## Problem
Builder page navigation, Authentication, and HTTP response headers used
different path matchers from published Remix pages. For example, Builder
did not select a `/docs/*` page at `/docs`, and a request for `/%64ocs`
could reach the `/docs` page without matching its Authentication rule.
## Change
- Use Remix's framework-independent router for page selection and
project path rules. Adapt Webstudio named splats and preserve encoded
static path segments.
- Keep Authentication's first matching rule and Headers' ordered
application of every matching rule.
- Preserve previously saved encoded literals such as `/%2A`, `/%3F`, and
`/%3Aid`. They match only their literal encoded pathname and cannot
become wildcards or parameters. Previously accepted malformed encoding
remains a literal path.
- Replace Builder's separate route ranking and URLPattern matcher.
URLPattern remains for page path validation and path editing.
- Use the request URL for the project-domain authentication exemption
instead of trusting `x-forwarded-host`. Generated HTML, XML, and text
routes share one authentication helper.
- Extend the HTTP headers guide and shared path pattern reference with
matching behavior, an iframe example, and verification steps.
## Validation
- Authentication package: 88 tests. New regression cases cover saved
Authentication and Headers rules, literal matching, route ranking,
parameter values, and a marker collision attempt. The regressions failed
before the fix and pass now.
- Project build: 2,484 tests, including 214 route and redirect checks.
SDK: 636 tests. CLI: 1,165 tests. Builder system: 5 tests.
- Typechecks: Authentication, project build, Builder, SDK, and CLI.
Lint, package boundaries, formatting, and diff checks pass.
- The fixture pipeline completed and made no additional changes. The
generated fixture files already changed by this PR remain included.
- Staging project build 196 published successfully using the companion
published-site Worker branch. The edge dispatcher was deployed from its
staging branch to normalize forwarded hosts. Live HTTP checks covered
base and child routes, dynamic pages, redirects, 404s, global headers,
and route-scoped headers. The generated site challenged protected base
and child paths, accepted the route password, and left public routes
accessible. The project domain intentionally skips route-specific auth
and has a separate staging Basic Auth gate, so the successful
route-password request was checked in the generated production runtime.
A forged `x-forwarded-host` no longer changes the hosted project-domain
auth decision.
- An initial CLI run alongside two other full suites timed out in one
fixture API test; that test passed alone, and the full CLI suite passed
when rerun alone.
## Compatibility
- [x] Preserve previously accepted percent-encoded route literals before
merging.
- The old URLPattern test asserting that `/docs/*` does not match
`/docs` was intentionally changed because the published Remix router
does match the base path. Tests for the removed custom route sorter were
replaced with router-selection tests.
## Rollout
- [x] Migrate matching in this repository.
- [x] Update user documentation.
- [x] Verify package consumers and related code.
- [ ] Merge
[webstudio-saas#665](https://github.com/webstudio-is/webstudio-saas/pull/665)
before releasing this PR. The current published-site Worker template
imports the removed `matchesPathnamePattern` export; without the
companion change, a published site fails at Wrangler build.
- [ ] After publishing the new `@webstudio-is/wsauth` version, update
the published-site Worker template’s pinned `0.301.0` dependency, remove
the temporary fallback, and deploy the hosted Worker.
Replaces #6482 so the review tracks the deployed `headers.staging`
branch.
Authentication and custom response headers use the same route-rule
syntax, but the shared matcher and validator had auth-specific names.
Give those functions generic names in `wsauth` and update the Builder
header UI and SDK response-header schema to call them directly. All
basic-auth logic remains in `wsauth`; this change adds no package or
re-export.
The project-build page matcher is different: it uses `URLPattern` and
returns decoded parameters. Rename it to `matchUrlPattern` and document
the behavior difference. For example, `/docs/*` matches `/docs` for
authentication and headers, but not for the page matcher. Tests cover
both behaviors.
This renames the two public `wsauth` route exports. Published workers
pinned to the older package retain the old API; the SaaS worker can
adopt the new names after this package is released.
Validation: `wsauth` tests, including its packaged consumer test; SDK
page and response-header tests; project-build route and redirect tests;
SDK, `wsauth`, project-build, and Builder typechecks.
## Summary
This improves how agents discover, author, inspect, and verify Webstudio
projects while reducing unnecessary MCP context usage.
## What changed
- Adds an **Agents** section to Project Settings with ready-to-run setup
commands and client configuration for Claude Code, Codex, Cursor, and VS
Code.
- Makes large list and schema responses compact and paginated by
default, with **verbose** available when complete records or diagnostics
are needed.
- Applies consistent compact output to assets, instances, styles, design
tokens, CLI schemas, and project-session metadata.
- Returns actionable expression warnings for props, resources, and
Collection bindings, including unknown variables and risky render-time
mutation resources.
- Improves Collection expression guidance so agents can bind array items
with the correct scoped variables.
- Reports rendered audit outcomes explicitly as complete, partial,
confirmation-required, or failed.
- Expands runtime output schemas so MCP clients can validate responses
reliably.
- Strengthens the packaged CLI smoke workflow with a realistic
seven-page stdio MCP scenario.
## Architecture
- Consolidates `project-build` from 65 file-oriented entrypoints to 11
architecture-owned surfaces.
- Separates the core model, contracts, runtime authoring, transfer,
state, project sessions, MCP, visual tooling, persistence codecs, and
authenticated server services.
- Isolates Node-only JSX evaluation from browser-safe transfer utilities
and authenticated server modules.
- Keeps persistence codecs independent from authenticated database
services, preventing unrelated module initialization.
- Defines shared instance-path types once and reuses them across runtime
modules.
- Preserves Immer initialization through explicit package side-effect
metadata.
- Adds package tests that prevent a return to source-file entrypoints or
generic exposure of Node-only surfaces.
## Validation
- Full repository checks, tests, typechecks, generated-file checks, and
fixtures
- All 163 Builder test files and 2,141 tests
- All 71 project-build test files and 1,794 tests
- Lint and package-boundary validation
- Full packed CLI release smoke test, including install, preview, agent
setup, seven-page stdio MCP workflow, rendered audit, and structured
commands
This PR expands Webstudio MCP and CLI into a more complete agent
authoring interface. Agents can discover project capabilities, edit real
Webstudio content, use data/resources, verify visual output, and report
useful issues when workflows fail.
## MCP User Capabilities
- Create, update, duplicate, reorder, and delete pages.
- Create pages from templates and manage reusable page templates.
- Inspect project pages, instances, props, styles, assets, variables,
resources, and metadata.
- Insert Webstudio components and authored JSX fragments into pages.
- Edit text, props, styles, breakpoints, design tokens, and CSS
variables.
- Update page metadata, SEO fields, redirects, marketplace metadata, and
project settings.
- Create and use static data variables.
- Create and use dynamic resources fetched over HTTP.
- Use REST, GraphQL, and built-in system resources in authored pages.
- Bind data variables and resources to visible page content.
- Create resource-backed pages such as sitemap XML, structured SEO data,
and API-driven content sections.
- Preview current project state without requiring a publish step.
- Capture screenshots for visual verification.
- Verify responsive designs across desktop, tablet, and mobile
breakpoints.
- Use screenshot diff and OCR-style checks to inspect rendered output.
- Reset and refresh local MCP project state when needed.
- Discover available CLI/MCP commands from generated manuals.
- Use clearer examples for resources, data variables, JSX authoring,
previewing, and visual checks.
- Read marketplace product metadata without requiring a full project
snapshot.
- Get safer guidance when using low-level patch tools.
- Get a ready-to-copy Discord report template when MCP/CLI behavior is
confusing or broken.
Adds permission protection around page templates so content editors can
create pages from templates without being able to open, edit, or patch
template pages directly.
## Description
1. Issue: https://github.com/webstudio-is/webstudio/issues/4931
2. Adds V1 of Page Templates for designers:
- stores project-local page templates separately from published pages
- adds a designer-only Page Templates section in the Pages panel
- supports creating, editing, duplicating, deleting, and reordering
templates
- supports creating a regular page from a template through a prefilled
page settings dialog
- makes canvas/page awareness, asset usage, asset replacement, and
page-copy utilities template-aware while keeping templates out of normal
public page lookup paths
## Steps for reproduction
1. Open the builder in Design mode and open the Pages panel.
2. Click the New Template button in the Page Templates section.
3. Fill in template settings, including name, title, description, search
toggle, social image, and custom metadata.
4. Click Create template and expect the new template to appear under
Page Templates and load on the canvas with an editable blank body.
5. Add content to the template canvas, reopen template settings, change
metadata, close/reopen settings, and expect the changes to persist.
6. Click the `+` action on the template row and expect a Create Page
from Template dialog prefilled from the template with a unique page
path.
7. Change page settings, click Create page, and expect a normal page to
be created in the root folder with copied content and metadata while the
template remains unchanged.
8. Right-click a template row, choose Duplicate, and expect a new
independent template copy with a deduplicated name.
9. Drag templates within the Page Templates section and expect the order
to persist.
10. Right-click a template row, choose Delete, confirm deletion, and
expect the template and its canvas tree to be removed. If the deleted
template was selected, expect the builder to navigate back to the home
page.
11. Switch to Content mode and expect template management UI to be
hidden.
12. Use a template social image from Assets, check asset usages, replace
the asset, and expect the template social image reference to update.
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [x] made a self-review
- [x] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [x] tested locally and on preview environment (preview dev login:
0000)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
---------
Co-authored-by: shreyanshkotak <sk7739@nyu.edu>
## Description
1. What is this PR about (link the issue and add a short description)
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
0000)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
Closes https://github.com/webstudio-is/webstudio/issues/3510
## Summary
This PR adds a **Current Date** system resource, extends the `system`
object with a `pathname` property, and enhances the **Time component**
with custom date formatting capabilities to provide more flexibility and
prevent hydration errors.
### Key Features
1. **Current Date System Resource** - Provides normalized date/time
information that prevents React hydration errors
2. **System Pathname** - Adds `pathname` property directly to the
`system` object for easy access in expressions
3. **Time Component Custom Formatting** - Adds a `format` prop with
template tokens for flexible date/time display
## Motivation
These changes solve important use cases:
- **Current Date**: Prevents React hydration errors when displaying
dynamic dates (e.g., copyright years in footers). Previously, using `new
Date()` in expressions would cause server/client mismatch.
- **System Pathname**: Provides easy access to the current page path in
expressions without needing to parse the URL manually.
- **Custom Time Formatting**: Allows users to format dates with simple
templates (e.g., `YYYY-MM-DD`) without being limited to
`Intl.DateTimeFormat` options, and provides a simple way to exclude
specific date or time components to avoid hydration issues.
## Changes
### Current Date Resource
- Created
[`apps/builder/app/shared/$resources/current-date.server.ts`](apps/builder/app/shared/$resources/current-date.server.ts)
- Provides date fields: `year`, `month`, `day`, `iso`, `timestamp`
- All values normalized to midnight UTC (00:00:00.000Z) to prevent
hydration errors
- Registered in
[`rest.resources-loader.ts`](apps/builder/app/routes/rest.resources-loader.ts)
- Added to SystemResourceForm dropdown in UI
### System Pathname
- Added `pathname` property to
[`System`](packages/sdk/src/schema/pages.ts) type
- Updated [`system.ts`](apps/builder/app/shared/system.ts) to compute
and include pathname
- Normalized empty pathname to `'/'` for consistency
- Available in expressions as `system.pathname`
### Time Component Enhancements
- Added [`formatDate()`](packages/sdk-components-react/src/time.tsx:353)
function supporting template tokens:
- `YYYY`, `YY` - year (4-digit, 2-digit)
- `MM`, `M` - month (zero-padded, no padding)
- `DD`, `D` - day (zero-padded, no padding)
- `HH`, `H` - hours (zero-padded, no padding)
- `mm`, `m` - minutes (zero-padded, no padding)
- `ss`, `s` - seconds (zero-padded, no padding)
- Added `format` prop to
[`Time`](packages/sdk-components-react/src/time.tsx:386) component that
overrides `dateStyle`/`timeStyle` when provided
- Updated component logic to check for `format` prop first before
falling back to `Intl.DateTimeFormat`
- Added comprehensive tests for date formatting in
[`time.test.ts`](packages/sdk-components-react/src/time.test.ts)
- Updated component metadata in
[`time.ws.ts`](packages/sdk-components-react/src/time.ws.ts) to include
`format` in initialProps
- Example: `format="YYYY-MM-DD HH:mm:ss"` displays as "2025-11-03
18:47:25"
### Template & Fixture Updates
- Updated all CLI templates (defaults, react-router, SSG) to include
`pathname` in system objects
- Updated all fixture files (47 files total) to include `pathname` in
system objects
- All 694 tests passing
- All typecheck passing
## Usage
### Current Date Resource
Users can now add the Current Date resource from the Data Variables
panel:
1. Click + next to Data Variables
2. Select "System Resource"
3. Choose "Current Date" from the dropdown
4. Access in expressions:
- `date.year` - for copyright year
- `date.month` - current month (1-12)
- `date.day` - current day (1-31)
- `date.iso` - ISO 8601 string
- `date.timestamp` - Unix timestamp
### System Pathname
Access the current page path directly:
- `system.pathname` - current page path (e.g., `/about`, `/blog/post-1`)
### Time Component Custom Format
Use the `format` prop for custom date/time display:
```jsx
<Time datetime="2025-11-03T18:47:25Z" format="YYYY-MM-DD" />
// Displays: 2025-11-03
<Time datetime="2025-11-03T18:47:25Z" format="YYYY-MM-DD HH:mm:ss" />
// Displays: 2025-11-03 18:47:25
<Time datetime="2025-11-03T18:47:25Z" format="M/D/YYYY" />
// Displays: 11/3/2025
```
Technical Notes
- Current Date values are normalized to midnight UTC to ensure
consistency throughout the day and prevent hydration mismatches
- The pathname property is computed from the request URL and normalized
to '/' when empty
- Custom format templates in the Time component are processed before
falling back to Intl.DateTimeFormat
- All changes are backward compatible
We are moving away from binding system to variables and instead gonna
have one global variable.
Here moved system values into separate store coupled to pages instead of
variables.
Also fixed suggestions in address bar, probably broke while design
system refactorings.
Testing
- submit form with one named input
- check system value is rendered
- check system value can be inspected
Oleg Isonen