@dotcms/uve 26.8.3-1-next.2478 → 26.8.7-1

package/index.cjs.js

@@ -13,6 +13,7 @@ exports.enableBlockEditorInline = _public.enableBlockEditorInline;
 exports.getUVEState = _public.getUVEState;
 exports.initInlineEditing = _public.initInlineEditing;
 exports.initUVE = _public.initUVE;
+exports.isRequestFromUVE = _public.isRequestFromUVE;
 exports.reorderMenu = _public.reorderMenu;
 exports.sendMessageToUVE = _public.sendMessageToUVE;
 exports.updateNavigation = _public.updateNavigation;

package/index.esm.js

@@ -1,3 +1,3 @@
-export { b as createContentlet, c as createUVESubscription, e as editContentlet, a as enableBlockEditorInline, g as getUVEState, i as initInlineEditing, d as initUVE, r as reorderMenu, s as sendMessageToUVE, u as updateNavigation } from './public.esm.js';
+export { d as createContentlet, c as createUVESubscription, e as editContentlet, b as enableBlockEditorInline, g as getUVEState, a as initInlineEditing, f as initUVE, i as isRequestFromUVE, r as reorderMenu, s as sendMessageToUVE, u as updateNavigation } from './public.esm.js';
 import '@dotcms/types';
 import '@dotcms/types/internal';

package/internal.cjs.js

@@ -402,6 +402,7 @@ exports.getDotContentletAttributes = _public.getDotContentletAttributes;
 exports.getNativeEventBinder = _public.getNativeEventBinder;
 exports.getUVEState = _public.getUVEState;
 exports.isDotAnalyticsActive = _public.isDotAnalyticsActive;
+exports.isRequestFromUVE = _public.isRequestFromUVE;
 exports.isValidBlocks = _public.isValidBlocks;
 exports.readContentletDataset = _public.readContentletDataset;
 exports.setBounds = _public.setBounds;

package/internal.esm.js

@@ -1,5 +1,5 @@
 import { g as getUVEState, s as sendMessageToUVE } from './public.esm.js';
-export { A as ANALYTICS_ACTIVE_WINDOW_KEY, l as ANALYTICS_READY_EVENT, C as CUSTOM_NO_COMPONENT, D as DEVELOPMENT_MODE, k as DOT_SECTION_ID_PREFIX, j as EMPTY_CONTAINER_STYLE_ANGULAR, h as EMPTY_CONTAINER_STYLE_REACT, E as END_CLASS, P as PRODUCTION_MODE, S as START_CLASS, T as TEMP_EMPTY_CONTENTLET, m as TEMP_EMPTY_CONTENTLET_TYPE, _ as __UVE_EVENTS__, f as __UVE_EVENT_ERROR_FALLBACK__, x as combineClasses, w as computeScrollIsInBottom, c as createUVESubscription, t as findDotCMSElement, v as findDotCMSVTLData, B as getAnalyticsContentletAttributes, q as getClosestDotCMSContainerData, y as getColumnPositionClasses, G as getContainersData, H as getContentletsInContainer, p as getDotCMSContainerData, o as getDotCMSContentletsBound, n as getDotCMSPageBounds, I as getDotContainerAttributes, z as getDotContentletAttributes, K as getNativeEventBinder, F as isDotAnalyticsActive, M as isValidBlocks, J as readContentletDataset, L as setBounds } from './public.esm.js';
+export { A as ANALYTICS_ACTIVE_WINDOW_KEY, m as ANALYTICS_READY_EVENT, C as CUSTOM_NO_COMPONENT, D as DEVELOPMENT_MODE, l as DOT_SECTION_ID_PREFIX, k as EMPTY_CONTAINER_STYLE_ANGULAR, j as EMPTY_CONTAINER_STYLE_REACT, E as END_CLASS, P as PRODUCTION_MODE, S as START_CLASS, T as TEMP_EMPTY_CONTENTLET, n as TEMP_EMPTY_CONTENTLET_TYPE, _ as __UVE_EVENTS__, h as __UVE_EVENT_ERROR_FALLBACK__, y as combineClasses, x as computeScrollIsInBottom, c as createUVESubscription, v as findDotCMSElement, w as findDotCMSVTLData, F as getAnalyticsContentletAttributes, t as getClosestDotCMSContainerData, z as getColumnPositionClasses, H as getContainersData, I as getContentletsInContainer, q as getDotCMSContainerData, p as getDotCMSContentletsBound, o as getDotCMSPageBounds, J as getDotContainerAttributes, B as getDotContentletAttributes, L as getNativeEventBinder, G as isDotAnalyticsActive, i as isRequestFromUVE, N as isValidBlocks, K as readContentletDataset, M as setBounds } from './public.esm.js';
 import { UVE_MODE, DotCMSUVEAction } from '@dotcms/types';
 import '@dotcms/types/internal';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotcms/uve",
-  "version": "26.8.3-1-next.2478",
+  "version": "26.08.07-01",
   "description": "Official JavaScript library for interacting with Universal Visual Editor (UVE)",
   "repository": {
     "type": "git",

package/public.cjs.js

@@ -1042,6 +1042,36 @@ function getUVEState() {
     dotCMSHost
   };
 }
+/**
+ * Detects whether a request's query parameters came through the UVE iframe - for server-only
+ * contexts (e.g. a Next.js Server Component fetching data before any client code runs) where
+ * `getUVEState()` can't be used, since it reads `window.location` and there is no `window` yet.
+ *
+ * UVE always appends `dotCMSHost` to the iframed URL, so its presence is the signal checked here.
+ *
+ * @remarks
+ * This is a heuristic based on a single query parameter, not a security boundary - it can be
+ * forced onto any URL. A forced/spoofed request only ever gets a blank/placeholder response
+ * instead of a real 404 or error page: the actual page content still only ever arrives through a
+ * genuine UVE editor `postMessage`, so nothing sensitive leaks. If a wrong HTTP status in that
+ * forced case matters for your use case (SEO, monitoring), validate the request further
+ * server-side (e.g. the `Sec-Fetch-Dest: iframe` header) before trusting this.
+ *
+ * @param searchParams - The request's query parameters, as a plain object (e.g. a Next.js
+ * Server Component's `searchParams` prop).
+ *
+ * @example
+ * ```ts
+ * export default async function Page({ searchParams }) {
+ *   const sp = await searchParams;
+ *   const insideUVE = isRequestFromUVE(sp);
+ *   // ...decide whether to bail to notFound() or render the page shell
+ * }
+ * ```
+ */
+function isRequestFromUVE(searchParams) {
+  return Boolean(searchParams['dotCMSHost']);
+}
 /**
  * Creates a subscription to a UVE event.
  *
@@ -1515,6 +1545,11 @@ function createContentlet(contentType) {
  * - Client ready state
  * - UVE event subscriptions
  *
+ * @param {Partial<DotCMSPageResponse>} [config] - Sent as-is to the editor as the CLIENT_READY
+ * payload. Accepts a partial shape (e.g. just `{ graphql }`) for callers that don't yet have a
+ * full page response — a failed/draft page fetch, for instance — since this only ever forwards
+ * `config` to the editor and never reads any of its fields itself.
+ *
  * @returns {Object} An object containing the cleanup function
  * @returns {Function} destroyUVESubscriptions - Function to clean up all UVE event subscriptions
  *
@@ -1584,6 +1619,7 @@ exports.getUVEState = getUVEState;
 exports.initInlineEditing = initInlineEditing;
 exports.initUVE = initUVE;
 exports.isDotAnalyticsActive = isDotAnalyticsActive;
+exports.isRequestFromUVE = isRequestFromUVE;
 exports.isValidBlocks = isValidBlocks;
 exports.readContentletDataset = readContentletDataset;
 exports.reorderMenu = reorderMenu;

package/public.esm.js

@@ -1040,6 +1040,36 @@ function getUVEState() {
     dotCMSHost
   };
 }
+/**
+ * Detects whether a request's query parameters came through the UVE iframe - for server-only
+ * contexts (e.g. a Next.js Server Component fetching data before any client code runs) where
+ * `getUVEState()` can't be used, since it reads `window.location` and there is no `window` yet.
+ *
+ * UVE always appends `dotCMSHost` to the iframed URL, so its presence is the signal checked here.
+ *
+ * @remarks
+ * This is a heuristic based on a single query parameter, not a security boundary - it can be
+ * forced onto any URL. A forced/spoofed request only ever gets a blank/placeholder response
+ * instead of a real 404 or error page: the actual page content still only ever arrives through a
+ * genuine UVE editor `postMessage`, so nothing sensitive leaks. If a wrong HTTP status in that
+ * forced case matters for your use case (SEO, monitoring), validate the request further
+ * server-side (e.g. the `Sec-Fetch-Dest: iframe` header) before trusting this.
+ *
+ * @param searchParams - The request's query parameters, as a plain object (e.g. a Next.js
+ * Server Component's `searchParams` prop).
+ *
+ * @example
+ * ```ts
+ * export default async function Page({ searchParams }) {
+ *   const sp = await searchParams;
+ *   const insideUVE = isRequestFromUVE(sp);
+ *   // ...decide whether to bail to notFound() or render the page shell
+ * }
+ * ```
+ */
+function isRequestFromUVE(searchParams) {
+  return Boolean(searchParams['dotCMSHost']);
+}
 /**
  * Creates a subscription to a UVE event.
  *
@@ -1513,6 +1543,11 @@ function createContentlet(contentType) {
  * - Client ready state
  * - UVE event subscriptions
  *
+ * @param {Partial<DotCMSPageResponse>} [config] - Sent as-is to the editor as the CLIENT_READY
+ * payload. Accepts a partial shape (e.g. just `{ graphql }`) for callers that don't yet have a
+ * full page response — a failed/draft page fetch, for instance — since this only ever forwards
+ * `config` to the editor and never reads any of its fields itself.
+ *
  * @returns {Object} An object containing the cleanup function
  * @returns {Function} destroyUVESubscriptions - Function to clean up all UVE event subscriptions
  *
@@ -1545,4 +1580,4 @@ function initUVE(config = {}) {
   };
 }
 
-export { ANALYTICS_ACTIVE_WINDOW_KEY as A, getAnalyticsContentletAttributes as B, CUSTOM_NO_COMPONENT as C, DEVELOPMENT_MODE as D, END_CLASS as E, isDotAnalyticsActive as F, getContainersData as G, getContentletsInContainer as H, getDotContainerAttributes as I, readContentletDataset as J, getNativeEventBinder as K, setBounds as L, isValidBlocks as M, PRODUCTION_MODE as P, START_CLASS as S, TEMP_EMPTY_CONTENTLET as T, __UVE_EVENTS__ as _, enableBlockEditorInline as a, createContentlet as b, createUVESubscription as c, initUVE as d, editContentlet as e, __UVE_EVENT_ERROR_FALLBACK__ as f, getUVEState as g, EMPTY_CONTAINER_STYLE_REACT as h, initInlineEditing as i, EMPTY_CONTAINER_STYLE_ANGULAR as j, DOT_SECTION_ID_PREFIX as k, ANALYTICS_READY_EVENT as l, TEMP_EMPTY_CONTENTLET_TYPE as m, getDotCMSPageBounds as n, getDotCMSContentletsBound as o, getDotCMSContainerData as p, getClosestDotCMSContainerData as q, reorderMenu as r, sendMessageToUVE as s, findDotCMSElement as t, updateNavigation as u, findDotCMSVTLData as v, computeScrollIsInBottom as w, combineClasses as x, getColumnPositionClasses as y, getDotContentletAttributes as z };
+export { ANALYTICS_ACTIVE_WINDOW_KEY as A, getDotContentletAttributes as B, CUSTOM_NO_COMPONENT as C, DEVELOPMENT_MODE as D, END_CLASS as E, getAnalyticsContentletAttributes as F, isDotAnalyticsActive as G, getContainersData as H, getContentletsInContainer as I, getDotContainerAttributes as J, readContentletDataset as K, getNativeEventBinder as L, setBounds as M, isValidBlocks as N, PRODUCTION_MODE as P, START_CLASS as S, TEMP_EMPTY_CONTENTLET as T, __UVE_EVENTS__ as _, initInlineEditing as a, enableBlockEditorInline as b, createUVESubscription as c, createContentlet as d, editContentlet as e, initUVE as f, getUVEState as g, __UVE_EVENT_ERROR_FALLBACK__ as h, isRequestFromUVE as i, EMPTY_CONTAINER_STYLE_REACT as j, EMPTY_CONTAINER_STYLE_ANGULAR as k, DOT_SECTION_ID_PREFIX as l, ANALYTICS_READY_EVENT as m, TEMP_EMPTY_CONTENTLET_TYPE as n, getDotCMSPageBounds as o, getDotCMSContentletsBound as p, getDotCMSContainerData as q, reorderMenu as r, sendMessageToUVE as s, getClosestDotCMSContainerData as t, updateNavigation as u, findDotCMSElement as v, findDotCMSVTLData as w, computeScrollIsInBottom as x, combineClasses as y, getColumnPositionClasses as z };

package/src/lib/core/core.utils.d.ts

@@ -28,6 +28,34 @@ import { UVEEventPayloadMap, UVEEventSubscription, UVEEventType, UVEState } from
  * ```
  */
 export declare function getUVEState(): UVEState | undefined;
+/**
+ * Detects whether a request's query parameters came through the UVE iframe - for server-only
+ * contexts (e.g. a Next.js Server Component fetching data before any client code runs) where
+ * `getUVEState()` can't be used, since it reads `window.location` and there is no `window` yet.
+ *
+ * UVE always appends `dotCMSHost` to the iframed URL, so its presence is the signal checked here.
+ *
+ * @remarks
+ * This is a heuristic based on a single query parameter, not a security boundary - it can be
+ * forced onto any URL. A forced/spoofed request only ever gets a blank/placeholder response
+ * instead of a real 404 or error page: the actual page content still only ever arrives through a
+ * genuine UVE editor `postMessage`, so nothing sensitive leaks. If a wrong HTTP status in that
+ * forced case matters for your use case (SEO, monitoring), validate the request further
+ * server-side (e.g. the `Sec-Fetch-Dest: iframe` header) before trusting this.
+ *
+ * @param searchParams - The request's query parameters, as a plain object (e.g. a Next.js
+ * Server Component's `searchParams` prop).
+ *
+ * @example
+ * ```ts
+ * export default async function Page({ searchParams }) {
+ *   const sp = await searchParams;
+ *   const insideUVE = isRequestFromUVE(sp);
+ *   // ...decide whether to bail to notFound() or render the page shell
+ * }
+ * ```
+ */
+export declare function isRequestFromUVE(searchParams: Record<string, string | string[] | undefined>): boolean;
 /**
  * Creates a subscription to a UVE event.
  *

package/src/lib/editor/public.d.ts

@@ -86,6 +86,11 @@ export declare function createContentlet(contentType: string): void;
  * - Client ready state
  * - UVE event subscriptions
  *
+ * @param {Partial<DotCMSPageResponse>} [config] - Sent as-is to the editor as the CLIENT_READY
+ * payload. Accepts a partial shape (e.g. just `{ graphql }`) for callers that don't yet have a
+ * full page response — a failed/draft page fetch, for instance — since this only ever forwards
+ * `config` to the editor and never reads any of its fields itself.
+ *
  * @returns {Object} An object containing the cleanup function
  * @returns {Function} destroyUVESubscriptions - Function to clean up all UVE event subscriptions
  *
@@ -97,6 +102,6 @@ export declare function createContentlet(contentType: string): void;
  * destroyUVESubscriptions();
  * ```
  */
-export declare function initUVE(config?: DotCMSPageResponse): {
+export declare function initUVE(config?: Partial<DotCMSPageResponse>): {
     destroyUVESubscriptions: () => void;
 };

package/src/script/utils.d.ts

@@ -44,7 +44,7 @@ export declare function registerUVEEvents(): {
  * This is typically called after all UVE event handlers and DOM listeners
  * have been set up successfully.
  */
-export declare function setClientIsReady(config?: DotCMSPageResponse): void;
+export declare function setClientIsReady(config?: Partial<DotCMSPageResponse>): void;
 /**
  * Listen for block editor inline event.
  */