@pramen/cms 0.0.60 → 0.0.61

package/README.md

@@ -204,9 +204,13 @@ const handlers = { ...createCmsHandlers(cms) };
 const routes = [...cmsRoutes({ handlers: cms })];
 ```
 
-That identity must also be granted by your ACL. Preview is **DO-only**: redemption reaches
-the Durable Object, so `signPagePreview` refuses on the D1 store rather than mint a link
-that could never be redeemed.
+That identity must also be granted by your ACL. Preview works on **both stores**. It used to
+be DO-only — redemption goes through `ctx.callPrivileged`, which only forwarded to the
+Durable Object, so minting on D1 would have handed out a link that 404s forever and
+`signPagePreview` refused instead. `callPrivileged` now dispatches locally in the Worker on
+the D1 store, so the refusal is gone. A browser redeeming a link sends no `x-pramen-store`
+header, so a deployment serving the CMS from D1 needs `PRAMEN_STORE=d1` for the redeem route
+to land on the right store (an embedded topology sets it anyway).
 
 The grant is scoped to **one page** and carries its own expiry (default 1 hour, clamped to
 30 days), so a leaked link is not "see all drafts" and stops working on its own. Signing

package/dist/index.d.ts

@@ -2837,7 +2837,7 @@ export declare function createCollectionHandlers(collections: readonly Collectio
         revisionId: string;
     }, Record<string, unknown>>;
     /** Mint a signed link that shows ONE row's unpublished state, to whoever holds it.
-     * Mirrors `signPagePreview` — same secret, same TTL clamp, same D1 refusal, and the
+     * Mirrors `signPagePreview` — same secret, same TTL clamp, works on both stores, and the
      * same rule that the row is read through the ACL FIRST: minting a link is granting
      * access to the row, so a caller who cannot read it must not be able to mint one. */
     signCollectionPreview: import("@pramen/server").Handler<{

package/dist/index.js

@@ -3799,10 +3799,11 @@ export function createCmsHandlers(opts = {}) {
             const secret = previewSecret(ctx.env);
             if (!secret)
                 throw previewUnconfigured(); // fail closed — never mint a forgeable link
-            // The redeem route always reaches a Durable Object (callPrivileged -> PRAMEN.get); it
-            // has no notion of `x-pramen-store`. Minting on the D1 store therefore produces a
-            // link that 404s forever while the editor reports success — refuse instead of
-            // handing out a token that cannot work.
+            // This used to refuse on the D1 store: redemption goes through `ctx.callPrivileged`,
+            // which only forwarded to a DO, so a link minted on D1 would have 404'd forever while
+            // the editor reported success. `callPrivileged` now dispatches locally in the Worker
+            // on D1, so both stores mint. The redeem route is a BROWSER request carrying no
+            // `x-pramen-store`, so a D1 deployment still needs `PRAMEN_STORE=d1` to route it.
             const db = cdb(ctx);
             // Read the page through the ACL first: minting a link is granting access to it, so a
             // caller who cannot read the page must not be able to mint a link that can.
@@ -4919,7 +4920,7 @@ export function createCollectionHandlers(collections, opts = {}) {
         }),
         // ---- preview ------------------------------------------------------------
         /** Mint a signed link that shows ONE row's unpublished state, to whoever holds it.
-         * Mirrors `signPagePreview` — same secret, same TTL clamp, same D1 refusal, and the
+         * Mirrors `signPagePreview` — same secret, same TTL clamp, works on both stores, and the
          * same rule that the row is read through the ACL FIRST: minting a link is granting
          * access to the row, so a caller who cannot read it must not be able to mint one. */
         signCollectionPreview: query(async (ctx, input) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pramen/cms",
-  "version": "0.0.60",
+  "version": "0.0.61",
   "description": "Optional block/page builder for pramen — Drupal-Paragraphs-style typed blocks in named regions, reusable blocks, scheduled publishing, built entirely from pramen primitives.",
   "license": "MIT",
   "repository": {
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pramen/server": "0.0.60"
+    "@pramen/server": "0.0.61"
   },
   "peerDependencies": {
     "react": ">=18"

package/src/index.ts

@@ -4330,11 +4330,11 @@ export function createCmsHandlers(opts: CmsHandlerOpts = {}) {
     signPagePreview: query(async (ctx, input: { pageId: string; expiresIn?: number }) => {
       const secret = previewSecret(ctx.env);
       if (!secret) throw previewUnconfigured(); // fail closed — never mint a forgeable link
-      // The redeem route always reaches a Durable Object (callPrivileged -> PRAMEN.get); it
-      // has no notion of `x-pramen-store`. Minting on the D1 store therefore produces a
-      // link that 404s forever while the editor reports success — refuse instead of
-      // handing out a token that cannot work.
-
+      // This used to refuse on the D1 store: redemption goes through `ctx.callPrivileged`,
+      // which only forwarded to a DO, so a link minted on D1 would have 404'd forever while
+      // the editor reported success. `callPrivileged` now dispatches locally in the Worker
+      // on D1, so both stores mint. The redeem route is a BROWSER request carrying no
+      // `x-pramen-store`, so a D1 deployment still needs `PRAMEN_STORE=d1` to route it.
       const db = cdb(ctx);
       // Read the page through the ACL first: minting a link is granting access to it, so a
       // caller who cannot read the page must not be able to mint a link that can.
@@ -5626,7 +5626,7 @@ export function createCollectionHandlers(collections: readonly CollectionDef[],
     // ---- preview ------------------------------------------------------------
 
     /** Mint a signed link that shows ONE row's unpublished state, to whoever holds it.
-     * Mirrors `signPagePreview` — same secret, same TTL clamp, same D1 refusal, and the
+     * Mirrors `signPagePreview` — same secret, same TTL clamp, works on both stores, and the
      * same rule that the row is read through the ACL FIRST: minting a link is granting
      * access to the row, so a caller who cannot read it must not be able to mint one. */
     signCollectionPreview: query(async (ctx, input: { collection: string; id: string; expiresIn?: number }) => {