fontdue-js 3.0.0-alpha11 → 3.0.0-alpha13

package/dist/components/FontdueProvider/index.server.d.ts

@@ -1,5 +1,6 @@
 import React from 'react';
 import type { FontdueProvider_props } from './index.js';
+import '../../next/registerSingleTenantResolver.js';
 export type { FontdueProvider_props } from './index.js';
 export type { FontdueProviderPreloadedQuery } from '../../loadFontdueProviderQuery.js';
 export type { FontdueServerConfig } from '../../relay/serverConfig.js';

package/dist/components/FontdueProvider/index.server.js

@@ -3,6 +3,16 @@ import React from 'react';
 import FontdueProvider from './index.js';
 import loadFontdueProviderQueryImpl from '../../loadFontdueProviderQuery.js';
 import { setFontdueServerConfig } from '../../relay/serverConfig.js';
+// Side-effect import: registers the single-tenant ambient config resolver so a
+// single-tenant foundry that mounts <FontdueProvider> never has to call a
+// per-render setup function. The module statically pulls in only browser-safe
+// code and lazy-loads the Next request APIs (next/headers, next/navigation)
+// behind a dynamic import that runs only when the resolver resolves config —
+// keeping next/* off this react-server entrypoint's eager graph. The resolver
+// no-ops in multi-tenant mode (which drives config through the slot) and is
+// inert in the default build Astro/RR7 use. See
+// ../../next/registerSingleTenantResolver.ts.
+import '../../next/registerSingleTenantResolver.js';
 // Stub for the RSC export condition. The default `<FontdueProvider>` server
 // entrypoint (this file) awaits the query for consumers, so RSC users should
 // never call it manually. Re-exporting a throwing stub makes the mistake

package/dist/fontdue.css

@@ -3431,6 +3431,65 @@ textarea.text-field__input {
   word-break: break-word;
 }
 
+.fontdue-admin-toolbar__actions {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  margin-top: 12px;
+}
+
+.fontdue-admin-toolbar__action {
+  display: inline-flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  width: 100%;
+  margin: 0;
+  padding: 7px 10px;
+  font: inherit;
+  font-size: 12px;
+  text-align: left;
+  text-decoration: none;
+  color: #fff;
+  background: transparent;
+  border: 1px solid var(--fdat-border);
+  border-radius: 0;
+  cursor: pointer;
+}
+.fontdue-admin-toolbar__action:hover {
+  border-color: rgba(255, 255, 255, 0.4);
+}
+.fontdue-admin-toolbar__action:focus-visible {
+  outline: 1px solid #fff;
+  outline-offset: 1px;
+}
+.fontdue-admin-toolbar__action:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
+
+.fontdue-admin-toolbar__notice {
+  margin: 10px 0 0;
+  color: var(--fdat-muted);
+  font-size: 12px;
+}
+
+.fontdue-admin-toolbar__meta {
+  margin: 12px 0 0;
+  padding-top: 10px;
+  border-top: 1px solid var(--fdat-border);
+  color: var(--fdat-muted);
+  font-size: 11px;
+  word-break: break-word;
+}
+
+.fontdue-admin-toolbar__version {
+  display: block;
+  margin-top: 4px;
+  color: rgba(255, 255, 255, 0.32);
+  font-size: 11px;
+}
+
 :root {
   --section_spacing: 60px;
 }

package/dist/next/index.d.ts

@@ -1,2 +1 @@
-export { isMultiTenant, isValidDomain, fontdueEndpoint, fontdueServerConfig, configureFontdueRender, prepareFontdueRender, currentFontdueEndpoint, generateStaticParams, type FontdueEndpoint, } from './tenant.js';
-export { setFontdueServerConfig, getFontdueServerConfig, type FontdueServerConfig, } from '../relay/serverConfig.js';
+export { configureFontduePreview, fontdueEndpoint, __prepareFontdueRender, type FontdueEndpoint, } from './tenant.js';

package/dist/next/index.js

@@ -2,9 +2,19 @@
 // The config-time wrapper lives in 'fontdue-js/next/config' and the deploy
 // hook route handler in 'fontdue-js/next/revalidate'.
 
-export { isMultiTenant, isValidDomain, fontdueEndpoint, fontdueServerConfig, configureFontdueRender, prepareFontdueRender, currentFontdueEndpoint, generateStaticParams } from './tenant.js';
-
-// The per-render config store consumed by fontdue-js's own server-side
-// fetches. configureFontdueRender covers the common case; these are exported
-// for apps that need to set or inspect the config directly.
-export { setFontdueServerConfig, getFontdueServerConfig } from '../relay/serverConfig.js';
+// Public foundry-facing API. Single-tenant apps need no per-render setup call —
+// mounting <FontdueProvider> registers the ambient resolver that configures
+// every server fetch (see ../components/FontdueProvider/index.server.tsx ->
+// registerSingleTenantResolver). configureFontduePreview() remains exported as
+// an optional explicit hook (e.g. to get the resolved endpoint in a render);
+// route handlers (sitemap, robots) read fontdueEndpoint() since they run
+// outside React.
+//
+// __prepareFontdueRender is the internal multi-tenant API used only by the
+// Fontdue-hosted next-template — not part of the foundry surface. The
+// remaining tenant/config helpers (isMultiTenant, isValidDomain,
+// endpointForDomain, fontdueServerConfig, configureFontdueRender,
+// setFontdueServerConfig/getFontdueSlotConfig) are deliberately not re-exported
+// here; the modules that need them import them directly from './tenant.js' /
+// '../relay/serverConfig.js'.
+export { configureFontduePreview, fontdueEndpoint, __prepareFontdueRender } from './tenant.js';

package/dist/next/registerSingleTenantResolver.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/next/registerSingleTenantResolver.js

@@ -0,0 +1,36 @@
+// Registers the single-tenant ambient config resolver (env URL +
+// draftMode()/cookies() preview token, resolved per fetch) so a single-tenant
+// foundry that mounts <FontdueProvider> never has to call a per-render setup
+// function. The FontdueProvider react-server entrypoint imports this module as
+// a side effect — in the call-free model the app no longer imports
+// 'fontdue-js/next' itself, so the provider mount is the only thing guaranteed
+// to wire the resolver up.
+//
+// Why this lives apart from ./tenant.ts: it statically imports ONLY the
+// browser-safe registerAmbientConfigResolver. The Next request APIs
+// (next/headers, next/navigation) the resolver needs sit behind a lazy
+// `import('./tenant.js')` in the resolver body, which runs only when a server
+// fetch actually resolves config — i.e. only under Next. That keeps next/* off
+// the provider entrypoint's eager import graph, so mounting <FontdueProvider>
+// stays safe for any non-Next RSC consumer. (Today only Next resolves the
+// react-server export condition, but the decoupling makes that a structural
+// invariant rather than an incidental one.)
+import { registerAmbientConfigResolver } from '../relay/serverConfig.js';
+registerAmbientConfigResolver(async () => {
+  // Loaded lazily so next/headers + next/navigation never enter the
+  // provider's static graph; config is read per fetch from Next's request
+  // context (draftMode()/cookies()), which also covers soft navigations that
+  // re-render only the page segment.
+  const {
+    isMultiTenant,
+    singleTenantUrl,
+    buildRenderConfig
+  } = await import('./tenant.js');
+  // Multi-tenant drives config through the React.cache slot
+  // (__prepareFontdueRender), which needs the per-request route param, so the
+  // resolver stays out of its way. The slot also wins the merge, so an
+  // explicit configureFontduePreview()/__prepareFontdueRender call still
+  // overrides this when present.
+  if (isMultiTenant || !singleTenantUrl) return undefined;
+  return buildRenderConfig(new URL(singleTenantUrl).host);
+});

package/dist/next/revalidate.js

@@ -7,7 +7,7 @@
 // receive the tenant in the URL, e.g.
 //   POST /api/revalidate?domain=acme.fontdue.com
 // and only that tenant's cache is purged (pages and embed data share the
-// per-domain tag — see fontdueEndpoint/fontdueServerConfig in ./tenant).
+// per-domain tag — see endpointForDomain/fontdueServerConfig in ./tenant).
 // Single-tenant deployments use the parameterless form and purge everything
 // carrying the 'graphql' tag.
 

package/dist/next/tenant.d.ts

@@ -1,5 +1,6 @@
 import { type FontdueServerConfig } from '../relay/serverConfig.js';
 export declare const isMultiTenant: boolean;
+export declare const singleTenantUrl: string | undefined;
 export declare function isValidDomain(domain: string): boolean;
 export interface FontdueEndpoint {
     /** The site domain this endpoint resolves. */
@@ -14,13 +15,14 @@ export interface FontdueEndpoint {
      */
     tags: string[];
 }
-export declare function fontdueEndpoint(domain: string): FontdueEndpoint;
+export declare function endpointForDomain(domain: string): FontdueEndpoint;
 export declare function fontdueServerConfig(domain: string): FontdueServerConfig;
 export declare function configureFontdueRender(domain: string): FontdueEndpoint | null;
 interface RenderProps {
     params: Promise<Record<string, string | string[] | undefined>>;
 }
-export declare function prepareFontdueRender(props: RenderProps): Promise<FontdueEndpoint>;
-export declare function currentFontdueEndpoint(): FontdueEndpoint;
-export declare function generateStaticParams(): Promise<never[]>;
+export declare function buildRenderConfig(domain: string): Promise<FontdueServerConfig>;
+export declare function configureFontduePreview(): Promise<FontdueEndpoint>;
+export declare function __prepareFontdueRender(props: RenderProps): Promise<FontdueEndpoint>;
+export declare function fontdueEndpoint(): FontdueEndpoint;
 export {};

package/dist/next/tenant.js

@@ -20,14 +20,16 @@
 //
 // The fontdue-js components embedded in pages fetch the same way: their
 // server-side preloads read the per-render config set by
-// configureFontdueRender, and in the browser they fetch the relative
-// /graphql on the page's own origin — so multi-tenant mode needs no
-// NEXT_PUBLIC_FONTDUE_URL at all.
+// __prepareFontdueRender (or configureFontduePreview in single-tenant apps),
+// and in the browser they fetch the relative /graphql on the page's own
+// origin — so multi-tenant mode needs no NEXT_PUBLIC_FONTDUE_URL at all.
 
-import { notFound } from 'next/navigation';
-import { setFontdueServerConfig, getFontdueServerConfig } from '../relay/serverConfig.js';
+import { notFound, unstable_rethrow } from 'next/navigation';
+import { cookies, draftMode } from 'next/headers';
+import { setFontdueServerConfig, getFontdueSlotConfig } from '../relay/serverConfig.js';
+import { PREVIEW_TOKEN_COOKIE, previewAuthHeaders } from '../preview/index.js';
 export const isMultiTenant = process.env.FONTDUE_MULTI_TENANT === '1';
-const singleTenantUrl = process.env.NEXT_PUBLIC_FONTDUE_URL;
+export const singleTenantUrl = process.env.NEXT_PUBLIC_FONTDUE_URL;
 const internalOrigin = process.env.FONTDUE_ORIGIN;
 const proxySecret = process.env.FONTDUE_PROXY_SECRET;
 
@@ -39,7 +41,7 @@ export function isValidDomain(domain) {
 }
 // Where to fetch GraphQL for a given tenant domain, plus any headers needed
 // for the Fontdue server to resolve that tenant.
-export function fontdueEndpoint(domain) {
+export function endpointForDomain(domain) {
   const tags = ['graphql', `graphql:${domain}`];
   if (!isMultiTenant) {
     return {
@@ -84,7 +86,7 @@ export function fontdueServerConfig(domain) {
   const {
     origin,
     headers
-  } = fontdueEndpoint(domain);
+  } = endpointForDomain(domain);
   return {
     url: origin,
     headers,
@@ -104,66 +106,137 @@ export function fontdueServerConfig(domain) {
 export function configureFontdueRender(domain) {
   if (!isValidDomain(domain)) return null;
   setFontdueServerConfig(fontdueServerConfig(domain));
-  return fontdueEndpoint(domain);
+  return endpointForDomain(domain);
 }
 
 // The props every page, layout and generateMetadata receives. Any params
 // object is structurally compatible; only `domain` is read.
 
-// The one line at the top of every page, layout and generateMetadata body
-// in the [domain] route tree:
+// Build this render's server config for `domain` (origin, headers, per-site
+// cache tags) and install it for the rest of the pass. When a logged-in admin
+// is in preview (Next draft mode), fold the token into the headers and drop the
+// cache tags, so every server fetch in the render — the app's own and the
+// embedded components' preloads — reveals hidden fonts and stays live
+// (uncached, never landing in a shared cache).
+export async function buildRenderConfig(domain) {
+  const config = fontdueServerConfig(domain);
+  const previewHeaders = await readPreviewHeaders();
+  return previewHeaders ? {
+    ...config,
+    headers: {
+      ...config.headers,
+      ...previewHeaders
+    },
+    cacheTags: undefined
+  } : config;
+}
+async function applyRenderConfig(domain) {
+  setFontdueServerConfig(await buildRenderConfig(domain));
+}
+
+// Single-tenant render setup — the one line at the top of every page, layout
+// and generateMetadata that fetches Fontdue data or renders Fontdue components:
+//
+//   await configureFontduePreview();
 //
-//   await prepareFontdueRender(props);
+// It points this render's server-side fetches — your own (createFontdueFetch)
+// AND the embedded components' preloads (type testers, store, character viewer)
+// — at your Fontdue site (NEXT_PUBLIC_FONTDUE_URL), and when a logged-in admin
+// has entered preview it forwards their token and serves a live (uncached)
+// render so hidden (unpublished) fonts show up. Public renders stay cached and
+// tagged for /api/revalidate.
 //
-// Reads the request's site from the [domain] route param, 404s anything
-// that isn't a plain hostname (stray paths can reach the catch-all route
-// with their first segment as the "domain"), and points every Fontdue fetch
-// in the rest of this render pass — the app's fetches via
-// currentFontdueEndpoint and fontdue-js's embedded-component preloads — at
-// that site.
+// Call it per entry point, not just the layout: a soft navigation re-renders
+// only the page segment with a fresh render store. Reading draft mode is
+// static-safe — it only forces dynamic rendering when an admin is actually
+// previewing, so static generation keeps working otherwise.
+//
+// Returns the endpoint, handy for e.g. a metadataBase fallback. Route handlers
+// (robots/sitemap) aren't React renders, so call fontdueEndpoint()
+// there instead.
+export async function configureFontduePreview() {
+  const domain = new URL(requireSingleTenantUrl()).host;
+  await applyRenderConfig(domain);
+  return endpointForDomain(domain);
+}
+
+// Internal multi-tenant API (double-underscored, not part of the public
+// foundry surface): the one line at the top of every page, layout and
+// generateMetadata body in the multi-tenant [domain] route tree (the
+// Fontdue-hosted service):
 //
-// It must run per entry point, not only in the layout: a soft navigation
-// re-renders just the page segment, and the per-render store starts empty
-// on every pass. Forgetting it is loud, not subtle: currentFontdueEndpoint
-// throws in multi-tenant mode when no render config was set.
+//   await __prepareFontdueRender(props);
 //
-// Route handlers are not React renders — the render-scoped store doesn't
-// exist there, so use the returned endpoint explicitly instead of relying
-// on currentFontdueEndpoint.
-export async function prepareFontdueRender(props) {
+// Reads the request's site from the route param, 404s anything that isn't a
+// plain hostname, and configures the render (including preview) for that site.
+// Like configureFontduePreview, it runs per entry point. Route handlers are not
+// React renders — use the returned endpoint explicitly there.
+export async function __prepareFontdueRender(props) {
   const {
     domain
   } = await props.params;
-  const endpoint = typeof domain === 'string' ? configureFontdueRender(domain) : null;
-  if (!endpoint) notFound();
-  return endpoint;
+  if (typeof domain !== 'string' || !isValidDomain(domain)) notFound();
+  await applyRenderConfig(domain);
+  return endpointForDomain(domain);
+}
+
+// The admin preview token for this render, as Authorization headers, or
+// undefined when not previewing. Draft mode gates it: reading draftMode().
+// isEnabled is static-safe (it returns false during static generation and only
+// forces dynamic rendering when actually enabled), and the token cookie is only
+// read in the preview branch.
+//
+// The catch handles two very different throws, and the difference is load-
+// bearing for preview:
+//
+//   1. Next's dynamic-rendering bailout. When an admin is previewing, reading
+//      cookies() during a prerender/static pass throws a control-flow error
+//      (DynamicServerError / prerender interrupt) whose whole purpose is to
+//      tell Next "abandon the static render and go dynamic." This is the ONLY
+//      signal that takes a route in generateStaticParams off the full-route
+//      cache for the preview request. Swallowing it (as this used to) let Next
+//      serve the cached, token-less *public* render in preview, so the embedded
+//      components' own server preloads (createNetworkFetch) never saw the token
+//      — hidden fonts stayed hidden and @required(THROW) embeds like
+//      <BuyButton> crashed the server render (FD-712). unstable_rethrow re-
+//      throws exactly these control-flow errors so the route bails to a
+//      dynamic, token-bearing render. Public renders never hit this branch
+//      (draftMode().isEnabled is false → early return), so they stay static.
+//   2. A genuine "no request scope" throw (older runtimes calling
+//      draftMode()/cookies() with no request at all): not a control-flow error,
+//      so unstable_rethrow is a no-op and we fall through to "not previewing".
+async function readPreviewHeaders() {
+  try {
+    var _await$cookies$get;
+    if (!(await draftMode()).isEnabled) return undefined;
+    const token = (_await$cookies$get = (await cookies()).get(PREVIEW_TOKEN_COOKIE)) === null || _await$cookies$get === void 0 ? void 0 : _await$cookies$get.value;
+    return token ? previewAuthHeaders(token) : undefined;
+  } catch (error) {
+    unstable_rethrow(error);
+    return undefined;
+  }
 }
 
 // Endpoint for the app's own GraphQL fetches in this render pass: whatever
-// prepareFontdueRender configured, or — in a single-tenant app without the
-// [domain] tree, where prepareFontdueRender is never called — the
+// __prepareFontdueRender configured, or — in a single-tenant app without the
+// [domain] tree, where __prepareFontdueRender is never called — the
 // NEXT_PUBLIC_FONTDUE_URL site. Throwing rather than guessing in
-// multi-tenant mode turns a forgotten prepareFontdueRender into an
+// multi-tenant mode turns a forgotten __prepareFontdueRender into an
 // unmissable error instead of a silent wrong-site fetch on soft
 // navigations.
-export function currentFontdueEndpoint() {
-  var _getFontdueServerConf;
-  const domain = (_getFontdueServerConf = getFontdueServerConfig()) === null || _getFontdueServerConf === void 0 ? void 0 : _getFontdueServerConf.domain;
-  if (domain) return fontdueEndpoint(domain);
+export function fontdueEndpoint() {
+  var _getFontdueSlotConfig;
+  const domain = (_getFontdueSlotConfig = getFontdueSlotConfig()) === null || _getFontdueSlotConfig === void 0 ? void 0 : _getFontdueSlotConfig.domain;
+  if (domain) return endpointForDomain(domain);
   if (isMultiTenant) {
-    throw new Error('fontdue-js/next: no render config set — call prepareFontdueRender(props) at the top of every page, layout and generateMetadata that fetches.');
+    throw new Error('fontdue-js/next: no render config set — call __prepareFontdueRender(props) at the top of every page, layout and generateMetadata that fetches.');
   }
-  return fontdueEndpoint(new URL(requireSingleTenantUrl()).host);
+  return endpointForDomain(new URL(requireSingleTenantUrl()).host);
 }
 
-// Re-export from routes in the [domain] tree:
-//
-//   export { generateStaticParams } from 'fontdue-js/next';
-//
-// Domains aren't known at build time, so nothing is prerendered — but
-// providing generateStaticParams is what opts a dynamic route into
-// static-on-demand rendering (generated on first request, then cached until
-// revalidated) instead of fully dynamic rendering.
-export async function generateStaticParams() {
-  return [];
-}
+// The single-tenant ambient resolver that lets a foundry skip per-render setup
+// is registered from ./registerSingleTenantResolver.ts (imported as a side
+// effect by the FontdueProvider react-server entrypoint), not here — so this
+// module's static next/* imports stay off that entrypoint's eager graph. The
+// resolver lazy-imports buildRenderConfig + singleTenantUrl + isMultiTenant
+// from this module at fetch time.

package/dist/preview/constants.d.ts

@@ -1,3 +1,5 @@
 export declare const PREVIEW_TOKEN_COOKIE = "fontdue_preview_token";
 export declare const PREVIEW_MARKER_COOKIE = "fontdue_preview";
 export declare const PREVIEW_ENDPOINT = "/api/preview";
+export declare const PREVIEW_HEADER = "fontdue-preview";
+export declare function hasPreviewMarkerCookie(): boolean;

package/dist/preview/constants.js

@@ -15,4 +15,23 @@ export const PREVIEW_MARKER_COOKIE = 'fontdue_preview';
 // Default path the toolbar POSTs (enter) / DELETEs (exit) to. Relative, so it
 // hits the storefront's own origin. Override per app via
 // FontdueConfig.preview.endpoint (and mount the route to match).
-export const PREVIEW_ENDPOINT = '/api/preview';
+export const PREVIEW_ENDPOINT = '/api/preview';
+
+// Request header storefront fetches send to declare preview intent explicitly.
+// The GraphQL server reveals hidden (unpublished) fonts only when this is
+// "true" AND the request is an authenticated admin — so merely *being* logged
+// in (an admin session cookie riding a storefront fetch) never leaks hidden
+// fonts outside preview. "false" forces the public view even for an admin; an
+// absent header (older fontdue-js clients) keeps the legacy "any admin sees
+// hidden" behavior, so older integrations are unaffected. See the matching
+// server logic in FontageWeb.Schema.Context.
+export const PREVIEW_HEADER = 'fontdue-preview';
+
+// Whether the readable preview marker cookie is set on the current document.
+// Browser-only (guarded so it stays inert during server rendering): lets the
+// admin toolbar and the client-side Relay network layer tell that an admin is
+// actively previewing, so storefront fetches can send PREVIEW_HEADER "true"
+// while previewing and "false" otherwise.
+export function hasPreviewMarkerCookie() {
+  return typeof document !== 'undefined' && document.cookie.split('; ').some(c => c === `${PREVIEW_MARKER_COOKIE}=1`);
+}

package/dist/relay/environment.d.ts

@@ -1,4 +1,6 @@
 import { Environment, RequestParameters, QueryResponseCache, Variables, GraphQLResponse } from 'relay-runtime';
+export declare const version: string;
+export declare function fontdueBaseUrl(): string | undefined;
 export declare function createNetworkFetch(options?: CreateRelayEnvironmentOptions): (request: RequestParameters, variables: Variables) => Promise<GraphQLResponse>;
 export declare const networkFetch: (request: RequestParameters, variables: Variables) => Promise<GraphQLResponse>;
 export declare const responseCache: QueryResponseCache | null;

package/dist/relay/environment.js

@@ -1,10 +1,13 @@
 import { Environment, Network, RecordSource, Store, QueryResponseCache } from 'relay-runtime';
 import { handlePossibleCorsError } from '../corsError.js';
-import { getFontdueServerConfig } from './serverConfig.js';
+import { resolveFontdueServerConfig } from './serverConfig.js';
+import { PREVIEW_HEADER, hasPreviewMarkerCookie } from '../preview/constants.js';
 
 // `__FONTDUE_JS_VERSION__` is replaced by an inline babel plugin
 // (defineVersionPlugin in .babelrc.cjs) with the literal package.json#version.
-const version = "3.0.0-alpha11";
+// Exported so UI (the admin toolbar) can surface it without re-reading the
+// build-time global in a 'use client' module.
+export const version = "3.0.0-alpha13";
 const IS_SERVER = typeof window === typeof undefined;
 
 // Read env from either process.env (Node/Next.js) or import.meta.env (Vite/Astro).
@@ -36,51 +39,77 @@ const FONTDUE_URL = readEnv('FONTDUE_URL') ?? readEnv('NEXT_PUBLIC_FONTDUE_URL')
 const STRIPE_INTEGRATION = readEnv('FONTDUE_STRIPE_INTEGRATION') ?? readEnv('NEXT_PUBLIC_FONTDUE_STRIPE_INTEGRATION') ?? NEXT_PUBLIC_STRIPE;
 const CACHE_TTL = 10 * 1000; // 10 seconds, to resolve preloaded results
 
+// The configured Fontdue base URL resolved for the current runtime, or
+// undefined when it can't be determined (e.g. multi-tenant, where fetches go to
+// the page's own origin). The admin toolbar uses it to show where the admin is
+// signed in and to link back to the Fontdue admin.
+export function fontdueBaseUrl() {
+  return FONTDUE_URL || undefined;
+}
 export function createNetworkFetch(options) {
   return async function networkFetch(request, variables) {
-    // Per-render server config (set via setFontdueServerConfig or the
-    // FontdueProvider server entrypoint). Resolved per call, not per
-    // createNetworkFetch, because module-level fetchers outlive renders.
-    const serverConfig = IS_SERVER ? getFontdueServerConfig() : undefined;
+    // Per-render server config (the RSC slot set via setFontdueServerConfig /
+    // the FontdueProvider server entrypoint, the runWithPreview AsyncLocalStorage
+    // store, or the Next single-tenant ambient resolver). Awaited per call, not
+    // per createNetworkFetch, because module-level fetchers outlive renders — so
+    // an embedded component's own preload reveals hidden fonts in preview even
+    // on a page that never calls the app's GraphQL fetcher.
+    const serverConfig = IS_SERVER ? await resolveFontdueServerConfig() : undefined;
     const base = (options === null || options === void 0 ? void 0 : options.url) ?? (serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.url) ?? FONTDUE_URL;
     if (IS_SERVER && (base == null || base === '')) {
       throw new Error('fontdue-js: no Fontdue URL configured for server-side fetch. ' + 'Set FONTDUE_URL / PUBLIC_FONTDUE_URL / VITE_FONTDUE_URL in your environment, ' + 'pass `url` to loadSerializableQuery, or call setFontdueServerConfig ' + '(or render <FontdueProvider url=…>) earlier in the server render.');
     }
     const url = `${base ?? ''}/graphql`;
+    const headers = {
+      ...(serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.headers),
+      // Per-call headers (e.g. a preview Authorization: Bearer token passed to
+      // a preload helper) override the render-store headers.
+      ...(options === null || options === void 0 ? void 0 : options.headers),
+      Accept: 'application/json',
+      'Content-Type': 'application/json',
+      'fontdue-stripe-integration': (options === null || options === void 0 ? void 0 : options.stripeIntegration) ?? STRIPE_INTEGRATION ?? 'dynamic',
+      'fontdue-client-version': version
+    };
+
+    // Whether this request is an admin *preview*. On the server that's a
+    // forwarded admin token; in the browser it's the readable preview marker
+    // cookie — NOT a bare admin session cookie that happens to ride the fetch
+    // (that conflation was the leak: a logged-in admin browsing normally would
+    // see hidden fonts). It's sent explicitly as the `fontdue-preview` header so
+    // the GraphQL server reveals hidden (unpublished) fonts only in preview:
+    // "false" forces the public view even for a logged-in admin, and an absent
+    // header (older clients) keeps the legacy "any admin sees hidden" behavior.
+    const previewing = IS_SERVER ? headers.authorization != null || headers.Authorization != null : hasPreviewMarkerCookie();
+    headers[PREVIEW_HEADER] = previewing ? 'true' : 'false';
+
+    // Public server fetches are all site content (per-session data is fetched
+    // client-side only), so opt them into Next's data cache — without this,
+    // Next 15 treats them as no-store and silently makes every page fully
+    // dynamic. The tags let the revalidate handler purge them. A preview render,
+    // though, carries an admin Authorization token: those fetches must stay live
+    // and never be written to or served from the shared data cache (a public
+    // request could otherwise be handed the hidden-fonts response), so opt them
+    // out with no-store. Both hints are inert outside Next.
+    const init = {
+      method: 'POST',
+      credentials: 'include',
+      headers,
+      body: JSON.stringify({
+        query: request.text,
+        variables
+      })
+    };
+    if (IS_SERVER && previewing) {
+      init.cache = 'no-store';
+    } else if (IS_SERVER) {
+      init.cache = 'force-cache';
+      init.next = {
+        tags: ['graphql', ...((serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.cacheTags) ?? []), `operation:${request.name}`]
+      };
+    }
     for (let attempt = 0; attempt <= 2; attempt++) {
       try {
-        const resp = await fetch(url + `?queryName=${request.name}`, {
-          method: 'POST',
-          credentials: 'include',
-          headers: {
-            ...(serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.headers),
-            // Per-call headers (e.g. a preview Authorization: Bearer token
-            // passed to a preload helper) override the render-store headers.
-            ...(options === null || options === void 0 ? void 0 : options.headers),
-            Accept: 'application/json',
-            'Content-Type': 'application/json',
-            'fontdue-stripe-integration': (options === null || options === void 0 ? void 0 : options.stripeIntegration) ?? STRIPE_INTEGRATION ?? 'dynamic',
-            'fontdue-client-version': version
-          },
-          body: JSON.stringify({
-            query: request.text,
-            variables
-          }),
-          // Server-side fetches are all site content (per-session data is
-          // fetched client-side only), so opt them into Next's data cache —
-          // without this, Next 15 treats them as no-store and silently makes
-          // every page fully dynamic. The tags below let the revalidate
-          // handler purge them when content changes. Inert outside Next:
-          // Node's fetch accepts and ignores this cache mode, and the
-          // browser path doesn't set it.
-          ...(IS_SERVER ? {
-            cache: 'force-cache'
-          } : {}),
-          // @ts-ignore
-          next: {
-            tags: ['graphql', ...((serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.cacheTags) ?? []), `operation:${request.name}`]
-          }
-        });
+        const resp = await fetch(url + `?queryName=${request.name}`, init);
         const json = await resp.json();
 
         // GraphQL returns exceptions (for example, a missing required variable) in the "errors"

package/dist/relay/serverConfig.d.ts

@@ -7,13 +7,15 @@ export interface FontdueServerConfig {
     cacheTags?: string[];
     /**
      * The site domain this render is for, when known. Set by
-     * fontdue-js/next's prepareFontdueRender so render-scoped helpers
-     * (currentFontdueEndpoint) can recover it.
+     * fontdue-js/next's __prepareFontdueRender so render-scoped helpers
+     * (fontdueEndpoint) can recover it.
      */
     domain?: string;
 }
+type MaybePromise<T> = T | Promise<T>;
+type AmbientConfigResolver = () => MaybePromise<FontdueServerConfig | undefined>;
 export declare function setFontdueServerConfig(config: FontdueServerConfig): void;
-type AmbientConfigResolver = () => FontdueServerConfig | undefined;
 export declare function registerAmbientConfigResolver(resolver: AmbientConfigResolver): void;
-export declare function getFontdueServerConfig(): FontdueServerConfig | undefined;
+export declare function getFontdueSlotConfig(): FontdueServerConfig | undefined;
+export declare function resolveFontdueServerConfig(): Promise<FontdueServerConfig | undefined>;
 export {};