@preprio/toolkit 0.5.0-rc.2 → 0.5.0-rc.3

package/dist/nextjs/live-action.cjs

@@ -0,0 +1,285 @@
+"use strict";
+"use server";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/nextjs/live-action.ts
+var live_action_exports = {};
+__export(live_action_exports, {
+  syncPreprLiveLog: () => syncPreprLiveLog
+});
+module.exports = __toCommonJS(live_action_exports);
+var nextCache = __toESM(require("next/cache"), 1);
+var import_headers = require("next/headers");
+
+// src/core/live-preview/normalize-query.ts
+var import_stega = require("@vercel/stega");
+
+// src/core/utils.ts
+var DebugLogger = class {
+  constructor(options) {
+    this.options = {
+      prefix: "[Prepr]",
+      ...options
+    };
+  }
+  // A local `enabled` wins; otherwise defer to the global logger so scoped
+  // loggers created before initDebugLogger() still pick up the setting.
+  isEnabled() {
+    if (this.options.enabled !== void 0) {
+      return this.options.enabled;
+    }
+    return globalDebugLogger?.options?.enabled ?? false;
+  }
+  log(message, ...args) {
+    if (!this.isEnabled()) return;
+    const prefix = this.options.prefix;
+    console.log(`${prefix} ${message}`, ...args);
+  }
+  warn(message, ...args) {
+    if (!this.isEnabled()) return;
+    const prefix = this.options.prefix;
+    console.warn(`${prefix} ${message}`, ...args);
+  }
+  error(message, ...args) {
+    if (!this.isEnabled()) return;
+    const prefix = this.options.prefix;
+    console.error(`${prefix} ${message}`, ...args);
+  }
+};
+var globalDebugLogger = null;
+function createScopedLogger(scopeName) {
+  return new DebugLogger({
+    prefix: `[Prepr][${scopeName}]`
+  });
+}
+
+// src/core/live-preview/validate.ts
+function isScalar(v) {
+  return typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+}
+var MAX_DEPTH = 3;
+var MAX_ENTRIES = 50;
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var SAFE_URL = /^https?:\/\//i;
+var URL_KEY = /^(?:url|href|src|link)$|(?:_url|Url)$/;
+var URL_IGNORED_ANYWHERE = /[\t\n\r]/g;
+var SCRIPT_SCHEME = /^(?:javascript|vbscript|data):/i;
+function isSafeLinkValue(value) {
+  const stripped = value.replace(URL_IGNORED_ANYWHERE, "");
+  let start = 0;
+  while (start < stripped.length && stripped.charCodeAt(start) <= 32) start++;
+  return !SCRIPT_SCHEME.test(stripped.slice(start));
+}
+function isUrlKey(key) {
+  return URL_KEY.test(key);
+}
+function isSafeKeyValue(key, value) {
+  if (typeof value !== "string") return true;
+  if (key === "url") return SAFE_URL.test(value);
+  return !isUrlKey(key) || isSafeLinkValue(value);
+}
+function isLiveValue(v, depth = 0) {
+  if (v === null || isScalar(v)) return true;
+  if (depth >= MAX_DEPTH) return false;
+  if (Array.isArray(v)) {
+    return depth === 0 && v.length <= MAX_ENTRIES && v.every((entry) => isPlainRecord(entry) && isLiveValue(entry, depth + 1));
+  }
+  if (!isPlainRecord(v)) return false;
+  const keys = Object.keys(v);
+  if (keys.length > MAX_ENTRIES) return false;
+  return keys.every((key) => {
+    if (FORBIDDEN_KEYS.has(key)) return false;
+    const value = v[key];
+    if (!isSafeKeyValue(key, value)) return false;
+    return !Array.isArray(value) && isLiveValue(value, depth + 1);
+  });
+}
+function isLiveFieldChange(field, value) {
+  if (!isLiveValue(value)) return false;
+  const name = field.slice(field.lastIndexOf(".") + 1);
+  return typeof value !== "string" || !isUrlKey(name) || isSafeLinkValue(value);
+}
+var MAX_LIST_ENTRIES = 200;
+function parseListEntries(value) {
+  if (!Array.isArray(value) || value.length > MAX_LIST_ENTRIES) return null;
+  const list = [];
+  for (const raw of value) {
+    if (!isPlainRecord(raw) || typeof raw._id !== "string" || !raw._id) {
+      return null;
+    }
+    const entry = { _id: raw._id };
+    if (typeof raw.__typename === "string") entry.__typename = raw.__typename;
+    if (typeof raw.body === "string") entry.body = raw.body;
+    if (typeof raw.format === "string" || raw.format === null) {
+      entry.format = raw.format;
+    }
+    if (typeof raw.typeName === "string" && raw.typeName.length <= 200) {
+      entry.typeName = raw.typeName;
+    }
+    if (raw.fields !== void 0) {
+      if (!isPlainRecord(raw.fields) || !isFieldValue(raw.fields, 0)) {
+        return null;
+      }
+      entry.fields = raw.fields;
+    }
+    list.push(entry);
+  }
+  return list;
+}
+function isPlainRecord(v) {
+  return v !== null && typeof v === "object" && Object.getPrototypeOf(v) === Object.prototype;
+}
+var MAX_FIELD_DEPTH = 6;
+var MAX_FIELD_KEYS = 100;
+function isFieldValue(v, depth) {
+  if (v === null || isScalar(v)) return true;
+  if (depth >= MAX_FIELD_DEPTH) return false;
+  if (Array.isArray(v)) {
+    return v.length <= MAX_ENTRIES && v.every(
+      (entry) => isScalar(entry) || isPlainRecord(entry) && isFieldValue(entry, depth + 1)
+    );
+  }
+  if (!isPlainRecord(v)) return false;
+  const keys = Object.keys(v);
+  if (keys.length > MAX_FIELD_KEYS) return false;
+  return keys.every((key) => {
+    if (FORBIDDEN_KEYS.has(key)) return false;
+    const value = v[key];
+    if (!isSafeKeyValue(key, value)) return false;
+    return isFieldValue(value, depth + 1);
+  });
+}
+var MAX_EDIT_LENGTH = 1e3;
+function parseEditTarget(raw) {
+  if (!isPlainRecord(raw)) return void 0;
+  const { item, field } = raw;
+  if (typeof item !== "string" || !item || item.length > MAX_EDIT_LENGTH) {
+    return void 0;
+  }
+  if (typeof field !== "string" || !field || field.length > MAX_EDIT_LENGTH) {
+    return void 0;
+  }
+  return { item, field };
+}
+
+// src/core/live-preview/normalize-query.ts
+var debug = createScopedLogger("live-preview:normalize");
+var MAX_LOG_ENTRIES = 500;
+var MAX_LOG_SOURCE_LENGTH = 1e6;
+function parsePatchLog(raw) {
+  let value = raw;
+  if (typeof value === "string") {
+    if (!value || value.length > MAX_LOG_SOURCE_LENGTH) return [];
+    try {
+      value = JSON.parse(value);
+    } catch {
+      return [];
+    }
+  }
+  if (!Array.isArray(value)) return [];
+  const log = [];
+  for (const entry of value.slice(-MAX_LOG_ENTRIES)) {
+    if (!isPlainRecord(entry)) continue;
+    const { type, itemId, field } = entry;
+    if (typeof itemId !== "string" || !itemId) continue;
+    if (typeof field !== "string" || !field) continue;
+    if (type === "field" && isLiveFieldChange(field, entry.value)) {
+      const edit = parseEditTarget(entry.edit);
+      log.push(
+        edit ? { type, itemId, field, value: entry.value, edit } : { type, itemId, field, value: entry.value }
+      );
+    } else if (type === "list") {
+      const entries = parseListEntries(entry.entries);
+      if (entries) log.push({ type, itemId, field, entries });
+    }
+  }
+  return log;
+}
+
+// src/core/server.ts
+var PREVIEW_PACKAGE_PART = /(?:^|;)\s*preview=true\s*(?:;|$)/;
+function isPreviewFromHeaders(headers2) {
+  return PREVIEW_PACKAGE_PART.test(headers2.get("Prepr-Package") ?? "");
+}
+
+// src/nextjs/live-log.ts
+var LIVE_LOG_COOKIE = "__prepr_live";
+var TTL_MS = 15e3;
+var MAX_SLOTS = 50;
+var KEY = /* @__PURE__ */ Symbol.for("@preprio/toolkit/live-log");
+function slots() {
+  const holder = globalThis;
+  let map = holder[KEY];
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    holder[KEY] = map;
+  }
+  return map;
+}
+function prune(map, now) {
+  for (const [token, slot] of map) {
+    if (slot.expires <= now) map.delete(token);
+  }
+  while (map.size >= MAX_SLOTS) {
+    map.delete(map.keys().next().value);
+  }
+}
+function putLiveLog(log) {
+  const map = slots();
+  const now = Date.now();
+  prune(map, now);
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  const token = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join(
+    ""
+  );
+  map.set(token, { log, expires: now + TTL_MS });
+  return token;
+}
+
+// src/nextjs/live-action.ts
+async function syncPreprLiveLog(log) {
+  const refresh2 = nextCache.refresh;
+  if (typeof refresh2 !== "function") return;
+  if (!isPreviewFromHeaders(await (0, import_headers.headers)())) return;
+  const parsed = parsePatchLog(log);
+  if (!parsed.length) return;
+  (await (0, import_headers.cookies)()).set(LIVE_LOG_COOKIE, putLiveLog(parsed), {
+    // Expired on arrival: only the re-render of this request reads it.
+    maxAge: 0,
+    httpOnly: true,
+    sameSite: "strict",
+    path: "/"
+  });
+  refresh2();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  syncPreprLiveLog
+});

package/dist/nextjs/live-action.d.cts

@@ -0,0 +1,12 @@
+/**
+ * Server action that re-renders the current route with the editor's unsaved
+ * changes, for `normalizeQuery` to apply. Called by `PreprRefresh`.
+ *
+ * Anyone can call a server action on a production deployment, so it does
+ * nothing unless the Prepr middleware ran with `preview: true`, and the log
+ * is validated as hostile input. Requires Next.js 16 (`refresh`); on older
+ * versions it is a no-op and the page updates on save only.
+ */
+declare function syncPreprLiveLog(log: unknown): Promise<void>;
+
+export { syncPreprLiveLog };

package/dist/nextjs/live-action.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Server action that re-renders the current route with the editor's unsaved
+ * changes, for `normalizeQuery` to apply. Called by `PreprRefresh`.
+ *
+ * Anyone can call a server action on a production deployment, so it does
+ * nothing unless the Prepr middleware ran with `preview: true`, and the log
+ * is validated as hostile input. Requires Next.js 16 (`refresh`); on older
+ * versions it is a no-op and the page updates on save only.
+ */
+declare function syncPreprLiveLog(log: unknown): Promise<void>;
+
+export { syncPreprLiveLog };

package/dist/nextjs/live-action.js

@@ -0,0 +1,68 @@
+"use server";
+import {
+  isPreviewFromHeaders
+} from "../chunk-SXUDBGLZ.js";
+import "../chunk-MDAV2FLM.js";
+import {
+  parsePatchLog
+} from "../chunk-42Z2VW7G.js";
+import "../chunk-S3VT4UWM.js";
+
+// src/nextjs/live-action.ts
+import * as nextCache from "next/cache";
+import { cookies, headers } from "next/headers";
+
+// src/nextjs/live-log.ts
+var LIVE_LOG_COOKIE = "__prepr_live";
+var TTL_MS = 15e3;
+var MAX_SLOTS = 50;
+var KEY = /* @__PURE__ */ Symbol.for("@preprio/toolkit/live-log");
+function slots() {
+  const holder = globalThis;
+  let map = holder[KEY];
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    holder[KEY] = map;
+  }
+  return map;
+}
+function prune(map, now) {
+  for (const [token, slot] of map) {
+    if (slot.expires <= now) map.delete(token);
+  }
+  while (map.size >= MAX_SLOTS) {
+    map.delete(map.keys().next().value);
+  }
+}
+function putLiveLog(log) {
+  const map = slots();
+  const now = Date.now();
+  prune(map, now);
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  const token = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join(
+    ""
+  );
+  map.set(token, { log, expires: now + TTL_MS });
+  return token;
+}
+
+// src/nextjs/live-action.ts
+async function syncPreprLiveLog(log) {
+  const refresh2 = nextCache.refresh;
+  if (typeof refresh2 !== "function") return;
+  if (!isPreviewFromHeaders(await headers())) return;
+  const parsed = parsePatchLog(log);
+  if (!parsed.length) return;
+  (await cookies()).set(LIVE_LOG_COOKIE, putLiveLog(parsed), {
+    // Expired on arrival: only the re-render of this request reads it.
+    maxAge: 0,
+    httpOnly: true,
+    sameSite: "strict",
+    path: "/"
+  });
+  refresh2();
+}
+export {
+  syncPreprLiveLog
+};