@decocms/nextjs 8.5.1 → 8.6.0

package/dist/server/index.js

@@ -2,27 +2,36 @@
  * `@decocms/nextjs/server`: draft previews in Server Components (pages,
  * layouts, route handlers). Server only: it reads `next/headers`.
  *
- * A page (and, through the `x-deco-draft` header the proxy forwards, the root
- * layout) binds the request's draft before it reads content, then reads
- * through `contentClient(cms)`:
+ * The proxy decides what a request reads (`@decocms/nextjs/proxy`): the
+ * version, the visitor, and each test and campaign on or off, forwarded on
+ * `x-deco-version`, `x-deco-visitor` and `x-deco-assignments`. A page (and,
+ * through those headers, the root layout) binds them before it reads
+ * content, then reads through `contentClient(cms)`, which builds
+ * `cms.client({ version, experiments, campaigns })` and decides nothing
+ * again:
  *
  * ```tsx
  * export default async function Page({ searchParams }) {
- *   await bindDraft(cms, { searchParams: await searchParams, site: "my-store" });
+ *   await bindDraft(cms, { searchParams: await searchParams });
  *   const client = contentClient(cms);
  *   …
  *   return <>{sections}<DraftPreviewIndicator /></>;
  * }
  * ```
  *
- * The host check is the proxy's (`decideDraft`), repeated here with the same
- * options, so a route the proxy doesn't match, or a forged `x-deco-draft`,
- * still gets the release on a host that may not preview.
+ * The host check is the proxy's (`decideDraft`), repeated here against the
+ * same CMS, so a route the proxy doesn't match, or a forged `x-deco-version`,
+ * still gets the release on a host that may not preview. On the release, a
+ * test at 0% stays off whatever `x-deco-assignments` says.
  */
+import { parseVisitor } from "@decocms/blocks/experiments";
 import { headers } from "next/headers.js";
-import { DRAFT_HEADER, DRAFT_PARAM } from "../draft.js";
-import { allowedDraft, isDraftPreviewEnabled, requestLike } from "../drafts.js";
+import { ASSIGNMENTS_HEADER, parseAssignmentsSegment, withoutDarkTests, } from "../assignments.js";
+import { DRAFT_PARAM, VERSION_HEADER } from "../draft.js";
+import { allowedDraft, requestLike } from "../drafts.js";
+import { VISITOR_HEADER } from "../visitor.js";
 import { activeDraftPointer, draftSlot } from "./slot.js";
+export { ASSIGNMENTS_ROUTE_PREFIX, assignmentsSegment, parseAssignmentsSegment, } from "../assignments.js";
 export { requestLike } from "../drafts.js";
 export { activeDraftPointer };
 function firstParam(searchParams, key) {
@@ -30,35 +39,130 @@ function firstParam(searchParams, key) {
     return (Array.isArray(raw) ? raw[0] : raw) ?? null;
 }
 /**
- * Binds the request's draft, if any: the page's own `?__draft=` first (`off`
- * leaves preview), then the pointer the proxy forwarded on `x-deco-draft`,
- * then the draft cookie, each on a host the options allow. Returns whether a
- * draft was bound. With previews off on every host it returns `false`
- * without reading the request, so a static page stays static.
+ * Binds what the request reads: the version, if any (the page's own
+ * `?__draft=` first, `off` leaving preview, then the version the proxy
+ * forwarded on `x-deco-version`, then the draft cookie, each on a host the
+ * CMS allows), and what the proxy decided (`x-deco-assignments`) and the
+ * visitor it read (`x-deco-visitor`). Returns whether a version was bound:
+ * a draft, or a published release's commit SHA (Studio's "Preview this
+ * version"). It reads the request's headers, so it belongs on the draft
+ * route; a cached (ISR) page reads what its path names (`assignedClient`).
  */
 export async function bindDraft(cms, options = {}) {
-    const { searchParams, ...policy } = options;
-    if (!(await isDraftPreviewEnabled(cms, policy)))
-        return false;
+    if (await bindVersion(cms, options)) {
+        // A preview renders per request anyway, and may switch on a test at 0%.
+        await bindForwarded(cms, false);
+        return true;
+    }
+    if (await variesByVisitor(cms))
+        await bindForwarded(cms, true);
+    return false;
+}
+/** The visitor and the assignments the proxy forwarded, if any. */
+async function bindForwarded(cms, release) {
+    const requestHeaders = await headers();
+    const slot = draftSlot();
+    slot.visitor = parseVisitor(requestHeaders.get(VISITOR_HEADER));
+    const decided = parseAssignmentsSegment(requestHeaders.get(ASSIGNMENTS_HEADER) ?? "");
+    slot.assignments = decided && release ? await withoutDarkTests(cms, decided) : decided;
+}
+/**
+ * Whether the release saves an `experiments` block (the built-in
+ * `split-traffic`) or a `campaigns` block (the built-in `calendar`) with a
+ * name in it: only then does a page vary by what the proxy decided. Read from
+ * memory, unresolved; `false` when both are missing.
+ */
+async function variesByVisitor(cms) {
+    const saves = async (name, type) => {
+        try {
+            const [block] = await cms.forRelease().resolve(name, { run: false });
+            if (typeof block !== "object" || block === null)
+                return false;
+            const record = block;
+            return (record.__resolveType === type && Object.keys(record).some((key) => key !== "__resolveType"));
+        }
+        catch {
+            return false;
+        }
+    };
+    const [tests, campaigns] = await Promise.all([
+        saves("experiments", "split-traffic"),
+        saves("campaigns", "calendar"),
+    ]);
+    return tests || campaigns;
+}
+async function bindVersion(cms, options) {
+    const { searchParams } = options;
     const param = firstParam(searchParams, DRAFT_PARAM);
     if (param === "off")
         return false;
     const requestHeaders = await headers();
-    const forwarded = param ?? requestHeaders.get(DRAFT_HEADER);
+    const forwarded = param ?? requestHeaders.get(VERSION_HEADER);
     const query = forwarded ? `?${DRAFT_PARAM}=${encodeURIComponent(forwarded)}` : "";
     const request = requestLike(requestHeaders, `/${query}`);
-    const pointer = request ? await allowedDraft(cms, request, policy) : null;
-    if (pointer === null)
+    const version = request ? await allowedDraft(cms, request) : null;
+    if (version === null)
         return false;
-    draftSlot().pointer = pointer;
+    draftSlot().version = version;
     return true;
 }
 /**
- * The content client for this request: the draft `bindDraft` bound, or the
- * release.
+ * The content client for this request, from what `bindDraft` bound:
+ * `cms.client({ version, experiments, campaigns })` with the tests and
+ * campaigns the proxy decided, deciding nothing again. On a route the proxy
+ * didn't decide for, the visitor and the preview's moment and switched tests
+ * and campaigns decide instead. Create one per request.
  */
 export function contentClient(cms) {
-    const pointer = activeDraftPointer();
-    return pointer ? cms.forDraft(pointer) : cms.forRelease();
+    const { version, visitor, assignments } = draftSlot();
+    const options = { visitor, version: version?.version ?? null };
+    if (version?.date !== undefined)
+        options.date = version.date;
+    const experiments = over(version?.experiments, assignments?.experiments);
+    const campaigns = over(version?.campaigns, assignments?.campaigns);
+    if (experiments !== undefined)
+        options.experiments = experiments;
+    if (campaigns !== undefined)
+        options.campaigns = campaigns;
+    return cms.client(options);
+}
+/** `decided` over `preview`, name by name; `undefined` when neither has any. */
+function over(preview, decided) {
+    if (preview === undefined && decided === undefined)
+        return undefined;
+    return { ...preview, ...decided };
+}
+/**
+ * The content client of a page on the assignments route
+ * (`app/%5Fassignments/[assignments]/[[...path]]`, which the proxy's
+ * `rewriteToAssignmentsRoute` rewrites the CMS's pages to): the current
+ * release, read as `cms.client({ experiments, campaigns })` with every test
+ * and campaign the path's segment names on or off as the proxy decided, and
+ * no visitor. The proxy decides, the page renders that, reading no request,
+ * so Next can cache it (ISR, `revalidate = 600`). A test at 0% stays off
+ * whatever the path names, and a test or a campaign the content doesn't have
+ * stays out, never an error: a 404 here would be cached under the path by
+ * Next. `null` only when the segment isn't one the proxy writes: the page
+ * answers with `notFound()`.
+ *
+ * ```tsx
+ * export const revalidate = 600;
+ * export async function generateStaticParams() {
+ *   return [];
+ * }
+ * export default async function Page({ params }) {
+ *   const { assignments, path } = await params;
+ *   const client = await assignedClient(cms, assignments);
+ *   if (!client) notFound();
+ *   …
+ * }
+ * ```
+ */
+export async function assignedClient(cms, segment) {
+    const parsed = parseAssignmentsSegment(segment);
+    if (parsed === null)
+        return null;
+    const assignments = await withoutDarkTests(cms, parsed);
+    return cms.client({ experiments: assignments.experiments, campaigns: assignments.campaigns });
 }
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAsB,WAAW,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAsB,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAU9B,SAAS,UAAU,CAAC,YAAsC,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAA0D,EAC1D,OAAO,GAAqB,EAAE;IAE9B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,cAAyB,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,SAAS,EAAE,CAAC,OAAO,GAAG,OAAO,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyC;IACrE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAElB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAElB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAY9B,SAAS,UAAU,CAAC,YAAsC,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,OAAO,GAAqB,EAAE;IAC1E,IAAI,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,wEAAwE;QACxE,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,eAAe,CAAC,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,aAAa,CAAC,GAAY,EAAE,OAAgB;IACzD,MAAM,cAAc,GAAG,MAAM,OAAO,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,uBAAuB,CAAC,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,WAAW,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,GAA4B;IACzD,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,IAAY,EAAoB,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,CAAU,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC9D,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,OAAO,CACL,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC,CAC5F,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC;QACrC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC;KAC/B,CAAC,CAAC;IACH,OAAO,KAAK,IAAI,SAAS,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,OAAyB;IAChE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,cAAyB,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,SAAS,EAAE,CAAC,OAAO,GAAG,OAAO,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAwB;IACpD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,CAAC;IACtD,MAAM,OAAO,GAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IAC9E,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACnE,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IACjE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC3D,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,SAAS,IAAI,CACX,OAAsD,EACtD,OAAsD;IAEtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAuC,EACvC,OAAe;IAEf,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,WAAW,GAAoB,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;AAChG,CAAC"}

package/dist/server/slot.d.ts

@@ -1,6 +1,21 @@
-export declare const draftSlot: () => {
-    pointer: string | null;
-};
-/** The draft pointer bound to this request (`bindDraft`), or `null` when it renders the release. */
+/**
+ * What a request renders, held for the request's Server Components: the
+ * version (a draft, or an old release, with its preview's moment and switched
+ * tests and campaigns), the visitor and the tests and campaigns the proxy
+ * decided. React's `cache()` gives one slot per request in the React Server
+ * Components graph, the scope a draft needs; no `next/headers` here, so the
+ * root components can read it without binding anything.
+ */
+import type { RequestVersion } from "@decocms/blocks";
+import type { Visitor } from "@decocms/blocks/experiments";
+import type { PathAssignments } from "../assignments.ts";
+interface DraftSlot {
+    version: RequestVersion | null;
+    visitor: Visitor | null;
+    assignments: PathAssignments | null;
+}
+export declare const draftSlot: () => DraftSlot;
+/** The version bound to this request (`bindDraft`), or `null` when it renders the current release. */
 export declare function activeDraftPointer(): string | null;
+export {};
 //# sourceMappingURL=slot.d.ts.map

package/dist/server/slot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slot.d.ts","sourceRoot":"","sources":["../../src/server/slot.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,SAAS,QAAa;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAA0B,CAAC;AAEtF,oGAAoG;AACpG,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAElD"}
+{"version":3,"file":"slot.d.ts","sourceRoot":"","sources":["../../src/server/slot.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,UAAU,SAAS;IACjB,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;CACrC;AAED,eAAO,MAAM,SAAS,QAChB,SACL,CAAC;AAEF,sGAAsG;AACtG,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAElD"}

package/dist/server/slot.js

@@ -1,13 +1,7 @@
-/**
- * The draft a request renders, held for the request's Server Components.
- * React's `cache()` gives one slot per request in the React Server
- * Components graph, the scope a draft needs; no `next/headers` here, so the
- * root components can read it without binding anything.
- */
 import { cache } from "react";
-export const draftSlot = cache(() => ({ pointer: null }));
-/** The draft pointer bound to this request (`bindDraft`), or `null` when it renders the release. */
+export const draftSlot = cache(() => ({ version: null, visitor: null, assignments: null }));
+/** The version bound to this request (`bindDraft`), or `null` when it renders the current release. */
 export function activeDraftPointer() {
-    return draftSlot().pointer;
+    return draftSlot().version?.version ?? null;
 }
 //# sourceMappingURL=slot.js.map

package/dist/server/slot.js.map

@@ -1 +1 @@
-{"version":3,"file":"slot.js","sourceRoot":"","sources":["../../src/server/slot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,GAA+B,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAEtF,oGAAoG;AACpG,MAAM,UAAU,kBAAkB;IAChC,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"slot.js","sourceRoot":"","sources":["../../src/server/slot.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAS9B,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAC5B,GAAc,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACvE,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,kBAAkB;IAChC,OAAO,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;AAC9C,CAAC"}

package/dist/visitor.d.ts

@@ -0,0 +1,16 @@
+/**
+ * How the proxy hands the pages the visitor: the request header it forwards
+ * once it read the visitor (`readVisitor` from `@decocms/blocks/experiments`,
+ * a new one on a first visit). The proxy writes it (`visitorRequestHeaders`
+ * from `@decocms/nextjs/proxy`); the pages read it (`bindDraft`, then
+ * `contentClient`, from `@decocms/nextjs/server`). The package's own copy: it
+ * never imports `@decocms/tanstack`. No imports, no state: safe in every
+ * bundle.
+ */
+/**
+ * The request header carrying the visitor, in its stored form (the
+ * `deco_segment` cookie's value, `serializeVisitor`). The proxy removes any
+ * copy that arrives from outside (`draftRequestHeaders`).
+ */
+export declare const VISITOR_HEADER = "x-deco-visitor";
+//# sourceMappingURL=visitor.d.ts.map

package/dist/visitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor.d.ts","sourceRoot":"","sources":["../src/visitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC"}

package/dist/visitor.js

@@ -0,0 +1,16 @@
+/**
+ * How the proxy hands the pages the visitor: the request header it forwards
+ * once it read the visitor (`readVisitor` from `@decocms/blocks/experiments`,
+ * a new one on a first visit). The proxy writes it (`visitorRequestHeaders`
+ * from `@decocms/nextjs/proxy`); the pages read it (`bindDraft`, then
+ * `contentClient`, from `@decocms/nextjs/server`). The package's own copy: it
+ * never imports `@decocms/tanstack`. No imports, no state: safe in every
+ * bundle.
+ */
+/**
+ * The request header carrying the visitor, in its stored form (the
+ * `deco_segment` cookie's value, `serializeVisitor`). The proxy removes any
+ * copy that arrives from outside (`draftRequestHeaders`).
+ */
+export const VISITOR_HEADER = "x-deco-visitor";
+//# sourceMappingURL=visitor.js.map

package/dist/visitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor.js","sourceRoot":"","sources":["../src/visitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/nextjs",
-  "version": "8.5.1",
+  "version": "8.6.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -56,7 +56,7 @@
     "typecheck": "node ../../scripts/tsc.mjs -p tsconfig.json"
   },
   "peerDependencies": {
-    "@decocms/blocks": "^8.5.0",
+    "@decocms/blocks": "^8.6.0",
     "@opentelemetry/api": "^1.0.0",
     "next": "^16.0.0",
     "react": "^19.0.0"
@@ -67,7 +67,7 @@
     }
   },
   "devDependencies": {
-    "@decocms/blocks": "8.5.1",
+    "@decocms/blocks": "8.6.0",
     "@opentelemetry/api": "^1.9.1",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",

package/src/assignments.ts

@@ -0,0 +1,278 @@
+/**
+ * A request's assignments: what its content gives it, decided once, in the
+ * proxy, and handed to the page. The version it reads (a Studio link's draft
+ * or release SHA, `null` for the current release), each test of the saved
+ * `experiments` block on or off for its visitor, and each campaign of the
+ * saved `campaigns` block running or not at its date, with a preview's
+ * switched tests and campaigns on top. The page builds
+ * `cms.client({ version, experiments, campaigns })` from them, a client that
+ * decides nothing again.
+ *
+ * Two requests with the same assignments render the same content, so they
+ * share a cache entry: `assignmentsKey` for a cache keyed on a string,
+ * `assignmentsSegment` for Next's own path-keyed cache. The visitor id itself
+ * is never in either, or every visitor would miss. The binding caches nothing
+ * itself.
+ *
+ * The same reading as `@decocms/tanstack/worker`'s.
+ */
+import type { ClientOptions, CMS } from "@decocms/blocks";
+import type { Assignments } from "@decocms/blocks/experiments";
+
+export interface RequestAssignments {
+  /** The version read, `null` for the current release. */
+  version: string | null;
+  /** Each test of the saved `experiments` block: on or off. */
+  experiments: Readonly<Assignments>;
+  /** Each campaign of the saved `campaigns` block: running or not. */
+  campaigns: Readonly<Assignments>;
+}
+
+/**
+ * The request header the proxy hands the pages the assignments it decided on
+ * (`assignmentsSegment`), for `bindDraft` and `contentClient`. The proxy
+ * removes any copy that arrives from outside.
+ */
+export const ASSIGNMENTS_HEADER = "x-deco-assignments";
+
+/** What a page's path and the decisions header carry: the tests and campaigns, never the version or the visitor. */
+export type PathAssignments = Pick<RequestAssignments, "experiments" | "campaigns">;
+
+const EXPERIMENTS = { block: "experiments", type: "split-traffic" } as const;
+const CAMPAIGNS = { block: "campaigns", type: "calendar" } as const;
+
+type Reader = ReturnType<CMS["client"]>;
+
+/** Plain code-unit order, the same on every server and locale. */
+const byCodeUnit = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function record(): Assignments {
+  return Object.create(null) as Assignments;
+}
+
+/**
+ * Whether the content saves a block of `type`: listing never fails on a
+ * missing block, so a site without tests or campaigns reports no error.
+ */
+async function saves(client: Reader, type: string): Promise<boolean> {
+  const [list] = await client.list(type);
+  return (list?.length ?? 0) > 0;
+}
+
+/** The saved `block` resolved, each name `true` or `false`; `null` when the content saves none. */
+async function decided(
+  client: Reader,
+  spec: { block: string; type: string },
+): Promise<Assignments | null> {
+  try {
+    if (!(await saves(client, spec.type))) return null;
+    const [value] = await client.resolve<unknown>(spec.block);
+    const out = record();
+    if (!isRecord(value)) return out;
+    for (const name of Object.keys(value).sort(byCodeUnit)) out[name] = value[name] === true;
+    return out;
+  } catch {
+    return record();
+  }
+}
+
+/**
+ * The assignments of one request: `cms.client(options)` (the version, the
+ * visitor, the date and a preview's switched tests and campaigns, as
+ * `cms.readVersion` reads them) resolving `experiments` and `campaigns`.
+ * Missing blocks (or content that doesn't load) give none, never an error.
+ */
+export async function readAssignments(
+  cms: Pick<CMS, "client">,
+  options: ClientOptions,
+): Promise<RequestAssignments> {
+  return (await readAssignmentsAndScope(cms, options)).assignments;
+}
+
+/**
+ * `readAssignments`, and whether its page can differ by them: `true` when the
+ * content saves tests or campaigns (or couldn't be read, to stay safe), so a
+ * response keyed on them must never be shared by its URL alone.
+ */
+export async function readAssignmentsAndScope(
+  cms: Pick<CMS, "client">,
+  options: ClientOptions,
+): Promise<{ assignments: RequestAssignments; varies: boolean }> {
+  const version = typeof options.version === "string" ? options.version : null;
+  const none: RequestAssignments = { version, experiments: record(), campaigns: record() };
+  let client: Reader;
+  try {
+    client = cms.client(options);
+  } catch {
+    return { assignments: none, varies: true };
+  }
+  const [experiments, campaigns] = await Promise.all([
+    decided(client, EXPERIMENTS),
+    decided(client, CAMPAIGNS),
+  ]);
+  return {
+    assignments: {
+      version,
+      experiments: experiments ?? none.experiments,
+      campaigns: campaigns ?? none.campaigns,
+    },
+    varies: experiments !== null || campaigns !== null,
+  };
+}
+
+/** The names that are on, sorted. */
+function onNames(assignments: Readonly<Assignments>): string[] {
+  return Object.keys(assignments)
+    .filter((name) => assignments[name] === true)
+    .sort(byCodeUnit);
+}
+
+/**
+ * The assignments as one stable string for a cache key:
+ * `v=<version>|x=<tests on>|c=<campaigns running>`, names sorted and
+ * URL-encoded, empty parts left out; `""` for none. The names that are off
+ * aren't in it: within one content revision they are the rest.
+ */
+export function assignmentsKey(assignments: RequestAssignments): string {
+  const list = (names: string[]) => names.map(encodeURIComponent).join(",");
+  const parts: string[] = [];
+  if (assignments.version) parts.push(`v=${encodeURIComponent(assignments.version)}`);
+  const tests = onNames(assignments.experiments);
+  const campaigns = onNames(assignments.campaigns);
+  if (tests.length) parts.push(`x=${list(tests)}`);
+  if (campaigns.length) parts.push(`c=${list(campaigns)}`);
+  return parts.join("|");
+}
+
+/**
+ * The route a page renders on under the assignments its proxy made:
+ * `/_assignments/<assignments>/<path>`, mounted as `app/%5Fassignments/[assignments]/[[...path]]`
+ * (a literal `_assignments` folder is private in Next and never routes). The proxy
+ * rewrites to it (`rewriteToAssignmentsRoute`) and answers a direct hit with
+ * its 404, so a visitor can't pick the assignments by typing a path.
+ */
+export const ASSIGNMENTS_ROUTE_PREFIX = "/_assignments";
+
+/** The segment for content with no test and no campaign. */
+const NONE = "-";
+
+function toBase64Url(text: string): string {
+  let binary = "";
+  for (const byte of new TextEncoder().encode(text)) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function fromBase64Url(segment: string): string | null {
+  if (!/^[A-Za-z0-9_-]+$/.test(segment)) return null;
+  try {
+    const binary = atob(segment.replace(/-/g, "+").replace(/_/g, "/"));
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return null;
+  }
+}
+
+/** `+name` on, `-name` off, names URL-encoded and sorted. */
+function encodeStates(states: Readonly<Assignments>): string {
+  return Object.keys(states)
+    .sort(byCodeUnit)
+    .map((name) => `${states[name] === true ? "+" : "-"}${encodeURIComponent(name)}`)
+    .join(",");
+}
+
+/**
+ * The tests and campaigns as one path segment, every name with its state
+ * (`x=+on,-off|c=+running,-not`, base64url-encoded so Next passes it to the
+ * page unchanged), for Next's own path-keyed cache (ISR, the full route
+ * cache) and for the decisions header (`ASSIGNMENTS_HEADER`): `-` for none.
+ * The same assignments always give the same segment; the visitor is never in
+ * it.
+ */
+export function assignmentsSegment(assignments: PathAssignments): string {
+  const parts: string[] = [];
+  const tests = encodeStates(assignments.experiments);
+  const campaigns = encodeStates(assignments.campaigns);
+  if (tests) parts.push(`x=${tests}`);
+  if (campaigns) parts.push(`c=${campaigns}`);
+  return parts.length === 0 ? NONE : toBase64Url(parts.join("|"));
+}
+
+/**
+ * The tests and campaigns a segment carries, or `null` when it isn't one
+ * `assignmentsSegment` writes (malformed, or the same assignments spelled
+ * another way), so each set of assignments has exactly one path.
+ */
+export function parseAssignmentsSegment(segment: string): PathAssignments | null {
+  if (segment === NONE) return { experiments: record(), campaigns: record() };
+  const key = fromBase64Url(segment);
+  if (key === null) return null;
+  const parsed = { experiments: record(), campaigns: record() };
+  const seen = new Set<string>();
+  try {
+    for (const part of key.split("|")) {
+      const eq = part.indexOf("=");
+      const tag = part.slice(0, eq);
+      const list = part.slice(eq + 1);
+      if (eq <= 0 || list === "" || seen.has(tag) || (tag !== "x" && tag !== "c")) return null;
+      seen.add(tag);
+      const target = tag === "x" ? parsed.experiments : parsed.campaigns;
+      for (const entry of list.split(",")) {
+        const state = entry[0];
+        if (state !== "+" && state !== "-") return null;
+        target[decodeURIComponent(entry.slice(1))] = state === "+";
+      }
+    }
+  } catch {
+    return null;
+  }
+  return assignmentsSegment(parsed) === segment ? parsed : null;
+}
+
+/** `/_assignments/<segment><pathname>` (the bare prefix and segment for `/`). */
+export function assignmentsRoutePath(pathname: string, assignments: PathAssignments): string {
+  const base = `${ASSIGNMENTS_ROUTE_PREFIX}/${assignmentsSegment(assignments)}`;
+  return pathname === "/" || pathname === "" ? base : `${base}${pathname}`;
+}
+
+/** Whether `pathname` is on the assignments route: a site's proxy answers a direct hit there with its 404. */
+export function isAssignmentsRoutePath(pathname: string): boolean {
+  return (
+    pathname === ASSIGNMENTS_ROUTE_PREFIX || pathname.startsWith(`${ASSIGNMENTS_ROUTE_PREFIX}/`)
+  );
+}
+
+/**
+ * The tests a path or header names, as a page renders them on the current
+ * release: a test at 0% stays off whatever it says, so a forged path or
+ * header can't switch on a test nobody is in (a preview, on its own version,
+ * may). A name the content doesn't have stays out anyway (`cms.client`
+ * keeps only the block's names). Read from memory, unresolved.
+ */
+export async function withoutDarkTests(
+  cms: Pick<CMS, "forRelease">,
+  assignments: PathAssignments,
+): Promise<PathAssignments> {
+  const on = Object.keys(assignments.experiments).filter(
+    (name) => assignments.experiments[name] === true,
+  );
+  if (on.length === 0) return assignments;
+  let saved: Record<string, unknown> = {};
+  try {
+    const [block] = await cms.forRelease().resolve<unknown>(EXPERIMENTS.block, { run: false });
+    if (isRecord(block) && block.__resolveType === EXPERIMENTS.type) saved = block;
+  } catch {
+    // No experiments block: every test the client is given stays out.
+  }
+  const experiments = record();
+  for (const name of Object.keys(assignments.experiments)) {
+    const pct = Object.hasOwn(saved, name) ? saved[name] : undefined;
+    const dark = typeof pct !== "number" || !Number.isFinite(pct) || Math.round(pct) <= 0;
+    experiments[name] = assignments.experiments[name] === true && !dark;
+  }
+  return { experiments, campaigns: assignments.campaigns };
+}

package/src/draft.ts

@@ -1,7 +1,7 @@
 /**
  * The draft names and headers of a Deco Next.js site: the `?__draft=` link,
  * the cookie that keeps a preview going, the request header the proxy hands
- * the pages, and the response headers of a page rendered from a draft. The
+ * the pages the version on, and the response headers of a page rendered from a draft. The
  * proxy reads and writes them (`./drafts.ts`, `./proxy`); the pages read the
  * header (`./server`); `./config/index.cjs` repeats them (`config.test.ts`
  * holds them equal). This package's own copy: it never imports
@@ -23,11 +23,13 @@ export const DRAFT_COOKIE = "__deco_draft";
 
 /**
  * The request header the proxy sets on the request it hands the pages once it
- * accepted the draft: the pointer, already checked. The proxy removes any
- * copy that arrives from outside, and `bindDraft` repeats the host check, so a
- * client can't send one itself.
+ * accepted a Studio link: the version (a draft pointer or a release's commit
+ * SHA), already checked, without the preview's moment and switched tests
+ * (those are decided in the proxy: `ASSIGNMENTS_HEADER`). The proxy removes
+ * any copy that arrives from outside, and `bindDraft` repeats the host check,
+ * so a client can't send one itself.
  */
-export const DRAFT_HEADER = "x-deco-draft";
+export const VERSION_HEADER = "x-deco-version";
 
 /** The URL prefix a drafted request is rewritten onto (`app/%5Fdraft/[[...path]]`). */
 export const DRAFT_ROUTE_PREFIX = "/_draft";
@@ -35,11 +37,11 @@ export const DRAFT_ROUTE_PREFIX = "/_draft";
 /**
  * The response headers of a page rendered from a draft: never stored by a
  * browser or a CDN (`Cache-Control: no-store, private`, `Vary: Cookie`) and
- * never indexed (`X-Robots-Tag: noindex, nofollow`). `{}` when `pointer` is
+ * never indexed (`X-Robots-Tag: noindex, nofollow`). `{}` when `version` is
  * `null`, so the result of the draft decision applies as is.
  */
-export function draftResponseHeaders(pointer: string | null | undefined): Record<string, string> {
-  if (!pointer) return {};
+export function draftResponseHeaders(version: string | null | undefined): Record<string, string> {
+  if (!version) return {};
   return {
     "Cache-Control": "no-store, private",
     Vary: "Cookie",