@cmssy/next 9.10.0 → 10.1.0

package/dist/server.cjs

@@ -4,32 +4,13 @@ require('server-only');
 var headers = require('next/headers');
 var navigation = require('next/navigation');
 var react = require('@cmssy/react');
-var client = require('@cmssy/react/client');
+var internal$1 = require('@cmssy/react/internal');
+var internalServer = require('@cmssy/react/internal-server');
+var internal = require('@cmssy/core/internal');
 var core = require('@cmssy/core');
 var jsxRuntime = require('react/jsx-runtime');
 
 // src/server.ts
-async function readValidSession(config) {
-  const auth = core.assertAuthConfig(config);
-  const jar = await headers.cookies();
-  const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  const session = await core.openSession(
-    raw,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  if (!session || core.isAccessExpired(session)) return null;
-  return session;
-}
-async function getCmssyUser(config) {
-  const session = await readValidSession(config);
-  return session?.user ?? null;
-}
-async function getCmssyAccessToken(config) {
-  const session = await readValidSession(config);
-  return session?.accessToken ?? null;
-}
 function hasEditFlag(value) {
   return Array.isArray(value) ? value.includes("1") : value === "1";
 }
@@ -40,7 +21,7 @@ async function resolveEditorRequest(query, draftSecret) {
   if (!hasEditFlag(query[core.CMSSY_EDIT_QUERY_PARAM])) return false;
   const provided = firstValue(query[core.CMSSY_SECRET_QUERY_PARAM]);
   if (!provided || !draftSecret) return false;
-  return core.cmssySecretsMatch(provided, draftSecret);
+  return internal.cmssySecretsMatch(provided, draftSecret);
 }
 function createCmssyPage(config, blocks, options) {
   return buildCmssyPageRenderer(config, blocks, options, false);
@@ -60,7 +41,7 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
     org: config.org,
     workspaceSlug: config.workspaceSlug
   };
-  const client$1 = react.createCmssyClient(clientConfig);
+  const client = react.createCmssyClient(clientConfig);
   const fixedPath = options?.path?.split("/").map((segment) => segment.trim()).filter(Boolean);
   return async function CmssyCatchAllPage({
     params,
@@ -73,27 +54,27 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
       const query = searchParams ? await searchParams : {};
       editorActive = await resolveEditorRequest(query, config.draftSecret);
       if (!editorActive) {
-        if (core.isDevelopment()) {
+        if (internal.isDevelopment()) {
           return renderEditDiagnosticsPage(config, query);
         }
         navigation.notFound();
       }
     }
     const editMode = isEnabled || editorActive;
-    const devAllowed = core.isDevelopment() && Boolean(config.devToken?.trim());
+    const devAllowed = internal.isDevelopment() && Boolean(config.devToken?.trim());
     let locale;
     let pagePath = path;
-    const siteLocales = await react.resolveSiteLocales(clientConfig);
+    const siteLocales = await internal.resolveSiteLocales(clientConfig);
     const { defaultLocale, locales: enabledLocales } = siteLocales;
     if (config.resolveLocale) {
       locale = await config.resolveLocale();
     } else {
-      const split = react.splitLocaleFromPath(path, siteLocales);
+      const split = internal.splitLocaleFromPath(path, siteLocales);
       locale = split.locale;
       pagePath = split.path;
     }
-    const devWorkspaceId = devAllowed ? await client$1.resolveWorkspaceId() : void 0;
-    const page = await react.fetchPage(clientConfig, pagePath, {
+    const devWorkspaceId = devAllowed ? await client.resolveWorkspaceId() : void 0;
+    const page = await internal.fetchPage(clientConfig, pagePath, {
       previewSecret: editMode ? config.draftSecret : void 0,
       devPreview: devAllowed || void 0,
       devToken: devAllowed ? config.devToken : void 0,
@@ -107,7 +88,7 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
         'cmssy: edit/dev mode requires options.editor \u2014 pass a "use client" editor that imports your blocks and renders <CmssyEditablePage blocks={blocks} \u2026 />'
       );
     }
-    const resolvedForms = await react.resolveForms(
+    const resolvedForms = await internal.resolveForms(
       clientConfig,
       page.blocks,
       locale,
@@ -121,7 +102,7 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
     };
     if (editorActive && Editor) {
       const bridgeOrigin = resolveBridgeOrigin(config.editorOrigin);
-      const editorData = await react.resolveEditorBlockData({
+      const editorData = await internalServer.resolveEditorBlockData({
         page,
         blocks,
         locale,
@@ -131,7 +112,7 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
         isPreview: true,
         config
       });
-      return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
+      return /* @__PURE__ */ jsxRuntime.jsx(internal$1.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
         Editor,
         {
           page,
@@ -145,28 +126,17 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
         }
       ) });
     }
-    let auth;
-    if (config.auth) {
-      try {
-        const user = await getCmssyUser(config);
-        auth = {
-          isAuthenticated: !!user,
-          member: user ? { recordId: user.recordId, email: user.email } : null
-        };
-      } catch {
-        auth = void 0;
-      }
-    }
+    const auth = void 0;
     let workspace;
     try {
       workspace = {
-        id: await client$1.resolveWorkspaceId(),
+        id: await client.resolveWorkspaceId(),
         slug: config.workspaceSlug
       };
     } catch {
       workspace = void 0;
     }
-    return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
+    return /* @__PURE__ */ jsxRuntime.jsx(internal$1.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
       react.CmssyServerPage,
       {
         page,
@@ -211,812 +181,18 @@ async function resolveDevOrigin() {
 function resolveBridgeOrigin(editorOrigin) {
   const resolved = core.resolveEditorOrigin(editorOrigin);
   const origins = (Array.isArray(resolved) ? resolved : [resolved]).map(
-    (origin) => core.toCspOrigin(origin.trim())
+    (origin) => internal.toCspOrigin(origin.trim())
   );
   if (origins.length === 0) {
     throw new Error("cmssy: editorOrigin must be set to frame the editor");
   }
-  if (origins.includes("*") && !core.isDevelopment()) {
+  if (origins.includes("*") && !internal.isDevelopment()) {
     throw new Error(
       "cmssy: editorOrigin '*' is only allowed in development; set a concrete editor origin (e.g. https://cmssy.io) for production"
     );
   }
   return origins.length === 1 ? origins[0] : origins;
 }
-function DefaultNotFound() {
-  return /* @__PURE__ */ jsxRuntime.jsxs(
-    "main",
-    {
-      style: {
-        minHeight: "60vh",
-        display: "flex",
-        flexDirection: "column",
-        alignItems: "center",
-        justifyContent: "center",
-        gap: "0.5rem",
-        textAlign: "center",
-        padding: "2rem"
-      },
-      children: [
-        /* @__PURE__ */ jsxRuntime.jsx("h1", { style: { fontSize: "2rem", fontWeight: 700, margin: 0 }, children: "404" }),
-        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: 0, opacity: 0.7 }, children: "Page not found" })
-      ]
-    }
-  );
-}
-function createCmssyNotFound(config, blocks, options) {
-  if (!Array.isArray(blocks)) {
-    throw new Error(
-      "cmssy: createCmssyNotFound(config, blocks) requires a blocks array \u2014 pass your defineBlock(...) array"
-    );
-  }
-  const clientConfig = {
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  };
-  const fallback = options?.fallback ?? /* @__PURE__ */ jsxRuntime.jsx(DefaultNotFound, {});
-  return async function CmssyNotFound() {
-    try {
-      const siteConfig = await react.fetchSiteConfig(clientConfig);
-      const notFoundPageId = siteConfig?.notFoundPageId;
-      if (!notFoundPageId) return fallback;
-      const page = await react.fetchPageById(clientConfig, notFoundPageId);
-      if (!page || page.blocks.length === 0) return fallback;
-      const { defaultLocale, locales: enabledLocales } = await react.resolveSiteLocales(clientConfig);
-      const locale = config.resolveLocale ? await config.resolveLocale() : defaultLocale;
-      const resolvedForms = await react.resolveForms(
-        clientConfig,
-        page.blocks,
-        locale,
-        defaultLocale
-      );
-      const forms = Object.keys(resolvedForms).length > 0 ? resolvedForms : void 0;
-      const localeContext = {
-        current: locale,
-        default: defaultLocale,
-        enabled: enabledLocales
-      };
-      return /* @__PURE__ */ jsxRuntime.jsx(client.CmssyLocaleProvider, { value: localeContext, children: /* @__PURE__ */ jsxRuntime.jsx(
-        react.CmssyServerPage,
-        {
-          page,
-          blocks,
-          locale,
-          defaultLocale,
-          enabledLocales,
-          forms
-        }
-      ) });
-    } catch (err) {
-      if (typeof console !== "undefined") {
-        console.warn("[cmssy] not-found page render failed", err);
-      }
-      return fallback;
-    }
-  };
-}
-async function isCmssyEditMode() {
-  const h = await headers.headers();
-  return h.get(core.CMSSY_EDIT_HEADER) === "1";
-}
-async function getCmssyLocale(config, options) {
-  if (options?.path !== void 0) {
-    return core.localeForPath(config, options.path);
-  }
-  const { headers: headers3 } = await import('next/headers');
-  const headerList = await headers3();
-  const fromHeader = headerList.get(core.CMSSY_LOCALE_HEADER);
-  if (fromHeader) return fromHeader;
-  const { defaultLocale } = await core.resolveSiteLocales(config);
-  return defaultLocale;
-}
-async function CmssyLayoutSlot({
-  config,
-  blocks,
-  position,
-  page = "/",
-  editable
-}) {
-  const editMode = await isCmssyEditMode();
-  const [groups, locale, siteLocales] = await Promise.all([
-    react.fetchLayouts(
-      config,
-      page,
-      editMode ? { previewSecret: config.draftSecret } : void 0
-    ),
-    getCmssyLocale(config),
-    react.resolveSiteLocales(config)
-  ]);
-  if (editMode && editable) {
-    const origin = core.resolveEditorOrigin(config.editorOrigin);
-    const Editable = editable;
-    const editorData = await react.resolveEditorLayoutBlockData({
-      groups,
-      blocks,
-      position,
-      locale,
-      defaultLocale: siteLocales.defaultLocale,
-      enabledLocales: siteLocales.locales,
-      isPreview: true,
-      config
-    });
-    return /* @__PURE__ */ jsxRuntime.jsx(
-      Editable,
-      {
-        groups,
-        position,
-        locale,
-        defaultLocale: siteLocales.defaultLocale,
-        enabledLocales: siteLocales.locales,
-        edit: {
-          editorOrigin: (Array.isArray(origin) ? origin[0] : origin) ?? ""
-        },
-        data: editorData.data,
-        resolvedContent: editorData.content
-      }
-    );
-  }
-  return /* @__PURE__ */ jsxRuntime.jsx(
-    react.CmssyServerLayout,
-    {
-      groups,
-      blocks,
-      position,
-      locale,
-      defaultLocale: siteLocales.defaultLocale,
-      enabledLocales: siteLocales.locales,
-      config,
-      editMode
-    }
-  );
-}
-
-// src/seo-base-url.ts
-function trimTrailingSlash(url) {
-  return url.replace(/\/+$/, "");
-}
-async function resolveSeoBaseUrl(config, option) {
-  if (typeof option === "function") return trimTrailingSlash(await option());
-  if (typeof option === "string" && option) return trimTrailingSlash(option);
-  if (config.siteUrl) return trimTrailingSlash(config.siteUrl);
-  const { headers: headers3 } = await import('next/headers');
-  const h = await headers3();
-  const host = h.get("host");
-  if (!host) return "";
-  const protocol = isLocalHost(host) ? "http" : "https";
-  return `${protocol}://${host}`;
-}
-function isLocalHost(host) {
-  const hostname = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
-  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname === "::1") {
-    return true;
-  }
-  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!ipv4) return false;
-  const [a, b] = [Number(ipv4[1]), Number(ipv4[2])];
-  return a === 127 || a === 0 || a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31;
-}
-function pick(value, locale, defaultLocale) {
-  if (!value) return "";
-  if (typeof value === "string") return value;
-  return value[locale] || value[defaultLocale] || Object.values(value)[0] || "";
-}
-async function buildCmssyMetadata(config, path, options = {}) {
-  const clientConfig = {
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  };
-  const [siteConfig, baseUrl] = await Promise.all([
-    react.fetchSiteConfig(clientConfig).catch(() => null),
-    resolveSeoBaseUrl(config, options.baseUrl)
-  ]);
-  const { defaultLocale, locales: enabledLocales } = core.localesFromSiteConfig(siteConfig);
-  const segments = Array.isArray(path) ? path : path ? path.split("/").filter(Boolean) : void 0;
-  const fromPath = react.splitLocaleFromPath(segments, {
-    defaultLocale,
-    locales: enabledLocales
-  });
-  const locale = options.locale ?? (fromPath.locale !== defaultLocale ? fromPath.locale : await config.resolveLocale?.() ?? defaultLocale);
-  const slug = react.normalizeSlug(fromPath.path);
-  const meta = await react.fetchPageMeta(clientConfig, slug).catch(() => null);
-  const siteName = pick(siteConfig?.siteName, locale, defaultLocale) || siteConfig?.branding?.brandName || void 0;
-  const title = pick(meta?.seoTitle, locale, defaultLocale) || pick(meta?.displayName, locale, defaultLocale) || siteName || "";
-  const description = pick(meta?.seoDescription, locale, defaultLocale);
-  const keywords = meta?.seoKeywords?.length ? meta.seoKeywords : void 0;
-  const image = options.image ?? siteConfig?.branding?.ogImageUrl ?? void 0;
-  const canonical = baseUrl ? `${baseUrl}${core.localizedPath(slug, locale, defaultLocale)}` : void 0;
-  const languages = baseUrl && enabledLocales.length > 1 ? {
-    ...Object.fromEntries(
-      enabledLocales.map((l) => [
-        l,
-        `${baseUrl}${core.localizedPath(slug, l, defaultLocale)}`
-      ])
-    ),
-    // What to serve a reader whose language none of these match.
-    "x-default": `${baseUrl}${core.localizedPath(slug, defaultLocale, defaultLocale)}`
-  } : void 0;
-  return {
-    ...baseUrl ? { metadataBase: new URL(baseUrl) } : {},
-    ...title ? { title } : {},
-    ...description ? { description } : {},
-    ...keywords ? { keywords } : {},
-    ...canonical || languages ? {
-      alternates: {
-        ...canonical ? { canonical } : {},
-        ...languages ? { languages } : {}
-      }
-    } : {},
-    openGraph: {
-      ...title ? { title } : {},
-      ...description ? { description } : {},
-      ...canonical ? { url: canonical } : {},
-      ...siteName ? { siteName } : {},
-      type: options.ogType ?? "website",
-      locale,
-      ...image ? { images: [{ url: image }] } : {}
-    },
-    twitter: {
-      card: image ? options.twitterCard ?? "summary_large_image" : "summary",
-      ...title ? { title } : {},
-      ...description ? { description } : {},
-      ...image ? { images: [image] } : {}
-    }
-  };
-}
-
-// src/create-cmssy-robots.ts
-function createCmssyRobots(config, options = {}) {
-  return async function robots() {
-    const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
-    const rules = options.rules ?? {
-      userAgent: "*",
-      allow: "/",
-      disallow: options.disallow ?? ["/api/"]
-    };
-    const includeSitemap = options.sitemap !== false && Boolean(baseUrl);
-    return {
-      rules,
-      ...includeSitemap ? { sitemap: `${baseUrl}/sitemap.xml` } : {},
-      ...options.host && baseUrl ? { host: baseUrl } : {}
-    };
-  };
-}
-function createCmssySitemap(config, options = {}) {
-  const clientConfig = {
-    apiUrl: config.apiUrl,
-    org: config.org,
-    workspaceSlug: config.workspaceSlug
-  };
-  return async function sitemap() {
-    let pages = [];
-    try {
-      pages = await react.fetchPages(clientConfig);
-    } catch (err) {
-      if (typeof console !== "undefined") {
-        console.warn("[cmssy] sitemap page fetch failed", err);
-      }
-      pages = [];
-    }
-    let siteConfig = null;
-    try {
-      siteConfig = await react.fetchSiteConfig(clientConfig);
-    } catch {
-      siteConfig = null;
-    }
-    const notFoundPageId = siteConfig?.notFoundPageId ?? null;
-    const baseUrl = await resolveSeoBaseUrl(config, options.baseUrl);
-    const { defaultLocale, locales } = core.localesFromSiteConfig(siteConfig);
-    const excluded = new Set((options.excludeSlugs ?? []).map(core.normalizeSlug));
-    const languagesFor = (slug) => locales.length > 1 ? {
-      languages: {
-        ...Object.fromEntries(
-          locales.map((locale) => [
-            locale,
-            `${baseUrl}${core.localizedPath(slug, locale, defaultLocale)}`
-          ])
-        ),
-        "x-default": `${baseUrl}${core.localizedPath(slug, defaultLocale, defaultLocale)}`
-      }
-    } : void 0;
-    const entries = pages.map((page) => ({ ...page, slug: core.normalizeSlug(page.slug) })).filter((page) => page.id !== notFoundPageId && !excluded.has(page.slug)).flatMap((page) => {
-      const lastModified = page.updatedAt ?? page.publishedAt ?? void 0;
-      const alternates = languagesFor(page.slug);
-      return locales.map((locale) => ({
-        url: `${baseUrl}${core.localizedPath(page.slug, locale, defaultLocale)}`,
-        ...lastModified ? { lastModified: new Date(lastModified) } : {},
-        ...alternates ? { alternates } : {}
-      }));
-    });
-    if (!options.extra) return entries;
-    const extra = typeof options.extra === "function" ? await options.extra({ baseUrl, defaultLocale, locales }) : options.extra;
-    return [...entries, ...extra];
-  };
-}
-var MAX_BODY_CHARS = 16 * 1024;
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    }
-  });
-}
-async function readBody(request) {
-  const contentType = request.headers.get("content-type") ?? "";
-  if (!contentType.toLowerCase().includes("application/json")) {
-    throw new Error("content-type must be application/json");
-  }
-  const text = await request.text();
-  if (text.length > MAX_BODY_CHARS) {
-    throw new Error("body too large");
-  }
-  if (!text) return {};
-  const parsed = JSON.parse(text);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("body must be a JSON object");
-  }
-  return parsed;
-}
-function str(value) {
-  return typeof value === "string" ? value : "";
-}
-function plainObject(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return value;
-}
-async function readSession(config, auth) {
-  const jar = await headers.cookies();
-  const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
-  if (!raw) return null;
-  return core.openSession(raw, auth.sessionSecret, config.workspaceSlug);
-}
-async function writeSession(config, auth, payload) {
-  const sealed = await core.sealSession(
-    payload,
-    auth.sessionSecret,
-    config.workspaceSlug
-  );
-  const jar = await headers.cookies();
-  jar.set(core.CMSSY_SESSION_COOKIE, sealed, core.sessionCookieOptions());
-}
-async function clearSession() {
-  const jar = await headers.cookies();
-  jar.set(core.CMSSY_SESSION_COOKIE, "", {
-    ...core.sessionCookieOptions(),
-    maxAge: 0
-  });
-}
-async function refreshSession(config, auth, session) {
-  const result = await core.backendRefresh(config, session.refreshToken);
-  const payload = core.toSessionPayload(result);
-  if (!payload) {
-    await clearSession();
-    return null;
-  }
-  await writeSession(config, auth, payload);
-  return payload;
-}
-function createCmssyAuthRoute(config) {
-  const auth = core.assertAuthConfig(config);
-  async function handleSignIn(body) {
-    const identity = str(body.identity);
-    const password = str(body.password);
-    if (!identity || !password) {
-      return json({ ok: false, message: "Invalid credentials." }, 400);
-    }
-    const result = await core.backendSignIn(
-      config,
-      auth.modelSlug,
-      identity,
-      password
-    );
-    const payload = core.toSessionPayload(result);
-    if (!payload) {
-      return json({ ok: false, message: result.message }, 401);
-    }
-    await writeSession(config, auth, payload);
-    return json({ ok: true, user: payload.user });
-  }
-  async function handleRegister(body) {
-    const identity = str(body.identity);
-    const password = str(body.password);
-    if (!identity || !password) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await core.backendRegister(
-      config,
-      auth.modelSlug,
-      identity,
-      password,
-      plainObject(body.fields)
-    );
-    return json({ ok: result.success, message: result.message });
-  }
-  async function handleSignOut() {
-    const session = await readSession(config, auth);
-    if (session) {
-      await core.backendSignOut(config, session.refreshToken);
-    }
-    await clearSession();
-    return json({ ok: true });
-  }
-  async function handleSignOutEverywhere() {
-    let session = await readSession(config, auth);
-    if (session && core.isAccessExpired(session)) {
-      session = await refreshSession(config, auth, session);
-    }
-    if (session) {
-      await core.backendSignOutEverywhere(config, session.accessToken);
-    }
-    await clearSession();
-    return json({ ok: true });
-  }
-  async function handleRefresh() {
-    const session = await readSession(config, auth);
-    if (!session) {
-      return json({ ok: false, user: null }, 401);
-    }
-    const refreshed = await refreshSession(config, auth, session);
-    if (!refreshed) {
-      return json({ ok: false, user: null }, 401);
-    }
-    return json({ ok: true, user: refreshed.user });
-  }
-  async function handleMe() {
-    let session = await readSession(config, auth);
-    if (session && core.isAccessExpired(session)) {
-      session = await refreshSession(config, auth, session);
-    }
-    return json({ user: session?.user ?? null });
-  }
-  async function handleForgotPassword(body) {
-    const identity = str(body.identity);
-    if (!identity) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await core.backendForgotPassword(
-      config,
-      auth.modelSlug,
-      identity
-    );
-    return json({ ok: result.success, message: result.message });
-  }
-  async function handleResetPassword(body) {
-    const token = str(body.token);
-    const newPassword = str(body.newPassword);
-    if (!token || !newPassword) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await core.backendResetPassword(config, token, newPassword);
-    return json({ ok: result.success, message: result.message });
-  }
-  async function handleVerifyEmail(body) {
-    const token = str(body.token);
-    if (!token) {
-      return json({ ok: false, message: "Invalid input." }, 400);
-    }
-    const result = await core.backendVerifyEmail(config, token);
-    return json({ ok: result.success, message: result.message });
-  }
-  return {
-    async POST(request, context) {
-      const { action } = await context.params;
-      let body;
-      try {
-        body = await readBody(request);
-      } catch {
-        return json({ ok: false, message: "Invalid request body." }, 400);
-      }
-      try {
-        switch (action) {
-          case "sign-in":
-            return await handleSignIn(body);
-          case "register":
-            return await handleRegister(body);
-          case "sign-out":
-            return await handleSignOut();
-          case "sign-out-everywhere":
-            return await handleSignOutEverywhere();
-          case "refresh":
-            return await handleRefresh();
-          case "forgot-password":
-            return await handleForgotPassword(body);
-          case "reset-password":
-            return await handleResetPassword(body);
-          case "verify-email":
-            return await handleVerifyEmail(body);
-          default:
-            return json({ ok: false, message: "Not found." }, 404);
-        }
-      } catch {
-        return json({ ok: false, message: "Something went wrong." }, 500);
-      }
-    },
-    async GET(_request, context) {
-      const { action } = await context.params;
-      if (action !== "me") {
-        return json({ ok: false, message: "Not found." }, 404);
-      }
-      try {
-        return await handleMe();
-      } catch {
-        return json({ user: null });
-      }
-    }
-  };
-}
-var CMSSY_CART_COOKIE = "cmssy_cart";
-var CART_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-var CART_TOKEN_BYTES = 32;
-var MAX_BODY_CHARS2 = 16 * 1024;
-function json2(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    }
-  });
-}
-function cartCookieOptions() {
-  return {
-    httpOnly: true,
-    secure: process.env.NODE_ENV !== "development",
-    sameSite: "lax",
-    path: "/",
-    maxAge: CART_MAX_AGE_SECONDS
-  };
-}
-function mintToken() {
-  const bytes = new Uint8Array(CART_TOKEN_BYTES);
-  crypto.getRandomValues(bytes);
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function readBody2(request) {
-  const contentType = request.headers.get("content-type") ?? "";
-  if (!contentType.toLowerCase().includes("application/json")) {
-    throw new Error("content-type must be application/json");
-  }
-  const text = await request.text();
-  if (text.length > MAX_BODY_CHARS2) throw new Error("body too large");
-  if (!text) return {};
-  const parsed = JSON.parse(text);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("body must be a JSON object");
-  }
-  return parsed;
-}
-function str2(value) {
-  return typeof value === "string" ? value : "";
-}
-function plainObject2(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return value;
-}
-function optionalStr(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-var ADDRESS_REQUIRED = [
-  "name",
-  "line1",
-  "postalCode",
-  "city",
-  "country"
-];
-var CmssyAddressError = class extends Error {
-  constructor(missing) {
-    super(
-      `cmssy: shippingAddress is missing required field(s): ${missing.join(
-        ", "
-      )}. Expected { name, line1, postalCode, city, country } (plus optional company, line2, region, phone, vatId).`
-    );
-    this.missing = missing;
-    this.name = "CmssyAddressError";
-  }
-  missing;
-};
-function shippingAddress(value) {
-  if (value === void 0 || value === null) return null;
-  if (typeof value !== "object" || Array.isArray(value)) {
-    throw new CmssyAddressError([...ADDRESS_REQUIRED]);
-  }
-  const raw = value;
-  const missing = ADDRESS_REQUIRED.filter((key) => !optionalStr(raw[key]));
-  if (missing.length > 0) throw new CmssyAddressError(missing);
-  return {
-    name: optionalStr(raw.name),
-    company: optionalStr(raw.company),
-    line1: optionalStr(raw.line1),
-    line2: optionalStr(raw.line2),
-    postalCode: optionalStr(raw.postalCode),
-    city: optionalStr(raw.city),
-    region: optionalStr(raw.region),
-    country: optionalStr(raw.country),
-    phone: optionalStr(raw.phone),
-    vatId: optionalStr(raw.vatId)
-  };
-}
-function createCmssyCartRoute(config) {
-  async function ensureCartToken() {
-    const jar = await headers.cookies();
-    const existing = jar.get(CMSSY_CART_COOKIE)?.value;
-    if (existing) return existing;
-    const token = mintToken();
-    jar.set(CMSSY_CART_COOKIE, token, cartCookieOptions());
-    return token;
-  }
-  async function clearCartToken() {
-    const jar = await headers.cookies();
-    jar.set(CMSSY_CART_COOKIE, "", { ...cartCookieOptions(), maxAge: 0 });
-  }
-  async function memberAccessToken() {
-    if (!config.auth) return void 0;
-    const jar = await headers.cookies();
-    const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
-    if (!raw) return void 0;
-    const session = await core.openSession(
-      raw,
-      config.auth.sessionSecret,
-      config.workspaceSlug
-    );
-    if (!session || core.isAccessExpired(session)) return void 0;
-    return session.accessToken;
-  }
-  async function buildContext() {
-    const cartToken = await ensureCartToken();
-    const accessToken = await memberAccessToken();
-    return accessToken ? { cartToken, accessToken } : { cartToken };
-  }
-  return {
-    async POST(request, context) {
-      const { action } = await context.params;
-      let body;
-      try {
-        body = await readBody2(request);
-      } catch {
-        return json2({ message: "Invalid request body." }, 400);
-      }
-      try {
-        const ctx = await buildContext();
-        switch (action) {
-          case "cart":
-            return json2({ cart: await core.backendGetCart(config, ctx) });
-          case "add":
-            return json2({
-              cart: await core.backendAddToCart(config, ctx, {
-                recordId: str2(body.recordId),
-                quantity: typeof body.quantity === "number" ? body.quantity : 1,
-                variantSelections: body.variantSelections,
-                notes: typeof body.notes === "string" ? body.notes : void 0
-              })
-            });
-          case "update":
-            return json2({
-              cart: await core.backendUpdateItem(config, ctx, {
-                itemId: str2(body.itemId),
-                quantity: typeof body.quantity === "number" ? body.quantity : 0
-              })
-            });
-          case "remove":
-            return json2({
-              cart: await core.backendRemoveItem(config, ctx, str2(body.itemId))
-            });
-          case "clear":
-            return json2({ cart: await core.backendClearCart(config, ctx) });
-          case "apply-discount":
-            return json2({
-              cart: await core.backendApplyDiscount(config, ctx, str2(body.code))
-            });
-          case "remove-discount":
-            return json2({ cart: await core.backendRemoveDiscount(config, ctx) });
-          case "set-shipping":
-            return json2({
-              cart: await core.backendSetShippingMethod(
-                config,
-                ctx,
-                optionalStr(body.shippingMethodId)
-              )
-            });
-          case "merge":
-            return json2({ cart: await core.backendMergeCart(config, ctx) });
-          case "checkout": {
-            const order = await core.backendCheckout(config, ctx, {
-              customerEmail: str2(body.customerEmail),
-              poNumber: optionalStr(body.poNumber),
-              customerNote: optionalStr(body.customerNote),
-              shippingAddress: shippingAddress(body.shippingAddress)
-            });
-            await clearCartToken();
-            return json2({ order });
-          }
-          case "product":
-            return json2({
-              product: await core.backendProduct(
-                config,
-                ctx,
-                str2(body.modelSlug),
-                plainObject2(body.filter)
-              )
-            });
-          default:
-            return json2({ message: "Not found." }, 404);
-        }
-      } catch (err) {
-        if (err instanceof CmssyAddressError) {
-          return json2({ message: err.message, missing: err.missing }, 400);
-        }
-        return json2(
-          {
-            message: err instanceof Error ? err.message : "Commerce request failed"
-          },
-          502
-        );
-      }
-    }
-  };
-}
-var DEFAULT_LIMIT = 20;
-var MAX_LIMIT = 100;
-function json3(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    }
-  });
-}
-function createCmssyOrdersRoute(config) {
-  async function memberAccessToken() {
-    if (!config.auth) return void 0;
-    const jar = await headers.cookies();
-    const raw = jar.get(core.CMSSY_SESSION_COOKIE)?.value;
-    if (!raw) return void 0;
-    const session = await core.openSession(
-      raw,
-      config.auth.sessionSecret,
-      config.workspaceSlug
-    );
-    if (!session || core.isAccessExpired(session)) return void 0;
-    return session.accessToken;
-  }
-  return {
-    async GET(request) {
-      const accessToken = await memberAccessToken();
-      if (!accessToken) {
-        return json3({ message: "Not signed in." }, 401);
-      }
-      const url = new URL(request.url);
-      try {
-        const id = url.searchParams.get("id");
-        if (id) {
-          return json3({ order: await core.backendMyOrder(config, accessToken, id) });
-        }
-        const skip = Math.max(
-          0,
-          Math.floor(Number(url.searchParams.get("skip")) || 0)
-        );
-        const limitParam = Math.floor(Number(url.searchParams.get("limit")));
-        const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(limitParam, MAX_LIMIT) : DEFAULT_LIMIT;
-        const result = await core.backendMyOrders(config, accessToken, {
-          skip,
-          limit
-        });
-        return json3(result);
-      } catch (err) {
-        return json3(
-          { message: err instanceof Error ? err.message : "Orders error" },
-          502
-        );
-      }
-    }
-  };
-}
 var MIN_SECRET_LENGTH = 16;
 function safeRedirect(redirect2, fallback) {
   if (!redirect2 || !redirect2.startsWith("/")) return fallback;
@@ -1053,7 +229,7 @@ function createDraftRoute(config) {
       );
     }
     const secret = url.searchParams.get("secret");
-    if (!secret || !await core.cmssySecretsMatch(secret, config.draftSecret)) {
+    if (!secret || !await internal.cmssySecretsMatch(secret, config.draftSecret)) {
       return new Response("Invalid draft secret", { status: 401 });
     }
     const location = safeRedirect(
@@ -1065,37 +241,12 @@ function createDraftRoute(config) {
     navigation.redirect(location);
   };
 }
-async function requestLocale(config) {
-  try {
-    return await getCmssyLocale(config);
-  } catch {
-    return void 0;
-  }
-}
-async function fetchProducts(config, options) {
-  const locale = options.locale ?? await requestLocale(config);
-  return core.fetchProducts(config, { ...options, locale });
-}
-async function fetchProduct(config, options) {
-  const locale = options.locale ?? await requestLocale(config);
-  return core.fetchProduct(config, { ...options, locale });
+async function isCmssyEditMode() {
+  const h = await headers.headers();
+  return h.get(core.CMSSY_EDIT_HEADER) === "1";
 }
 
-exports.CMSSY_CART_COOKIE = CMSSY_CART_COOKIE;
-exports.CmssyLayoutSlot = CmssyLayoutSlot;
-exports.buildCmssyMetadata = buildCmssyMetadata;
-exports.createCmssyAuthRoute = createCmssyAuthRoute;
-exports.createCmssyCartRoute = createCmssyCartRoute;
 exports.createCmssyEditPage = createCmssyEditPage;
-exports.createCmssyNotFound = createCmssyNotFound;
-exports.createCmssyOrdersRoute = createCmssyOrdersRoute;
 exports.createCmssyPage = createCmssyPage;
-exports.createCmssyRobots = createCmssyRobots;
-exports.createCmssySitemap = createCmssySitemap;
 exports.createDraftRoute = createDraftRoute;
-exports.fetchProduct = fetchProduct;
-exports.fetchProducts = fetchProducts;
-exports.getCmssyAccessToken = getCmssyAccessToken;
-exports.getCmssyLocale = getCmssyLocale;
-exports.getCmssyUser = getCmssyUser;
 exports.isCmssyEditMode = isCmssyEditMode;