@cmssy/next 4.7.2 → 5.0.0

package/dist/index.js

@@ -1,2024 +1 @@
-import { headers, draftMode, cookies } from 'next/headers';
-import { notFound, redirect } from 'next/navigation';
-import { createCmssyClient, resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, CmssyServerPage, fetchSiteConfig, fetchPageById, fetchPages, normalizeSlug as normalizeSlug$1, fetchPageMeta, resolveWorkspaceId, graphqlRequest, resolveApiUrl } from '@cmssy/react';
-export { DEFAULT_CMSSY_API_URL, evaluateFieldConditionGroup, resolveApiUrl } from '@cmssy/react';
-import { CmssyLocaleProvider } from '@cmssy/react/client';
-import { EncryptJWT, jwtDecrypt } from 'jose';
-import { jsx, jsxs } from 'react/jsx-runtime';
-import { NextResponse } from 'next/server';
-import { createHmac, timingSafeEqual } from 'crypto';
-
-// src/create-cmssy-page.tsx
-var CMSSY_SESSION_COOKIE = "cmssy_session";
-var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-var MIN_SESSION_SECRET_LENGTH = 32;
-var ACCESS_EXPIRY_SKEW_MS = 3e4;
-async function deriveSessionKey(secret) {
-  if (typeof secret !== "string" || secret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy auth sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(secret)
-  );
-  return new Uint8Array(digest);
-}
-async function sealSession(payload, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  const jwt = new EncryptJWT({ ...payload }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`);
-  if (audience) jwt.setAudience(audience);
-  return jwt.encrypt(key);
-}
-async function openSession(token, secret, audience) {
-  const key = await deriveSessionKey(secret);
-  try {
-    const { payload } = await jwtDecrypt(token, key, {
-      keyManagementAlgorithms: ["dir"],
-      contentEncryptionAlgorithms: ["A256GCM"],
-      ...audience ? { audience } : {}
-    });
-    const { accessToken, refreshToken, accessExpiresAt, user } = payload;
-    if (typeof accessToken !== "string" || typeof refreshToken !== "string" || !Number.isFinite(accessExpiresAt) || !user || typeof user !== "object" || typeof user.recordId !== "string" || typeof user.email !== "string") {
-      return null;
-    }
-    return {
-      accessToken,
-      refreshToken,
-      accessExpiresAt,
-      user: {
-        recordId: user.recordId,
-        email: user.email
-      }
-    };
-  } catch {
-    return null;
-  }
-}
-function isAccessExpired(payload, now = Date.now()) {
-  return payload.accessExpiresAt <= now + ACCESS_EXPIRY_SKEW_MS;
-}
-function sessionCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: process.env.NODE_ENV !== "development",
-    sameSite: "lax",
-    path: "/",
-    maxAge: SESSION_MAX_AGE_SECONDS
-  };
-}
-
-// src/config.ts
-var DEFAULT_CMSSY_EDITOR_ORIGINS = [
-  "https://cmssy.io",
-  "https://www.cmssy.io"
-];
-function parseEditorOriginEnv(raw) {
-  if (!raw) return void 0;
-  const parts = raw.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
-  if (parts.length === 0) return void 0;
-  return parts.length === 1 ? parts[0] : parts;
-}
-function isDevelopment() {
-  return typeof process !== "undefined" && process.env.NODE_ENV === "development";
-}
-function resolveEditorOrigin(editorOrigin) {
-  const value = editorOrigin ?? (typeof process !== "undefined" ? parseEditorOriginEnv(process.env.CMSSY_EDITOR_ORIGIN) : void 0);
-  if (value === void 0) {
-    return isDevelopment() ? "*" : DEFAULT_CMSSY_EDITOR_ORIGINS;
-  }
-  if (Array.isArray(value)) {
-    const cleaned = value.filter((o) => o && o.trim().length > 0);
-    return cleaned.length > 0 ? cleaned : DEFAULT_CMSSY_EDITOR_ORIGINS;
-  }
-  return value.trim().length > 0 ? value : DEFAULT_CMSSY_EDITOR_ORIGINS;
-}
-var REQUIRED_CONFIG_ENV = [
-  ["org", "CMSSY_ORG_SLUG"],
-  ["workspaceSlug", "CMSSY_WORKSPACE_SLUG"],
-  ["draftSecret", "CMSSY_DRAFT_SECRET"]
-];
-function defineCmssyConfig(config) {
-  const resolved = { ...config };
-  const missing = [];
-  for (const [key, env] of REQUIRED_CONFIG_ENV) {
-    const value = config[key];
-    const trimmed = typeof value === "string" ? value.trim() : "";
-    if (trimmed) {
-      resolved[key] = trimmed;
-    } else {
-      missing.push(`${env} (config.${key})`);
-    }
-  }
-  if (missing.length > 0) {
-    if (typeof window !== "undefined") {
-      throw new Error(
-        `cmssy: the config was evaluated in the browser, so it cannot see the server's environment variables.
-
-This is an import problem, not a config problem: a client component ("use client") imported a VALUE from a module that reads the cmssy config - directly, or through a helper next to one.
-
-Fix it by importing types only (they are erased at build time), or by moving the value into a module that does not touch the config.`
-      );
-    }
-    throw new Error(
-      `cmssy: missing required configuration:
-  - ${missing.join(
-        "\n  - "
-      )}
-Set the listed environment variables (e.g. in .env.local) and restart the dev server.`
-    );
-  }
-  return resolved;
-}
-function assertAuthConfig(config) {
-  const auth = config.auth;
-  if (!auth || typeof auth.modelSlug !== "string" || !auth.modelSlug) {
-    throw new Error("cmssy: config.auth.modelSlug is required for auth routes");
-  }
-  if (typeof auth.sessionSecret !== "string" || auth.sessionSecret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error(
-      `cmssy: config.auth.sessionSecret must be at least ${MIN_SESSION_SECRET_LENGTH} characters`
-    );
-  }
-  return auth;
-}
-
-// src/auth-server.ts
-async function readValidSession(config) {
-  const auth = assertAuthConfig(config);
-  const jar = await cookies();
-  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  const session = await openSession(
-    raw,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  if (!session || isAccessExpired(session)) return null;
-  return session;
-}
-async function getCmssyUser(config) {
-  const session = await readValidSession(config);
-  return session?.user ?? null;
-}
-async function getCmssyAccessToken(config) {
-  const session = await readValidSession(config);
-  return session?.accessToken ?? null;
-}
-
-// src/csp.ts
-function toCspOrigin(origin) {
-  if (origin === "*") return "*";
-  let parsed;
-  try {
-    parsed = new URL(origin);
-  } catch {
-    throw new Error(`cmssy: invalid editorOrigin "${origin}"`);
-  }
-  if (parsed.origin === "null") {
-    throw new Error(`cmssy: editorOrigin "${origin}" has no usable origin`);
-  }
-  return parsed.origin;
-}
-function frameAncestors(editorOrigin) {
-  const resolved = resolveEditorOrigin(editorOrigin);
-  const origins = Array.isArray(resolved) ? resolved : [resolved];
-  if (origins.length === 0) {
-    throw new Error(
-      "cmssy: editorOrigin must contain at least one valid origin"
-    );
-  }
-  const normalized = origins.map((origin) => toCspOrigin(origin.trim()));
-  return `frame-ancestors ${normalized.join(" ")}`;
-}
-function cmssyCspHeaders(options) {
-  return {
-    "Content-Security-Policy": frameAncestors(options.editorOrigin)
-  };
-}
-function mergeFrameAncestors(existing, directive) {
-  if (!existing) return directive;
-  const kept = existing.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !/^frame-ancestors\b/i.test(part));
-  kept.push(directive);
-  return kept.join("; ");
-}
-function applyCmssyCsp(response, options) {
-  const merged = mergeFrameAncestors(
-    response.headers.get("Content-Security-Policy"),
-    frameAncestors(options.editorOrigin)
-  );
-  response.headers.set("Content-Security-Policy", merged);
-  response.headers.delete("X-Frame-Options");
-  return response;
-}
-
-// src/secret-match.ts
-var MAX_SECRET_LENGTH = 256;
-async function cmssySecretsMatch(a, b) {
-  if (a.length > MAX_SECRET_LENGTH || b.length > MAX_SECRET_LENGTH) {
-    return false;
-  }
-  const encoder = new TextEncoder();
-  const [ha, hb] = await Promise.all([
-    crypto.subtle.digest("SHA-256", encoder.encode(a)),
-    crypto.subtle.digest("SHA-256", encoder.encode(b))
-  ]);
-  const va = new Uint8Array(ha);
-  const vb = new Uint8Array(hb);
-  let diff = 0;
-  for (let i = 0; i < va.length; i += 1) {
-    diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
-  }
-  return diff === 0;
-}
-
-// src/edit-mode.ts
-var CMSSY_EDIT_HEADER = "x-cmssy-edit";
-var CMSSY_EDIT_QUERY_PARAM = "cmssyEdit";
-var CMSSY_SECRET_QUERY_PARAM = "cmssySecret";
-async function isCmssyEditRequest(request2, config) {
-  if (request2.cookies.has("__prerender_bypass")) return true;
-  if (!request2.nextUrl.searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) {
-    return false;
-  }
-  const provided = request2.nextUrl.searchParams.get(CMSSY_SECRET_QUERY_PARAM);
-  if (!provided || !config.draftSecret) return false;
-  return cmssySecretsMatch(provided, config.draftSecret);
-}
-async function isCmssyEditMode() {
-  const h = await headers();
-  return h.get(CMSSY_EDIT_HEADER) === "1";
-}
-function hasEditFlag(value) {
-  return Array.isArray(value) ? value.includes("1") : value === "1";
-}
-function firstValue(value) {
-  return Array.isArray(value) ? value[0] : value;
-}
-async function resolveEditorRequest(query, draftSecret) {
-  if (!hasEditFlag(query[CMSSY_EDIT_QUERY_PARAM])) return false;
-  const provided = firstValue(query[CMSSY_SECRET_QUERY_PARAM]);
-  if (!provided || !draftSecret) return false;
-  return cmssySecretsMatch(provided, draftSecret);
-}
-function createCmssyPage(config, blocks, options) {
-  return buildCmssyPageRenderer(config, blocks, options, false);
-}
-function createCmssyEditPage(config, blocks, options) {
-  return buildCmssyPageRenderer(config, blocks, options, true);
-}
-function buildCmssyPageRenderer(config, blocks, options, editRoute) {
-  if (!Array.isArray(blocks)) {
-    throw new Error(
-      "cmssy: createCmssyPage(config, blocks) requires a blocks array \u2014 pass your defineBlock(...) array"
-    );
-  }
-  const Editor = options?.editor;
-  const clientConfig = {
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  };
-  const client = createCmssyClient(clientConfig);
-  const fixedPath = options?.path?.split("/").map((segment) => segment.trim()).filter(Boolean);
-  return async function CmssyCatchAllPage({
-    params,
-    searchParams
-  }) {
-    const path = fixedPath ?? (params ? (await params).path ?? void 0 : void 0);
-    const { isEnabled } = await draftMode();
-    let editorActive = false;
-    if (editRoute) {
-      const query = searchParams ? await searchParams : {};
-      editorActive = await resolveEditorRequest(query, config.draftSecret);
-      if (!editorActive) {
-        notFound();
-      }
-    }
-    const editMode = isEnabled || editorActive;
-    const devAllowed = isDevelopment() && Boolean(config.devToken?.trim());
-    let locale;
-    let pagePath = path;
-    let defaultLocale;
-    let enabledLocales = config.enabledLocales;
-    if (config.resolveLocale) {
-      defaultLocale = config.defaultLocale ?? (await resolveSiteLocales(clientConfig)).defaultLocale;
-      locale = await config.resolveLocale();
-    } else {
-      const siteLocales = await resolveSiteLocales(clientConfig);
-      defaultLocale = config.defaultLocale ?? siteLocales.defaultLocale;
-      const locales = config.enabledLocales ?? siteLocales.locales;
-      enabledLocales = locales;
-      const split = splitLocaleFromPath(path, { defaultLocale, locales });
-      locale = split.locale;
-      pagePath = split.path;
-    }
-    const devWorkspaceId = devAllowed ? await client.resolveWorkspaceId() : void 0;
-    const page = await fetchPage(clientConfig, pagePath, {
-      previewSecret: editMode ? config.draftSecret : void 0,
-      devPreview: devAllowed || void 0,
-      devToken: devAllowed ? config.devToken : void 0,
-      workspaceId: devWorkspaceId
-    });
-    if (!page) {
-      notFound();
-    }
-    if (editorActive && !Editor) {
-      throw new Error(
-        'cmssy: edit/dev mode requires options.editor \u2014 pass a "use client" editor that imports your blocks and renders <CmssyEditablePage blocks={blocks} \u2026 />'
-      );
-    }
-    const resolvedForms = await resolveForms(
-      clientConfig,
-      page.blocks,
-      locale,
-      defaultLocale
-    );
-    const forms = Object.keys(resolvedForms).length > 0 ? resolvedForms : void 0;
-    const localeContext = {
-      current: locale,
-      default: defaultLocale,
-      enabled: enabledLocales && enabledLocales.length > 0 ? enabledLocales : Array.from(/* @__PURE__ */ new Set([defaultLocale, locale]))
-    };
-    if (editorActive && Editor) {
-      const bridgeOrigin = resolveBridgeOrigin(config.editorOrigin);
-      return /* @__PURE__ */ jsx(CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsx(
-        Editor,
-        {
-          page,
-          locale,
-          defaultLocale,
-          enabledLocales,
-          edit: { editorOrigin: bridgeOrigin },
-          forms
-        }
-      ) });
-    }
-    let auth;
-    if (config.auth) {
-      try {
-        const user = await getCmssyUser(config);
-        auth = {
-          isAuthenticated: !!user,
-          member: user ? { recordId: user.recordId, email: user.email } : null
-        };
-      } catch {
-        auth = void 0;
-      }
-    }
-    let workspace;
-    try {
-      workspace = {
-        id: await client.resolveWorkspaceId(),
-        slug: config.workspaceSlug
-      };
-    } catch {
-      workspace = void 0;
-    }
-    return /* @__PURE__ */ jsx(CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsx(
-      CmssyServerPage,
-      {
-        page,
-        blocks,
-        locale,
-        defaultLocale,
-        enabledLocales,
-        forms,
-        auth,
-        workspace
-      }
-    ) });
-  };
-}
-function resolveBridgeOrigin(editorOrigin) {
-  const resolved = resolveEditorOrigin(editorOrigin);
-  const origins = (Array.isArray(resolved) ? resolved : [resolved]).map(
-    (origin) => toCspOrigin(origin.trim())
-  );
-  if (origins.length === 0) {
-    throw new Error("cmssy: editorOrigin must be set to frame the editor");
-  }
-  if (origins.includes("*") && !isDevelopment()) {
-    throw new Error(
-      "cmssy: editorOrigin '*' is only allowed in development; set a concrete editor origin (e.g. https://cmssy.io) for production"
-    );
-  }
-  return origins.length === 1 ? origins[0] : origins;
-}
-var CMSSY_EDIT_PATH_PREFIX = "/cmssy-edit";
-async function cmssyEditRewrite(request2, config, options = {}) {
-  const { pathname, searchParams } = request2.nextUrl;
-  if (pathname.startsWith(CMSSY_EDIT_PATH_PREFIX)) return null;
-  if (!searchParams.getAll(CMSSY_EDIT_QUERY_PARAM).includes("1")) return null;
-  const provided = searchParams.get(CMSSY_SECRET_QUERY_PARAM);
-  if (!provided || !config.draftSecret) return null;
-  if (!await cmssySecretsMatch(provided, config.draftSecret)) return null;
-  const url = request2.nextUrl.clone();
-  url.pathname = `${CMSSY_EDIT_PATH_PREFIX}${pathname === "/" ? "" : pathname}`;
-  warnIfEditRouteMissing(url);
-  return NextResponse.rewrite(
-    url,
-    options.requestHeaders ? { request: { headers: options.requestHeaders } } : void 0
-  );
-}
-function createCmssyEditMiddleware(config) {
-  return async function cmssyEditMiddleware(request2) {
-    return await cmssyEditRewrite(request2, config) ?? NextResponse.next();
-  };
-}
-var probed = false;
-function warnIfEditRouteMissing(url) {
-  if (process.env.NODE_ENV === "production" || probed) return;
-  probed = true;
-  void fetch(url, { method: "HEAD" }).then((response) => {
-    if (response.status !== 404) return;
-    console.error(
-      `[cmssy] The editor request was rewritten to ${url.pathname}, but nothing is mounted there (404). Add the edit route:
-
-  // app/cmssy-edit/[[...path]]/page.tsx
-  export const dynamic = "force-dynamic";
-  export default createCmssyEditPage(cmssy, blocks, { editor: CmssyEditor });
-
-Until then the editor preview stays blank.`
-    );
-  }).catch(() => {
-  });
-}
-function DefaultNotFound() {
-  return /* @__PURE__ */ jsxs(
-    "main",
-    {
-      style: {
-        minHeight: "60vh",
-        display: "flex",
-        flexDirection: "column",
-        alignItems: "center",
-        justifyContent: "center",
-        gap: "0.5rem",
-        textAlign: "center",
-        padding: "2rem"
-      },
-      children: [
-        /* @__PURE__ */ jsx("h1", { style: { fontSize: "2rem", fontWeight: 700, margin: 0 }, children: "404" }),
-        /* @__PURE__ */ jsx("p", { style: { margin: 0, opacity: 0.7 }, children: "Page not found" })
-      ]
-    }
-  );
-}
-function createCmssyNotFound(config, blocks, options) {
-  if (!Array.isArray(blocks)) {
-    throw new Error(
-      "cmssy: createCmssyNotFound(config, blocks) requires a blocks array \u2014 pass your defineBlock(...) array"
-    );
-  }
-  const clientConfig = {
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  };
-  const fallback = options?.fallback ?? /* @__PURE__ */ jsx(DefaultNotFound, {});
-  return async function CmssyNotFound() {
-    try {
-      const siteConfig = await fetchSiteConfig(clientConfig);
-      const notFoundPageId = siteConfig?.notFoundPageId;
-      if (!notFoundPageId) return fallback;
-      const page = await fetchPageById(clientConfig, notFoundPageId);
-      if (!page || page.blocks.length === 0) return fallback;
-      let locale;
-      let defaultLocale;
-      let enabledLocales = config.enabledLocales;
-      if (config.resolveLocale) {
-        defaultLocale = config.defaultLocale ?? "en";
-        locale = await config.resolveLocale();
-      } else {
-        const siteLocales = await resolveSiteLocales(clientConfig);
-        defaultLocale = config.defaultLocale ?? siteLocales.defaultLocale;
-        enabledLocales = config.enabledLocales ?? siteLocales.locales;
-        locale = defaultLocale;
-      }
-      const resolvedForms = await resolveForms(
-        clientConfig,
-        page.blocks,
-        locale,
-        defaultLocale
-      );
-      const forms = Object.keys(resolvedForms).length > 0 ? resolvedForms : void 0;
-      const localeContext = {
-        current: locale,
-        default: defaultLocale,
-        enabled: enabledLocales && enabledLocales.length > 0 ? enabledLocales : Array.from(/* @__PURE__ */ new Set([defaultLocale, locale]))
-      };
-      return /* @__PURE__ */ jsx(CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsx(
-        CmssyServerPage,
-        {
-          page,
-          blocks,
-          locale,
-          defaultLocale,
-          enabledLocales,
-          forms
-        }
-      ) });
-    } catch (err) {
-      if (typeof console !== "undefined") {
-        console.warn("[cmssy] not-found page render failed", err);
-      }
-      return fallback;
-    }
-  };
-}
-
-// src/seo-base-url.ts
-function trimTrailingSlash(url) {
-  return url.replace(/\/+$/, "");
-}
-async function resolveSeoBaseUrl(config, option) {
-  if (typeof option === "function") return trimTrailingSlash(await option());
-  if (typeof option === "string" && option) return trimTrailingSlash(option);
-  if (config.siteUrl) return trimTrailingSlash(config.siteUrl);
-  const { headers: headers3 } = await import('next/headers');
-  const h = await headers3();
-  const host = h.get("host");
-  if (!host) return "";
-  const protocol = isLocalHost(host) ? "http" : "https";
-  return `${protocol}://${host}`;
-}
-function isLocalHost(host) {
-  const hostname = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
-  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname === "::1") {
-    return true;
-  }
-  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!ipv4) return false;
-  const [a, b] = [Number(ipv4[1]), Number(ipv4[2])];
-  return a === 127 || a === 0 || a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31;
-}
-
-// src/create-cmssy-robots.ts
-function createCmssyRobots(config, options = {}) {
-  return async function robots() {
-    const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
-    const rules = options.rules ?? {
-      userAgent: "*",
-      allow: "/",
-      disallow: options.disallow ?? ["/api/"]
-    };
-    const includeSitemap = options.sitemap !== false && Boolean(baseUrl);
-    return {
-      rules,
-      ...includeSitemap ? { sitemap: `${baseUrl}/sitemap.xml` } : {},
-      ...options.host && baseUrl ? { host: baseUrl } : {}
-    };
-  };
-}
-
-// src/seo-paths.ts
-function resolveSeoLocales(config, siteConfig) {
-  const defaultLocale = config.defaultLocale ?? siteConfig?.defaultLanguage ?? "en";
-  const locales = config.enabledLocales && config.enabledLocales.length > 0 ? config.enabledLocales : siteConfig?.enabledLanguages && siteConfig.enabledLanguages.length > 0 ? siteConfig.enabledLanguages : [defaultLocale];
-  return { defaultLocale, locales };
-}
-function normalizeSlug(slug) {
-  if (slug === "/" || slug === "") return "/";
-  return slug.startsWith("/") ? slug : `/${slug}`;
-}
-function localizedPath(slug, locale, defaultLocale) {
-  const normalized = normalizeSlug(slug);
-  const base = normalized === "/" ? "" : normalized;
-  return locale === defaultLocale ? base || "/" : `/${locale}${base}`;
-}
-
-// src/create-cmssy-sitemap.ts
-function createCmssySitemap(config, options = {}) {
-  const clientConfig = {
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  };
-  return async function sitemap() {
-    let pages = [];
-    try {
-      pages = await fetchPages(clientConfig);
-    } catch (err) {
-      if (typeof console !== "undefined") {
-        console.warn("[cmssy] sitemap page fetch failed", err);
-      }
-      pages = [];
-    }
-    let siteConfig = null;
-    try {
-      siteConfig = await fetchSiteConfig(clientConfig);
-    } catch {
-      siteConfig = null;
-    }
-    const notFoundPageId = siteConfig?.notFoundPageId ?? null;
-    const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
-    const { defaultLocale, locales } = resolveSeoLocales(config, siteConfig);
-    const excluded = new Set((options.excludeSlugs ?? []).map(normalizeSlug));
-    const languagesFor = (slug) => locales.length > 1 ? {
-      languages: {
-        ...Object.fromEntries(
-          locales.map((locale) => [
-            locale,
-            `${baseUrl}${localizedPath(slug, locale, defaultLocale)}`
-          ])
-        ),
-        "x-default": `${baseUrl}${localizedPath(slug, defaultLocale, defaultLocale)}`
-      }
-    } : void 0;
-    const entries = pages.map((page) => ({ ...page, slug: normalizeSlug(page.slug) })).filter((page) => page.id !== notFoundPageId && !excluded.has(page.slug)).flatMap((page) => {
-      const lastModified = page.updatedAt ?? page.publishedAt ?? void 0;
-      const alternates = languagesFor(page.slug);
-      return locales.map((locale) => ({
-        url: `${baseUrl}${localizedPath(page.slug, locale, defaultLocale)}`,
-        ...lastModified ? { lastModified: new Date(lastModified) } : {},
-        ...alternates ? { alternates } : {}
-      }));
-    });
-    if (!options.extra) return entries;
-    const extra = typeof options.extra === "function" ? await options.extra({ baseUrl, defaultLocale, locales }) : options.extra;
-    return [...entries, ...extra];
-  };
-}
-function pick(value, locale, defaultLocale) {
-  if (!value) return "";
-  if (typeof value === "string") return value;
-  return value[locale] || value[defaultLocale] || Object.values(value)[0] || "";
-}
-async function buildCmssyMetadata(config, path, options = {}) {
-  const clientConfig = {
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  };
-  const [siteConfig, baseUrl] = await Promise.all([
-    fetchSiteConfig(clientConfig).catch(() => null),
-    resolveSeoBaseUrl(config, options.baseUrl)
-  ]);
-  const { defaultLocale, locales: enabledLocales } = resolveSeoLocales(
-    config,
-    siteConfig
-  );
-  const segments = Array.isArray(path) ? path : path ? path.split("/").filter(Boolean) : void 0;
-  const fromPath = splitLocaleFromPath(segments, {
-    defaultLocale,
-    locales: enabledLocales
-  });
-  const locale = options.locale ?? (fromPath.locale !== defaultLocale ? fromPath.locale : await config.resolveLocale?.() ?? defaultLocale);
-  const slug = normalizeSlug$1(fromPath.path);
-  const meta = await fetchPageMeta(clientConfig, slug).catch(() => null);
-  const siteName = pick(siteConfig?.siteName, locale, defaultLocale) || siteConfig?.branding?.brandName || void 0;
-  const title = pick(meta?.seoTitle, locale, defaultLocale) || pick(meta?.displayName, locale, defaultLocale) || siteName || "";
-  const description = pick(meta?.seoDescription, locale, defaultLocale);
-  const keywords = meta?.seoKeywords?.length ? meta.seoKeywords : void 0;
-  const image = options.image ?? siteConfig?.branding?.ogImageUrl ?? void 0;
-  const canonical = baseUrl ? `${baseUrl}${localizedPath(slug, locale, defaultLocale)}` : void 0;
-  const languages = baseUrl && enabledLocales.length > 1 ? {
-    ...Object.fromEntries(
-      enabledLocales.map((l) => [
-        l,
-        `${baseUrl}${localizedPath(slug, l, defaultLocale)}`
-      ])
-    ),
-    // What to serve a reader whose language none of these match.
-    "x-default": `${baseUrl}${localizedPath(slug, defaultLocale, defaultLocale)}`
-  } : void 0;
-  return {
-    ...baseUrl ? { metadataBase: new URL(baseUrl) } : {},
-    ...title ? { title } : {},
-    ...description ? { description } : {},
-    ...keywords ? { keywords } : {},
-    ...canonical || languages ? {
-      alternates: {
-        ...canonical ? { canonical } : {},
-        ...languages ? { languages } : {}
-      }
-    } : {},
-    openGraph: {
-      ...title ? { title } : {},
-      ...description ? { description } : {},
-      ...canonical ? { url: canonical } : {},
-      ...siteName ? { siteName } : {},
-      type: options.ogType ?? "website",
-      locale,
-      ...image ? { images: [{ url: image }] } : {}
-    },
-    twitter: {
-      card: image ? options.twitterCard ?? "summary_large_image" : "summary",
-      ...title ? { title } : {},
-      ...description ? { description } : {},
-      ...image ? { images: [image] } : {}
-    }
-  };
-}
-var MIN_SECRET_LENGTH = 16;
-function safeRedirect(redirect2, fallback) {
-  if (!redirect2 || !redirect2.startsWith("/")) return fallback;
-  if (redirect2.startsWith("//") || redirect2.includes("\\")) return fallback;
-  try {
-    if (new URL(redirect2, "https://cmssy.invalid").origin !== "https://cmssy.invalid") {
-      return fallback;
-    }
-  } catch {
-    return fallback;
-  }
-  return redirect2;
-}
-function createDraftRoute(config) {
-  const fallbackRedirect = config.defaultRedirect ?? "/";
-  if (safeRedirect(fallbackRedirect, "/") !== fallbackRedirect) {
-    throw new Error(
-      "cmssy: defaultRedirect must be a same-origin path starting with '/'"
-    );
-  }
-  return async function GET(request2) {
-    const url = new URL(request2.url);
-    if (url.searchParams.get("disable") === "1") {
-      const draft2 = await draftMode();
-      draft2.disable();
-      redirect(
-        safeRedirect(url.searchParams.get("redirect"), fallbackRedirect)
-      );
-    }
-    if (config.draftSecret.length < MIN_SECRET_LENGTH) {
-      return new Response(
-        `cmssy: draftSecret must be at least ${MIN_SECRET_LENGTH} characters`,
-        { status: 500 }
-      );
-    }
-    const secret = url.searchParams.get("secret");
-    if (!secret || !await cmssySecretsMatch(secret, config.draftSecret)) {
-      return new Response("Invalid draft secret", { status: 401 });
-    }
-    const location = safeRedirect(
-      url.searchParams.get("redirect"),
-      fallbackRedirect
-    );
-    const draft = await draftMode();
-    draft.enable();
-    redirect(location);
-  };
-}
-var CMSSY_LOCALE_HEADER = "x-cmssy-locale";
-async function localeForPathname(config, pathname) {
-  const siteLocales = await resolveSiteLocales(config);
-  const segments = pathname.split("/").filter(Boolean);
-  return splitLocaleFromPath(segments, siteLocales).locale;
-}
-async function splitCmssyLocale(config, path) {
-  const siteLocales = await resolveSiteLocales(config);
-  return splitLocaleFromPath(path, siteLocales);
-}
-async function getCmssyLocale(config, options) {
-  if (options?.path !== void 0) {
-    const siteLocales = await resolveSiteLocales(config);
-    const segments = Array.isArray(options.path) ? options.path.filter(Boolean) : options.path.split("/").filter(Boolean);
-    return splitLocaleFromPath(segments, siteLocales).locale;
-  }
-  const { headers: headers3 } = await import('next/headers');
-  const headerList = await headers3();
-  const fromHeader = headerList.get(CMSSY_LOCALE_HEADER);
-  if (fromHeader) return fromHeader;
-  const { defaultLocale } = await resolveSiteLocales(config);
-  return defaultLocale;
-}
-async function resolveLocaleFromPathname(config, pathname) {
-  const segments = pathname.split("/").filter(Boolean);
-  const hasStaticLocales = !!config.enabledLocales?.length;
-  const fetched = config.defaultLocale && hasStaticLocales ? null : await resolveSiteLocales({
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  });
-  const siteLocales = {
-    defaultLocale: config.defaultLocale ?? fetched.defaultLocale,
-    locales: hasStaticLocales ? config.enabledLocales : fetched.locales
-  };
-  return splitLocaleFromPath(segments, siteLocales).locale;
-}
-function createCmssyLocaleMiddleware(config) {
-  return async function cmssyLocaleMiddleware(request2) {
-    const locale = await resolveLocaleFromPathname(
-      config,
-      request2.nextUrl.pathname
-    );
-    const headers3 = new Headers(request2.headers);
-    headers3.set(CMSSY_LOCALE_HEADER, locale);
-    return NextResponse.next({ request: { headers: headers3 } });
-  };
-}
-var LOGIN_MUTATION = `mutation SiteMemberLogin($input: SiteMemberLoginInput!) {
-  siteMember {
-    login(input: $input) {
-      success message accessToken refreshToken accessTokenExpiresIn
-    }
-  }
-}`;
-var REGISTER_MUTATION = `mutation SiteMemberRegister($input: SiteMemberRegisterInput!) {
-  siteMember {
-    register(input: $input) { success message }
-  }
-}`;
-var REFRESH_MUTATION = `mutation SiteMemberRefresh($refreshToken: String!) {
-  siteMember {
-    refresh(refreshToken: $refreshToken) {
-      success message accessToken refreshToken accessTokenExpiresIn
-    }
-  }
-}`;
-var LOGOUT_MUTATION = `mutation SiteMemberLogout($refreshToken: String!) {
-  siteMember {
-    logout(refreshToken: $refreshToken) { success message }
-  }
-}`;
-var LOGOUT_EVERYWHERE_MUTATION = `mutation SiteMemberLogoutEverywhere {
-  siteMember {
-    logoutEverywhere { success message }
-  }
-}`;
-var FORGOT_MUTATION = `mutation SiteMemberForgotPassword($modelSlug: String!, $identity: String!) {
-  siteMember {
-    forgotPassword(modelSlug: $modelSlug, identity: $identity) { success message }
-  }
-}`;
-var RESET_MUTATION = `mutation SiteMemberResetPassword($token: String!, $newPassword: String!) {
-  siteMember {
-    resetPassword(token: $token, newPassword: $newPassword) { success message }
-  }
-}`;
-var VERIFY_MUTATION = `mutation SiteMemberVerifyEmail($token: String!) {
-  siteMember {
-    verifyEmail(token: $token) { success message }
-  }
-}`;
-var workspaceIdCache = /* @__PURE__ */ new Map();
-function workspaceIdFor(config) {
-  const key = `${resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
-  const existing = workspaceIdCache.get(key);
-  if (existing) return existing;
-  const fresh = resolveWorkspaceId(config).catch((err) => {
-    workspaceIdCache.delete(key);
-    throw err;
-  });
-  workspaceIdCache.set(key, fresh);
-  return fresh;
-}
-async function authRequest(config, query, variables, label, accessToken) {
-  const workspaceId = await workspaceIdFor(config);
-  return graphqlRequest(
-    config,
-    query,
-    variables,
-    {
-      headers: {
-        "x-workspace-id": workspaceId,
-        ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
-      }
-    },
-    label
-  );
-}
-function decodeAccessClaims(accessToken) {
-  const parts = accessToken.split(".");
-  if (parts.length !== 3) return null;
-  try {
-    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-    const bytes = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
-    const json4 = JSON.parse(new TextDecoder().decode(bytes));
-    if (typeof json4.recordId !== "string" || typeof json4.email !== "string" || json4.type !== "site_member") {
-      return null;
-    }
-    return { recordId: json4.recordId, email: json4.email };
-  } catch {
-    return null;
-  }
-}
-function toSessionPayload(result) {
-  if (!result.success || !result.accessToken || !result.refreshToken || !result.accessTokenExpiresIn) {
-    return null;
-  }
-  const user = decodeAccessClaims(result.accessToken);
-  if (!user) return null;
-  return {
-    accessToken: result.accessToken,
-    refreshToken: result.refreshToken,
-    accessExpiresAt: Date.now() + result.accessTokenExpiresIn * 1e3,
-    user
-  };
-}
-async function backendSignIn(config, modelSlug, identity, password) {
-  const data = await authRequest(
-    config,
-    LOGIN_MUTATION,
-    {
-      input: { modelSlug, identity, password }
-    },
-    "site member login"
-  );
-  return data.siteMember.login;
-}
-async function backendRegister(config, modelSlug, identity, password, fields) {
-  const data = await authRequest(
-    config,
-    REGISTER_MUTATION,
-    {
-      input: { modelSlug, identity, password, fields }
-    },
-    "site member register"
-  );
-  return data.siteMember.register;
-}
-async function backendRefresh(config, refreshToken) {
-  const data = await authRequest(
-    config,
-    REFRESH_MUTATION,
-    { refreshToken },
-    "site member refresh"
-  );
-  return data.siteMember.refresh;
-}
-async function backendSignOut(config, refreshToken) {
-  try {
-    await authRequest(
-      config,
-      LOGOUT_MUTATION,
-      { refreshToken },
-      "site member logout"
-    );
-  } catch {
-    return;
-  }
-}
-async function backendSignOutEverywhere(config, accessToken) {
-  try {
-    await authRequest(
-      config,
-      LOGOUT_EVERYWHERE_MUTATION,
-      {},
-      "site member logout everywhere",
-      accessToken
-    );
-  } catch {
-    return;
-  }
-}
-async function backendForgotPassword(config, modelSlug, identity) {
-  const data = await authRequest(
-    config,
-    FORGOT_MUTATION,
-    { modelSlug, identity },
-    "site member forgot password"
-  );
-  return data.siteMember.forgotPassword;
-}
-async function backendResetPassword(config, token, newPassword) {
-  const data = await authRequest(
-    config,
-    RESET_MUTATION,
-    { token, newPassword },
-    "site member reset password"
-  );
-  return data.siteMember.resetPassword;
-}
-async function backendVerifyEmail(config, token) {
-  const data = await authRequest(
-    config,
-    VERIFY_MUTATION,
-    { token },
-    "site member verify email"
-  );
-  return data.siteMember.verifyEmail;
-}
-
-// src/create-auth-route.ts
-var MAX_BODY_CHARS = 16 * 1024;
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    }
-  });
-}
-async function readBody(request2) {
-  const contentType = request2.headers.get("content-type") ?? "";
-  if (!contentType.toLowerCase().includes("application/json")) {
-    throw new Error("content-type must be application/json");
-  }
-  const text = await request2.text();
-  if (text.length > MAX_BODY_CHARS) {
-    throw new Error("body too large");
-  }
-  if (!text) return {};
-  const parsed = JSON.parse(text);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("body must be a JSON object");
-  }
-  return parsed;
-}
-function str(value) {
-  return typeof value === "string" ? value : "";
-}
-function plainObject(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return value;
-}
-async function readSession(config, auth) {
-  const jar = await cookies();
-  const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  return openSession(raw, auth.sessionSecret, config.workspaceSlug);
-}
-async function writeSession(config, auth, payload) {
-  const sealed = await sealSession(
-    payload,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  const jar = await cookies();
-  jar.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
-}
-async function clearSession() {
-  const jar = await cookies();
-  jar.set(CMSSY_SESSION_COOKIE, "", {
-    ...sessionCookieOptions(),
-    maxAge: 0
-  });
-}
-async function refreshSession(config, auth, session) {
-  const result = await backendRefresh(config, session.refreshToken);
-  const payload = toSessionPayload(result);
-  if (!payload) {
-    await clearSession();
-    return null;
-  }
-  await writeSession(config, auth, payload);
-  return payload;
-}
-function createCmssyAuthRoute(config) {
-  const auth = assertAuthConfig(config);
-  async function handleSignIn(body) {
-    const identity = str(body.identity);
-    const password = str(body.password);
-    if (!identity || !password) {
-      return json({ ok: false, message: "Invalid credentials." }, 400);
-    }
-    const result = await backendSignIn(
-      config,
-      auth.modelSlug,
-      identity,
-      password
-    );
-    const payload = toSessionPayload(result);
-    if (!payload) {
-      return json({ ok: false, message: result.message }, 401);
-    }
-    await writeSession(config, auth, payload);
-    return json({ ok: true, user: payload.user });
-  }
-  async function handleRegister(body) {
-    const identity = str(body.identity);
-    const password = str(body.password);
-    if (!identity || !password) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await backendRegister(
-      config,
-      auth.modelSlug,
-      identity,
-      password,
-      plainObject(body.fields)
-    );
-    return json({ ok: result.success, message: result.message });
-  }
-  async function handleSignOut() {
-    const session = await readSession(config, auth);
-    if (session) {
-      await backendSignOut(config, session.refreshToken);
-    }
-    await clearSession();
-    return json({ ok: true });
-  }
-  async function handleSignOutEverywhere() {
-    let session = await readSession(config, auth);
-    if (session && isAccessExpired(session)) {
-      session = await refreshSession(config, auth, session);
-    }
-    if (session) {
-      await backendSignOutEverywhere(config, session.accessToken);
-    }
-    await clearSession();
-    return json({ ok: true });
-  }
-  async function handleRefresh() {
-    const session = await readSession(config, auth);
-    if (!session) {
-      return json({ ok: false, user: null }, 401);
-    }
-    const refreshed = await refreshSession(config, auth, session);
-    if (!refreshed) {
-      return json({ ok: false, user: null }, 401);
-    }
-    return json({ ok: true, user: refreshed.user });
-  }
-  async function handleMe() {
-    let session = await readSession(config, auth);
-    if (session && isAccessExpired(session)) {
-      session = await refreshSession(config, auth, session);
-    }
-    return json({ user: session?.user ?? null });
-  }
-  async function handleForgotPassword(body) {
-    const identity = str(body.identity);
-    if (!identity) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await backendForgotPassword(
-      config,
-      auth.modelSlug,
-      identity
-    );
-    return json({ ok: result.success, message: result.message });
-  }
-  async function handleResetPassword(body) {
-    const token = str(body.token);
-    const newPassword = str(body.newPassword);
-    if (!token || !newPassword) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await backendResetPassword(config, token, newPassword);
-    return json({ ok: result.success, message: result.message });
-  }
-  async function handleVerifyEmail(body) {
-    const token = str(body.token);
-    if (!token) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await backendVerifyEmail(config, token);
-    return json({ ok: result.success, message: result.message });
-  }
-  return {
-    async POST(request2, context) {
-      const { action } = await context.params;
-      let body;
-      try {
-        body = await readBody(request2);
-      } catch {
-        return json({ ok: false, message: "Invalid request body." }, 400);
-      }
-      try {
-        switch (action) {
-          case "sign-in":
-            return await handleSignIn(body);
-          case "register":
-            return await handleRegister(body);
-          case "sign-out":
-            return await handleSignOut();
-          case "sign-out-everywhere":
-            return await handleSignOutEverywhere();
-          case "refresh":
-            return await handleRefresh();
-          case "forgot-password":
-            return await handleForgotPassword(body);
-          case "reset-password":
-            return await handleResetPassword(body);
-          case "verify-email":
-            return await handleVerifyEmail(body);
-          default:
-            return json({ ok: false, message: "Not found." }, 404);
-        }
-      } catch {
-        return json({ ok: false, message: "Something went wrong." }, 500);
-      }
-    },
-    async GET(_request, context) {
-      const { action } = await context.params;
-      if (action !== "me") {
-        return json({ ok: false, message: "Not found." }, 404);
-      }
-      try {
-        return await handleMe();
-      } catch {
-        return json({ user: null });
-      }
-    }
-  };
-}
-var CART_FIELDS = `
-  id
-  status
-  itemCount
-  subtotal
-  currency
-  discountedTotal
-  tax
-  totalGross
-  pricesIncludeTax
-  shippingTotal
-  taxSummary { rateId name rate base amount }
-  shippingMethod { id label price etaLabel }
-  availableShippingMethods { id label price etaLabel }
-  appliedDiscount { code type value computedAmount }
-  items {
-    id
-    recordId
-    quantity
-    variantSelections
-    unitPrice
-    currentPrice
-    priceMismatch
-    snapshot { name price currency imageUrl sku tiers { minQty price } }
-  }
-`;
-var CART_QUERY = `query Cart($workspaceId: ID!) { cart { get(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
-var ADD_TO_CART = `mutation AddToCart($input: AddToCartInput!) { cart { addItem(input: $input) { ${CART_FIELDS} } } }`;
-var UPDATE_ITEM = `mutation UpdateCartItem($input: UpdateCartItemInput!) { cart { updateItem(input: $input) { ${CART_FIELDS} } } }`;
-var REMOVE_ITEM = `mutation RemoveCartItem($workspaceId: ID!, $itemId: ID!) { cart { removeItem(workspaceId: $workspaceId, itemId: $itemId) { ${CART_FIELDS} } } }`;
-var CLEAR_CART = `mutation ClearCart($workspaceId: ID!) { cart { clear(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
-var APPLY_DISCOUNT = `mutation ApplyDiscount($workspaceId: ID!, $code: String!) { cart { applyDiscount(workspaceId: $workspaceId, code: $code) { ${CART_FIELDS} } } }`;
-var REMOVE_DISCOUNT = `mutation RemoveDiscount($workspaceId: ID!) { cart { removeDiscount(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
-var SET_SHIPPING_METHOD = `mutation SetShippingMethod($workspaceId: ID!, $shippingMethodId: String) {
-  cart { setShippingMethod(workspaceId: $workspaceId, shippingMethodId: $shippingMethodId) { ${CART_FIELDS} } }
-}`;
-var MERGE_CART = `mutation MergeCart($workspaceId: ID!) { cart { merge(workspaceId: $workspaceId) { ${CART_FIELDS} } } }`;
-var CHECKOUT = `mutation Checkout($input: CheckoutInput!) {
-  cart {
-    checkout(input: $input) {
-      id
-      orderNumber
-      status
-      subtotal
-      discount
-      appliedDiscount { code type value amount }
-      tax
-      total
-      currency
-      customerEmail
-      accessToken
-      poNumber
-      customerNote
-      shippingTotal
-      pricesIncludeTax
-      shippingMethod { id label price }
-      shippingAddress { name company line1 line2 postalCode city region country phone vatId }
-      taxSummary { rateId name rate base amount }
-      items { name sku quantity price listPrice tierMinQty currency taxRate taxAmount }
-    }
-  }
-}`;
-var PRODUCT = `query Product($workspaceId: String!, $modelSlug: String!, $filter: JSON) {
-  public {
-    model {
-      records(workspaceId: $workspaceId, modelSlug: $modelSlug, filter: $filter, limit: 1) {
-        items {
-          id
-          data
-          priceTiers { minQty price }
-          variants { id sku price inventory tiers { minQty price } selectedOptions { name value } }
-        }
-      }
-    }
-  }
-}`;
-var workspaceIdCache2 = /* @__PURE__ */ new Map();
-function workspaceIdFor2(config) {
-  const key = `${resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
-  const existing = workspaceIdCache2.get(key);
-  if (existing) return existing;
-  const fresh = resolveWorkspaceId(config).catch((err) => {
-    workspaceIdCache2.delete(key);
-    throw err;
-  });
-  workspaceIdCache2.set(key, fresh);
-  return fresh;
-}
-async function request(config, ctx, workspaceId, query, variables, label) {
-  return graphqlRequest(
-    config,
-    query,
-    variables,
-    {
-      headers: {
-        "x-workspace-id": workspaceId,
-        "x-cart-session": ctx.cartToken,
-        ...ctx.accessToken ? { authorization: `Bearer ${ctx.accessToken}` } : {}
-      }
-    },
-    label
-  );
-}
-async function backendGetCart(config, ctx) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    CART_QUERY,
-    { workspaceId },
-    "cart query"
-  );
-  return data.cart.get;
-}
-async function backendAddToCart(config, ctx, input) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    ADD_TO_CART,
-    { input: { workspaceId, ...input } },
-    "add to cart"
-  );
-  return data.cart.addItem;
-}
-async function backendUpdateItem(config, ctx, input) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    UPDATE_ITEM,
-    { input: { workspaceId, ...input } },
-    "update cart item"
-  );
-  return data.cart.updateItem;
-}
-async function backendRemoveItem(config, ctx, itemId) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    REMOVE_ITEM,
-    { workspaceId, itemId },
-    "remove cart item"
-  );
-  return data.cart.removeItem;
-}
-async function backendClearCart(config, ctx) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    CLEAR_CART,
-    { workspaceId },
-    "clear cart"
-  );
-  return data.cart.clear;
-}
-async function backendApplyDiscount(config, ctx, code) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    APPLY_DISCOUNT,
-    { workspaceId, code },
-    "apply discount"
-  );
-  return data.cart.applyDiscount;
-}
-async function backendRemoveDiscount(config, ctx) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    REMOVE_DISCOUNT,
-    { workspaceId },
-    "remove discount"
-  );
-  return data.cart.removeDiscount;
-}
-async function backendSetShippingMethod(config, ctx, shippingMethodId) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    SET_SHIPPING_METHOD,
-    { workspaceId, shippingMethodId },
-    "set shipping method"
-  );
-  return data.cart.setShippingMethod;
-}
-async function backendMergeCart(config, ctx) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    MERGE_CART,
-    { workspaceId },
-    "merge cart"
-  );
-  return data.cart.merge;
-}
-async function backendCheckout(config, ctx, input) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    CHECKOUT,
-    { input: { workspaceId, ...input } },
-    "checkout"
-  );
-  return data.cart.checkout;
-}
-async function backendProduct(config, ctx, modelSlug, filter) {
-  const workspaceId = await workspaceIdFor2(config);
-  const data = await request(
-    config,
-    ctx,
-    workspaceId,
-    PRODUCT,
-    { workspaceId, modelSlug, filter },
-    "product query"
-  );
-  return data.public.model.records.items[0] ?? null;
-}
-
-// src/create-cart-route.ts
-var CMSSY_CART_COOKIE = "cmssy_cart";
-var CART_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-var CART_TOKEN_BYTES = 32;
-var MAX_BODY_CHARS2 = 16 * 1024;
-function json2(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    }
-  });
-}
-function cartCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: process.env.NODE_ENV !== "development",
-    sameSite: "lax",
-    path: "/",
-    maxAge: CART_MAX_AGE_SECONDS
-  };
-}
-function mintToken() {
-  const bytes = new Uint8Array(CART_TOKEN_BYTES);
-  crypto.getRandomValues(bytes);
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function readBody2(request2) {
-  const contentType = request2.headers.get("content-type") ?? "";
-  if (!contentType.toLowerCase().includes("application/json")) {
-    throw new Error("content-type must be application/json");
-  }
-  const text = await request2.text();
-  if (text.length > MAX_BODY_CHARS2) throw new Error("body too large");
-  if (!text) return {};
-  const parsed = JSON.parse(text);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("body must be a JSON object");
-  }
-  return parsed;
-}
-function str2(value) {
-  return typeof value === "string" ? value : "";
-}
-function plainObject2(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return value;
-}
-function optionalStr(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-var ADDRESS_REQUIRED = [
-  "name",
-  "line1",
-  "postalCode",
-  "city",
-  "country"
-];
-var CmssyAddressError = class extends Error {
-  constructor(missing) {
-    super(
-      `cmssy: shippingAddress is missing required field(s): ${missing.join(
-        ", "
-      )}. Expected { name, line1, postalCode, city, country } (plus optional company, line2, region, phone, vatId).`
-    );
-    this.missing = missing;
-    this.name = "CmssyAddressError";
-  }
-  missing;
-};
-function shippingAddress(value) {
-  if (value === void 0 || value === null) return null;
-  if (typeof value !== "object" || Array.isArray(value)) {
-    throw new CmssyAddressError([...ADDRESS_REQUIRED]);
-  }
-  const raw = value;
-  const missing = ADDRESS_REQUIRED.filter((key) => !optionalStr(raw[key]));
-  if (missing.length > 0) throw new CmssyAddressError(missing);
-  return {
-    name: optionalStr(raw.name),
-    company: optionalStr(raw.company),
-    line1: optionalStr(raw.line1),
-    line2: optionalStr(raw.line2),
-    postalCode: optionalStr(raw.postalCode),
-    city: optionalStr(raw.city),
-    region: optionalStr(raw.region),
-    country: optionalStr(raw.country),
-    phone: optionalStr(raw.phone),
-    vatId: optionalStr(raw.vatId)
-  };
-}
-function createCmssyCartRoute(config) {
-  async function ensureCartToken() {
-    const jar = await cookies();
-    const existing = jar.get(CMSSY_CART_COOKIE)?.value;
-    if (existing) return existing;
-    const token = mintToken();
-    jar.set(CMSSY_CART_COOKIE, token, cartCookieOptions());
-    return token;
-  }
-  async function clearCartToken() {
-    const jar = await cookies();
-    jar.set(CMSSY_CART_COOKIE, "", { ...cartCookieOptions(), maxAge: 0 });
-  }
-  async function memberAccessToken() {
-    if (!config.auth) return void 0;
-    const jar = await cookies();
-    const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-    if (!raw) return void 0;
-    const session = await openSession(
-      raw,
-      config.auth.sessionSecret,
-      config.workspaceSlug
-    );
-    if (!session || isAccessExpired(session)) return void 0;
-    return session.accessToken;
-  }
-  async function buildContext() {
-    const cartToken = await ensureCartToken();
-    const accessToken = await memberAccessToken();
-    return accessToken ? { cartToken, accessToken } : { cartToken };
-  }
-  return {
-    async POST(request2, context) {
-      const { action } = await context.params;
-      let body;
-      try {
-        body = await readBody2(request2);
-      } catch {
-        return json2({ message: "Invalid request body." }, 400);
-      }
-      try {
-        const ctx = await buildContext();
-        switch (action) {
-          case "cart":
-            return json2({ cart: await backendGetCart(config, ctx) });
-          case "add":
-            return json2({
-              cart: await backendAddToCart(config, ctx, {
-                recordId: str2(body.recordId),
-                quantity: typeof body.quantity === "number" ? body.quantity : 1,
-                variantSelections: body.variantSelections,
-                notes: typeof body.notes === "string" ? body.notes : void 0
-              })
-            });
-          case "update":
-            return json2({
-              cart: await backendUpdateItem(config, ctx, {
-                itemId: str2(body.itemId),
-                quantity: typeof body.quantity === "number" ? body.quantity : 0
-              })
-            });
-          case "remove":
-            return json2({
-              cart: await backendRemoveItem(config, ctx, str2(body.itemId))
-            });
-          case "clear":
-            return json2({ cart: await backendClearCart(config, ctx) });
-          case "apply-discount":
-            return json2({
-              cart: await backendApplyDiscount(config, ctx, str2(body.code))
-            });
-          case "remove-discount":
-            return json2({ cart: await backendRemoveDiscount(config, ctx) });
-          case "set-shipping":
-            return json2({
-              cart: await backendSetShippingMethod(
-                config,
-                ctx,
-                optionalStr(body.shippingMethodId)
-              )
-            });
-          case "merge":
-            return json2({ cart: await backendMergeCart(config, ctx) });
-          case "checkout": {
-            const order = await backendCheckout(config, ctx, {
-              customerEmail: str2(body.customerEmail),
-              poNumber: optionalStr(body.poNumber),
-              customerNote: optionalStr(body.customerNote),
-              shippingAddress: shippingAddress(body.shippingAddress)
-            });
-            await clearCartToken();
-            return json2({ order });
-          }
-          case "product":
-            return json2({
-              product: await backendProduct(
-                config,
-                ctx,
-                str2(body.modelSlug),
-                plainObject2(body.filter)
-              )
-            });
-          default:
-            return json2({ message: "Not found." }, 404);
-        }
-      } catch (err) {
-        if (err instanceof CmssyAddressError) {
-          return json2({ message: err.message, missing: err.missing }, 400);
-        }
-        return json2(
-          {
-            message: err instanceof Error ? err.message : "Commerce request failed"
-          },
-          502
-        );
-      }
-    }
-  };
-}
-function isPrefetch(request2) {
-  return request2.headers.get("next-router-prefetch") !== null || request2.headers.get("purpose") === "prefetch" || (request2.headers.get("sec-purpose") ?? "").includes("prefetch");
-}
-function createCmssyAuthMiddleware(config) {
-  const auth = assertAuthConfig(config);
-  return async function cmssyAuthMiddleware(request2) {
-    const raw = request2.cookies.get(CMSSY_SESSION_COOKIE)?.value;
-    if (!raw) return NextResponse.next();
-    const session = await openSession(
-      raw,
-      auth.sessionSecret,
-      config.workspaceSlug
-    );
-    if (!session) {
-      const response = NextResponse.next();
-      response.cookies.set(CMSSY_SESSION_COOKIE, "", {
-        ...sessionCookieOptions(),
-        maxAge: 0
-      });
-      return response;
-    }
-    if (!isAccessExpired(session)) return NextResponse.next();
-    if (isPrefetch(request2)) return NextResponse.next();
-    let payload = null;
-    try {
-      const result = await backendRefresh(config, session.refreshToken);
-      payload = toSessionPayload(result);
-    } catch {
-      return NextResponse.next();
-    }
-    if (!payload) {
-      const cleared = NextResponse.next();
-      cleared.cookies.set(CMSSY_SESSION_COOKIE, "", {
-        ...sessionCookieOptions(),
-        maxAge: 0
-      });
-      return cleared;
-    }
-    const sealed = await sealSession(
-      payload,
-      auth.sessionSecret,
-      config.workspaceSlug
-    );
-    request2.cookies.set(CMSSY_SESSION_COOKIE, sealed);
-    const refreshed = NextResponse.next({ request: request2 });
-    refreshed.cookies.set(CMSSY_SESSION_COOKIE, sealed, sessionCookieOptions());
-    return refreshed;
-  };
-}
-var PRODUCTS_QUERY = `query Products($workspaceId: String!, $modelSlug: String!, $filter: JSON, $stockState: String, $locale: String, $limit: Int, $offset: Int, $sort: String) {
-  public {
-    model {
-      records(workspaceId: $workspaceId, modelSlug: $modelSlug, filter: $filter, stockState: $stockState, locale: $locale, limit: $limit, offset: $offset, sort: $sort) {
-        total
-        hasMore
-        items {
-          id
-          data
-          priceTiers { minQty price }
-          variants { id sku price inventory tiers { minQty price } selectedOptions { name value } }
-        }
-      }
-    }
-  }
-}`;
-async function requestLocale(config) {
-  try {
-    return await getCmssyLocale(config);
-  } catch {
-    return null;
-  }
-}
-async function fetchProducts(config, options) {
-  const workspaceId = await resolveWorkspaceId(config);
-  const locale = options.locale ?? await requestLocale(config);
-  const data = await graphqlRequest(
-    config,
-    PRODUCTS_QUERY,
-    {
-      workspaceId,
-      modelSlug: options.modelSlug,
-      filter: options.filter ?? {},
-      stockState: options.stockState ?? null,
-      locale,
-      limit: options.limit ?? 50,
-      offset: options.offset ?? 0,
-      sort: options.sort ?? null
-    },
-    { headers: { "x-workspace-id": workspaceId } },
-    "products query"
-  );
-  return data.public.model.records;
-}
-async function fetchProduct(config, options) {
-  const page = await fetchProducts(config, {
-    modelSlug: options.modelSlug,
-    filter: { [options.slugField ?? "slug"]: options.slug },
-    locale: options.locale,
-    limit: 1
-  });
-  return page.items[0] ?? null;
-}
-var ORDER_FIELDS = `
-  id
-  status
-  subtotal
-  discount
-  appliedDiscount { code type value amount }
-  tax
-  total
-  pricesIncludeTax
-  taxSummary { rateId name rate base amount }
-  currency
-  customerEmail
-  refundedAmount
-  paymentProvider
-  paymentStatus
-  fulfillmentStatus
-  amountPaid
-  balanceDue
-  paymentReference
-  trackingNumber
-  trackingCarrier
-  invoiceNumber
-  invoiceUrl
-  invoiceProvider
-  paidAt
-  fulfilledAt
-  createdAt
-  orderNumber
-  poNumber
-  customerNote
-  shippingTotal
-  shippingMethod { id label price }
-  shippingAddress { name company line1 line2 postalCode city region country phone vatId }
-  items { name price listPrice tierMinQty currency quantity sku }
-  payments { amount reference provider at }
-`;
-var PUBLIC_ORDER_FIELDS = `
-  id
-  orderNumber
-  status
-  paymentStatus
-  fulfillmentStatus
-  subtotal
-  discount
-  appliedDiscount { code type value amount }
-  tax
-  total
-  pricesIncludeTax
-  taxSummary { rateId name rate base amount }
-  currency
-  customerEmail
-  poNumber
-  customerNote
-  shippingTotal
-  shippingMethod { id label price }
-  shippingAddress { name company line1 line2 postalCode city region country phone vatId }
-  amountPaid
-  balanceDue
-  refundedAmount
-  trackingNumber
-  trackingCarrier
-  invoiceNumber
-  invoiceUrl
-  paidAt
-  fulfilledAt
-  createdAt
-  items { name price listPrice tierMinQty currency quantity sku taxRate taxAmount }
-`;
-var MY_ORDERS = `query MyOrders($workspaceId: ID!, $skip: Int, $limit: Int) {
-  account {
-    orders(workspaceId: $workspaceId, skip: $skip, limit: $limit) {
-      total
-      hasMore
-      items { ${ORDER_FIELDS} }
-    }
-  }
-}`;
-var MY_ORDER = `query MyOrder($workspaceId: ID!, $id: ID!) {
-  account {
-    order(workspaceId: $workspaceId, id: $id) { ${ORDER_FIELDS} }
-  }
-}`;
-var PUBLIC_ORDER_BY_TOKEN = `query PublicOrder($workspaceId: ID!, $orderId: ID!, $accessToken: String!) {
-  public {
-    order {
-      byToken(workspaceId: $workspaceId, orderId: $orderId, accessToken: $accessToken) {
-        ${PUBLIC_ORDER_FIELDS}
-      }
-    }
-  }
-}`;
-var workspaceIdCache3 = /* @__PURE__ */ new Map();
-function workspaceIdFor3(config) {
-  const key = `${resolveApiUrl(config.apiUrl)}::${config.workspaceSlug}`;
-  const existing = workspaceIdCache3.get(key);
-  if (existing) return existing;
-  const fresh = resolveWorkspaceId(config).catch((err) => {
-    workspaceIdCache3.delete(key);
-    throw err;
-  });
-  workspaceIdCache3.set(key, fresh);
-  return fresh;
-}
-function headers2(workspaceId, accessToken) {
-  return {
-    "x-workspace-id": workspaceId,
-    authorization: `Bearer ${accessToken}`
-  };
-}
-async function backendMyOrders(config, accessToken, options) {
-  const workspaceId = await workspaceIdFor3(config);
-  const data = await graphqlRequest(
-    config,
-    MY_ORDERS,
-    { workspaceId, skip: options.skip, limit: options.limit },
-    { headers: headers2(workspaceId, accessToken) },
-    "my orders"
-  );
-  return data.account.orders;
-}
-async function backendMyOrder(config, accessToken, id) {
-  const workspaceId = await workspaceIdFor3(config);
-  const data = await graphqlRequest(
-    config,
-    MY_ORDER,
-    { workspaceId, id },
-    { headers: headers2(workspaceId, accessToken) },
-    "my order"
-  );
-  return data.account.order;
-}
-async function backendOrderByToken(config, options) {
-  const workspaceId = await workspaceIdFor3(config);
-  const data = await graphqlRequest(
-    config,
-    PUBLIC_ORDER_BY_TOKEN,
-    {
-      workspaceId,
-      orderId: options.orderId,
-      accessToken: options.accessToken
-    },
-    { headers: { "x-workspace-id": workspaceId } },
-    "public order lookup"
-  );
-  return data.public.order.byToken;
-}
-
-// src/order-server.ts
-async function fetchOrderByToken(config, options) {
-  return backendOrderByToken(config, options);
-}
-var DEFAULT_LIMIT = 20;
-var MAX_LIMIT = 100;
-function json3(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    }
-  });
-}
-function createCmssyOrdersRoute(config) {
-  async function memberAccessToken() {
-    if (!config.auth) return void 0;
-    const jar = await cookies();
-    const raw = jar.get(CMSSY_SESSION_COOKIE)?.value;
-    if (!raw) return void 0;
-    const session = await openSession(
-      raw,
-      config.auth.sessionSecret,
-      config.workspaceSlug
-    );
-    if (!session || isAccessExpired(session)) return void 0;
-    return session.accessToken;
-  }
-  return {
-    async GET(request2) {
-      const accessToken = await memberAccessToken();
-      if (!accessToken) {
-        return json3({ message: "Not signed in." }, 401);
-      }
-      const url = new URL(request2.url);
-      try {
-        const id = url.searchParams.get("id");
-        if (id) {
-          return json3({ order: await backendMyOrder(config, accessToken, id) });
-        }
-        const skip = Math.max(
-          0,
-          Math.floor(Number(url.searchParams.get("skip")) || 0)
-        );
-        const limitParam = Math.floor(Number(url.searchParams.get("limit")));
-        const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(limitParam, MAX_LIMIT) : DEFAULT_LIMIT;
-        const result = await backendMyOrders(config, accessToken, {
-          skip,
-          limit
-        });
-        return json3(result);
-      } catch (err) {
-        return json3(
-          { message: err instanceof Error ? err.message : "Orders error" },
-          502
-        );
-      }
-    }
-  };
-}
-var CmssyWebhookError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CmssyWebhookError";
-  }
-};
-var DEFAULT_TOLERANCE_SECONDS = 300;
-function parseSignatureHeader(header) {
-  let timestamp = null;
-  let signature = null;
-  for (const part of header.split(",")) {
-    const idx = part.indexOf("=");
-    if (idx === -1) continue;
-    const key = part.slice(0, idx).trim();
-    const value = part.slice(idx + 1).trim();
-    if (key === "t") timestamp = Number(value);
-    else if (key === "v1") signature = value;
-  }
-  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
-    throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
-  }
-  return { timestamp, signature };
-}
-function timingSafeHexEqual(expectedHex, providedHex) {
-  const expected = Buffer.from(expectedHex, "hex");
-  const provided = Buffer.from(providedHex, "hex");
-  if (expected.length !== provided.length) return false;
-  return timingSafeEqual(expected, provided);
-}
-function verifyCmssyWebhook(options) {
-  const { body, signatureHeader, secret } = options;
-  if (!signatureHeader) {
-    throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
-  }
-  if (!secret) {
-    throw new CmssyWebhookError("Missing webhook secret");
-  }
-  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
-  const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
-  const now = options.now ?? Date.now();
-  if (Math.abs(now - timestamp) > toleranceMs) {
-    throw new CmssyWebhookError("Webhook timestamp outside tolerance");
-  }
-  const expected = createHmac("sha256", secret).update(`${timestamp}.${body}`).digest("hex");
-  if (!timingSafeHexEqual(expected, signature)) {
-    throw new CmssyWebhookError("Webhook signature mismatch");
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    throw new CmssyWebhookError("Webhook body is not valid JSON");
-  }
-  return parsed;
-}
-
-export { CMSSY_CART_COOKIE, CMSSY_EDIT_HEADER, CMSSY_EDIT_PATH_PREFIX, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, CmssyWebhookError, DEFAULT_CMSSY_EDITOR_ORIGINS, SESSION_MAX_AGE_SECONDS, applyCmssyCsp, assertAuthConfig, buildCmssyMetadata, cmssyCspHeaders, cmssyEditRewrite, createCmssyAuthMiddleware, createCmssyAuthRoute, createCmssyCartRoute, createCmssyEditMiddleware, createCmssyEditPage, createCmssyLocaleMiddleware, createCmssyNotFound, createCmssyOrdersRoute, createCmssyPage, createCmssyRobots, createCmssySitemap, createDraftRoute, defineCmssyConfig, fetchOrderByToken, fetchProduct, fetchProducts, getCmssyAccessToken, getCmssyLocale, getCmssyUser, isAccessExpired, isCmssyEditMode, isCmssyEditRequest, localeForPathname, openSession, resolveEditorOrigin, resolveLocaleFromPathname, sealSession, sessionCookieOptions, splitCmssyLocale, verifyCmssyWebhook };
+export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, DEFAULT_CMSSY_EDITOR_ORIGINS, assertAuthConfig, defineCmssyConfig, resolveEditorOrigin } from '@cmssy/core';