@cmssy/next 2.7.0 → 4.0.0

package/dist/index.cjs

@@ -6,8 +6,8 @@ var react = require('@cmssy/react');
 var client = require('@cmssy/react/client');
 var jose = require('jose');
 var jsxRuntime = require('react/jsx-runtime');
-var crypto$1 = require('crypto');
 var server = require('next/server');
+var crypto$1 = require('crypto');
 
 // src/create-cmssy-page.tsx
 var CMSSY_SESSION_COOKIE = "cmssy_session";
@@ -204,11 +204,63 @@ function applyCmssyCsp(response, options) {
   response.headers.delete("X-Frame-Options");
   return response;
 }
-var EDIT_QUERY_PARAM = "cmssyEdit";
+
+// src/secret-match.ts
+var MAX_SECRET_LENGTH = 256;
+async function cmssySecretsMatch(a, b) {
+  if (a.length > MAX_SECRET_LENGTH || b.length > MAX_SECRET_LENGTH) {
+    return false;
+  }
+  const encoder = new TextEncoder();
+  const [ha, hb] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder.encode(a)),
+    crypto.subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  const va = new Uint8Array(ha);
+  const vb = new Uint8Array(hb);
+  let diff = 0;
+  for (let i = 0; i < va.length; i += 1) {
+    diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/edit-mode.ts
+var CMSSY_EDIT_HEADER = "x-cmssy-edit";
+var CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+var CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
+async function isCmssyEditRequest(request2, config) {
+  if (request2.cookies.has("__prerender_bypass")) return true;
+  if (!request2.nextUrl.searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) {
+    return false;
+  }
+  const provided = request2.nextUrl.searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return false;
+  return cmssySecretsMatch(provided, config.draftSecret);
+}
+async function isCmssyEditMode() {
+  const h = await headers.headers();
+  return h.get(CMSSY_EDIT_HEADER) === "1";
+}
 function hasEditFlag(value) {
   return Array.isArray(value) ? value.includes("1") : value === "1";
 }
+function firstValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+async function resolveEditorRequest(query, draftSecret) {
+  if (!hasEditFlag(query[CMSSY_EDIT_QUERY_PARAM])) return false;
+  const provided = firstValue(query[CMSSY_SECRET_QUERY_PARAM]);
+  if (!provided || !draftSecret) return false;
+  return cmssySecretsMatch(provided, draftSecret);
+}
 function createCmssyPage(config, blocks, options) {
+  return buildCmssyPageRenderer(config, blocks, options, false);
+}
+function createCmssyEditPage(config, blocks, options) {
+  return buildCmssyPageRenderer(config, blocks, options, true);
+}
+function buildCmssyPageRenderer(config, blocks, options, editRoute) {
   if (!Array.isArray(blocks)) {
     throw new Error(
       "cmssy: createCmssyPage(config, blocks) requires a blocks array \u2014 pass your defineBlock(...) array"
@@ -228,10 +280,16 @@ function createCmssyPage(config, blocks, options) {
   }) {
     const path = fixedPath ?? (params ? (await params).path ?? void 0 : void 0);
     const { isEnabled } = await headers.draftMode();
-    const query = searchParams ? await searchParams : {};
-    const editMode = isEnabled || hasEditFlag(query[EDIT_QUERY_PARAM]);
+    let editorActive = false;
+    if (editRoute) {
+      const query = searchParams ? await searchParams : {};
+      editorActive = await resolveEditorRequest(query, config.draftSecret);
+      if (!editorActive) {
+        navigation.notFound();
+      }
+    }
+    const editMode = isEnabled || editorActive;
     const devAllowed = isDevelopment() && Boolean(config.devToken?.trim());
-    const editorActive = editMode;
     let locale;
     let pagePath = path;
     let defaultLocale;
@@ -340,6 +398,23 @@ function resolveBridgeOrigin(editorOrigin) {
   }
   return origins.length === 1 ? origins[0] : origins;
 }
+var CMSSY_EDIT_PATH_PREFIX = "/__cmssy/edit";
+async function cmssyEditRewrite(request2, config) {
+  const { pathname, searchParams } = request2.nextUrl;
+  if (pathname.startsWith(CMSSY_EDIT_PATH_PREFIX)) return null;
+  if (!searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) return null;
+  const provided = searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return null;
+  if (!await cmssySecretsMatch(provided, config.draftSecret)) return null;
+  const url = request2.nextUrl.clone();
+  url.pathname = `${CMSSY_EDIT_PATH_PREFIX}${pathname === "/" ? "" : pathname}`;
+  return server.NextResponse.rewrite(url);
+}
+function createCmssyEditMiddleware(config) {
+  return async function cmssyEditMiddleware(request2) {
+    return await cmssyEditRewrite(request2, config) ?? server.NextResponse.next();
+  };
+}
 function DefaultNotFound() {
   return /* @__PURE__ */ jsxRuntime.jsxs(
     "main",
@@ -595,11 +670,6 @@ async function buildCmssyMetadata(config, path, options = {}) {
   };
 }
 var MIN_SECRET_LENGTH = 16;
-function secretsMatch(a, b) {
-  const ha = crypto$1.createHash("sha256").update(a).digest();
-  const hb = crypto$1.createHash("sha256").update(b).digest();
-  return crypto$1.timingSafeEqual(ha, hb);
-}
 function safeRedirect(redirect2, fallback) {
   if (!redirect2 || !redirect2.startsWith("/")) return fallback;
   if (redirect2.startsWith("//") || redirect2.includes("\\")) return fallback;
@@ -620,15 +690,22 @@ function createDraftRoute(config) {
     );
   }
   return async function GET(request2) {
+    const url = new URL(request2.url);
+    if (url.searchParams.get("disable") === "1") {
+      const draft2 = await headers.draftMode();
+      draft2.disable();
+      navigation.redirect(
+        safeRedirect(url.searchParams.get("redirect"), fallbackRedirect)
+      );
+    }
     if (config.draftSecret.length < MIN_SECRET_LENGTH) {
       return new Response(
         `cmssy: draftSecret must be at least ${MIN_SECRET_LENGTH} characters`,
         { status: 500 }
       );
     }
-    const url = new URL(request2.url);
     const secret = url.searchParams.get("secret");
-    if (!secret || !secretsMatch(secret, config.draftSecret)) {
+    if (!secret || !await cmssySecretsMatch(secret, config.draftSecret)) {
       return new Response("Invalid draft secret", { status: 401 });
     }
     const location = safeRedirect(
@@ -640,14 +717,6 @@ function createDraftRoute(config) {
     navigation.redirect(location);
   };
 }
-var CMSSY_EDIT_HEADER = "x-cmssy-edit";
-function isCmssyEditRequest(request2) {
-  return request2.cookies.has("__prerender_bypass") || request2.nextUrl.searchParams.getAll("cmssyEdit").includes("1");
-}
-async function isCmssyEditMode() {
-  const h = await headers.headers();
-  return h.get(CMSSY_EDIT_HEADER) === "1";
-}
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 async function localeForPathname(config, pathname) {
   const siteLocales = await react.resolveSiteLocales(config);
@@ -658,7 +727,12 @@ async function splitCmssyLocale(config, path) {
   const siteLocales = await react.resolveSiteLocales(config);
   return react.splitLocaleFromPath(path, siteLocales);
 }
-async function getCmssyLocale(config) {
+async function getCmssyLocale(config, options) {
+  if (options?.path !== void 0) {
+    const siteLocales = await react.resolveSiteLocales(config);
+    const segments = Array.isArray(options.path) ? options.path.filter(Boolean) : options.path.split("/").filter(Boolean);
+    return react.splitLocaleFromPath(segments, siteLocales).locale;
+  }
   const { headers: headers3 } = await import('next/headers');
   const headerList = await headers3();
   const fromHeader = headerList.get(CMSSY_LOCALE_HEADER);
@@ -1918,7 +1992,10 @@ Object.defineProperty(exports, "resolveApiUrl", {
 });
 exports.CMSSY_CART_COOKIE = CMSSY_CART_COOKIE;
 exports.CMSSY_EDIT_HEADER = CMSSY_EDIT_HEADER;
+exports.CMSSY_EDIT_PATH_PREFIX = CMSSY_EDIT_PATH_PREFIX;
+exports.CMSSY_EDIT_QUERY_PARAM = CMSSY_EDIT_QUERY_PARAM;
 exports.CMSSY_LOCALE_HEADER = CMSSY_LOCALE_HEADER;
+exports.CMSSY_SECRET_QUERY_PARAM = CMSSY_SECRET_QUERY_PARAM;
 exports.CMSSY_SESSION_COOKIE = CMSSY_SESSION_COOKIE;
 exports.CmssyWebhookError = CmssyWebhookError;
 exports.DEFAULT_CMSSY_EDITOR_ORIGINS = DEFAULT_CMSSY_EDITOR_ORIGINS;
@@ -1927,9 +2004,12 @@ exports.applyCmssyCsp = applyCmssyCsp;
 exports.assertAuthConfig = assertAuthConfig;
 exports.buildCmssyMetadata = buildCmssyMetadata;
 exports.cmssyCspHeaders = cmssyCspHeaders;
+exports.cmssyEditRewrite = cmssyEditRewrite;
 exports.createCmssyAuthMiddleware = createCmssyAuthMiddleware;
 exports.createCmssyAuthRoute = createCmssyAuthRoute;
 exports.createCmssyCartRoute = createCmssyCartRoute;
+exports.createCmssyEditMiddleware = createCmssyEditMiddleware;
+exports.createCmssyEditPage = createCmssyEditPage;
 exports.createCmssyLocaleMiddleware = createCmssyLocaleMiddleware;
 exports.createCmssyNotFound = createCmssyNotFound;
 exports.createCmssyOrdersRoute = createCmssyOrdersRoute;

package/dist/index.d.cts

@@ -5,8 +5,8 @@ export { DEFAULT_CMSSY_API_URL, FieldCondition, FieldConditionGroup, FieldCondit
 import { EditBridgeConfig } from '@cmssy/react/client';
 import { CmssyAuthConfig, CmssySessionPayload, SessionCookieOptions, CmssySessionUser, FetchProductOptions, CmssyProduct, FetchProductsOptions, CmssyProductPage, FetchOrderByTokenOptions, CmssyOrder, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';
 export { CmssyAuthConfig, CmssyProductPage, CmssySessionPayload, CmssySessionUser, CmssyStockState, CmssyWebhookEvent, CmssyWebhookOrder, FetchOrderByTokenOptions, FetchProductOptions, FetchProductsOptions, MyOrdersResult, SessionCookieOptions, VerifyCmssyWebhookOptions } from '@cmssy/types';
-import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
+import { MetadataRoute, Metadata } from 'next';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
@@ -88,7 +88,51 @@ interface CatchAllProps {
     params?: Promise<CatchAllParams>;
     searchParams?: Promise<SearchParams>;
 }
+/**
+ * Public catch-all page. Statically renderable: it never reads
+ * `searchParams` or `headers()` - awaiting either forces every route
+ * dynamic and kills ISR (CMS-952). Draft-mode preview (the authenticated
+ * /api/draft cookie) still works per-request via `draftMode()`, which is
+ * static-safe, and renders draft CONTENT without the editor (CMS-948).
+ * The editor-iframe flow (`?cmssyEdit=1&cmssySecret=...`) is served by
+ * the middleware rewrite (`cmssyEditRewrite`) onto the dynamic edit route
+ * mounted with `createCmssyEditPage`.
+ */
 declare function createCmssyPage(config: CmssyNextConfig, blocks: BlockDefinition[], options?: CreateCmssyPageOptions): ({ params, searchParams, }: CatchAllProps) => Promise<react_jsx_runtime.JSX.Element>;
+/**
+ * Editor page for the middleware-rewritten edit route
+ * (`app/__cmssy/edit/[[...path]]/page.tsx`, `dynamic = "force-dynamic"`).
+ * Re-verifies the `cmssyEdit` + `cmssySecret` pair itself, so a direct hit
+ * on the route path (bypassing the middleware) cannot mount the editor.
+ */
+declare function createCmssyEditPage(config: CmssyNextConfig, blocks: BlockDefinition[], options?: CreateCmssyPageOptions): ({ params, searchParams, }: CatchAllProps) => Promise<react_jsx_runtime.JSX.Element>;
+
+/**
+ * Where the middleware rewrites editor-preview traffic. Mount the matching
+ * dynamic route in the consumer app:
+ *
+ *   app/__cmssy/edit/[[...path]]/page.tsx
+ *     export const dynamic = "force-dynamic";
+ *     export default createCmssyEditPage(cmssy, blocks, { editor: Editor });
+ */
+declare const CMSSY_EDIT_PATH_PREFIX = "/__cmssy/edit";
+/**
+ * Rewrite VERIFIED editor requests (`cmssyEdit=1` + a `cmssySecret` matching
+ * the site's draft secret, CMS-948) onto the dedicated dynamic edit route, so
+ * the public catch-all can stay fully static. A static page never sees its
+ * query string - this rewrite is what makes the editor iframe work at all
+ * once ISR is on. Draft-mode preview (the authenticated /api/draft cookie) is
+ * NOT rewritten: it renders draft content on the public route via
+ * `draftMode()`, without the editor. Returns null for normal traffic so it
+ * composes with other middleware.
+ */
+declare function cmssyEditRewrite(request: NextRequest, config: {
+    draftSecret: string;
+}): Promise<NextResponse | null>;
+/** Standalone middleware when the consumer has no other middleware to compose. */
+declare function createCmssyEditMiddleware(config: {
+    draftSecret: string;
+}): (request: NextRequest) => Promise<NextResponse>;
 
 interface CreateCmssyNotFoundOptions {
     /**
@@ -196,6 +240,8 @@ declare function cmssyCspHeaders(options: CmssyCspOptions): Record<string, strin
 declare function applyCmssyCsp<T extends MutableHeaders>(response: T, options: CmssyCspOptions): T;
 
 declare const CMSSY_EDIT_HEADER = "x-cmssy-edit";
+declare const CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+declare const CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
 interface EditRequestLike {
     cookies: {
         has: (name: string) => boolean;
@@ -203,10 +249,13 @@ interface EditRequestLike {
     nextUrl: {
         searchParams: {
             getAll: (name: string) => string[];
+            get: (name: string) => string | null;
         };
     };
 }
-declare function isCmssyEditRequest(request: EditRequestLike): boolean;
+declare function isCmssyEditRequest(request: EditRequestLike, config: {
+    draftSecret: string;
+}): Promise<boolean>;
 declare function isCmssyEditMode(): Promise<boolean>;
 
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
@@ -215,7 +264,15 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
     locale: string;
     path: string[] | undefined;
 }>;
-declare function getCmssyLocale(config: CmssyClientConfig): Promise<string>;
+/**
+ * Resolve the active locale. Pass `options.path` (route params) wherever
+ * possible - that path is static-safe. The no-argument form falls back to the
+ * `x-cmssy-locale` request header, which reads `headers()` and forces the
+ * calling route into dynamic rendering.
+ */
+declare function getCmssyLocale(config: CmssyClientConfig, options?: {
+    path?: string | string[];
+}): Promise<string>;
 
 /**
  * Resolves the active locale from a pathname's leading segment. Uses the
@@ -299,4 +356,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_EDIT_PATH_PREFIX, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, cmssyEditRewrite, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyEditMiddleware, createCmssyEditPage, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.d.ts

@@ -5,8 +5,8 @@ export { DEFAULT_CMSSY_API_URL, FieldCondition, FieldConditionGroup, FieldCondit
 import { EditBridgeConfig } from '@cmssy/react/client';
 import { CmssyAuthConfig, CmssySessionPayload, SessionCookieOptions, CmssySessionUser, FetchProductOptions, CmssyProduct, FetchProductsOptions, CmssyProductPage, FetchOrderByTokenOptions, CmssyOrder, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';
 export { CmssyAuthConfig, CmssyProductPage, CmssySessionPayload, CmssySessionUser, CmssyStockState, CmssyWebhookEvent, CmssyWebhookOrder, FetchOrderByTokenOptions, FetchProductOptions, FetchProductsOptions, MyOrdersResult, SessionCookieOptions, VerifyCmssyWebhookOptions } from '@cmssy/types';
-import { MetadataRoute, Metadata } from 'next';
 import { NextRequest, NextResponse } from 'next/server';
+import { MetadataRoute, Metadata } from 'next';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
@@ -88,7 +88,51 @@ interface CatchAllProps {
     params?: Promise<CatchAllParams>;
     searchParams?: Promise<SearchParams>;
 }
+/**
+ * Public catch-all page. Statically renderable: it never reads
+ * `searchParams` or `headers()` - awaiting either forces every route
+ * dynamic and kills ISR (CMS-952). Draft-mode preview (the authenticated
+ * /api/draft cookie) still works per-request via `draftMode()`, which is
+ * static-safe, and renders draft CONTENT without the editor (CMS-948).
+ * The editor-iframe flow (`?cmssyEdit=1&cmssySecret=...`) is served by
+ * the middleware rewrite (`cmssyEditRewrite`) onto the dynamic edit route
+ * mounted with `createCmssyEditPage`.
+ */
 declare function createCmssyPage(config: CmssyNextConfig, blocks: BlockDefinition[], options?: CreateCmssyPageOptions): ({ params, searchParams, }: CatchAllProps) => Promise<react_jsx_runtime.JSX.Element>;
+/**
+ * Editor page for the middleware-rewritten edit route
+ * (`app/__cmssy/edit/[[...path]]/page.tsx`, `dynamic = "force-dynamic"`).
+ * Re-verifies the `cmssyEdit` + `cmssySecret` pair itself, so a direct hit
+ * on the route path (bypassing the middleware) cannot mount the editor.
+ */
+declare function createCmssyEditPage(config: CmssyNextConfig, blocks: BlockDefinition[], options?: CreateCmssyPageOptions): ({ params, searchParams, }: CatchAllProps) => Promise<react_jsx_runtime.JSX.Element>;
+
+/**
+ * Where the middleware rewrites editor-preview traffic. Mount the matching
+ * dynamic route in the consumer app:
+ *
+ *   app/__cmssy/edit/[[...path]]/page.tsx
+ *     export const dynamic = "force-dynamic";
+ *     export default createCmssyEditPage(cmssy, blocks, { editor: Editor });
+ */
+declare const CMSSY_EDIT_PATH_PREFIX = "/__cmssy/edit";
+/**
+ * Rewrite VERIFIED editor requests (`cmssyEdit=1` + a `cmssySecret` matching
+ * the site's draft secret, CMS-948) onto the dedicated dynamic edit route, so
+ * the public catch-all can stay fully static. A static page never sees its
+ * query string - this rewrite is what makes the editor iframe work at all
+ * once ISR is on. Draft-mode preview (the authenticated /api/draft cookie) is
+ * NOT rewritten: it renders draft content on the public route via
+ * `draftMode()`, without the editor. Returns null for normal traffic so it
+ * composes with other middleware.
+ */
+declare function cmssyEditRewrite(request: NextRequest, config: {
+    draftSecret: string;
+}): Promise<NextResponse | null>;
+/** Standalone middleware when the consumer has no other middleware to compose. */
+declare function createCmssyEditMiddleware(config: {
+    draftSecret: string;
+}): (request: NextRequest) => Promise<NextResponse>;
 
 interface CreateCmssyNotFoundOptions {
     /**
@@ -196,6 +240,8 @@ declare function cmssyCspHeaders(options: CmssyCspOptions): Record<string, strin
 declare function applyCmssyCsp<T extends MutableHeaders>(response: T, options: CmssyCspOptions): T;
 
 declare const CMSSY_EDIT_HEADER = "x-cmssy-edit";
+declare const CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+declare const CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
 interface EditRequestLike {
     cookies: {
         has: (name: string) => boolean;
@@ -203,10 +249,13 @@ interface EditRequestLike {
     nextUrl: {
         searchParams: {
             getAll: (name: string) => string[];
+            get: (name: string) => string | null;
         };
     };
 }
-declare function isCmssyEditRequest(request: EditRequestLike): boolean;
+declare function isCmssyEditRequest(request: EditRequestLike, config: {
+    draftSecret: string;
+}): Promise<boolean>;
 declare function isCmssyEditMode(): Promise<boolean>;
 
 declare const CMSSY_LOCALE_HEADER = "x-cmssy-locale";
@@ -215,7 +264,15 @@ declare function splitCmssyLocale(config: CmssyClientConfig, path: string[] | un
     locale: string;
     path: string[] | undefined;
 }>;
-declare function getCmssyLocale(config: CmssyClientConfig): Promise<string>;
+/**
+ * Resolve the active locale. Pass `options.path` (route params) wherever
+ * possible - that path is static-safe. The no-argument form falls back to the
+ * `x-cmssy-locale` request header, which reads `headers()` and forces the
+ * calling route into dynamic rendering.
+ */
+declare function getCmssyLocale(config: CmssyClientConfig, options?: {
+    path?: string | string[];
+}): Promise<string>;
 
 /**
  * Resolves the active locale from a pathname's leading segment. Uses the
@@ -299,4 +356,4 @@ declare class CmssyWebhookError extends Error {
  */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
 
-export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { type BuildCmssyMetadataOptions, CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_EDIT_PATH_PREFIX, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, type CmssyAuthMiddleware, type CmssyAuthRouteHandlers, type CmssyCartRouteHandlers, type CmssyCspOptions, type CmssyDraftRouteConfig, type CmssyEditorProps, type CmssyEnvConfig, type CmssyNextConfig, type CmssyOrdersRouteHandlers, CmssyWebhookError, type CreateCmssyNotFoundOptions, type CreateCmssyPageOptions, type CreateCmssyRobotsOptions, type CreateCmssySitemapOptions, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, cmssyEditRewrite, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyEditMiddleware, createCmssyEditPage, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/dist/index.js

@@ -1,12 +1,12 @@
-import { draftMode, headers, cookies } from 'next/headers';
+import { headers, draftMode, cookies } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
 import { createCmssyClient, resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, fetchSiteConfig, fetchPageById, fetchPages, fetchPageMeta, normalizeSlug as normalizeSlug$1, resolveWorkspaceId, graphqlRequest, resolveApiUrl } from '@cmssy/react';
 export { DEFAULT_CMSSY_API_URL, evaluateFieldConditionGroup, resolveApiUrl } from '@cmssy/react';
 import { CmssyLocaleProvider } from '@cmssy/react/client';
 import { EncryptJWT, jwtDecrypt } from 'jose';
 import { jsx, jsxs } from 'react/jsx-runtime';
-import { createHmac, createHash, timingSafeEqual } from 'crypto';
 import { NextResponse } from 'next/server';
+import { createHmac, timingSafeEqual } from 'crypto';
 
 // src/create-cmssy-page.tsx
 var CMSSY_SESSION_COOKIE = "cmssy_session";
@@ -203,11 +203,63 @@ function applyCmssyCsp(response, options) {
   response.headers.delete("X-Frame-Options");
   return response;
 }
-var EDIT_QUERY_PARAM = "cmssyEdit";
+
+// src/secret-match.ts
+var MAX_SECRET_LENGTH = 256;
+async function cmssySecretsMatch(a, b) {
+  if (a.length > MAX_SECRET_LENGTH || b.length > MAX_SECRET_LENGTH) {
+    return false;
+  }
+  const encoder = new TextEncoder();
+  const [ha, hb] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder.encode(a)),
+    crypto.subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  const va = new Uint8Array(ha);
+  const vb = new Uint8Array(hb);
+  let diff = 0;
+  for (let i = 0; i < va.length; i += 1) {
+    diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/edit-mode.ts
+var CMSSY_EDIT_HEADER = "x-cmssy-edit";
+var CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
+var CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
+async function isCmssyEditRequest(request2, config) {
+  if (request2.cookies.has("__prerender_bypass")) return true;
+  if (!request2.nextUrl.searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) {
+    return false;
+  }
+  const provided = request2.nextUrl.searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return false;
+  return cmssySecretsMatch(provided, config.draftSecret);
+}
+async function isCmssyEditMode() {
+  const h = await headers();
+  return h.get(CMSSY_EDIT_HEADER) === "1";
+}
 function hasEditFlag(value) {
   return Array.isArray(value) ? value.includes("1") : value === "1";
 }
+function firstValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+async function resolveEditorRequest(query, draftSecret) {
+  if (!hasEditFlag(query[CMSSY_EDIT_QUERY_PARAM])) return false;
+  const provided = firstValue(query[CMSSY_SECRET_QUERY_PARAM]);
+  if (!provided || !draftSecret) return false;
+  return cmssySecretsMatch(provided, draftSecret);
+}
 function createCmssyPage(config, blocks, options) {
+  return buildCmssyPageRenderer(config, blocks, options, false);
+}
+function createCmssyEditPage(config, blocks, options) {
+  return buildCmssyPageRenderer(config, blocks, options, true);
+}
+function buildCmssyPageRenderer(config, blocks, options, editRoute) {
   if (!Array.isArray(blocks)) {
     throw new Error(
       "cmssy: createCmssyPage(config, blocks) requires a blocks array \u2014 pass your defineBlock(...) array"
@@ -227,10 +279,16 @@ function createCmssyPage(config, blocks, options) {
   }) {
     const path = fixedPath ?? (params ? (await params).path ?? void 0 : void 0);
     const { isEnabled } = await draftMode();
-    const query = searchParams ? await searchParams : {};
-    const editMode = isEnabled || hasEditFlag(query[EDIT_QUERY_PARAM]);
+    let editorActive = false;
+    if (editRoute) {
+      const query = searchParams ? await searchParams : {};
+      editorActive = await resolveEditorRequest(query, config.draftSecret);
+      if (!editorActive) {
+        notFound();
+      }
+    }
+    const editMode = isEnabled || editorActive;
     const devAllowed = isDevelopment() && Boolean(config.devToken?.trim());
-    const editorActive = editMode;
     let locale;
     let pagePath = path;
     let defaultLocale;
@@ -339,6 +397,23 @@ function resolveBridgeOrigin(editorOrigin) {
   }
   return origins.length === 1 ? origins[0] : origins;
 }
+var CMSSY_EDIT_PATH_PREFIX = "/__cmssy/edit";
+async function cmssyEditRewrite(request2, config) {
+  const { pathname, searchParams } = request2.nextUrl;
+  if (pathname.startsWith(CMSSY_EDIT_PATH_PREFIX)) return null;
+  if (!searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) return null;
+  const provided = searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return null;
+  if (!await cmssySecretsMatch(provided, config.draftSecret)) return null;
+  const url = request2.nextUrl.clone();
+  url.pathname = `${CMSSY_EDIT_PATH_PREFIX}${pathname === "/" ? "" : pathname}`;
+  return NextResponse.rewrite(url);
+}
+function createCmssyEditMiddleware(config) {
+  return async function cmssyEditMiddleware(request2) {
+    return await cmssyEditRewrite(request2, config) ?? NextResponse.next();
+  };
+}
 function DefaultNotFound() {
   return /* @__PURE__ */ jsxs(
     "main",
@@ -594,11 +669,6 @@ async function buildCmssyMetadata(config, path, options = {}) {
   };
 }
 var MIN_SECRET_LENGTH = 16;
-function secretsMatch(a, b) {
-  const ha = createHash("sha256").update(a).digest();
-  const hb = createHash("sha256").update(b).digest();
-  return timingSafeEqual(ha, hb);
-}
 function safeRedirect(redirect2, fallback) {
   if (!redirect2 || !redirect2.startsWith("/")) return fallback;
   if (redirect2.startsWith("//") || redirect2.includes("\\")) return fallback;
@@ -619,15 +689,22 @@ function createDraftRoute(config) {
     );
   }
   return async function GET(request2) {
+    const url = new URL(request2.url);
+    if (url.searchParams.get("disable") === "1") {
+      const draft2 = await draftMode();
+      draft2.disable();
+      redirect(
+        safeRedirect(url.searchParams.get("redirect"), fallbackRedirect)
+      );
+    }
     if (config.draftSecret.length < MIN_SECRET_LENGTH) {
       return new Response(
         `cmssy: draftSecret must be at least ${MIN_SECRET_LENGTH} characters`,
         { status: 500 }
       );
     }
-    const url = new URL(request2.url);
     const secret = url.searchParams.get("secret");
-    if (!secret || !secretsMatch(secret, config.draftSecret)) {
+    if (!secret || !await cmssySecretsMatch(secret, config.draftSecret)) {
       return new Response("Invalid draft secret", { status: 401 });
     }
     const location = safeRedirect(
@@ -639,14 +716,6 @@ function createDraftRoute(config) {
     redirect(location);
   };
 }
-var CMSSY_EDIT_HEADER = "x-cmssy-edit";
-function isCmssyEditRequest(request2) {
-  return request2.cookies.has("__prerender_bypass") || request2.nextUrl.searchParams.getAll("cmssyEdit").includes("1");
-}
-async function isCmssyEditMode() {
-  const h = await headers();
-  return h.get(CMSSY_EDIT_HEADER) === "1";
-}
 var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
 async function localeForPathname(config, pathname) {
   const siteLocales = await resolveSiteLocales(config);
@@ -657,7 +726,12 @@ async function splitCmssyLocale(config, path) {
   const siteLocales = await resolveSiteLocales(config);
   return splitLocaleFromPath(path, siteLocales);
 }
-async function getCmssyLocale(config) {
+async function getCmssyLocale(config, options) {
+  if (options?.path !== void 0) {
+    const siteLocales = await resolveSiteLocales(config);
+    const segments = Array.isArray(options.path) ? options.path.filter(Boolean) : options.path.split("/").filter(Boolean);
+    return splitLocaleFromPath(segments, siteLocales).locale;
+  }
   const { headers: headers3 } = await import('next/headers');
   const headerList = await headers3();
   const fromHeader = headerList.get(CMSSY_LOCALE_HEADER);
@@ -1903,4 +1977,4 @@ function verifyCmssyWebhook(options) {
   return parsed;
 }
 
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_EDIT_PATH_PREFIX, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, cmssyEditRewrite, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyEditMiddleware, createCmssyEditPage, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/next",
-  "version": "2.7.0",
+  "version": "4.0.0",
   "description": "Next.js App Router bindings for cmssy headless sites (createCmssyPage + draft preview)",
   "keywords": [
     "cmssy",
@@ -41,7 +41,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@cmssy/react": "^2.1.0",
+    "@cmssy/react": "^4.0.0",
     "next": ">=15",
     "react": "^18.2.0 || ^19.0.0",
     "react-dom": "^18.2.0 || ^19.0.0"
@@ -55,7 +55,7 @@
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@cmssy/react": "2.7.0"
+    "@cmssy/react": "4.0.0"
   },
   "dependencies": {
     "jose": "^6.2.3",