@orion-studios/cms 0.5.6 → 0.5.7

package/README.md

@@ -41,7 +41,14 @@ Requires Next.js (App Router), React 19, Zod 3. Supabase only in supabase mode.
 import { createCmsRoutes } from '@orion-studios/cms/server'
 import { registry } from '@/cms/registry'
 export const { GET, POST, PATCH, DELETE } = createCmsRoutes({
-  registry, syncToken: process.env.CMS_SYNC_TOKEN,
+  registry,
+  syncToken: process.env.CMS_SYNC_TOKEN,
+  cronToken: process.env.CRON_SECRET,
+  previewSecret: process.env.CMS_PREVIEW_SECRET,
+  previewKeyId: process.env.CMS_PREVIEW_KEY_ID,
+  analyticsSecret: process.env.CMS_ANALYTICS_HASH_SECRET,
+  autoReplyHashSecret: process.env.CMS_AUTO_REPLY_HASH_SECRET,
+  projectRef: process.env.CMS_EXPECTED_SUPABASE_PROJECT_REF,
 })
 
 // src/app/studio/page.tsx — the admin
@@ -75,10 +82,20 @@ own role, never delete yourself.
 | Variable | Where | Purpose |
 | --- | --- | --- |
 | `NEXT_PUBLIC_SUPABASE_URL` | local + Vercel | project URL (also selects supabase mode) |
-| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | local + Vercel | public reads (RLS: published content only) |
-| `SUPABASE_SERVICE_ROLE_KEY` | local + Vercel | server-only; powers the API layer |
-| `DATABASE_URL` | local + Vercel | Postgres for bootstrap (use the transaction pooler on Vercel) |
+| `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` | local + Vercel | public reads (RLS: published content only) |
+| `SUPABASE_SECRET_KEY` | local + Vercel | server-only API access; the legacy service-role alias remains supported |
+| `CMS_EXPECTED_SUPABASE_PROJECT_REF` | local + Vercel | binds the project URL, server credential, previews, and operator database target |
+| `CMS_DATABASE_URL` | local operator only | direct or port 5432 session connection for bootstrap and migrations |
+| `CMS_EXPECTED_DATABASE_ROLE` | local operator only | dedicated CMS migration role with no `app` schema access |
+| `CMS_EXPECTED_DATABASE_NAME` | local operator only | exact database name required by the target guard |
+| `CMS_DATABASE_CONFIRMATION` | local operator only | exact redacted target-receipt hash required before database writes |
+| `CMS_PREVIEW_SECRET` | local + Vercel | signs short-lived, revocable preview grants |
+| `CMS_PREVIEW_KEY_ID` | local + Vercel | non-secret identifier bound into preview grants |
+| `CMS_PREVIEW_PREVIOUS_SECRET`, `CMS_PREVIEW_PREVIOUS_KEY_ID`, `CMS_PREVIEW_PREVIOUS_VALID_UNTIL` | local + Vercel | optional bounded preview-key rotation overlap |
+| `CMS_ANALYTICS_HASH_SECRET` | local + Vercel | hashes analytics session and visitor identifiers |
+| `CMS_AUTO_REPLY_HASH_SECRET` | local + Vercel | hashes form auto-reply rate-limit keys |
 | `CMS_SYNC_TOKEN` | local + Vercel | authorizes `POST /api/cms/sync` |
+| `CRON_SECRET` | local + Vercel | authorizes scheduled publication only |
 | `CMS_STATIC=true` | optional | static mode (no CMS) |
 | `CMS_MEMORY=true` | optional | force memory mode |
 

package/dist/{chunk-AYV6KYDP.js → chunk-NSAZCP4I.js}

@@ -1,5 +1,21 @@
 // src/content/index.ts
 import { createClient } from "@supabase/supabase-js";
+
+// src/supabase-keys.ts
+var isServerSupabaseKey = (key) => {
+  if (key.startsWith("sb_secret_")) return true;
+  const payload = key.split(".")[1];
+  if (!payload) return false;
+  try {
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const decoded = JSON.parse(atob(normalized));
+    return decoded.role === "service_role";
+  } catch {
+    return false;
+  }
+};
+
+// src/content/index.ts
 var CONTENT_CACHE_TAG = "orion-content";
 var toPublicPage = (row) => ({
   id: String(row.id),
@@ -11,12 +27,15 @@ var toPublicPage = (row) => ({
 });
 function createContentClient(options = {}) {
   const supabaseUrl = options.supabaseUrl || process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL || "";
-  const anonKey = options.anonKey || process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || process.env.SUPABASE_ANON_KEY || process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY || process.env.SUPABASE_PUBLISHABLE_KEY || "";
+  const anonKey = options.anonKey || process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY || process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || process.env.SUPABASE_PUBLISHABLE_KEY || process.env.SUPABASE_ANON_KEY || "";
   if (!supabaseUrl || !anonKey) {
     throw new Error(
       "Orion CMS: NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY (or NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY) must be set."
     );
   }
+  if (isServerSupabaseKey(anonKey)) {
+    throw new Error("Orion CMS: a Supabase server key cannot be used for public content reads.");
+  }
   const client = createClient(supabaseUrl, anonKey, {
     auth: { persistSession: false, autoRefreshToken: false }
   });

package/dist/content/index.js

@@ -1,7 +1,7 @@
 import {
   CONTENT_CACHE_TAG,
   createContentClient
-} from "../chunk-AYV6KYDP.js";
+} from "../chunk-NSAZCP4I.js";
 export {
   CONTENT_CACHE_TAG,
   createContentClient

package/dist/server/index.d.ts

@@ -52,8 +52,10 @@ type CmsRoutesOptions = {
     allowedOrigins?: string[];
     /** Rate limiter for public submissions. Defaults to in-memory (5/min/IP). */
     rateLimitStore?: RateLimitStore | null;
-    /** Token accepted by POST /sync and POST /cron/* in addition to admin bearer auth. */
+    /** Token accepted only by POST /sync in addition to admin bearer auth. */
     syncToken?: string;
+    /** Token accepted only by POST or GET /cron/publish-due. */
+    cronToken?: string;
     /** Extra domains never flagged as email typos. */
     knownGoodEmailDomains?: string[];
     /**
@@ -63,8 +65,20 @@ type CmsRoutesOptions = {
     sendEmail?: EmailSender | null;
     /** Site name used in notification emails. */
     siteName?: string;
-    /** Secret for draft preview tokens. Defaults to the service-role key. */
+    /** Purpose-specific secret for draft preview grants. */
     previewSecret?: string;
+    /** Stable identifier for the active preview signing key. */
+    previewKeyId?: string;
+    /** Optional prior preview key accepted only through the bounded overlap. */
+    previewPreviousSecret?: string;
+    previewPreviousKeyId?: string;
+    previewPreviousValidUntil?: number;
+    /** Stable Supabase project reference bound into preview grants. */
+    projectRef?: string;
+    /** Purpose-specific secret for analytics visitor and session hashing. */
+    analyticsSecret?: string;
+    /** Purpose-specific secret for auto-reply recipient hashing. */
+    autoReplyHashSecret?: string;
     /** Cloudflare Turnstile secret — when set, public submits must include a valid `_turnstileToken`. */
     turnstileSecret?: string;
     /** Max upload size in bytes (default 15 MB). */
@@ -120,10 +134,35 @@ declare function createCmsRoutes(options: CmsRoutesOptions): {
 };
 
 declare const PREVIEW_TOKEN_TTL_MS: number;
+declare const PREVIEW_TOKEN_MAX_USES = 8;
 declare const PREVIEW_SESSION_COOKIE = "orion_preview_session";
-declare function createPreviewToken(pageId: string, secret: string, ttlMs?: number): string;
-/** Returns the page id when the token is valid and unexpired, else null. */
-declare function verifyPreviewToken(token: string, secret: string): string | null;
+type PreviewSigningKey = {
+    id: string;
+    secret: string;
+};
+type PreviewKeyRing = {
+    active: PreviewSigningKey;
+    previous?: PreviewSigningKey & {
+        acceptUntil: number;
+    };
+};
+type PreviewGrantClaims = {
+    version: 1;
+    audience: 'cms-preview';
+    operation: 'read-draft';
+    keyId: string;
+    grantId: string;
+    pageId: string;
+    userId: string;
+    projectRef: string;
+    issuedAt: number;
+    expiresAt: number;
+};
+declare function createPreviewToken(grant: Omit<PreviewGrantClaims, 'version' | 'audience' | 'operation' | 'keyId' | 'issuedAt' | 'expiresAt'>, keys: PreviewKeyRing | string, ttlMs?: number): string;
+/** Returns bound claims when the token is valid and unexpired, else null. */
+declare function verifyPreviewGrantToken(token: string, keys: PreviewKeyRing | string, now?: number): PreviewGrantClaims | null;
+/** Compatibility helper for callers that only need the signed page binding. */
+declare function verifyPreviewToken(token: string, keys: PreviewKeyRing | string): string | null;
 type PreviewPage = {
     id: string;
     slug: string;
@@ -136,7 +175,7 @@ type PreviewPage = {
  * Site-side helper: verifies a preview token and loads the page's DRAFT
  * layout with the given (service or memory) client.
  */
-declare function getPreviewPage(client: SupabaseClient, token: string, secret: string): Promise<PreviewPage | null>;
+declare function getPreviewPage(client: SupabaseClient, token: string, keys: PreviewKeyRing | string, expectedProjectRef: string): Promise<PreviewPage | null>;
 
 /**
  * Pure analytics aggregation: raw event rows in, the full dashboard payload
@@ -301,9 +340,11 @@ declare function geoFrom(request: Request): {
  *   access token), verified via auth.getUser(). Stateless: no cookie plumbing.
  */
 type CmsEnv = {
+    expectedProjectRef: string;
     supabaseUrl: string;
     serviceRoleKey: string;
 };
+declare function validateCmsEnv(env: CmsEnv): CmsEnv;
 declare function readCmsEnv(): CmsEnv;
 declare function getServiceClient(env?: CmsEnv): SupabaseClient;
 /** Test seam: inject a fake client. */
@@ -333,14 +374,6 @@ declare function can(user: CmsUser | null, action: CmsAction): boolean;
  */
 declare function isStructuralChange(previous: PageLayout, next: PageLayout): boolean;
 
-/**
- * Content-as-code sync: the single implementation used by both the
- * POST /api/cms/sync route and local `npm run sync` scripts.
- *
- * Contract (proven on Currin): create missing pages, refresh metadata always,
- * write layouts only where the page is not builder-owned, upsert globals and
- * forms. Idempotent.
- */
 type SyncPageInput = {
     slug: string;
     path?: string;
@@ -358,6 +391,11 @@ type SyncFormInput = {
     config?: Record<string, unknown>;
     successMessage?: string;
 };
+type SyncRedirectInput = {
+    fromPath: string;
+    toPath: string;
+    permanent?: boolean;
+};
 type SyncMediaInput = {
     storagePath: string;
     filename?: string;
@@ -373,8 +411,27 @@ type SyncInput = {
     globals?: SyncGlobalInput[];
     forms?: SyncFormInput[];
     media?: SyncMediaInput[];
+    redirects?: SyncRedirectInput[];
+};
+type SyncOperation = {
+    kind: 'page' | 'global' | 'form' | 'media' | 'redirect';
+    key: string;
+    action: 'create' | 'update' | 'noop' | 'conflict' | 'blocked-delete';
+};
+type SyncPlan = {
+    mode: 'dry-run';
+    manifestHash: string;
+    targetReceiptHash: string;
+    operations: SyncOperation[];
+    skipped: Array<{
+        slug: string;
+        issues: unknown;
+    }>;
 };
 type SyncResult = {
+    mode: 'apply';
+    manifestHash: string;
+    targetReceiptHash: string;
     synced: string[];
     skipped: Array<{
         slug: string;
@@ -383,14 +440,23 @@ type SyncResult = {
     globals: number;
     forms: number;
     media: number;
-    /** Non-page resources that failed to write (globals/forms). */
     failed: Array<{
-        kind: 'global' | 'form';
+        kind: SyncOperation['kind'];
         key: string;
         error: string;
     }>;
+    conflicts: SyncOperation[];
+};
+type SyncOptions = {
+    mode?: 'dry-run';
+    expectedProjectRef?: string;
+} | {
+    mode: 'apply';
+    expectedManifestHash: string;
+    expectedProjectRef?: string;
+    expectedTargetReceiptHash: string;
 };
-declare function runContentSync(client: SupabaseClient, registry: BlockRegistry, input: SyncInput): Promise<SyncResult>;
+declare function runContentSync(client: SupabaseClient, registry: BlockRegistry, input: SyncInput, options?: SyncOptions): Promise<SyncPlan | SyncResult>;
 
 /**
  * In-memory CMS backend for local development and end-to-end tests.
@@ -423,4 +489,4 @@ declare function createMemoryCms(): MemoryCms;
 /** Process-wide singleton for Next.js dev servers (module state survives HMR via globalThis). */
 declare function getMemoryCms(): MemoryCms;
 
-export { type AnalyticsEventType, type AnalyticsKpis, type AnalyticsSummary, type CmsAction, type CmsEnv, type CmsRole, type CmsRoutesOptions, type CmsUser, type EmailMessage, type EmailSender, type IncomingEvent, MEMORY_DEV_TOKEN, type MemoryCms, PREVIEW_SESSION_COOKIE, PREVIEW_TOKEN_TTL_MS, type PreviewPage, type ResendSenderOptions, type StoredEvent, type SyncFormInput, type SyncGlobalInput, type SyncInput, type SyncMediaInput, type SyncPageInput, type SyncResult, aggregateAnalytics, can, createCmsRoutes, createDurableRateLimitStore, createMemoryCms, createPreviewToken, createResendSender, deviceFrom, formatSubmissionText, geoFrom, getMemoryCms, getPreviewPage, getServiceClient, isBotRequest, isStructuralChange, notifySubmission, parseEventBatch, readCmsEnv, resolveUser, runContentSync, sessionKeyFor, setServiceClientForTesting, verifyPreviewToken, visitorKeyFor };
+export { type AnalyticsEventType, type AnalyticsKpis, type AnalyticsSummary, type CmsAction, type CmsEnv, type CmsRole, type CmsRoutesOptions, type CmsUser, type EmailMessage, type EmailSender, type IncomingEvent, MEMORY_DEV_TOKEN, type MemoryCms, PREVIEW_SESSION_COOKIE, PREVIEW_TOKEN_MAX_USES, PREVIEW_TOKEN_TTL_MS, type PreviewGrantClaims, type PreviewPage, type ResendSenderOptions, type StoredEvent, type SyncFormInput, type SyncGlobalInput, type SyncInput, type SyncMediaInput, type SyncOperation, type SyncOptions, type SyncPageInput, type SyncPlan, type SyncResult, aggregateAnalytics, can, createCmsRoutes, createDurableRateLimitStore, createMemoryCms, createPreviewToken, createResendSender, deviceFrom, formatSubmissionText, geoFrom, getMemoryCms, getPreviewPage, getServiceClient, isBotRequest, isStructuralChange, notifySubmission, parseEventBatch, readCmsEnv, resolveUser, runContentSync, sessionKeyFor, setServiceClientForTesting, validateCmsEnv, verifyPreviewGrantToken, verifyPreviewToken, visitorKeyFor };