@druxt-contrib/node-preview 0.1.0-dev.20261030024907 → 0.1.0-dev.20261109195239

package/dist/index.esm.js

@@ -1,13 +1,263 @@
 import { resolve } from 'path';
+import { DruxtClient } from 'druxt';
+
+const PREFIX = "[druxt-node-preview] ";
+const TIMEOUT = 5e3;
+const HEARTBEAT = 6 * 60 * 60 * 1e3;
+const warn$1 = (message) => console.warn(PREFIX + message);
+const info = (message) => console.info(PREFIX + message);
+const fromEnv = (env, name) => (env[name] || "").trim() || void 0;
+const toBaseUrl = (value) => {
+  try {
+    const url = new URL(value);
+    return typeof value === "string" && ["http:", "https:"].includes(url.protocol) && !url.search && !url.hash ? (url.origin + url.pathname).replace(/\/+$/, "") : null;
+  } catch (e) {
+    return null;
+  }
+};
+const resolveBackend = (value, env) => {
+  const options = registerOptions(value);
+  const raw = options && rawBackend(options, env);
+  return raw ? toBaseUrl(raw) : null;
+};
+const registerOptions = (value) => {
+  if (value === true) return {};
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+};
+const rawBackend = (options, env) => fromEnv(env, "DRUXT_NODE_PREVIEW_REGISTER_BACKEND") || options.backend;
+const resolveRegister = (value, env) => {
+  if (value === void 0 || value === null || value === false) return null;
+  const options = registerOptions(value);
+  if (!options) {
+    warn$1("Ignored the register option. Use true or an object.");
+    return null;
+  }
+  if (options.secret !== void 0) {
+    warn$1(
+      "Ignored druxt.nodePreview.register.secret. Never put the secret in nuxt.config.js."
+    );
+  }
+  const url = toBaseUrl(fromEnv(env, "DRUXT_NODE_PREVIEW_URL") || options.url);
+  const consumer = fromEnv(env, "DRUXT_NODE_PREVIEW_CLIENT_ID") || options.consumer;
+  const setBackend = rawBackend(options, env);
+  const backend = setBackend ? toBaseUrl(setBackend) : null;
+  const secretName = setBackend ? "DRUXT_NODE_PREVIEW_REGISTER_SECRET" : "DRUXT_NODE_PREVIEW_CLIENT_SECRET";
+  const secret = fromEnv(env, secretName);
+  const envToken = fromEnv(env, "DRUXT_NODE_PREVIEW_REGISTER_TOKEN");
+  const rawToken = envToken !== void 0 ? envToken : options.token;
+  const token = rawToken === void 0 ? Boolean(backend) : (/* @__PURE__ */ new Map([
+    ["true", true],
+    ["1", true],
+    ["false", false],
+    ["0", false]
+  ])).get(String(rawToken));
+  const problems = [
+    !url && "DRUXT_NODE_PREVIEW_URL or register.url must be the frontend's full http(s) URL, with no query or fragment.",
+    (typeof consumer !== "string" || !/^[\x21-\x7e]+$/.test(consumer)) && "DRUXT_NODE_PREVIEW_CLIENT_ID or register.consumer must be the consumer's client ID.",
+    setBackend && !backend && "DRUXT_NODE_PREVIEW_REGISTER_BACKEND or register.backend must be the Drupal site's full http(s) URL.",
+    token === void 0 && "DRUXT_NODE_PREVIEW_REGISTER_TOKEN or register.token must be true or false.",
+    !secret && `${secretName} must be the consumer's secret, in the environment that runs Nuxt.`
+  ].filter(Boolean);
+  if (problems.length) {
+    warn$1(`Ignored the register option. ${problems.join(" ")}`);
+    return null;
+  }
+  const label = typeof options.label === "string" && options.label.trim() || new URL(url).host;
+  return {
+    url,
+    label,
+    consumer,
+    secret,
+    token,
+    ...backend ? { backend } : {}
+  };
+};
+const targetUrl = (url, path, layouts, token = false, backend = false) => url + path + "?vm=[view_mode]" + (layouts.length ? "&layout=[layout]" : "") + (backend ? "#[jsonapi_node_preview]" : "#[jsonapi_node_preview_path]") + (token ? ";token=[preview_token]" : "");
+const CREDENTIALS = "Check the secret, and that the consumer is confidential, allows the Client credentials grant, and has a Client credentials user.";
+const TOKEN_HINTS = {
+  400: CREDENTIALS,
+  401: CREDENTIALS,
+  404: "Install and set up the Simple OAuth module on Drupal."
+};
+const TARGET_HINTS = {
+  401: `The consumer's Client credentials user must own the consumer, and the token's scope must give the "register consumer node preview targets" permission.`,
+  403: `The consumer's Client credentials user must own the consumer, and the token's scope must give the "register consumer node preview targets" permission.`,
+  404: "Check that Consumer Node Preview is installed, and that a consumer has this client ID.",
+  405: "Update Consumer Node Preview. This module needs a version with the PATCH method.",
+  422: "Check the register url and the path option."
+};
+const reason = (data) => {
+  const text = [data == null ? void 0 : data.error_description, data == null ? void 0 : data.message, data == null ? void 0 : data.error].find(
+    (value) => typeof value === "string" && value.trim()
+  );
+  return text ? `: ${text.trim().slice(0, 300)}` : "";
+};
+const forBackend = (defaults, options) => {
+  const adapter = typeof defaults.adapter === "function" ? defaults.adapter : "http";
+  for (const name of Object.keys(defaults)) delete defaults[name];
+  Object.assign(defaults, {
+    ...options,
+    adapter,
+    headers: {},
+    transformRequest: [
+      (data) => data === void 0 || typeof data === "string" ? data : JSON.stringify(data)
+    ],
+    transformResponse: [
+      (data) => {
+        try {
+          return JSON.parse(data);
+        } catch (e) {
+          return data;
+        }
+      }
+    ]
+  });
+};
+const send = async (client, config, hints) => {
+  const { status, data, headers } = await client.axios.request({
+    ...config,
+    maxRedirects: 0,
+    validateStatus: () => true
+  });
+  if (status === 200) return data;
+  if (status >= 300 && status < 400) {
+    const location = (headers == null ? void 0 : headers.location) ? ` to ${headers.location}` : "";
+    throw new Error(
+      `Drupal redirected ${config.url}${location} (HTTP ${status}). Set druxt.baseUrl to the URL Drupal redirects to.`
+    );
+  }
+  throw new Error(
+    `${config.url} answered HTTP ${status}${reason(data)}. ${hints[status] || ""}`.trim()
+  );
+};
+const registerTarget = async ({
+  baseUrl,
+  backend,
+  token: useToken,
+  druxt = {},
+  url,
+  label,
+  consumer,
+  secret,
+  path,
+  layouts
+}) => {
+  let token;
+  try {
+    if (!backend && !baseUrl) throw new Error("druxt.baseUrl is not set.");
+    const base = (backend || baseUrl).replace(/\/+$/, "");
+    const { protocol, hostname } = new URL(base);
+    if (protocol === "http:" && !/^(localhost|127\.\d+\.\d+\.\d+|\[::1\])$|\.localhost$/.test(hostname)) {
+      warn$1(
+        `${backend ? "The register backend" : "druxt.baseUrl"} uses plain HTTP, so the secret and the token cross the network unencrypted. Use https.`
+      );
+    }
+    const { timeout = TIMEOUT, proxy } = druxt.axios || {};
+    const client = new DruxtClient(base, {
+      ...druxt,
+      axios: backend ? { timeout } : { timeout: TIMEOUT, ...druxt.axios }
+    });
+    if (backend) {
+      forBackend(client.axios.defaults, {
+        timeout,
+        ...proxy === void 0 ? {} : { proxy }
+      });
+    }
+    const answer = await send(
+      client,
+      {
+        method: "POST",
+        url: `${base}/oauth/token`,
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        data: new URLSearchParams({
+          grant_type: "client_credentials",
+          client_id: consumer,
+          client_secret: secret
+        }).toString()
+      },
+      TOKEN_HINTS
+    );
+    token = answer == null ? void 0 : answer.access_token;
+    if (!token) throw new Error(`${base}/oauth/token gave no access token.`);
+    await send(
+      client,
+      {
+        method: "PATCH",
+        url: `${base}/api/consumer-node-preview/targets`,
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+          "X-Consumer-ID": consumer
+        },
+        // Without layouts, Drupal keeps the consumer's own.
+        data: {
+          target: {
+            label,
+            url: targetUrl(
+              url,
+              path,
+              layouts,
+              Boolean(useToken),
+              Boolean(backend)
+            )
+          },
+          ...layouts.length ? { layouts: [...new Set(layouts)] } : {}
+        }
+      },
+      TARGET_HINTS
+    );
+    info(`Registered the preview target "${label}" on "${consumer}".`);
+    return "registered";
+  } catch (error) {
+    const message = [secret, token].filter(Boolean).reduce(
+      (text, value) => text.split(value).join("[hidden]"),
+      error.message
+    );
+    warn$1(`Could not register the preview target: ${message}`);
+    return "failed";
+  }
+};
+const registerOnce = (run) => {
+  var _a, _b;
+  const key = /* @__PURE__ */ Symbol.for("druxt-node-preview.register");
+  if (!process[key]) {
+    process[key] = run();
+    (_b = (_a = setInterval(run, HEARTBEAT)).unref) == null ? void 0 : _b.call(_a);
+  }
+  return process[key];
+};
 
 const toOrigin = (url) => {
   try {
-    const { origin, protocol } = new URL(url);
-    return ["http:", "https:"].includes(protocol) ? origin : null;
+    const { origin, protocol, hostname } = new URL(url);
+    const plain = /^([a-z0-9_-]+\.)*[a-z0-9_-]+\.?$|^\[[0-9a-f:.]+\]$/;
+    return ["http:", "https:"].includes(protocol) && plain.test(hostname) ? origin : null;
   } catch (e) {
     return null;
   }
 };
+const forLog = (url) => {
+  try {
+    const { protocol, host } = new URL(url);
+    return protocol + "//" + host;
+  } catch (e) {
+    return String(url).replace(/^[^/]*@/, "");
+  }
+};
+const originProblem = (url) => {
+  try {
+    const { hostname, protocol } = new URL(url);
+    if (["http:", "https:"].includes(protocol)) {
+      return `Its host, "${hostname}", may only have letters, digits, dots, hyphens and _, or be an IPv6 address in brackets.`;
+    }
+  } catch (e) {
+  }
+  return 'Use a full http(s) URL, such as "https://cms.example.com".';
+};
 const warn = (message) => console.warn("[druxt-node-preview] " + message);
 const toInclude = (value) => {
   const paths = (list, where) => {
@@ -80,6 +330,8 @@ const NuxtModule = function(moduleOptions = {}) {
       component: resolveRoute(this.options.buildDir, dst)
     });
   });
+  const register = resolveRegister(options.register, process.env);
+  const backend = resolveBackend(options.register, process.env);
   if (!Array.isArray(options.origins)) {
     warn(
       "Ignored the origins option. Use a list of full http(s) URLs, such as ['https://cms.example.com']."
@@ -88,25 +340,48 @@ const NuxtModule = function(moduleOptions = {}) {
   const listed = (Array.isArray(options.origins) ? options.origins : []).filter(
     (url) => {
       if (toOrigin(url)) return true;
-      warn(
-        `Ignored the origin "${url}". Use a full http(s) URL, such as "https://cms.example.com".`
-      );
+      warn(`Ignored the origin "${forLog(url)}". ${originProblem(url)}`);
       return false;
     }
   );
   const pluginOptions = {
     include: toInclude(options.include),
     origins: [],
+    // Druxt's Drupal origin. The page fetches from any other origin without
+    // the Druxt client, whose options are for druxt.baseUrl.
+    drupal: null,
     layouts: toLayouts(options.layouts)
   };
+  let reported;
   const setOrigins = () => {
     const baseUrl = ((this.options || {}).druxt || {}).baseUrl;
+    pluginOptions.drupal = toOrigin(baseUrl);
+    if (baseUrl && !pluginOptions.drupal && reported !== baseUrl) {
+      reported = baseUrl;
+      warn(
+        `Ignored druxt.baseUrl "${forLog(baseUrl)}" for previews. ${originProblem(baseUrl)}`
+      );
+    }
     pluginOptions.origins = [
-      ...new Set([baseUrl, ...listed].map(toOrigin).filter(Boolean))
+      ...new Set([baseUrl, backend, ...listed].map(toOrigin).filter(Boolean))
     ];
   };
   setOrigins();
   if (this.nuxt) this.nuxt.hook("modules:done", setOrigins);
+  if (register && this.nuxt) {
+    this.nuxt.hook(
+      "ready",
+      () => registerOnce(
+        () => registerTarget({
+          ...register,
+          druxt: (this.options || {}).druxt || {},
+          baseUrl: ((this.options || {}).druxt || {}).baseUrl,
+          path: options.path,
+          layouts: pluginOptions.layouts
+        })
+      )
+    );
+  }
   this.addPlugin({
     src: resolve(__dirname, "../templates/plugin.js"),
     fileName: "druxt-node-preview.js",

package/dist/index.ssr.js

@@ -1,15 +1,265 @@
 'use strict';
 
 const path = require('path');
+const druxt = require('druxt');
+
+const PREFIX = "[druxt-node-preview] ";
+const TIMEOUT = 5e3;
+const HEARTBEAT = 6 * 60 * 60 * 1e3;
+const warn$1 = (message) => console.warn(PREFIX + message);
+const info = (message) => console.info(PREFIX + message);
+const fromEnv = (env, name) => (env[name] || "").trim() || void 0;
+const toBaseUrl = (value) => {
+  try {
+    const url = new URL(value);
+    return typeof value === "string" && ["http:", "https:"].includes(url.protocol) && !url.search && !url.hash ? (url.origin + url.pathname).replace(/\/+$/, "") : null;
+  } catch (e) {
+    return null;
+  }
+};
+const resolveBackend = (value, env) => {
+  const options = registerOptions(value);
+  const raw = options && rawBackend(options, env);
+  return raw ? toBaseUrl(raw) : null;
+};
+const registerOptions = (value) => {
+  if (value === true) return {};
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+};
+const rawBackend = (options, env) => fromEnv(env, "DRUXT_NODE_PREVIEW_REGISTER_BACKEND") || options.backend;
+const resolveRegister = (value, env) => {
+  if (value === void 0 || value === null || value === false) return null;
+  const options = registerOptions(value);
+  if (!options) {
+    warn$1("Ignored the register option. Use true or an object.");
+    return null;
+  }
+  if (options.secret !== void 0) {
+    warn$1(
+      "Ignored druxt.nodePreview.register.secret. Never put the secret in nuxt.config.js."
+    );
+  }
+  const url = toBaseUrl(fromEnv(env, "DRUXT_NODE_PREVIEW_URL") || options.url);
+  const consumer = fromEnv(env, "DRUXT_NODE_PREVIEW_CLIENT_ID") || options.consumer;
+  const setBackend = rawBackend(options, env);
+  const backend = setBackend ? toBaseUrl(setBackend) : null;
+  const secretName = setBackend ? "DRUXT_NODE_PREVIEW_REGISTER_SECRET" : "DRUXT_NODE_PREVIEW_CLIENT_SECRET";
+  const secret = fromEnv(env, secretName);
+  const envToken = fromEnv(env, "DRUXT_NODE_PREVIEW_REGISTER_TOKEN");
+  const rawToken = envToken !== void 0 ? envToken : options.token;
+  const token = rawToken === void 0 ? Boolean(backend) : (/* @__PURE__ */ new Map([
+    ["true", true],
+    ["1", true],
+    ["false", false],
+    ["0", false]
+  ])).get(String(rawToken));
+  const problems = [
+    !url && "DRUXT_NODE_PREVIEW_URL or register.url must be the frontend's full http(s) URL, with no query or fragment.",
+    (typeof consumer !== "string" || !/^[\x21-\x7e]+$/.test(consumer)) && "DRUXT_NODE_PREVIEW_CLIENT_ID or register.consumer must be the consumer's client ID.",
+    setBackend && !backend && "DRUXT_NODE_PREVIEW_REGISTER_BACKEND or register.backend must be the Drupal site's full http(s) URL.",
+    token === void 0 && "DRUXT_NODE_PREVIEW_REGISTER_TOKEN or register.token must be true or false.",
+    !secret && `${secretName} must be the consumer's secret, in the environment that runs Nuxt.`
+  ].filter(Boolean);
+  if (problems.length) {
+    warn$1(`Ignored the register option. ${problems.join(" ")}`);
+    return null;
+  }
+  const label = typeof options.label === "string" && options.label.trim() || new URL(url).host;
+  return {
+    url,
+    label,
+    consumer,
+    secret,
+    token,
+    ...backend ? { backend } : {}
+  };
+};
+const targetUrl = (url, path, layouts, token = false, backend = false) => url + path + "?vm=[view_mode]" + (layouts.length ? "&layout=[layout]" : "") + (backend ? "#[jsonapi_node_preview]" : "#[jsonapi_node_preview_path]") + (token ? ";token=[preview_token]" : "");
+const CREDENTIALS = "Check the secret, and that the consumer is confidential, allows the Client credentials grant, and has a Client credentials user.";
+const TOKEN_HINTS = {
+  400: CREDENTIALS,
+  401: CREDENTIALS,
+  404: "Install and set up the Simple OAuth module on Drupal."
+};
+const TARGET_HINTS = {
+  401: `The consumer's Client credentials user must own the consumer, and the token's scope must give the "register consumer node preview targets" permission.`,
+  403: `The consumer's Client credentials user must own the consumer, and the token's scope must give the "register consumer node preview targets" permission.`,
+  404: "Check that Consumer Node Preview is installed, and that a consumer has this client ID.",
+  405: "Update Consumer Node Preview. This module needs a version with the PATCH method.",
+  422: "Check the register url and the path option."
+};
+const reason = (data) => {
+  const text = [data == null ? void 0 : data.error_description, data == null ? void 0 : data.message, data == null ? void 0 : data.error].find(
+    (value) => typeof value === "string" && value.trim()
+  );
+  return text ? `: ${text.trim().slice(0, 300)}` : "";
+};
+const forBackend = (defaults, options) => {
+  const adapter = typeof defaults.adapter === "function" ? defaults.adapter : "http";
+  for (const name of Object.keys(defaults)) delete defaults[name];
+  Object.assign(defaults, {
+    ...options,
+    adapter,
+    headers: {},
+    transformRequest: [
+      (data) => data === void 0 || typeof data === "string" ? data : JSON.stringify(data)
+    ],
+    transformResponse: [
+      (data) => {
+        try {
+          return JSON.parse(data);
+        } catch (e) {
+          return data;
+        }
+      }
+    ]
+  });
+};
+const send = async (client, config, hints) => {
+  const { status, data, headers } = await client.axios.request({
+    ...config,
+    maxRedirects: 0,
+    validateStatus: () => true
+  });
+  if (status === 200) return data;
+  if (status >= 300 && status < 400) {
+    const location = (headers == null ? void 0 : headers.location) ? ` to ${headers.location}` : "";
+    throw new Error(
+      `Drupal redirected ${config.url}${location} (HTTP ${status}). Set druxt.baseUrl to the URL Drupal redirects to.`
+    );
+  }
+  throw new Error(
+    `${config.url} answered HTTP ${status}${reason(data)}. ${hints[status] || ""}`.trim()
+  );
+};
+const registerTarget = async ({
+  baseUrl,
+  backend,
+  token: useToken,
+  druxt: druxt$1 = {},
+  url,
+  label,
+  consumer,
+  secret,
+  path,
+  layouts
+}) => {
+  let token;
+  try {
+    if (!backend && !baseUrl) throw new Error("druxt.baseUrl is not set.");
+    const base = (backend || baseUrl).replace(/\/+$/, "");
+    const { protocol, hostname } = new URL(base);
+    if (protocol === "http:" && !/^(localhost|127\.\d+\.\d+\.\d+|\[::1\])$|\.localhost$/.test(hostname)) {
+      warn$1(
+        `${backend ? "The register backend" : "druxt.baseUrl"} uses plain HTTP, so the secret and the token cross the network unencrypted. Use https.`
+      );
+    }
+    const { timeout = TIMEOUT, proxy } = druxt$1.axios || {};
+    const client = new druxt.DruxtClient(base, {
+      ...druxt$1,
+      axios: backend ? { timeout } : { timeout: TIMEOUT, ...druxt$1.axios }
+    });
+    if (backend) {
+      forBackend(client.axios.defaults, {
+        timeout,
+        ...proxy === void 0 ? {} : { proxy }
+      });
+    }
+    const answer = await send(
+      client,
+      {
+        method: "POST",
+        url: `${base}/oauth/token`,
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        data: new URLSearchParams({
+          grant_type: "client_credentials",
+          client_id: consumer,
+          client_secret: secret
+        }).toString()
+      },
+      TOKEN_HINTS
+    );
+    token = answer == null ? void 0 : answer.access_token;
+    if (!token) throw new Error(`${base}/oauth/token gave no access token.`);
+    await send(
+      client,
+      {
+        method: "PATCH",
+        url: `${base}/api/consumer-node-preview/targets`,
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+          "X-Consumer-ID": consumer
+        },
+        // Without layouts, Drupal keeps the consumer's own.
+        data: {
+          target: {
+            label,
+            url: targetUrl(
+              url,
+              path,
+              layouts,
+              Boolean(useToken),
+              Boolean(backend)
+            )
+          },
+          ...layouts.length ? { layouts: [...new Set(layouts)] } : {}
+        }
+      },
+      TARGET_HINTS
+    );
+    info(`Registered the preview target "${label}" on "${consumer}".`);
+    return "registered";
+  } catch (error) {
+    const message = [secret, token].filter(Boolean).reduce(
+      (text, value) => text.split(value).join("[hidden]"),
+      error.message
+    );
+    warn$1(`Could not register the preview target: ${message}`);
+    return "failed";
+  }
+};
+const registerOnce = (run) => {
+  var _a, _b;
+  const key = /* @__PURE__ */ Symbol.for("druxt-node-preview.register");
+  if (!process[key]) {
+    process[key] = run();
+    (_b = (_a = setInterval(run, HEARTBEAT)).unref) == null ? void 0 : _b.call(_a);
+  }
+  return process[key];
+};
 
 const toOrigin = (url) => {
   try {
-    const { origin, protocol } = new URL(url);
-    return ["http:", "https:"].includes(protocol) ? origin : null;
+    const { origin, protocol, hostname } = new URL(url);
+    const plain = /^([a-z0-9_-]+\.)*[a-z0-9_-]+\.?$|^\[[0-9a-f:.]+\]$/;
+    return ["http:", "https:"].includes(protocol) && plain.test(hostname) ? origin : null;
   } catch (e) {
     return null;
   }
 };
+const forLog = (url) => {
+  try {
+    const { protocol, host } = new URL(url);
+    return protocol + "//" + host;
+  } catch (e) {
+    return String(url).replace(/^[^/]*@/, "");
+  }
+};
+const originProblem = (url) => {
+  try {
+    const { hostname, protocol } = new URL(url);
+    if (["http:", "https:"].includes(protocol)) {
+      return `Its host, "${hostname}", may only have letters, digits, dots, hyphens and _, or be an IPv6 address in brackets.`;
+    }
+  } catch (e) {
+  }
+  return 'Use a full http(s) URL, such as "https://cms.example.com".';
+};
 const warn = (message) => console.warn("[druxt-node-preview] " + message);
 const toInclude = (value) => {
   const paths = (list, where) => {
@@ -82,6 +332,8 @@ const NuxtModule = function(moduleOptions = {}) {
       component: resolveRoute(this.options.buildDir, dst)
     });
   });
+  const register = resolveRegister(options.register, process.env);
+  const backend = resolveBackend(options.register, process.env);
   if (!Array.isArray(options.origins)) {
     warn(
       "Ignored the origins option. Use a list of full http(s) URLs, such as ['https://cms.example.com']."
@@ -90,25 +342,48 @@ const NuxtModule = function(moduleOptions = {}) {
   const listed = (Array.isArray(options.origins) ? options.origins : []).filter(
     (url) => {
       if (toOrigin(url)) return true;
-      warn(
-        `Ignored the origin "${url}". Use a full http(s) URL, such as "https://cms.example.com".`
-      );
+      warn(`Ignored the origin "${forLog(url)}". ${originProblem(url)}`);
       return false;
     }
   );
   const pluginOptions = {
     include: toInclude(options.include),
     origins: [],
+    // Druxt's Drupal origin. The page fetches from any other origin without
+    // the Druxt client, whose options are for druxt.baseUrl.
+    drupal: null,
     layouts: toLayouts(options.layouts)
   };
+  let reported;
   const setOrigins = () => {
     const baseUrl = ((this.options || {}).druxt || {}).baseUrl;
+    pluginOptions.drupal = toOrigin(baseUrl);
+    if (baseUrl && !pluginOptions.drupal && reported !== baseUrl) {
+      reported = baseUrl;
+      warn(
+        `Ignored druxt.baseUrl "${forLog(baseUrl)}" for previews. ${originProblem(baseUrl)}`
+      );
+    }
     pluginOptions.origins = [
-      ...new Set([baseUrl, ...listed].map(toOrigin).filter(Boolean))
+      ...new Set([baseUrl, backend, ...listed].map(toOrigin).filter(Boolean))
     ];
   };
   setOrigins();
   if (this.nuxt) this.nuxt.hook("modules:done", setOrigins);
+  if (register && this.nuxt) {
+    this.nuxt.hook(
+      "ready",
+      () => registerOnce(
+        () => registerTarget({
+          ...register,
+          druxt: (this.options || {}).druxt || {},
+          baseUrl: ((this.options || {}).druxt || {}).baseUrl,
+          path: options.path,
+          layouts: pluginOptions.layouts
+        })
+      )
+    );
+  }
   this.addPlugin({
     src: path.resolve(__dirname, "../templates/plugin.js"),
     fileName: "druxt-node-preview.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@druxt-contrib/node-preview",
-  "version": "0.1.0-dev.20261030024907",
+  "version": "0.1.0-dev.20261109195239",
   "description": "Renders Drupal node previews in a Druxt frontend, fed by JSON:API Node Preview and Consumer Node Preview.",
   "keywords": [
     "decoupled",
@@ -47,10 +47,11 @@
     "lint:knip": "knip --include dependencies,unlisted --no-config-hints",
     "lint:md": "markdownlint-cli2 \"**/*.md\"",
     "lint:private": "node scripts/lint-private-refs.mjs",
-    "lint:prose": "PROSE_LINT_GLOB='!{.changeset,example/drupal}/**' bash .gitlab/scripts/lint-prose.sh --all",
+    "lint:prose": "PROSE_LINT_GLOB='!{.changeset/**,example/drupal/**,CHANGELOG.md}' bash .gitlab/scripts/lint-prose.sh --all",
     "lint:prose:install": "bash .gitlab/scripts/install-vale.sh .vale/bin .vale/styles",
     "prepack": "npm run build",
     "prepare": "node scripts/postinstall.mjs",
+    "release:version": "changeset version && npm install --package-lock-only --ignore-scripts --no-audit --no-fund",
     "test": "jest",
     "test:e2e": "playwright test",
     "test:e2e:stack": "test/e2e/run.sh",
@@ -63,6 +64,7 @@
     "@commitlint/cli": "17.8.1",
     "@commitlint/config-conventional": "17.8.1",
     "@playwright/test": "^1.49.0",
+    "axios": "^1.21.0",
     "babel-core": "7.0.0-bridge.0",
     "cspell": "7.3.9",
     "druxt": "0.25.0",