@sitecore-content-sdk/nextjs 2.5.1-canary.20261102062040 → 2.5.1

package/dist/cjs/components/DesignLibrary/DesignLibraryApp.js

@@ -1,31 +1,56 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DesignLibraryApp = void 0;
 const react_1 = __importDefault(require("react"));
-const layout_1 = require("@sitecore-content-sdk/content/layout");
-const DesignLibraryServer_1 = require("./DesignLibraryServer");
-const react_2 = require("@sitecore-content-sdk/react");
 /**
- * Design Library component intended to be used by the NextJs app router application
- * This component serves as a router between client and server component rendering modes for the Design Library.
- * It inspects the component type from the component map and
- * delegates to the appropriate rendering implementation:
- * - Client components are rendered using the `DesignLibrary` component
- * - Server components are rendered using the `DesignLibraryServer` component
+ * Design Library component intended to be used by the NextJs app router application.
+ * This component serves as a router between client and server component rendering modes
+ * for the Design Library. The client/server runtime is loaded lazily so static import
+ * of `DesignLibrary` / `DesignLibraryServer` does not pull those modules into every render.
  * @param {DesingLibraryAppProps} props - The properties for the Design Library App.
  * @public
  */
-const DesignLibraryApp = ({ page, componentMap, loadServerImportMap = react_2.noopLoadImportMap, }) => {
-    var _a;
-    const { route } = page.layout.sitecore;
-    if (!route)
+const DesignLibraryApp = async (props) => {
+    if (!props.page.layout.sitecore.route)
         return null;
-    const rendering = (_a = route === null || route === void 0 ? void 0 : route.placeholders[layout_1.EDITING_COMPONENT_PLACEHOLDER]) === null || _a === void 0 ? void 0 : _a[0];
-    const component = componentMap.get((rendering === null || rendering === void 0 ? void 0 : rendering.componentName) || '');
-    const isClient = component && component.componentType === 'client';
-    return (react_1.default.createElement(react_1.default.Fragment, null, isClient ? (react_1.default.createElement(react_2.DesignLibrary, null)) : (react_1.default.createElement(DesignLibraryServer_1.DesignLibraryServer, { page: page, componentMap: componentMap, loadServerImportMap: loadServerImportMap, rendering: route }))));
+    const { DesignLibraryRuntime } = await Promise.resolve().then(() => __importStar(require('./DesignLibraryRuntime')));
+    return react_1.default.createElement(DesignLibraryRuntime, Object.assign({}, props));
 };
 exports.DesignLibraryApp = DesignLibraryApp;
+exports.default = exports.DesignLibraryApp;

package/dist/cjs/components/DesignLibrary/DesignLibraryRuntime.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DesignLibraryRuntime = void 0;
+const react_1 = __importDefault(require("react"));
+const layout_1 = require("@sitecore-content-sdk/content/layout");
+const DesignLibraryServer_1 = require("./DesignLibraryServer");
+const react_2 = require("@sitecore-content-sdk/react");
+/**
+ * Internal Design Library renderer. Routes between client and server
+ * implementations after `DesignLibraryApp` has authorized the request.
+ * @param {DesingLibraryAppProps} props - The properties for the Design Library App.
+ * @internal
+ */
+const DesignLibraryRuntime = ({ page, componentMap, loadServerImportMap = react_2.noopLoadImportMap, }) => {
+    var _a;
+    const { route } = page.layout.sitecore;
+    if (!route)
+        return null;
+    const rendering = (_a = route === null || route === void 0 ? void 0 : route.placeholders[layout_1.EDITING_COMPONENT_PLACEHOLDER]) === null || _a === void 0 ? void 0 : _a[0];
+    const component = componentMap.get((rendering === null || rendering === void 0 ? void 0 : rendering.componentName) || '');
+    const isClient = component && component.componentType === 'client';
+    return (react_1.default.createElement(react_1.default.Fragment, null, isClient ? (react_1.default.createElement(react_2.DesignLibrary, null)) : (react_1.default.createElement(DesignLibraryServer_1.DesignLibraryServer, { page: page, componentMap: componentMap, loadServerImportMap: loadServerImportMap, rendering: route }))));
+};
+exports.DesignLibraryRuntime = DesignLibraryRuntime;

package/dist/cjs/editing/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EDITING_PARAMS_HEADER = exports.EDITING_PASS_THROUGH_HEADERS = exports.QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE = exports.QUERY_PARAM_VERCEL_PROTECTION_BYPASS = void 0;
+exports.EDITING_SECRET_HEADER = exports.EDITING_PARAMS_HEADER = exports.EDITING_PASS_THROUGH_HEADERS = exports.QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE = exports.QUERY_PARAM_VERCEL_PROTECTION_BYPASS = void 0;
 exports.QUERY_PARAM_VERCEL_PROTECTION_BYPASS = 'x-vercel-protection-bypass';
 exports.QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE = 'x-vercel-set-bypass-cookie';
 /**
@@ -13,3 +13,9 @@ exports.EDITING_PASS_THROUGH_HEADERS = ['authorization', 'cookie'];
  * route handler to the Next.js page when running in App Router.
  */
 exports.EDITING_PARAMS_HEADER = 'x-sitecore-editing-params';
+/**
+ * Header used to forward the already-validated editing secret from the editing
+ * render handler/middleware to the internal Next.js page or server-action request.
+ * Do not put this value in `EDITING_PARAMS_HEADER` JSON.
+ */
+exports.EDITING_SECRET_HEADER = 'x-sitecore-editing-secret';

package/dist/cjs/route-handler/editing-render-route-handler.js

@@ -94,7 +94,8 @@ const createEditingRenderRouteHandlers = (options) => {
         }
         const responseHeaders = expectedCorsHeaders;
         // Validate secret
-        if (!validateEditingSecret(query[editing_1.QUERY_PARAM_EDITING_SECRET])) {
+        const receivedSecret = query[editing_1.QUERY_PARAM_EDITING_SECRET];
+        if (!validateEditingSecret(receivedSecret)) {
             return Response.json({
                 html: editing_1.INVALID_SECRET_HTML_MESSAGE,
             }, { status: 401, headers: responseHeaders });
@@ -161,7 +162,7 @@ const createEditingRenderRouteHandlers = (options) => {
             // `EDITING_PARAMS_HEADER` instead via `client.getPreviewInputs`.
             // TODO: Remove preview data from qs before next major release.
             const propagatedQsParams = Object.assign(Object.assign({}, (0, utils_2.getQueryParamsForPropagation)(query)), editingPreviewData);
-            const propagatedHeaders = Object.assign(Object.assign({}, (0, utils_2.getHeadersForPropagation)(headers)), { [constants_1.EDITING_PARAMS_HEADER]: JSON.stringify(editingPreviewData) });
+            const propagatedHeaders = Object.assign(Object.assign({}, (0, utils_2.getHeadersForPropagation)(headers)), { [constants_1.EDITING_PARAMS_HEADER]: JSON.stringify(editingPreviewData), [constants_1.EDITING_SECRET_HEADER]: receivedSecret });
             const html = await (0, utils_2.getEditingRequestHtml)(requestUrl, propagatedQsParams, propagatedHeaders, convertedCookies, dataFetcher);
             // remove nextjs preview cookies to not leak them to the browser
             const filteredCookies = (0, utils_2.cleanupNextPreviewCookies)(convertedCookies);
@@ -208,7 +209,8 @@ const createEditingRenderRouteHandlers = (options) => {
             });
         }
         // Validate secret
-        if (!validateEditingSecret(req.nextUrl.searchParams.get(editing_1.QUERY_PARAM_EDITING_SECRET) || '')) {
+        const receivedSecret = req.nextUrl.searchParams.get(editing_1.QUERY_PARAM_EDITING_SECRET) || '';
+        if (!validateEditingSecret(receivedSecret)) {
             return Response.json({
                 html: editing_1.INVALID_SECRET_HTML_MESSAGE,
             }, { status: 401, headers: expectedCorsHeaders !== null && expectedCorsHeaders !== void 0 ? expectedCorsHeaders : {} });
@@ -244,6 +246,7 @@ const createEditingRenderRouteHandlers = (options) => {
         const forwardHeaders = new Headers(req.headers);
         forwardHeaders.set('cookie', forwardCookie);
         forwardHeaders.set(constants_1.EDITING_PARAMS_HEADER, JSON.stringify(editingPreviewData));
+        forwardHeaders.set(constants_1.EDITING_SECRET_HEADER, receivedSecret);
         const forwardedResponse = await dataFetcher.fetch(targetUrl.toString(), {
             method: req.method,
             headers: forwardHeaders,

package/dist/cjs/server-actions/update-server-component-action.js

@@ -8,6 +8,18 @@ const content_1 = require("@sitecore-content-sdk/content");
 const codegen_1 = require("@sitecore-content-sdk/content/codegen");
 const tools_1 = require("@sitecore-content-sdk/core/tools");
 const editing_1 = require("@sitecore-content-sdk/content/editing");
+const utils_1 = require("../utils/utils");
+/**
+ * Fail-closed secret check for Design Library server actions.
+ * Does not log the token.
+ */
+const assertEditingSecretAuthorized = async () => {
+    if (await (0, utils_1.isDesignLibraryAuthorizedFromHeaders)()) {
+        return;
+    }
+    content_1.debug.editing('empty / invalid editing secret');
+    throw new Error('Unauthorized');
+};
 /**
  * Server action to update global cache with the provided component updates received from Design Library.
  * Stores the given {@link ComponentUpdateModel} in the global cache using a key based on the component UID.
@@ -16,6 +28,7 @@ const editing_1 = require("@sitecore-content-sdk/content/editing");
  * @returns A Promise that resolves when the cache has been updated.
  */
 async function updateComponentAction(updatedComponent) {
+    await assertEditingSecretAuthorized();
     content_1.debug.editing(`Updating server component cache for Update Component: ${updatedComponent.uid}`);
     (0, tools_1.setCache)(`${editing_1.COMPONENT_UPDATE_CACHE_KEY_PREFIX}${updatedComponent.uid}`, updatedComponent);
     (0, cache_1.refresh)();
@@ -30,6 +43,7 @@ async function updateComponentAction(updatedComponent) {
  * @returns A Promise that resolves when the cache has been updated.
  */
 async function previewComponentAction(previewEvent, rendering, edgeUrl) {
+    await assertEditingSecretAuthorized();
     content_1.debug.editing(`Updating server component cache for Preview Component: ${previewEvent.uid}`);
     const updatedComponent = {
         uid: previewEvent.uid,

package/dist/cjs/utils/utils.js

@@ -1,8 +1,42 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseRewriteHeader = exports.isServerSidePropsContext = exports.extractPath = exports.getEditingSecret = exports.handleEditorFastRefresh = void 0;
+exports.parseRewriteHeader = exports.isServerSidePropsContext = exports.extractPath = exports.isDesignLibraryAuthorizedFromHeaders = exports.getEditingRequestHeaders = exports.getConfiguredEditingSecret = exports.getEditingSecret = exports.handleEditorFastRefresh = void 0;
 const editing_1 = require("@sitecore-content-sdk/content/editing");
 const proxy_1 = require("../proxy/proxy");
+const constants_1 = require("../editing/constants");
 /**
  * Since Sitecore editors do not support Fast Refresh:
  * 1. Subscribe on events provided by webpack.
@@ -42,6 +76,44 @@ const getEditingSecret = () => {
     return secret;
 };
 exports.getEditingSecret = getEditingSecret;
+/**
+ * Reads the raw configured editing secret without throwing.
+ * Empty and whitespace-only values are treated as unset.
+ * @returns The trimmed `SITECORE_EDITING_SECRET` value, or an empty string when unset.
+ * @internal
+ */
+const getConfiguredEditingSecret = () => {
+    return (process.env.SITECORE_EDITING_SECRET || '').trim();
+};
+exports.getConfiguredEditingSecret = getConfiguredEditingSecret;
+/**
+ * Reads Next.js request headers when available (App Router / server actions).
+ * Returns null when `headers()` is unavailable so Pages Router callers can continue.
+ * @returns {Promise<Headers | null>} The request headers, or null.
+ * @internal
+ */
+const getEditingRequestHeaders = async () => {
+    try {
+        const { headers } = await Promise.resolve().then(() => __importStar(require('next/headers')));
+        return await headers();
+    }
+    catch (_a) {
+        return null;
+    }
+};
+exports.getEditingRequestHeaders = getEditingRequestHeaders;
+/**
+ * Authorizes an editing/Design Library request from the internal secret header.
+ * Fail-closed: missing headers, empty env, placeholder, or mismatch → false.
+ * @returns {Promise<boolean>} True when the request carries a valid editing secret.
+ * @internal
+ */
+const isDesignLibraryAuthorizedFromHeaders = async () => {
+    const headerList = await (0, exports.getEditingRequestHeaders)();
+    const envSecret = (0, exports.getEditingSecret)();
+    return envSecret === (headerList === null || headerList === void 0 ? void 0 : headerList.get(constants_1.EDITING_SECRET_HEADER));
+};
+exports.isDesignLibraryAuthorizedFromHeaders = isDesignLibraryAuthorizedFromHeaders;
 /**
  * Extracts the path from the Next.js context parameters.
  * @param {GetStaticPropsContext | GetServerSidePropsContext} context - The Next.js context parameters.

package/dist/esm/components/DesignLibrary/DesignLibraryApp.js

@@ -1,24 +1,16 @@
 import React from 'react';
-import { EDITING_COMPONENT_PLACEHOLDER } from '@sitecore-content-sdk/content/layout';
-import { DesignLibraryServer } from './DesignLibraryServer';
-import { DesignLibrary, noopLoadImportMap } from '@sitecore-content-sdk/react';
 /**
- * Design Library component intended to be used by the NextJs app router application
- * This component serves as a router between client and server component rendering modes for the Design Library.
- * It inspects the component type from the component map and
- * delegates to the appropriate rendering implementation:
- * - Client components are rendered using the `DesignLibrary` component
- * - Server components are rendered using the `DesignLibraryServer` component
+ * Design Library component intended to be used by the NextJs app router application.
+ * This component serves as a router between client and server component rendering modes
+ * for the Design Library. The client/server runtime is loaded lazily so static import
+ * of `DesignLibrary` / `DesignLibraryServer` does not pull those modules into every render.
  * @param {DesingLibraryAppProps} props - The properties for the Design Library App.
  * @public
  */
-export const DesignLibraryApp = ({ page, componentMap, loadServerImportMap = noopLoadImportMap, }) => {
-    var _a;
-    const { route } = page.layout.sitecore;
-    if (!route)
+export const DesignLibraryApp = async (props) => {
+    if (!props.page.layout.sitecore.route)
         return null;
-    const rendering = (_a = route === null || route === void 0 ? void 0 : route.placeholders[EDITING_COMPONENT_PLACEHOLDER]) === null || _a === void 0 ? void 0 : _a[0];
-    const component = componentMap.get((rendering === null || rendering === void 0 ? void 0 : rendering.componentName) || '');
-    const isClient = component && component.componentType === 'client';
-    return (React.createElement(React.Fragment, null, isClient ? (React.createElement(DesignLibrary, null)) : (React.createElement(DesignLibraryServer, { page: page, componentMap: componentMap, loadServerImportMap: loadServerImportMap, rendering: route }))));
+    const { DesignLibraryRuntime } = await import('./DesignLibraryRuntime');
+    return React.createElement(DesignLibraryRuntime, Object.assign({}, props));
 };
+export default DesignLibraryApp;

package/dist/esm/components/DesignLibrary/DesignLibraryRuntime.js

@@ -0,0 +1,20 @@
+import React from 'react';
+import { EDITING_COMPONENT_PLACEHOLDER } from '@sitecore-content-sdk/content/layout';
+import { DesignLibraryServer } from './DesignLibraryServer';
+import { DesignLibrary, noopLoadImportMap } from '@sitecore-content-sdk/react';
+/**
+ * Internal Design Library renderer. Routes between client and server
+ * implementations after `DesignLibraryApp` has authorized the request.
+ * @param {DesingLibraryAppProps} props - The properties for the Design Library App.
+ * @internal
+ */
+export const DesignLibraryRuntime = ({ page, componentMap, loadServerImportMap = noopLoadImportMap, }) => {
+    var _a;
+    const { route } = page.layout.sitecore;
+    if (!route)
+        return null;
+    const rendering = (_a = route === null || route === void 0 ? void 0 : route.placeholders[EDITING_COMPONENT_PLACEHOLDER]) === null || _a === void 0 ? void 0 : _a[0];
+    const component = componentMap.get((rendering === null || rendering === void 0 ? void 0 : rendering.componentName) || '');
+    const isClient = component && component.componentType === 'client';
+    return (React.createElement(React.Fragment, null, isClient ? (React.createElement(DesignLibrary, null)) : (React.createElement(DesignLibraryServer, { page: page, componentMap: componentMap, loadServerImportMap: loadServerImportMap, rendering: route }))));
+};

package/dist/esm/editing/constants.js

@@ -10,3 +10,9 @@ export const EDITING_PASS_THROUGH_HEADERS = ['authorization', 'cookie'];
  * route handler to the Next.js page when running in App Router.
  */
 export const EDITING_PARAMS_HEADER = 'x-sitecore-editing-params';
+/**
+ * Header used to forward the already-validated editing secret from the editing
+ * render handler/middleware to the internal Next.js page or server-action request.
+ * Do not put this value in `EDITING_PARAMS_HEADER` JSON.
+ */
+export const EDITING_SECRET_HEADER = 'x-sitecore-editing-secret';

package/dist/esm/route-handler/editing-render-route-handler.js

@@ -5,7 +5,7 @@ import { LayoutServicePageState } from '@sitecore-content-sdk/content/layout';
 import { getEditingSecret } from '../utils/utils';
 import { draftMode, cookies as nextCokies } from 'next/headers';
 import { mapEditingParams, getEditingRequestHtml, cleanupNextPreviewCookies, getHeadersForPropagation, getQueryParamsForPropagation, getRequiredEditingParamsList, getCSPHeader, resolveServerUrl, PREVIEW_COOKIES, getAllowedQueryParams, } from '../editing/utils';
-import { EDITING_PARAMS_HEADER } from '../editing/constants';
+import { EDITING_PARAMS_HEADER, EDITING_SECRET_HEADER } from '../editing/constants';
 import { SITE_KEY } from '@sitecore-content-sdk/content/site';
 import debug from '../debug';
 /**
@@ -87,7 +87,8 @@ export const createEditingRenderRouteHandlers = (options) => {
         }
         const responseHeaders = expectedCorsHeaders;
         // Validate secret
-        if (!validateEditingSecret(query[QUERY_PARAM_EDITING_SECRET])) {
+        const receivedSecret = query[QUERY_PARAM_EDITING_SECRET];
+        if (!validateEditingSecret(receivedSecret)) {
             return Response.json({
                 html: INVALID_SECRET_HTML_MESSAGE,
             }, { status: 401, headers: responseHeaders });
@@ -154,7 +155,7 @@ export const createEditingRenderRouteHandlers = (options) => {
             // `EDITING_PARAMS_HEADER` instead via `client.getPreviewInputs`.
             // TODO: Remove preview data from qs before next major release.
             const propagatedQsParams = Object.assign(Object.assign({}, getQueryParamsForPropagation(query)), editingPreviewData);
-            const propagatedHeaders = Object.assign(Object.assign({}, getHeadersForPropagation(headers)), { [EDITING_PARAMS_HEADER]: JSON.stringify(editingPreviewData) });
+            const propagatedHeaders = Object.assign(Object.assign({}, getHeadersForPropagation(headers)), { [EDITING_PARAMS_HEADER]: JSON.stringify(editingPreviewData), [EDITING_SECRET_HEADER]: receivedSecret });
             const html = await getEditingRequestHtml(requestUrl, propagatedQsParams, propagatedHeaders, convertedCookies, dataFetcher);
             // remove nextjs preview cookies to not leak them to the browser
             const filteredCookies = cleanupNextPreviewCookies(convertedCookies);
@@ -201,7 +202,8 @@ export const createEditingRenderRouteHandlers = (options) => {
             });
         }
         // Validate secret
-        if (!validateEditingSecret(req.nextUrl.searchParams.get(QUERY_PARAM_EDITING_SECRET) || '')) {
+        const receivedSecret = req.nextUrl.searchParams.get(QUERY_PARAM_EDITING_SECRET) || '';
+        if (!validateEditingSecret(receivedSecret)) {
             return Response.json({
                 html: INVALID_SECRET_HTML_MESSAGE,
             }, { status: 401, headers: expectedCorsHeaders !== null && expectedCorsHeaders !== void 0 ? expectedCorsHeaders : {} });
@@ -237,6 +239,7 @@ export const createEditingRenderRouteHandlers = (options) => {
         const forwardHeaders = new Headers(req.headers);
         forwardHeaders.set('cookie', forwardCookie);
         forwardHeaders.set(EDITING_PARAMS_HEADER, JSON.stringify(editingPreviewData));
+        forwardHeaders.set(EDITING_SECRET_HEADER, receivedSecret);
         const forwardedResponse = await dataFetcher.fetch(targetUrl.toString(), {
             method: req.method,
             headers: forwardHeaders,

package/dist/esm/server-actions/update-server-component-action.js

@@ -4,6 +4,18 @@ import { debug } from '@sitecore-content-sdk/content';
 import { fetchGeneratedComponentFromCache, } from '@sitecore-content-sdk/content/codegen';
 import { setCache } from '@sitecore-content-sdk/core/tools';
 import { COMPONENT_UPDATE_CACHE_KEY_PREFIX, COMPONENT_PREVIEW_CACHE_KEY_PREFIX, } from '@sitecore-content-sdk/content/editing';
+import { isDesignLibraryAuthorizedFromHeaders } from '../utils/utils';
+/**
+ * Fail-closed secret check for Design Library server actions.
+ * Does not log the token.
+ */
+const assertEditingSecretAuthorized = async () => {
+    if (await isDesignLibraryAuthorizedFromHeaders()) {
+        return;
+    }
+    debug.editing('empty / invalid editing secret');
+    throw new Error('Unauthorized');
+};
 /**
  * Server action to update global cache with the provided component updates received from Design Library.
  * Stores the given {@link ComponentUpdateModel} in the global cache using a key based on the component UID.
@@ -12,6 +24,7 @@ import { COMPONENT_UPDATE_CACHE_KEY_PREFIX, COMPONENT_PREVIEW_CACHE_KEY_PREFIX,
  * @returns A Promise that resolves when the cache has been updated.
  */
 export async function updateComponentAction(updatedComponent) {
+    await assertEditingSecretAuthorized();
     debug.editing(`Updating server component cache for Update Component: ${updatedComponent.uid}`);
     setCache(`${COMPONENT_UPDATE_CACHE_KEY_PREFIX}${updatedComponent.uid}`, updatedComponent);
     refresh();
@@ -26,6 +39,7 @@ export async function updateComponentAction(updatedComponent) {
  * @returns A Promise that resolves when the cache has been updated.
  */
 export async function previewComponentAction(previewEvent, rendering, edgeUrl) {
+    await assertEditingSecretAuthorized();
     debug.editing(`Updating server component cache for Preview Component: ${previewEvent.uid}`);
     const updatedComponent = {
         uid: previewEvent.uid,

package/dist/esm/utils/utils.js

@@ -1,5 +1,6 @@
 import { isEditorActive, resetEditorChromes } from '@sitecore-content-sdk/content/editing';
 import { REWRITE_HEADER_NAME } from '../proxy/proxy';
+import { EDITING_SECRET_HEADER } from '../editing/constants';
 /**
  * Since Sitecore editors do not support Fast Refresh:
  * 1. Subscribe on events provided by webpack.
@@ -37,6 +38,41 @@ export const getEditingSecret = () => {
     }
     return secret;
 };
+/**
+ * Reads the raw configured editing secret without throwing.
+ * Empty and whitespace-only values are treated as unset.
+ * @returns The trimmed `SITECORE_EDITING_SECRET` value, or an empty string when unset.
+ * @internal
+ */
+export const getConfiguredEditingSecret = () => {
+    return (process.env.SITECORE_EDITING_SECRET || '').trim();
+};
+/**
+ * Reads Next.js request headers when available (App Router / server actions).
+ * Returns null when `headers()` is unavailable so Pages Router callers can continue.
+ * @returns {Promise<Headers | null>} The request headers, or null.
+ * @internal
+ */
+export const getEditingRequestHeaders = async () => {
+    try {
+        const { headers } = await import('next/headers');
+        return await headers();
+    }
+    catch (_a) {
+        return null;
+    }
+};
+/**
+ * Authorizes an editing/Design Library request from the internal secret header.
+ * Fail-closed: missing headers, empty env, placeholder, or mismatch → false.
+ * @returns {Promise<boolean>} True when the request carries a valid editing secret.
+ * @internal
+ */
+export const isDesignLibraryAuthorizedFromHeaders = async () => {
+    const headerList = await getEditingRequestHeaders();
+    const envSecret = getEditingSecret();
+    return envSecret === (headerList === null || headerList === void 0 ? void 0 : headerList.get(EDITING_SECRET_HEADER));
+};
 /**
  * Extracts the path from the Next.js context parameters.
  * @param {GetStaticPropsContext | GetServerSidePropsContext} context - The Next.js context parameters.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sitecore-content-sdk/nextjs",
-  "version": "2.5.1-canary.20261102062040",
+  "version": "2.5.1",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "sideEffects": false,
@@ -98,7 +98,7 @@
     "@sitecore-content-sdk/content": "^2.4.0",
     "@sitecore-content-sdk/core": "^2.1.4",
     "@sitecore-content-sdk/events": "^2.1.2",
-    "@sitecore-content-sdk/react": "2.5.1-canary.20261102062040",
+    "@sitecore-content-sdk/react": "^2.5.0",
     "recast": "^0.23.11",
     "regex-parser": "^2.3.1"
   },

package/types/components/DesignLibrary/DesignLibraryApp.d.ts

@@ -1,14 +1,13 @@
 import React from 'react';
 import { DesingLibraryAppProps } from './models';
 /**
- * Design Library component intended to be used by the NextJs app router application
- * This component serves as a router between client and server component rendering modes for the Design Library.
- * It inspects the component type from the component map and
- * delegates to the appropriate rendering implementation:
- * - Client components are rendered using the `DesignLibrary` component
- * - Server components are rendered using the `DesignLibraryServer` component
+ * Design Library component intended to be used by the NextJs app router application.
+ * This component serves as a router between client and server component rendering modes
+ * for the Design Library. The client/server runtime is loaded lazily so static import
+ * of `DesignLibrary` / `DesignLibraryServer` does not pull those modules into every render.
  * @param {DesingLibraryAppProps} props - The properties for the Design Library App.
  * @public
  */
-export declare const DesignLibraryApp: ({ page, componentMap, loadServerImportMap, }: DesingLibraryAppProps) => React.JSX.Element | null;
+export declare const DesignLibraryApp: (props: DesingLibraryAppProps) => Promise<React.JSX.Element | null>;
+export default DesignLibraryApp;
 //# sourceMappingURL=DesignLibraryApp.d.ts.map

package/types/components/DesignLibrary/DesignLibraryApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DesignLibraryApp.d.ts","sourceRoot":"","sources":["../../../src/components/DesignLibrary/DesignLibraryApp.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAIjD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,8CAI9B,qBAAqB,6BAsBvB,CAAC"}
+{"version":3,"file":"DesignLibraryApp.d.ts","sourceRoot":"","sources":["../../../src/components/DesignLibrary/DesignLibraryApp.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,OAAO,qBAAqB,KAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAKlC,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/types/components/DesignLibrary/DesignLibraryRuntime.d.ts

@@ -0,0 +1,10 @@
+import React from 'react';
+import { DesingLibraryAppProps } from './models';
+/**
+ * Internal Design Library renderer. Routes between client and server
+ * implementations after `DesignLibraryApp` has authorized the request.
+ * @param {DesingLibraryAppProps} props - The properties for the Design Library App.
+ * @internal
+ */
+export declare const DesignLibraryRuntime: ({ page, componentMap, loadServerImportMap, }: DesingLibraryAppProps) => React.JSX.Element | null;
+//# sourceMappingURL=DesignLibraryRuntime.d.ts.map

package/types/components/DesignLibrary/DesignLibraryRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DesignLibraryRuntime.d.ts","sourceRoot":"","sources":["../../../src/components/DesignLibrary/DesignLibraryRuntime.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAIjD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,8CAIlC,qBAAqB,6BAsBvB,CAAC"}

package/types/editing/constants.d.ts

@@ -10,4 +10,10 @@ export declare const EDITING_PASS_THROUGH_HEADERS: string[];
  * route handler to the Next.js page when running in App Router.
  */
 export declare const EDITING_PARAMS_HEADER = "x-sitecore-editing-params";
+/**
+ * Header used to forward the already-validated editing secret from the editing
+ * render handler/middleware to the internal Next.js page or server-action request.
+ * Do not put this value in `EDITING_PARAMS_HEADER` JSON.
+ */
+export declare const EDITING_SECRET_HEADER = "x-sitecore-editing-secret";
 //# sourceMappingURL=constants.d.ts.map

package/types/editing/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/editing/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oCAAoC,+BAA+B,CAAC;AACjF,eAAO,MAAM,oCAAoC,+BAA+B,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,UAA8B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/editing/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oCAAoC,+BAA+B,CAAC;AACjF,eAAO,MAAM,oCAAoC,+BAA+B,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,UAA8B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC"}

package/types/route-handler/editing-render-route-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"editing-render-route-handler.d.ts","sourceRoot":"","sources":["../../src/route-handler/editing-render-route-handler.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;GAGG;AACH,wBAAsB,cAAc,iBAMnC;AAED,KAAK,qBAAqB,GAAG;IAC3B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C;;OAEG;IACH,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,qBAAqB;eAwDrD,WAAW;gBA4KV,WAAW;mBA9Ld,WAAW;CAmTlC,CAAC"}
+{"version":3,"file":"editing-render-route-handler.d.ts","sourceRoot":"","sources":["../../src/route-handler/editing-render-route-handler.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;GAGG;AACH,wBAAsB,cAAc,iBAMnC;AAED,KAAK,qBAAqB,GAAG;IAC3B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C;;OAEG;IACH,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,qBAAqB;eAwDrD,WAAW;gBA8KV,WAAW;mBAhMd,WAAW;CAuTlC,CAAC"}

package/types/server-actions/update-server-component-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-server-component-action.d.ts","sourceRoot":"","sources":["../../src/server-actions/update-server-component-action.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EAEvB,MAAM,uCAAuC,CAAC;AAO/C,MAAM,MAAM,oBAAoB,GAAG;IACjC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;OAEG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD;;OAEG;IACH,SAAS,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,IAAI,EAAE,+BAA+B,CAAC;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,gBAAgB,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjG;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,iBAAiB,EAC/B,SAAS,EAAE,kBAAkB,GAAG,IAAI,EACpC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,IAAI,CAAC,CAgCf"}
+{"version":3,"file":"update-server-component-action.d.ts","sourceRoot":"","sources":["../../src/server-actions/update-server-component-action.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EAEvB,MAAM,uCAAuC,CAAC;AAoB/C,MAAM,MAAM,oBAAoB,GAAG;IACjC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;OAEG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD;;OAEG;IACH,SAAS,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,IAAI,EAAE,+BAA+B,CAAC;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,gBAAgB,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjG;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,iBAAiB,EAC/B,SAAS,EAAE,kBAAkB,GAAG,IAAI,EACpC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/types/utils/utils.d.ts

@@ -8,6 +8,27 @@ import { GetServerSidePropsContext, GetStaticPropsContext } from 'next';
  */
 export declare const handleEditorFastRefresh: (forceReload?: boolean) => void;
 export declare const getEditingSecret: () => string;
+/**
+ * Reads the raw configured editing secret without throwing.
+ * Empty and whitespace-only values are treated as unset.
+ * @returns The trimmed `SITECORE_EDITING_SECRET` value, or an empty string when unset.
+ * @internal
+ */
+export declare const getConfiguredEditingSecret: () => string;
+/**
+ * Reads Next.js request headers when available (App Router / server actions).
+ * Returns null when `headers()` is unavailable so Pages Router callers can continue.
+ * @returns {Promise<Headers | null>} The request headers, or null.
+ * @internal
+ */
+export declare const getEditingRequestHeaders: () => Promise<Headers | null>;
+/**
+ * Authorizes an editing/Design Library request from the internal secret header.
+ * Fail-closed: missing headers, empty env, placeholder, or mismatch → false.
+ * @returns {Promise<boolean>} True when the request carries a valid editing secret.
+ * @internal
+ */
+export declare const isDesignLibraryAuthorizedFromHeaders: () => Promise<boolean>;
 /**
  * Extracts the path from the Next.js context parameters.
  * @param {GetStaticPropsContext | GetServerSidePropsContext} context - The Next.js context parameters.

package/types/utils/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AAGxE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAI,qBAAmB,KAAG,IA6B7D,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAO,MAMnC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,qBAAqB,GAAG,yBAAyB,WAMrF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,yBAAyB,GAAG,qBAAqB,KACzD,OAAO,IAAI,yBAEb,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO;;;CAMlD,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AAIxE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAI,qBAAmB,KAAG,IA6B7D,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAO,MAMnC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAO,MAE7C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAa,OAAO,CAAC,OAAO,GAAG,IAAI,CAOvE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,QAAa,OAAO,CAAC,OAAO,CAI5E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,qBAAqB,GAAG,yBAAyB,WAMrF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,yBAAyB,GAAG,qBAAqB,KACzD,OAAO,IAAI,yBAEb,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO;;;CAMlD,CAAC"}