@prismicio/svelte 3.0.0-pr.71.35fb12f → 3.0.0-pr.71.88eae6d

package/dist/kit/PrismicPreview.svelte

@@ -1,5 +1,7 @@
 <script lang="ts">
 	import { beforeNavigate, goto, refreshAll } from "$app/navigation"
+	import { resolve } from "$app/paths"
+	import { page } from "$app/state"
 	import { getToolbarSrc } from "@prismicio/client"
 	import { onMount } from "svelte"
 
@@ -21,8 +23,10 @@
 		routePrefixName?: string
 
 		/**
-		 * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
-		 * share links, and hides its Share button without it.
+		 * The path of your preview route, without `paths.base`. The Prismic Toolbar uses it to create
+		 * share links.
+		 *
+		 * @defaultValue `"/api/preview"`
 		 */
 		previewURL?: string
 	}
@@ -31,10 +35,12 @@
 		repositoryName,
 		routePrefix = "preview",
 		routePrefixName = routePrefix,
-		previewURL,
+		previewURL = "/api/preview",
 	}: Props = $props()
 
 	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
+	// `resolve()` can return a path relative to the current page, which changes on navigation.
+	const previewPath = $derived(new URL(resolve(previewURL, {}), page.url).pathname)
 
 	/** Set to `true` when the next `beforeNavigate()` call should not prefix the route. */
 	let endingPreview = $state(false)
@@ -100,5 +106,5 @@
 </script>
 
 <svelte:head>
-	<script defer src={toolbarSrc} data-preview-url={previewURL}></script>
+	<script defer src={toolbarSrc} data-preview-url={previewPath}></script>
 </svelte:head>

package/dist/kit/PrismicPreview.svelte.d.ts

@@ -13,8 +13,10 @@ type Props = {
      */
     routePrefixName?: string;
     /**
-     * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
-     * share links, and hides its Share button without it.
+     * The path of your preview route, without `paths.base`. The Prismic Toolbar uses it to create
+     * share links.
+     *
+     * @defaultValue `"/api/preview"`
      */
     previewURL?: string;
 };

package/dist/kit/redirectToPreviewURL.js

@@ -63,9 +63,10 @@ const getSharedPath = (requestURL, routePrefix) => {
     // `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
     // either absolute or relative to the request.
     const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1);
-    if (!path?.startsWith(`${base}/`)) {
+    const rest = path?.startsWith(base) ? path.slice(base.length) : undefined;
+    // `/docs` and `/docs?q=1` are under the `/docs` base, but `/docs-old` isn't.
+    if (rest === undefined || !/^([/?#]|$)/.test(rest)) {
         return;
     }
-    const pathname = path.slice(base.length);
-    return pathname.split(/[/?#]/)[1] === routePrefix ? path : `${base}/${routePrefix}${pathname}`;
+    return /^\/([^/?#]*)/.exec(rest)?.[1] === routePrefix ? path : `${base}/${routePrefix}${rest}`;
 };

package/dist/lib/getSafePath.d.ts

@@ -1,2 +1,5 @@
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
 export declare function getSafePath(path: string | null | undefined): string | undefined;

package/dist/lib/getSafePath.js

@@ -1,11 +1,22 @@
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
 export function getSafePath(path) {
     if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
         return;
     }
     const origin = "https://placeholder.invalid";
-    const url = new URL(path, origin);
-    if (url.origin === origin) {
-        return url.href.slice(origin.length);
+    let url;
+    try {
+        url = new URL(path, origin);
+    }
+    catch {
+        return;
+    }
+    const safePath = url.href.slice(origin.length);
+    // Normalizing can create `//`, like with `/.//example.com`.
+    if (url.origin === origin && !safePath.startsWith("//")) {
+        return safePath;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/svelte",
-	"version": "3.0.0-pr.71.35fb12f",
+	"version": "3.0.0-pr.71.88eae6d",
 	"description": "Svelte components to present Prismic content.",
 	"keywords": [
 		"prismic",
@@ -62,7 +62,7 @@
 		"esm-env": "^1.2.2"
 	},
 	"devDependencies": {
-		"@prismicio/client": "7.22.3-pr.477.9eb2102",
+		"@prismicio/client": "^7.23.0",
 		"@prismicio/mock": "^0.7.2",
 		"@sveltejs/kit": "^3.0.1",
 		"@sveltejs/package": "^3.0.1",
@@ -71,7 +71,7 @@
 		"@types/node": "^26.6.5",
 		"@vitest/coverage-v8": "^5.0.5",
 		"globals": "^17.13.0",
-		"happy-dom": "^21.0.3",
+		"happy-dom": "^21.0.4",
 		"oxfmt": "^0.74.0",
 		"oxlint": "^1.89.0",
 		"standard-version": "^9.5.0",

package/src/kit/PrismicPreview.svelte

@@ -1,5 +1,7 @@
 <script lang="ts">
 	import { beforeNavigate, goto, refreshAll } from "$app/navigation"
+	import { resolve } from "$app/paths"
+	import { page } from "$app/state"
 	import { getToolbarSrc } from "@prismicio/client"
 	import { onMount } from "svelte"
 
@@ -21,8 +23,10 @@
 		routePrefixName?: string
 
 		/**
-		 * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
-		 * share links, and hides its Share button without it.
+		 * The path of your preview route, without `paths.base`. The Prismic Toolbar uses it to create
+		 * share links.
+		 *
+		 * @defaultValue `"/api/preview"`
 		 */
 		previewURL?: string
 	}
@@ -31,10 +35,12 @@
 		repositoryName,
 		routePrefix = "preview",
 		routePrefixName = routePrefix,
-		previewURL,
+		previewURL = "/api/preview",
 	}: Props = $props()
 
 	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
+	// `resolve()` can return a path relative to the current page, which changes on navigation.
+	const previewPath = $derived(new URL(resolve(previewURL, {}), page.url).pathname)
 
 	/** Set to `true` when the next `beforeNavigate()` call should not prefix the route. */
 	let endingPreview = $state(false)
@@ -100,5 +106,5 @@
 </script>
 
 <svelte:head>
-	<script defer src={toolbarSrc} data-preview-url={previewURL}></script>
+	<script defer src={toolbarSrc} data-preview-url={previewPath}></script>
 </svelte:head>

package/src/kit/redirectToPreviewURL.ts

@@ -102,11 +102,11 @@ const getSharedPath = (requestURL: string, routePrefix: string): string | undefi
 	// `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
 	// either absolute or relative to the request.
 	const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1)
-	if (!path?.startsWith(`${base}/`)) {
+	const rest = path?.startsWith(base) ? path.slice(base.length) : undefined
+	// `/docs` and `/docs?q=1` are under the `/docs` base, but `/docs-old` isn't.
+	if (rest === undefined || !/^([/?#]|$)/.test(rest)) {
 		return
 	}
 
-	const pathname = path.slice(base.length)
-
-	return pathname.split(/[/?#]/)[1] === routePrefix ? path : `${base}/${routePrefix}${pathname}`
+	return /^\/([^/?#]*)/.exec(rest)?.[1] === routePrefix ? path : `${base}/${routePrefix}${rest}`
 }

package/src/lib/getSafePath.ts

@@ -1,12 +1,22 @@
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
 export function getSafePath(path: string | null | undefined): string | undefined {
 	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
 		return
 	}
 
 	const origin = "https://placeholder.invalid"
-	const url = new URL(path, origin)
-	if (url.origin === origin) {
-		return url.href.slice(origin.length)
+	let url: URL
+	try {
+		url = new URL(path, origin)
+	} catch {
+		return
+	}
+	const safePath = url.href.slice(origin.length)
+	// Normalizing can create `//`, like with `/.//example.com`.
+	if (url.origin === origin && !safePath.startsWith("//")) {
+		return safePath
 	}
 }