@preprio/toolkit 0.6.0-alpha.0 → 0.6.0-alpha.10

package/dist/nextjs/index.js

@@ -1,6 +1,9 @@
 import {
+  PREPR_ANY_ITEM_TAG,
+  PREPR_SCHEMA_TAG,
   PreprError,
-  VERSION,
+  createPreprDraftRoute,
+  createPreprMiddleware,
   extractAccessToken,
   getActiveSegment,
   getActiveVariant,
@@ -8,332 +11,128 @@ import {
   getPreprUUID,
   getToolbarProps,
   isPersonalizedResponse,
-  resolveFeatures,
+  preprDraftRedirect,
+  preprItemTag,
+  preprModelTag,
   validatePreprToken
-} from "./chunk-U4HXENF7.js";
-
-// src/nextjs/middleware.ts
-import { NextResponse } from "next/server";
+} from "./chunk-B4GVZEOL.js";
 
-// src/core/constants.ts
-var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
-var COOKIE_SEGMENT = "Prepr-Segments";
-var COOKIE_VARIANT = "Prepr-ABtesting";
-var COOKIE_UID = "__prepr_uid";
-var COOKIE_HUBSPOT = "hubspotutk";
-var PARAM_SEGMENT = "prepr_preview_segment";
-var PARAM_VARIANT = "prepr_preview_ab";
-var PARAM_HIDE_BAR = "prepr_hide_bar";
-var ONE_YEAR_SECONDS = 60 * 60 * 24 * 365;
-
-// src/core/middleware.ts
-var UTM_PARAMS = [
-  "utm_source",
-  "utm_medium",
-  "utm_term",
-  "utm_content",
-  "utm_campaign"
-];
-var MAX_HEADER_VALUE_LENGTH = 2048;
-function sanitizeHeaderValue(value) {
-  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
-  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
-}
-function parseCookies(request) {
-  const cookies2 = /* @__PURE__ */ new Map();
-  const header = request.headers.get("cookie");
-  if (!header) return cookies2;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) continue;
-    const name = part.slice(0, eq).trim();
-    const value = part.slice(eq + 1).trim();
-    if (!name) continue;
-    try {
-      cookies2.set(name, decodeURIComponent(value));
-    } catch {
-      cookies2.set(name, value);
-    }
-  }
-  return cookies2;
-}
-function processFrameworkRequest(request, opts, framework) {
-  const requestHeaders = new Headers(request.headers);
-  const responseCookies = [];
-  const inboundPreprHeaders = [];
-  requestHeaders.forEach((_value, key) => {
-    if (key.toLowerCase().startsWith("prepr-")) {
-      inboundPreprHeaders.push(key);
-    }
-  });
-  for (const key of inboundPreprHeaders) {
-    requestHeaders.delete(key);
-  }
-  const requestCookies = parseCookies(request);
-  const url = new URL(request.url);
-  const searchParams = url.searchParams;
-  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
-  const isSecure = forwardedProto ? forwardedProto === "https" : url.protocol === "https:";
-  const crossSite = isSecure ? { sameSite: "None", secure: true } : {};
-  for (const key of UTM_PARAMS) {
-    const value = searchParams.get(key);
-    if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
+// src/nextjs/webhook.ts
+import { revalidateTag } from "next/cache";
+var CONTENT_EVENTS = /* @__PURE__ */ new Set([
+  "content_item.published",
+  "content_item.unpublished",
+  "content_item.deleted",
+  "content_item.invalidated",
+  "asset.changed",
+  "asset.deleted"
+]);
+var MODEL_EVENTS = /* @__PURE__ */ new Set([
+  "content_item.published",
+  "content_item.unpublished",
+  "content_item.deleted"
+]);
+var MAX_AGE_MS = 5 * 60 * 1e3;
+var HEX_SIGNATURE = /^[0-9a-f]{64}$/i;
+var BASE64_SIGNATURE = /^[A-Za-z0-9+/]{43}=$/;
+var SIGNATURE_PREFIX = /^sha256=/i;
+var MAX_ID_LENGTH = 200;
+var text = (body, status) => new Response(body, { status, headers: { "Content-Type": "text/plain" } });
+function signatureBytes(header) {
+  const value = header.trim().replace(SIGNATURE_PREFIX, "");
+  if (HEX_SIGNATURE.test(value)) {
+    const bytes = new Uint8Array(32);
+    for (let i = 0; i < 32; i++) {
+      bytes[i] = parseInt(value.slice(i * 2, i * 2 + 2), 16);
     }
+    return bytes;
   }
-  const referer = request.headers.get("referer");
-  if (referer) {
-    requestHeaders.set(
-      "Prepr-Context-initial_referral",
-      sanitizeHeaderValue(referer)
-    );
-  }
-  const userAgent = request.headers.get("user-agent");
-  if (userAgent) {
-    requestHeaders.set("User-Agent", sanitizeHeaderValue(userAgent));
-  }
-  const packageParts = [`@preprio/toolkit@${opts?.version ?? VERSION}`];
-  if (framework) packageParts.push(`framework=${framework}`);
-  packageParts.push(`preview=${opts?.preview ? "true" : "false"}`);
-  requestHeaders.set("Prepr-Package", packageParts.join("; "));
-  const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
-  if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
-  }
-  const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
-  if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
-  }
-  let uid = sanitizeHeaderValue(requestCookies.get(COOKIE_UID) ?? "");
-  if (!uid) {
-    uid = crypto.randomUUID();
-    responseCookies.push({
-      name: COOKIE_UID,
-      value: uid,
-      maxAge: ONE_YEAR_SECONDS,
-      path: "/"
-    });
-    requestHeaders.set("Prepr-Customer-Id-Created", "true");
-  }
-  requestHeaders.set("Prepr-Customer-Id", uid);
-  if (!opts?.preview) {
-    return { requestHeaders, responseCookies };
-  }
-  const features = resolveFeatures(opts?.features);
-  const hasPreviewParams = features.segments && searchParams.has(PARAM_SEGMENT) || features.abTesting && searchParams.has(PARAM_VARIANT);
-  if (!hasPreviewParams) {
-    const previewModeCookie = requestCookies.get(COOKIE_PREVIEW_MODE);
-    const previewModeEnabled = previewModeCookie !== "false";
-    if (!previewModeEnabled) {
-      return { requestHeaders, responseCookies };
-    }
-  }
-  requestHeaders.set("Prepr-Preview-Bar", "true");
-  const isLivePreview = searchParams.get(PARAM_HIDE_BAR) === "true";
-  if (!isLivePreview && !requestCookies.has(COOKIE_PREVIEW_MODE)) {
-    responseCookies.push({
-      name: COOKIE_PREVIEW_MODE,
-      value: "true",
-      maxAge: ONE_YEAR_SECONDS,
-      path: "/",
-      ...crossSite
-    });
-  }
-  if (!isLivePreview) {
-    const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
-    if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
-    }
-    const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
-    if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
-    }
+  if (BASE64_SIGNATURE.test(value)) {
+    return Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
   }
-  const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
-  if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
-    if (!isLivePreview) {
-      responseCookies.push({
-        name: COOKIE_VARIANT,
-        value: previewAb,
-        maxAge: ONE_YEAR_SECONDS,
-        path: "/",
-        ...crossSite
-      });
-    }
-  }
-  const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
-  if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
-    if (!isLivePreview) {
-      responseCookies.push({
-        name: COOKIE_SEGMENT,
-        value: previewSegment,
-        maxAge: ONE_YEAR_SECONDS,
-        path: "/",
-        ...crossSite
-      });
-    }
-  }
-  if (requestHeaders.has("Prepr-Segments")) {
-    requestHeaders.delete("Prepr-Customer-Id");
-    requestHeaders.delete("Prepr-Customer-Id-Created");
-  }
-  return { requestHeaders, responseCookies };
+  return null;
 }
-
-// src/nextjs/middleware.ts
-function createPreprMiddleware(request, responseOrOptions, maybeOptions) {
-  let chainedResponse;
-  let options;
-  if (responseOrOptions instanceof NextResponse) {
-    chainedResponse = responseOrOptions;
-    options = maybeOptions;
-  } else {
-    options = responseOrOptions;
-  }
-  const { requestHeaders, responseCookies } = processFrameworkRequest(
-    request,
-    options,
-    "nextjs"
+async function verify(secret, signature, body) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
   );
-  const response = chainedResponse ?? NextResponse.next({ request: { headers: requestHeaders } });
-  if (chainedResponse) {
-    const existing = response.headers.get("x-middleware-override-headers");
-    const names = new Set(
-      existing ? existing.split(",").map((name) => name.trim()).filter(Boolean) : []
-    );
-    requestHeaders.forEach((value, key) => {
-      names.add(key);
-      response.headers.set(`x-middleware-request-${key}`, value);
-    });
-    response.headers.set("x-middleware-override-headers", [...names].join(","));
-  }
-  for (const cookie of responseCookies) {
-    response.cookies.set(cookie.name, cookie.value, {
-      maxAge: cookie.maxAge,
-      path: cookie.path,
-      // Lower-cased: Next's cookie API expects 'none' | 'lax' | 'strict'.
-      ...cookie.sameSite ? {
-        sameSite: cookie.sameSite.toLowerCase()
-      } : {},
-      ...cookie.secure ? { secure: true } : {}
-    });
-  }
-  return response;
-}
-
-// src/nextjs/bucket.ts
-var PREPR_BUCKET_COOKIE = "prepr_ab_bucket";
-var isBucket = (value) => value === "A" || value === "B";
-function setBucketCookie(request, response, bucket) {
-  response.cookies.set(PREPR_BUCKET_COOKIE, bucket, {
-    path: "/",
-    sameSite: "lax",
-    // Readable on purpose: PreprStack's inline switch reads it before first
-    // paint. It holds only "A" or "B".
-    httpOnly: false,
-    secure: request.nextUrl.protocol === "https:",
-    maxAge: 60 * 60 * 24 * 365
-  });
+  return crypto.subtle.verify("HMAC", key, signature, body);
 }
-async function resolvePreprBucket(request, response, options) {
-  const stored = request.cookies.get(PREPR_BUCKET_COOKIE)?.value;
-  const forced = response.headers.get("x-middleware-request-prepr-abtesting") ?? request.cookies.get(COOKIE_VARIANT)?.value;
-  if (options.preview && isBucket(forced)) {
-    if (forced !== stored) setBucketCookie(request, response, forced);
-    return forced;
-  }
-  if (isBucket(stored)) return stored;
-  if (options.onlyIf) {
-    const needed = await Promise.resolve().then(options.onlyIf).catch(() => true);
-    if (!needed) return "A";
-  }
-  const customerId = request.cookies.get(COOKIE_UID)?.value ?? response.cookies.get(COOKIE_UID)?.value;
-  if (!customerId) return "A";
+function parse(body) {
   try {
-    const res = await fetch(options.url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Prepr-Customer-Id": customerId
-      },
-      body: JSON.stringify({ query: "{ __typename }" }),
-      cache: "no-store",
-      signal: AbortSignal.timeout(options.timeoutMs ?? 1500)
-    });
-    const bucket = res.headers.get("x-prepr-customer-bucket");
-    if (isBucket(bucket)) {
-      setBucketCookie(request, response, bucket);
-      return bucket;
-    }
+    const value = JSON.parse(new TextDecoder().decode(body));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
   } catch {
+    return null;
   }
-  return "A";
 }
-
-// src/nextjs/draft.ts
-import { cookies, draftMode } from "next/headers";
-import { redirect } from "next/navigation";
-import { NextResponse as NextResponse2 } from "next/server";
-var DRAFT_COOKIE = "__prerender_bypass";
-var RETURN_PARAM = "prepr_draft";
-var DEFAULT_ROUTE = "/api/prepr/draft";
-function preprDraftRedirect(request, options) {
-  if (!options.preview) return null;
-  if (request.method !== "GET" && request.method !== "HEAD") return null;
-  const url = request.nextUrl;
-  if (url.pathname === (options.route ?? DEFAULT_ROUTE)) return null;
-  if (request.cookies.has(DRAFT_COOKIE)) {
-    if (!url.searchParams.has(RETURN_PARAM)) return null;
-    const clean = url.clone();
-    clean.searchParams.delete(RETURN_PARAM);
-    return NextResponse2.redirect(clean, 307);
-  }
-  if (url.searchParams.has(RETURN_PARAM)) return null;
-  const target = new URL(options.route ?? DEFAULT_ROUTE, request.url);
-  target.searchParams.set("to", url.pathname + url.search);
-  return NextResponse2.redirect(target, 307);
+function eventTime(value) {
+  if (typeof value === "number") return value * 1e3;
+  if (typeof value === "string") return Date.parse(value);
+  return NaN;
+}
+function field(value, key) {
+  return typeof value === "object" && value !== null ? value[key] : void 0;
 }
-function createPreprDraftRoute(options) {
+var usable = (value) => typeof value === "string" && value !== "" && value.length <= MAX_ID_LENGTH;
+function tagsFor(event) {
+  const name = event.event;
+  if (name === "schema.changed") return [PREPR_SCHEMA_TAG];
+  if (typeof name !== "string" || !CONTENT_EVENTS.has(name)) return [];
+  const tags = [PREPR_ANY_ITEM_TAG];
+  const id = field(event.payload, "id");
+  if (usable(id)) tags.push(preprItemTag(id));
+  const model = field(field(event.payload, "model"), "body_singular");
+  if (MODEL_EVENTS.has(name) && usable(model)) tags.push(preprModelTag(model));
+  return tags;
+}
+function createPreprWebhookRoute(options) {
+  const { profile = { expire: 0 } } = options;
   return async (request) => {
-    if (!options.preview) return new Response("Not found", { status: 404 });
-    (await draftMode()).enable();
-    const self = new URL(request.url);
-    if (self.protocol === "https:") {
-      const jar = await cookies();
-      const draft = jar.get(DRAFT_COOKIE);
-      if (draft) {
-        jar.set({
-          name: DRAFT_COOKIE,
-          value: draft.value,
-          path: "/",
-          httpOnly: true,
-          secure: true,
-          sameSite: "none",
-          partitioned: true
-        });
-      }
+    const { secret } = options;
+    if (!secret) return text("Webhook secret not configured", 500);
+    const signature = signatureBytes(
+      request.headers.get("prepr-signature") ?? ""
+    );
+    let body;
+    try {
+      body = await request.arrayBuffer();
+    } catch {
+      return text("Unreadable body", 400);
+    }
+    if (!signature || !await verify(secret, signature, body)) {
+      return text("Invalid signature", 401);
+    }
+    const event = parse(body);
+    if (!event) return text("Invalid body", 400);
+    const sentAt = eventTime(event.created_on);
+    if (Number.isFinite(sentAt) && Math.abs(Date.now() - sentAt) > MAX_AGE_MS) {
+      return text("Expired", 401);
     }
-    let to = new URL(self.searchParams.get("to") ?? "/", self);
-    if (to.origin !== self.origin) to = new URL("/", self);
-    to.searchParams.set(RETURN_PARAM, "1");
-    redirect(to.pathname + to.search);
+    const tags = tagsFor(event);
+    for (const tag of tags) revalidateTag(tag, profile);
+    return Response.json({ revalidated: tags });
   };
 }
 
 // src/nextjs/index.ts
 import {
+  PreprPersonalizationSwitch,
   PreprToolbar,
   PreprTrackingPixel
 } from "./components.js";
 export {
-  PREPR_BUCKET_COOKIE,
   PreprError,
+  PreprPersonalizationSwitch,
   PreprToolbar,
   PreprTrackingPixel,
   createPreprDraftRoute,
   createPreprMiddleware,
+  createPreprWebhookRoute,
   extractAccessToken,
   getActiveSegment,
   getActiveVariant,
@@ -342,6 +141,5 @@ export {
   getToolbarProps,
   isPersonalizedResponse,
   preprDraftRedirect,
-  resolvePreprBucket,
   validatePreprToken
 };

package/dist/nextjs/{server-CjpELYvq.d.ts → server-BL-sqZvu.d.cts}

@@ -153,4 +153,4 @@ declare function validatePreprToken(token: string): void;
  */
 declare function extractAccessToken(graphqlUrl: string): string;
 
-export { type PreprHeaders as P, PreprError as a, type PreprFeatures as b, type PreprToolbarProps as c, type PreprToolbarComponentProps as d, extractAccessToken as e, isPersonalizedResponse as i, validatePreprToken as v };
+export { type PreprHeaders as P, type PreprFeatures as a, PreprError as b, type PreprToolbarProps as c, type PreprToolbarComponentProps as d, extractAccessToken as e, isPersonalizedResponse as i, validatePreprToken as v };

package/dist/nextjs/{server-CjpELYvq.d.cts → server-BL-sqZvu.d.ts}

@@ -153,4 +153,4 @@ declare function validatePreprToken(token: string): void;
  */
 declare function extractAccessToken(graphqlUrl: string): string;
 
-export { type PreprHeaders as P, PreprError as a, type PreprFeatures as b, type PreprToolbarProps as c, type PreprToolbarComponentProps as d, extractAccessToken as e, isPersonalizedResponse as i, validatePreprToken as v };
+export { type PreprHeaders as P, type PreprFeatures as a, PreprError as b, type PreprToolbarProps as c, type PreprToolbarComponentProps as d, extractAccessToken as e, isPersonalizedResponse as i, validatePreprToken as v };

package/dist/nuxt/{chunk-P6ENNAEE.js → chunk-FMC3DP7N.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.6.0-alpha.0";
+var VERSION = "0.6.0-alpha.10";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";