@preprio/toolkit 0.2.0-beta.5 → 0.2.0-beta.7

package/dist/astro/index.cjs

@@ -30,7 +30,7 @@ __export(astro_exports, {
 module.exports = __toCommonJS(astro_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -193,6 +193,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -224,6 +229,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -233,25 +247,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -291,16 +308,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -313,7 +330,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/astro/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -162,6 +162,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -193,6 +198,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -202,25 +216,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -260,16 +277,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -282,7 +299,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/{chunk-BYJ2JBGX.js → chunk-P6VTLWM4.js}

@@ -644,6 +644,8 @@ function createStegaAutoClean() {
   function scanAndClean() {
     processing = true;
     walkTextNodes(document.body, cleanTextNode);
+    const title = vercelStegaSplit(document.title);
+    if (title.encoded) document.title = title.cleaned;
     processing = false;
   }
   function collectAffected(mutations) {
@@ -689,15 +691,8 @@ function createStegaAutoClean() {
   }
   function start() {
     if (observer || typeof window === "undefined") return;
-    const run = () => {
-      scanAndClean();
-      setupObserver();
-    };
-    if ("requestIdleCallback" in window) {
-      window.requestIdleCallback(run);
-    } else {
-      setTimeout(run, 0);
-    }
+    scanAndClean();
+    setupObserver();
     debug6.log("stega auto-clean started");
   }
   function stop() {
@@ -1909,7 +1904,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -1931,7 +1929,7 @@ function cookieOpts() {
   };
 }
 function createChangeHandler(deps) {
-  const { store, stega, syncAutoClean, features, editingEnabled } = deps;
+  const { store, stega, features, editingEnabled } = deps;
   function updateParams(patch) {
     const [path, existing] = splitPath(deps.currentPath());
     const params = new URLSearchParams(existing);
@@ -1994,16 +1992,17 @@ function createChangeHandler(deps) {
       setCookie(COOKIE_PREVIEW_MODE, String(after.previewMode), cookieOpts());
       setCookie(COOKIE_TOOLBAR_OPEN, "false", cookieOpts());
       sendPreprEvent("preview_mode_toggled", { previewMode: after.previewMode });
-      syncAutoClean(after.previewMode);
-      const [path, existing] = splitPath(deps.currentPath());
-      const params = new URLSearchParams(existing);
-      if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
-        params.delete(PARAM_SEGMENT);
-        params.delete(PARAM_VARIANT);
-        const query = params.toString();
-        deps.navigate(query ? `${path}?${query}` : path);
-      } else {
-        deps.reload();
+      if (!after.isIframe) {
+        const [path, existing] = splitPath(deps.currentPath());
+        const params = new URLSearchParams(existing);
+        if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
+          params.delete(PARAM_SEGMENT);
+          params.delete(PARAM_VARIANT);
+          const query = params.toString();
+          deps.navigate(query ? `${path}?${query}` : path);
+        } else {
+          deps.reload();
+        }
       }
     }
     if (before.toolbarOpen !== after.toolbarOpen) {
@@ -2026,6 +2025,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2089,24 +2096,25 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });
   const autoClean = createStegaAutoClean();
-  let autoCleanActive = false;
-  function syncAutoClean(active) {
-    if (active && !autoCleanActive) {
-      autoClean.start();
-      autoCleanActive = true;
-    } else if (!active && autoCleanActive) {
-      autoClean.stop();
-      autoCleanActive = false;
-    }
-  }
+  autoClean.start();
   const handleChange = createChangeHandler({
     store,
     features,
@@ -2114,8 +2122,7 @@ function createPreprPreview(opts = {}) {
     navigate: (url) => navigation.navigate(url),
     currentPath: () => navigation.currentPath(),
     reload: navigation.reload ?? (() => window.location.reload()),
-    stega,
-    syncAutoClean
+    stega
   });
   let prev = store.get();
   const unsubscribe = store.subscribe((state) => {
@@ -2123,7 +2130,6 @@ function createPreprPreview(opts = {}) {
     prev = state;
     handleChange(before, state);
   });
-  syncAutoClean(store.get().previewMode);
   const bridge = createIframeBridge(store, {
     allowedEditorOrigins: options?.allowedEditorOrigins
   });
@@ -2136,7 +2142,7 @@ function createPreprPreview(opts = {}) {
   function destroy() {
     unsubscribe();
     stega.stop();
-    syncAutoClean(false);
+    autoClean.stop();
     if (isIframe) {
       bridge.stop();
     }

package/dist/index.cjs

@@ -44,7 +44,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -355,7 +355,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -461,6 +464,8 @@ function createStegaAutoClean() {
   function scanAndClean() {
     processing = true;
     walkTextNodes(document.body, cleanTextNode);
+    const title = (0, import_stega2.vercelStegaSplit)(document.title);
+    if (title.encoded) document.title = title.cleaned;
     processing = false;
   }
   function collectAffected(mutations) {
@@ -506,15 +511,8 @@ function createStegaAutoClean() {
   }
   function start() {
     if (observer || typeof window === "undefined") return;
-    const run = () => {
-      scanAndClean();
-      setupObserver();
-    };
-    if ("requestIdleCallback" in window) {
-      window.requestIdleCallback(run);
-    } else {
-      setTimeout(run, 0);
-    }
+    scanAndClean();
+    setupObserver();
     debug2.log("stega auto-clean started");
   }
   function stop() {
@@ -1007,7 +1005,7 @@ function cookieOpts() {
   };
 }
 function createChangeHandler(deps) {
-  const { store, stega, syncAutoClean, features, editingEnabled } = deps;
+  const { store, stega, features, editingEnabled } = deps;
   function updateParams(patch) {
     const [path, existing] = splitPath(deps.currentPath());
     const params = new URLSearchParams(existing);
@@ -1070,16 +1068,17 @@ function createChangeHandler(deps) {
       setCookie(COOKIE_PREVIEW_MODE, String(after.previewMode), cookieOpts());
       setCookie(COOKIE_TOOLBAR_OPEN, "false", cookieOpts());
       sendPreprEvent("preview_mode_toggled", { previewMode: after.previewMode });
-      syncAutoClean(after.previewMode);
-      const [path, existing] = splitPath(deps.currentPath());
-      const params = new URLSearchParams(existing);
-      if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
-        params.delete(PARAM_SEGMENT);
-        params.delete(PARAM_VARIANT);
-        const query = params.toString();
-        deps.navigate(query ? `${path}?${query}` : path);
-      } else {
-        deps.reload();
+      if (!after.isIframe) {
+        const [path, existing] = splitPath(deps.currentPath());
+        const params = new URLSearchParams(existing);
+        if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
+          params.delete(PARAM_SEGMENT);
+          params.delete(PARAM_VARIANT);
+          const query = params.toString();
+          deps.navigate(query ? `${path}?${query}` : path);
+        } else {
+          deps.reload();
+        }
       }
     }
     if (before.toolbarOpen !== after.toolbarOpen) {
@@ -2074,6 +2073,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2137,24 +2144,25 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });
   const autoClean = createStegaAutoClean();
-  let autoCleanActive = false;
-  function syncAutoClean(active) {
-    if (active && !autoCleanActive) {
-      autoClean.start();
-      autoCleanActive = true;
-    } else if (!active && autoCleanActive) {
-      autoClean.stop();
-      autoCleanActive = false;
-    }
-  }
+  autoClean.start();
   const handleChange = createChangeHandler({
     store,
     features,
@@ -2162,8 +2170,7 @@ function createPreprPreview(opts = {}) {
     navigate: (url) => navigation.navigate(url),
     currentPath: () => navigation.currentPath(),
     reload: navigation.reload ?? (() => window.location.reload()),
-    stega,
-    syncAutoClean
+    stega
   });
   let prev = store.get();
   const unsubscribe = store.subscribe((state) => {
@@ -2171,7 +2178,6 @@ function createPreprPreview(opts = {}) {
     prev = state;
     handleChange(before, state);
   });
-  syncAutoClean(store.get().previewMode);
   const bridge = createIframeBridge(store, {
     allowedEditorOrigins: options?.allowedEditorOrigins
   });
@@ -2184,7 +2190,7 @@ function createPreprPreview(opts = {}) {
   function destroy() {
     unsubscribe();
     stega.stop();
-    syncAutoClean(false);
+    autoClean.stop();
     if (isIframe) {
       bridge.stop();
     }
@@ -2358,6 +2364,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -2375,6 +2386,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -2384,25 +2404,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -2442,16 +2465,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -2464,7 +2487,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/index.d.cts

@@ -5,7 +5,7 @@ export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j
  * Package version; must match package.json. Lives in its own leaf module so
  * core can import it without cycling through the barrel.
  */
-declare const VERSION = "0.2.0-beta.5";
+declare const VERSION = "0.2.0-beta.7";
 
 /**
  * Resolve a `PreprFeatures` bag to plain booleans, defaulting every omitted key

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j
  * Package version; must match package.json. Lives in its own leaf module so
  * core can import it without cycling through the barrel.
  */
-declare const VERSION = "0.2.0-beta.5";
+declare const VERSION = "0.2.0-beta.7";
 
 /**
  * Resolve a `PreprFeatures` bag to plain booleans, defaulting every omitted key