@orion-studios/cms 0.5.6 → 0.5.7

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import {
   CONTENT_CACHE_TAG
-} from "../chunk-AYV6KYDP.js";
+} from "../chunk-NSAZCP4I.js";
 import {
   createMemoryRateLimitStore,
   getAutoReplyEmailFields,
@@ -10,7 +10,7 @@ import {
 } from "../chunk-CFZP7674.js";
 
 // src/server/routes.ts
-import { createHash as createHash2, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash3, createHmac as createHmac3, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
 
 // src/analytics/aggregate.ts
 var CONVERSION_NAMES = /* @__PURE__ */ new Set(["call", "email"]);
@@ -437,33 +437,62 @@ var encode = (value) => Buffer.from(value, "utf8").toString("base64url");
 var decode = (value) => Buffer.from(value, "base64url").toString("utf8");
 var sign = (payload, secret) => createHmac2("sha256", secret).update(payload).digest("base64url");
 var PREVIEW_TOKEN_TTL_MS = 60 * 60 * 1e3;
+var PREVIEW_TOKEN_MAX_USES = 8;
 var PREVIEW_SESSION_COOKIE = "orion_preview_session";
-function createPreviewToken(pageId, secret, ttlMs = PREVIEW_TOKEN_TTL_MS) {
-  const payload = encode(`${pageId}|${Date.now() + ttlMs}`);
-  return `${payload}.${sign(payload, secret)}`;
+var keyRing = (keys) => typeof keys === "string" ? { active: { id: "legacy", secret: keys } } : keys;
+function createPreviewToken(grant, keys, ttlMs = PREVIEW_TOKEN_TTL_MS) {
+  const active = keyRing(keys).active;
+  const issuedAt = Date.now();
+  const payload = encode(JSON.stringify({
+    version: 1,
+    audience: "cms-preview",
+    operation: "read-draft",
+    keyId: active.id,
+    ...grant,
+    issuedAt,
+    expiresAt: issuedAt + Math.min(Math.max(ttlMs, 1), PREVIEW_TOKEN_TTL_MS)
+  }));
+  return `${payload}.${sign(payload, active.secret)}`;
 }
-function verifyPreviewToken(token, secret) {
+function verifyPreviewGrantToken(token, keys, now = Date.now()) {
   const segments = token.split(".");
   if (segments.length !== 2) return null;
   const [payload, signature] = segments;
   if (!payload || !signature) return null;
-  const expected = sign(payload, secret);
-  const expectedBuffer = Buffer.from(expected);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) return null;
-  if (!timingSafeEqual(expectedBuffer, actualBuffer)) return null;
   try {
-    const [pageId, expiresAt] = decode(payload).split("|");
-    if (!pageId || Number(expiresAt) < Date.now()) return null;
-    return pageId;
+    const claims = JSON.parse(decode(payload));
+    if (claims.version !== 1 || claims.audience !== "cms-preview" || claims.operation !== "read-draft" || typeof claims.keyId !== "string" || typeof claims.grantId !== "string" || typeof claims.pageId !== "string" || typeof claims.userId !== "string" || typeof claims.projectRef !== "string" || typeof claims.issuedAt !== "number" || !Number.isSafeInteger(claims.issuedAt) || typeof claims.expiresAt !== "number" || !Number.isSafeInteger(claims.expiresAt) || claims.issuedAt > now || claims.expiresAt <= now || claims.expiresAt - claims.issuedAt > PREVIEW_TOKEN_TTL_MS) {
+      return null;
+    }
+    const configured = keyRing(keys);
+    const signingKey = claims.keyId === configured.active.id || configured.active.id === "legacy" ? configured.active : claims.keyId === configured.previous?.id && now <= configured.previous.acceptUntil ? configured.previous : null;
+    if (!signingKey) return null;
+    const expectedBuffer = Buffer.from(sign(payload, signingKey.secret));
+    const actualBuffer = Buffer.from(signature);
+    if (expectedBuffer.length !== actualBuffer.length) return null;
+    if (!timingSafeEqual(expectedBuffer, actualBuffer)) return null;
+    return claims;
   } catch {
     return null;
   }
 }
-async function getPreviewPage(client, token, secret) {
-  const pageId = verifyPreviewToken(token, secret);
-  if (!pageId) return null;
-  const { data } = await client.from("cms_pages").select("id, slug, path, title, seo, draft_layout").eq("id", pageId).maybeSingle();
+function verifyPreviewToken(token, keys) {
+  return verifyPreviewGrantToken(token, keys)?.pageId ?? null;
+}
+async function getPreviewPage(client, token, keys, expectedProjectRef) {
+  const configured = keyRing(keys);
+  if (!configured.active.id || !configured.active.secret || !expectedProjectRef) return null;
+  const claims = verifyPreviewGrantToken(token, configured);
+  if (!claims || claims.projectRef !== expectedProjectRef) return null;
+  const { data: consumed, error: consumeError } = await client.rpc("cms_consume_preview_grant", {
+    p_grant_id: claims.grantId,
+    p_page_id: claims.pageId,
+    p_user_id: claims.userId,
+    p_project_ref: claims.projectRef,
+    p_key_id: claims.keyId
+  });
+  if (consumeError || consumed !== true) return null;
+  const { data } = await client.from("cms_pages").select("id, slug, path, title, seo, draft_layout").eq("id", claims.pageId).maybeSingle();
   if (!data) return null;
   return {
     id: String(data.id),
@@ -477,20 +506,67 @@ async function getPreviewPage(client, token, secret) {
 
 // src/server/supabase.ts
 import { createClient } from "@supabase/supabase-js";
+var projectRefFromUrl = (supabaseUrl) => {
+  let parsed;
+  try {
+    parsed = new URL(supabaseUrl);
+  } catch {
+    throw new Error("Orion CMS: the Supabase URL is invalid.");
+  }
+  const match = /^([a-z0-9]{20})\.supabase\.co$/.exec(parsed.hostname);
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.port || parsed.pathname !== "/" && parsed.pathname !== "" || parsed.search || parsed.hash || !match) {
+    throw new Error("Orion CMS: the standard HTTPS Supabase project URL is required.");
+  }
+  return match[1];
+};
+var legacyServiceKeyClaims = (key) => {
+  const segments = key.split(".");
+  if (segments.length !== 3) return null;
+  try {
+    const payload = Buffer.from(segments[1] || "", "base64url").toString("utf8");
+    const claims = JSON.parse(payload);
+    return claims && typeof claims === "object" && !Array.isArray(claims) ? claims : null;
+  } catch {
+    return null;
+  }
+};
+function validateCmsEnv(env) {
+  if (!/^[a-z0-9]{20}$/.test(env.expectedProjectRef)) {
+    throw new Error("Orion CMS: CMS_EXPECTED_SUPABASE_PROJECT_REF must be set.");
+  }
+  if (projectRefFromUrl(env.supabaseUrl) !== env.expectedProjectRef) {
+    throw new Error("Orion CMS: the Supabase URL does not match the expected project.");
+  }
+  if (env.serviceRoleKey.startsWith("sb_publishable_")) {
+    throw new Error("Orion CMS: a publishable key cannot be used as the server credential.");
+  }
+  if (!env.serviceRoleKey.startsWith("sb_secret_")) {
+    const claims = legacyServiceKeyClaims(env.serviceRoleKey);
+    if (!claims || claims.role !== "service_role") {
+      throw new Error("Orion CMS: a Supabase secret or legacy service-role key is required.");
+    }
+    if (claims.ref !== env.expectedProjectRef) {
+      throw new Error("Orion CMS: the legacy service-role key does not match the expected project.");
+    }
+  }
+  return env;
+}
 function readCmsEnv() {
   const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL || "";
-  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY || "";
+  const serviceRoleKey = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_SERVICE_ROLE_KEY || "";
+  const expectedProjectRef = process.env.CMS_EXPECTED_SUPABASE_PROJECT_REF || "";
   if (!supabaseUrl || !serviceRoleKey) {
     throw new Error(
-      "Orion CMS: NEXT_PUBLIC_SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (or SUPABASE_SECRET_KEY) must be set."
+      "Orion CMS: NEXT_PUBLIC_SUPABASE_URL and SUPABASE_SECRET_KEY (or legacy SUPABASE_SERVICE_ROLE_KEY) must be set."
     );
   }
-  return { supabaseUrl, serviceRoleKey };
+  return validateCmsEnv({ expectedProjectRef, supabaseUrl, serviceRoleKey });
 }
 var serviceClient = null;
 function getServiceClient(env = readCmsEnv()) {
   if (!serviceClient) {
-    serviceClient = createClient(env.supabaseUrl, env.serviceRoleKey, {
+    const validated = validateCmsEnv(env);
+    serviceClient = createClient(validated.supabaseUrl, validated.serviceRoleKey, {
       auth: { persistSession: false, autoRefreshToken: false }
     });
   }
@@ -516,12 +592,19 @@ async function resolveUser(request, client = getServiceClient()) {
 }
 
 // src/server/sync.ts
+import { createHash as createHash2 } from "crypto";
 var isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
 var publicFormConfig = (value) => {
   const config = isRecord(value) ? { ...value } : {};
   delete config.notify;
   return config;
 };
+var canonicalize = (value) => {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalize(value[key])]));
+};
+var sameValue = (left, right) => JSON.stringify(canonicalize(left)) === JSON.stringify(canonicalize(right));
 var mimeByExtension = {
   avif: "image/avif",
   gif: "image/gif",
@@ -534,22 +617,15 @@ var mimeByExtension = {
   webp: "image/webp"
 };
 var cleanPath = (src) => src.split("?")[0]?.split("#")[0] || src;
-var filenameFromPath = (path) => {
-  const clean = cleanPath(path);
-  return clean.split("/").filter(Boolean).pop() || clean;
-};
-var mimeFromPath = (path) => {
-  const extension = filenameFromPath(path).split(".").pop()?.toLowerCase() || "";
-  return mimeByExtension[extension] || "";
-};
+var filenameFromPath = (path) => cleanPath(path).split("/").filter(Boolean).pop() || cleanPath(path);
+var mimeFromPath = (path) => mimeByExtension[filenameFromPath(path).split(".").pop()?.toLowerCase() || ""] || "";
 var shouldIndexMediaPath = (src) => Boolean(src) && !src.startsWith("data:") && !/^https?:\/\//i.test(src);
 var toSyncMedia = (value) => {
   const src = typeof value.src === "string" ? value.src.trim() : "";
   if (!shouldIndexMediaPath(src)) return null;
-  const filename = typeof value.filename === "string" && value.filename.trim() ? value.filename.trim() : filenameFromPath(src);
   return {
     storagePath: src,
-    filename,
+    filename: typeof value.filename === "string" && value.filename.trim() ? value.filename.trim() : filenameFromPath(src),
     alt: typeof value.alt === "string" ? value.alt : "",
     caption: typeof value.caption === "string" ? value.caption : "",
     mimeType: mimeFromPath(src)
@@ -582,79 +658,328 @@ var normalizeManualMedia = (item) => {
     filesize: typeof item.filesize === "number" ? item.filesize : null
   };
 };
-async function runContentSync(client, registry, input) {
-  const pages = input.pages || [];
-  const globals = input.globals || [];
-  const forms = input.forms || [];
+var prepareSync = (registry, input) => {
+  const pages = [];
   const media = /* @__PURE__ */ new Map();
-  const synced = [];
   const skipped = [];
-  for (const page of pages) {
+  for (const page of input.pages || []) {
     if (!page || typeof page.slug !== "string") continue;
     const validated = registry.validateLayout(page.layout ?? []);
     if (!validated.ok) {
       skipped.push({ slug: page.slug, issues: validated.issues });
       continue;
     }
-    const { error } = await client.rpc("cms_sync_page", {
-      p_slug: page.slug,
-      p_path: typeof page.path === "string" ? page.path : page.slug === "home" ? "/" : `/${page.slug}`,
-      p_title: typeof page.title === "string" ? page.title : page.slug,
-      p_seo: isRecord(page.seo) ? page.seo : {},
-      p_layout: validated.layout
-    });
-    if (error) {
-      skipped.push({ slug: page.slug, issues: error.message });
-      continue;
-    }
     collectLayoutMedia(validated.layout, media);
-    synced.push(page.slug);
+    pages.push({
+      slug: page.slug,
+      path: typeof page.path === "string" ? page.path : page.slug === "home" ? "/" : `/${page.slug}`,
+      title: typeof page.title === "string" ? page.title : page.slug,
+      seo: isRecord(page.seo) ? page.seo : {},
+      layout: validated.layout
+    });
   }
   for (const item of input.media || []) {
     const normalized = normalizeManualMedia(item);
     if (normalized && !media.has(normalized.storagePath)) media.set(normalized.storagePath, normalized);
   }
-  let syncedMedia = 0;
-  for (const item of media.values()) {
-    const { data: existing, error: readError } = await client.from("cms_media").select("id").eq("storage_path", item.storagePath).maybeSingle();
-    if (readError || existing) continue;
-    const { error: insertError } = await client.from("cms_media").insert({
-      storage_path: item.storagePath,
-      filename: item.filename || filenameFromPath(item.storagePath),
-      alt: item.alt || "",
-      caption: item.caption || "",
-      mime_type: item.mimeType || mimeFromPath(item.storagePath),
-      width: item.width ?? null,
-      height: item.height ?? null,
-      filesize: item.filesize ?? null
-    });
-    if (!insertError) syncedMedia += 1;
-  }
-  const failed = [];
-  let syncedGlobals = 0;
-  for (const global of globals) {
-    if (!global || typeof global.key !== "string" || !isRecord(global.data)) continue;
-    const { error } = await client.from("cms_globals").upsert({ key: global.key, data: global.data, updated_at: (/* @__PURE__ */ new Date()).toISOString() });
-    if (error) failed.push({ kind: "global", key: global.key, error: error.message });
-    else syncedGlobals += 1;
-  }
-  let syncedForms = 0;
-  for (const form of forms) {
-    if (!form || typeof form.slug !== "string") continue;
-    const { error } = await client.from("cms_forms").upsert(
+  return {
+    pages,
+    globals: (input.globals || []).filter((item) => Boolean(item && typeof item.key === "string" && isRecord(item.data))),
+    forms: (input.forms || []).filter((item) => Boolean(item && typeof item.slug === "string")).map((form) => ({
+      slug: form.slug,
+      title: typeof form.title === "string" ? form.title : form.slug,
+      config: publicFormConfig(form.config),
+      successMessage: typeof form.successMessage === "string" ? form.successMessage : ""
+    })),
+    media: [...media.values()],
+    redirects: (input.redirects || []).filter((item) => Boolean(
+      item && typeof item.fromPath === "string" && typeof item.toPath === "string"
+    )).map((item) => ({
+      fromPath: item.fromPath,
+      toPath: item.toPath,
+      permanent: item.permanent !== false
+    })),
+    skipped
+  };
+};
+var readOne = async (client, table, columns, key, value) => {
+  const { data, error } = await client.from(table).select(columns).eq(key, value).maybeSingle();
+  if (error) throw new Error(error.message);
+  return data;
+};
+var readMany = async (client, table, columns) => {
+  const { data, error } = await client.from(table).select(columns);
+  if (error) throw new Error(error.message);
+  return data || [];
+};
+var targetReceiptHash = async (client, expectedProjectRef = "") => {
+  if (expectedProjectRef === "memory") {
+    return createHash2("sha256").update("memory:uninitialized").digest("hex");
+  }
+  const marker = await readOne(client, "cms_target_identity", "project_ref", "singleton", true);
+  const projectRef = typeof marker?.project_ref === "string" ? marker.project_ref : "";
+  if (!expectedProjectRef && !projectRef) {
+    return createHash2("sha256").update("unbound-local:uninitialized").digest("hex");
+  }
+  if (!projectRef || projectRef !== expectedProjectRef) {
+    throw new Error("Sync target identity does not match the expected CMS project.");
+  }
+  const migrations = await readMany(client, "cms_migrations", "version");
+  const migrationHead = migrations.map((row) => String(row.version)).sort().at(-1) || "empty";
+  return createHash2("sha256").update(JSON.stringify(canonicalize({
+    migrationHead,
+    projectRefHash: createHash2("sha256").update(projectRef).digest("hex").slice(0, 16)
+  }))).digest("hex");
+};
+async function buildPlan(client, registry, input, expectedProjectRef = "") {
+  const prepared = prepareSync(registry, input);
+  const operations = [];
+  for (const page of prepared.pages) {
+    const current = await readOne(client, "cms_pages", "slug, path, title, seo, draft_layout, builder_owned", "slug", page.slug);
+    const action = !current ? "create" : current.builder_owned === true ? "conflict" : sameValue(
+      { path: current.path, title: current.title, seo: current.seo, layout: current.draft_layout },
+      { path: page.path, title: page.title, seo: page.seo, layout: page.layout }
+    ) ? "noop" : "update";
+    operations.push({ kind: "page", key: page.slug, action });
+  }
+  for (const global of prepared.globals) {
+    const current = await readOne(client, "cms_globals", "key, data, builder_owned", "key", global.key);
+    const action = !current ? "create" : current.builder_owned === true ? "conflict" : sameValue(current.data, global.data) ? "noop" : "update";
+    operations.push({ kind: "global", key: global.key, action });
+  }
+  for (const form of prepared.forms) {
+    const current = await readOne(client, "cms_forms", "slug, title, config, success_message, builder_owned", "slug", form.slug);
+    const action = !current ? "create" : current.builder_owned === true ? "conflict" : sameValue(
+      { title: current.title, config: current.config, successMessage: current.success_message },
+      { title: form.title, config: form.config, successMessage: form.successMessage }
+    ) ? "noop" : "update";
+    operations.push({ kind: "form", key: form.slug, action });
+  }
+  for (const item of prepared.media) {
+    const current = await readOne(client, "cms_media", "id, storage_path, filename, alt, caption, mime_type, width, height, filesize, builder_owned", "storage_path", item.storagePath);
+    const action = !current ? "create" : current.builder_owned === true ? "conflict" : sameValue(
       {
-        slug: form.slug,
-        title: typeof form.title === "string" ? form.title : form.slug,
-        config: publicFormConfig(form.config),
-        success_message: typeof form.successMessage === "string" ? form.successMessage : "",
-        updated_at: (/* @__PURE__ */ new Date()).toISOString()
+        filename: current.filename,
+        alt: current.alt,
+        caption: current.caption,
+        mimeType: current.mime_type,
+        width: current.width,
+        height: current.height,
+        filesize: current.filesize
       },
-      { onConflict: "slug" }
+      {
+        filename: item.filename,
+        alt: item.alt,
+        caption: item.caption,
+        mimeType: item.mimeType,
+        width: item.width ?? null,
+        height: item.height ?? null,
+        filesize: item.filesize ?? null
+      }
+    ) ? "noop" : "update";
+    operations.push({ kind: "media", key: item.storagePath, action });
+  }
+  for (const redirect of prepared.redirects) {
+    const current = await readOne(client, "cms_redirects", "from_path, to_path, permanent, builder_owned", "from_path", redirect.fromPath);
+    const action = !current ? "create" : current.builder_owned === true ? "conflict" : sameValue(
+      { toPath: current.to_path, permanent: current.permanent },
+      { toPath: redirect.toPath, permanent: redirect.permanent }
+    ) ? "noop" : "update";
+    operations.push({ kind: "redirect", key: redirect.fromPath, action });
+  }
+  const ownershipSets = /* @__PURE__ */ new Map([
+    ["page", new Set(prepared.pages.map((item) => item.slug))],
+    ["global", new Set(prepared.globals.map((item) => item.key))],
+    ["form", new Set(prepared.forms.map((item) => item.slug))],
+    ["media", new Set(prepared.media.map((item) => item.storagePath))],
+    ["redirect", new Set(prepared.redirects.map((item) => item.fromPath))]
+  ]);
+  const remoteOwned = [
+    ["page", "cms_pages", "slug"],
+    ["global", "cms_globals", "key"],
+    ["form", "cms_forms", "slug"],
+    ["media", "cms_media", "storage_path"],
+    ["redirect", "cms_redirects", "from_path"]
+  ];
+  for (const [kind, table, key] of remoteOwned) {
+    const rows = await readMany(client, table, `${key}, builder_owned`);
+    for (const row of rows) {
+      const value = String(row[key] ?? "");
+      if (row.builder_owned === false && value && !ownershipSets.get(kind)?.has(value)) {
+        operations.push({ kind, key: value, action: "blocked-delete" });
+      }
+    }
+  }
+  const kindOrder = {
+    page: 0,
+    global: 1,
+    form: 2,
+    media: 3,
+    redirect: 4
+  };
+  operations.sort(
+    (left, right) => kindOrder[left.kind] - kindOrder[right.kind] || left.key.localeCompare(right.key)
+  );
+  const receiptHash = await targetReceiptHash(client, expectedProjectRef);
+  const manifestHash = createHash2("sha256").update(JSON.stringify(canonicalize({
+    input: prepared,
+    targetReceiptHash: receiptHash,
+    version: 1
+  }))).digest("hex");
+  return {
+    prepared,
+    plan: {
+      mode: "dry-run",
+      manifestHash,
+      targetReceiptHash: receiptHash,
+      operations,
+      skipped: prepared.skipped
+    }
+  };
+}
+async function runContentSync(client, registry, input, options = { mode: "dry-run" }) {
+  if (options.mode === "apply") {
+    const currentTargetReceiptHash = await targetReceiptHash(client, options.expectedProjectRef);
+    if (!options.expectedTargetReceiptHash || options.expectedTargetReceiptHash !== currentTargetReceiptHash) {
+      throw new Error("Sync target receipt changed. Run a new dry run for the current CMS target.");
+    }
+    const completed = await readOne(
+      client,
+      "cms_sync_runs",
+      "manifest_hash, target_receipt_hash, status, result",
+      "manifest_hash",
+      options.expectedManifestHash
     );
-    if (error) failed.push({ kind: "form", key: form.slug, error: error.message });
-    else syncedForms += 1;
+    if (completed?.status === "complete" && completed.target_receipt_hash === currentTargetReceiptHash && isRecord(completed.result)) {
+      return completed.result;
+    }
+  }
+  const { prepared, plan } = await buildPlan(client, registry, input, options.expectedProjectRef);
+  if (options.mode !== "apply") return plan;
+  if (!options.expectedManifestHash || options.expectedManifestHash !== plan.manifestHash) {
+    throw new Error("Sync manifest changed. Run a new dry run and apply its exact manifest hash.");
+  }
+  if (!options.expectedTargetReceiptHash || options.expectedTargetReceiptHash !== plan.targetReceiptHash) {
+    throw new Error("Sync target receipt changed. Run a new dry run for the current CMS target.");
+  }
+  const { data: lease, error: leaseError } = await client.rpc("cms_begin_sync", {
+    p_manifest_hash: plan.manifestHash,
+    p_target_receipt_hash: plan.targetReceiptHash
+  });
+  if (leaseError) throw new Error(leaseError.message);
+  const leaseResult = isRecord(lease) ? lease : {};
+  if (leaseResult.status === "busy") {
+    throw new Error("Another content sync is active for this CMS target.");
+  }
+  if (leaseResult.status === "complete" && isRecord(leaseResult.result)) {
+    return leaseResult.result;
+  }
+  if (!["started", "resume"].includes(String(leaseResult.status))) {
+    throw new Error("The CMS sync lease could not be acquired.");
+  }
+  try {
+    const synced = [];
+    const failed = [];
+    const conflicts = plan.operations.filter((operation) => operation.action === "conflict");
+    let globals = 0;
+    let forms = 0;
+    let media = 0;
+    for (const page of prepared.pages) {
+      const operation = plan.operations.find((item) => item.kind === "page" && item.key === page.slug);
+      if (!operation || operation.action === "conflict" || operation.action === "noop") continue;
+      const { error } = await client.rpc("cms_sync_page", {
+        p_slug: page.slug,
+        p_path: page.path,
+        p_title: page.title,
+        p_seo: page.seo,
+        p_layout: page.layout
+      });
+      if (error) failed.push({ kind: "page", key: page.slug, error: error.message });
+      else synced.push(page.slug);
+    }
+    for (const global of prepared.globals) {
+      const operation = plan.operations.find((item) => item.kind === "global" && item.key === global.key);
+      if (!operation || operation.action === "conflict" || operation.action === "noop") continue;
+      const { data, error } = await client.rpc("cms_sync_global", { p_key: global.key, p_data: global.data });
+      if (error) failed.push({ kind: "global", key: global.key, error: error.message });
+      else if (data === true) globals += 1;
+      else conflicts.push({ kind: "global", key: global.key, action: "conflict" });
+    }
+    for (const form of prepared.forms) {
+      const operation = plan.operations.find((item) => item.kind === "form" && item.key === form.slug);
+      if (!operation || operation.action === "conflict" || operation.action === "noop") continue;
+      const { data, error } = await client.rpc("cms_sync_form", {
+        p_slug: form.slug,
+        p_title: form.title,
+        p_config: form.config,
+        p_success_message: form.successMessage
+      });
+      if (error) failed.push({ kind: "form", key: form.slug, error: error.message });
+      else if (data === true) forms += 1;
+      else conflicts.push({ kind: "form", key: form.slug, action: "conflict" });
+    }
+    for (const item of prepared.media) {
+      const operation = plan.operations.find((entry) => entry.kind === "media" && entry.key === item.storagePath);
+      if (!operation || !["create", "update"].includes(operation.action)) continue;
+      const { data, error } = await client.rpc("cms_sync_media", {
+        p_storage_path: item.storagePath,
+        p_filename: item.filename || filenameFromPath(item.storagePath),
+        p_alt: item.alt || "",
+        p_caption: item.caption || "",
+        p_mime_type: item.mimeType || mimeFromPath(item.storagePath),
+        p_width: item.width ?? null,
+        p_height: item.height ?? null,
+        p_filesize: item.filesize ?? null
+      });
+      if (error) failed.push({ kind: "media", key: item.storagePath, error: error.message });
+      else if (data === true) media += 1;
+      else conflicts.push({ kind: "media", key: item.storagePath, action: "conflict" });
+    }
+    for (const redirect of prepared.redirects) {
+      const operation = plan.operations.find((entry) => entry.kind === "redirect" && entry.key === redirect.fromPath);
+      if (!operation || !["create", "update"].includes(operation.action)) continue;
+      const { data, error } = await client.rpc("cms_sync_redirect", {
+        p_from_path: redirect.fromPath,
+        p_to_path: redirect.toPath,
+        p_permanent: redirect.permanent
+      });
+      if (error) failed.push({ kind: "redirect", key: redirect.fromPath, error: error.message });
+      else if (data !== true) conflicts.push({ kind: "redirect", key: redirect.fromPath, action: "conflict" });
+    }
+    const result = {
+      mode: "apply",
+      manifestHash: plan.manifestHash,
+      targetReceiptHash: plan.targetReceiptHash,
+      synced,
+      skipped: plan.skipped,
+      globals,
+      forms,
+      media,
+      failed,
+      conflicts
+    };
+    const completionStatus = failed.length === 0 ? "complete" : "failed";
+    const completionError = completionStatus === "failed" ? `${failed.length} content sync operation${failed.length === 1 ? "" : "s"} failed.` : null;
+    const { data: finished, error: finishError } = await client.rpc("cms_finish_sync", {
+      p_manifest_hash: plan.manifestHash,
+      p_status: completionStatus,
+      p_result: completionStatus === "complete" ? result : null,
+      p_error: completionError
+    });
+    if (finishError || finished !== true) {
+      throw new Error(finishError?.message || "The CMS sync completion receipt was not recorded.");
+    }
+    if (completionError) throw new Error(completionError);
+    return result;
+  } catch (error) {
+    await client.rpc("cms_finish_sync", {
+      p_manifest_hash: plan.manifestHash,
+      p_status: "failed",
+      p_result: null,
+      p_error: error instanceof Error ? error.message : "Content sync failed."
+    });
+    throw error;
   }
-  return { synced, skipped, globals: syncedGlobals, forms: syncedForms, media: syncedMedia, failed };
 }
 
 // src/server/routes.ts
@@ -739,6 +1064,7 @@ var clientKey = (request) => {
 };
 var MAX_PUBLIC_BODY_BYTES = 64 * 1024;
 var MAX_PUBLIC_BODY_DEPTH = 12;
+var MAX_SYNC_BODY_BYTES = 2 * 1024 * 1024;
 function exceedsDepth(value, limit, depth = 0) {
   if (depth > limit) return true;
   if (Array.isArray(value)) return value.some((item) => exceedsDepth(item, limit, depth + 1));
@@ -746,13 +1072,38 @@ function exceedsDepth(value, limit, depth = 0) {
   return false;
 }
 async function readJsonLimited(request, limits) {
-  let text;
+  const declaredLength = request.headers.get("content-length");
+  if (declaredLength !== null) {
+    if (!/^[0-9]+$/.test(declaredLength)) return null;
+    const length = Number(declaredLength);
+    if (!Number.isSafeInteger(length) || length > limits.maxBytes) return null;
+  }
+  if (!request.body) return null;
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let totalBytes = 0;
+  let text = "";
   try {
-    text = await request.text();
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > limits.maxBytes) {
+        await reader.cancel("CMS request body exceeded the configured byte limit.");
+        return null;
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
   } catch {
+    try {
+      await reader.cancel();
+    } catch {
+    }
     return null;
+  } finally {
+    reader.releaseLock();
   }
-  if (text.length > limits.maxBytes) return null;
   let parsed;
   try {
     parsed = JSON.parse(text);
@@ -763,7 +1114,7 @@ async function readJsonLimited(request, limits) {
   if (exceedsDepth(parsed, limits.maxDepth)) return null;
   return parsed;
 }
-var hashedClientKey = (ip) => createHash2("sha256").update(ip).digest("hex").slice(0, 24);
+var hashedClientKey = (ip) => createHash3("sha256").update(ip).digest("hex").slice(0, 24);
 var requestPagePath = (request) => {
   const referrer = request.headers.get("referer");
   if (!referrer) return "";
@@ -799,16 +1150,27 @@ function createDurableRateLimitStore(getClient, options) {
   };
 }
 function createCmsRoutes(options) {
-  const { registry, allowedOrigins, syncToken, knownGoodEmailDomains } = options;
+  const { registry, allowedOrigins, syncToken, cronToken, knownGoodEmailDomains } = options;
   const db = () => options.client ?? getServiceClient();
   const hostedMemoryMode = options.memoryMode === true && process.env.NODE_ENV === "production";
   const rateLimit = options.rateLimitStore === null ? null : options.rateLimitStore || (options.memoryMode ? createMemoryRateLimitStore() : createDurableRateLimitStore(db, { max: 5, windowMs: 6e4, bucket: "submit" }));
   const sendEmail = hostedMemoryMode || options.sendEmail === null ? null : options.sendEmail || createResendSender();
   const maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
-  const previewSecret = () => {
-    if (hostedMemoryMode) return "";
-    return options.previewSecret || process.env.SUPABASE_SERVICE_ROLE_KEY || (options.memoryMode ? "orion-memory-preview-secret" : "");
-  };
+  const previewKeys = () => {
+    if (hostedMemoryMode) return null;
+    const activeSecret = options.previewSecret || (options.memoryMode ? "orion-memory-preview-secret" : "");
+    const activeId = options.previewKeyId || (options.memoryMode ? "memory-v1" : "");
+    if (!activeSecret || !activeId) return null;
+    const previous = options.previewPreviousSecret && options.previewPreviousKeyId && options.previewPreviousValidUntil ? {
+      id: options.previewPreviousKeyId,
+      secret: options.previewPreviousSecret,
+      acceptUntil: options.previewPreviousValidUntil
+    } : void 0;
+    return { active: { id: activeId, secret: activeSecret }, ...previous ? { previous } : {} };
+  };
+  const previewProjectRef = options.projectRef || (options.memoryMode ? "memory" : "");
+  const analyticsSecret = options.analyticsSecret || (options.memoryMode ? "orion-memory-analytics-secret" : "");
+  const autoReplyHashSecret = options.autoReplyHashSecret || (options.memoryMode ? "orion-memory-auto-reply-secret" : "");
   const analyticsLimit = (max, windowMs, bucket) => options.memoryMode ? createMemoryRateLimitStore({ max, windowMs }) : createDurableRateLimitStore(db, { max, windowMs, bucket, failClosed: true });
   const autoReplyLimit = (max, windowMs, bucket) => options.memoryMode ? createMemoryRateLimitStore({ max, windowMs }) : createDurableRateLimitStore(db, { max, windowMs, bucket, failClosed: true });
   const boundedAutoReplyMax = (name, fallback) => {
@@ -832,14 +1194,12 @@ function createCmsRoutes(options) {
       "auto-reply-site-day"
     )
   };
-  const autoReplyRecipientKey = (email) => createHmac3(
-    "sha256",
-    previewSecret() || syncToken || "orion-memory-auto-reply-secret"
-  ).update(`recipient:${email}`).digest("hex").slice(0, 24);
+  const autoReplyRecipientKey = (email) => createHmac3("sha256", autoReplyHashSecret).update(`recipient:${email}`).digest("hex").slice(0, 24);
   const maySendAutoReply = async (config, data) => {
     if (config.notify?.autoReply !== true) return false;
     const recipient = resolveSubmitterEmail(config, data);
     if (!recipient) return false;
+    if (!autoReplyHashSecret) return false;
     const now = Date.now();
     if (await autoReplyLimits.recipientPerHour.isLimited(autoReplyRecipientKey(recipient), now)) {
       return false;
@@ -891,8 +1251,8 @@ function createCmsRoutes(options) {
   };
   const analyticsRetentionDays = options.analyticsRetentionDays ?? 90;
   const requestSessionKey = (request) => {
-    const secret = previewSecret() || "orion-analytics";
-    return sessionKeyFor(clientKey(request), request.headers.get("user-agent") || "", secret);
+    if (!analyticsSecret) return "";
+    return sessionKeyFor(clientKey(request), request.headers.get("user-agent") || "", analyticsSecret);
   };
   const guard = async (request, action) => {
     if (hostedMemoryMode) return errors.unauthorized();
@@ -901,6 +1261,13 @@ function createCmsRoutes(options) {
     if (!can(user, action)) return errors.forbidden();
     return { user };
   };
+  const revokePreviewGrants = async (filter) => {
+    let query = db().from("cms_preview_grants").update({ revoked_at: (/* @__PURE__ */ new Date()).toISOString() });
+    if (filter.pageId) query = query.eq("page_id", filter.pageId);
+    if (filter.userId) query = query.eq("user_id", filter.userId);
+    const { error } = await query;
+    return error?.message ?? null;
+  };
   const logActivity = async (user, action, subject) => {
     try {
       await db().from("cms_activity").insert({
@@ -1020,6 +1387,7 @@ function createCmsRoutes(options) {
         }
         patch.path = path;
       }
+      patch.builder_owned = true;
       if (Object.keys(patch).length > 0) {
         const oldPath = String(current.path || "");
         const wasPublished = current.status === "published";
@@ -1033,7 +1401,12 @@ function createCmsRoutes(options) {
         const newPath = typeof patch.path === "string" ? patch.path : oldPath;
         if (newPath !== oldPath && wasPublished && oldPath !== "/") {
           await db().from("cms_redirects").delete().eq("from_path", newPath);
-          await db().from("cms_redirects").upsert({ from_path: oldPath, to_path: newPath, permanent: true }, { onConflict: "from_path" });
+          await db().from("cms_redirects").upsert({
+            from_path: oldPath,
+            to_path: newPath,
+            permanent: true,
+            builder_owned: true
+          }, { onConflict: "from_path" });
         }
         if (newPath !== oldPath) {
           await logActivity(auth.user, "page.rename", `${oldPath} \u2192 ${newPath}`);
@@ -1093,6 +1466,8 @@ function createCmsRoutes(options) {
     if (!Number.isSafeInteger(expectedVersionId) || expectedVersionId <= 0) {
       return errors.conflict("Page version conflict: save the draft again before publishing.");
     }
+    const revokeError = await revokePreviewGrants({ pageId: id });
+    if (revokeError) return errors.badRequest("Unable to revoke existing preview grants.");
     const { data, error } = await db().rpc("cms_publish_page", {
       p_page_id: id,
       p_expected_version_id: expectedVersionId,
@@ -1109,6 +1484,8 @@ function createCmsRoutes(options) {
   const unpublishPage = async (request, id) => {
     const auth = await guard(request, "pages.publish");
     if (auth instanceof Response) return auth;
+    const revokeError = await revokePreviewGrants({ pageId: id });
+    if (revokeError) return errors.badRequest("Unable to revoke existing preview grants.");
     const { data, error } = await db().from("cms_pages").update({
       status: "draft",
       publish_at: null,
@@ -1167,11 +1544,28 @@ function createCmsRoutes(options) {
   const previewToken = async (request, id) => {
     const auth = await guard(request, "pages.read");
     if (auth instanceof Response) return auth;
-    const secret = previewSecret();
-    if (!secret) return errors.badRequest("Preview is not configured on this site.");
+    const keys = previewKeys();
+    if (!keys || !previewProjectRef) return errors.badRequest("Preview is not configured on this site.");
     const { data } = await db().from("cms_pages").select("id, path").eq("id", id).maybeSingle();
     if (!data) return errors.notFound();
-    const token = createPreviewToken(id, secret);
+    const grantId = randomUUID();
+    const expiresAt = new Date(Date.now() + PREVIEW_TOKEN_TTL_MS).toISOString();
+    const { error: grantError } = await db().from("cms_preview_grants").insert({
+      id: grantId,
+      page_id: id,
+      user_id: auth.user.id,
+      project_ref: previewProjectRef,
+      key_id: keys.active.id,
+      expires_at: expiresAt,
+      max_uses: PREVIEW_TOKEN_MAX_USES
+    });
+    if (grantError) return errors.badRequest("Unable to create a preview grant.");
+    const token = createPreviewToken({
+      grantId,
+      pageId: id,
+      userId: auth.user.id,
+      projectRef: previewProjectRef
+    }, keys);
     const previewUrl = `/cms-preview/${encodeURIComponent(String(data.id))}`;
     const response = json({ path: data.path, url: previewUrl });
     const secure = process.env.NODE_ENV === "production" || new URL(request.url).protocol === "https:";
@@ -1183,6 +1577,14 @@ function createCmsRoutes(options) {
     );
     return response;
   };
+  const revokePagePreviews = async (request, id) => {
+    const auth = await guard(request, "pages.read");
+    if (auth instanceof Response) return auth;
+    const revokeError = await revokePreviewGrants({ pageId: id });
+    if (revokeError) return errors.badRequest("Unable to revoke preview grants.");
+    await logActivity(auth.user, "page.preview.revoke", id);
+    return json({ success: true });
+  };
   const listVersions = async (request, id) => {
     const auth = await guard(request, "pages.restore");
     if (auth instanceof Response) return auth;
@@ -1209,6 +1611,10 @@ function createCmsRoutes(options) {
   const restoreVersion = async (request, versionId) => {
     const auth = await guard(request, "pages.restore");
     if (auth instanceof Response) return auth;
+    const { data: version } = await db().from("cms_page_versions").select("page_id").eq("id", Number(versionId)).maybeSingle();
+    if (!version) return errors.notFound();
+    const revokeError = await revokePreviewGrants({ pageId: String(version.page_id) });
+    if (revokeError) return errors.badRequest("Unable to revoke existing preview grants.");
     const { data, error } = await db().rpc("cms_restore_page_version", {
       p_version_id: Number(versionId),
       p_actor: auth.user.id
@@ -1254,6 +1660,7 @@ function createCmsRoutes(options) {
     const { data, error } = await db().from("cms_globals").upsert({
       key: version.key,
       data: version.data,
+      builder_owned: true,
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     }).select("*").single();
     if (error) return errors.badRequest(error.message);
@@ -1343,7 +1750,8 @@ function createCmsRoutes(options) {
       mime_type: normalizedFile.type,
       width: prepared.width,
       height: prepared.height,
-      filesize: normalizedFile.size
+      filesize: normalizedFile.size,
+      builder_owned: true
     }).select("*").single();
     if (error) return errors.badRequest(error.message);
     if (!options.memoryMode) {
@@ -1361,7 +1769,10 @@ function createCmsRoutes(options) {
     if (auth instanceof Response) return auth;
     const body = await readJson(request);
     if (!body) return errors.badRequest("Invalid body.");
-    const patch = { updated_at: (/* @__PURE__ */ new Date()).toISOString() };
+    const patch = {
+      builder_owned: true,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
     if (typeof body.alt === "string") patch.alt = body.alt;
     if (typeof body.caption === "string") patch.caption = body.caption;
     if (typeof body.filename === "string" && body.filename.trim()) {
@@ -1420,6 +1831,7 @@ function createCmsRoutes(options) {
       filesize: normalizedFile.size,
       width: prepared.width,
       height: prepared.height,
+      builder_owned: true,
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     }).eq("id", id).select("*").single();
     if (error) return errors.badRequest(error.message);
@@ -1488,7 +1900,8 @@ function createCmsRoutes(options) {
       slug,
       title,
       config: { steps: [{ title: "", fields: [] }] },
-      success_message: "Thanks \u2014 we received your submission."
+      success_message: "Thanks \u2014 we received your submission.",
+      builder_owned: true
     }).select("*").single();
     if (error) {
       if (error.message.includes("duplicate")) {
@@ -1502,9 +1915,15 @@ function createCmsRoutes(options) {
   const getForm = async (request, slug) => {
     const auth = await guard(request, "forms.read");
     if (auth instanceof Response) return auth;
-    const { data, error } = await db().from("cms_forms").select("*").eq("slug", slug).maybeSingle();
+    const projection = can(auth.user, "forms.write") ? "id, slug, title, config, notify, success_message, updated_at" : "id, slug, title, config, success_message, updated_at";
+    const { data, error } = await db().from("cms_forms").select(projection).eq("slug", slug).maybeSingle();
     if (error) return errors.badRequest(error.message);
     if (!data) return errors.notFound();
+    if (!can(auth.user, "forms.write")) {
+      const { notify, ...publicForm } = data;
+      void notify;
+      return json({ form: publicForm });
+    }
     return json({ form: data });
   };
   const updateForm = async (request, slug) => {
@@ -1546,6 +1965,7 @@ function createCmsRoutes(options) {
         config,
         notify,
         success_message: typeof body.successMessage === "string" ? body.successMessage : "",
+        builder_owned: true,
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
       { onConflict: "slug" }
@@ -1754,7 +2174,12 @@ function createCmsRoutes(options) {
       return errors.badRequest("To path must start with / or be a full URL.");
     }
     if (fromPath === toPath) return errors.badRequest("A redirect cannot point at itself.");
-    const { data, error } = await db().from("cms_redirects").upsert({ from_path: fromPath, to_path: toPath, permanent }, { onConflict: "from_path" }).select("*").single();
+    const { data, error } = await db().from("cms_redirects").upsert({
+      from_path: fromPath,
+      to_path: toPath,
+      permanent,
+      builder_owned: true
+    }, { onConflict: "from_path" }).select("*").single();
     if (error) return errors.badRequest(error.message);
     await logActivity(auth.user, "redirect.save", `${fromPath} \u2192 ${toPath}`);
     return json({ redirect: data }, 201);
@@ -1768,6 +2193,7 @@ function createCmsRoutes(options) {
   };
   const ingestEvents = async (request) => {
     if (!isOriginAllowed(request, allowedOrigins)) return errors.forbidden();
+    if (!analyticsSecret) return json({ success: true });
     const userAgent = request.headers.get("user-agent") || "";
     if (isBotRequest(userAgent)) return json({ success: true });
     const now = Date.now();
@@ -1784,7 +2210,7 @@ function createCmsRoutes(options) {
       sessionKey: requestSessionKey(request),
       visitorKey: visitorKeyFor(
         body?.visitorId,
-        previewSecret() || "orion-analytics"
+        analyticsSecret
       ),
       device: deviceFrom(userAgent),
       ...geoFrom(request)
@@ -1861,7 +2287,7 @@ function createCmsRoutes(options) {
   const cronPublishDue = async (request) => {
     if (hostedMemoryMode) return errors.forbidden();
     const bearer = (request.headers.get("authorization") || "").replace(/^Bearer\s+/i, "");
-    let authorized = tokenEquals(bearer, syncToken || "") || tokenEquals(bearer, process.env.CRON_SECRET || "");
+    let authorized = tokenEquals(bearer, cronToken || "");
     if (!authorized) {
       const user = await resolveUser(request, db());
       authorized = Boolean(user && can(user, "pages.publish"));
@@ -2020,6 +2446,10 @@ function createCmsRoutes(options) {
         return errors.badRequest("You can only assign roles at or below your own.");
       }
     }
+    if (body.role !== void 0 && body.role !== membership.role) {
+      const revokeError = await revokePreviewGrants({ userId: canonicalUserId });
+      if (revokeError) return errors.badRequest("Unable to revoke the user preview grants.");
+    }
     if (typeof body.password === "string") {
       if (body.password.length < 8) return errors.badRequest("Password must be at least 8 characters.");
       const { error: passwordError } = await db().auth.admin.updateUserById(canonicalUserId, {
@@ -2048,6 +2478,8 @@ function createCmsRoutes(options) {
       return errors.badRequest("You can't remove your own account.");
     }
     if (!outranksOrEqual(auth.user.role, membership.role)) return errors.forbidden();
+    const revokeError = await revokePreviewGrants({ userId: canonicalUserId });
+    if (revokeError) return errors.badRequest("Unable to revoke the user preview grants.");
     const { error: authError } = await db().auth.admin.deleteUser(canonicalUserId);
     if (authError) return errors.badRequest(authError.message);
     const { error: profileError } = await db().from("cms_profiles").delete().eq("user_id", canonicalUserId);
@@ -2064,10 +2496,30 @@ function createCmsRoutes(options) {
       authorized = Boolean(user && can(user, "sync.run"));
     }
     if (!authorized) return errors.forbidden();
-    const body = await readJson(request);
+    const body = await readJsonLimited(request, { maxBytes: MAX_SYNC_BODY_BYTES, maxDepth: 32 });
     if (!body) return errors.badRequest("Invalid body.");
-    const result = await runContentSync(db(), registry, body);
-    await revalidateContent();
+    const input = isRecord2(body.input) ? body.input : body;
+    const mode = body.mode === "apply" ? "apply" : "dry-run";
+    const expectedManifestHash = typeof body.expectedManifestHash === "string" ? body.expectedManifestHash : "";
+    const expectedTargetReceiptHash = typeof body.expectedTargetReceiptHash === "string" ? body.expectedTargetReceiptHash : "";
+    let result;
+    try {
+      result = mode === "apply" ? await runContentSync(db(), registry, input, {
+        mode,
+        expectedManifestHash,
+        expectedProjectRef: previewProjectRef,
+        expectedTargetReceiptHash
+      }) : await runContentSync(db(), registry, input, {
+        mode,
+        expectedProjectRef: previewProjectRef
+      });
+    } catch (error) {
+      return errors.conflict(error instanceof Error ? error.message : "Sync manifest conflict.");
+    }
+    if (result.mode === "apply") {
+      await logActivity(null, "sync.apply", result.manifestHash);
+      await revalidateContent();
+    }
     return json({ success: true, ...result });
   };
   const dispatch = async (request, context) => {
@@ -2091,6 +2543,8 @@ function createCmsRoutes(options) {
         return duplicatePage(request, second);
       } else if (third === "preview" && method === "POST") {
         return previewToken(request, second);
+      } else if (third === "preview" && method === "DELETE") {
+        return revokePagePreviews(request, second);
       } else if (third === "versions" && method === "GET") {
         return listVersions(request, second);
       }
@@ -2465,10 +2919,11 @@ function runRpc(store, fn, args = {}) {
       const key = String(args.p_key);
       let row = globals.find((r) => r.key === key);
       if (!row) {
-        row = { key, label: "", data: args.p_data ?? {}, updated_at: nowIso() };
+        row = { key, label: "", data: args.p_data ?? {}, builder_owned: true, updated_at: nowIso() };
         globals.push(row);
       } else {
         row.data = args.p_data ?? {};
+        row.builder_owned = true;
         row.updated_at = nowIso();
       }
       globalVersions.push({
@@ -2513,6 +2968,55 @@ function runRpc(store, fn, args = {}) {
       store.setTable("cms_rate_limits", kept);
       return { data: limits.length - kept.length, error: null };
     }
+    case "cms_consume_preview_grant": {
+      const grant = store.table("cms_preview_grants").find(
+        (row) => row.id === args.p_grant_id && row.page_id === args.p_page_id && row.user_id === args.p_user_id && row.project_ref === args.p_project_ref && row.key_id === args.p_key_id
+      );
+      if (!grant || grant.revoked_at) return { data: false, error: null };
+      const expiresAt = typeof grant.expires_at === "string" ? Date.parse(grant.expires_at) : NaN;
+      if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) return { data: false, error: null };
+      const useCount = typeof grant.use_count === "number" ? grant.use_count : 0;
+      const maxUses = typeof grant.max_uses === "number" ? grant.max_uses : 0;
+      if (useCount >= maxUses) return { data: false, error: null };
+      grant.use_count = useCount + 1;
+      grant.last_used_at = nowIso();
+      return { data: true, error: null };
+    }
+    case "cms_begin_sync": {
+      const runs = store.table("cms_sync_runs");
+      const requested = runs.find((row) => row.manifest_hash === args.p_manifest_hash);
+      if (requested?.status === "complete") {
+        return { data: { status: "complete", result: requested.result }, error: null };
+      }
+      if (requested?.status === "active") return { data: { status: "busy" }, error: null };
+      const active = runs.find(
+        (row) => row.status === "active" && row.manifest_hash !== args.p_manifest_hash
+      );
+      if (active) return { data: { status: "busy" }, error: null };
+      if (requested) {
+        requested.status = "active";
+        requested.target_receipt_hash = args.p_target_receipt_hash;
+        requested.updated_at = nowIso();
+        return { data: { status: "resume" }, error: null };
+      }
+      runs.push({
+        manifest_hash: args.p_manifest_hash,
+        target_receipt_hash: args.p_target_receipt_hash,
+        status: "active",
+        started_at: nowIso(),
+        updated_at: nowIso()
+      });
+      return { data: { status: "started" }, error: null };
+    }
+    case "cms_finish_sync": {
+      const run = store.table("cms_sync_runs").find((row) => row.manifest_hash === args.p_manifest_hash);
+      if (!run || run.status !== "active") return { data: false, error: null };
+      run.status = args.p_status;
+      run.result = args.p_status === "complete" ? args.p_result : null;
+      run.error = args.p_status === "failed" ? args.p_error : null;
+      run.updated_at = nowIso();
+      return { data: true, error: null };
+    }
     case "cms_publish_due_pages": {
       const nowMs = Date.now();
       const published = [];
@@ -2591,6 +3095,90 @@ function runRpc(store, fn, args = {}) {
       }
       return { data: page, error: null };
     }
+    case "cms_sync_global": {
+      const globals = store.table("cms_globals");
+      const key = String(args.p_key);
+      let row = globals.find((item) => item.key === key);
+      if (row?.builder_owned) return { data: false, error: null };
+      if (!row) {
+        row = { key, label: "", data: args.p_data ?? {}, builder_owned: false, updated_at: nowIso() };
+        globals.push(row);
+      } else {
+        row.data = args.p_data ?? {};
+        row.updated_at = nowIso();
+      }
+      return { data: true, error: null };
+    }
+    case "cms_sync_form": {
+      const forms = store.table("cms_forms");
+      const slug = String(args.p_slug);
+      let row = forms.find((item) => item.slug === slug);
+      if (row?.builder_owned) return { data: false, error: null };
+      if (!row) {
+        row = {
+          id: newId(),
+          slug,
+          title: args.p_title ?? slug,
+          config: args.p_config ?? {},
+          notify: {},
+          success_message: args.p_success_message ?? "",
+          builder_owned: false,
+          created_at: nowIso(),
+          updated_at: nowIso()
+        };
+        forms.push(row);
+      } else {
+        row.title = args.p_title ?? slug;
+        row.config = args.p_config ?? {};
+        row.success_message = args.p_success_message ?? "";
+        row.updated_at = nowIso();
+      }
+      return { data: true, error: null };
+    }
+    case "cms_sync_media": {
+      const media = store.table("cms_media");
+      const storagePath = String(args.p_storage_path);
+      let row = media.find((item) => item.storage_path === storagePath);
+      if (row?.builder_owned) return { data: false, error: null };
+      const values = {
+        storage_path: storagePath,
+        filename: args.p_filename,
+        alt: args.p_alt,
+        caption: args.p_caption,
+        mime_type: args.p_mime_type,
+        width: args.p_width,
+        height: args.p_height,
+        filesize: args.p_filesize,
+        builder_owned: false,
+        updated_at: nowIso()
+      };
+      if (!row) {
+        row = { id: newId(), created_at: nowIso(), ...values };
+        media.push(row);
+      } else {
+        Object.assign(row, values);
+      }
+      return { data: true, error: null };
+    }
+    case "cms_sync_redirect": {
+      const redirects = store.table("cms_redirects");
+      const fromPath = String(args.p_from_path);
+      let row = redirects.find((item) => item.from_path === fromPath);
+      if (row?.builder_owned) return { data: false, error: null };
+      const values = {
+        from_path: fromPath,
+        to_path: args.p_to_path,
+        permanent: args.p_permanent,
+        builder_owned: false
+      };
+      if (!row) {
+        row = { id: newId(), created_at: nowIso(), ...values };
+        redirects.push(row);
+      } else {
+        Object.assign(row, values);
+      }
+      return { data: true, error: null };
+    }
     default:
       return { data: null, error: { message: `unknown function ${fn}` } };
   }
@@ -2646,6 +3234,7 @@ export {
   CONTENT_CACHE_TAG,
   MEMORY_DEV_TOKEN,
   PREVIEW_SESSION_COOKIE,
+  PREVIEW_TOKEN_MAX_USES,
   PREVIEW_TOKEN_TTL_MS,
   aggregateAnalytics,
   can,
@@ -2669,6 +3258,8 @@ export {
   runContentSync,
   sessionKeyFor,
   setServiceClientForTesting,
+  validateCmsEnv,
+  verifyPreviewGrantToken,
   verifyPreviewToken,
   visitorKeyFor
 };