@cmssy/next 4.7.1 → 5.0.0

package/dist/server.cjs

@@ -0,0 +1,1063 @@
+'use strict';
+
+require('server-only');
+var headers = require('next/headers');
+var navigation = require('next/navigation');
+var react = require('@cmssy/react');
+var client = require('@cmssy/react/client');
+var core = require('@cmssy/core');
+var jsxRuntime = require('react/jsx-runtime');
+
+// src/server.ts
+async function readValidSession(config) {
+  const auth = core.assertAuthConfig(config);
+  const jar = await headers.cookies();
+  const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  const session = await core.openSession(
+    raw,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  if (!session || core.isAccessExpired(session)) return null;
+  return session;
+}
+async function getCmssyUser(config) {
+  const session = await readValidSession(config);
+  return session?.user ?? null;
+}
+async function getCmssyAccessToken(config) {
+  const session = await readValidSession(config);
+  return session?.accessToken ?? null;
+}
+function hasEditFlag(value) {
+  return Array.isArray(value) ? value.includes("1") : value === "1";
+}
+function firstValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+async function resolveEditorRequest(query, draftSecret) {
+  if (!hasEditFlag(query[core.CMSSY_EDIT_QUERY_PARAM])) return false;
+  const provided = firstValue(query[core.CMSSY_SECRET_QUERY_PARAM]);
+  if (!provided || !draftSecret) return false;
+  return core.cmssySecretsMatch(provided, draftSecret);
+}
+function createCmssyPage(config, blocks, options) {
+  return buildCmssyPageRenderer(config, blocks, options, false);
+}
+function createCmssyEditPage(config, blocks, options) {
+  return buildCmssyPageRenderer(config, blocks, options, true);
+}
+function buildCmssyPageRenderer(config, blocks, options, editRoute) {
+  if (!Array.isArray(blocks)) {
+    throw new Error(
+      "cmssy: createCmssyPage(config, blocks) requires a blocks array \u2014 pass your defineBlock(...) array"
+    );
+  }
+  const Editor = options?.editor;
+  const clientConfig = {
+    apiUrl: config.apiUrl,
+    org: config.org,
+    workspaceSlug: config.workspaceSlug
+  };
+  const client$1 = react.createCmssyClient(clientConfig);
+  const fixedPath = options?.path?.split("/").map((segment) => segment.trim()).filter(Boolean);
+  return async function CmssyCatchAllPage({
+    params,
+    searchParams
+  }) {
+    const path = fixedPath ?? (params ? (await params).path ?? void 0 : void 0);
+    const { isEnabled } = await headers.draftMode();
+    let editorActive = false;
+    if (editRoute) {
+      const query = searchParams ? await searchParams : {};
+      editorActive = await resolveEditorRequest(query, config.draftSecret);
+      if (!editorActive) {
+        navigation.notFound();
+      }
+    }
+    const editMode = isEnabled || editorActive;
+    const devAllowed = core.isDevelopment() && Boolean(config.devToken?.trim());
+    let locale;
+    let pagePath = path;
+    let defaultLocale;
+    let enabledLocales = config.enabledLocales;
+    if (config.resolveLocale) {
+      defaultLocale = config.defaultLocale ?? (await react.resolveSiteLocales(clientConfig)).defaultLocale;
+      locale = await config.resolveLocale();
+    } else {
+      const siteLocales = await react.resolveSiteLocales(clientConfig);
+      defaultLocale = config.defaultLocale ?? siteLocales.defaultLocale;
+      const locales = config.enabledLocales ?? siteLocales.locales;
+      enabledLocales = locales;
+      const split = react.splitLocaleFromPath(path, { defaultLocale, locales });
+      locale = split.locale;
+      pagePath = split.path;
+    }
+    const devWorkspaceId = devAllowed ? await client$1.resolveWorkspaceId() : void 0;
+    const page = await react.fetchPage(clientConfig, pagePath, {
+      previewSecret: editMode ? config.draftSecret : void 0,
+      devPreview: devAllowed || void 0,
+      devToken: devAllowed ? config.devToken : void 0,
+      workspaceId: devWorkspaceId
+    });
+    if (!page) {
+      navigation.notFound();
+    }
+    if (editorActive && !Editor) {
+      throw new Error(
+        'cmssy: edit/dev mode requires options.editor \u2014 pass a "use client" editor that imports your blocks and renders <CmssyEditablePage blocks={blocks} \u2026 />'
+      );
+    }
+    const resolvedForms = await react.resolveForms(
+      clientConfig,
+      page.blocks,
+      locale,
+      defaultLocale
+    );
+    const forms = Object.keys(resolvedForms).length > 0 ? resolvedForms : void 0;
+    const localeContext = {
+      current: locale,
+      default: defaultLocale,
+      enabled: enabledLocales && enabledLocales.length > 0 ? enabledLocales : Array.from(/* @__PURE__ */ new Set([defaultLocale, locale]))
+    };
+    if (editorActive && Editor) {
+      const bridgeOrigin = resolveBridgeOrigin(config.editorOrigin);
+      return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
+        Editor,
+        {
+          page,
+          locale,
+          defaultLocale,
+          enabledLocales,
+          edit: { editorOrigin: bridgeOrigin },
+          forms
+        }
+      ) });
+    }
+    let auth;
+    if (config.auth) {
+      try {
+        const user = await getCmssyUser(config);
+        auth = {
+          isAuthenticated: !!user,
+          member: user ? { recordId: user.recordId, email: user.email } : null
+        };
+      } catch {
+        auth = void 0;
+      }
+    }
+    let workspace;
+    try {
+      workspace = {
+        id: await client$1.resolveWorkspaceId(),
+        slug: config.workspaceSlug
+      };
+    } catch {
+      workspace = void 0;
+    }
+    return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
+      react.CmssyServerPage,
+      {
+        page,
+        blocks,
+        locale,
+        defaultLocale,
+        enabledLocales,
+        forms,
+        auth,
+        workspace
+      }
+    ) });
+  };
+}
+function resolveBridgeOrigin(editorOrigin) {
+  const resolved = core.resolveEditorOrigin(editorOrigin);
+  const origins = (Array.isArray(resolved) ? resolved : [resolved]).map(
+    (origin) => core.toCspOrigin(origin.trim())
+  );
+  if (origins.length === 0) {
+    throw new Error("cmssy: editorOrigin must be set to frame the editor");
+  }
+  if (origins.includes("*") && !core.isDevelopment()) {
+    throw new Error(
+      "cmssy: editorOrigin '*' is only allowed in development; set a concrete editor origin (e.g. https://cmssy.io) for production"
+    );
+  }
+  return origins.length === 1 ? origins[0] : origins;
+}
+function DefaultNotFound() {
+  return /* @__PURE__ */ jsxRuntime.jsxs(
+    "main",
+    {
+      style: {
+        minHeight: "60vh",
+        display: "flex",
+        flexDirection: "column",
+        alignItems: "center",
+        justifyContent: "center",
+        gap: "0.5rem",
+        textAlign: "center",
+        padding: "2rem"
+      },
+      children: [
+        /* @__PURE__ */ jsxRuntime.jsx("h1", { style: { fontSize: "2rem", fontWeight: 700, margin: 0 }, children: "404" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: 0, opacity: 0.7 }, children: "Page not found" })
+      ]
+    }
+  );
+}
+function createCmssyNotFound(config, blocks, options) {
+  if (!Array.isArray(blocks)) {
+    throw new Error(
+      "cmssy: createCmssyNotFound(config, blocks) requires a blocks array \u2014 pass your defineBlock(...) array"
+    );
+  }
+  const clientConfig = {
+    apiUrl: config.apiUrl,
+    org: config.org,
+    workspaceSlug: config.workspaceSlug
+  };
+  const fallback = options?.fallback ?? /* @__PURE__ */ jsxRuntime.jsx(DefaultNotFound, {});
+  return async function CmssyNotFound() {
+    try {
+      const siteConfig = await react.fetchSiteConfig(clientConfig);
+      const notFoundPageId = siteConfig?.notFoundPageId;
+      if (!notFoundPageId) return fallback;
+      const page = await react.fetchPageById(clientConfig, notFoundPageId);
+      if (!page || page.blocks.length === 0) return fallback;
+      let locale;
+      let defaultLocale;
+      let enabledLocales = config.enabledLocales;
+      if (config.resolveLocale) {
+        defaultLocale = config.defaultLocale ?? "en";
+        locale = await config.resolveLocale();
+      } else {
+        const siteLocales = await react.resolveSiteLocales(clientConfig);
+        defaultLocale = config.defaultLocale ?? siteLocales.defaultLocale;
+        enabledLocales = config.enabledLocales ?? siteLocales.locales;
+        locale = defaultLocale;
+      }
+      const resolvedForms = await react.resolveForms(
+        clientConfig,
+        page.blocks,
+        locale,
+        defaultLocale
+      );
+      const forms = Object.keys(resolvedForms).length > 0 ? resolvedForms : void 0;
+      const localeContext = {
+        current: locale,
+        default: defaultLocale,
+        enabled: enabledLocales && enabledLocales.length > 0 ? enabledLocales : Array.from(/* @__PURE__ */ new Set([defaultLocale, locale]))
+      };
+      return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
+        react.CmssyServerPage,
+        {
+          page,
+          blocks,
+          locale,
+          defaultLocale,
+          enabledLocales,
+          forms
+        }
+      ) });
+    } catch (err) {
+      if (typeof console !== "undefined") {
+        console.warn("[cmssy] not-found page render failed", err);
+      }
+      return fallback;
+    }
+  };
+}
+async function isCmssyEditMode() {
+  const h = await headers.headers();
+  return h.get(core.CMSSY_EDIT_HEADER) === "1";
+}
+async function getCmssyLocale(config, options) {
+  if (options?.path !== void 0) {
+    return core.localeForPath(config, options.path);
+  }
+  const { headers: headers2 } = await import('next/headers');
+  const headerList = await headers2();
+  const fromHeader = headerList.get(core.CMSSY_LOCALE_HEADER);
+  if (fromHeader) return fromHeader;
+  const { defaultLocale } = await core.resolveSiteLocales(config);
+  return defaultLocale;
+}
+async function CmssyChrome({
+  config,
+  blocks,
+  position,
+  page = "/",
+  editable
+}) {
+  const editMode = await isCmssyEditMode();
+  const [groups, locale, siteLocales] = await Promise.all([
+    react.fetchLayouts(
+      config,
+      page,
+      editMode ? { previewSecret: config.draftSecret } : void 0
+    ),
+    getCmssyLocale(config),
+    react.resolveSiteLocales(config)
+  ]);
+  if (editMode && editable) {
+    const origin = core.resolveEditorOrigin(config.editorOrigin);
+    const Editable = editable;
+    return /* @__PURE__ */ jsxRuntime.jsx(
+      Editable,
+      {
+        groups,
+        position,
+        locale,
+        defaultLocale: siteLocales.defaultLocale,
+        enabledLocales: siteLocales.locales,
+        edit: {
+          editorOrigin: (Array.isArray(origin) ? origin[0] : origin) ?? ""
+        }
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    react.CmssyServerLayout,
+    {
+      groups,
+      blocks,
+      position,
+      locale,
+      defaultLocale: siteLocales.defaultLocale,
+      enabledLocales: siteLocales.locales
+    }
+  );
+}
+
+// src/seo-base-url.ts
+function trimTrailingSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+async function resolveSeoBaseUrl(config, option) {
+  if (typeof option === "function") return trimTrailingSlash(await option());
+  if (typeof option === "string" && option) return trimTrailingSlash(option);
+  if (config.siteUrl) return trimTrailingSlash(config.siteUrl);
+  const { headers: headers2 } = await import('next/headers');
+  const h = await headers2();
+  const host = h.get("host");
+  if (!host) return "";
+  const protocol = isLocalHost(host) ? "http" : "https";
+  return `${protocol}://${host}`;
+}
+function isLocalHost(host) {
+  const hostname = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname === "::1") {
+    return true;
+  }
+  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!ipv4) return false;
+  const [a, b] = [Number(ipv4[1]), Number(ipv4[2])];
+  return a === 127 || a === 0 || a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31;
+}
+function pick(value, locale, defaultLocale) {
+  if (!value) return "";
+  if (typeof value === "string") return value;
+  return value[locale] || value[defaultLocale] || Object.values(value)[0] || "";
+}
+async function buildCmssyMetadata(config, path, options = {}) {
+  const clientConfig = {
+    apiUrl: config.apiUrl,
+    org: config.org,
+    workspaceSlug: config.workspaceSlug
+  };
+  const [siteConfig, baseUrl] = await Promise.all([
+    react.fetchSiteConfig(clientConfig).catch(() => null),
+    resolveSeoBaseUrl(config, options.baseUrl)
+  ]);
+  const { defaultLocale, locales: enabledLocales } = core.resolveSeoLocales(
+    config,
+    siteConfig
+  );
+  const segments = Array.isArray(path) ? path : path ? path.split("/").filter(Boolean) : void 0;
+  const fromPath = react.splitLocaleFromPath(segments, {
+    defaultLocale,
+    locales: enabledLocales
+  });
+  const locale = options.locale ?? (fromPath.locale !== defaultLocale ? fromPath.locale : await config.resolveLocale?.() ?? defaultLocale);
+  const slug = react.normalizeSlug(fromPath.path);
+  const meta = await react.fetchPageMeta(clientConfig, slug).catch(() => null);
+  const siteName = pick(siteConfig?.siteName, locale, defaultLocale) || siteConfig?.branding?.brandName || void 0;
+  const title = pick(meta?.seoTitle, locale, defaultLocale) || pick(meta?.displayName, locale, defaultLocale) || siteName || "";
+  const description = pick(meta?.seoDescription, locale, defaultLocale);
+  const keywords = meta?.seoKeywords?.length ? meta.seoKeywords : void 0;
+  const image = options.image ?? siteConfig?.branding?.ogImageUrl ?? void 0;
+  const canonical = baseUrl ? `${baseUrl}${core.localizedPath(slug, locale, defaultLocale)}` : void 0;
+  const languages = baseUrl && enabledLocales.length > 1 ? {
+    ...Object.fromEntries(
+      enabledLocales.map((l) => [
+        l,
+        `${baseUrl}${core.localizedPath(slug, l, defaultLocale)}`
+      ])
+    ),
+    // What to serve a reader whose language none of these match.
+    "x-default": `${baseUrl}${core.localizedPath(slug, defaultLocale, defaultLocale)}`
+  } : void 0;
+  return {
+    ...baseUrl ? { metadataBase: new URL(baseUrl) } : {},
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...keywords ? { keywords } : {},
+    ...canonical || languages ? {
+      alternates: {
+        ...canonical ? { canonical } : {},
+        ...languages ? { languages } : {}
+      }
+    } : {},
+    openGraph: {
+      ...title ? { title } : {},
+      ...description ? { description } : {},
+      ...canonical ? { url: canonical } : {},
+      ...siteName ? { siteName } : {},
+      type: options.ogType ?? "website",
+      locale,
+      ...image ? { images: [{ url: image }] } : {}
+    },
+    twitter: {
+      card: image ? options.twitterCard ?? "summary_large_image" : "summary",
+      ...title ? { title } : {},
+      ...description ? { description } : {},
+      ...image ? { images: [image] } : {}
+    }
+  };
+}
+
+// src/create-cmssy-robots.ts
+function createCmssyRobots(config, options = {}) {
+  return async function robots() {
+    const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
+    const rules = options.rules ?? {
+      userAgent: "*",
+      allow: "/",
+      disallow: options.disallow ?? ["/api/"]
+    };
+    const includeSitemap = options.sitemap !== false && Boolean(baseUrl);
+    return {
+      rules,
+      ...includeSitemap ? { sitemap: `${baseUrl}/sitemap.xml` } : {},
+      ...options.host && baseUrl ? { host: baseUrl } : {}
+    };
+  };
+}
+function createCmssySitemap(config, options = {}) {
+  const clientConfig = {
+    apiUrl: config.apiUrl,
+    org: config.org,
+    workspaceSlug: config.workspaceSlug
+  };
+  return async function sitemap() {
+    let pages = [];
+    try {
+      pages = await react.fetchPages(clientConfig);
+    } catch (err) {
+      if (typeof console !== "undefined") {
+        console.warn("[cmssy] sitemap page fetch failed", err);
+      }
+      pages = [];
+    }
+    let siteConfig = null;
+    try {
+      siteConfig = await react.fetchSiteConfig(clientConfig);
+    } catch {
+      siteConfig = null;
+    }
+    const notFoundPageId = siteConfig?.notFoundPageId ?? null;
+    const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
+    const { defaultLocale, locales } = core.resolveSeoLocales(config, siteConfig);
+    const excluded = new Set((options.excludeSlugs ?? []).map(core.normalizeSlug));
+    const languagesFor = (slug) => locales.length > 1 ? {
+      languages: {
+        ...Object.fromEntries(
+          locales.map((locale) => [
+            locale,
+            `${baseUrl}${core.localizedPath(slug, locale, defaultLocale)}`
+          ])
+        ),
+        "x-default": `${baseUrl}${core.localizedPath(slug, defaultLocale, defaultLocale)}`
+      }
+    } : void 0;
+    const entries = pages.map((page) => ({ ...page, slug: core.normalizeSlug(page.slug) })).filter((page) => page.id !== notFoundPageId && !excluded.has(page.slug)).flatMap((page) => {
+      const lastModified = page.updatedAt ?? page.publishedAt ?? void 0;
+      const alternates = languagesFor(page.slug);
+      return locales.map((locale) => ({
+        url: `${baseUrl}${core.localizedPath(page.slug, locale, defaultLocale)}`,
+        ...lastModified ? { lastModified: new Date(lastModified) } : {},
+        ...alternates ? { alternates } : {}
+      }));
+    });
+    if (!options.extra) return entries;
+    const extra = typeof options.extra === "function" ? await options.extra({ baseUrl, defaultLocale, locales }) : options.extra;
+    return [...entries, ...extra];
+  };
+}
+var MAX_BODY_CHARS = 16 * 1024;
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+async function readBody(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new Error("content-type must be application/json");
+  }
+  const text = await request.text();
+  if (text.length > MAX_BODY_CHARS) {
+    throw new Error("body too large");
+  }
+  if (!text) return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("body must be a JSON object");
+  }
+  return parsed;
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+function plainObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+async function readSession(config, auth) {
+  const jar = await headers.cookies();
+  const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
+  if (!raw) return null;
+  return core.openSession(raw, auth.sessionSecret, config.workspaceSlug);
+}
+async function writeSession(config, auth, payload) {
+  const sealed = await core.sealSession(
+    payload,
+    auth.sessionSecret,
+    config.workspaceSlug
+  );
+  const jar = await headers.cookies();
+  jar.set(core.CMSSY_SESSION_COOKIE, sealed, core.sessionCookieOptions());
+}
+async function clearSession() {
+  const jar = await headers.cookies();
+  jar.set(core.CMSSY_SESSION_COOKIE, "", {
+    ...core.sessionCookieOptions(),
+    maxAge: 0
+  });
+}
+async function refreshSession(config, auth, session) {
+  const result = await core.backendRefresh(config, session.refreshToken);
+  const payload = core.toSessionPayload(result);
+  if (!payload) {
+    await clearSession();
+    return null;
+  }
+  await writeSession(config, auth, payload);
+  return payload;
+}
+function createCmssyAuthRoute(config) {
+  const auth = core.assertAuthConfig(config);
+  async function handleSignIn(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid credentials." }, 400);
+    }
+    const result = await core.backendSignIn(
+      config,
+      auth.modelSlug,
+      identity,
+      password
+    );
+    const payload = core.toSessionPayload(result);
+    if (!payload) {
+      return json({ ok: false, message: result.message }, 401);
+    }
+    await writeSession(config, auth, payload);
+    return json({ ok: true, user: payload.user });
+  }
+  async function handleRegister(body) {
+    const identity = str(body.identity);
+    const password = str(body.password);
+    if (!identity || !password) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await core.backendRegister(
+      config,
+      auth.modelSlug,
+      identity,
+      password,
+      plainObject(body.fields)
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleSignOut() {
+    const session = await readSession(config, auth);
+    if (session) {
+      await core.backendSignOut(config, session.refreshToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleSignOutEverywhere() {
+    let session = await readSession(config, auth);
+    if (session && core.isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    if (session) {
+      await core.backendSignOutEverywhere(config, session.accessToken);
+    }
+    await clearSession();
+    return json({ ok: true });
+  }
+  async function handleRefresh() {
+    const session = await readSession(config, auth);
+    if (!session) {
+      return json({ ok: false, user: null }, 401);
+    }
+    const refreshed = await refreshSession(config, auth, session);
+    if (!refreshed) {
+      return json({ ok: false, user: null }, 401);
+    }
+    return json({ ok: true, user: refreshed.user });
+  }
+  async function handleMe() {
+    let session = await readSession(config, auth);
+    if (session && core.isAccessExpired(session)) {
+      session = await refreshSession(config, auth, session);
+    }
+    return json({ user: session?.user ?? null });
+  }
+  async function handleForgotPassword(body) {
+    const identity = str(body.identity);
+    if (!identity) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await core.backendForgotPassword(
+      config,
+      auth.modelSlug,
+      identity
+    );
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleResetPassword(body) {
+    const token = str(body.token);
+    const newPassword = str(body.newPassword);
+    if (!token || !newPassword) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await core.backendResetPassword(config, token, newPassword);
+    return json({ ok: result.success, message: result.message });
+  }
+  async function handleVerifyEmail(body) {
+    const token = str(body.token);
+    if (!token) {
+      return json({ ok: false, message: "Invalid input." }, 400);
+    }
+    const result = await core.backendVerifyEmail(config, token);
+    return json({ ok: result.success, message: result.message });
+  }
+  return {
+    async POST(request, context) {
+      const { action } = await context.params;
+      let body;
+      try {
+        body = await readBody(request);
+      } catch {
+        return json({ ok: false, message: "Invalid request body." }, 400);
+      }
+      try {
+        switch (action) {
+          case "sign-in":
+            return await handleSignIn(body);
+          case "register":
+            return await handleRegister(body);
+          case "sign-out":
+            return await handleSignOut();
+          case "sign-out-everywhere":
+            return await handleSignOutEverywhere();
+          case "refresh":
+            return await handleRefresh();
+          case "forgot-password":
+            return await handleForgotPassword(body);
+          case "reset-password":
+            return await handleResetPassword(body);
+          case "verify-email":
+            return await handleVerifyEmail(body);
+          default:
+            return json({ ok: false, message: "Not found." }, 404);
+        }
+      } catch {
+        return json({ ok: false, message: "Something went wrong." }, 500);
+      }
+    },
+    async GET(_request, context) {
+      const { action } = await context.params;
+      if (action !== "me") {
+        return json({ ok: false, message: "Not found." }, 404);
+      }
+      try {
+        return await handleMe();
+      } catch {
+        return json({ user: null });
+      }
+    }
+  };
+}
+var CMSSY_CART_COOKIE = "cmssy_cart";
+var CART_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var CART_TOKEN_BYTES = 32;
+var MAX_BODY_CHARS2 = 16 * 1024;
+function json2(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+function cartCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV !== "development",
+    sameSite: "lax",
+    path: "/",
+    maxAge: CART_MAX_AGE_SECONDS
+  };
+}
+function mintToken() {
+  const bytes = new Uint8Array(CART_TOKEN_BYTES);
+  crypto.getRandomValues(bytes);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function readBody2(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new Error("content-type must be application/json");
+  }
+  const text = await request.text();
+  if (text.length > MAX_BODY_CHARS2) throw new Error("body too large");
+  if (!text) return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("body must be a JSON object");
+  }
+  return parsed;
+}
+function str2(value) {
+  return typeof value === "string" ? value : "";
+}
+function plainObject2(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+function optionalStr(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+var ADDRESS_REQUIRED = [
+  "name",
+  "line1",
+  "postalCode",
+  "city",
+  "country"
+];
+var CmssyAddressError = class extends Error {
+  constructor(missing) {
+    super(
+      `cmssy: shippingAddress is missing required field(s): ${missing.join(
+        ", "
+      )}. Expected { name, line1, postalCode, city, country } (plus optional company, line2, region, phone, vatId).`
+    );
+    this.missing = missing;
+    this.name = "CmssyAddressError";
+  }
+  missing;
+};
+function shippingAddress(value) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new CmssyAddressError([...ADDRESS_REQUIRED]);
+  }
+  const raw = value;
+  const missing = ADDRESS_REQUIRED.filter((key) => !optionalStr(raw[key]));
+  if (missing.length > 0) throw new CmssyAddressError(missing);
+  return {
+    name: optionalStr(raw.name),
+    company: optionalStr(raw.company),
+    line1: optionalStr(raw.line1),
+    line2: optionalStr(raw.line2),
+    postalCode: optionalStr(raw.postalCode),
+    city: optionalStr(raw.city),
+    region: optionalStr(raw.region),
+    country: optionalStr(raw.country),
+    phone: optionalStr(raw.phone),
+    vatId: optionalStr(raw.vatId)
+  };
+}
+function createCmssyCartRoute(config) {
+  async function ensureCartToken() {
+    const jar = await headers.cookies();
+    const existing = jar.get(CMSSY_CART_COOKIE)?.value;
+    if (existing) return existing;
+    const token = mintToken();
+    jar.set(CMSSY_CART_COOKIE, token, cartCookieOptions());
+    return token;
+  }
+  async function clearCartToken() {
+    const jar = await headers.cookies();
+    jar.set(CMSSY_CART_COOKIE, "", { ...cartCookieOptions(), maxAge: 0 });
+  }
+  async function memberAccessToken() {
+    if (!config.auth) return void 0;
+    const jar = await headers.cookies();
+    const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return void 0;
+    const session = await core.openSession(
+      raw,
+      config.auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session || core.isAccessExpired(session)) return void 0;
+    return session.accessToken;
+  }
+  async function buildContext() {
+    const cartToken = await ensureCartToken();
+    const accessToken = await memberAccessToken();
+    return accessToken ? { cartToken, accessToken } : { cartToken };
+  }
+  return {
+    async POST(request, context) {
+      const { action } = await context.params;
+      let body;
+      try {
+        body = await readBody2(request);
+      } catch {
+        return json2({ message: "Invalid request body." }, 400);
+      }
+      try {
+        const ctx = await buildContext();
+        switch (action) {
+          case "cart":
+            return json2({ cart: await core.backendGetCart(config, ctx) });
+          case "add":
+            return json2({
+              cart: await core.backendAddToCart(config, ctx, {
+                recordId: str2(body.recordId),
+                quantity: typeof body.quantity === "number" ? body.quantity : 1,
+                variantSelections: body.variantSelections,
+                notes: typeof body.notes === "string" ? body.notes : void 0
+              })
+            });
+          case "update":
+            return json2({
+              cart: await core.backendUpdateItem(config, ctx, {
+                itemId: str2(body.itemId),
+                quantity: typeof body.quantity === "number" ? body.quantity : 0
+              })
+            });
+          case "remove":
+            return json2({
+              cart: await core.backendRemoveItem(config, ctx, str2(body.itemId))
+            });
+          case "clear":
+            return json2({ cart: await core.backendClearCart(config, ctx) });
+          case "apply-discount":
+            return json2({
+              cart: await core.backendApplyDiscount(config, ctx, str2(body.code))
+            });
+          case "remove-discount":
+            return json2({ cart: await core.backendRemoveDiscount(config, ctx) });
+          case "set-shipping":
+            return json2({
+              cart: await core.backendSetShippingMethod(
+                config,
+                ctx,
+                optionalStr(body.shippingMethodId)
+              )
+            });
+          case "merge":
+            return json2({ cart: await core.backendMergeCart(config, ctx) });
+          case "checkout": {
+            const order = await core.backendCheckout(config, ctx, {
+              customerEmail: str2(body.customerEmail),
+              poNumber: optionalStr(body.poNumber),
+              customerNote: optionalStr(body.customerNote),
+              shippingAddress: shippingAddress(body.shippingAddress)
+            });
+            await clearCartToken();
+            return json2({ order });
+          }
+          case "product":
+            return json2({
+              product: await core.backendProduct(
+                config,
+                ctx,
+                str2(body.modelSlug),
+                plainObject2(body.filter)
+              )
+            });
+          default:
+            return json2({ message: "Not found." }, 404);
+        }
+      } catch (err) {
+        if (err instanceof CmssyAddressError) {
+          return json2({ message: err.message, missing: err.missing }, 400);
+        }
+        return json2(
+          {
+            message: err instanceof Error ? err.message : "Commerce request failed"
+          },
+          502
+        );
+      }
+    }
+  };
+}
+var DEFAULT_LIMIT = 20;
+var MAX_LIMIT = 100;
+function json3(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+function createCmssyOrdersRoute(config) {
+  async function memberAccessToken() {
+    if (!config.auth) return void 0;
+    const jar = await headers.cookies();
+    const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
+    if (!raw) return void 0;
+    const session = await core.openSession(
+      raw,
+      config.auth.sessionSecret,
+      config.workspaceSlug
+    );
+    if (!session || core.isAccessExpired(session)) return void 0;
+    return session.accessToken;
+  }
+  return {
+    async GET(request) {
+      const accessToken = await memberAccessToken();
+      if (!accessToken) {
+        return json3({ message: "Not signed in." }, 401);
+      }
+      const url = new URL(request.url);
+      try {
+        const id = url.searchParams.get("id");
+        if (id) {
+          return json3({ order: await core.backendMyOrder(config, accessToken, id) });
+        }
+        const skip = Math.max(
+          0,
+          Math.floor(Number(url.searchParams.get("skip")) || 0)
+        );
+        const limitParam = Math.floor(Number(url.searchParams.get("limit")));
+        const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(limitParam, MAX_LIMIT) : DEFAULT_LIMIT;
+        const result = await core.backendMyOrders(config, accessToken, {
+          skip,
+          limit
+        });
+        return json3(result);
+      } catch (err) {
+        return json3(
+          { message: err instanceof Error ? err.message : "Orders error" },
+          502
+        );
+      }
+    }
+  };
+}
+var MIN_SECRET_LENGTH = 16;
+function safeRedirect(redirect2, fallback) {
+  if (!redirect2 || !redirect2.startsWith("/")) return fallback;
+  if (redirect2.startsWith("//") || redirect2.includes("\\")) return fallback;
+  try {
+    if (new URL(redirect2, "https://cmssy.invalid").origin !== "https://cmssy.invalid") {
+      return fallback;
+    }
+  } catch {
+    return fallback;
+  }
+  return redirect2;
+}
+function createDraftRoute(config) {
+  const fallbackRedirect = config.defaultRedirect ?? "/";
+  if (safeRedirect(fallbackRedirect, "/") !== fallbackRedirect) {
+    throw new Error(
+      "cmssy: defaultRedirect must be a same-origin path starting with '/'"
+    );
+  }
+  return async function GET(request) {
+    const url = new URL(request.url);
+    if (url.searchParams.get("disable") === "1") {
+      const draft2 = await headers.draftMode();
+      draft2.disable();
+      navigation.redirect(
+        safeRedirect(url.searchParams.get("redirect"), fallbackRedirect)
+      );
+    }
+    if (config.draftSecret.length < MIN_SECRET_LENGTH) {
+      return new Response(
+        `cmssy: draftSecret must be at least ${MIN_SECRET_LENGTH} characters`,
+        { status: 500 }
+      );
+    }
+    const secret = url.searchParams.get("secret");
+    if (!secret || !await core.cmssySecretsMatch(secret, config.draftSecret)) {
+      return new Response("Invalid draft secret", { status: 401 });
+    }
+    const location = safeRedirect(
+      url.searchParams.get("redirect"),
+      fallbackRedirect
+    );
+    const draft = await headers.draftMode();
+    draft.enable();
+    navigation.redirect(location);
+  };
+}
+async function requestLocale(config) {
+  try {
+    return await getCmssyLocale(config);
+  } catch {
+    return void 0;
+  }
+}
+async function fetchProducts(config, options) {
+  const locale = options.locale ?? await requestLocale(config);
+  return core.fetchProducts(config, { ...options, locale });
+}
+async function fetchProduct(config, options) {
+  const locale = options.locale ?? await requestLocale(config);
+  return core.fetchProduct(config, { ...options, locale });
+}
+
+exports.CMSSY_CART_COOKIE = CMSSY_CART_COOKIE;
+exports.CmssyChrome = CmssyChrome;
+exports.buildCmssyMetadata = buildCmssyMetadata;
+exports.createCmssyAuthRoute = createCmssyAuthRoute;
+exports.createCmssyCartRoute = createCmssyCartRoute;
+exports.createCmssyEditPage = createCmssyEditPage;
+exports.createCmssyNotFound = createCmssyNotFound;
+exports.createCmssyOrdersRoute = createCmssyOrdersRoute;
+exports.createCmssyPage = createCmssyPage;
+exports.createCmssyRobots = createCmssyRobots;
+exports.createCmssySitemap = createCmssySitemap;
+exports.createDraftRoute = createDraftRoute;
+exports.fetchProduct = fetchProduct;
+exports.fetchProducts = fetchProducts;
+exports.getCmssyAccessToken = getCmssyAccessToken;
+exports.getCmssyLocale = getCmssyLocale;
+exports.getCmssyUser = getCmssyUser;
+exports.isCmssyEditMode = isCmssyEditMode;