@akinon/next 2.0.79-rc.0 → 2.0.79-rc.1

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @akinon/next
 
+## 2.0.79-rc.1
+
+### Patch Changes
+
+- 86187b1c: ZERO-4879: Repair sync-merge corruption in default middleware and server data loaders — remove a duplicated block that left an unbalanced brace, and restore the awaited `result` binding the payload optimization reads
+- 0cf9ea239: BRDG-16491: Prevent redirect when iframe payment is active
+- 324f97d55: ZERO-4219: replace masterpass-rest-complete with masterpass-rest-callback
+- 51ea06888: ZERO-4377: Fix checkout card type state being cleared after valid bin number responses.
+- ZERO-4160: Enhance oauth-login middleware with improved request handling and logging
+- 2fea4143: ZERO-4620: Add runtime access to `NEXT_PUBLIC_*` environment variables from Client Components
+- b55acb768: ZERO-2577: Fix pagination bug and update usePagination hook and ensure pagination controls rendering correctly
+- 760258c1c: ZERO-4160: Enhance oauth-login middleware to handle fetch errors and improve response handling
+- 143be2b9d: ZERO-3457: Crop styles are customizable and logic improved for rendering similar products modal
+- 7889b08fe: ZERO-4276: Enhance route generation by adding .env loading and custom skip segments support
+- 9f8cd3bc5: ZERO-3449: AI Search Active Filters & Crop Style changes have been implemented
+- bfafa3f49: ZERO-4160: Refactor oauth-login middleware to use fetchCommerce for API calls and improve cookie handling
+- 57d7eb305: ZERO-4276: Refactor route generation logic by removing environment loading and simplifying skip segments handling
+- d99a6a7d5: ZERO-3457_1: Fixed the settings prop and made sure everything is customizable.
+- 9db81a714: ZERO-4365: Remove brand `@theme/*` alias imports from library packages
+- 591e345e1: ZERO-3855: Enhance credit card payment handling in checkout middlewares
+- 4de5303c5: ZERO-2504: add cookie filter to api client request
+- 95b139dc1: ZERO-3795: Remove duplicate entry for SavedCard in PluginComponents map
+- 1d00f2d06: BRDG-16664: Set secure flag for CSRF token cookies in useCaptcha and default middleware
+- 4ac7b2a1e: ZERO-4219: fix masterpass-rest callback route format and double-encoded error cookie
+- e9598c71: ZERO-4622: Images remotePatterns for improved readability
+- 4998a9631: ZERO-4168: Add server-side payload optimization
+- 804d2bd6: ZERO-4536: Add akinon.net domain to CSP frame-ancestors directive
+- 3909d3224: Edit the duplicate Plugin.SimilarProducts in the plugin-module.
+- 6a3d8a63: ZERO-4541: Fix URL query string formatting in getOrders and getOldOrders functions
+- e18836b20: ZERO-4160: Restore scope in Sentry addon configuration in akinon.json
+- b1111d7b: ZERO-4841: Guard `withPrettyUrl` against calling `String.prototype.replace` with an `undefined` locale prefix on projects without a URL locale prefix (e.g. `HideDefaultLocale`) — previously this coerced to the literal string `"undefined"` and silently stripped a trailing `/undefined` segment from the path before the pretty-url lookup, causing bogus URLs like `/{product-slug}/undefined` to resolve and rewrite to the real product page (200) instead of 404
+
 ## 2.0.79-rc.0
 
 ### Patch Changes

package/data/server/widget.ts

@@ -1,19 +1,192 @@
 import { Cache, CacheKey } from '../../lib/cache';
 import 'server-only';
+import { draftMode } from 'next/headers';
 import { CacheOptions, WidgetResultType, WidgetSchemaType } from '../../types';
 import appFetch from '../../utils/app-fetch';
 import { widgets } from '../urls';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeWidgetResponse } from '../../utils/payload-optimizer';
-import logger from '../../utils/log';
-import settings from 'settings';
+import {
+  isPreviewCopySlug,
+  isValidPreviewId,
+  previewSlug
+} from '../../utils/preview';
+
+/**
+ * Widget preview (draft mode): the theme editor keeps any number of NAMED
+ * previews, each storing its pages under `<slug>-preview-<previewId>`. With
+ * draft mode on (entered via /api/preview, toggled by `?preview` on any page
+ * url) and a preview id on the request, every widget fetch first tries that
+ * preview's copy and falls back to the live slug when none exists — a
+ * preview renders as "live + that preview's overlay". Preview fetches bypass
+ * Redis and the fetch data cache so the editor's latest save is visible.
+ *
+ * BOTH signals are required: draft mode alone renders live (no id ⇒ no
+ * preview slug to try), and an id alone does nothing without draft mode.
+ */
+const PREVIEW_SNAPSHOT_ATTRIBUTE = 'preview_snapshot';
+
+const PREVIEW_NO_STORE = { revalidate: 0 };
+
+// The snapshot blob owns theme settings/data sources in preview, so the
+// theme-config widget itself is never slug-transformed; a slug that is
+// already this preview's copy is never transformed twice. Checked against
+// the CURRENT id, not a shape — a live slug may legitimately end in
+// `-preview-<something>` (a custom page named `summer-preview-2026`).
+const isPreviewTransformableSlug = (slug: string, previewId: string): boolean =>
+  slug !== 'theme-config' && !isPreviewCopySlug(slug, previewId);
+
+/**
+ * The editor's directory of previews that exist (`theme-previews` widget,
+ * `theme_previews` attribute). Deleting a preview removes it here first and
+ * clears only the pages the editor had loaded — so this is what makes a
+ * deleted preview stop rendering, even for a browser that still carries its
+ * cookie. Read uncached, remembered briefly across requests: a deleted
+ * preview may linger for at most REGISTRY_TTL_MS. An unreadable registry
+ * fails OPEN (behaves as before the check existed) rather than blanking
+ * every preview on a transient backend error.
+ */
+const PREVIEW_REGISTRY_SLUG = 'theme-previews';
+const PREVIEW_REGISTRY_ATTRIBUTE = 'theme_previews';
+const REGISTRY_TTL_MS = 5_000;
+
+let registryMemo: { ids: Set<string> | null; expires: number } = {
+  ids: null,
+  expires: 0
+};
+
+const unwrapAttribute = (raw: unknown): unknown =>
+  typeof raw === 'object' && raw !== null && 'value' in raw
+    ? (raw as { value?: unknown }).value
+    : raw;
+
+const registryKnowsPreview = async (
+  previewId: string,
+  locale: string,
+  currency: string
+): Promise<boolean> => {
+  const now = Date.now();
+  if (registryMemo.expires <= now) {
+    let ids: Set<string> | null = null;
+    try {
+      const widget = await getWidgetDataHandler(
+        PREVIEW_REGISTRY_SLUG,
+        locale,
+        currency,
+        undefined,
+        PREVIEW_NO_STORE
+      )();
+      const raw = unwrapAttribute(
+        (widget as { attributes?: Record<string, unknown> } | null)
+          ?.attributes?.[PREVIEW_REGISTRY_ATTRIBUTE]
+      );
+      if (typeof raw === 'string' && raw) {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed?.previews)) {
+          ids = new Set(
+            (parsed.previews as Array<{ id?: unknown }>)
+              .map((entry) => entry?.id)
+              .filter((id): id is string => typeof id === 'string')
+          );
+        }
+      }
+    } catch {
+      ids = null;
+    }
+    registryMemo = { ids, expires: now + REGISTRY_TTL_MS };
+  }
+  return registryMemo.ids ? registryMemo.ids.has(previewId) : true;
+};
+
+/**
+ * The named preview this render belongs to, or '' when the request is not a
+ * preview at all. The id is decoded from the pz route segment (see
+ * utils/preview.ts) and re-validated here — it originates from a cookie.
+ */
+const previewIdForRequest = async (
+  locale: string = ServerVariables.locale,
+  currency: string = ServerVariables.currency
+): Promise<string> => {
+  try {
+    if (!(await draftMode()).isEnabled) return '';
+  } catch {
+    // No request scope (e.g. build-time prerender) — never a preview.
+    return '';
+  }
+  const previewId = ServerVariables.previewId;
+  if (!isValidPreviewId(previewId)) return '';
+  return (await registryKnowsPreview(previewId, locale, currency))
+    ? previewId
+    : '';
+};
+
+/**
+ * Whole-placeholder preview snapshot written by the theme editor into the
+ * `preview_snapshot` attribute of `<placeholderSlug>-preview-<previewId>`.
+ * When present (draft mode only), the placeholder renders straight from this
+ * blob — no per-section fetches.
+ */
+export type PreviewSnapshot = {
+  version: number;
+  savedAt?: string;
+  themeSettings?: Record<string, unknown> | null;
+  dataSources?: unknown[];
+  sections: unknown[];
+};
+
+export const getPreviewSnapshot = async ({
+  slug,
+  locale = ServerVariables.locale,
+  currency = ServerVariables.currency
+}: {
+  slug: string;
+  locale?: string;
+  currency?: string;
+}): Promise<PreviewSnapshot | null> => {
+  const previewId = slug ? await previewIdForRequest(locale, currency) : '';
+  if (!previewId) {
+    return null;
+  }
+
+  const widget = await getWidgetDataHandler(
+    previewSlug(slug, previewId),
+    locale,
+    currency,
+    undefined,
+    PREVIEW_NO_STORE
+  )();
+
+  const rawAttribute = (
+    widget as { attributes?: Record<string, unknown> } | null
+  )?.attributes?.[PREVIEW_SNAPSHOT_ATTRIBUTE];
+  const rawValue =
+    typeof rawAttribute === 'object' &&
+    rawAttribute !== null &&
+    'value' in rawAttribute
+      ? (rawAttribute as { value?: unknown }).value
+      : rawAttribute;
+
+  if (typeof rawValue !== 'string' || !rawValue) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(rawValue);
+    if (parsed?.version === 1 && Array.isArray(parsed.sections)) {
+      return parsed as PreviewSnapshot;
+    }
+  } catch {
+    // Malformed snapshot — fall back to the live render path.
+  }
+  return null;
+};
 
 const getWidgetDataHandler =
   (
     slug: string,
     locale: string,
     currency: string,
-    headers?: Record<string, string>
+    headers?: Record<string, string>,
+    next?: { revalidate: number }
   ) =>
   async () => {
     if (!slug) {
@@ -25,13 +198,20 @@ const getWidgetDataHandler =
       locale,
       currency,
       init: {
-        headers
+        headers,
+        ...(next ? { next } : {})
       }
     });
   };
 
 const getWidgetSchemaDataHandler =
-  (widgetSlug: string, locale: string, currency: string) => async () => {
+  (
+    widgetSlug: string,
+    locale: string,
+    currency: string,
+    next?: { revalidate: number }
+  ) =>
+  async () => {
     if (!widgetSlug) {
       return null;
     }
@@ -39,7 +219,8 @@ const getWidgetSchemaDataHandler =
     return await appFetch({
       url: widgets.getWidgetSchema(widgetSlug),
       locale,
-      currency
+      currency,
+      init: next ? { next } : {}
     });
   };
 
@@ -56,7 +237,36 @@ export const getWidgetData = async <T>({
   cacheOptions?: CacheOptions;
   headers?: Record<string, string>;
 }): Promise<WidgetResultType<T>> => {
-  const result = await Cache.wrap(
+  const requestPreviewId =
+    slug === 'theme-config' ? '' : await previewIdForRequest(locale, currency);
+  const previewId = isPreviewTransformableSlug(slug, requestPreviewId)
+    ? requestPreviewId
+    : '';
+  if (previewId) {
+    const previewData = await getWidgetDataHandler(
+      previewSlug(slug, previewId),
+      locale,
+      currency,
+      headers,
+      PREVIEW_NO_STORE
+    )();
+
+    // A snapshot HOLDER (placeholder blob carrier, consumed exclusively via
+    // getPreviewSnapshot) is not a per-widget preview copy — returning it
+    // here would shadow the live widget with an attribute-less shell when
+    // its blob is malformed and the caller fell back to the live path.
+    const previewAttributes = (
+      previewData as { attributes?: Record<string, unknown> } | null
+    )?.attributes;
+    if (
+      previewAttributes &&
+      previewAttributes[PREVIEW_SNAPSHOT_ATTRIBUTE] === undefined
+    ) {
+      return previewData as WidgetResultType<T>;
+    }
+  }
+
+  return Cache.wrap(
     CacheKey.Widget(slug),
     locale,
     getWidgetDataHandler(slug, locale, currency, headers),
@@ -78,7 +288,13 @@ export const getWidgetData = async <T>({
 };
 
 const getCollectionWidgetDataHandler =
-  (slug: string, locale: string, currency: string) => async () => {
+  (
+    slug: string,
+    locale: string,
+    currency: string,
+    next?: { revalidate: number }
+  ) =>
+  async () => {
     if (!slug) {
       return null;
     }
@@ -86,7 +302,8 @@ const getCollectionWidgetDataHandler =
     return await appFetch({
       url: widgets.getCollectionWidget(slug),
       locale,
-      currency
+      currency,
+      init: next ? { next } : {}
     });
   };
 
@@ -101,6 +318,24 @@ export const getCollectionWidgetData = async <T>({
   currency?: string;
   cacheOptions?: CacheOptions;
 }): Promise<WidgetResultType<T>> => {
+  const requestPreviewId =
+    slug === 'theme-config' ? '' : await previewIdForRequest(locale, currency);
+  const previewId = isPreviewTransformableSlug(slug, requestPreviewId)
+    ? requestPreviewId
+    : '';
+  if (previewId) {
+    const previewData = await getCollectionWidgetDataHandler(
+      previewSlug(slug, previewId),
+      locale,
+      currency,
+      PREVIEW_NO_STORE
+    )();
+
+    if ((previewData as { attributes?: unknown } | null)?.attributes) {
+      return previewData as WidgetResultType<T>;
+    }
+  }
+
   return Cache.wrap(
     CacheKey.Widget(`collection:${slug}`),
     locale,
@@ -123,6 +358,26 @@ export const getWidgetSchemaData = async <T>({
   currency?: string;
   cacheOptions?: CacheOptions;
 }): Promise<WidgetSchemaType<T>> => {
+  const requestPreviewId =
+    widgetSlug === 'theme-config'
+      ? ''
+      : await previewIdForRequest(locale, currency);
+  const previewId = isPreviewTransformableSlug(widgetSlug, requestPreviewId)
+    ? requestPreviewId
+    : '';
+  if (previewId) {
+    const previewData = await getWidgetSchemaDataHandler(
+      previewSlug(widgetSlug, previewId),
+      locale,
+      currency,
+      PREVIEW_NO_STORE
+    )();
+
+    if ((previewData as { schema?: unknown } | null)?.schema) {
+      return previewData as WidgetSchemaType<T>;
+    }
+  }
+
   return Cache.wrap(
     CacheKey.WidgetSchema(widgetSlug),
     locale,

package/hocs/server/with-segment-defaults.tsx

@@ -15,6 +15,7 @@ import {
   getBuiltInSegments,
   isLegacyMode
 } from '../../utils/pz-segments';
+import { isValidPreviewId, PREVIEW_PZ_SEGMENT } from '../../utils/preview';
 
 type SegmentType = 'root-layout' | 'layout' | 'page';
 
@@ -60,6 +61,9 @@ export const withSegmentDefaults =
 
     let localeValue: string;
     let currencyValue: string;
+    // Which named widget preview this render belongs to, if any — see
+    // utils/preview.ts for why it travels in the route rather than a cookie.
+    let previewValue = '';
 
     if (isLegacyMode(settings)) {
       localeValue = resolvedParams.locale;
@@ -70,6 +74,10 @@ export const withSegmentDefaults =
       const builtIn = getBuiltInSegments(parsed, settings);
       localeValue = builtIn.locale;
       currencyValue = builtIn.currency;
+      // Cookie-derived, so re-validated here rather than trusted.
+      previewValue = isValidPreviewId(parsed[PREVIEW_PZ_SEGMENT])
+        ? parsed[PREVIEW_PZ_SEGMENT]
+        : '';
     }
 
     if (options.segmentType === 'root-layout') {
@@ -83,6 +91,7 @@ export const withSegmentDefaults =
 
     ServerVariables.locale = localeValue;
     ServerVariables.currency = currencyValue;
+    ServerVariables.previewId = previewValue;
 
     return await (
       <>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@akinon/next",
   "description": "Core package for Project Zero Next",
-  "version": "2.0.79-rc.0",
+  "version": "2.0.79-rc.1",
   "private": false,
   "license": "MIT",
   "bin": {
@@ -36,7 +36,7 @@
     "set-cookie-parser": "2.6.0"
   },
   "devDependencies": {
-    "@akinon/eslint-plugin-projectzero": "2.0.79-rc.0",
+    "@akinon/eslint-plugin-projectzero": "2.0.79-rc.1",
     "@babel/core": "7.26.10",
     "@babel/preset-env": "7.26.9",
     "@babel/preset-typescript": "7.27.0",

package/utils/app-fetch.ts

@@ -76,7 +76,9 @@ const appFetch = async <T>({
       'x-forwarded-for': ip
     };
 
-    init.next = {
+    // Callers may pass their own cache directives (e.g. widget preview
+    // fetches use revalidate: 0); only apply the default when they don't.
+    init.next = init.next ?? {
       revalidate: Settings.usePrettyUrlRoute ? 0 : 60
     };
 

package/utils/preview-token.ts

@@ -0,0 +1,111 @@
+import { isValidPreviewId } from './preview';
+
+/**
+ * Signed, expiring preview entry tokens.
+ *
+ * The storefront never hands out its PREVIEW_SECRET: the editor asks
+ * `/api/preview/link` (proving it is an editor user with its Omnitron token)
+ * and receives a token that names ONE preview and dies at `expiresAt`. A leaked
+ * link therefore exposes nothing lasting, and rotating the secret invalidates
+ * every outstanding link at once.
+ *
+ * Format: `v1.<previewId>.<expiresAt unix seconds>.<base64url HMAC-SHA256>`.
+ * Web Crypto only, so the same code runs in Node route handlers and on the
+ * edge.
+ */
+export const PREVIEW_TOKEN_VERSION = 'v1';
+
+/** How long an editor-issued preview link stays valid unless configured. */
+export const DEFAULT_PREVIEW_LINK_TTL_SECONDS = 24 * 60 * 60;
+
+export interface PreviewTokenClaims {
+  previewId: string;
+  /** Unix time in SECONDS. */
+  expiresAt: number;
+}
+
+export type PreviewTokenVerdict =
+  | { ok: true; claims: PreviewTokenClaims }
+  | { ok: false; reason: 'malformed' | 'expired' | 'invalid-signature' };
+
+// Created per call: the module is also imported where TextEncoder only shows
+// up after a polyfill (jsdom), and the cost is negligible.
+const encode = (value: string) => new TextEncoder().encode(value);
+
+const base64url = (bytes: ArrayBuffer): string => {
+  const view = new Uint8Array(bytes);
+  let binary = '';
+  for (let i = 0; i < view.length; i++) {
+    binary += String.fromCharCode(view[i]);
+  }
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+
+const hmac = async (secret: string, payload: string): Promise<string> => {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  );
+  return base64url(await crypto.subtle.sign('HMAC', key, encode(payload)));
+};
+
+/** Constant-time string equality — a signature check must not leak by timing. */
+const timingSafeEqual = (a: string, b: string): boolean => {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+};
+
+const payloadOf = ({ previewId, expiresAt }: PreviewTokenClaims): string =>
+  `${PREVIEW_TOKEN_VERSION}.${previewId}.${expiresAt}`;
+
+export const signPreviewToken = async (
+  claims: PreviewTokenClaims,
+  secret: string
+): Promise<string> => {
+  if (!isValidPreviewId(claims.previewId)) {
+    throw new Error('signPreviewToken: invalid preview id');
+  }
+  if (!Number.isInteger(claims.expiresAt) || claims.expiresAt <= 0) {
+    throw new Error('signPreviewToken: invalid expiry');
+  }
+  const payload = payloadOf(claims);
+  return `${payload}.${await hmac(secret, payload)}`;
+};
+
+export const verifyPreviewToken = async (
+  token: string,
+  secret: string,
+  nowMs: number = Date.now()
+): Promise<PreviewTokenVerdict> => {
+  const parts = typeof token === 'string' ? token.split('.') : [];
+  if (parts.length !== 4 || parts[0] !== PREVIEW_TOKEN_VERSION) {
+    return { ok: false, reason: 'malformed' };
+  }
+  const [, previewId, expiresAtRaw, signature] = parts;
+  const expiresAt = Number(expiresAtRaw);
+  if (
+    !isValidPreviewId(previewId) ||
+    !/^\d+$/.test(expiresAtRaw) ||
+    !Number.isSafeInteger(expiresAt) ||
+    !signature
+  ) {
+    return { ok: false, reason: 'malformed' };
+  }
+  // Signature before expiry: an attacker must not learn which expired tokens
+  // were once valid.
+  const expected = await hmac(secret, payloadOf({ previewId, expiresAt }));
+  if (!timingSafeEqual(signature, expected)) {
+    return { ok: false, reason: 'invalid-signature' };
+  }
+  if (expiresAt * 1000 <= nowMs) {
+    return { ok: false, reason: 'expired' };
+  }
+  return { ok: true, claims: { previewId, expiresAt } };
+};

package/utils/preview.ts

@@ -0,0 +1,83 @@
+/**
+ * Widget preview contract — shared by the middleware/route handler that
+ * enters preview, the pz segment that carries which preview is being viewed,
+ * and the widget fetch layer that resolves the preview copies.
+ *
+ * The theme editor writes the other half of this contract: it creates named
+ * previews and stores each one's pages under `<slug>-preview-<id>`. The two
+ * sides must never drift.
+ */
+
+/** Suffix before the preview id — hyphenated because Omnitron slugifies. */
+export const PREVIEW_SLUG_SUFFIX = '-preview';
+
+/** Remembers which named preview this browser is viewing. */
+export const PREVIEW_ID_COOKIE = 'pz-preview-id';
+
+/** Next.js's own draft-mode cookie — set by `draftMode().enable()`. */
+export const DRAFT_MODE_COOKIE = '__prerender_bypass';
+
+/** Query key on the editor's link, consumed by the /api/preview handler. */
+export const PREVIEW_ID_QUERY_PARAM = 'preview_id';
+
+/**
+ * The pz segment carrying the preview id into the render.
+ *
+ * A cookie cannot be used directly: the pages that render widgets are
+ * `dynamic = 'force-static'`, and Next.js blanks `cookies()`/`headers()`
+ * under that config (draftMode is the exception). Route params always
+ * survive, so the middleware resolves the cookie into this segment and the
+ * server components read it from there. See settings.js `pzSegments`.
+ */
+export const PREVIEW_PZ_SEGMENT = 'preview';
+
+/**
+ * Ids come from a cookie, so they are validated everywhere they are used:
+ * lowercase slug words joined by single hyphens, bounded length — exactly
+ * what the editor produces (see slugifyPreviewId there). No `--` anywhere:
+ * that is the pz segment separator, and an id containing it would make the
+ * segment undecodable.
+ */
+export const isValidPreviewId = (id: unknown): id is string =>
+  typeof id === 'string' &&
+  id.length <= 32 &&
+  /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(id);
+
+/** The slug a widget's copy lives under inside one named preview. */
+export const previewSlug = (slug: string, previewId: string): string =>
+  `${slug}${PREVIEW_SLUG_SUFFIX}-${previewId}`;
+
+/**
+ * True for slugs shaped like a preview copy of something. A HEURISTIC — a
+ * live slug can legitimately end this way (a custom page named
+ * `summer-preview-2026`), so the fetch layer does not use it to decide
+ * whether to overlay; see `isPreviewCopySlug`.
+ */
+export const isPreviewSlug = (slug: string): boolean =>
+  /-preview-[a-z0-9-]+$/.test(slug);
+
+/**
+ * True when `slug` is already the copy of something inside THIS preview —
+ * the exact check the fetch layer needs so preview slugs are never nested,
+ * without misreading live slugs that merely look like one.
+ */
+export const isPreviewCopySlug = (slug: string, previewId: string): boolean =>
+  previewId !== '' && slug.endsWith(previewSlug('', previewId));
+
+/**
+ * Resolves the pz segment value from the request — used by settings.js.
+ * An invalid or absent cookie yields '' (no preview), which the fetch layer
+ * treats as "render live".
+ *
+ * The id only counts alongside Next's draft-mode cookie: without it the
+ * request renders live anyway, and folding an unauthenticated cookie value
+ * into the route segment would let any visitor mint a fresh ISR/Redis cache
+ * key per request.
+ */
+export const resolvePreviewSegment = (req: {
+  cookies: { get: (name: string) => { value: string } | undefined };
+}): string => {
+  if (!req.cookies.get(DRAFT_MODE_COOKIE)?.value) return '';
+  const value = req.cookies.get(PREVIEW_ID_COOKIE)?.value ?? '';
+  return isValidPreviewId(value) ? value : '';
+};

package/utils/pz-segments.ts

@@ -40,15 +40,44 @@ export function encodePzValue(
     .join(config.separator);
 }
 
+/**
+ * Inverse of `encodePzValue`.
+ *
+ * The `url` segment is `encodeURIComponent(fullUrl)`, and that leaves `-`
+ * alone — so a pathname containing the separator (`/collections/summer--sale`)
+ * splits into extra parts. Only `url` can do that (locale, currency and the
+ * custom segments are validated slugs), so the segments before it are read
+ * from the front, the ones after it from the back, and whatever is left in
+ * the middle is the url re-joined. A purely positional read would hand the
+ * url's tail to the segment after it — with a preview segment present that
+ * meant rendering the wrong preview (or live) with a misleading banner.
+ */
 export function decodePzValue(
   pzValue: string,
   config: PzSegmentsConfig
 ): Record<string, string> {
   const parts = pzValue.split(config.separator);
   const result: Record<string, string> = {};
+  const urlIndex = config.segments.findIndex((seg) => seg.name === 'url');
 
+  if (urlIndex === -1 || parts.length <= config.segments.length) {
+    config.segments.forEach((seg, index) => {
+      result[seg.name] = parts[index] ?? '';
+    });
+    return result;
+  }
+
+  const trailing = config.segments.length - urlIndex - 1;
   config.segments.forEach((seg, index) => {
-    result[seg.name] = parts[index] ?? '';
+    if (index < urlIndex) {
+      result[seg.name] = parts[index] ?? '';
+    } else if (index === urlIndex) {
+      result[seg.name] = parts
+        .slice(urlIndex, parts.length - trailing)
+        .join(config.separator);
+    } else {
+      result[seg.name] = parts[parts.length - trailing + (index - urlIndex - 1)] ?? '';
+    }
   });
 
   return result;

package/utils/server-variables.ts

@@ -6,5 +6,12 @@ const { locales, defaultLocaleValue, defaultCurrencyCode } =
 export const ServerVariables = {
   locale: locales.find((l) => l.value === defaultLocaleValue)?.value ?? '',
   currency: defaultCurrencyCode,
-  globalHeaders: {}
+  globalHeaders: {},
+  /**
+   * Which named widget preview the current render belongs to, decoded from
+   * the pz route segment by withSegmentDefaults. Empty for ordinary traffic.
+   * Only ever acted on together with draft mode, so a value left behind by a
+   * concurrent request cannot leak preview content to a normal visitor.
+   */
+  previewId: ''
 };