@preprio/toolkit 0.5.0-rc.1 → 0.6.0-alpha.0

package/dist/nextjs/index.js

@@ -1,9 +1,20 @@
+import {
+  PreprError,
+  VERSION,
+  extractAccessToken,
+  getActiveSegment,
+  getActiveVariant,
+  getPreprHeaders,
+  getPreprUUID,
+  getToolbarProps,
+  isPersonalizedResponse,
+  resolveFeatures,
+  validatePreprToken
+} from "./chunk-U4HXENF7.js";
+
 // src/nextjs/middleware.ts
 import { NextResponse } from "next/server";
 
-// src/version.ts
-var VERSION = "0.5.0-rc.1";
-
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
 var COOKIE_SEGMENT = "Prepr-Segments";
@@ -15,24 +26,6 @@ var PARAM_VARIANT = "prepr_preview_ab";
 var PARAM_HIDE_BAR = "prepr_hide_bar";
 var ONE_YEAR_SECONDS = 60 * 60 * 24 * 365;
 
-// src/core/features.ts
-function isEnabled(config) {
-  if (typeof config === "boolean") return config;
-  return config?.enabled ?? true;
-}
-function resolveFeatures(features) {
-  return {
-    segments: isEnabled(features?.segments),
-    abTesting: isEnabled(features?.abTesting),
-    editMode: isEnabled(features?.editMode)
-  };
-}
-var ALL_FEATURES_ENABLED = Object.freeze({
-  segments: true,
-  abTesting: true,
-  editMode: true
-});
-
 // src/core/middleware.ts
 var UTM_PARAMS = [
   "utm_source",
@@ -47,9 +40,9 @@ function sanitizeHeaderValue(value) {
   return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
 }
 function parseCookies(request) {
-  const cookies = /* @__PURE__ */ new Map();
+  const cookies2 = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
-  if (!header) return cookies;
+  if (!header) return cookies2;
   for (const part of header.split(";")) {
     const eq = part.indexOf("=");
     if (eq === -1) continue;
@@ -57,12 +50,12 @@ function parseCookies(request) {
     const value = part.slice(eq + 1).trim();
     if (!name) continue;
     try {
-      cookies.set(name, decodeURIComponent(value));
+      cookies2.set(name, decodeURIComponent(value));
     } catch {
-      cookies.set(name, value);
+      cookies2.set(name, value);
     }
   }
-  return cookies;
+  return cookies2;
 }
 function processFrameworkRequest(request, opts, framework) {
   const requestHeaders = new Headers(request.headers);
@@ -182,6 +175,10 @@ function processFrameworkRequest(request, opts, framework) {
       });
     }
   }
+  if (requestHeaders.has("Prepr-Segments")) {
+    requestHeaders.delete("Prepr-Customer-Id");
+    requestHeaders.delete("Prepr-Customer-Id-Created");
+  }
   return { requestHeaders, responseCookies };
 }
 
@@ -226,195 +223,103 @@ function createPreprMiddleware(request, responseOrOptions, maybeOptions) {
   return response;
 }
 
-// src/nextjs/server.ts
-import { headers } from "next/headers";
-
-// src/core/server.ts
-var PreprError = class extends Error {
-  constructor(message, code, context, originalError) {
-    super(message);
-    this.code = code;
-    this.context = context;
-    this.originalError = originalError;
-    this.name = "PreprError";
-  }
-};
-function getPreprUUIDFromHeaders(headers2) {
-  return headers2.get("prepr-customer-id");
-}
-function getActiveSegmentFromHeaders(headers2) {
-  return headers2.get("Prepr-Segments");
-}
-function getActiveVariantFromHeaders(headers2) {
-  return headers2.get("Prepr-ABtesting");
-}
-var PREPR_HEADER_KEYS = [
-  "prepr-customer-id",
-  "Prepr-Segments",
-  "Prepr-ABtesting",
-  "Prepr-Preview-Bar",
-  "Prepr-Context-utm_source",
-  "Prepr-Context-utm_medium",
-  "Prepr-Context-utm_term",
-  "Prepr-Context-utm_content",
-  "Prepr-Context-utm_campaign",
-  "Prepr-Context-initial_referral",
-  "Prepr-Visitor-IP",
-  "Prepr-Hubspot-Id",
-  "Prepr-Customer-Id-Created",
-  "User-Agent",
-  "Prepr-Package"
-];
-function getPreprHeadersFromHeaders(headers2) {
-  const preprHeaders = {};
-  const copy = (key) => {
-    const value = headers2.get(key);
-    if (value !== null) {
-      preprHeaders[key] = value;
-    }
-  };
-  for (const key of PREPR_HEADER_KEYS) {
-    copy(key);
-  }
-  return preprHeaders;
-}
-function validatePreprToken(token) {
-  if (!token) {
-    throw new PreprError(
-      "Token is required",
-      "MISSING_TOKEN",
-      "validatePreprToken"
-    );
-  }
-  if (!token.startsWith("https://")) {
-    throw new PreprError(
-      "Token must be a valid HTTPS URL",
-      "INVALID_TOKEN",
-      "validatePreprToken"
-    );
-  }
+// src/nextjs/bucket.ts
+var PREPR_BUCKET_COOKIE = "prepr_ab_bucket";
+var isBucket = (value) => value === "A" || value === "B";
+function setBucketCookie(request, response, bucket) {
+  response.cookies.set(PREPR_BUCKET_COOKIE, bucket, {
+    path: "/",
+    sameSite: "lax",
+    // Readable on purpose: PreprStack's inline switch reads it before first
+    // paint. It holds only "A" or "B".
+    httpOnly: false,
+    secure: request.nextUrl.protocol === "https:",
+    maxAge: 60 * 60 * 24 * 365
+  });
 }
-function extractAccessToken(graphqlUrl) {
-  let url;
-  try {
-    url = new URL(graphqlUrl);
-  } catch (error) {
-    throw new PreprError(
-      "Token must be a valid URL",
-      "INVALID_TOKEN",
-      "extractAccessToken",
-      error instanceof Error ? error : new Error(String(error))
-    );
-  }
-  if (url.hostname !== "graphql.prepr.io") {
-    throw new PreprError(
-      "Token must be a graphql.prepr.io URL",
-      "INVALID_TOKEN",
-      "extractAccessToken"
-    );
+async function resolvePreprBucket(request, response, options) {
+  const stored = request.cookies.get(PREPR_BUCKET_COOKIE)?.value;
+  const forced = response.headers.get("x-middleware-request-prepr-abtesting") ?? request.cookies.get(COOKIE_VARIANT)?.value;
+  if (options.preview && isBucket(forced)) {
+    if (forced !== stored) setBucketCookie(request, response, forced);
+    return forced;
   }
-  const pathParts = url.pathname.split("/");
-  const token = pathParts[pathParts.length - 1];
-  if (!token) {
-    throw new PreprError(
-      "Token URL is missing an access token segment",
-      "INVALID_TOKEN",
-      "extractAccessToken"
-    );
+  if (isBucket(stored)) return stored;
+  if (options.onlyIf) {
+    const needed = await Promise.resolve().then(options.onlyIf).catch(() => true);
+    if (!needed) return "A";
   }
-  return token;
-}
-async function getPreprEnvironmentSegments(token) {
-  validatePreprToken(token);
+  const customerId = request.cookies.get(COOKIE_UID)?.value ?? response.cookies.get(COOKIE_UID)?.value;
+  if (!customerId) return "A";
   try {
-    const response = await fetch(token, {
+    const res = await fetch(options.url, {
+      method: "POST",
       headers: {
-        "Prepr-Package": `@preprio/toolkit@${VERSION}`,
-        // Duplicates the version in Prepr-Package. It keeps the User-Agent
-        // format used by `@preprio/prepr-nextjs`, for Prepr API consumers that
-        // still identify the toolbar by that string.
-        "User-Agent": `Prepr-Preview-Bar/${VERSION}`,
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        "Prepr-Customer-Id": customerId
       },
-      method: "POST",
-      body: JSON.stringify({
-        query: `{
-                _Segments {
-                    _id
-                    name
-                }
-            }`
-      })
+      body: JSON.stringify({ query: "{ __typename }" }),
+      cache: "no-store",
+      signal: AbortSignal.timeout(options.timeoutMs ?? 1500)
     });
-    if (!response.ok) {
-      throw new PreprError(
-        `HTTP ${response.status}: ${response.statusText}`,
-        "HTTP_ERROR",
-        "getPreprEnvironmentSegments"
-      );
-    }
-    const json = await response.json();
-    if (!json || !json.data || !json.data._Segments) {
-      throw new PreprError(
-        "Invalid response format from Prepr API",
-        "INVALID_RESPONSE",
-        "getPreprEnvironmentSegments"
-      );
-    }
-    return json.data._Segments;
-  } catch (error) {
-    if (error instanceof PreprError) {
-      throw error;
+    const bucket = res.headers.get("x-prepr-customer-bucket");
+    if (isBucket(bucket)) {
+      setBucketCookie(request, response, bucket);
+      return bucket;
     }
-    throw new PreprError(
-      "Failed to fetch segments from Prepr API",
-      "FETCH_ERROR",
-      "getPreprEnvironmentSegments",
-      error instanceof Error ? error : new Error(String(error))
-    );
+  } catch {
   }
-}
-async function getToolbarPropsFromHeaders(headers2, token, features) {
-  const resolved = resolveFeatures(features);
-  let segments = [];
-  if (resolved.segments) {
-    try {
-      segments = await getPreprEnvironmentSegments(token);
-    } catch {
-      segments = [];
-    }
-  }
-  return {
-    activeSegment: resolved.segments ? getActiveSegmentFromHeaders(headers2) : null,
-    activeVariant: resolved.abTesting ? getActiveVariantFromHeaders(headers2) : null,
-    segments,
-    data: segments
-  };
+  return "A";
 }
 
-// src/nextjs/server.ts
-async function readHeaders() {
-  return await headers();
-}
-async function getPreprUUID() {
-  const h = await readHeaders();
-  return getPreprUUIDFromHeaders(h);
-}
-async function getActiveSegment() {
-  const h = await readHeaders();
-  return getActiveSegmentFromHeaders(h);
-}
-async function getActiveVariant() {
-  const h = await readHeaders();
-  return getActiveVariantFromHeaders(h);
-}
-async function getPreprHeaders() {
-  const h = await readHeaders();
-  return getPreprHeadersFromHeaders(h);
+// src/nextjs/draft.ts
+import { cookies, draftMode } from "next/headers";
+import { redirect } from "next/navigation";
+import { NextResponse as NextResponse2 } from "next/server";
+var DRAFT_COOKIE = "__prerender_bypass";
+var RETURN_PARAM = "prepr_draft";
+var DEFAULT_ROUTE = "/api/prepr/draft";
+function preprDraftRedirect(request, options) {
+  if (!options.preview) return null;
+  if (request.method !== "GET" && request.method !== "HEAD") return null;
+  const url = request.nextUrl;
+  if (url.pathname === (options.route ?? DEFAULT_ROUTE)) return null;
+  if (request.cookies.has(DRAFT_COOKIE)) {
+    if (!url.searchParams.has(RETURN_PARAM)) return null;
+    const clean = url.clone();
+    clean.searchParams.delete(RETURN_PARAM);
+    return NextResponse2.redirect(clean, 307);
+  }
+  if (url.searchParams.has(RETURN_PARAM)) return null;
+  const target = new URL(options.route ?? DEFAULT_ROUTE, request.url);
+  target.searchParams.set("to", url.pathname + url.search);
+  return NextResponse2.redirect(target, 307);
 }
-async function getToolbarProps(token, features) {
-  const h = await readHeaders();
-  return getToolbarPropsFromHeaders(h, token, features);
+function createPreprDraftRoute(options) {
+  return async (request) => {
+    if (!options.preview) return new Response("Not found", { status: 404 });
+    (await draftMode()).enable();
+    const self = new URL(request.url);
+    if (self.protocol === "https:") {
+      const jar = await cookies();
+      const draft = jar.get(DRAFT_COOKIE);
+      if (draft) {
+        jar.set({
+          name: DRAFT_COOKIE,
+          value: draft.value,
+          path: "/",
+          httpOnly: true,
+          secure: true,
+          sameSite: "none",
+          partitioned: true
+        });
+      }
+    }
+    let to = new URL(self.searchParams.get("to") ?? "/", self);
+    if (to.origin !== self.origin) to = new URL("/", self);
+    to.searchParams.set(RETURN_PARAM, "1");
+    redirect(to.pathname + to.search);
+  };
 }
 
 // src/nextjs/index.ts
@@ -423,9 +328,11 @@ import {
   PreprTrackingPixel
 } from "./components.js";
 export {
+  PREPR_BUCKET_COOKIE,
   PreprError,
   PreprToolbar,
   PreprTrackingPixel,
+  createPreprDraftRoute,
   createPreprMiddleware,
   extractAccessToken,
   getActiveSegment,
@@ -433,5 +340,8 @@ export {
   getPreprHeaders,
   getPreprUUID,
   getToolbarProps,
+  isPersonalizedResponse,
+  preprDraftRedirect,
+  resolvePreprBucket,
   validatePreprToken
 };

package/dist/nextjs/server-CjpELYvq.d.cts

@@ -0,0 +1,156 @@
+type Dictionary = Record<string, unknown>;
+declare const dictionaries: {
+    en: Dictionary;
+    nl: Dictionary;
+};
+type Locale = keyof typeof dictionaries;
+
+interface PreprSegment {
+    readonly _id: string;
+    readonly name: string;
+}
+/**
+ * Per-feature config. `false` is shorthand for `{ enabled: false }`; the object
+ * form leaves room for per-feature options later without a breaking change.
+ */
+type PreprFeatureConfig = boolean | {
+    enabled?: boolean;
+};
+/** Toolkit features a consumer can turn off. Omitted keys stay enabled. */
+interface PreprFeatures {
+    /** Segment picker, `Prepr-Segments` header and its cookie/query param. */
+    segments?: PreprFeatureConfig;
+    /** A/B variant switch, `Prepr-ABtesting` header and its cookie/query param. */
+    abTesting?: PreprFeatureConfig;
+    /**
+     * The site's own click-to-edit: the toolbar's Edit mode control, the stega
+     * tooltip/overlay and the close-edit pill.
+     *
+     * NOT a security control, and NOT the Prepr editor's live preview. When the
+     * site is framed by the editor, `prepr:initVE` still activates edit mode —
+     * that is the CMS operating inside its own iframe, not an affordance offered
+     * to visitors. See iframe-bridge.ts.
+     */
+    editMode?: PreprFeatureConfig;
+}
+interface PreprToolbarOptions {
+    debug?: boolean;
+    locale?: Locale;
+    /** Disable features app-wide. Pass the same object to the middleware. */
+    features?: PreprFeatures;
+}
+/**
+ * Options for the preview runtime. Two independent axes: `features` decides
+ * *what runs*, `ui` decides *whether the toolbar is visible*.
+ */
+interface PreprPreviewOptions extends PreprToolbarOptions {
+    /**
+     * Mount the visible `<prepr-toolbar>` element. Default `true`.
+     *
+     * `false` keeps every non-visual side effect wired — click-to-edit, the
+     * editor bridge, scroll restore, cookies and headers — with no chrome of its
+     * own. That is how a site gets live editing, or editor scroll restore, while
+     * rendering its own UI instead of the bar.
+     *
+     * Already implied inside the editor's iframe (the CMS owns the chrome there)
+     * and by `?prepr_hide_bar=true`, so this option is for consumers who want a
+     * headless preview by their own choice.
+     */
+    ui?: boolean;
+    /**
+     * Replace the `*.prepr.io` editor-origin wildcard with an exact list.
+     * Intended for self-hosted editors; when set, the wildcard no longer applies.
+     */
+    allowedEditorOrigins?: string[];
+    /**
+     * Strip the invisible stega characters out of visible text at runtime.
+     * Default `true`.
+     *
+     * Preview content carries an encoded payload inside the text itself. Left in
+     * place it is invisible but real: it inflates `String.length`, breaks text
+     * measurement and truncation, and is announced by screen readers.
+     *
+     * Set `false` only when the site already strips the characters itself — for
+     * example by passing every field through `stegaClean` as it renders.
+     * Click-to-edit is unaffected either way: elements are still tagged from the
+     * payload, so the overlay keeps working.
+     */
+    autoClean?: boolean;
+}
+interface PreprToolbarProps {
+    /**
+     * Server-resolved active segment. Optional: omit it with `segments`
+     * disabled, where there is nothing to resolve. When enabled and omitted,
+     * the persisted cookie is used.
+     */
+    readonly activeSegment?: string | null;
+    /**
+     * Server-resolved active A/B variant. Optional: omit it with `abTesting`
+     * disabled, where there is nothing to resolve. When enabled and omitted,
+     * the persisted cookie is used.
+     */
+    readonly activeVariant?: string | null;
+    /** Available segments to personalize on. */
+    readonly segments?: readonly PreprSegment[];
+    /** @deprecated Alias for `segments`. */
+    readonly data?: readonly PreprSegment[];
+}
+/**
+ * Prop type for the framework `<PreprToolbar>` components: the toolbar data
+ * plus the options bag core `createPreprPreview` accepts.
+ */
+interface PreprToolbarComponentProps extends PreprToolbarProps {
+    options?: PreprPreviewOptions;
+}
+type PreprVariant = 'A' | 'B';
+interface PreprHeaders {
+    readonly 'prepr-customer-id'?: string;
+    readonly 'Prepr-Segments'?: string;
+    readonly 'Prepr-ABtesting'?: PreprVariant;
+    readonly 'Prepr-Preview-Bar'?: 'true';
+    readonly 'Prepr-Context-utm_source'?: string;
+    readonly 'Prepr-Context-utm_medium'?: string;
+    readonly 'Prepr-Context-utm_term'?: string;
+    readonly 'Prepr-Context-utm_content'?: string;
+    readonly 'Prepr-Context-utm_campaign'?: string;
+    readonly 'Prepr-Context-initial_referral'?: string;
+    readonly 'Prepr-Visitor-IP'?: string;
+    readonly 'Prepr-Hubspot-Id'?: string;
+    readonly 'Prepr-Customer-Id-Created'?: 'true';
+    /** The visitor's browser User-Agent, used by the API for device detection. */
+    readonly 'User-Agent'?: string;
+    /** @deprecated Never populated; the visitor's value is under `User-Agent`. */
+    readonly 'Prepr-User-Agent'?: string;
+    readonly 'Prepr-Package'?: string;
+}
+type PreprErrorCode = 'INVALID_TOKEN' | 'MISSING_TOKEN' | 'HTTP_ERROR' | 'FETCH_ERROR' | 'INVALID_RESPONSE' | 'CONTEXT_ERROR' | 'GRAPHQL_ERROR' | 'INVALID_DOCUMENT';
+
+/**
+ * Whether a Prepr GraphQL response differs per visitor, read from its `Vary`
+ * header. Use it when fetching with your own GraphQL client; the toolkit's
+ * `createPreprClient` already returns it as `personalized`.
+ *
+ * Never throws; a response without `Vary` is not personalized.
+ */
+declare function isPersonalizedResponse(source: Response | Headers): boolean;
+
+/** Error thrown by the token helpers and the segments fetch. */
+declare class PreprError extends Error {
+    readonly code: PreprErrorCode;
+    readonly context?: string | undefined;
+    readonly originalError?: Error | undefined;
+    constructor(message: string, code: PreprErrorCode, context?: string | undefined, originalError?: Error | undefined);
+}
+/**
+ * Asserts `token` is the full `https://graphql.prepr.io/<token>` URL.
+ * @throws PreprError if the token is missing or not an HTTPS URL.
+ */
+declare function validatePreprToken(token: string): void;
+/**
+ * Pulls the access token out of a GraphQL URL: `https://graphql.prepr.io/abc123`
+ * -> `abc123`.
+ * @throws PreprError if the URL is not a valid `graphql.prepr.io` URL.
+ */
+declare function extractAccessToken(graphqlUrl: string): string;
+
+export { type PreprHeaders as P, PreprError as a, type PreprFeatures as b, type PreprToolbarProps as c, type PreprToolbarComponentProps as d, extractAccessToken as e, isPersonalizedResponse as i, validatePreprToken as v };