@obelism/content 0.28.3 → 0.29.0

package/dist/site.js

@@ -1,344 +1,14 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var config = require('./config-ci2hxmas.js');
+require('./config-ci2hxmas.js');
+var site = require('./site-j5kqgtj3.js');
 
-// Editing on your own site, outside the visual editor
-// (https://content.obelism.studio/docs/guides/site-editing). One handler
-// serves everything under `/cms` (the `basePath`) on your site:
-//
-// - `/cms/login?return_to=/pricing` — sends the browser to Obelism Content
-//   to sign in, with a PKCE challenge, and…
-// - `/cms/callback` — …takes it back: trades the one-time code for a site
-//   token, keeps it in an httpOnly cookie, calls `onSignIn` (turn on your
-//   framework's draft mode there) and returns to `return_to`.
-// - `/cms/logout` — ends the session in the CMS, clears the cookies, calls
-//   `onSignOut`.
-// - `/cms/api/…` — what the bridge's prompt bar calls in the browser,
-//   forwarded to the CMS with the token. The token never reaches page
-//   scripts.
-//
-// While signed in, render drafts by reading the delivery API with the token
-// (`readSiteToken`), and the bridge shows the prompt bar with Save and
-// Publish.
-const SITE_TOKEN_COOKIE = 'obelism_content_token';
-// Readable by the page: tells the bridge the site is being edited, and where
-// this handler lives. Holds no secret.
-const SITE_EDITING_COOKIE = 'obelism_content_editing';
-const FLOW_COOKIE = 'obelism_content_flow';
-// The bridge sends it with every write, which a cross-site form can't.
-const SITE_REQUEST_HEADER = 'x-obelism-content';
-const SITE_PATH = '/api/site/v1';
-const FLOW_MAX_AGE = 10 * 60;
-// The site token from a Cookie header (or a framework's cookie store), or
-// null when not signed in to edit:
-//
-//   const token = readSiteToken(request.headers.get('cookie'))
-//   const content = token ? new ContentClient({ token, init: { cache: 'no-store' } }) : delivery
-const readSiteToken = (cookies)=>{
-    if (!cookies) return null;
-    if (typeof cookies !== 'string') return cookies.get(SITE_TOKEN_COOKIE)?.value || null;
-    return parseCookies(cookies).get(SITE_TOKEN_COOKIE) || null;
-};
-const parseCookies = (header)=>{
-    const cookies = new Map();
-    for (const part of header.split(';')){
-        const index = part.indexOf('=');
-        if (index < 0) continue;
-        const name = part.slice(0, index).trim();
-        if (!name || cookies.has(name)) continue;
-        try {
-            cookies.set(name, decodeURIComponent(part.slice(index + 1).trim()));
-        } catch  {
-            cookies.set(name, part.slice(index + 1).trim());
-        }
-    }
-    return cookies;
-};
-const serializeCookie = (name, value, { maxAge, path, httpOnly, secure })=>[
-        `${name}=${encodeURIComponent(value)}`,
-        `Path=${path}`,
-        `Max-Age=${Math.max(0, Math.floor(maxAge))}`,
-        // Also Expires: Next.js re-serializes response cookies when draft mode
-        // changes, and drops a Max-Age of 0.
-        `Expires=${new Date(maxAge > 0 ? Date.now() + maxAge * 1000 : 0).toUTCString()}`,
-        'SameSite=Lax',
-        httpOnly && 'HttpOnly',
-        secure && 'Secure'
-    ].filter(Boolean).join('; ');
-const base64Url = (bytes)=>{
-    let binary = '';
-    for (const byte of bytes)binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-};
-const randomString = (bytes = 32)=>base64Url(crypto.getRandomValues(new Uint8Array(bytes)));
-const pkceChallenge = async (verifier)=>base64Url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
-const PLACEHOLDER_ORIGIN = 'https://site.invalid';
-// Only a path on this site: never an open redirect. Resolved the way a
-// browser reads Location, which drops tabs and newlines and reads \ as /.
-const safeReturnTo = (value)=>{
-    if (!value?.startsWith('/')) return '/';
-    const url = new URL(value, PLACEHOLDER_ORIGIN);
-    return url.origin === PLACEHOLDER_ORIGIN ? `${url.pathname}${url.search}${url.hash}` : '/';
-};
-const normalizeBasePath = (basePath)=>`/${basePath.replace(/^\/+|\/+$/g, '')}`;
-// What the browser may reach through `/cms/api/…`: reads, and the writes
-// the prompt bar makes. Nothing else of the site API is exposed.
-const PROXY_ROUTES = [
-    {
-        method: 'GET',
-        pattern: /^session$/
-    },
-    {
-        method: 'GET',
-        pattern: /^pages$/
-    },
-    {
-        method: 'GET',
-        pattern: /^entries\/[\w-]+$/
-    },
-    {
-        method: 'POST',
-        pattern: /^entries$/
-    },
-    // "Add a product page" on a product the site marks (editableProduct),
-    // "Add a collection page" on a collection (editableCollection).
-    {
-        method: 'POST',
-        pattern: /^product-pages$/
-    },
-    {
-        method: 'POST',
-        pattern: /^collection-pages$/
-    },
-    // The one-time address of the CMS's entry form (the prompt box's Form).
-    {
-        method: 'POST',
-        pattern: /^form$/
-    },
-    // Clicks on the links the page tags, from Numbers.
-    {
-        method: 'POST',
-        pattern: /^stats$/
-    },
-    {
-        method: 'POST',
-        pattern: /^entries\/[\w-]+\/(preview|prompt|view|apply|save|publish)$/
-    }
-];
-// The handler for everything under `basePath`. In Next.js:
-//
-//   // app/cms/[...path]/route.ts
-//   const handler = createSiteEditing({
-//     spaceId: process.env.CONTENT_SPACE_ID!,
-//     environment: 'production',
-//     onSignIn: async () => (await draftMode()).enable(),
-//     onSignOut: async () => (await draftMode()).disable(),
-//   })
-//   export { handler as GET, handler as POST }
-const createSiteEditing = ({ spaceId, environment, url, basePath = '/cms', siteUrl, onSignIn, onSignOut, timeout = config.DEFAULT_TIMEOUT, fetch: fetchImpl })=>{
-    const cms = config.normalizeUrl(url || config.DEFAULT_URL);
-    const base = normalizeBasePath(basePath);
-    const doFetch = fetchImpl ?? ((...args)=>fetch(...args));
-    const callCms = (path, init = {})=>doFetch(`${cms}${SITE_PATH}/${path}`, {
-            ...init,
-            redirect: 'manual',
-            signal: AbortSignal.timeout(timeout)
-        });
-    return async (request)=>{
-        const requestUrl = new URL(request.url);
-        const origin = siteUrl ? config.normalizeUrl(siteUrl) : requestUrl.origin;
-        const secure = origin.startsWith('https:');
-        const redirectUri = `${origin}${base}/callback`;
-        const cookies = parseCookies(request.headers.get('cookie') ?? '');
-        const path = requestUrl.pathname.startsWith(`${base}/`) ? requestUrl.pathname.slice(base.length + 1) : null;
-        const sessionCookies = (session)=>[
-                serializeCookie(SITE_TOKEN_COOKIE, session.token, {
-                    maxAge: session.maxAge,
-                    path: '/',
-                    httpOnly: true,
-                    secure
-                }),
-                serializeCookie(SITE_EDITING_COOKIE, session.token ? base : '', {
-                    maxAge: session.maxAge,
-                    path: '/',
-                    httpOnly: false,
-                    secure
-                })
-            ];
-        const clearedCookies = ()=>sessionCookies({
-                token: '',
-                maxAge: 0
-            });
-        const redirect = (location, setCookies = [])=>{
-            const headers = new Headers({
-                Location: location,
-                'Cache-Control': 'no-store'
-            });
-            for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
-            return new Response(null, {
-                status: 302,
-                headers
-            });
-        };
-        if (path === 'login' && request.method === 'GET') {
-            const state = randomString(16);
-            const verifier = randomString(48);
-            const flow = JSON.stringify({
-                state,
-                verifier,
-                returnTo: safeReturnTo(requestUrl.searchParams.get('return_to'))
-            });
-            const connect = new URL(`${cms}/site/connect`);
-            connect.search = new URLSearchParams({
-                space: spaceId,
-                environment,
-                redirect_uri: redirectUri,
-                state,
-                code_challenge: await pkceChallenge(verifier),
-                code_challenge_method: 'S256'
-            }).toString();
-            return redirect(connect.toString(), [
-                serializeCookie(FLOW_COOKIE, flow, {
-                    maxAge: FLOW_MAX_AGE,
-                    path: base,
-                    httpOnly: true,
-                    secure
-                })
-            ]);
-        }
-        if (path === 'callback' && request.method === 'GET') {
-            const clearFlow = serializeCookie(FLOW_COOKIE, '', {
-                maxAge: 0,
-                path: base,
-                httpOnly: true,
-                secure
-            });
-            let flow;
-            try {
-                flow = JSON.parse(cookies.get(FLOW_COOKIE) ?? '');
-            } catch  {
-                flow = {};
-            }
-            const code = requestUrl.searchParams.get('code');
-            if (!code || typeof flow.state !== 'string' || typeof flow.verifier !== 'string' || flow.state !== requestUrl.searchParams.get('state')) {
-                return textResponse(400, 'This sign-in link is invalid or expired. Start again from the login link.', [
-                    clearFlow
-                ]);
-            }
-            const response = await callCms('token', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({
-                    code,
-                    code_verifier: flow.verifier,
-                    redirect_uri: redirectUri
-                })
-            });
-            if (!response.ok) {
-                return textResponse(400, 'Obelism Content did not accept the sign-in. Start again from the login link.', [
-                    clearFlow
-                ]);
-            }
-            const session = await response.json();
-            await onSignIn?.(session);
-            const maxAge = (Date.parse(session.expiresAt) - Date.now()) / 1000;
-            return redirect(safeReturnTo(flow.returnTo), [
-                clearFlow,
-                ...sessionCookies({
-                    token: session.token,
-                    maxAge
-                })
-            ]);
-        }
-        if (path === 'logout') {
-            const token = cookies.get(SITE_TOKEN_COOKIE);
-            if (token) {
-                await callCms('session', {
-                    method: 'DELETE',
-                    headers: {
-                        Authorization: `Bearer ${token}`
-                    }
-                }).catch(()=>null);
-            }
-            await onSignOut?.();
-            return redirect(safeReturnTo(requestUrl.searchParams.get('return_to')), clearedCookies());
-        }
-        if (path?.startsWith('api/')) {
-            const route = path.slice('api/'.length);
-            if (!PROXY_ROUTES.some(({ method, pattern })=>method === request.method && pattern.test(route))) {
-                return Response.json({
-                    error: 'Not found'
-                }, {
-                    status: 404
-                });
-            }
-            if (request.method !== 'GET' && request.headers.get(SITE_REQUEST_HEADER) !== '1') {
-                return Response.json({
-                    error: 'Forbidden'
-                }, {
-                    status: 403
-                });
-            }
-            const token = cookies.get(SITE_TOKEN_COOKIE);
-            if (!token) {
-                return Response.json({
-                    error: 'Not signed in'
-                }, {
-                    status: 401
-                });
-            }
-            const response = await callCms(route, {
-                method: request.method,
-                headers: {
-                    Authorization: `Bearer ${token}`,
-                    ...request.method !== 'GET' && {
-                        'Content-Type': 'application/json'
-                    }
-                },
-                ...request.method !== 'GET' && {
-                    body: await request.text()
-                }
-            });
-            const headers = new Headers({
-                'Content-Type': 'application/json',
-                'Cache-Control': 'no-store'
-            });
-            // The session ended in the CMS: stop showing the editing UI.
-            if (response.status === 401) {
-                for (const cookie of clearedCookies()){
-                    headers.append('Set-Cookie', cookie);
-                }
-            }
-            return new Response(await response.text(), {
-                status: response.status,
-                headers
-            });
-        }
-        return Response.json({
-            error: 'Not found'
-        }, {
-            status: 404
-        });
-    };
-};
-const textResponse = (status, text, setCookies)=>{
-    const headers = new Headers({
-        'Content-Type': 'text/plain; charset=utf-8',
-        'Cache-Control': 'no-store'
-    });
-    for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
-    return new Response(text, {
-        status,
-        headers
-    });
-};
 
-exports.SITE_EDITING_COOKIE = SITE_EDITING_COOKIE;
-exports.SITE_REQUEST_HEADER = SITE_REQUEST_HEADER;
-exports.SITE_TOKEN_COOKIE = SITE_TOKEN_COOKIE;
-exports.createSiteEditing = createSiteEditing;
-exports.pkceChallenge = pkceChallenge;
-exports.readSiteToken = readSiteToken;
-exports.safeReturnTo = safeReturnTo;
+
+exports.SITE_EDITING_COOKIE = site.SITE_EDITING_COOKIE;
+exports.SITE_REQUEST_HEADER = site.SITE_REQUEST_HEADER;
+exports.SITE_TOKEN_COOKIE = site.SITE_TOKEN_COOKIE;
+exports.createSiteEditing = site.createSiteEditing;
+exports.pkceChallenge = site.pkceChallenge;
+exports.readSiteToken = site.readSiteToken;
+exports.safeReturnTo = site.safeReturnTo;

package/dist/site.mjs

@@ -1,336 +1,2 @@
-import { n as normalizeUrl, a as DEFAULT_TIMEOUT, D as DEFAULT_URL } from './config-c6qktlz6.mjs';
-
-// Editing on your own site, outside the visual editor
-// (https://content.obelism.studio/docs/guides/site-editing). One handler
-// serves everything under `/cms` (the `basePath`) on your site:
-//
-// - `/cms/login?return_to=/pricing` — sends the browser to Obelism Content
-//   to sign in, with a PKCE challenge, and…
-// - `/cms/callback` — …takes it back: trades the one-time code for a site
-//   token, keeps it in an httpOnly cookie, calls `onSignIn` (turn on your
-//   framework's draft mode there) and returns to `return_to`.
-// - `/cms/logout` — ends the session in the CMS, clears the cookies, calls
-//   `onSignOut`.
-// - `/cms/api/…` — what the bridge's prompt bar calls in the browser,
-//   forwarded to the CMS with the token. The token never reaches page
-//   scripts.
-//
-// While signed in, render drafts by reading the delivery API with the token
-// (`readSiteToken`), and the bridge shows the prompt bar with Save and
-// Publish.
-const SITE_TOKEN_COOKIE = 'obelism_content_token';
-// Readable by the page: tells the bridge the site is being edited, and where
-// this handler lives. Holds no secret.
-const SITE_EDITING_COOKIE = 'obelism_content_editing';
-const FLOW_COOKIE = 'obelism_content_flow';
-// The bridge sends it with every write, which a cross-site form can't.
-const SITE_REQUEST_HEADER = 'x-obelism-content';
-const SITE_PATH = '/api/site/v1';
-const FLOW_MAX_AGE = 10 * 60;
-// The site token from a Cookie header (or a framework's cookie store), or
-// null when not signed in to edit:
-//
-//   const token = readSiteToken(request.headers.get('cookie'))
-//   const content = token ? new ContentClient({ token, init: { cache: 'no-store' } }) : delivery
-const readSiteToken = (cookies)=>{
-    if (!cookies) return null;
-    if (typeof cookies !== 'string') return cookies.get(SITE_TOKEN_COOKIE)?.value || null;
-    return parseCookies(cookies).get(SITE_TOKEN_COOKIE) || null;
-};
-const parseCookies = (header)=>{
-    const cookies = new Map();
-    for (const part of header.split(';')){
-        const index = part.indexOf('=');
-        if (index < 0) continue;
-        const name = part.slice(0, index).trim();
-        if (!name || cookies.has(name)) continue;
-        try {
-            cookies.set(name, decodeURIComponent(part.slice(index + 1).trim()));
-        } catch  {
-            cookies.set(name, part.slice(index + 1).trim());
-        }
-    }
-    return cookies;
-};
-const serializeCookie = (name, value, { maxAge, path, httpOnly, secure })=>[
-        `${name}=${encodeURIComponent(value)}`,
-        `Path=${path}`,
-        `Max-Age=${Math.max(0, Math.floor(maxAge))}`,
-        // Also Expires: Next.js re-serializes response cookies when draft mode
-        // changes, and drops a Max-Age of 0.
-        `Expires=${new Date(maxAge > 0 ? Date.now() + maxAge * 1000 : 0).toUTCString()}`,
-        'SameSite=Lax',
-        httpOnly && 'HttpOnly',
-        secure && 'Secure'
-    ].filter(Boolean).join('; ');
-const base64Url = (bytes)=>{
-    let binary = '';
-    for (const byte of bytes)binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-};
-const randomString = (bytes = 32)=>base64Url(crypto.getRandomValues(new Uint8Array(bytes)));
-const pkceChallenge = async (verifier)=>base64Url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
-const PLACEHOLDER_ORIGIN = 'https://site.invalid';
-// Only a path on this site: never an open redirect. Resolved the way a
-// browser reads Location, which drops tabs and newlines and reads \ as /.
-const safeReturnTo = (value)=>{
-    if (!value?.startsWith('/')) return '/';
-    const url = new URL(value, PLACEHOLDER_ORIGIN);
-    return url.origin === PLACEHOLDER_ORIGIN ? `${url.pathname}${url.search}${url.hash}` : '/';
-};
-const normalizeBasePath = (basePath)=>`/${basePath.replace(/^\/+|\/+$/g, '')}`;
-// What the browser may reach through `/cms/api/…`: reads, and the writes
-// the prompt bar makes. Nothing else of the site API is exposed.
-const PROXY_ROUTES = [
-    {
-        method: 'GET',
-        pattern: /^session$/
-    },
-    {
-        method: 'GET',
-        pattern: /^pages$/
-    },
-    {
-        method: 'GET',
-        pattern: /^entries\/[\w-]+$/
-    },
-    {
-        method: 'POST',
-        pattern: /^entries$/
-    },
-    // "Add a product page" on a product the site marks (editableProduct),
-    // "Add a collection page" on a collection (editableCollection).
-    {
-        method: 'POST',
-        pattern: /^product-pages$/
-    },
-    {
-        method: 'POST',
-        pattern: /^collection-pages$/
-    },
-    // The one-time address of the CMS's entry form (the prompt box's Form).
-    {
-        method: 'POST',
-        pattern: /^form$/
-    },
-    // Clicks on the links the page tags, from Numbers.
-    {
-        method: 'POST',
-        pattern: /^stats$/
-    },
-    {
-        method: 'POST',
-        pattern: /^entries\/[\w-]+\/(preview|prompt|view|apply|save|publish)$/
-    }
-];
-// The handler for everything under `basePath`. In Next.js:
-//
-//   // app/cms/[...path]/route.ts
-//   const handler = createSiteEditing({
-//     spaceId: process.env.CONTENT_SPACE_ID!,
-//     environment: 'production',
-//     onSignIn: async () => (await draftMode()).enable(),
-//     onSignOut: async () => (await draftMode()).disable(),
-//   })
-//   export { handler as GET, handler as POST }
-const createSiteEditing = ({ spaceId, environment, url, basePath = '/cms', siteUrl, onSignIn, onSignOut, timeout = DEFAULT_TIMEOUT, fetch: fetchImpl })=>{
-    const cms = normalizeUrl(url || DEFAULT_URL);
-    const base = normalizeBasePath(basePath);
-    const doFetch = fetchImpl ?? ((...args)=>fetch(...args));
-    const callCms = (path, init = {})=>doFetch(`${cms}${SITE_PATH}/${path}`, {
-            ...init,
-            redirect: 'manual',
-            signal: AbortSignal.timeout(timeout)
-        });
-    return async (request)=>{
-        const requestUrl = new URL(request.url);
-        const origin = siteUrl ? normalizeUrl(siteUrl) : requestUrl.origin;
-        const secure = origin.startsWith('https:');
-        const redirectUri = `${origin}${base}/callback`;
-        const cookies = parseCookies(request.headers.get('cookie') ?? '');
-        const path = requestUrl.pathname.startsWith(`${base}/`) ? requestUrl.pathname.slice(base.length + 1) : null;
-        const sessionCookies = (session)=>[
-                serializeCookie(SITE_TOKEN_COOKIE, session.token, {
-                    maxAge: session.maxAge,
-                    path: '/',
-                    httpOnly: true,
-                    secure
-                }),
-                serializeCookie(SITE_EDITING_COOKIE, session.token ? base : '', {
-                    maxAge: session.maxAge,
-                    path: '/',
-                    httpOnly: false,
-                    secure
-                })
-            ];
-        const clearedCookies = ()=>sessionCookies({
-                token: '',
-                maxAge: 0
-            });
-        const redirect = (location, setCookies = [])=>{
-            const headers = new Headers({
-                Location: location,
-                'Cache-Control': 'no-store'
-            });
-            for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
-            return new Response(null, {
-                status: 302,
-                headers
-            });
-        };
-        if (path === 'login' && request.method === 'GET') {
-            const state = randomString(16);
-            const verifier = randomString(48);
-            const flow = JSON.stringify({
-                state,
-                verifier,
-                returnTo: safeReturnTo(requestUrl.searchParams.get('return_to'))
-            });
-            const connect = new URL(`${cms}/site/connect`);
-            connect.search = new URLSearchParams({
-                space: spaceId,
-                environment,
-                redirect_uri: redirectUri,
-                state,
-                code_challenge: await pkceChallenge(verifier),
-                code_challenge_method: 'S256'
-            }).toString();
-            return redirect(connect.toString(), [
-                serializeCookie(FLOW_COOKIE, flow, {
-                    maxAge: FLOW_MAX_AGE,
-                    path: base,
-                    httpOnly: true,
-                    secure
-                })
-            ]);
-        }
-        if (path === 'callback' && request.method === 'GET') {
-            const clearFlow = serializeCookie(FLOW_COOKIE, '', {
-                maxAge: 0,
-                path: base,
-                httpOnly: true,
-                secure
-            });
-            let flow;
-            try {
-                flow = JSON.parse(cookies.get(FLOW_COOKIE) ?? '');
-            } catch  {
-                flow = {};
-            }
-            const code = requestUrl.searchParams.get('code');
-            if (!code || typeof flow.state !== 'string' || typeof flow.verifier !== 'string' || flow.state !== requestUrl.searchParams.get('state')) {
-                return textResponse(400, 'This sign-in link is invalid or expired. Start again from the login link.', [
-                    clearFlow
-                ]);
-            }
-            const response = await callCms('token', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({
-                    code,
-                    code_verifier: flow.verifier,
-                    redirect_uri: redirectUri
-                })
-            });
-            if (!response.ok) {
-                return textResponse(400, 'Obelism Content did not accept the sign-in. Start again from the login link.', [
-                    clearFlow
-                ]);
-            }
-            const session = await response.json();
-            await onSignIn?.(session);
-            const maxAge = (Date.parse(session.expiresAt) - Date.now()) / 1000;
-            return redirect(safeReturnTo(flow.returnTo), [
-                clearFlow,
-                ...sessionCookies({
-                    token: session.token,
-                    maxAge
-                })
-            ]);
-        }
-        if (path === 'logout') {
-            const token = cookies.get(SITE_TOKEN_COOKIE);
-            if (token) {
-                await callCms('session', {
-                    method: 'DELETE',
-                    headers: {
-                        Authorization: `Bearer ${token}`
-                    }
-                }).catch(()=>null);
-            }
-            await onSignOut?.();
-            return redirect(safeReturnTo(requestUrl.searchParams.get('return_to')), clearedCookies());
-        }
-        if (path?.startsWith('api/')) {
-            const route = path.slice('api/'.length);
-            if (!PROXY_ROUTES.some(({ method, pattern })=>method === request.method && pattern.test(route))) {
-                return Response.json({
-                    error: 'Not found'
-                }, {
-                    status: 404
-                });
-            }
-            if (request.method !== 'GET' && request.headers.get(SITE_REQUEST_HEADER) !== '1') {
-                return Response.json({
-                    error: 'Forbidden'
-                }, {
-                    status: 403
-                });
-            }
-            const token = cookies.get(SITE_TOKEN_COOKIE);
-            if (!token) {
-                return Response.json({
-                    error: 'Not signed in'
-                }, {
-                    status: 401
-                });
-            }
-            const response = await callCms(route, {
-                method: request.method,
-                headers: {
-                    Authorization: `Bearer ${token}`,
-                    ...request.method !== 'GET' && {
-                        'Content-Type': 'application/json'
-                    }
-                },
-                ...request.method !== 'GET' && {
-                    body: await request.text()
-                }
-            });
-            const headers = new Headers({
-                'Content-Type': 'application/json',
-                'Cache-Control': 'no-store'
-            });
-            // The session ended in the CMS: stop showing the editing UI.
-            if (response.status === 401) {
-                for (const cookie of clearedCookies()){
-                    headers.append('Set-Cookie', cookie);
-                }
-            }
-            return new Response(await response.text(), {
-                status: response.status,
-                headers
-            });
-        }
-        return Response.json({
-            error: 'Not found'
-        }, {
-            status: 404
-        });
-    };
-};
-const textResponse = (status, text, setCookies)=>{
-    const headers = new Headers({
-        'Content-Type': 'text/plain; charset=utf-8',
-        'Cache-Control': 'no-store'
-    });
-    for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
-    return new Response(text, {
-        status,
-        headers
-    });
-};
-
-export { SITE_EDITING_COOKIE, SITE_REQUEST_HEADER, SITE_TOKEN_COOKIE, createSiteEditing, pkceChallenge, readSiteToken, safeReturnTo };
+import './config-c6qktlz6.mjs';
+export { S as SITE_EDITING_COOKIE, a as SITE_REQUEST_HEADER, b as SITE_TOKEN_COOKIE, c as createSiteEditing, d as pkceChallenge, r as readSiteToken, e as safeReturnTo } from './site-m85jdjid.mjs';