@jxsuite/server 0.35.0 → 0.36.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxsuite/server",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "Jx development server with live reload, server-side proxy, and studio integration",
   "license": "MIT",
   "repository": {
@@ -31,13 +31,13 @@
     "test:coverage": "bun test --isolate --coverage"
   },
   "dependencies": {
-    "@jxsuite/compiler": "^0.34.1",
-    "@jxsuite/create": "^0.35.0",
-    "@jxsuite/import": "^0.35.0",
-    "@jxsuite/parser": "^0.35.0",
-    "@jxsuite/runtime": "^0.34.1",
-    "@jxsuite/schema": "^0.34.0",
-    "@jxsuite/starters": "^0.35.0",
+    "@jxsuite/compiler": "^0.35.0",
+    "@jxsuite/create": "^0.36.0",
+    "@jxsuite/import": "^0.35.1",
+    "@jxsuite/parser": "^0.35.1",
+    "@jxsuite/runtime": "^0.34.2",
+    "@jxsuite/schema": "^0.35.0",
+    "@jxsuite/starters": "^0.35.1",
     "chokidar": "^5.0.0",
     "zod": "^4.4.3"
   }

package/src/ai-api.ts

@@ -385,7 +385,7 @@ export async function handleModels(req: Request): Promise<Response> {
       { id: "gpt-4o-mini", name: "GPT-4o Mini", contextWindow: 128_000 },
     ];
     return Response.json(
-      { models: defaults, configured: false },
+      { models: defaults, configured: false, managed: false },
       {
         headers: { "Content-Type": "application/json" },
       },
@@ -403,7 +403,7 @@ export async function handleModels(req: Request): Promise<Response> {
       // Upstream failed — return defaults with configured flag so user can still try.
       const defaults = [{ id: "gpt-4o", name: "GPT-4o", contextWindow: 128_000 }];
       return Response.json(
-        { models: defaults, configured: true, upstreamError: upstreamResp.status },
+        { models: defaults, configured: true, managed: false, upstreamError: upstreamResp.status },
         {
           headers: { "Content-Type": "application/json" },
         },
@@ -426,7 +426,7 @@ export async function handleModels(req: Request): Promise<Response> {
     }));
 
     return Response.json(
-      { models, configured: true },
+      { models, configured: true, managed: false },
       {
         headers: { "Content-Type": "application/json" },
       },
@@ -435,7 +435,7 @@ export async function handleModels(req: Request): Promise<Response> {
     // Network error → return defaults.
     const defaults = [{ id: "gpt-4o", name: "GPT-4o", contextWindow: 128_000 }];
     return Response.json(
-      { models: defaults, configured: true, upstreamError: "network" },
+      { models: defaults, configured: true, managed: false, upstreamError: "network" },
       {
         headers: { "Content-Type": "application/json" },
       },

package/src/studio-api.ts

@@ -1072,6 +1072,46 @@ export async function handleStudioApi(
   }
 
   // Discover a plugin module's schema for studio form rendering
+  /* Cloudflare API passthrough — the backend of the publish surface's `cfApi`.
+     Stateless: the credential arrives per-request in X-CF-Token (the user's
+     pasted API token, kept client-side) and is never stored. Only account
+     listing and Pages project/deployment paths are reachable. */
+  if (path === "/__studio/cf/proxy" && req.method === "POST") {
+    const CF_PROXY_ALLOWLIST = [
+      /^\/accounts$/,
+      /^\/accounts\/[0-9a-f]{32}\/pages\/projects(?:\/[\w-]+)?$/,
+      /^\/accounts\/[0-9a-f]{32}\/pages\/projects\/[\w-]+\/deployments(?:\/[\w-]+)?$/,
+      /^\/accounts\/[0-9a-f]{32}\/pages\/projects\/[\w-]+\/deployments\/[\w-]+\/retry$/,
+    ];
+    const cfToken = req.headers.get("X-CF-Token");
+    if (!cfToken) {
+      return Response.json({ error: "Missing X-CF-Token header" }, { status: 401 });
+    }
+    let payload: { path?: string; method?: string; body?: unknown };
+    try {
+      payload = (await req.json()) as typeof payload;
+    } catch {
+      return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+    }
+    const apiPath = payload.path ?? "";
+    if (!CF_PROXY_ALLOWLIST.some((re) => re.test(apiPath))) {
+      return Response.json({ error: `Path not allowed: ${apiPath}` }, { status: 403 });
+    }
+    const method = payload.method ?? "GET";
+    const upstream = await fetch(`https://api.cloudflare.com/client/v4${apiPath}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${cfToken}`,
+        ...(payload.body === undefined ? {} : { "Content-Type": "application/json" }),
+      },
+      ...(payload.body === undefined ? {} : { body: JSON.stringify(payload.body) }),
+    });
+    return new Response(upstream.body, {
+      headers: { "Content-Type": upstream.headers.get("Content-Type") ?? "application/json" },
+      status: upstream.status,
+    });
+  }
+
   // Format capability proxy — studio fallback for capabilities whose timing excludes "client".
   // Dispatches parse/serialize through the project's format registry by import name.
   if (path === "/__studio/format" && req.method === "POST") {