@sitecore-content-sdk/nextjs 2.3.0 → 2.4.0-canary.20260819212348

package/dist/cjs/editing/codegen/index.js

@@ -5,5 +5,5 @@ var import_map_1 = require("./import-map");
 Object.defineProperty(exports, "defaultImportEntries", { enumerable: true, get: function () { return import_map_1.defaultImportEntries; } });
 var import_map_server_1 = require("./import-map-server");
 Object.defineProperty(exports, "defaultServerImportEntries", { enumerable: true, get: function () { return import_map_server_1.defaultServerImportEntries; } });
-var import_map_utils_1 = require("./import-map-utils");
-Object.defineProperty(exports, "combineImportEntries", { enumerable: true, get: function () { return import_map_utils_1.combineImportEntries; } });
+var tools_1 = require("@sitecore-content-sdk/content/tools");
+Object.defineProperty(exports, "combineImportEntries", { enumerable: true, get: function () { return tools_1.combineImportEntries; } });

package/dist/cjs/editing/editing-endpoint-auth.js

@@ -0,0 +1,61 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEditingSecretQueryParamName = exports.authorizeEditingEndpointRequest = void 0;
+const editing_1 = require("@sitecore-content-sdk/content/editing");
+const tools_1 = require("@sitecore-content-sdk/core/tools");
+const debug_1 = __importDefault(require("../debug"));
+const utils_1 = require("../utils/utils");
+/**
+ * Shared CORS + editing-secret authorization used by Pages Router middleware and
+ * App Router route handlers for editing endpoints.
+ * @param {object} params - Request authorization inputs.
+ * @param {string | undefined} params.method - HTTP method.
+ * @param {HeaderBag} params.headers - Request headers.
+ * @param {string | string[] | null | undefined} params.secret - Editing secret from query/search params.
+ * @param {string | undefined} [params.presetCorsHeader] - Existing Access-Control-Allow-Origin header if any.
+ * @param {boolean} [params.requireSecret=true] - When false, only CORS is validated (e.g. OPTIONS may still check secret depending on caller).
+ * @returns {EditingEndpointAuthResult} Authorization result.
+ * @internal
+ */
+const authorizeEditingEndpointRequest = (params) => {
+    const { method, headers, secret, presetCorsHeader, requireSecret = true } = params;
+    const corsHeaders = (0, tools_1.getEnforcedCorsHeaders)({
+        requestMethod: method,
+        headers: headers,
+        presetCorsHeader,
+        allowedOrigins: editing_1.EDITING_ALLOWED_ORIGINS,
+    });
+    if (!corsHeaders) {
+        debug_1.default.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+        return {
+            ok: false,
+            status: 401,
+            body: { message: 'Invalid origin' },
+        };
+    }
+    if (requireSecret) {
+        const secretValue = Array.isArray(secret) ? secret[0] : secret !== null && secret !== void 0 ? secret : undefined;
+        const expectedSecret = (0, utils_1.getEditingSecret)();
+        if (secretValue !== expectedSecret) {
+            debug_1.default.editing('invalid editing secret - sent "%s" expected "%s"', secretValue, expectedSecret);
+            return {
+                ok: false,
+                status: 401,
+                body: { message: 'Missing or invalid editing secret' },
+                corsHeaders,
+            };
+        }
+    }
+    return { ok: true, corsHeaders };
+};
+exports.authorizeEditingEndpointRequest = authorizeEditingEndpointRequest;
+/**
+ * Reads the editing secret query param name used by editing endpoints.
+ * @returns {string} Query parameter name for the editing secret.
+ * @internal
+ */
+const getEditingSecretQueryParamName = () => editing_1.QUERY_PARAM_EDITING_SECRET;
+exports.getEditingSecretQueryParamName = getEditingSecretQueryParamName;

package/dist/cjs/editing/experimental-features-middleware.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExperimentalFeaturesMiddleware = void 0;
+const experimental_1 = require("@sitecore-content-sdk/content/experimental");
+const debug_1 = __importDefault(require("../debug"));
+const editing_endpoint_auth_1 = require("./editing-endpoint-auth");
+const experimental_json_1 = __importDefault(require("../experimental.json"));
+const experimentalFeaturesCatalog = experimental_json_1.default;
+/**
+ * Middleware / handler used in the experimental features API route
+ * (e.g. '/api/editing/experimental'). Exposes available experimental features
+ * and whether each is currently enabled, for Sitecore AI / editing host consumers.
+ *
+ * Catalog is owned by this package (`src/experimental.json`) and is not app-configurable.
+ * @public
+ */
+class ExperimentalFeaturesMiddleware {
+    constructor() {
+        this.handler = async (_req, res) => {
+            const auth = (0, editing_endpoint_auth_1.authorizeEditingEndpointRequest)({
+                method: _req.method,
+                headers: _req.headers,
+                secret: _req.query[(0, editing_endpoint_auth_1.getEditingSecretQueryParamName)()],
+                presetCorsHeader: res === null || res === void 0 ? void 0 : res.getHeader('Access-Control-Allow-Origin'),
+            });
+            if (!auth.ok) {
+                if (auth.corsHeaders) {
+                    Object.keys(auth.corsHeaders).forEach((key) => {
+                        res.setHeader(key, auth.corsHeaders[key]);
+                    });
+                }
+                return res.status(auth.status).json(auth.body);
+            }
+            Object.keys(auth.corsHeaders).forEach((key) => {
+                res.setHeader(key, auth.corsHeaders[key]);
+            });
+            if (_req.method === 'OPTIONS') {
+                debug_1.default.editing('preflight request');
+                return res.status(204).send(null);
+            }
+            return res.status(200).json((0, experimental_1.buildExperimentalFeaturesResponse)(experimentalFeaturesCatalog));
+        };
+    }
+    /**
+     * Gets the Next.js API route handler
+     * @returns middleware handler
+     */
+    getHandler() {
+        return this.handler;
+    }
+}
+exports.ExperimentalFeaturesMiddleware = ExperimentalFeaturesMiddleware;

package/dist/cjs/editing/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EDITING_COMPONENT_ID = exports.EDITING_COMPONENT_PLACEHOLDER = exports.RenderingType = exports.EditingConfigMiddleware = exports.FEAASRenderMiddleware = exports.getHeadersForPropagation = exports.getQueryParamsForPropagation = exports.isDesignLibraryPreviewData = exports.PREVIEW_COOKIES = exports.EditingRenderMiddleware = exports.EditingService = void 0;
+exports.resolveExperimentalFeatureStatuses = exports.isExperimentalEnvFlagEnabled = exports.buildExperimentalFeaturesResponse = exports.EDITING_COMPONENT_ID = exports.EDITING_COMPONENT_PLACEHOLDER = exports.RenderingType = exports.ExperimentalFeaturesMiddleware = exports.EditingConfigMiddleware = exports.FEAASRenderMiddleware = exports.getHeadersForPropagation = exports.getQueryParamsForPropagation = exports.isDesignLibraryPreviewData = exports.PREVIEW_COOKIES = exports.EditingRenderMiddleware = exports.EditingService = void 0;
 var editing_1 = require("@sitecore-content-sdk/content/editing");
 Object.defineProperty(exports, "EditingService", { enumerable: true, get: function () { return editing_1.EditingService; } });
 var editing_render_middleware_1 = require("./editing-render-middleware");
@@ -14,7 +14,13 @@ var feaas_render_middleware_1 = require("./feaas-render-middleware");
 Object.defineProperty(exports, "FEAASRenderMiddleware", { enumerable: true, get: function () { return feaas_render_middleware_1.FEAASRenderMiddleware; } });
 var editing_config_middleware_1 = require("./editing-config-middleware");
 Object.defineProperty(exports, "EditingConfigMiddleware", { enumerable: true, get: function () { return editing_config_middleware_1.EditingConfigMiddleware; } });
+var experimental_features_middleware_1 = require("./experimental-features-middleware");
+Object.defineProperty(exports, "ExperimentalFeaturesMiddleware", { enumerable: true, get: function () { return experimental_features_middleware_1.ExperimentalFeaturesMiddleware; } });
 var layout_1 = require("@sitecore-content-sdk/content/layout");
 Object.defineProperty(exports, "RenderingType", { enumerable: true, get: function () { return layout_1.RenderingType; } });
 Object.defineProperty(exports, "EDITING_COMPONENT_PLACEHOLDER", { enumerable: true, get: function () { return layout_1.EDITING_COMPONENT_PLACEHOLDER; } });
 Object.defineProperty(exports, "EDITING_COMPONENT_ID", { enumerable: true, get: function () { return layout_1.EDITING_COMPONENT_ID; } });
+var experimental_1 = require("@sitecore-content-sdk/content/experimental");
+Object.defineProperty(exports, "buildExperimentalFeaturesResponse", { enumerable: true, get: function () { return experimental_1.buildExperimentalFeaturesResponse; } });
+Object.defineProperty(exports, "isExperimentalEnvFlagEnabled", { enumerable: true, get: function () { return experimental_1.isExperimentalEnvFlagEnabled; } });
+Object.defineProperty(exports, "resolveExperimentalFeatureStatuses", { enumerable: true, get: function () { return experimental_1.resolveExperimentalFeatureStatuses; } });

package/dist/cjs/experimental-features/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExperimentalFeatureStatuses = exports.isExperimentalEnvFlagEnabled = exports.buildExperimentalFeaturesResponse = void 0;
+var experimental_1 = require("@sitecore-content-sdk/content/experimental");
+Object.defineProperty(exports, "buildExperimentalFeaturesResponse", { enumerable: true, get: function () { return experimental_1.buildExperimentalFeaturesResponse; } });
+Object.defineProperty(exports, "isExperimentalEnvFlagEnabled", { enumerable: true, get: function () { return experimental_1.isExperimentalEnvFlagEnabled; } });
+Object.defineProperty(exports, "resolveExperimentalFeatureStatuses", { enumerable: true, get: function () { return experimental_1.resolveExperimentalFeatureStatuses; } });

package/dist/cjs/experimental.json

@@ -0,0 +1,14 @@
+[
+    {
+        "idName": "dummy-feature",
+        "displayName": "Dummy Feature",
+        "envVarName": "CSDK_EXPERIMENTAL_DUMMY_FEATURE",
+        "description": "Sample experimental feature used to verify the visibility API."
+    },
+    {
+        "idName": "dummy-feature-two",
+        "displayName": "Dummy Feature Two",
+        "envVarName": "CSDK_EXPERIMENTAL_DUMMY_FEATURE_TWO",
+        "description": "Second sample experimental feature for API testing."
+    }
+]

package/dist/cjs/route-handler/experimental-features-route-handler.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExperimentalFeaturesRouteHandler = void 0;
+const experimental_1 = require("@sitecore-content-sdk/content/experimental");
+const debug_1 = __importDefault(require("../debug"));
+const editing_endpoint_auth_1 = require("../editing/editing-endpoint-auth");
+const experimental_json_1 = __importDefault(require("../experimental.json"));
+const experimentalFeaturesCatalog = experimental_json_1.default;
+/**
+ * Creates a route handler for the experimental features API route
+ * (e.g. '/api/editing/experimental'). Exposes available experimental features
+ * and whether each is currently enabled, for Sitecore AI / editing host consumers.
+ *
+ * Catalog is owned by this package (`src/experimental.json`) and is not app-configurable.
+ * @returns The route handler with GET and OPTIONS methods.
+ * @public
+ */
+const createExperimentalFeaturesRouteHandler = () => {
+    const authorize = (req, requireSecret) => (0, editing_endpoint_auth_1.authorizeEditingEndpointRequest)({
+        method: req.method,
+        headers: req.headers,
+        secret: req.nextUrl.searchParams.get((0, editing_endpoint_auth_1.getEditingSecretQueryParamName)()),
+        requireSecret,
+    });
+    const GET = async (req) => {
+        var _a;
+        try {
+            const startTimestamp = Date.now();
+            debug_1.default.editing('experimental features route handler start');
+            const auth = authorize(req, true);
+            if (!auth.ok) {
+                return new Response(JSON.stringify(auth.body), {
+                    status: auth.status,
+                    headers: Object.assign({ 'Content-Type': 'application/json' }, ((_a = auth.corsHeaders) !== null && _a !== void 0 ? _a : {})),
+                });
+            }
+            const responseData = (0, experimental_1.buildExperimentalFeaturesResponse)(experimentalFeaturesCatalog);
+            debug_1.default.editing('experimental features route handler end in %dms', Date.now() - startTimestamp);
+            return new Response(JSON.stringify(responseData), {
+                status: 200,
+                headers: Object.assign({ 'Content-Type': 'application/json' }, auth.corsHeaders),
+            });
+        }
+        catch (error) {
+            console.log('Experimental features route handler failed:');
+            console.log(error);
+            return new Response('Internal Server Error', {
+                status: 500,
+            });
+        }
+    };
+    const OPTIONS = async (req) => {
+        try {
+            debug_1.default.editing('preflight request');
+            // Match previous behavior: OPTIONS validates CORS only (secret not required).
+            const auth = authorize(req, false);
+            if (!auth.ok) {
+                return new Response(JSON.stringify(auth.body), {
+                    status: auth.status,
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                });
+            }
+            return new Response(null, {
+                status: 204,
+                headers: auth.corsHeaders,
+            });
+        }
+        catch (error) {
+            console.log('Experimental features OPTIONS route handler failed:');
+            console.log(error);
+            return new Response('Internal Server Error', {
+                status: 500,
+            });
+        }
+    };
+    return { GET, OPTIONS };
+};
+exports.createExperimentalFeaturesRouteHandler = createExperimentalFeaturesRouteHandler;

package/dist/cjs/route-handler/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSitecoreRevalidateRouteHandler = exports.createEditingRenderRouteHandlers = exports.createEditingConfigRouteHandler = exports.createRobotsRouteHandler = exports.createSitemapRouteHandler = void 0;
+exports.createSitecoreRevalidateRouteHandler = exports.createExperimentalFeaturesRouteHandler = exports.createEditingRenderRouteHandlers = exports.createEditingConfigRouteHandler = exports.createRobotsRouteHandler = exports.createSitemapRouteHandler = void 0;
 var sitemap_route_handler_1 = require("./sitemap-route-handler");
 Object.defineProperty(exports, "createSitemapRouteHandler", { enumerable: true, get: function () { return sitemap_route_handler_1.createSitemapRouteHandler; } });
 var robots_route_handler_1 = require("./robots-route-handler");
@@ -9,5 +9,7 @@ var editing_config_route_handler_1 = require("./editing-config-route-handler");
 Object.defineProperty(exports, "createEditingConfigRouteHandler", { enumerable: true, get: function () { return editing_config_route_handler_1.createEditingConfigRouteHandler; } });
 var editing_render_route_handler_1 = require("./editing-render-route-handler");
 Object.defineProperty(exports, "createEditingRenderRouteHandlers", { enumerable: true, get: function () { return editing_render_route_handler_1.createEditingRenderRouteHandlers; } });
+var experimental_features_route_handler_1 = require("./experimental-features-route-handler");
+Object.defineProperty(exports, "createExperimentalFeaturesRouteHandler", { enumerable: true, get: function () { return experimental_features_route_handler_1.createExperimentalFeaturesRouteHandler; } });
 var sitecore_revalidate_route_handler_1 = require("./sitecore-revalidate-route-handler");
 Object.defineProperty(exports, "createSitecoreRevalidateRouteHandler", { enumerable: true, get: function () { return sitecore_revalidate_route_handler_1.createSitecoreRevalidateRouteHandler; } });

package/dist/esm/editing/codegen/index.js

@@ -1,3 +1,3 @@
 export { defaultImportEntries } from './import-map';
 export { defaultServerImportEntries } from './import-map-server';
-export { combineImportEntries } from './import-map-utils';
+export { combineImportEntries } from '@sitecore-content-sdk/content/tools';

package/dist/esm/editing/editing-endpoint-auth.js

@@ -0,0 +1,53 @@
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET, } from '@sitecore-content-sdk/content/editing';
+import { getEnforcedCorsHeaders } from '@sitecore-content-sdk/core/tools';
+import debug from '../debug';
+import { getEditingSecret } from '../utils/utils';
+/**
+ * Shared CORS + editing-secret authorization used by Pages Router middleware and
+ * App Router route handlers for editing endpoints.
+ * @param {object} params - Request authorization inputs.
+ * @param {string | undefined} params.method - HTTP method.
+ * @param {HeaderBag} params.headers - Request headers.
+ * @param {string | string[] | null | undefined} params.secret - Editing secret from query/search params.
+ * @param {string | undefined} [params.presetCorsHeader] - Existing Access-Control-Allow-Origin header if any.
+ * @param {boolean} [params.requireSecret=true] - When false, only CORS is validated (e.g. OPTIONS may still check secret depending on caller).
+ * @returns {EditingEndpointAuthResult} Authorization result.
+ * @internal
+ */
+export const authorizeEditingEndpointRequest = (params) => {
+    const { method, headers, secret, presetCorsHeader, requireSecret = true } = params;
+    const corsHeaders = getEnforcedCorsHeaders({
+        requestMethod: method,
+        headers: headers,
+        presetCorsHeader,
+        allowedOrigins: EDITING_ALLOWED_ORIGINS,
+    });
+    if (!corsHeaders) {
+        debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+        return {
+            ok: false,
+            status: 401,
+            body: { message: 'Invalid origin' },
+        };
+    }
+    if (requireSecret) {
+        const secretValue = Array.isArray(secret) ? secret[0] : secret !== null && secret !== void 0 ? secret : undefined;
+        const expectedSecret = getEditingSecret();
+        if (secretValue !== expectedSecret) {
+            debug.editing('invalid editing secret - sent "%s" expected "%s"', secretValue, expectedSecret);
+            return {
+                ok: false,
+                status: 401,
+                body: { message: 'Missing or invalid editing secret' },
+                corsHeaders,
+            };
+        }
+    }
+    return { ok: true, corsHeaders };
+};
+/**
+ * Reads the editing secret query param name used by editing endpoints.
+ * @returns {string} Query parameter name for the editing secret.
+ * @internal
+ */
+export const getEditingSecretQueryParamName = () => QUERY_PARAM_EDITING_SECRET;

package/dist/esm/editing/experimental-features-middleware.js

@@ -0,0 +1,48 @@
+import { buildExperimentalFeaturesResponse } from '@sitecore-content-sdk/content/experimental';
+import debug from '../debug';
+import { authorizeEditingEndpointRequest, getEditingSecretQueryParamName, } from './editing-endpoint-auth';
+import experimentalFeaturesCatalogJson from '../experimental.json';
+const experimentalFeaturesCatalog = experimentalFeaturesCatalogJson;
+/**
+ * Middleware / handler used in the experimental features API route
+ * (e.g. '/api/editing/experimental'). Exposes available experimental features
+ * and whether each is currently enabled, for Sitecore AI / editing host consumers.
+ *
+ * Catalog is owned by this package (`src/experimental.json`) and is not app-configurable.
+ * @public
+ */
+export class ExperimentalFeaturesMiddleware {
+    constructor() {
+        this.handler = async (_req, res) => {
+            const auth = authorizeEditingEndpointRequest({
+                method: _req.method,
+                headers: _req.headers,
+                secret: _req.query[getEditingSecretQueryParamName()],
+                presetCorsHeader: res === null || res === void 0 ? void 0 : res.getHeader('Access-Control-Allow-Origin'),
+            });
+            if (!auth.ok) {
+                if (auth.corsHeaders) {
+                    Object.keys(auth.corsHeaders).forEach((key) => {
+                        res.setHeader(key, auth.corsHeaders[key]);
+                    });
+                }
+                return res.status(auth.status).json(auth.body);
+            }
+            Object.keys(auth.corsHeaders).forEach((key) => {
+                res.setHeader(key, auth.corsHeaders[key]);
+            });
+            if (_req.method === 'OPTIONS') {
+                debug.editing('preflight request');
+                return res.status(204).send(null);
+            }
+            return res.status(200).json(buildExperimentalFeaturesResponse(experimentalFeaturesCatalog));
+        };
+    }
+    /**
+     * Gets the Next.js API route handler
+     * @returns middleware handler
+     */
+    getHandler() {
+        return this.handler;
+    }
+}

package/dist/esm/editing/index.js

@@ -3,4 +3,6 @@ export { EditingRenderMiddleware, } from './editing-render-middleware';
 export { PREVIEW_COOKIES, isDesignLibraryPreviewData, getQueryParamsForPropagation, getHeadersForPropagation, } from './utils';
 export { FEAASRenderMiddleware } from './feaas-render-middleware';
 export { EditingConfigMiddleware, } from './editing-config-middleware';
+export { ExperimentalFeaturesMiddleware } from './experimental-features-middleware';
 export { RenderingType, EDITING_COMPONENT_PLACEHOLDER, EDITING_COMPONENT_ID, } from '@sitecore-content-sdk/content/layout';
+export { buildExperimentalFeaturesResponse, isExperimentalEnvFlagEnabled, resolveExperimentalFeatureStatuses, } from '@sitecore-content-sdk/content/experimental';

package/dist/esm/experimental-features/index.js

@@ -0,0 +1 @@
+export { buildExperimentalFeaturesResponse, isExperimentalEnvFlagEnabled, resolveExperimentalFeatureStatuses, } from '@sitecore-content-sdk/content/experimental';

package/dist/esm/experimental.json

@@ -0,0 +1,14 @@
+[
+    {
+        "idName": "dummy-feature",
+        "displayName": "Dummy Feature",
+        "envVarName": "CSDK_EXPERIMENTAL_DUMMY_FEATURE",
+        "description": "Sample experimental feature used to verify the visibility API."
+    },
+    {
+        "idName": "dummy-feature-two",
+        "displayName": "Dummy Feature Two",
+        "envVarName": "CSDK_EXPERIMENTAL_DUMMY_FEATURE_TWO",
+        "description": "Second sample experimental feature for API testing."
+    }
+]

package/dist/esm/route-handler/experimental-features-route-handler.js

@@ -0,0 +1,76 @@
+import { buildExperimentalFeaturesResponse } from '@sitecore-content-sdk/content/experimental';
+import debug from '../debug';
+import { authorizeEditingEndpointRequest, getEditingSecretQueryParamName, } from '../editing/editing-endpoint-auth';
+import experimentalFeaturesCatalogJson from '../experimental.json';
+const experimentalFeaturesCatalog = experimentalFeaturesCatalogJson;
+/**
+ * Creates a route handler for the experimental features API route
+ * (e.g. '/api/editing/experimental'). Exposes available experimental features
+ * and whether each is currently enabled, for Sitecore AI / editing host consumers.
+ *
+ * Catalog is owned by this package (`src/experimental.json`) and is not app-configurable.
+ * @returns The route handler with GET and OPTIONS methods.
+ * @public
+ */
+export const createExperimentalFeaturesRouteHandler = () => {
+    const authorize = (req, requireSecret) => authorizeEditingEndpointRequest({
+        method: req.method,
+        headers: req.headers,
+        secret: req.nextUrl.searchParams.get(getEditingSecretQueryParamName()),
+        requireSecret,
+    });
+    const GET = async (req) => {
+        var _a;
+        try {
+            const startTimestamp = Date.now();
+            debug.editing('experimental features route handler start');
+            const auth = authorize(req, true);
+            if (!auth.ok) {
+                return new Response(JSON.stringify(auth.body), {
+                    status: auth.status,
+                    headers: Object.assign({ 'Content-Type': 'application/json' }, ((_a = auth.corsHeaders) !== null && _a !== void 0 ? _a : {})),
+                });
+            }
+            const responseData = buildExperimentalFeaturesResponse(experimentalFeaturesCatalog);
+            debug.editing('experimental features route handler end in %dms', Date.now() - startTimestamp);
+            return new Response(JSON.stringify(responseData), {
+                status: 200,
+                headers: Object.assign({ 'Content-Type': 'application/json' }, auth.corsHeaders),
+            });
+        }
+        catch (error) {
+            console.log('Experimental features route handler failed:');
+            console.log(error);
+            return new Response('Internal Server Error', {
+                status: 500,
+            });
+        }
+    };
+    const OPTIONS = async (req) => {
+        try {
+            debug.editing('preflight request');
+            // Match previous behavior: OPTIONS validates CORS only (secret not required).
+            const auth = authorize(req, false);
+            if (!auth.ok) {
+                return new Response(JSON.stringify(auth.body), {
+                    status: auth.status,
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                });
+            }
+            return new Response(null, {
+                status: 204,
+                headers: auth.corsHeaders,
+            });
+        }
+        catch (error) {
+            console.log('Experimental features OPTIONS route handler failed:');
+            console.log(error);
+            return new Response('Internal Server Error', {
+                status: 500,
+            });
+        }
+    };
+    return { GET, OPTIONS };
+};

package/dist/esm/route-handler/index.js

@@ -2,4 +2,5 @@ export { createSitemapRouteHandler } from './sitemap-route-handler';
 export { createRobotsRouteHandler } from './robots-route-handler';
 export { createEditingConfigRouteHandler } from './editing-config-route-handler';
 export { createEditingRenderRouteHandlers } from './editing-render-route-handler';
+export { createExperimentalFeaturesRouteHandler } from './experimental-features-route-handler';
 export { createSitecoreRevalidateRouteHandler, } from './sitecore-revalidate-route-handler';

package/experimental.d.ts

@@ -0,0 +1 @@
+export * from './types/experimental-features/index';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sitecore-content-sdk/nextjs",
-  "version": "2.3.0",
+  "version": "2.4.0-canary.20260819212348",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "sideEffects": false,
@@ -90,10 +90,10 @@
   },
   "dependencies": {
     "@babel/parser": "^7.27.2",
-    "@sitecore-content-sdk/content": "^2.2.2",
+    "@sitecore-content-sdk/content": "2.3.0-canary.20260819212348",
     "@sitecore-content-sdk/core": "^2.1.3",
     "@sitecore-content-sdk/events": "^2.1.2",
-    "@sitecore-content-sdk/react": "^2.3.0",
+    "@sitecore-content-sdk/react": "2.4.0-canary.20260819212348",
     "recast": "^0.23.11",
     "regex-parser": "^2.3.1"
   },
@@ -133,6 +133,11 @@
       "import": "./dist/esm/editing/index.js",
       "require": "./dist/cjs/editing/index.js"
     },
+    "./experimental": {
+      "import": "./dist/esm/experimental-features/index.js",
+      "require": "./dist/cjs/experimental-features/index.js",
+      "types": "./types/experimental-features/index.d.ts"
+    },
     "./proxy": {
       "types": "./types/proxy/index.d.ts",
       "import": "./dist/esm/proxy/index.js",

package/types/editing/codegen/index.d.ts

@@ -1,5 +1,5 @@
 export { defaultImportEntries } from './import-map';
 export { defaultServerImportEntries } from './import-map-server';
-export { combineImportEntries } from './import-map-utils';
 export { ImportEntry } from '@sitecore-content-sdk/content/codegen';
+export { combineImportEntries } from '@sitecore-content-sdk/content/tools';
 //# sourceMappingURL=index.d.ts.map

package/types/editing/codegen/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/editing/codegen/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/editing/codegen/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC"}

package/types/editing/editing-endpoint-auth.d.ts

@@ -0,0 +1,42 @@
+import { IncomingHttpHeaders } from 'http';
+type HeaderBag = Headers | IncomingHttpHeaders | Record<string, string | string[] | undefined>;
+export type EditingEndpointAuthSuccess = {
+    ok: true;
+    corsHeaders: Record<string, string>;
+};
+export type EditingEndpointAuthFailure = {
+    ok: false;
+    status: 401;
+    body: {
+        message: string;
+    };
+    corsHeaders?: Record<string, string>;
+};
+export type EditingEndpointAuthResult = EditingEndpointAuthSuccess | EditingEndpointAuthFailure;
+/**
+ * Shared CORS + editing-secret authorization used by Pages Router middleware and
+ * App Router route handlers for editing endpoints.
+ * @param {object} params - Request authorization inputs.
+ * @param {string | undefined} params.method - HTTP method.
+ * @param {HeaderBag} params.headers - Request headers.
+ * @param {string | string[] | null | undefined} params.secret - Editing secret from query/search params.
+ * @param {string | undefined} [params.presetCorsHeader] - Existing Access-Control-Allow-Origin header if any.
+ * @param {boolean} [params.requireSecret=true] - When false, only CORS is validated (e.g. OPTIONS may still check secret depending on caller).
+ * @returns {EditingEndpointAuthResult} Authorization result.
+ * @internal
+ */
+export declare const authorizeEditingEndpointRequest: (params: {
+    method?: string;
+    headers: HeaderBag;
+    secret?: string | string[] | null;
+    presetCorsHeader?: string;
+    requireSecret?: boolean;
+}) => EditingEndpointAuthResult;
+/**
+ * Reads the editing secret query param name used by editing endpoints.
+ * @returns {string} Query parameter name for the editing secret.
+ * @internal
+ */
+export declare const getEditingSecretQueryParamName: () => string;
+export {};
+//# sourceMappingURL=editing-endpoint-auth.d.ts.map

package/types/editing/editing-endpoint-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"editing-endpoint-auth.d.ts","sourceRoot":"","sources":["../../src/editing/editing-endpoint-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAS3C,KAAK,SAAS,GACV,OAAO,GACP,mBAAmB,GACnB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAElD,MAAM,MAAM,0BAA0B,GAAG;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,CAAC;IACZ,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,GAAG,0BAA0B,CAAC;AAEhG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,+BAA+B,GAAI,QAAQ;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,KAAG,yBAyCH,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAAO,MAAoC,CAAC"}

package/types/editing/experimental-features-middleware.d.ts

@@ -0,0 +1,18 @@
+import { NextApiRequest, NextApiResponse } from 'next';
+/**
+ * Middleware / handler used in the experimental features API route
+ * (e.g. '/api/editing/experimental'). Exposes available experimental features
+ * and whether each is currently enabled, for Sitecore AI / editing host consumers.
+ *
+ * Catalog is owned by this package (`src/experimental.json`) and is not app-configurable.
+ * @public
+ */
+export declare class ExperimentalFeaturesMiddleware {
+    /**
+     * Gets the Next.js API route handler
+     * @returns middleware handler
+     */
+    getHandler(): (req: NextApiRequest, res: NextApiResponse) => Promise<void>;
+    private handler;
+}
+//# sourceMappingURL=experimental-features-middleware.d.ts.map

package/types/editing/experimental-features-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"experimental-features-middleware.d.ts","sourceRoot":"","sources":["../../src/editing/experimental-features-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAYvD;;;;;;;GAOG;AACH,qBAAa,8BAA8B;IACzC;;;OAGG;IACI,UAAU,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC;IAIjF,OAAO,CAAC,OAAO,CA2Bb;CACH"}

package/types/editing/index.d.ts

@@ -3,6 +3,9 @@ export { EditingRenderMiddleware, EditingRenderMiddlewareConfig, } from './editi
 export { PREVIEW_COOKIES, isDesignLibraryPreviewData, getQueryParamsForPropagation, getHeadersForPropagation, } from './utils';
 export { FEAASRenderMiddleware, FEAASRenderMiddlewareConfig } from './feaas-render-middleware';
 export { EditingConfigMiddleware, EditingConfigMiddlewareConfig, } from './editing-config-middleware';
+export { ExperimentalFeaturesMiddleware } from './experimental-features-middleware';
 export { RenderingType, EDITING_COMPONENT_PLACEHOLDER, EDITING_COMPONENT_ID, } from '@sitecore-content-sdk/content/layout';
 export type { AllowedQueryParam, AllowedQueryParamsResolver, AllowedQueryParams } from './types';
+export type { ExperimentalFeatureData, ExperimentalFeatureStatus, ExperimentalFeaturesResponse, } from '@sitecore-content-sdk/content/experimental';
+export { buildExperimentalFeaturesResponse, isExperimentalEnvFlagEnabled, resolveExperimentalFeatureStatuses, } from '@sitecore-content-sdk/content/experimental';
 //# sourceMappingURL=index.d.ts.map

package/types/editing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/editing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,aAAa,EACb,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/editing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EACL,aAAa,EACb,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AACjG,YAAY,EACV,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,4CAA4C,CAAC"}

package/types/experimental-features/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Re-exports shared experimental features helpers from `@sitecore-content-sdk/content/experimental`
+ * for convenience in Next.js apps. The Next.js catalog lives in `src/experimental.json`.
+ */
+export type { ExperimentalFeatureData, ExperimentalFeatureStatus, ExperimentalFeaturesResponse, } from '@sitecore-content-sdk/content/experimental';
+export { buildExperimentalFeaturesResponse, isExperimentalEnvFlagEnabled, resolveExperimentalFeatureStatuses, } from '@sitecore-content-sdk/content/experimental';
+//# sourceMappingURL=index.d.ts.map

package/types/experimental-features/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/experimental-features/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,YAAY,EACV,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,4CAA4C,CAAC"}

package/types/route-handler/experimental-features-route-handler.d.ts

@@ -0,0 +1,15 @@
+import { NextRequest } from 'next/server';
+/**
+ * Creates a route handler for the experimental features API route
+ * (e.g. '/api/editing/experimental'). Exposes available experimental features
+ * and whether each is currently enabled, for Sitecore AI / editing host consumers.
+ *
+ * Catalog is owned by this package (`src/experimental.json`) and is not app-configurable.
+ * @returns The route handler with GET and OPTIONS methods.
+ * @public
+ */
+export declare const createExperimentalFeaturesRouteHandler: () => {
+    GET: (req: NextRequest) => Promise<Response>;
+    OPTIONS: (req: NextRequest) => Promise<Response>;
+};
+//# sourceMappingURL=experimental-features-route-handler.d.ts.map

package/types/route-handler/experimental-features-route-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"experimental-features-route-handler.d.ts","sourceRoot":"","sources":["../../src/route-handler/experimental-features-route-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C;;;;;;;;GAQG;AACH,eAAO,MAAM,sCAAsC;eASzB,WAAW;mBAyCP,WAAW;CA+BxC,CAAC"}

package/types/route-handler/index.d.ts

@@ -2,5 +2,6 @@ export { createSitemapRouteHandler } from './sitemap-route-handler';
 export { createRobotsRouteHandler } from './robots-route-handler';
 export { createEditingConfigRouteHandler } from './editing-config-route-handler';
 export { createEditingRenderRouteHandlers } from './editing-render-route-handler';
+export { createExperimentalFeaturesRouteHandler } from './experimental-features-route-handler';
 export { createSitecoreRevalidateRouteHandler, type SitecoreRevalidateRouteHandlerOptions, type RevalidateTagCacheProfile, } from './sitecore-revalidate-route-handler';
 //# sourceMappingURL=index.d.ts.map

package/types/route-handler/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/route-handler/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EACL,oCAAoC,EACpC,KAAK,qCAAqC,EAC1C,KAAK,yBAAyB,GAC/B,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/route-handler/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EACL,oCAAoC,EACpC,KAAK,qCAAqC,EAC1C,KAAK,yBAAyB,GAC/B,MAAM,qCAAqC,CAAC"}

package/dist/cjs/editing/codegen/import-map-utils.js

@@ -1,38 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.combineImportEntries = void 0;
-/**
- * Combines the default import entries with the generated import entries.
- * @param {ImportEntry[]} defaultImportEntries - The default import entries.
- * @param {ImportEntry[]} generatedImportEntries - The generated import entries.
- * @returns {ImportEntry[]} The combined import entries.
- * @public
- */
-const combineImportEntries = (defaultImportEntries, generatedImportEntries) => {
-    const combinedEntries = [];
-    const importMap = new Map();
-    // add generated entries to the map, overwriting existing ones
-    generatedImportEntries.forEach((entry) => {
-        importMap.set(entry.module, entry);
-    });
-    // add default entries to the map, if not present
-    defaultImportEntries.forEach((defaultEntry) => {
-        const mapEntry = importMap.get(defaultEntry.module);
-        if (mapEntry) {
-            defaultEntry.exports.forEach((defaultExportsEntry) => {
-                if (!mapEntry.exports.some((e) => e.name === defaultExportsEntry.name)) {
-                    mapEntry.exports.push(defaultExportsEntry);
-                }
-            });
-        }
-        else {
-            importMap.set(defaultEntry.module, defaultEntry);
-        }
-    });
-    // convert map back to array
-    importMap.forEach((value) => {
-        combinedEntries.push(value);
-    });
-    return combinedEntries;
-};
-exports.combineImportEntries = combineImportEntries;

package/dist/esm/editing/codegen/import-map-utils.js

@@ -1,34 +0,0 @@
-/**
- * Combines the default import entries with the generated import entries.
- * @param {ImportEntry[]} defaultImportEntries - The default import entries.
- * @param {ImportEntry[]} generatedImportEntries - The generated import entries.
- * @returns {ImportEntry[]} The combined import entries.
- * @public
- */
-export const combineImportEntries = (defaultImportEntries, generatedImportEntries) => {
-    const combinedEntries = [];
-    const importMap = new Map();
-    // add generated entries to the map, overwriting existing ones
-    generatedImportEntries.forEach((entry) => {
-        importMap.set(entry.module, entry);
-    });
-    // add default entries to the map, if not present
-    defaultImportEntries.forEach((defaultEntry) => {
-        const mapEntry = importMap.get(defaultEntry.module);
-        if (mapEntry) {
-            defaultEntry.exports.forEach((defaultExportsEntry) => {
-                if (!mapEntry.exports.some((e) => e.name === defaultExportsEntry.name)) {
-                    mapEntry.exports.push(defaultExportsEntry);
-                }
-            });
-        }
-        else {
-            importMap.set(defaultEntry.module, defaultEntry);
-        }
-    });
-    // convert map back to array
-    importMap.forEach((value) => {
-        combinedEntries.push(value);
-    });
-    return combinedEntries;
-};

package/types/editing/codegen/import-map-utils.d.ts

@@ -1,10 +0,0 @@
-import { ImportEntry } from '@sitecore-content-sdk/content/codegen';
-/**
- * Combines the default import entries with the generated import entries.
- * @param {ImportEntry[]} defaultImportEntries - The default import entries.
- * @param {ImportEntry[]} generatedImportEntries - The generated import entries.
- * @returns {ImportEntry[]} The combined import entries.
- * @public
- */
-export declare const combineImportEntries: (defaultImportEntries: ImportEntry[], generatedImportEntries: ImportEntry[]) => ImportEntry[];
-//# sourceMappingURL=import-map-utils.d.ts.map

package/types/editing/codegen/import-map-utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"import-map-utils.d.ts","sourceRoot":"","sources":["../../../src/editing/codegen/import-map-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,sBAAsB,WAAW,EAAE,EACnC,wBAAwB,WAAW,EAAE,KACpC,WAAW,EA6Bb,CAAC"}