@wizestudio/plugin-strapi

The Strapi v5 plugin that hosts the WizeStudio editor.

Where this sits

WizeStudio is a visual page builder for headless CMS platforms. Pages are stored as structured JSON, your React components render them, and the editor edits your real frontend rather than an approximation of it.

This package is the Strapi half. It mounts @wizestudio/editor in the Strapi admin, injects the CmsAdapter from @wizestudio/cms-strapi, and adds the small amount of server state Strapi has no native place for. It is the only package that couples WizeStudio to Strapi's admin; the editor itself does not know it is inside Strapi. A Payload host would be the same shape with a different adapter.

Install

npm install @wizestudio/plugin-strapi

Strapi v5 only.

Setup

// config/plugins.ts
export default () => ({
  wizestudio: {
    enabled: true,
    config: {
      canvasUrl: process.env.WIZE_CANVAS_URL ?? 'http://localhost:3000/wizestudio/canvas',
    },
  },
});

Add a JSON field named layout to any content type you want to build visually, then open the editor for an entry:

/admin/plugins/wizestudio?collection=api::page.page&documentId=YOUR_ID

The route dispatches on query parameters — collection, documentId, and optionally field, locale and canvasUrl — rather than nesting a router inside Strapi's own. One route, no router coupling, and a URL an author can bookmark.

Your frontend must expose the canvas route the editor frames. See @wizestudio/renderer-react's WizeCanvas, and publish your widget manifests with npx wize push so the widget panel is populated even when the frontend is down.

Permissions

The plugin registers two actions under Settings → Roles:

| Action | Grants | |---|---| | plugin::wizestudio.use | Open the visual editor; read, write and delete reusable blocks; take over an edit lease | | plugin::wizestudio.settings | Publish widget manifests and design tokens; set the licence key |

Publishing manifests changes what every editor in the project can insert, so it takes an explicit permission rather than mere authentication. Your CI token needs the second action; most authors need only the first.

What it stores

Only what Strapi has no native place for, in the plugin store: the manifest bundle pushed by wize push, design token sets, and reusable blocks. Layout documents live in ordinary JSON fields on your own content types — no bespoke storage, and no normalising a layout into Strapi components, which would fight Strapi's migration story forever and end CMS-agnosticism on day one.

Edit leases

Opening a page acquires a lease, held by a browser session rather than a user — one person in two tabs is two holders, which is the more common way a page gets overwritten. A second visitor gets a read-only canvas and a Request edit access button; the holder sees a countdown and may hand over immediately or decline.

The lease is checked again on write by a Strapi document middleware, so a stale tab cannot PUT past a UI that merely looks disabled. Acquisition runs inside a database transaction where Strapi offers one — without it the read-modify-write of a single store key is a genuine race, in exactly the situation the guarantee exists for. On a Strapi without document middleware the plugin still loads and logs a warning; the lease is advisory there rather than enforced.

Editing the layout field through Strapi's own entry form while a lease is held is refused by the middleware, reported as a plain 409.

Licensing behaviour

The licence key is pasted into the plugin's settings and gates editing only. Reads stay open so the admin can always render and explain itself, and every refusal names the host and says what to do next.

Verification is offline against an embedded Ed25519 public key, so a running site never depends on our uptime. Unreachable is not invalid: a network error, timeout or 5xx yields the last known state, never a downgrade.

Licence

Commercial. See LICENSE-COMMERCIAL.md and wizestudio.wizeb.com/pricing.

Development hosts are free and unlimited — localhost, *.local, *.test, private IP ranges and single-label hosts are resolved as free before any token is examined. A developer needs no account, no network and no licence.

Only authoring is licensed. The packages that serve your published pages — schema, core, canvas-bridge, renderer-react, renderer-next and cli — are MIT and contain no licensing code at all. That is what makes "a lapsed subscription cannot break your live site" a property of the build rather than a promise.

wizestudio.wizeb.com