_HEADER) === "1";
+}
 function hasEditFlag(value) {
   return Array.isArray(value) ? value.includes("1") : value === "1";
 }
+function firstValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+async function resolveEditorRequest(query, draftSecret) {
+  if (!hasEditFlag(query[CMSSY_EDIT_QUERY_PARAM])) return false;
+  const provided = firstValue(query[CMSSY_SECRET_QUERY_PARAM]);
+  if (!provided || !draftSecret) return false;
+  return cmssySecretsMatch(provided, draftSecret);
+}
 function createCmssyPage(config, blocks, options) {
   if (!Array.isArray(blocks)) {
     throw new Error(
@@ -228,9 +274,9 @@ function createCmssyPage(config, blocks, options) {
     const path = fixedPath ?? (params ? (await params).path ?? void 0 : void 0);
     const { isEnabled } = await draftMode();
     const query = searchParams ? await searchParams : {};
-    const editMode = isEnabled || hasEditFlag(query[EDIT_QUERY_PARAM]);
+    const editorActive = await resolveEditorRequest(query, config.draftSecret);
+    const editMode = isEnabled || editorActive;
     const devAllowed = isDevelopment() && Boolean(config.devToken?.trim());
-    const editorActive = editMode;
     let locale;
     let pagePath = path;
     let defaultLocale;
@@ -594,11 +640,6 @@ async function buildCmssyMetadata(config, path, options = {}) {
   };
 }
 var MIN_SECRET_LENGTH = 16;
-function secretsMatch(a, b) {
-  const ha = createHash("sha256").update(a).digest();
-  const hb = createHash("sha256").update(b).digest();
-  return timingSafeEqual(ha, hb);
-}
 function safeRedirect(redirect2, fallback) {
   if (!redirect2 || !redirect2.startsWith("/")) return fallback;
   if (redirect2.startsWith("//") || redirect2.includes("\\")) return fallback;
@@ -619,15 +660,22 @@ function createDraftRoute(config) {
     );
   }
   return async function GET(request2) {
+    const url = new URL(request2.url);
+    if (url.searchParams.get("disable") === "1") {
+      const draft2 = await draftMode();
+      draft2.disable();
+      redirect(
+        safeRedirect(url.searchParams.get("redirect"), fallbackRedirect)
+      );
+    }
     if (config.draftSecret.length < MIN_SECRET_LENGTH) {
       return new Response(
         `cmssy: draftSecret must be at least ${MIN_SECRET_LENGTH} characters`,
         { status: 500 }
       );
     }
-    const url = new URL(request2.url);
     const secret = url.searchParams.get("secret");
-    if (!secret || !secretsMatch(secret, config.draftSecret)) {
+    if (!secret || !await cmssySecretsMatch(secret, config.draftSecret)) {
       return new Response("Invalid draft secret", { status: 401 });
     }
     const location = safeRedirect(
@@ -639,14 +687,6 @@ function createDraftRoute(config) {
     redirect(location);
   };
 }
-var CMSSY_EDIT_HEADER = "x-cmssy-edit";
-function isCmssyEditRequest(request2) {
-  return request2.cookies.has("__prerender_bypass") || request2.nextUrl.searchParams.getAll("cmssyEdit").includes("1");
-}
-async function isCmssyEditMode() {
-  const h = await headers();
-  return h.get(CMSSY_EDIT_HEADER) === "1";
-}
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 async function localeForPathname(config, pathname) {
   const siteLocales = await resolveSiteLocales(config);
@@ -1903,4 +1943,4 @@ function verifyCmssyWebhook(options) {
   return parsed;
 }
 
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/next",
-  "version": "2.7.0",
+  "version": "3.0.0",
   "description": "Next.js App Router bindings for cmssy headless sites (createCmssyPage + draft preview)",
   "keywords": [
     "cmssy",
@@ -41,7 +41,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@cmssy/react": "^2.1.0",
+    "@cmssy/react": "^3.0.0",
     "next": ">=15",
     "react": "^18.2.0 || ^19.0.0",
     "react-dom": "^18.2.0 || ^19.0.0"
@@ -55,7 +55,7 @@
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@cmssy/react": "2.7.0"
+    "@cmssy/react": "3.0.0"
   },
   "dependencies": {
     "jose": "^6.2.3",