camox 0.42.0 → 0.44.0

package/dist/features/studio/components/Navbar.js

@@ -1,7 +1,6 @@
 import { Link as Link$1, useLocation, useNavigate } from "../../navigation/navigation.js";
 import { actionsStore } from "../../provider/actionsStore.js";
-import { useProjectSlug } from "../../../lib/auth.js";
-import { pageQueries, projectQueries } from "../../../lib/queries.js";
+import { usePageDestinations } from "../../../hooks/use-page-destinations.js";
 import { PlatformLabel } from "../../../components/PlatformLabel.js";
 import { cn } from "../../../lib/utils.js";
 import { STUDIO_CONTENT_PATH } from "../routes.js";
@@ -10,7 +9,6 @@ import { EnvironmentMenu } from "./EnvironmentMenu.js";
 import { ProjectMenu } from "./ProjectMenu.js";
 import { UserButton } from "./UserButton.js";
 import { c } from "react/compiler-runtime";
-import { useQuery } from "@tanstack/react-query";
 import * as React from "react";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { Kbd } from "@camox/ui/kbd";
@@ -36,97 +34,72 @@ const links = [{
 	]
 }];
 const Navbar = (t0) => {
-	const $ = c(20);
-	if ($[0] !== "4608f306773df1a594409c84a68bc5a0c72c93c4fbda9136da94d4900e84546d") {
-		for (let $i = 0; $i < 20; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
-		$[0] = "4608f306773df1a594409c84a68bc5a0c72c93c4fbda9136da94d4900e84546d";
+	const $ = c(13);
+	if ($[0] !== "9182f23e40dc6d439cec2c533b4f9436ee59f885213d6d7a79d434c7aa8349c6") {
+		for (let $i = 0; $i < 13; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
+		$[0] = "9182f23e40dc6d439cec2c533b4f9436ee59f885213d6d7a79d434c7aa8349c6";
 	}
 	const { isPreview: t1 } = t0;
 	const isPreview = t1 === void 0 ? false : t1;
-	const projectSlug = useProjectSlug();
-	let t2;
-	if ($[1] !== projectSlug) {
-		t2 = projectQueries.getBySlug(projectSlug);
-		$[1] = projectSlug;
-		$[2] = t2;
-	} else t2 = $[2];
-	const { data: project } = useQuery(t2);
-	let t3;
-	if ($[3] !== project?.id) {
-		t3 = pageQueries.list(project?.id ?? 0);
-		$[3] = project?.id;
-		$[4] = t3;
-	} else t3 = $[4];
-	const t4 = !!project;
-	let t5;
-	if ($[5] !== t3 || $[6] !== t4) {
-		t5 = {
-			...t3,
-			enabled: t4
-		};
-		$[5] = t3;
-		$[6] = t4;
-		$[7] = t5;
-	} else t5 = $[7];
-	const { data: pages } = useQuery(t5);
+	const pages = usePageDestinations();
 	const { pathname } = useLocation();
-	let t6;
-	if ($[8] === Symbol.for("react.memo_cache_sentinel")) {
-		t6 = /* @__PURE__ */ jsxs("div", {
+	let t2;
+	if ($[1] === Symbol.for("react.memo_cache_sentinel")) {
+		t2 = /* @__PURE__ */ jsxs("div", {
 			className: "flew-row flex gap-1",
 			children: [/* @__PURE__ */ jsx(ProjectMenu, {}), /* @__PURE__ */ jsx(EnvironmentMenu, {})]
 		});
-		$[8] = t6;
-	} else t6 = $[8];
-	let t7;
-	if ($[9] !== isPreview || $[10] !== pages || $[11] !== pathname) {
-		t7 = links.map((link, index) => /* @__PURE__ */ jsx("li", { children: /* @__PURE__ */ jsx(Link$1, {
+		$[1] = t2;
+	} else t2 = $[1];
+	let t3;
+	if ($[2] !== isPreview || $[3] !== pages || $[4] !== pathname) {
+		t3 = links.map((link, index) => /* @__PURE__ */ jsx("li", { children: /* @__PURE__ */ jsx(Link$1, {
 			to: link.to,
 			className: cn("flex gap-2 items-center rounded-md px-4 py-2 text-sm font-medium", "hover:bg-accent hover:text-accent-foreground outline-none transition-[color,box-shadow] focus-visible:ring-ring/50 focus-visible:ring-[3px] focus-visible:outline-1", (isPreview || pages?.some((page) => page.fullPath === pathname)) && index === 0 ? "bg-accent hover:bg-accent text-accent-foreground" : "text-muted-foreground"),
 			activeProps: { className: "bg-accent hover:bg-accent text-accent-foreground!" },
 			children: link.children
 		}) }, link.to));
-		$[9] = isPreview;
-		$[10] = pages;
-		$[11] = pathname;
-		$[12] = t7;
-	} else t7 = $[12];
-	let t8;
-	if ($[13] !== t7) {
-		t8 = /* @__PURE__ */ jsxs("div", {
+		$[2] = isPreview;
+		$[3] = pages;
+		$[4] = pathname;
+		$[5] = t3;
+	} else t3 = $[5];
+	let t4;
+	if ($[6] !== t3) {
+		t4 = /* @__PURE__ */ jsxs("div", {
 			className: "flex flex-row gap-2",
-			children: [t6, /* @__PURE__ */ jsx("ul", {
+			children: [t2, /* @__PURE__ */ jsx("ul", {
 				className: "flex items-center gap-1",
-				children: t7
+				children: t3
 			})]
 		});
-		$[13] = t7;
-		$[14] = t8;
-	} else t8 = $[14];
-	let t10;
-	let t9;
-	if ($[15] === Symbol.for("react.memo_cache_sentinel")) {
-		t9 = /* @__PURE__ */ jsx(SearchIcon, { className: "text-muted-foreground size-4" });
-		t10 = /* @__PURE__ */ jsx("span", {
+		$[6] = t3;
+		$[7] = t4;
+	} else t4 = $[7];
+	let t5;
+	let t6;
+	if ($[8] === Symbol.for("react.memo_cache_sentinel")) {
+		t5 = /* @__PURE__ */ jsx(SearchIcon, { className: "text-muted-foreground size-4" });
+		t6 = /* @__PURE__ */ jsx("span", {
 			className: "text-muted-foreground",
 			children: "Quick find"
 		});
-		$[15] = t10;
-		$[16] = t9;
+		$[8] = t5;
+		$[9] = t6;
 	} else {
-		t10 = $[15];
-		t9 = $[16];
+		t5 = $[8];
+		t6 = $[9];
 	}
-	let t11;
-	if ($[17] === Symbol.for("react.memo_cache_sentinel")) {
-		t11 = /* @__PURE__ */ jsxs("div", {
+	let t7;
+	if ($[10] === Symbol.for("react.memo_cache_sentinel")) {
+		t7 = /* @__PURE__ */ jsxs("div", {
 			className: "flex items-center gap-2",
 			children: [/* @__PURE__ */ jsxs(Button, {
 				variant: "outline",
 				onClick: _temp,
 				children: [
-					t9,
-					t10,
+					t5,
+					t6,
 					/* @__PURE__ */ jsx(Kbd, {
 						className: "ml-4",
 						children: /* @__PURE__ */ jsx(PlatformLabel, {
@@ -137,24 +110,24 @@ const Navbar = (t0) => {
 				]
 			}), /* @__PURE__ */ jsx(UserButton, {})]
 		});
-		$[17] = t11;
-	} else t11 = $[17];
-	let t12;
-	if ($[18] !== t8) {
-		t12 = /* @__PURE__ */ jsxs("nav", {
+		$[10] = t7;
+	} else t7 = $[10];
+	let t8;
+	if ($[11] !== t4) {
+		t8 = /* @__PURE__ */ jsxs("nav", {
 			className: "bg-background relative flex items-center justify-between gap-4 border-b-2 px-2 py-2",
-			children: [t8, t11]
+			children: [t4, t7]
 		});
-		$[18] = t8;
-		$[19] = t12;
-	} else t12 = $[19];
-	return t12;
+		$[11] = t4;
+		$[12] = t8;
+	} else t8 = $[12];
+	return t8;
 };
 function useNavbarActions() {
 	const $ = c(4);
-	if ($[0] !== "4608f306773df1a594409c84a68bc5a0c72c93c4fbda9136da94d4900e84546d") {
+	if ($[0] !== "9182f23e40dc6d439cec2c533b4f9436ee59f885213d6d7a79d434c7aa8349c6") {
 		for (let $i = 0; $i < 4; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
-		$[0] = "4608f306773df1a594409c84a68bc5a0c72c93c4fbda9136da94d4900e84546d";
+		$[0] = "9182f23e40dc6d439cec2c533b4f9436ee59f885213d6d7a79d434c7aa8349c6";
 	}
 	const navigate = useNavigate();
 	let t0;

package/dist/features/vite/auth.js

@@ -1,52 +1,3 @@
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
+import { readAuthTokenForUrl, verifyOneTimeToken, writeAuthTokenForUrl } from "@camox/cli/auth";
 
-//#region src/features/vite/auth.ts
-const AUTH_DIR = path.join(os.homedir(), ".camox");
-const AUTH_FILE = path.join(AUTH_DIR, "auth.json");
-function normalizeUrl(url) {
-	return url.replace(/\/+$/, "");
-}
-function readAllTokens() {
-	try {
-		return JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-	} catch {
-		return {};
-	}
-}
-function writeAllTokens(tokens) {
-	fs.mkdirSync(AUTH_DIR, { recursive: true });
-	fs.writeFileSync(AUTH_FILE, JSON.stringify(tokens, null, 2), { mode: 384 });
-}
-function readAuthTokenForUrl(authenticationUrl) {
-	const entry = readAllTokens()[normalizeUrl(authenticationUrl)];
-	if (entry?.token && entry?.name && typeof entry.email === "string") return entry;
-	return null;
-}
-function writeAuthTokenForUrl(authenticationUrl, token) {
-	const tokens = readAllTokens();
-	tokens[normalizeUrl(authenticationUrl)] = token;
-	writeAllTokens(tokens);
-}
-async function verifyOneTimeToken(apiUrl, token) {
-	const response = await fetch(`${normalizeUrl(apiUrl)}/api/auth/one-time-token/verify`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ token })
-	});
-	if (!response.ok) throw new Error(`OTT verification failed: ${response.status}`);
-	const data = await response.json();
-	const user = data.user;
-	if (!user?.name) throw new Error("No user info in verification response");
-	const sessionToken = data.session?.token;
-	if (!sessionToken) throw new Error("No session token in verification response");
-	return {
-		name: user.name,
-		email: user.email ?? "",
-		token: sessionToken
-	};
-}
-
-//#endregion
 export { readAuthTokenForUrl, verifyOneTimeToken, writeAuthTokenForUrl };

package/dist/features/vite/iconGeneration.js

@@ -0,0 +1,16 @@
+import { iconCollectionIds, loadIconCollection } from "@camox/api-contract";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+//#region src/features/vite/iconGeneration.ts
+async function generateIconTypes(root, prefix) {
+	const ids = prefix ? iconCollectionIds(await loadIconCollection(prefix)) : [];
+	mkdirSync(resolve(root, "src/camox"), { recursive: true });
+	const union = ids.map((id) => JSON.stringify(id));
+	const type = union.length > 1 ? `\n      | ${union.join("\n      | ")}` : union[0] ?? "never";
+	writeFileSync(resolve(root, "src/camox/icons.gen.d.ts"), `// Generated by Camox. Do not edit.\nexport {};\ndeclare global {\n  interface CamoxIconRegistry {\n    ids:${union.length > 1 ? "" : " "}${type};\n  }\n}\n`);
+	return ids;
+}
+
+//#endregion
+export { generateIconTypes };

package/dist/features/vite/layoutGeneration.js

@@ -3,6 +3,9 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { basename, resolve } from "node:path";
 
 //#region src/features/vite/layoutGeneration.ts
+function propertyName(name) {
+	return /^[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*$/u.test(name) ? name : JSON.stringify(name);
+}
 /** Keep file identities stable across moves without executing application modules. */
 function generateLayoutFiles(appRoot) {
 	const directory = resolve(appRoot, "src/layouts");
@@ -28,10 +31,11 @@ export const Layout = createLayout(${JSON.stringify(id)})({
 		writeIfChanged(path, source);
 		const segments = id.split(".");
 		const route = "/" + segments.map((segment) => segment.startsWith("$") ? `:${segment.slice(1)}` : segment).join("/");
-		const params = segments.filter((segment) => segment.startsWith("$")).map((segment) => `${JSON.stringify(segment.slice(1))}: string`).join("; ");
-		declarations.push(`${JSON.stringify(id)}: { route: ${JSON.stringify(route)}; params: { ${params} } };`);
+		const params = segments.filter((segment) => segment.startsWith("$")).map((segment) => `        ${propertyName(segment.slice(1))}: string;`);
+		const paramsType = params.length ? `{\n${params.join("\n")}\n      }` : "{}";
+		declarations.push(`    ${propertyName(id)}: {\n      route: ${JSON.stringify(route)};\n      params: ${paramsType};\n    };`);
 	}
-	writeIfChanged(resolve(appRoot, "src/camox/layouts.gen.d.ts"), `// Generated by Camox.\nimport "camox/createLayout";\ndeclare module "camox/createLayout" {\n  interface LayoutFileRoutes {\n    ${declarations.join("\n    ")}\n  }\n}\n`);
+	writeIfChanged(resolve(appRoot, "src/camox/layouts.gen.d.ts"), `// Generated by Camox.\nimport "camox/createLayout";\ndeclare module "camox/createLayout" {\n  interface LayoutFileRoutes ${declarations.length ? `{\n${declarations.join("\n")}\n  }` : "{}"}\n}\n`);
 }
 
 //#endregion

package/dist/features/vite/vite.d.ts

@@ -23,14 +23,16 @@ type CamoxVitePlugin = Plugin & {
 interface CamoxPluginOptions {
   /** Stable, human-readable slug identifying this project (e.g. "prestigious-impala-84") */
   projectSlug: string;
+  /** Iconify collection available to all icon fields. */
+  icons?: string;
   /** Disable telemetry collection (default: false) */
   disableTelemetry?: boolean;
   /** Internal options (intended for Camox contributors in development, not for public use) */
   _internal?: {
     /** URL of the Camox API backend, used for data fetching */apiUrl?: string; /** URL of the Camox authentication backend (default: https://app.camox.dev) */
     authenticationUrl?: string; /** Show Tanstack query devtools (default: false) */
-    enableTanstackDevtools?: boolean; /** Enable the frontend-only comments prototype (default: false). */
-    enableComments?: boolean; /** Disable automatic code generation (route files and app file) (default: false) */
+    enableTanstackDevtools?: boolean; /** Enable experimental features, including feedback (default: false). */
+    enableExperimentalFeatures?: boolean; /** Disable automatic code generation (route files and app file) (default: false) */
     disableCodeGen?: boolean; /** Mount the Camox-owned dev runtime at this base path. Use "/" for root mode. */
     runtimeBasePath?: string;
   };

package/dist/features/vite/vite.js

@@ -2,6 +2,7 @@ import { generateAppFile, watchAppFile } from "./appGeneration.js";
 import { readAuthTokenForUrl } from "./auth.js";
 import { watchNewBlockFiles } from "./blockBoilerplate.js";
 import { installDevAuthenticationMiddleware } from "./devAuthentication.js";
+import { generateIconTypes } from "./iconGeneration.js";
 import { syncDefinitions, syncDefinitionsToApi } from "./definitionsSync.js";
 import { cleanupGeneratedRouteFiles } from "./routeGeneration.js";
 import { installRuntimeNitroRoutes, loadRuntimeDevModule, resolveRuntimeDevId } from "./runtimeDev.js";
@@ -82,7 +83,11 @@ function camox(options) {
 		nitro: { setup(nitro) {
 			if (nitro.options.noExternals !== true) {
 				const noExternals = Array.isArray(nitro.options.noExternals) ? nitro.options.noExternals : [];
-				nitro.options.noExternals = [...noExternals, "camox"];
+				nitro.options.noExternals = [
+					...noExternals,
+					"camox",
+					"tslib"
+				];
 			}
 			installRuntimeNitroRoutes(nitro, { runtimeBasePath });
 			nitro.hooks.hook("compiled", ({ options }) => {
@@ -91,7 +96,8 @@ function camox(options) {
 				cpSync(serverAssets, join(options.output.publicDir, "assets"), { recursive: true });
 			});
 		} },
-		config(_config, env) {
+		async config(_config, env) {
+			const iconIds = await generateIconTypes(resolve(_config.root ?? process.cwd()), options.icons);
 			isBuild = env.command === "build";
 			isRelease = isBuild && process.env.CAMOX_INTERNAL_RELEASE === "1";
 			if (isRelease) environmentName = "production";
@@ -103,9 +109,10 @@ function camox(options) {
 			return {
 				build: { emitAssets: true },
 				define: {
+					__CAMOX_ICON_IDS__: JSON.stringify(iconIds),
 					__CAMOX_TELEMETRY_DISABLED__: JSON.stringify(!!options.disableTelemetry),
 					__ENABLE_TANSTACK_DEVTOOLS__: JSON.stringify(enableTanstackDevtools),
-					__CAMOX_ENABLE_COMMENTS__: JSON.stringify(options._internal?.enableComments ?? false),
+					__CAMOX_ENABLE_EXPERIMENTAL_FEATURES__: JSON.stringify(options._internal?.enableExperimentalFeatures ?? false),
 					__CAMOX_ENVIRONMENT_NAME__: JSON.stringify(environmentName),
 					__CAMOX_API_URL__: JSON.stringify(apiUrl),
 					__CAMOX_AUTHENTICATION_URL__: JSON.stringify(authenticationUrl),
@@ -135,6 +142,8 @@ function camox(options) {
 					"camox > @base-ui/react/accordion",
 					"camox > @base-ui/react/alert-dialog",
 					"camox > @base-ui/react/avatar",
+					"camox > @base-ui/react/button",
+					"camox > @base-ui/react/combobox",
 					"camox > @base-ui/react/dialog",
 					"camox > @base-ui/react/input",
 					"camox > @base-ui/react/menu",
@@ -149,9 +158,12 @@ function camox(options) {
 					"camox > @base-ui/react/use-render",
 					"camox > @camox/api-contract",
 					"camox > @camox/api-contract/query-keys",
+					"camox > @camox/ui > class-variance-authority",
+					"camox > @camox/ui > clsx",
 					"camox > @camox/ui > cmdk",
 					"camox > @camox/ui > lucide-react",
 					"camox > @camox/ui > sonner",
+					"camox > @camox/ui > tailwind-merge",
 					"camox > @dnd-kit/core",
 					"camox > @dnd-kit/modifiers",
 					"camox > @dnd-kit/sortable",
@@ -175,7 +187,14 @@ function camox(options) {
 					"camox > @sinclair/typebox",
 					"camox > @takumi-rs/image-response",
 					"camox > @tanstack/react-form",
+					"camox > @tanstack/react-query",
+					"camox > @tanstack/react-router",
+					"camox > @tanstack/react-virtual",
+					"camox > @unhead/react/client",
+					"camox > @unhead/react/server",
 					"camox > @xstate/store-react",
+					"camox > better-auth/client/plugins",
+					"camox > better-auth/react",
 					"camox > better-auth > @better-auth/core/env",
 					"camox > better-auth > @better-auth/core/error",
 					"camox > better-auth > @better-auth/core/utils/error-codes",
@@ -186,6 +205,7 @@ function camox(options) {
 					"camox > fractional-indexing",
 					"camox > lexical",
 					"camox > lucide-react",
+					"camox > marked",
 					"camox > @tanstack/react-query-devtools/production",
 					"camox > partysocket/react"
 				] }
@@ -242,6 +262,7 @@ function camox(options) {
 				root: resolvedConfig.root,
 				cacheDir: resolve(resolvedConfig.root, "node_modules", ".vite-camox-temp"),
 				resolve: resolvedConfig.resolve,
+				define: resolvedConfig.define,
 				server: { middlewareMode: true },
 				logLevel: "silent"
 			});

package/dist/hooks/use-page-destinations.js

@@ -0,0 +1,53 @@
+import { useProjectSlug } from "../lib/auth.js";
+import { getPageDestinations } from "../core/pageDestinations.js";
+import { useCamoxApp } from "../features/provider/components/CamoxAppContext.js";
+import { pageQueries, projectQueries } from "../lib/queries.js";
+import { c } from "react/compiler-runtime";
+import { useQuery } from "@tanstack/react-query";
+
+//#region src/hooks/use-page-destinations.ts
+function usePageDestinations() {
+	const $ = c(11);
+	if ($[0] !== "5104e69847ee48202a1abdefc32d4e478db3a82331029421687a5ec8f7a46eaa") {
+		for (let $i = 0; $i < 11; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
+		$[0] = "5104e69847ee48202a1abdefc32d4e478db3a82331029421687a5ec8f7a46eaa";
+	}
+	const app = useCamoxApp();
+	const projectSlug = useProjectSlug();
+	let t0;
+	if ($[1] !== projectSlug) {
+		t0 = projectQueries.getBySlug(projectSlug);
+		$[1] = projectSlug;
+		$[2] = t0;
+	} else t0 = $[2];
+	const { data: project } = useQuery(t0);
+	let t1;
+	if ($[3] !== project?.id) {
+		t1 = pageQueries.list(project?.id ?? 0);
+		$[3] = project?.id;
+		$[4] = t1;
+	} else t1 = $[4];
+	const t2 = !!project;
+	let t3;
+	if ($[5] !== t1 || $[6] !== t2) {
+		t3 = {
+			...t1,
+			enabled: t2
+		};
+		$[5] = t1;
+		$[6] = t2;
+		$[7] = t3;
+	} else t3 = $[7];
+	const { data: pages } = useQuery(t3);
+	let t4;
+	if ($[8] !== app || $[9] !== pages) {
+		t4 = getPageDestinations(pages ?? [], app.getLayouts());
+		$[8] = app;
+		$[9] = pages;
+		$[10] = t4;
+	} else t4 = $[10];
+	return t4;
+}
+
+//#endregion
+export { usePageDestinations };

package/dist/lib/auth.js

@@ -1,14 +1,12 @@
 import { actionsStore } from "../features/provider/actionsStore.js";
+import { validatePreviewTarget } from "./preview-handoff.js";
+import { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, getServerAuthCookieHeader } from "./server-auth-cookie.js";
 import { c } from "react/compiler-runtime";
 import * as React from "react";
 import { oneTimeTokenClient, organizationClient } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/react";
 
 //#region src/lib/auth.ts
-const SERVER_AUTH_COOKIE_NAME = "camox_auth_cookie";
-function buildClearServerAuthCookieHeader() {
-	return `${SERVER_AUTH_COOKIE_NAME}=; Path=/; SameSite=Lax; Max-Age=0`;
-}
 function writeServerAuthCookie(cookie) {
 	if (typeof document === "undefined") return;
 	const secure = window.location.protocol === "https:" ? "; Secure" : "";
@@ -184,21 +182,32 @@ function createCamoxAuthClient(apiUrl) {
 * Process a `?ott=` one-time token from the URL before the provider mounts.
 * Verifies the token against the API backend and notifies the session store.
 *
-* Returns `true` once processing is complete (or if there was no OTT).
+* Reports completion and explicit handoff failures instead of silently showing live content.
 */
-function useProcessOtt(authClient) {
+function useProcessOtt(authClient, target) {
+	const [error, setError] = React.useState(null);
+	const processing = React.useRef(false);
 	const [ready, setReady] = React.useState(() => {
 		if (typeof window === "undefined") return true;
 		return !new URL(window.location.href).searchParams.has("ott");
 	});
 	React.useEffect(() => {
-		if (ready) return;
 		const url = new URL(window.location.href);
+		const targetError = validatePreviewTarget(url.searchParams.get("camox-preview"), target);
+		if (targetError) {
+			url.searchParams.delete("ott");
+			window.history.replaceState({}, "", url);
+			setError(targetError);
+			setReady(true);
+			return;
+		}
+		if (ready || processing.current) return;
 		const ott = url.searchParams.get("ott");
 		if (!ott) {
 			setReady(true);
 			return;
 		}
+		processing.current = true;
 		url.searchParams.delete("ott");
 		window.history.replaceState({}, "", url);
 		(async () => {
@@ -208,18 +217,29 @@ function useProcessOtt(authClient) {
 				if (!verification.data) throw new Error("OTT verification returned no session");
 				window.location.reload();
 				return;
-			} catch {}
+			} catch {
+				setError("Preview sign-in failed. The link may have expired or already been used. Run camox preview again for a fresh link.");
+			}
 			setReady(true);
 		})();
-	}, [authClient, ready]);
-	return ready;
+	}, [
+		authClient,
+		ready,
+		target.projectSlug,
+		target.environmentName,
+		target.apiUrl
+	]);
+	return {
+		ready,
+		error
+	};
 }
 const AuthContext = React.createContext(null);
 function useAuthContext() {
 	const $ = c(1);
-	if ($[0] !== "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b") {
+	if ($[0] !== "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525") {
 		for (let $i = 0; $i < 1; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
-		$[0] = "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b";
+		$[0] = "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525";
 	}
 	const ctx = React.useContext(AuthContext);
 	if (!ctx) throw new Error("Missing CamoxProvider");
@@ -227,9 +247,9 @@ function useAuthContext() {
 }
 function useProjectSlug() {
 	const $ = c(1);
-	if ($[0] !== "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b") {
+	if ($[0] !== "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525") {
 		for (let $i = 0; $i < 1; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
-		$[0] = "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b";
+		$[0] = "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525";
 	}
 	return useAuthContext().projectSlug;
 }
@@ -245,18 +265,18 @@ function useAuthState() {
 }
 function useIsAuthenticated() {
 	const $ = c(1);
-	if ($[0] !== "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b") {
+	if ($[0] !== "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525") {
 		for (let $i = 0; $i < 1; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
-		$[0] = "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b";
+		$[0] = "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525";
 	}
 	const { isAuthenticated } = useAuthState();
 	return isAuthenticated;
 }
 function useSignInRedirect(callbackHref) {
 	const $ = c(4);
-	if ($[0] !== "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b") {
+	if ($[0] !== "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525") {
 		for (let $i = 0; $i < 4; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
-		$[0] = "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b";
+		$[0] = "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525";
 	}
 	const { authenticationUrl } = useAuthContext();
 	let t0;
@@ -278,9 +298,9 @@ function useSignInRedirect(callbackHref) {
 */
 function useAuthActions() {
 	const $ = c(5);
-	if ($[0] !== "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b") {
+	if ($[0] !== "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525") {
 		for (let $i = 0; $i < 5; $i += 1) $[$i] = Symbol.for("react.memo_cache_sentinel");
-		$[0] = "613abd4be0f81de0bf8df48c671a83e40c3e6ac86dab4c38ebcffe92268b614b";
+		$[0] = "2870dba5d074cbe2d9a238f9ae39bb51493bf31c0dd30caa79404003309e1525";
 	}
 	const { authClient, authenticationUrl } = useAuthContext();
 	let t0;

package/dist/lib/preview-handoff.js

@@ -0,0 +1,13 @@
+//#region src/lib/preview-handoff.ts
+/** Validate the destination before exchanging any credential with its backend. */
+function validatePreviewTarget(raw, target) {
+	if (raw === null) return null;
+	try {
+		const expected = JSON.parse(raw);
+		if (expected.projectSlug === target.projectSlug && expected.environmentName === target.environmentName && typeof expected.apiUrl === "string" && expected.apiUrl.replace(/\/+$/, "") === target.apiUrl.replace(/\/+$/, "")) return null;
+	} catch {}
+	return "Preview destination does not match the CLI project, backend, or environment. Check --cwd and --url, then run camox preview again.";
+}
+
+//#endregion
+export { validatePreviewTarget };

package/dist/lib/queries.js

@@ -3,6 +3,17 @@ import { getApiUrl, getEnvironmentName, getOrpc } from "./api-client.js";
 import { queryKeys } from "@camox/api-contract/query-keys";
 
 //#region src/lib/queries.ts
+const commentQueries = { list: (pageId) => ({
+	...getOrpc().comments.list.queryOptions({
+		input: { pageId },
+		staleTime: 3e4
+	}),
+	queryKey: [...queryKeys.comments.list(pageId), getEnvironmentName() ?? "production"]
+}) };
+const commentMutations = {
+	create: () => getOrpc().comments.create.mutationOptions(),
+	setResolved: () => getOrpc().comments.setResolved.mutationOptions()
+};
 const pageQueries = {
 	list: (projectId) => ({
 		...getOrpc().pages.list.queryOptions({
@@ -183,4 +194,4 @@ const fileMutations = {
 };
 
 //#endregion
-export { blockMutations, blockQueries, environmentMutations, environmentQueries, fileMutations, fileQueries, layoutQueries, pageMutations, pageQueries, projectQueries, repeatableItemMutations };
+export { blockMutations, blockQueries, commentMutations, commentQueries, environmentMutations, environmentQueries, fileMutations, fileQueries, layoutQueries, pageMutations, pageQueries, projectQueries, repeatableItemMutations };

package/dist/lib/server-auth-cookie.js

@@ -0,0 +1,21 @@
+//#region src/lib/server-auth-cookie.ts
+const SERVER_AUTH_COOKIE_NAME = "camox_auth_cookie";
+function buildClearServerAuthCookieHeader() {
+	return `${SERVER_AUTH_COOKIE_NAME}=; Path=/; SameSite=Lax; Max-Age=0`;
+}
+/** Forward credentials to the API for validation; cookie presence is not authentication.
+* Cross-domain sessions use the mirror. Same-host sessions (including localhost
+* on different ports) may only have Better Auth's native, HttpOnly cookie.
+*/
+function getServerAuthCookieHeader(headers) {
+	const cookies = (headers.get("Cookie") ?? "").split(";").map((part) => part.trim());
+	const mirror = cookies.find((part) => part.startsWith(`${SERVER_AUTH_COOKIE_NAME}=`));
+	if (mirror) try {
+		const value = decodeURIComponent(mirror.slice(18));
+		if (value) return value;
+	} catch {}
+	return cookies.filter((part) => part.startsWith("better-auth.session_token=") || part.startsWith("__Secure-better-auth.session_token=")).join("; ");
+}
+
+//#endregion
+export { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, getServerAuthCookieHeader };