@decocms/blocks-admin 7.3.0 → 7.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks-admin",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "type": "module",
   "description": "Deco admin protocol: /live/_meta, /.decofile, /deco/invoke, /deco/render, plus admin-facing site setup and commerce-app auto-configuration",
   "repository": {
@@ -25,7 +25,7 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.3.0"
+    "@decocms/blocks": "7.4.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/admin/decofile.test.ts

@@ -1,9 +1,19 @@
-import { beforeEach, describe, expect, it } from "vitest";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 import { KV_KEYS, type KVNamespace, getRevision, loadBlocks, setBlocks } from "@decocms/blocks/cms";
 import { handleDecofileReload, setFastDeployKVGetter } from "./decofile";
 
-// In vitest, import.meta.env.DEV is true, so handleDecofileReload skips the
-// auth check (same branch the dev Vite plugin uses) — no token needed here.
+// handleDecofileReload's dev-bypass keys off NODE_ENV === "development" (see
+// decofile.ts), not import.meta.env.DEV. Vitest itself runs with
+// NODE_ENV=test (not "development"), so force it here to preserve this
+// suite's original intent: exercise the reload handler via the same no-auth
+// branch the dev Vite plugin / `next dev` use, without needing a token.
+const ORIGINAL_NODE_ENV = process.env.NODE_ENV;
+beforeAll(() => {
+  process.env.NODE_ENV = "development";
+});
+afterAll(() => {
+  process.env.NODE_ENV = ORIGINAL_NODE_ENV;
+});
 
 // decofile.ts no longer hard-imports getFastDeployKV (that would create a
 // admin → tanstack dependency, which is backwards). Instead the

package/src/admin/decofile.ts

@@ -105,14 +105,23 @@ export async function handleDecofileReload(
   // both the reload token and the fast-deploy KV binding.
   const runtimeEnv = env ?? getRuntimeEnv();
 
-  // In dev mode the Vite plugin POSTs new blocks here to hot-reload without
-  // module invalidation (which breaks TanStack Start/Router state). Skip auth
-  // so the plugin can POST from localhost.
-  // Uses import.meta.env.DEV directly (not isDevMode()) because isDevMode()
-  // bypass auth. Vite statically replaces import.meta.env.DEV with `false`
-  // in production builds, so this branch is dead-code-eliminated.
-  const isViteDev = !!(import.meta as unknown as { env?: { DEV?: boolean } }).env?.DEV;
-  if (!isViteDev) {
+  // In dev mode the Vite plugin (tanstack) or `next dev` POSTs new blocks
+  // here to hot-reload without module invalidation (which breaks TanStack
+  // Start/Router state). Skip auth so the plugin can POST from localhost.
+  //
+  // `import.meta.env?.DEV` was a Vite-ism AND a syntax error for CJS
+  // consumers (ts-jest compiles this raw-TS package to CJS, where
+  // `import.meta` cannot be represented at all). It was also always `false`
+  // under Next.js — Turbopack/webpack never define `import.meta.env` — so
+  // this dev-bypass never applied to `next dev` before this change. Checking
+  // NODE_ENV instead widens the bypass to any Node process with
+  // NODE_ENV=development, including `next dev`. That widening is intentional:
+  // dev environments shouldn't need a production reload token, and the check
+  // remains fail-closed (auth required) for any other NODE_ENV value (unset,
+  // "test", "production").
+  const isDevRuntime =
+    typeof process !== "undefined" && process.env.NODE_ENV === "development";
+  if (!isDevRuntime) {
     const authHeader = request.headers.get("Authorization") || "";
     const expectedToken =
       (runtimeEnv?.DECO_RELEASE_RELOAD_TOKEN as string | undefined) ??

package/src/admin/render.ts

@@ -132,7 +132,6 @@ export async function handleRender(request: Request): Promise<Response> {
   const url = new URL(request.url);
   const resolveChain = url.searchParams.get("resolveChain");
   const propsParam = url.searchParams.get("props");
-  console.log("handleRender", request.url);
 
   const pathPrefix = "/live/previews/";
   const rawPathComponent = url.pathname.startsWith(pathPrefix)