@sandboxsonny/ace-kit 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @sandboxsonny/ace-kit
 
+## 0.1.2
+
+### Patch Changes
+
+- 7980e43: Server-rendered sites now identify themselves to the API with a header of their own, `X-Ace-Site-Domain`, as well as `X-Forwarded-Host`. Some platforms' proxies (Railway's, for one) rewrite `X-Forwarded-Host` on the way in, so the API could not tell which site was asking and answered "no site for this domain". Needs a CMS Ace API that reads the new header; against an older API the site works as before wherever the proxy leaves `X-Forwarded-Host` alone.
+
+## 0.1.1
+
+### Patch Changes
+
+- 7cee0fb: Maintenance only, no change to the package: releases are now published with npm trusted publishing (GitHub proves its identity to npm) instead of a stored token.
+
 ## 0.1.0
 
 ### Minor Changes

package/dist/astro.js

@@ -1,4 +1,4 @@
-import { createAceClient, loadMenuLinks, loadPage } from './chunk-KLRCWAE4.js';
+import { createAceClient, loadMenuLinks, loadPage } from './chunk-XYOW63V6.js';
 import './chunk-M5WR5TCR.js';
 import './chunk-YLO6IAXF.js';
 import { ACE_SITE_DOMAIN, ACE_API_URL } from 'astro:env/server';

package/dist/{chunk-KLRCWAE4.js → chunk-XYOW63V6.js}

@@ -39,7 +39,7 @@ function createAceClient({
     let response;
     try {
       response = await fetchImplementation(`${apiUrl.replace(/\/+$/, "")}${path}`, {
-        headers: { Accept: "application/json", "X-Forwarded-Host": siteDomain },
+        headers: { Accept: "application/json", "X-Ace-Site-Domain": siteDomain, "X-Forwarded-Host": siteDomain },
         signal: AbortSignal.timeout(requestTimeoutMilliseconds)
       });
     } catch {

package/dist/cli.js

@@ -43,7 +43,7 @@ function createAceClient({
     let response;
     try {
       response = await fetchImplementation(`${apiUrl.replace(/\/+$/, "")}${path}`, {
-        headers: { Accept: "application/json", "X-Forwarded-Host": siteDomain },
+        headers: { Accept: "application/json", "X-Ace-Site-Domain": siteDomain, "X-Forwarded-Host": siteDomain },
         signal: AbortSignal.timeout(requestTimeoutMilliseconds)
       });
     } catch {

package/dist/index.d.ts

@@ -86,7 +86,8 @@ type AceNavigationLink = {
 
 /**
  * A client for the CMS Ace public API. It runs on the server only, so the visitor's browser never talks to the
- * API. The API finds the site from X-Forwarded-Host, which this client sets to the site's domain.
+ * API. The API finds the site from X-Ace-Site-Domain, which this client sets to the site's domain. X-Forwarded-Host
+ * is sent too, for an API that predates the first (some platforms' proxies rewrite X-Forwarded-Host on the way in).
  */
 declare function createAceClient({ apiUrl, siteDomain, cacheSeconds, fetchImplementation, now, }: AceClientOptions): {
     /**

package/dist/index.js

@@ -1,6 +1,6 @@
 export { pageNotices } from './chunk-XPZY5R5A.js';
 export { headingLevel, imageAttributes, isInternalPath, linkAddress, listStart, renderRichText, renderTextArea, richTextImageSizes } from './chunk-URLKW2YS.js';
 export { listenForPreviewRefresh, refreshPageContent } from './chunk-YN7LJWGI.js';
-export { AcePreviewExpiredError, AceUnavailableError, createAceClient, isCurrentPage, linksFromMenu, loadMenuLinks, loadPage } from './chunk-KLRCWAE4.js';
+export { AcePreviewExpiredError, AceUnavailableError, createAceClient, isCurrentPage, linksFromMenu, loadMenuLinks, loadPage } from './chunk-XYOW63V6.js';
 export { addressFromPath, homeAddress, isHomeAddress, pathOfAddress, visitablePath } from './chunk-M5WR5TCR.js';
 export { addFramingPolicy, framingPolicy, isRefreshRequest, originOf, previewHeaders, previewParameter, previewTokenFrom, refreshMessageType, swapPageContent } from './chunk-YLO6IAXF.js';

package/dist/react-router-server.d.ts

@@ -89,7 +89,8 @@ type AceContentTypeSchema = {
 
 /**
  * A client for the CMS Ace public API. It runs on the server only, so the visitor's browser never talks to the
- * API. The API finds the site from X-Forwarded-Host, which this client sets to the site's domain.
+ * API. The API finds the site from X-Ace-Site-Domain, which this client sets to the site's domain. X-Forwarded-Host
+ * is sent too, for an API that predates the first (some platforms' proxies rewrite X-Forwarded-Host on the way in).
  */
 declare function createAceClient({ apiUrl, siteDomain, cacheSeconds, fetchImplementation, now, }: AceClientOptions): {
     /**

package/dist/react-router-server.js

@@ -1,4 +1,4 @@
-import { createAceClient, loadMenuLinks, loadPage } from './chunk-KLRCWAE4.js';
+import { createAceClient, loadMenuLinks, loadPage } from './chunk-XYOW63V6.js';
 import './chunk-M5WR5TCR.js';
 import { previewTokenFrom, addFramingPolicy } from './chunk-YLO6IAXF.js';
 import { createReadableStreamFromReadable } from '@react-router/node';

package/docs/releasing.md

@@ -16,25 +16,17 @@ It asks for the size and a summary, and writes a small file in `.changeset/`. Co
 
 When changes are merged to `main`, the **Release** workflow opens (or updates) a pull request called "Version Packages". It bumps `package.json` and writes the summaries into `CHANGELOG.md`. Read it, then merge it: the workflow then publishes the new version to npm and tags it.
 
-Each published version carries npm **provenance**: a public statement, signed by GitHub, that this exact package was built from this repository by this workflow. People can check it on the package's npm page.
+Each published version carries npm **provenance**: a public statement, signed by GitHub, that this exact package was built from this repository by this workflow. People can check it on the package's npm page (and with `npm audit signatures`).
 
 ## One-time setup
 
-1. **Own the scope.** The package is `@sandboxsonny/ace-kit`; a scope on npm belongs to a user or an organisation of that name. [Create an npm account](https://www.npmjs.com/signup) called `sandboxsonny` (or an organisation with that name), turn on two-factor authentication, and check <https://www.npmjs.com/package/@sandboxsonny/ace-kit> doesn't already exist. If the name isn't available, pick another scope and follow "If the scope changes" below.
-2. **A token for the workflow.** On npm: Access Tokens → Generate New Token → _Granular access token_, with **Read and write** permission on the `@sandboxsonny` scope, and no expiry longer than you want to manage. Add it to this repository as the secret **`NPM_TOKEN`** (Settings → Secrets and variables → Actions).
-3. **A public repository.** Provenance needs one. Also turn on branch protection for `main` and require the CI checks, so a release can only come from reviewed, passing code.
+1. **Own the scope.** The package is `@sandboxsonny/ace-kit`; a scope on npm belongs to a user or an organisation of that name. [Create an npm account](https://www.npmjs.com/signup) called `sandboxsonny` (or an organisation with that name) and turn on two-factor authentication. If the name isn't available, pick another scope and follow "If the scope changes" below.
+2. **A public repository,** with branch protection on `main` that requires the CI checks, so a release can only come from reviewed, passing code. Also turn on private vulnerability reporting (Settings → Security), which `SECURITY.md` points to.
+3. **The first publish,** which needs a token because the package doesn't exist yet to attach trusted publishing to. Create a _granular access token_ on npm with read and write permission on the scope and a short expiry, store it in the repository as the secret `NPM_TOKEN`, and pass it to the release step as `NODE_AUTH_TOKEN`. (Or publish version 0.1.0 by hand: `npm login`, then `npm run release`.)
+4. **Trusted publishing,** so no token is needed after that. On the package's page on npmjs.com → Settings → Trusted Publisher, add GitHub Actions with: the owner and repository exactly as GitHub spells them (**`sandboxSonny`** and **`ace-kit`**: the capitals matter), and the workflow file name **`release.yml`**. npm shows it as "not yet validated" until one publish goes through it, and drops it if that doesn't happen within 48 hours. Make the next release (even a patch with no code change) to validate it.
+5. **Remove the token:** delete the `NPM_TOKEN` secret and revoke the token on npm, and make sure the workflow does not pass `NODE_AUTH_TOKEN` (npm would use it instead of the trusted route).
 
-### The very first release
-
-The first version can also be published by hand, from a clean checkout of `main`:
-
-```sh
-npm login
-npm run version      # turns the pending changeset into 0.1.0 and the changelog (if not already done)
-npm run release      # runs the whole check, then publishes
-```
-
-(Provenance is only added when publishing from GitHub Actions (the workflow turns it on with `NPM_CONFIG_PROVENANCE`), so a hand-published first version has none; later ones do. It is deliberately not in `package.json`: npm refuses to publish from a laptop when it is.)
+The workflow in this repository is already in the last state: no token, Node 24 with npm 11.5.1 or newer, and `id-token: write`. If a publish fails with a message about authentication, check that the repository name and workflow file name in the Trusted Publisher settings match exactly, and that the job really is running `release.yml` on `main`.
 
 ## What the checks protect
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandboxsonny/ace-kit",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Everything a website needs to use CMS Ace: a typed client, addressing, images, menus, rich text, live preview, and Astro and React adapters.",
   "keywords": [
     "cms",