@olonjs/next 0.0.2

package/dist/admin-gate.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Admin access gate (Vite tenant-alpha middleware parity).
+ * JWT ECDSA P-256, sub=admin-access. Active only when VERCEL_ENV is set.
+ */
+export declare const ADMIN_SESSION_COOKIE = "__olonjs_admin_session";
+
+export declare const ADMIN_SESSION_MAX_AGE = 3600;
+
+export declare type AdminGateEnv = {
+    VERCEL_ENV?: string;
+    ADMIN_PUBLIC_KEY?: string;
+};
+
+export declare type AdminGateResult = {
+    kind: 'bypass';
+} | {
+    kind: 'allow';
+} | {
+    kind: 'deny';
+    hint: string;
+} | {
+    kind: 'set-session';
+    token: string;
+    location: string;
+};
+
+/**
+ * Authorize an admin HTML or mutate-API request.
+ * Cookie Path must be `/` so session covers `/admin` and `/api/*` mutate routes.
+ */
+export declare function authorizeAdminRequest(request: Request, env: AdminGateEnv): Promise<AdminGateResult>;
+
+export declare function buildAdminSessionCookie(token: string): string;
+
+export declare function parseCookieHeader(header: string | null): Record<string, string>;
+
+export declare function verifyAdminJwt(token: string, publicKey: CryptoKey, options?: {
+    checkExp: boolean;
+}): Promise<boolean>;
+
+export { }

package/dist/admin-gate.js

@@ -0,0 +1,83 @@
+const d = "__olonjs_admin_session", E = 3600;
+function p(e) {
+  return e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
+}
+function y(e) {
+  const t = atob(e), o = new Uint8Array(t.length);
+  for (let n = 0; n < t.length; n++) o[n] = t.charCodeAt(n);
+  return o.buffer;
+}
+function k(e) {
+  const t = e.replace(/-----BEGIN PUBLIC KEY-----/g, "").replace(/-----END PUBLIC KEY-----/g, "").replace(/\\n/g, "").replace(/\s+/g, "");
+  return y(t);
+}
+async function m(e) {
+  return crypto.subtle.importKey(
+    "spki",
+    k(e),
+    { name: "ECDSA", namedCurve: "P-256" },
+    !1,
+    ["verify"]
+  );
+}
+async function f(e, t, o = { checkExp: !0 }) {
+  try {
+    const n = e.split(".");
+    if (n.length !== 3) return !1;
+    const [s, l, c] = n, i = JSON.parse(atob(p(l)));
+    if (i.sub !== "admin-access") return !1;
+    if (o.checkExp) {
+      const r = Math.floor(Date.now() / 1e3);
+      if (typeof i.exp != "number" || i.exp < r || typeof i.iat != "number" || r - i.iat > 45) return !1;
+    }
+    const u = new TextEncoder().encode(`${s}.${l}`), a = y(p(c));
+    return crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, t, a, u);
+  } catch {
+    return !1;
+  }
+}
+function _(e) {
+  return e ? Object.fromEntries(
+    e.split(";").map((t) => {
+      const [o, ...n] = t.trim().split("=");
+      return [o.trim(), decodeURIComponent(n.join("="))];
+    })
+  ) : {};
+}
+async function h(e, t) {
+  if (!t.VERCEL_ENV) return { kind: "bypass" };
+  const o = t.ADMIN_PUBLIC_KEY;
+  if (!o) return { kind: "deny", hint: "missing_public_key" };
+  let n;
+  try {
+    n = await m(o);
+  } catch (r) {
+    return {
+      kind: "deny",
+      hint: `key_import_failed: ${r instanceof Error ? r.message : String(r)}`
+    };
+  }
+  const s = new URL(e.url), c = _(e.headers.get("Cookie"))[d];
+  if (c && await f(c, n, { checkExp: !1 }))
+    return { kind: "allow" };
+  const i = e.headers.get("Authorization") ?? "", u = i.startsWith("Bearer ") ? i.slice(7) : null;
+  if (u && await f(u, n))
+    return { kind: "allow" };
+  const a = s.searchParams.get("token");
+  if (a && await f(a, n)) {
+    const r = new URL(s.toString());
+    return r.searchParams.delete("token"), { kind: "set-session", token: a, location: r.toString() };
+  }
+  return { kind: "deny", hint: "token_invalid" };
+}
+function A(e) {
+  return `${d}=${encodeURIComponent(e)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=3600`;
+}
+export {
+  d as ADMIN_SESSION_COOKIE,
+  E as ADMIN_SESSION_MAX_AGE,
+  h as authorizeAdminRequest,
+  A as buildAdminSessionCookie,
+  _ as parseCookieHeader,
+  f as verifyAdminJwt
+};

package/dist/client.d.ts

@@ -0,0 +1,18 @@
+import { JsonPagesConfig } from '@olonjs/core';
+import { JSX } from 'react/jsx-runtime';
+import { ReactNode } from 'react';
+
+export declare function AdminIsland({ config, children }: AdminIslandProps): JSX.Element;
+
+export declare type AdminIslandProps = {
+    config: JsonPagesConfig;
+    /** Optional overlays (e.g. Save2Repo DopaDrawer) rendered beside the engine. */
+    children?: ReactNode;
+};
+
+export declare const OLONJS_NEXT_CLIENT: {
+    name: string;
+    surface: "client";
+};
+
+export { }

package/dist/client.js

@@ -0,0 +1,13 @@
+import { O as x } from "./packageInfo-BtT3WSEw.js";
+import { jsxs as o, Fragment as e, jsx as m } from "react/jsx-runtime";
+import { JsonPagesEngine as s } from "@olonjs/react";
+function a({ config: r, children: n }) {
+  return /* @__PURE__ */ o(e, { children: [
+    /* @__PURE__ */ m(s, { config: r }),
+    n
+  ] });
+}
+export {
+  a as AdminIsland,
+  x as OLONJS_NEXT_CLIENT
+};

package/dist/index.d.ts

@@ -0,0 +1,54 @@
+export declare function listLocalImages(assetsImagesDir: string, urlPrefix?: string): {
+    id: string;
+    url: string;
+    alt: string;
+    tags: string[];
+}[];
+
+declare type LocalDataRoots = {
+    configDir: string;
+    pagesDir: string;
+    collectionsDir: string;
+    assetsImagesDir: string;
+};
+
+export declare const MAX_UPLOAD_BYTES: number;
+
+export declare const OLONJS_NEXT_CLIENT: {
+    name: string;
+    surface: "client";
+};
+
+export declare const OLONJS_NEXT_SERVER: {
+    name: string;
+    surface: "server";
+};
+
+declare type ProjectStateLike = {
+    site?: unknown;
+    menu?: unknown;
+    theme?: unknown;
+    page?: unknown;
+    collections?: Record<string, unknown>;
+};
+
+export declare function resolveLocalDataRoots(appRoot: string): LocalDataRoots;
+
+/**
+ * Resolve a page JSON path under rootDir without leaving that root.
+ * Mirrors tenant-alpha Vite plugin sanitization.
+ */
+export declare function safeDataSlugPath(rootDir: string, rawSlug: string, fallback: string): string;
+
+export declare function saveProjectStateToDisk(roots: LocalDataRoots, projectState: ProjectStateLike, slug: string): void;
+
+export declare function saveUploadedImage(options: {
+    assetsImagesDir: string;
+    filename: string;
+    mimeType?: string;
+    base64Data: string;
+}): {
+    url: string;
+};
+
+export { }

package/dist/index.js

@@ -0,0 +1,12 @@
+import { M as e, O as o, l as t, r as l, s as r, a as O, b as E } from "./localPersistence-CCNj_74I.js";
+import { O as S } from "./packageInfo-BtT3WSEw.js";
+export {
+  e as MAX_UPLOAD_BYTES,
+  S as OLONJS_NEXT_CLIENT,
+  o as OLONJS_NEXT_SERVER,
+  t as listLocalImages,
+  l as resolveLocalDataRoots,
+  r as safeDataSlugPath,
+  O as saveProjectStateToDisk,
+  E as saveUploadedImage
+};

package/dist/localPersistence-CCNj_74I.js

@@ -0,0 +1,71 @@
+import r from "node:fs";
+import s from "node:path";
+const v = {
+  name: "@olonjs/next",
+  surface: "server"
+};
+function f(e, n, t) {
+  const c = String(n || t).replace(/\\/g, "/").replace(/^\/+|\/+$/g, "").split("/").map((g) => g.replace(/[^a-zA-Z0-9_[\]-]/g, "_")).filter(Boolean), a = s.resolve(e, `${c.join(s.sep) || t}.json`);
+  if (!(a.startsWith(`${e}${s.sep}`) || a === e)) throw new Error("Invalid data path");
+  return a;
+}
+const o = /* @__PURE__ */ new Set([".jpg", ".jpeg", ".png", ".gif", ".webp", ".svg", ".avif"]), u = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/gif",
+  "image/svg+xml",
+  "image/avif"
+]), m = 5 * 1024 * 1024;
+function w(e) {
+  return {
+    configDir: s.resolve(e, "src", "data", "config"),
+    pagesDir: s.resolve(e, "src", "data", "pages"),
+    collectionsDir: s.resolve(e, "src", "data", "collections"),
+    assetsImagesDir: s.resolve(e, "public", "assets", "images")
+  };
+}
+function h(e, n, t) {
+  for (const i of [e.configDir, e.pagesDir, e.collectionsDir])
+    r.existsSync(i) || r.mkdirSync(i, { recursive: !0 });
+  if (n.site != null && r.writeFileSync(s.join(e.configDir, "site.json"), JSON.stringify(n.site, null, 2), "utf8"), n.menu != null && r.writeFileSync(s.join(e.configDir, "menu.json"), JSON.stringify(n.menu, null, 2), "utf8"), n.theme != null && r.writeFileSync(s.join(e.configDir, "theme.json"), JSON.stringify(n.theme, null, 2), "utf8"), n.page != null) {
+    const i = f(e.pagesDir, t, "page");
+    r.mkdirSync(s.dirname(i), { recursive: !0 }), r.writeFileSync(i, JSON.stringify(n.page, null, 2), "utf8");
+  }
+  if (n.collections && typeof n.collections == "object")
+    for (const [i, c] of Object.entries(n.collections)) {
+      const a = String(i).replace(/[^a-zA-Z0-9-_]/g, "_");
+      if (!a) continue;
+      const l = s.join(e.collectionsDir, a);
+      r.mkdirSync(l, { recursive: !0 }), r.writeFileSync(s.join(l, `${a}.json`), JSON.stringify(c, null, 2), "utf8");
+    }
+}
+function y(e, n = "/assets/images") {
+  const t = [];
+  if (!r.existsSync(e)) return t;
+  for (const i of r.readdirSync(e))
+    o.has(s.extname(i).toLowerCase()) && t.push({ id: i, url: `${n}/${i}`, alt: i, tags: [] });
+  return t;
+}
+function d(e, n) {
+  const t = e.replace(/\.[^.]+$/, "").replace(/[^a-zA-Z0-9-_]/g, "_").slice(0, 128) || "image", i = e.includes(".") ? s.extname(e).toLowerCase() : n != null && n.startsWith("image/") ? `.${(n.split("/")[1] || "png").replace("jpeg", "jpg")}` : ".png";
+  return `${Date.now()}-${t}${o.has(i) ? i : ".png"}`;
+}
+function D(e) {
+  const { assetsImagesDir: n, filename: t, mimeType: i, base64Data: c } = e, a = Buffer.from(c, "base64");
+  if (a.length > m)
+    throw new Error("File too large. Max 5MB.");
+  if (i && !u.has(i))
+    throw new Error("Invalid file type");
+  const l = d(t, i);
+  return r.existsSync(n) || r.mkdirSync(n, { recursive: !0 }), r.writeFileSync(s.join(n, l), a), { url: `/assets/images/${l}` };
+}
+export {
+  m as M,
+  v as O,
+  h as a,
+  D as b,
+  y as l,
+  w as r,
+  f as s
+};

package/dist/packageInfo-BtT3WSEw.js

@@ -0,0 +1,7 @@
+const e = {
+  name: "@olonjs/next",
+  surface: "client"
+};
+export {
+  e as O
+};

package/dist/server.d.ts

@@ -0,0 +1,220 @@
+import { JsonPagesConfig } from '@olonjs/core';
+import { MenuConfig } from '@olonjs/core';
+import { PageConfig } from '@olonjs/core';
+import { SiteConfig } from '@olonjs/core';
+
+/**
+ * Admin access gate (Vite tenant-alpha middleware parity).
+ * JWT ECDSA P-256, sub=admin-access. Active only when VERCEL_ENV is set.
+ */
+export declare const ADMIN_SESSION_COOKIE = "__olonjs_admin_session";
+
+export declare const ADMIN_SESSION_MAX_AGE = 3600;
+
+export declare type AdminGateEnv = {
+    VERCEL_ENV?: string;
+    ADMIN_PUBLIC_KEY?: string;
+};
+
+export declare type AdminGateResult = {
+    kind: 'bypass';
+} | {
+    kind: 'allow';
+} | {
+    kind: 'deny';
+    hint: string;
+} | {
+    kind: 'set-session';
+    token: string;
+    location: string;
+};
+
+/**
+ * Vite `applyDevSliceFilters` parity — filter resolved collection maps by authored `$sliceFilter`.
+ */
+export declare function applyDevSliceFilters<T extends {
+    sections?: Array<{
+        data?: Record<string, unknown>;
+    }>;
+}>(page: T, authored: {
+    sections?: Array<{
+        data?: Record<string, unknown>;
+    }>;
+} | undefined, params: Record<string, string>): T;
+
+/**
+ * Authorize an admin HTML or mutate-API request.
+ * Cookie Path must be `/` so session covers `/admin` and `/api/*` mutate routes.
+ */
+export declare function authorizeAdminRequest(request: Request, env: AdminGateEnv): Promise<AdminGateResult>;
+
+export declare function buildAdminSessionCookie(token: string): string;
+
+/**
+ * Next.js rewrites so `/*.json` and `/pages/*.json` hit the public-page API
+ * instead of the RSC catch-all.
+ */
+export declare function buildPublicPageJsonRewrites(): PublicPageJsonRewrite[];
+
+/** Map resolve result → HTTP status + JSON body (Vite page JSON parity). */
+export declare function createPublicPageJsonHttpResult(result: ResolvePublicPageJsonResult | null): PublicPageJsonHttpResult;
+
+export declare function listLocalImages(assetsImagesDir: string, urlPrefix?: string): {
+    id: string;
+    url: string;
+    alt: string;
+    tags: string[];
+}[];
+
+export declare type LivePublicPageContent = {
+    pages: Record<string, PageConfig>;
+    siteConfig: SiteConfig;
+    menuConfig: MenuConfig;
+};
+
+/**
+ * Live boot parity — single-page SPP `GET {apiBase}/render?path=…`.
+ */
+export declare function loadLivePublicPageContent(input: LoadLivePublicPageContentInput): Promise<LivePublicPageContent>;
+
+export declare type LoadLivePublicPageContentInput = {
+    slug: string;
+    apiBases: string[];
+    apiKey: string;
+    fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
+};
+
+/**
+ * Save2Repo static boot parity — fetch published `config/site.json` + `pages/{slug}.json`.
+ */
+export declare function loadPublishedStaticContent(input: LoadPublishedStaticContentInput): Promise<{
+    pages: Record<string, PageConfig>;
+    siteConfig: SiteConfig;
+}>;
+
+export declare type LoadPublishedStaticContentInput = {
+    knownSlugs: string[];
+    /** Absolute origin + optional base path, e.g. `https://cdn.example/` or `http://localhost:3000/`. */
+    baseUrl: string;
+    fetchImpl?: typeof fetch;
+};
+
+/**
+ * Visitor page loader for RSC hosts (ADR-0017).
+ * Empty registry → empty tenant; unknown slug → not-found (no home fallback).
+ */
+export declare function loadVisitorPage(input: VisitorLoadInput): VisitorLoadResult;
+
+export declare type LocalDataRoots = {
+    configDir: string;
+    pagesDir: string;
+    collectionsDir: string;
+    assetsImagesDir: string;
+};
+
+export declare const MAX_UPLOAD_BYTES: number;
+
+/**
+ * Normalize public page JSON request paths:
+ * `/pages/home.json`, `home.json`, `libri/1984.json` → registry/request slug.
+ */
+export declare function normalizePublicPageSlug(raw: string): string;
+
+/** Alpha `normalizeRouteSlug` / `normalizeSlugForCache` parity. */
+export declare function normalizePublishedSlug(value: string): string;
+
+export declare const OLONJS_NEXT_SERVER: {
+    name: string;
+    surface: "server";
+};
+
+export declare function parseCookieHeader(header: string | null): Record<string, string>;
+
+export declare type ProjectStateLike = {
+    site?: unknown;
+    menu?: unknown;
+    theme?: unknown;
+    page?: unknown;
+    collections?: Record<string, unknown>;
+};
+
+export declare type PublicPageContentBundle = {
+    pages: Record<string, PageConfig>;
+    siteConfig: SiteConfig;
+    themeConfig: JsonPagesConfig['themeConfig'];
+    menuConfig: MenuConfig;
+    collections?: JsonPagesConfig['collections'];
+    collectionSchemas?: JsonPagesConfig['collectionSchemas'];
+    refDocuments?: JsonPagesConfig['refDocuments'];
+};
+
+export declare type PublicPageJsonHttpResult = {
+    status: 200 | 404;
+    body: unknown;
+};
+
+export declare type PublicPageJsonRewrite = {
+    source: string;
+    destination: string;
+};
+
+export declare function resolveLocalDataRoots(appRoot: string): LocalDataRoots;
+
+/**
+ * Resolve a public page document for JSON responses (Vite `/slug.json` parity).
+ * Returns null when the slug does not match the page registry.
+ */
+export declare function resolvePublicPageJson(input: {
+    slug: string;
+    bundle: PublicPageContentBundle;
+}): ResolvePublicPageJsonResult | null;
+
+export declare type ResolvePublicPageJsonResult = {
+    page: PageConfig;
+    registrySlug: string;
+    params: Record<string, string>;
+};
+
+/**
+ * Resolve a page JSON path under rootDir without leaving that root.
+ * Mirrors tenant-alpha Vite plugin sanitization.
+ */
+export declare function safeDataSlugPath(rootDir: string, rawSlug: string, fallback: string): string;
+
+export declare function saveProjectStateToDisk(roots: LocalDataRoots, projectState: ProjectStateLike, slug: string): void;
+
+export declare function saveUploadedImage(options: {
+    assetsImagesDir: string;
+    filename: string;
+    mimeType?: string;
+    base64Data: string;
+}): {
+    url: string;
+};
+
+/** Map public JSON slug → SPP `render?path=` (bootLive parity). */
+export declare function slugToRenderPath(slug: string): string;
+
+export declare function verifyAdminJwt(token: string, publicKey: CryptoKey, options?: {
+    checkExp: boolean;
+}): Promise<boolean>;
+
+export declare type VisitorLoadInput = {
+    pages: Record<string, PageConfig>;
+    slug: string;
+};
+
+export declare type VisitorLoadResult = {
+    kind: 'empty';
+} | {
+    kind: 'not-found';
+} | {
+    kind: 'page';
+    slug: string;
+    registrySlug: string;
+    page: PageConfig;
+    params: Record<string, string>;
+};
+
+export { }

package/dist/server.js

@@ -0,0 +1,220 @@
+import { M as x, O as B, l as W, r as F, s as H, a as T, b as U } from "./localPersistence-CCNj_74I.js";
+import { resolvePageMatchFromRegistry as P, withBasePath as j, resolvePublicPageDocument as w } from "@olonjs/core";
+import { ADMIN_SESSION_COOKIE as V, ADMIN_SESSION_MAX_AGE as X, authorizeAdminRequest as G, buildAdminSessionCookie as K, parseCookieHeader as Y, verifyAdminJwt as Q } from "./admin-gate.js";
+function I(e) {
+  const t = e.pages ?? {};
+  if (Object.keys(t).length === 0) return { kind: "empty" };
+  const n = P(t, e.slug || "home");
+  return n ? {
+    kind: "page",
+    slug: n.requestedSlug,
+    registrySlug: n.registrySlug,
+    page: n.page,
+    params: n.params
+  } : { kind: "not-found" };
+}
+function O(e, t, n) {
+  if (!(t != null && t.sections) || !(e != null && e.sections)) return e;
+  const s = (r, a) => a.split(".").reduce((c, i) => c == null ? void 0 : c[i], r);
+  return {
+    ...e,
+    sections: e.sections.map((r, a) => {
+      var g, l;
+      const c = (l = (g = t.sections) == null ? void 0 : g[a]) == null ? void 0 : l.data;
+      if (!c || !r.data) return r;
+      const i = { ...r.data };
+      for (const [u, o] of Object.entries(c)) {
+        if (!(o != null && o.$sliceFilter) || typeof i[u] != "object" || i[u] === null) continue;
+        const m = Object.fromEntries(
+          Object.entries(o.$sliceFilter).map(([p, f]) => [
+            p,
+            typeof f == "string" ? f : n[(f == null ? void 0 : f.$routeParam) ?? ""] ?? ""
+          ]).filter(([, p]) => p)
+        );
+        i[u] = Object.fromEntries(
+          Object.entries(i[u]).filter(
+            ([, p]) => Object.entries(m).every(([f, y]) => String(s(p, f) ?? "") === y)
+          )
+        );
+      }
+      return { ...r, data: i };
+    })
+  };
+}
+function d(e) {
+  return typeof e == "object" && e !== null;
+}
+function h(e, t) {
+  return typeof e == "string" && e.trim() ? e : t;
+}
+function S(e) {
+  return e.toLowerCase().replace(/[^a-z0-9/_[\]-]/g, "-").replace(/^\/+|\/+$/g, "") || "home";
+}
+function $(e, t) {
+  let n = t;
+  if (typeof n == "string")
+    try {
+      n = JSON.parse(n);
+    } catch {
+      return null;
+    }
+  if (!d(n) || !Array.isArray(n.sections)) return null;
+  const s = d(n.meta) ? n.meta : {}, r = h(n.slug, e);
+  return {
+    id: h(n.id, `${r}-page`),
+    slug: r,
+    meta: {
+      title: h(s.title, r),
+      description: h(s.description, "")
+    },
+    sections: n.sections,
+    ...d(n.collection) ? { collection: n.collection } : {},
+    ...typeof n["global-header"] == "boolean" ? { "global-header": n["global-header"] } : {}
+  };
+}
+function C(e) {
+  let t = e;
+  if (typeof t == "string")
+    try {
+      t = JSON.parse(t);
+    } catch {
+      return null;
+    }
+  return !d(t) || !d(t.identity) ? null : t;
+}
+function E(e) {
+  if (!d(e)) return {};
+  const t = {};
+  for (const [n, s] of Object.entries(e)) {
+    const r = S(n), a = $(r, s);
+    a && (t[r] = { ...a, slug: r });
+  }
+  return t;
+}
+function b(e, t) {
+  const n = e.endsWith("/") ? e.slice(0, -1) : e, s = j(t, "/");
+  return `${n}${s.startsWith("/") ? s : `/${s}`}`;
+}
+async function L(e) {
+  const t = e.fetchImpl ?? fetch, n = b(e.baseUrl, "/config/site.json"), s = await t(n, { cache: "no-store" });
+  if (!s.ok)
+    throw new Error(`Static site config unavailable: ${s.status}`);
+  const r = await s.json().catch(() => null), a = C(r);
+  if (!a)
+    throw new Error("Static site config is invalid.");
+  const c = await Promise.all(
+    e.knownSlugs.map(async (g) => {
+      const l = b(e.baseUrl, `/pages/${S(g)}.json`), u = await t(l, { cache: "no-store" });
+      if (!u.ok)
+        throw new Error(`Static page unavailable for slug "${g}": ${u.status}`);
+      return [g, await u.json().catch(() => null)];
+    })
+  ), i = E(Object.fromEntries(c));
+  if (Object.keys(i).length === 0)
+    throw new Error("Static published pages are empty.");
+  return { pages: i, siteConfig: a };
+}
+function k(e) {
+  const t = e.trim().replace(/^\/+/, "").replace(/\.json$/i, "").replace(/\/+$/, "") || "home";
+  return t === "home" ? "/" : `/${t}`;
+}
+function R(e, t) {
+  if (t != null && t.trim()) return t.trim();
+  const n = typeof e.slug == "string" ? e.slug.trim() : "";
+  return n.includes("[") || n ? n : "home";
+}
+async function M(e) {
+  var a, c;
+  const t = e.fetchImpl ?? fetch, n = k(e.slug), s = new URLSearchParams({ path: n });
+  let r = "Live render unavailable";
+  for (const i of e.apiBases) {
+    const g = `${i.replace(/\/+$/, "")}/render?${s.toString()}`, l = await t(g, {
+      method: "GET",
+      cache: "no-store",
+      headers: { Authorization: `Bearer ${e.apiKey}` },
+      signal: e.signal
+    });
+    if (!(l.headers.get("content-type") || "").toLowerCase().includes("application/json")) {
+      r = `Live render unavailable: non-JSON from ${i}`;
+      continue;
+    }
+    const o = await l.json().catch(() => ({}));
+    if (!l.ok || !o.ok || !o.page || !((a = o.context) != null && a.siteConfig)) {
+      r = `Live render unavailable: ${o.error || o.code || `HTTP_${l.status}`}`;
+      continue;
+    }
+    return {
+      pages: { [R(o.page, (c = o.route) == null ? void 0 : c.template)]: o.page },
+      siteConfig: o.context.siteConfig,
+      menuConfig: o.context.menuConfig ?? {}
+    };
+  }
+  throw new Error(r);
+}
+function _(e) {
+  return e ? { status: 200, body: e.page } : { status: 404, body: { error: "Page JSON not found" } };
+}
+function D() {
+  return [
+    {
+      source: "/pages/:path*.json",
+      destination: "/api/public-page/:path*"
+    },
+    {
+      source: "/:path*.json",
+      destination: "/api/public-page/:path*"
+    }
+  ];
+}
+function A(e) {
+  let t = e.trim();
+  return t.startsWith("/") && (t = t.slice(1)), t.startsWith("pages/") && (t = t.slice(6)), t.endsWith(".json") && (t = t.slice(0, -5)), t || "home";
+}
+function N(e) {
+  const t = A(e.slug), n = w({
+    slug: t,
+    pages: e.bundle.pages,
+    siteConfig: e.bundle.siteConfig,
+    themeConfig: e.bundle.themeConfig,
+    menuConfig: e.bundle.menuConfig,
+    collections: e.bundle.collections,
+    collectionSchemas: e.bundle.collectionSchemas,
+    refDocuments: e.bundle.refDocuments
+  });
+  if (!n) return null;
+  const s = e.bundle.pages[n.pageMatch.registrySlug];
+  return {
+    page: O(
+      n.page,
+      s,
+      n.pageMatch.params ?? {}
+    ),
+    registrySlug: n.pageMatch.registrySlug,
+    params: n.pageMatch.params
+  };
+}
+export {
+  V as ADMIN_SESSION_COOKIE,
+  X as ADMIN_SESSION_MAX_AGE,
+  x as MAX_UPLOAD_BYTES,
+  B as OLONJS_NEXT_SERVER,
+  O as applyDevSliceFilters,
+  G as authorizeAdminRequest,
+  K as buildAdminSessionCookie,
+  D as buildPublicPageJsonRewrites,
+  _ as createPublicPageJsonHttpResult,
+  W as listLocalImages,
+  M as loadLivePublicPageContent,
+  L as loadPublishedStaticContent,
+  I as loadVisitorPage,
+  A as normalizePublicPageSlug,
+  S as normalizePublishedSlug,
+  Y as parseCookieHeader,
+  F as resolveLocalDataRoots,
+  N as resolvePublicPageJson,
+  H as safeDataSlugPath,
+  T as saveProjectStateToDisk,
+  U as saveUploadedImage,
+  k as slugToRenderPath,
+  Q as verifyAdminJwt
+};

package/package.json

@@ -0,0 +1,87 @@
+{
+  "name": "@olonjs/next",
+  "version": "0.0.2",
+  "private": false,
+  "type": "module",
+  "description": "Next.js App Router host binding for OlonJS — RSC visitors + admin client island (ADR-0017).",
+  "author": "JsonPages Team",
+  "license": "MIT",
+  "homepage": "https://github.com/olonjs/npm-jpcore#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/olonjs/npm-jpcore.git",
+    "directory": "packages/next"
+  },
+  "bugs": {
+    "url": "https://github.com/olonjs/npm-jpcore/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "default": "./dist/server.js"
+    },
+    "./admin-gate": {
+      "types": "./dist/admin-gate.d.ts",
+      "import": "./dist/admin-gate.js",
+      "default": "./dist/admin-gate.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js",
+      "default": "./dist/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "vite build",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "@olonjs/core": "^1.1.0",
+    "@olonjs/react": "^0.1.0",
+    "next": "^15.0.0 || ^16.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "react-router-dom": "^6.29.0 || ^7.0.0"
+  },
+  "dependencies": {
+    "@olonjs/core": "^1.1.22"
+  },
+  "peerDependenciesMeta": {
+    "@olonjs/react": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    },
+    "react-router-dom": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.1",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^4.0.0",
+    "typescript": "^5.7.3",
+    "vite": "^6.0.0",
+    "vite-plugin-dts": "^4.0.0",
+    "vitest": "^3.0.0"
+  }
+}