@obelism/content 0.28.3 → 0.29.0

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { TokenSource } from './oidc.mjs';
-import { R as RichTextFormat, E as Entry, a as RedirectList, b as Redirect, c as EntryList, M as ModelFile, A as Asset, B as Block, I as ImproveBlock, S as ShopifyItem, L as LinkTarget, d as Link, e as EntryStub, f as RichTextNode } from './types-b6jbj3g6.js';
-export { g as AssetProduct, C as ContentTypeAccent, h as ContentTypeDefinition, i as ContentTypeKind, j as Environment, F as FieldCondition, k as FieldDefinition, l as FieldGroup, m as FieldType, n as RichTextDocument, o as RichTextMark } from './types-b6jbj3g6.js';
+import { R as RichTextFormat, E as Entry, a as RedirectList, b as Redirect, c as EntryList, M as ModelFile, A as Asset, B as Block, I as ImproveBlock, S as ShopifyItem, L as LinkTarget, d as Link, e as EntryStub, f as RichTextNode } from './types-mqo1osjh.js';
+export { g as AssetProduct, C as ContentTypeAccent, h as ContentTypeDefinition, i as ContentTypeKind, j as Environment, F as FieldCondition, k as FieldDefinition, l as FieldGroup, m as FieldType, n as RichTextDocument, o as RichTextMark } from './types-mqo1osjh.js';
 
 type ContentClientOptions = {
     token: TokenSource;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { TokenSource } from './oidc.js';
-import { R as RichTextFormat, E as Entry, a as RedirectList, b as Redirect, c as EntryList, M as ModelFile, A as Asset, B as Block, I as ImproveBlock, S as ShopifyItem, L as LinkTarget, d as Link, e as EntryStub, f as RichTextNode } from './types-b6jbj3g6.js';
-export { g as AssetProduct, C as ContentTypeAccent, h as ContentTypeDefinition, i as ContentTypeKind, j as Environment, F as FieldCondition, k as FieldDefinition, l as FieldGroup, m as FieldType, n as RichTextDocument, o as RichTextMark } from './types-b6jbj3g6.js';
+import { R as RichTextFormat, E as Entry, a as RedirectList, b as Redirect, c as EntryList, M as ModelFile, A as Asset, B as Block, I as ImproveBlock, S as ShopifyItem, L as LinkTarget, d as Link, e as EntryStub, f as RichTextNode } from './types-mqo1osjh.js';
+export { g as AssetProduct, C as ContentTypeAccent, h as ContentTypeDefinition, i as ContentTypeKind, j as Environment, F as FieldCondition, k as FieldDefinition, l as FieldGroup, m as FieldType, n as RichTextDocument, o as RichTextMark } from './types-mqo1osjh.js';
 
 type ContentClientOptions = {
     token: TokenSource;

package/dist/index.js

@@ -33,6 +33,9 @@ const fieldParams = (fields)=>Object.fromEntries(Object.entries(fields ?? {}).ma
         ];
     }));
 const trimSlashes = (path)=>path.replace(/^\/+|\/+$/g, '');
+// `/space_…/<environment>`: the part of a scoped delivery path between
+// DELIVERY_PATH and the operation.
+const SCOPE = /^\/space_[^/]+\/[^/]+$/;
 // Reads one space environment's content through the delivery API. The token
 // decides the space, the environment and whether drafts are visible (for a
 // host token, with `drafts`).
@@ -42,11 +45,17 @@ const trimSlashes = (path)=>path.replace(/^\/+|\/+$/g, '');
 class ContentClient {
     #token;
     #place;
+    // Where the API answers this client's token: it sends a token that reads
+    // published content to `/api/delivery/v1/{space}/{environment}/…` with a
+    // 308, so the client asks there directly after the first one. Never used
+    // for a request that reads drafts, which the scoped path refuses.
+    #scope;
     #defaults;
     #timeout;
     #init;
     #fetch;
     constructor({ token, drafts, space, environment, url, locale, depth, richText, timeout, init, fetch: fetchImpl }){
+        this.#scope = null;
         // The page at a path (`blog/hello`), or null when there is none. A site's
         // catch-all route asks for this. The path is looked up in `locale`'s
         // paths (the default locale's when left out or `*`): pages can have a
@@ -171,7 +180,7 @@ class ContentClient {
     }
     // For a 404, null when `notFound` is set, or the body as is for 'body';
     // throws ContentApiError otherwise.
-    async #request(path, query, { init, ...options }, { notFound = false, defaults = true } = {}) {
+    async #request(path, query, { init, ...options }, { notFound = false, defaults = true, scoped = true } = {}) {
         // Checked here rather than in the constructor, so a module creating a
         // client still loads (and a build still runs) without the variable.
         if (!this.#token) throw new Error('ContentClient needs a token');
@@ -190,7 +199,8 @@ class ContentClient {
             if (value !== undefined) params.set(key, String(value));
         }
         const search = params.size > 0 ? `?${params}` : '';
-        const url = `${this.url}${config.DELIVERY_PATH}${path}${search}`;
+        const scope = drafts || !scoped ? null : this.#scope;
+        const url = `${this.url}${config.DELIVERY_PATH}${scope ?? ''}${path}${search}`;
         const merged = {
             ...this.#init,
             ...init
@@ -215,6 +225,21 @@ class ContentClient {
                 timeout
             ]) : timeout
         });
+        // A token that changed, or now reads drafts, is refused on the path
+        // learned for the one before it: ask unscoped once, and learn again.
+        if (scope && (response.status === 401 || response.status === 403)) {
+            if (this.#scope === scope) this.#scope = null;
+            await response.body?.cancel();
+            return this.#request(path, query, {
+                init,
+                ...options
+            }, {
+                notFound,
+                defaults,
+                scoped: false
+            });
+        }
+        if (!scope && !drafts && response.redirected) this.#learnScope(response, path);
         if (notFound === true && response.status === 404) return null;
         const text = await response.text();
         let body = text;
@@ -229,6 +254,18 @@ class ContentClient {
         if (!response.ok) throw new ContentApiError(response.status, url, body);
         return body;
     }
+    #learnScope(response, path) {
+        let redirected;
+        try {
+            redirected = new URL(response.url);
+        } catch  {
+            return;
+        }
+        const { origin, pathname } = redirected;
+        if (origin !== new URL(this.url).origin || !pathname.startsWith(`${config.DELIVERY_PATH}/`) || !pathname.endsWith(path)) return;
+        const scope = pathname.slice(config.DELIVERY_PATH.length, pathname.length - path.length);
+        if (SCOPE.test(scope)) this.#scope = scope;
+    }
 }
 const withoutUndefined = (value)=>Object.fromEntries(Object.entries(value).filter(([, entry])=>entry !== undefined));
 const headersToObject = (headers)=>headers ? Object.fromEntries(new Headers(headers)) : {};
@@ -277,11 +314,14 @@ const isImproveBlock = (block)=>block._type === IMPROVE_BLOCK;
 // improve's SDK returned for the visitor (getTestValue / getFlagValue). It
 // is null when the test or flag isn't active or the visitor isn't in it;
 // then, or for an option the block has no variant for, the `fallback`
-// option's variant, else the first one (usually the control).
+// option's variant, else the first one.
 const pickImproveVariant = (block, option, fallback)=>{
     const variants = block.variants ?? {};
     if (option && variants[option]) return variants[option];
-    if (fallback && variants[fallback]) return variants[fallback];
+    // The arm Improve gives a visitor outside the test, when the caller names
+    // none: it is not always the first variant.
+    const behind = fallback ?? block.fallback;
+    if (behind && variants[behind]) return variants[behind];
     return Object.values(variants)[0] ?? [];
 };
 

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { n as normalizeUrl, a as DEFAULT_TIMEOUT, b as DELIVERY_PATH, D as DEFAULT_URL } from './config-c6qktlz6.mjs';
-export { E as ENTRY_ATTRIBUTE, P as PREVIEW_PARAMS, b as PRODUCT_ATTRIBUTE, c as PRODUCT_HANDLE_ATTRIBUTE, U as UID_ATTRIBUTE, e as editable, d as editableCollection, f as editableProduct, r as readPreviewParams } from './preview-el7sfk3h.mjs';
+export { E as ENTRY_ATTRIBUTE, P as PREVIEW_PARAMS, c as PRODUCT_ATTRIBUTE, b as PRODUCT_HANDLE_ATTRIBUTE, U as UID_ATTRIBUTE, e as editable, d as editableCollection, f as editableProduct, r as readPreviewParams } from './preview-9qff497d.mjs';
 
 // A response from the API that wasn't a success. `message` is the API's own
 // `error` text when it sent one.
@@ -31,6 +31,9 @@ const fieldParams = (fields)=>Object.fromEntries(Object.entries(fields ?? {}).ma
         ];
     }));
 const trimSlashes = (path)=>path.replace(/^\/+|\/+$/g, '');
+// `/space_…/<environment>`: the part of a scoped delivery path between
+// DELIVERY_PATH and the operation.
+const SCOPE = /^\/space_[^/]+\/[^/]+$/;
 // Reads one space environment's content through the delivery API. The token
 // decides the space, the environment and whether drafts are visible (for a
 // host token, with `drafts`).
@@ -40,11 +43,17 @@ const trimSlashes = (path)=>path.replace(/^\/+|\/+$/g, '');
 class ContentClient {
     #token;
     #place;
+    // Where the API answers this client's token: it sends a token that reads
+    // published content to `/api/delivery/v1/{space}/{environment}/…` with a
+    // 308, so the client asks there directly after the first one. Never used
+    // for a request that reads drafts, which the scoped path refuses.
+    #scope;
     #defaults;
     #timeout;
     #init;
     #fetch;
     constructor({ token, drafts, space, environment, url, locale, depth, richText, timeout, init, fetch: fetchImpl }){
+        this.#scope = null;
         // The page at a path (`blog/hello`), or null when there is none. A site's
         // catch-all route asks for this. The path is looked up in `locale`'s
         // paths (the default locale's when left out or `*`): pages can have a
@@ -169,7 +178,7 @@ class ContentClient {
     }
     // For a 404, null when `notFound` is set, or the body as is for 'body';
     // throws ContentApiError otherwise.
-    async #request(path, query, { init, ...options }, { notFound = false, defaults = true } = {}) {
+    async #request(path, query, { init, ...options }, { notFound = false, defaults = true, scoped = true } = {}) {
         // Checked here rather than in the constructor, so a module creating a
         // client still loads (and a build still runs) without the variable.
         if (!this.#token) throw new Error('ContentClient needs a token');
@@ -188,7 +197,8 @@ class ContentClient {
             if (value !== undefined) params.set(key, String(value));
         }
         const search = params.size > 0 ? `?${params}` : '';
-        const url = `${this.url}${DELIVERY_PATH}${path}${search}`;
+        const scope = drafts || !scoped ? null : this.#scope;
+        const url = `${this.url}${DELIVERY_PATH}${scope ?? ''}${path}${search}`;
         const merged = {
             ...this.#init,
             ...init
@@ -213,6 +223,21 @@ class ContentClient {
                 timeout
             ]) : timeout
         });
+        // A token that changed, or now reads drafts, is refused on the path
+        // learned for the one before it: ask unscoped once, and learn again.
+        if (scope && (response.status === 401 || response.status === 403)) {
+            if (this.#scope === scope) this.#scope = null;
+            await response.body?.cancel();
+            return this.#request(path, query, {
+                init,
+                ...options
+            }, {
+                notFound,
+                defaults,
+                scoped: false
+            });
+        }
+        if (!scope && !drafts && response.redirected) this.#learnScope(response, path);
         if (notFound === true && response.status === 404) return null;
         const text = await response.text();
         let body = text;
@@ -227,6 +252,18 @@ class ContentClient {
         if (!response.ok) throw new ContentApiError(response.status, url, body);
         return body;
     }
+    #learnScope(response, path) {
+        let redirected;
+        try {
+            redirected = new URL(response.url);
+        } catch  {
+            return;
+        }
+        const { origin, pathname } = redirected;
+        if (origin !== new URL(this.url).origin || !pathname.startsWith(`${DELIVERY_PATH}/`) || !pathname.endsWith(path)) return;
+        const scope = pathname.slice(DELIVERY_PATH.length, pathname.length - path.length);
+        if (SCOPE.test(scope)) this.#scope = scope;
+    }
 }
 const withoutUndefined = (value)=>Object.fromEntries(Object.entries(value).filter(([, entry])=>entry !== undefined));
 const headersToObject = (headers)=>headers ? Object.fromEntries(new Headers(headers)) : {};
@@ -275,11 +312,14 @@ const isImproveBlock = (block)=>block._type === IMPROVE_BLOCK;
 // improve's SDK returned for the visitor (getTestValue / getFlagValue). It
 // is null when the test or flag isn't active or the visitor isn't in it;
 // then, or for an option the block has no variant for, the `fallback`
-// option's variant, else the first one (usually the control).
+// option's variant, else the first one.
 const pickImproveVariant = (block, option, fallback)=>{
     const variants = block.variants ?? {};
     if (option && variants[option]) return variants[option];
-    if (fallback && variants[fallback]) return variants[fallback];
+    // The arm Improve gives a visitor outside the test, when the caller names
+    // none: it is not always the first variant.
+    const behind = fallback ?? block.fallback;
+    if (behind && variants[behind]) return variants[behind];
     return Object.values(variants)[0] ?? [];
 };
 

package/dist/{preview-el7sfk3h.mjs → preview-9qff497d.mjs}

@@ -100,4 +100,4 @@ const readPreviewParams = (input)=>{
     };
 };
 
-export { COLLECTION_ATTRIBUTE as C, ENTRY_ATTRIBUTE as E, PREVIEW_PARAMS as P, UID_ATTRIBUTE as U, COLLECTION_HANDLE_ATTRIBUTE as a, PRODUCT_ATTRIBUTE as b, PRODUCT_HANDLE_ATTRIBUTE as c, editableCollection as d, editable as e, editableProduct as f, readPreviewParams as r };
+export { COLLECTION_HANDLE_ATTRIBUTE as C, ENTRY_ATTRIBUTE as E, PREVIEW_PARAMS as P, UID_ATTRIBUTE as U, COLLECTION_ATTRIBUTE as a, PRODUCT_HANDLE_ATTRIBUTE as b, PRODUCT_ATTRIBUTE as c, editableCollection as d, editable as e, editableProduct as f, readPreviewParams as r };

package/dist/site-j5kqgtj3.js

@@ -0,0 +1,368 @@
+var config = require('./config-ci2hxmas.js');
+
+// The cookies in a `Cookie` header or `document.cookie`, by name: the first
+// of each name, percent-decoded when it decodes.
+const parseCookies = (header)=>{
+    const cookies = new Map();
+    for (const part of header.split(';')){
+        const index = part.indexOf('=');
+        if (index < 0) continue;
+        const name = part.slice(0, index).trim();
+        if (!name || cookies.has(name)) continue;
+        try {
+            cookies.set(name, decodeURIComponent(part.slice(index + 1).trim()));
+        } catch  {
+            cookies.set(name, part.slice(index + 1).trim());
+        }
+    }
+    return cookies;
+};
+
+// What a site's shop pages come in: the bridge's SHOP table is keyed by the
+// type, and the site's API routes are built from the list.
+const SHOP_KINDS = [
+    'product',
+    'collection'
+];
+
+// Every call the bridge makes through the site's `/cms/api/…`, and what the
+// site's handler (`createSiteEditing`, ./site) lets through: one list, so a
+// call the bridge makes can't be one the proxy refuses.
+//
+// The bridge goes through the site because the CMS token stays in an httpOnly
+// cookie on it (the CMS's docs/adr/0010).
+const entryPath = (entryId, suffix = '')=>`entries/${encodeURIComponent(entryId)}${suffix}`;
+const siteApi = {
+    session: ()=>'session',
+    pages: ()=>'pages',
+    stats: ()=>'stats',
+    form: ()=>'form',
+    createEntry: ()=>'entries',
+    shopPages: (kind)=>`${kind}-pages`,
+    entry: (entryId)=>entryPath(entryId),
+    preview: (entryId)=>entryPath(entryId, '/preview'),
+    prompt: (entryId)=>entryPath(entryId, '/prompt'),
+    view: (entryId)=>entryPath(entryId, '/view'),
+    apply: (entryId)=>entryPath(entryId, '/apply'),
+    save: (entryId)=>entryPath(entryId, '/save'),
+    publish: (entryId)=>entryPath(entryId, '/publish')
+};
+// Each call's route on the CMS's site API, as the site's proxy matches it: an
+// entry id is one path segment of word characters or dashes.
+const ROUTE = {
+    session: 'session',
+    pages: 'pages',
+    stats: 'stats',
+    form: 'form',
+    createEntry: 'entries',
+    shopPages: `(?:${SHOP_KINDS.join('|')})-pages`,
+    entry: 'entries/[\\w-]+',
+    preview: 'entries/[\\w-]+/preview',
+    prompt: 'entries/[\\w-]+/prompt',
+    view: 'entries/[\\w-]+/view',
+    apply: 'entries/[\\w-]+/apply',
+    save: 'entries/[\\w-]+/save',
+    publish: 'entries/[\\w-]+/publish'
+};
+// The method each call is made with. The proxy lets only that one through.
+const SITE_METHOD = {
+    session: 'GET',
+    pages: 'GET',
+    stats: 'POST',
+    form: 'POST',
+    createEntry: 'POST',
+    shopPages: 'POST',
+    entry: 'GET',
+    preview: 'POST',
+    prompt: 'POST',
+    view: 'POST',
+    apply: 'POST',
+    save: 'POST',
+    publish: 'POST'
+};
+// Whether the site's proxy lets this method and route through.
+const siteApiAllows = (method, route)=>Object.keys(siteApi).some((name)=>SITE_METHOD[name] === method && new RegExp(`^${ROUTE[name]}$`).test(route));
+
+// Editing on your own site, outside the visual editor
+// (https://content.obelism.studio/docs/guides/site-editing). One handler
+// serves everything under `/cms` (the `basePath`) on your site:
+//
+// - `/cms/login?return_to=/pricing` — sends the browser to Obelism Content
+//   to sign in, with a PKCE challenge, and…
+// - `/cms/callback` — …takes it back: trades the one-time code for a site
+//   token, keeps it in an httpOnly cookie, calls `onSignIn` (turn on your
+//   framework's draft mode there) and returns to `return_to`.
+// - `/cms/logout` — ends the session in the CMS, clears the cookies, calls
+//   `onSignOut`.
+// - `/cms/api/…` — what the bridge's prompt bar calls in the browser,
+//   forwarded to the CMS with the token. The token never reaches page
+//   scripts.
+//
+// While signed in, render drafts by reading the delivery API with the token
+// (`readSiteToken`), and the bridge shows the prompt bar with Save and
+// Publish.
+const SITE_TOKEN_COOKIE = 'obelism_content_token';
+// Readable by the page: tells the bridge the site is being edited, and where
+// this handler lives. Holds no secret.
+const SITE_EDITING_COOKIE = 'obelism_content_editing';
+const FLOW_COOKIE = 'obelism_content_flow';
+// The bridge sends it with every write, which a cross-site form can't.
+const SITE_REQUEST_HEADER = 'x-obelism-content';
+const SITE_PATH = '/api/site/v1';
+const FLOW_MAX_AGE = 10 * 60;
+// The site token from a Cookie header (or a framework's cookie store), or
+// null when not signed in to edit:
+//
+//   const token = readSiteToken(request.headers.get('cookie'))
+//   const content = token ? new ContentClient({ token, init: { cache: 'no-store' } }) : delivery
+const readSiteToken = (cookies)=>{
+    if (!cookies) return null;
+    if (typeof cookies !== 'string') return cookies.get(SITE_TOKEN_COOKIE)?.value || null;
+    return parseCookies(cookies).get(SITE_TOKEN_COOKIE) || null;
+};
+const serializeCookie = (name, value, { maxAge, path, httpOnly, secure })=>[
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${path}`,
+        `Max-Age=${Math.max(0, Math.floor(maxAge))}`,
+        // Also Expires: Next.js re-serializes response cookies when draft mode
+        // changes, and drops a Max-Age of 0.
+        `Expires=${new Date(maxAge > 0 ? Date.now() + maxAge * 1000 : 0).toUTCString()}`,
+        'SameSite=Lax',
+        httpOnly && 'HttpOnly',
+        secure && 'Secure'
+    ].filter(Boolean).join('; ');
+const base64Url = (bytes)=>{
+    let binary = '';
+    for (const byte of bytes)binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const randomString = (bytes = 32)=>base64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+const pkceChallenge = async (verifier)=>base64Url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
+const PLACEHOLDER_ORIGIN = 'https://site.invalid';
+// Only a path on this site: never an open redirect. Resolved the way a
+// browser reads Location, which drops tabs and newlines and reads \ as /.
+const safeReturnTo = (value)=>{
+    if (!value?.startsWith('/')) return '/';
+    const url = new URL(value, PLACEHOLDER_ORIGIN);
+    return url.origin === PLACEHOLDER_ORIGIN ? `${url.pathname}${url.search}${url.hash}` : '/';
+};
+const normalizeBasePath = (basePath)=>`/${basePath.replace(/^\/+|\/+$/g, '')}`;
+// The handler for everything under `basePath`. In Next.js:
+//
+//   // app/cms/[...path]/route.ts
+//   const handler = createSiteEditing({
+//     spaceId: process.env.CONTENT_SPACE_ID!,
+//     environment: 'production',
+//     onSignIn: async () => (await draftMode()).enable(),
+//     onSignOut: async () => (await draftMode()).disable(),
+//   })
+//   export { handler as GET, handler as POST }
+const createSiteEditing = ({ spaceId, environment, url, basePath = '/cms', siteUrl, onSignIn, onSignOut, timeout = config.DEFAULT_TIMEOUT, fetch: fetchImpl })=>{
+    const cms = config.normalizeUrl(url || config.DEFAULT_URL);
+    const base = normalizeBasePath(basePath);
+    const doFetch = fetchImpl ?? ((...args)=>fetch(...args));
+    const callCms = (path, init = {})=>doFetch(`${cms}${SITE_PATH}/${path}`, {
+            ...init,
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeout)
+        });
+    return async (request)=>{
+        const requestUrl = new URL(request.url);
+        const origin = siteUrl ? config.normalizeUrl(siteUrl) : requestUrl.origin;
+        const secure = origin.startsWith('https:');
+        const redirectUri = `${origin}${base}/callback`;
+        const cookies = parseCookies(request.headers.get('cookie') ?? '');
+        const path = requestUrl.pathname.startsWith(`${base}/`) ? requestUrl.pathname.slice(base.length + 1) : null;
+        const sessionCookies = (session)=>[
+                serializeCookie(SITE_TOKEN_COOKIE, session.token, {
+                    maxAge: session.maxAge,
+                    path: '/',
+                    httpOnly: true,
+                    secure
+                }),
+                serializeCookie(SITE_EDITING_COOKIE, session.token ? base : '', {
+                    maxAge: session.maxAge,
+                    path: '/',
+                    httpOnly: false,
+                    secure
+                })
+            ];
+        const clearedCookies = ()=>sessionCookies({
+                token: '',
+                maxAge: 0
+            });
+        const redirect = (location, setCookies = [])=>{
+            const headers = new Headers({
+                Location: location,
+                'Cache-Control': 'no-store'
+            });
+            for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
+            return new Response(null, {
+                status: 302,
+                headers
+            });
+        };
+        if (path === 'login' && request.method === 'GET') {
+            const state = randomString(16);
+            const verifier = randomString(48);
+            const flow = JSON.stringify({
+                state,
+                verifier,
+                returnTo: safeReturnTo(requestUrl.searchParams.get('return_to'))
+            });
+            const connect = new URL(`${cms}/site/connect`);
+            connect.search = new URLSearchParams({
+                space: spaceId,
+                environment,
+                redirect_uri: redirectUri,
+                state,
+                code_challenge: await pkceChallenge(verifier),
+                code_challenge_method: 'S256'
+            }).toString();
+            return redirect(connect.toString(), [
+                serializeCookie(FLOW_COOKIE, flow, {
+                    maxAge: FLOW_MAX_AGE,
+                    path: base,
+                    httpOnly: true,
+                    secure
+                })
+            ]);
+        }
+        if (path === 'callback' && request.method === 'GET') {
+            const clearFlow = serializeCookie(FLOW_COOKIE, '', {
+                maxAge: 0,
+                path: base,
+                httpOnly: true,
+                secure
+            });
+            let flow;
+            try {
+                flow = JSON.parse(cookies.get(FLOW_COOKIE) ?? '');
+            } catch  {
+                flow = {};
+            }
+            const code = requestUrl.searchParams.get('code');
+            if (!code || typeof flow.state !== 'string' || typeof flow.verifier !== 'string' || flow.state !== requestUrl.searchParams.get('state')) {
+                return textResponse(400, 'This sign-in link is invalid or expired. Start again from the login link.', [
+                    clearFlow
+                ]);
+            }
+            const response = await callCms('token', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    code,
+                    code_verifier: flow.verifier,
+                    redirect_uri: redirectUri
+                })
+            });
+            if (!response.ok) {
+                return textResponse(400, 'Obelism Content did not accept the sign-in. Start again from the login link.', [
+                    clearFlow
+                ]);
+            }
+            const session = await response.json();
+            await onSignIn?.(session);
+            const maxAge = (Date.parse(session.expiresAt) - Date.now()) / 1000;
+            return redirect(safeReturnTo(flow.returnTo), [
+                clearFlow,
+                ...sessionCookies({
+                    token: session.token,
+                    maxAge
+                })
+            ]);
+        }
+        if (path === 'logout') {
+            const token = cookies.get(SITE_TOKEN_COOKIE);
+            if (token) {
+                await callCms('session', {
+                    method: 'DELETE',
+                    headers: {
+                        Authorization: `Bearer ${token}`
+                    }
+                }).catch(()=>null);
+            }
+            await onSignOut?.();
+            return redirect(safeReturnTo(requestUrl.searchParams.get('return_to')), clearedCookies());
+        }
+        if (path?.startsWith('api/')) {
+            const route = path.slice('api/'.length);
+            if (!siteApiAllows(request.method, route)) {
+                return Response.json({
+                    error: 'Not found'
+                }, {
+                    status: 404
+                });
+            }
+            if (request.method !== 'GET' && request.headers.get(SITE_REQUEST_HEADER) !== '1') {
+                return Response.json({
+                    error: 'Forbidden'
+                }, {
+                    status: 403
+                });
+            }
+            const token = cookies.get(SITE_TOKEN_COOKIE);
+            if (!token) {
+                return Response.json({
+                    error: 'Not signed in'
+                }, {
+                    status: 401
+                });
+            }
+            const response = await callCms(route, {
+                method: request.method,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    ...request.method !== 'GET' && {
+                        'Content-Type': 'application/json'
+                    }
+                },
+                ...request.method !== 'GET' && {
+                    body: await request.text()
+                }
+            });
+            const headers = new Headers({
+                'Content-Type': 'application/json',
+                'Cache-Control': 'no-store'
+            });
+            // The session ended in the CMS: stop showing the editing UI.
+            if (response.status === 401) {
+                for (const cookie of clearedCookies()){
+                    headers.append('Set-Cookie', cookie);
+                }
+            }
+            return new Response(await response.text(), {
+                status: response.status,
+                headers
+            });
+        }
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    };
+};
+const textResponse = (status, text, setCookies)=>{
+    const headers = new Headers({
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Cache-Control': 'no-store'
+    });
+    for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
+    return new Response(text, {
+        status,
+        headers
+    });
+};
+
+exports.SITE_EDITING_COOKIE = SITE_EDITING_COOKIE;
+exports.SITE_REQUEST_HEADER = SITE_REQUEST_HEADER;
+exports.SITE_TOKEN_COOKIE = SITE_TOKEN_COOKIE;
+exports.createSiteEditing = createSiteEditing;
+exports.parseCookies = parseCookies;
+exports.pkceChallenge = pkceChallenge;
+exports.readSiteToken = readSiteToken;
+exports.safeReturnTo = safeReturnTo;
+exports.siteApi = siteApi;