@crombolo/next-integration 0.0.0-stage → 0.37.0

package/dist/session.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Cookies the integration keeps (story 208): a member's tokens and a sign-in in
+ * progress, sealed with AES-GCM under `CROMBOLO_NEXT_SECRET`, and the editor's
+ * preview token. Web Crypto only, so it runs in Node and at the edge alike.
+ */
+export declare const SESSION_COOKIE = "crombolo_member";
+export declare const SIGN_IN_COOKIE = "crombolo_sign_in";
+export declare const PREVIEW_COOKIE = "crombolo_preview";
+export interface MemberSession {
+    accessToken: string;
+    refreshToken?: string;
+    /** When the access token stops working, in milliseconds since the epoch. */
+    expiresAt: number;
+}
+export interface SignInState {
+    state: string;
+    verifier: string;
+    returnTo: string;
+}
+/** The secret sessions are sealed with; refused when shorter than 32 characters. */
+export declare function sessionSecret(secret: string | undefined): string;
+/** A value sealed so only a holder of the secret can read or forge it. */
+export declare function seal(value: unknown, secret: string): Promise<string>;
+/** The value back, or undefined when it was tampered with or sealed under another secret. */
+export declare function unseal<T>(sealed: string | undefined, secret: string): Promise<T | undefined>;
+/** A random value for PKCE and `state`. */
+export declare function randomToken(bytes?: number): string;
+/** PKCE's S256 challenge for a verifier. */
+export declare function challengeFor(verifier: string): Promise<string>;
+/** Whether two secrets match, taking the same time whatever they hold. */
+export declare function sameSecret(given: string | null, expected: string): Promise<boolean>;
+/** A cookie's value from a `Cookie` header. */
+export declare function readCookie(header: string | null, name: string): string | undefined;
+/** A `Set-Cookie` value: http-only, `SameSite=Lax`, and `Secure` unless on plain http. */
+export declare function cookie(name: string, value: string, options?: {
+    maxAge?: number;
+    secure?: boolean;
+    path?: string;
+}): string;

package/dist/session.js

@@ -0,0 +1,96 @@
+/**
+ * Cookies the integration keeps (story 208): a member's tokens and a sign-in in
+ * progress, sealed with AES-GCM under `CROMBOLO_NEXT_SECRET`, and the editor's
+ * preview token. Web Crypto only, so it runs in Node and at the edge alike.
+ */
+export const SESSION_COOKIE = 'crombolo_member';
+export const SIGN_IN_COOKIE = 'crombolo_sign_in';
+export const PREVIEW_COOKIE = 'crombolo_preview';
+/** The secret sessions are sealed with; refused when shorter than 32 characters. */
+export function sessionSecret(secret) {
+    if (!secret || secret.length < 32)
+        throw new Error('CROMBOLO_NEXT_SECRET must be set to at least 32 characters to keep members signed in.');
+    return secret;
+}
+const encoder = new TextEncoder();
+function base64url(bytes) {
+    let text = '';
+    for (const byte of bytes)
+        text += String.fromCharCode(byte);
+    return btoa(text).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+function fromBase64url(value) {
+    const text = atob(value.replaceAll('-', '+').replaceAll('_', '/'));
+    const bytes = new Uint8Array(text.length);
+    for (let i = 0; i < text.length; i++)
+        bytes[i] = text.charCodeAt(i);
+    return bytes;
+}
+async function keyFor(secret) {
+    const digest = await crypto.subtle.digest('SHA-256', encoder.encode(secret));
+    return crypto.subtle.importKey('raw', digest, 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+/** A value sealed so only a holder of the secret can read or forge it. */
+export async function seal(value, secret) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const sealed = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await keyFor(secret), encoder.encode(JSON.stringify(value)));
+    return `${base64url(iv)}.${base64url(new Uint8Array(sealed))}`;
+}
+/** The value back, or undefined when it was tampered with or sealed under another secret. */
+export async function unseal(sealed, secret) {
+    if (!sealed)
+        return undefined;
+    const [iv, data] = sealed.split('.');
+    if (!iv || !data)
+        return undefined;
+    try {
+        const opened = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: fromBase64url(iv) }, await keyFor(secret), fromBase64url(data));
+        return JSON.parse(new TextDecoder().decode(opened));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A random value for PKCE and `state`. */
+export function randomToken(bytes = 32) {
+    return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+/** PKCE's S256 challenge for a verifier. */
+export async function challengeFor(verifier) {
+    return base64url(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(verifier))));
+}
+/** Whether two secrets match, taking the same time whatever they hold. */
+export async function sameSecret(given, expected) {
+    if (!given)
+        return false;
+    const [a, b] = await Promise.all([given, expected].map(async (v) => new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(v)))));
+    const left = a;
+    const right = b;
+    let difference = 0;
+    for (let i = 0; i < left.length; i++)
+        difference |= left[i] ^ right[i];
+    return difference === 0;
+}
+/** A cookie's value from a `Cookie` header. */
+export function readCookie(header, name) {
+    for (const part of (header ?? '').split(';')) {
+        const at = part.indexOf('=');
+        if (at > 0 && part.slice(0, at).trim() === name)
+            return decodeURIComponent(part.slice(at + 1).trim());
+    }
+    return undefined;
+}
+/** A `Set-Cookie` value: http-only, `SameSite=Lax`, and `Secure` unless on plain http. */
+export function cookie(name, value, options = {}) {
+    const parts = [
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${options.path ?? '/'}`,
+        'HttpOnly',
+        'SameSite=Lax',
+    ];
+    if (options.maxAge !== undefined)
+        parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
+    if (options.secure !== false)
+        parts.push('Secure');
+    return parts.join('; ');
+}

package/package.json

@@ -1,6 +1,88 @@
 {
   "name": "@crombolo/next-integration",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.37.0",
+  "description": "A Next.js App Router front end for a crombolo site: pages, metadata, preview, revalidation, members, images and content components.",
+  "license": "MIT",
+  "author": "Crombolo",
+  "homepage": "https://github.com/kineco-au/crombolo-cms#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kineco-au/crombolo-cms.git",
+    "directory": "packages/next-integration"
+  },
+  "bugs": {
+    "url": "https://github.com/kineco-au/crombolo-cms/issues"
+  },
+  "keywords": [
+    "crombolo",
+    "nextjs",
+    "headless"
+  ],
+  "engines": {
+    "bun": ">=1.3.0"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./cache-16": {
+      "types": "./dist/cache-16.d.ts",
+      "import": "./dist/cache-16.js",
+      "default": "./dist/cache-16.js"
+    },
+    "./cache-15": {
+      "types": "./dist/cache-15.d.ts",
+      "import": "./dist/cache-15.js",
+      "default": "./dist/cache-15.js"
+    },
+    "./route-handlers": {
+      "types": "./dist/route-handlers.d.ts",
+      "import": "./dist/route-handlers.js",
+      "default": "./dist/route-handlers.js"
+    },
+    "./middleware": {
+      "types": "./dist/middleware.d.ts",
+      "import": "./dist/middleware.js",
+      "default": "./dist/middleware.js"
+    },
+    "./components": {
+      "types": "./dist/components.d.ts",
+      "import": "./dist/components.js",
+      "default": "./dist/components.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js",
+      "default": "./dist/client.js"
+    },
+    "./image-loader": {
+      "types": "./dist/image-loader.d.ts",
+      "import": "./dist/image-loader.js",
+      "default": "./dist/image-loader.js"
+    }
+  },
+  "files": [
+    "dist",
+    "NOTICE"
+  ],
+  "dependencies": {
+    "@crombolo/common": "0.37.0",
+    "@crombolo/delivery-client": "0.37.0"
+  },
+  "peerDependencies": {
+    "next": ">=15.5 <17",
+    "react": ">=19"
+  },
+  "devDependencies": {
+    "@types/react": "19.3.0",
+    "next": "16.4.3",
+    "react": "19.3.1",
+    "react-dom": "19.3.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.