@cmssy/next 4.7.1 → 5.0.0

package/dist/middleware.cjs

@@ -0,0 +1,185 @@
+'use strict';
+
+var server = require('next/server');
+var react = require('@cmssy/react');
+var core = require('@cmssy/core');
+
+// src/preset/proxy.ts
+var CMSSY_EDIT_PATH_PREFIX = "/cmssy-edit";
+async function cmssyEditRewrite(request, config, options = {}) {
+  const { pathname, searchParams } = request.nextUrl;
+  if (pathname.startsWith(CMSSY_EDIT_PATH_PREFIX)) return null;
+  if (!searchParams.getAll(core.CMSSY_EDIT_QUERY_PARAM).includes("1")) return null;
+  const provided = searchParams.get(core.CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return null;
+  if (!await core.cmssySecretsMatch(provided, config.draftSecret)) return null;
+  const url = request.nextUrl.clone();
+  url.pathname = `${CMSSY_EDIT_PATH_PREFIX}${pathname === "/" ? "" : pathname}`;
+  warnIfEditRouteMissing(url);
+  return server.NextResponse.rewrite(
+    url,
+    options.requestHeaders ? { request: { headers: options.requestHeaders } } : void 0
+  );
+}
+function createCmssyEditMiddleware(config) {
+  return async function cmssyEditMiddleware(request) {
+    return await cmssyEditRewrite(request, config) ?? server.NextResponse.next();
+  };
+}
+var probed = false;
+function warnIfEditRouteMissing(url) {
+  if (process.env.NODE_ENV === "production" || probed) return;
+  probed = true;
+  void fetch(url, { method: "HEAD" }).then((response) => {
+    if (response.status !== 404) return;
+    console.error(
+      `[cmssy] The editor request was rewritten to ${url.pathname}, but nothing is mounted there (404). Add the edit route:
+
+  // app/cmssy-edit/[[...path]]/page.tsx
+  export const dynamic = "force-dynamic";
+  export default createCmssyEditPage(cmssy, blocks, { editor: CmssyEditor });
+
+Until then the editor preview stays blank.`
+    );
+  }).catch(() => {
+  });
+}
+function createCmssyProxy(config, options = {}) {
+  return async function cmssyProxy(request) {
+    const { pathname } = request.nextUrl;
+    const requestHeaders = new Headers(request.headers);
+    requestHeaders.delete(core.CMSSY_EDIT_HEADER);
+    requestHeaders.delete(core.CMSSY_LOCALE_HEADER);
+    const locale = await core.localeForPathname(config, pathname);
+    requestHeaders.set(core.CMSSY_LOCALE_HEADER, locale);
+    const editHeaders = new Headers(requestHeaders);
+    editHeaders.set(core.CMSSY_EDIT_HEADER, "1");
+    const editRewrite = await cmssyEditRewrite(request, config, {
+      requestHeaders: editHeaders
+    });
+    if (editRewrite) {
+      core.applyCmssyCsp(editRewrite, { editorOrigin: config.editorOrigin });
+      return editRewrite;
+    }
+    if (options.stripLocalePrefix && pathname.startsWith(`/${locale}`)) {
+      const { defaultLocale } = await react.resolveSiteLocales(config);
+      if (locale !== defaultLocale) {
+        const url = request.nextUrl.clone();
+        url.pathname = pathname.slice(locale.length + 1) || "/";
+        return server.NextResponse.rewrite(url, {
+          request: { headers: requestHeaders }
+        });
+      }
+    }
+    return server.NextResponse.next({ request: { headers: requestHeaders } });
+  };
+}
+var cmssyProxyMatcher = ["/((?!_next/|api/|.*\\..*).*)"];
+async function resolveLocaleFromPathname(config, pathname) {
+  const segments = pathname.split("/").filter(Boolean);
+  const hasStaticLocales = !!config.enabledLocales?.length;
+  const fetched = config.defaultLocale && hasStaticLocales ? null : await react.resolveSiteLocales({
+    apiUrl: config.apiUrl,
+    org: config.org,
+    workspaceSlug: config.workspaceSlug
+  });
+  const siteLocales = {
+    defaultLocale: config.defaultLocale ?? fetched.defaultLocale,
+    locales: hasStaticLocales ? config.enabledLocales : fetched.locales
+  };
+  return react.splitLocaleFromPath(segments, siteLocales).locale;
+}
+function createCmssyLocaleMiddleware(config) {
+  return async function cmssyLocaleMiddleware(request) {
+    const locale = await resolveLocaleFromPathname(
+      config,
+      request.nextUrl.pathname
+    );
+    const headers = new Headers(request.headers);
+    headers.set(core.CMSSY_LOCALE_HEADER, locale);
+    return server.NextResponse.next({ request: { headers } });
+  };
+}
+function isPrefetch(request) {
+  return request.headers.get("next-router-prefetch") !== null || request.headers.get("purpose") === "prefetch" || (request.headers.get("sec-purpose") ?? "").includes("prefetch");
+}
+function createCmssyAuthMiddleware(config) {
+  const auth = core.assertAuthConfig(config);
+  return async function cmssyAuthMiddleware(request) {
+    const raw = request.cookies.get(core.CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return server.NextResponse.next();
+    const session = await core.openSession(
+      raw,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session) {
+      const response = server.NextResponse.next();
+      response.cookies.set(core.CMSSY_SESSION_COOKIE, "", {
+        ...core.sessionCookieOptions(),
+        maxAge: 0
+      });
+      return response;
+    }
+    if (!core.isAccessExpired(session)) return server.NextResponse.next();
+    if (isPrefetch(request)) return server.NextResponse.next();
+    let payload = null;
+    try {
+      const result = await core.backendRefresh(config, session.refreshToken);
+      payload = core.toSessionPayload(result);
+    } catch {
+      return server.NextResponse.next();
+    }
+    if (!payload) {
+      const cleared = server.NextResponse.next();
+      cleared.cookies.set(core.CMSSY_SESSION_COOKIE, "", {
+        ...core.sessionCookieOptions(),
+        maxAge: 0
+      });
+      return cleared;
+    }
+    const sealed = await core.sealSession(
+      payload,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    request.cookies.set(core.CMSSY_SESSION_COOKIE, sealed);
+    const refreshed = server.NextResponse.next({ request });
+    refreshed.cookies.set(core.CMSSY_SESSION_COOKIE, sealed, core.sessionCookieOptions());
+    return refreshed;
+  };
+}
+async function isCmssyEditRequest(request, config) {
+  if (request.cookies.has("__prerender_bypass")) return true;
+  return core.isVerifiedEditUrl(request.nextUrl, config);
+}
+
+Object.defineProperty(exports, "CMSSY_EDIT_HEADER", {
+  enumerable: true,
+  get: function () { return core.CMSSY_EDIT_HEADER; }
+});
+Object.defineProperty(exports, "CMSSY_LOCALE_HEADER", {
+  enumerable: true,
+  get: function () { return core.CMSSY_LOCALE_HEADER; }
+});
+Object.defineProperty(exports, "applyCmssyCsp", {
+  enumerable: true,
+  get: function () { return core.applyCmssyCsp; }
+});
+Object.defineProperty(exports, "cmssyCspHeaders", {
+  enumerable: true,
+  get: function () { return core.cmssyCspHeaders; }
+});
+Object.defineProperty(exports, "localeForPathname", {
+  enumerable: true,
+  get: function () { return core.localeForPathname; }
+});
+exports.CMSSY_EDIT_PATH_PREFIX = CMSSY_EDIT_PATH_PREFIX;
+exports.cmssyEditRewrite = cmssyEditRewrite;
+exports.cmssyProxyMatcher = cmssyProxyMatcher;
+exports.createCmssyAuthMiddleware = createCmssyAuthMiddleware;
+exports.createCmssyEditMiddleware = createCmssyEditMiddleware;
+exports.createCmssyLocaleMiddleware = createCmssyLocaleMiddleware;
+exports.createCmssyProxy = createCmssyProxy;
+exports.isCmssyEditRequest = isCmssyEditRequest;
+exports.resolveLocaleFromPathname = resolveLocaleFromPathname;

package/dist/middleware.d.cts

@@ -0,0 +1,106 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { CmssyConfig } from '@cmssy/core';
+export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CmssyCspOptions, applyCmssyCsp, cmssyCspHeaders, localeForPathname } from '@cmssy/core';
+
+interface CmssyProxyOptions {
+    /**
+     * Strip the language prefix before the app sees it, so static routes like
+     * `/shop/cart` serve `/no/shop/cart` too. Leave it off for a catch-all app
+     * that reads the language off the path itself.
+     */
+    stripLocalePrefix?: boolean;
+}
+/**
+ * The whole middleware a cmssy app needs, in the order it has to happen:
+ *
+ *   1. resolve the language and pass it on (a route cannot read the prefix it
+ *      never sees);
+ *   2. send a VERIFIED editor request to /cmssy-edit, carrying that language and
+ *      the edit flag - the public pages are static, and a static page never sees
+ *      the query string that would put it in edit mode;
+ *   3. strip the language prefix for everything else, if asked.
+ *
+ * The order is not a detail: resolve the locale after the rewrite and the editor
+ * preview renders in the wrong language; forget the edit flag and the header and
+ * footer become markup the editor can select but not fill. Both mistakes shipped
+ * before this existed.
+ */
+declare function createCmssyProxy(config: CmssyConfig, options?: CmssyProxyOptions): (request: NextRequest) => Promise<NextResponse>;
+/**
+ * The matcher a cmssy app wants: everything except Next internals, API routes
+ * and files with an extension.
+ *
+ * Next parses `export const config` at COMPILE time, so it rejects an imported
+ * constant - copy this value into your proxy literally:
+ *
+ *   export const config = { matcher: ["/((?!_next/|api/|.*\\..*).*)"] };
+ */
+declare const cmssyProxyMatcher: string[];
+
+/**
+ * Where the middleware rewrites editor-preview traffic. Mount the matching
+ * dynamic route in the consumer app:
+ *
+ *   app/cmssy-edit/[[...path]]/page.tsx
+ *     export const dynamic = "force-dynamic";
+ *     export default createCmssyEditPage(cmssy, blocks, { editor: Editor });
+ */
+declare const CMSSY_EDIT_PATH_PREFIX = "/cmssy-edit";
+/**
+ * Rewrite VERIFIED editor requests (`cmssyEdit=1` + a `cmssySecret` matching
+ * the site's draft secret, CMS-948) onto the dedicated dynamic edit route, so
+ * the public catch-all can stay fully static. A static page never sees its
+ * query string - this rewrite is what makes the editor iframe work at all
+ * once ISR is on. Draft-mode preview (the authenticated /api/draft cookie) is
+ * NOT rewritten: it renders draft content on the public route via
+ * `draftMode()`, without the editor. Returns null for normal traffic so it
+ * composes with other middleware.
+ */
+declare function cmssyEditRewrite(request: NextRequest, config: {
+    draftSecret: string;
+}, options?: {
+    /**
+     * Headers to forward to the edit route, for a site whose middleware tells
+     * the app something the path alone does not - a resolved locale, say.
+     * Without them the editor preview renders in the default language while the
+     * public page renders in the visitor's.
+     */
+    requestHeaders?: Headers;
+}): Promise<NextResponse | null>;
+/** Standalone middleware when the consumer has no other middleware to compose. */
+declare function createCmssyEditMiddleware(config: {
+    draftSecret: string;
+}): (request: NextRequest) => Promise<NextResponse>;
+
+/**
+ * Resolves the active locale from a pathname's leading segment. Uses the
+ * config's static `defaultLocale` + `enabledLocales` when both are set (no
+ * network); otherwise fetches the workspace locales (cached).
+ */
+declare function resolveLocaleFromPathname(config: CmssyConfig, pathname: string): Promise<string>;
+/**
+ * Middleware that derives the locale from the URL path prefix and forwards it as
+ * the `x-cmssy-locale` request header, so server components that can't read the
+ * path (root layout) resolve the right locale via `getCmssyLocale`.
+ */
+declare function createCmssyLocaleMiddleware(config: CmssyConfig): (request: NextRequest) => Promise<NextResponse>;
+
+type CmssyAuthMiddleware = (request: NextRequest) => Promise<NextResponse>;
+declare function createCmssyAuthMiddleware(config: CmssyConfig): CmssyAuthMiddleware;
+
+interface EditRequestLike {
+    cookies: {
+        has: (name: string) => boolean;
+    };
+    nextUrl: {
+        searchParams: {
+            getAll: (name: string) => string[];
+            get: (name: string) => string | null;
+        };
+    };
+}
+declare function isCmssyEditRequest(request: EditRequestLike, config: {
+    draftSecret: string;
+}): Promise<boolean>;
+
+export { CMSSY_EDIT_PATH_PREFIX, type CmssyAuthMiddleware, type CmssyProxyOptions, cmssyEditRewrite, cmssyProxyMatcher, createCmssyAuthMiddleware, createCmssyEditMiddleware, createCmssyLocaleMiddleware, createCmssyProxy, isCmssyEditRequest, resolveLocaleFromPathname };

package/dist/middleware.d.ts

@@ -0,0 +1,106 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { CmssyConfig } from '@cmssy/core';
+export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, CmssyCspOptions, applyCmssyCsp, cmssyCspHeaders, localeForPathname } from '@cmssy/core';
+
+interface CmssyProxyOptions {
+    /**
+     * Strip the language prefix before the app sees it, so static routes like
+     * `/shop/cart` serve `/no/shop/cart` too. Leave it off for a catch-all app
+     * that reads the language off the path itself.
+     */
+    stripLocalePrefix?: boolean;
+}
+/**
+ * The whole middleware a cmssy app needs, in the order it has to happen:
+ *
+ *   1. resolve the language and pass it on (a route cannot read the prefix it
+ *      never sees);
+ *   2. send a VERIFIED editor request to /cmssy-edit, carrying that language and
+ *      the edit flag - the public pages are static, and a static page never sees
+ *      the query string that would put it in edit mode;
+ *   3. strip the language prefix for everything else, if asked.
+ *
+ * The order is not a detail: resolve the locale after the rewrite and the editor
+ * preview renders in the wrong language; forget the edit flag and the header and
+ * footer become markup the editor can select but not fill. Both mistakes shipped
+ * before this existed.
+ */
+declare function createCmssyProxy(config: CmssyConfig, options?: CmssyProxyOptions): (request: NextRequest) => Promise<NextResponse>;
+/**
+ * The matcher a cmssy app wants: everything except Next internals, API routes
+ * and files with an extension.
+ *
+ * Next parses `export const config` at COMPILE time, so it rejects an imported
+ * constant - copy this value into your proxy literally:
+ *
+ *   export const config = { matcher: ["/((?!_next/|api/|.*\\..*).*)"] };
+ */
+declare const cmssyProxyMatcher: string[];
+
+/**
+ * Where the middleware rewrites editor-preview traffic. Mount the matching
+ * dynamic route in the consumer app:
+ *
+ *   app/cmssy-edit/[[...path]]/page.tsx
+ *     export const dynamic = "force-dynamic";
+ *     export default createCmssyEditPage(cmssy, blocks, { editor: Editor });
+ */
+declare const CMSSY_EDIT_PATH_PREFIX = "/cmssy-edit";
+/**
+ * Rewrite VERIFIED editor requests (`cmssyEdit=1` + a `cmssySecret` matching
+ * the site's draft secret, CMS-948) onto the dedicated dynamic edit route, so
+ * the public catch-all can stay fully static. A static page never sees its
+ * query string - this rewrite is what makes the editor iframe work at all
+ * once ISR is on. Draft-mode preview (the authenticated /api/draft cookie) is
+ * NOT rewritten: it renders draft content on the public route via
+ * `draftMode()`, without the editor. Returns null for normal traffic so it
+ * composes with other middleware.
+ */
+declare function cmssyEditRewrite(request: NextRequest, config: {
+    draftSecret: string;
+}, options?: {
+    /**
+     * Headers to forward to the edit route, for a site whose middleware tells
+     * the app something the path alone does not - a resolved locale, say.
+     * Without them the editor preview renders in the default language while the
+     * public page renders in the visitor's.
+     */
+    requestHeaders?: Headers;
+}): Promise<NextResponse | null>;
+/** Standalone middleware when the consumer has no other middleware to compose. */
+declare function createCmssyEditMiddleware(config: {
+    draftSecret: string;
+}): (request: NextRequest) => Promise<NextResponse>;
+
+/**
+ * Resolves the active locale from a pathname's leading segment. Uses the
+ * config's static `defaultLocale` + `enabledLocales` when both are set (no
+ * network); otherwise fetches the workspace locales (cached).
+ */
+declare function resolveLocaleFromPathname(config: CmssyConfig, pathname: string): Promise<string>;
+/**
+ * Middleware that derives the locale from the URL path prefix and forwards it as
+ * the `x-cmssy-locale` request header, so server components that can't read the
+ * path (root layout) resolve the right locale via `getCmssyLocale`.
+ */
+declare function createCmssyLocaleMiddleware(config: CmssyConfig): (request: NextRequest) => Promise<NextResponse>;
+
+type CmssyAuthMiddleware = (request: NextRequest) => Promise<NextResponse>;
+declare function createCmssyAuthMiddleware(config: CmssyConfig): CmssyAuthMiddleware;
+
+interface EditRequestLike {
+    cookies: {
+        has: (name: string) => boolean;
+    };
+    nextUrl: {
+        searchParams: {
+            getAll: (name: string) => string[];
+            get: (name: string) => string | null;
+        };
+    };
+}
+declare function isCmssyEditRequest(request: EditRequestLike, config: {
+    draftSecret: string;
+}): Promise<boolean>;
+
+export { CMSSY_EDIT_PATH_PREFIX, type CmssyAuthMiddleware, type CmssyProxyOptions, cmssyEditRewrite, cmssyProxyMatcher, createCmssyAuthMiddleware, createCmssyEditMiddleware, createCmssyLocaleMiddleware, createCmssyProxy, isCmssyEditRequest, resolveLocaleFromPathname };

package/dist/middleware.js

@@ -0,0 +1,156 @@
+import { NextResponse } from 'next/server';
+import { resolveSiteLocales, splitLocaleFromPath } from '@cmssy/react';
+import { CMSSY_EDIT_QUERY_PARAM, CMSSY_SECRET_QUERY_PARAM, cmssySecretsMatch, CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, localeForPathname, applyCmssyCsp, assertAuthConfig, CMSSY_SESSION_COOKIE, openSession, sessionCookieOptions, isAccessExpired, backendRefresh, toSessionPayload, sealSession, isVerifiedEditUrl } from '@cmssy/core';
+export { CMSSY_EDIT_HEADER, CMSSY_LOCALE_HEADER, applyCmssyCsp, cmssyCspHeaders, localeForPathname } from '@cmssy/core';
+
+// src/preset/proxy.ts
+var CMSSY_EDIT_PATH_PREFIX = "/cmssy-edit";
+async function cmssyEditRewrite(request, config, options = {}) {
+  const { pathname, searchParams } = request.nextUrl;
+  if (pathname.startsWith(CMSSY_EDIT_PATH_PREFIX)) return null;
+  if (!searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) return null;
+  const provided = searchParams.get(CMSSY_SECRET_QUERY_PARAM);
+  if (!provided || !config.draftSecret) return null;
+  if (!await cmssySecretsMatch(provided, config.draftSecret)) return null;
+  const url = request.nextUrl.clone();
+  url.pathname = `${CMSSY_EDIT_PATH_PREFIX}${pathname === "/" ? "" : pathname}`;
+  warnIfEditRouteMissing(url);
+  return NextResponse.rewrite(
+    url,
+    options.requestHeaders ? { request: { headers: options.requestHeaders } } : void 0
+  );
+}
+function createCmssyEditMiddleware(config) {
+  return async function cmssyEditMiddleware(request) {
+    return await cmssyEditRewrite(request, config) ?? NextResponse.next();
+  };
+}
+var probed = false;
+function warnIfEditRouteMissing(url) {
+  if (process.env.NODE_ENV === "production" || probed) return;
+  probed = true;
+  void fetch(url, { method: "HEAD" }).then((response) => {
+    if (response.status !== 404) return;
+    console.error(
+      `[cmssy] The editor request was rewritten to ${url.pathname}, but nothing is mounted there (404). Add the edit route:
+
+  // app/cmssy-edit/[[...path]]/page.tsx
+  export const dynamic = "force-dynamic";
+  export default createCmssyEditPage(cmssy, blocks, { editor: CmssyEditor });
+
+Until then the editor preview stays blank.`
+    );
+  }).catch(() => {
+  });
+}
+function createCmssyProxy(config, options = {}) {
+  return async function cmssyProxy(request) {
+    const { pathname } = request.nextUrl;
+    const requestHeaders = new Headers(request.headers);
+    requestHeaders.delete(CMSSY_EDIT_HEADER);
+    requestHeaders.delete(CMSSY_LOCALE_HEADER);
+    const locale = await localeForPathname(config, pathname);
+    requestHeaders.set(CMSSY_LOCALE_HEADER, locale);
+    const editHeaders = new Headers(requestHeaders);
+    editHeaders.set(CMSSY_EDIT_HEADER, "1");
+    const editRewrite = await cmssyEditRewrite(request, config, {
+      requestHeaders: editHeaders
+    });
+    if (editRewrite) {
+      applyCmssyCsp(editRewrite, { editorOrigin: config.editorOrigin });
+      return editRewrite;
+    }
+    if (options.stripLocalePrefix && pathname.startsWith(`/${locale}`)) {
+      const { defaultLocale } = await resolveSiteLocales(config);
+      if (locale !== defaultLocale) {
+        const url = request.nextUrl.clone();
+        url.pathname = pathname.slice(locale.length + 1) || "/";
+        return NextResponse.rewrite(url, {
+          request: { headers: requestHeaders }
+        });
+      }
+    }
+    return NextResponse.next({ request: { headers: requestHeaders } });
+  };
+}
+var cmssyProxyMatcher = ["/((?!_next/|api/|.*\\..*).*)"];
+async function resolveLocaleFromPathname(config, pathname) {
+  const segments = pathname.split("/").filter(Boolean);
+  const hasStaticLocales = !!config.enabledLocales?.length;
+  const fetched = config.defaultLocale && hasStaticLocales ? null : await resolveSiteLocales({
+    apiUrl: config.apiUrl,
+    org: config.org,
+    workspaceSlug: config.workspaceSlug
+  });
+  const siteLocales = {
+    defaultLocale: config.defaultLocale ?? fetched.defaultLocale,
+    locales: hasStaticLocales ? config.enabledLocales : fetched.locales
+  };
+  return splitLocaleFromPath(segments, siteLocales).locale;
+}
+function createCmssyLocaleMiddleware(config) {
+  return async function cmssyLocaleMiddleware(request) {
+    const locale = await resolveLocaleFromPathname(
+      config,
+      request.nextUrl.pathname
+    );
+    const headers = new Headers(request.headers);
+    headers.set(CMSSY_LOCALE_HEADER, locale);
+    return NextResponse.next({ request: { headers } });
+  };
+}
+function isPrefetch(request) {
+  return request.headers.get("next-router-prefetch") !== null || request.headers.get("purpose") === "prefetch" || (request.headers.get("sec-purpose") ?? "").includes("prefetch");
+}
+function createCmssyAuthMiddleware(config) {
+  const auth = assertAuthConfig(config);
+  return async function cmssyAuthMiddleware(request) {
+    const raw = request.cookies.get(CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return NextResponse.next();
+    const session = await openSession(
+      raw,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session) {
+      const response = NextResponse.next();
+      response.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return response;
+    }
+    if (!isAccessExpired(session)) return NextResponse.next();
+    if (isPrefetch(request)) return NextResponse.next();
+    let payload = null;
+    try {
+      const result = await backendRefresh(config, session.refreshToken);
+      payload = toSessionPayload(result);
+    } catch {
+      return NextResponse.next();
+    }
+    if (!payload) {
+      const cleared = NextResponse.next();
+      cleared.cookies.set(CMSSY_SESSION_COOKIE, "", {
+        ...sessionCookieOptions(),
+        maxAge: 0
+      });
+      return cleared;
+    }
+    const sealed = await sealSession(
+      payload,
+      auth.sessionSecret,
+      config.workspaceSlug
+    );
+    request.cookies.set(CMSSY_SESSION_COOKIE, sealed);
+    const refreshed = NextResponse.next({ request });
+    refreshed.cookies.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
+    return refreshed;
+  };
+}
+async function isCmssyEditRequest(request, config) {
+  if (request.cookies.has("__prerender_bypass")) return true;
+  return isVerifiedEditUrl(request.nextUrl, config);
+}
+
+export { CMSSY_EDIT_PATH_PREFIX, cmssyEditRewrite, cmssyProxyMatcher, createCmssyAuthMiddleware, createCmssyEditMiddleware, createCmssyLocaleMiddleware, createCmssyProxy, isCmssyEditRequest, resolveLocaleFromPathname };