@ampless/runtime 1.0.0-beta.60 → 1.0.0-beta.62

package/dist/chunk-BS7KLDDE.js

@@ -0,0 +1,10 @@
+// src/request-headers.ts
+var AMPLESS_PATHNAME_HEADER = "x-ampless-pathname";
+var PREVIEW_THEME_HEADER = "x-preview-theme";
+var PREVIEW_COLOR_SCHEME_HEADER = "x-preview-color-scheme";
+
+export {
+  AMPLESS_PATHNAME_HEADER,
+  PREVIEW_THEME_HEADER,
+  PREVIEW_COLOR_SCHEME_HEADER
+};

package/dist/index.d.ts

@@ -336,6 +336,20 @@ interface PluginHeadApi {
      * `pluginSettings.loadAll()`.
      */
     contextForPlugins(): Promise<(plugin: AmplessPlugin) => PluginPublicRenderContext>;
+    /**
+     * Non-gated variant of `renderHead()` for use by the admin post preview.
+     *
+     * WHY this bypasses `isPublicRequest()`: the preview iframe is editor-only
+     * and must faithfully show what the published article looks like — including
+     * content-decoration plugins like mermaid/highlight that only register their
+     * scripts via `publicHead`. The `isPublicRequest()` gate correctly blocks
+     * analytics on public pages served to the admin or login routes, but for the
+     * preview we intentionally collect ALL publicHead descriptors so diagrams and
+     * syntax highlighting render. Analytics scripts (GA4/GTM/Plausible) also fire
+     * on preview as a side-effect; this is accepted (preview is not end-user
+     * traffic). Do NOT use this from public layouts — use `renderHead()` there.
+     */
+    renderHeadForPreview(): Promise<ReactNode>;
 }
 /**
  * Position-bucketed result of `renderHtmlForPost`. Themes embed these
@@ -367,18 +381,6 @@ interface PublicHtmlForPostResult {
  *   U+2029   → '\u2029'
  */
 declare function escapeJsonLdInlineBody(value: string): string;
-/**
- * Create the head/body renderer for a `Config`. The constructor-time
- * pass logs a single dev warning when two plugins share an
- * `instanceId ?? name`; everything else happens at render time so
- * descriptors reflect per-request site config.
- *
- * `pluginSettings` (Phase 2) is the runtime accessor that pulls
- * admin-managed `settings.public` values from the S3 site-settings
- * cache. Within a single request we fetch once via `loadAll()` and
- * bind a per-plugin `ctx.setting(key)` accessor before invoking
- * either `publicHead` or `publicBodyEnd`.
- */
 declare function createPluginHead(cmsConfig: Config, pluginSettings: PluginSettingsApi): PluginHeadApi;
 
 interface ThemesRegistry {
@@ -588,6 +590,13 @@ interface Ampless {
     postMetadata(post: Post): Promise<Metadata>;
     siteMetadata(): Promise<Metadata>;
     publicHead(): Promise<ReactNode>;
+    /**
+     * Non-gated head collector for the admin post preview. Collects ALL
+     * `publicHead` descriptors without calling `isPublicRequest()` so
+     * content-decoration plugins (mermaid, highlight) render in preview.
+     * Do NOT call from public layouts — use `publicHead()` there.
+     */
+    publicHeadForPreview(): Promise<ReactNode>;
     publicBodyEnd(): Promise<ReactNode>;
     /**
      * Per-post body descriptors (Phase 4 `schema` capability). Theme

package/dist/index.js

@@ -1,3 +1,8 @@
+import {
+  AMPLESS_PATHNAME_HEADER,
+  PREVIEW_COLOR_SCHEME_HEADER,
+  PREVIEW_THEME_HEADER
+} from "./chunk-BS7KLDDE.js";
 import {
   _resetStreamS3Cache,
   streamS3Object,
@@ -238,6 +243,7 @@ function createSeo(cmsConfig, settingsApi) {
 }
 
 // src/plugin-head.ts
+import { headers } from "next/headers";
 import {
   Fragment as Fragment2,
   createElement as createElement2
@@ -1428,6 +1434,20 @@ function collectHtmlForPost(plugins, site, snapshot, post) {
     afterContent: toReactNode(after, "afterContent")
   };
 }
+async function isPublicRequest() {
+  let h;
+  try {
+    h = await headers();
+  } catch {
+    return false;
+  }
+  const p = h.get(AMPLESS_PATHNAME_HEADER);
+  if (!p) return false;
+  if (p === "/admin" || p.startsWith("/admin/")) return false;
+  if (p === "/login" || p.startsWith("/login/")) return false;
+  if (h.get(PREVIEW_THEME_HEADER) || h.get(PREVIEW_COLOR_SCHEME_HEADER)) return false;
+  return true;
+}
 function createPluginHead(cmsConfig, pluginSettings) {
   const plugins = (cmsConfig.plugins ?? []).filter(isPlugin2);
   const validPlugins = [];
@@ -1532,6 +1552,7 @@ function createPluginHead(cmsConfig, pluginSettings) {
   }
   return {
     async renderHead() {
+      if (!await isPublicRequest()) return null;
       const snapshot = await pluginSettings.loadAll();
       return collectFor(
         validPlugins,
@@ -1542,6 +1563,7 @@ function createPluginHead(cmsConfig, pluginSettings) {
       );
     },
     async renderBodyEnd() {
+      if (!await isPublicRequest()) return null;
       const snapshot = await pluginSettings.loadAll();
       return collectFor(
         validPlugins,
@@ -1567,6 +1589,16 @@ function createPluginHead(cmsConfig, pluginSettings) {
     async contextForPlugins() {
       const snapshot = await pluginSettings.loadAll();
       return (plugin) => makeCtx(plugin, cmsConfig.site, snapshot);
+    },
+    async renderHeadForPreview() {
+      const snapshot = await pluginSettings.loadAll();
+      return collectFor(
+        validPlugins,
+        cmsConfig.site,
+        snapshot,
+        (p) => p.publicHead,
+        renderHeadDescriptor
+      );
     }
   };
 }
@@ -1664,7 +1696,7 @@ function createPluginSettings(storage) {
 }
 
 // src/theme-active.ts
-import { headers } from "next/headers";
+import { headers as headers2 } from "next/headers";
 function createThemeActive(registry, storage) {
   function settingsUrl() {
     if (!storage.isStorageConfigured()) return null;
@@ -1699,8 +1731,8 @@ function createThemeActive(registry, storage) {
     async resolveActiveTheme() {
       let previewOverride = null;
       try {
-        const h = await headers();
-        previewOverride = h.get("x-preview-theme");
+        const h = await headers2();
+        previewOverride = h.get(PREVIEW_THEME_HEADER);
       } catch {
       }
       if (previewOverride && previewOverride in registry.themes) {
@@ -1807,6 +1839,7 @@ function createAmpless(opts) {
     postMetadata: (post) => seo.postMetadata(post),
     siteMetadata: () => seo.siteMetadata(),
     publicHead: () => pluginHead.renderHead(),
+    publicHeadForPreview: () => pluginHead.renderHeadForPreview(),
     publicBodyEnd: () => pluginHead.renderBodyEnd(),
     publicBodyForPost: (post) => pluginHead.renderBodyForPost(post),
     publicHtmlForPost: (post) => pluginHead.renderHtmlForPost(post),

package/dist/middleware.d.ts

@@ -37,6 +37,12 @@ declare function computeCacheControl(flags: {
  *  - `?previewTheme` / `?previewColorScheme` → `x-preview-theme` /
  *    `x-preview-color-scheme` header forwarding for the admin's
  *    iframe-based theme preview.
+ *  - `x-ampless-pathname` marker header set unconditionally on every
+ *    request this middleware handles (public routes only). Server
+ *    components such as `renderHead` / `renderBodyEnd` read this header
+ *    to confirm a public, non-preview request before emitting analytics
+ *    or consent scripts. Routes excluded from the matcher (admin / api /
+ *    login) never receive a runtime-set marker, so those layouts stay clean.
  */
 declare function createAmplessMiddleware(opts: CreateMiddlewareOpts): MiddlewareFn;
 /**

package/dist/middleware.js

@@ -1,3 +1,9 @@
+import {
+  AMPLESS_PATHNAME_HEADER,
+  PREVIEW_COLOR_SCHEME_HEADER,
+  PREVIEW_THEME_HEADER
+} from "./chunk-BS7KLDDE.js";
+
 // src/middleware.ts
 import { NextResponse } from "next/server";
 var runtime = "nodejs";
@@ -137,10 +143,13 @@ function createAmplessMiddleware(opts) {
     const previewTheme = url.searchParams.get("previewTheme");
     const previewColorScheme = url.searchParams.get("previewColorScheme");
     const requestHeaders = new Headers(request.headers);
-    if (previewTheme) requestHeaders.set("x-preview-theme", previewTheme);
+    requestHeaders.delete(PREVIEW_THEME_HEADER);
+    requestHeaders.delete(PREVIEW_COLOR_SCHEME_HEADER);
+    if (previewTheme) requestHeaders.set(PREVIEW_THEME_HEADER, previewTheme);
     if (previewColorScheme) {
-      requestHeaders.set("x-preview-color-scheme", previewColorScheme);
+      requestHeaders.set(PREVIEW_COLOR_SCHEME_HEADER, previewColorScheme);
     }
+    requestHeaders.set(AMPLESS_PATHNAME_HEADER, url.pathname);
     const passthrough = () => NextResponse.next({ request: { headers: requestHeaders } });
     const segments = url.pathname.split("/").filter(Boolean);
     if (segments.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/runtime",
-  "version": "1.0.0-beta.60",
+  "version": "1.0.0-beta.62",
   "description": "Public-side runtime for ampless: post fetching, theme dispatch, middleware, public route handlers",
   "license": "MIT",
   "type": "module",
@@ -51,8 +51,8 @@
     "marked": "^18.0.4",
     "sanitize-html": "^2.17.4",
     "tailwind-merge": "^3.6.0",
-    "@ampless/plugin-og-image": "0.2.0-beta.51",
-    "ampless": "1.0.0-beta.51"
+    "@ampless/plugin-og-image": "0.2.0-beta.52",
+    "ampless": "1.0.0-beta.52"
   },
   "peerDependencies": {
     "@aws-amplify/adapter-nextjs": "^1",