payload-live-preview 1.0.2 → 1.0.4

package/dist/{middleware-BwIlf0jW.d.cts → middleware-CkSeLZ-9.d.ts}

@@ -10,15 +10,20 @@ interface LivePreviewAstroOptions {
      *   - `'inline'` (default) — bake the runtime into every page at
      *     build time. For `output: 'static'` projects.
      *   - `'middleware'` — auto-register the preview middleware:
-     *     request-time injection into preview requests only, plus
-     *     `frame-ancestors` CSP management. For `output: 'server'`.
+     *     request-time injection into requests with preview intent,
+     *     plus `frame-ancestors` CSP management. For `output: 'server'`.
      *     (`shouldInject` is unsupported here — options serialize into
      *     the build.)
+     *
+     * Intent signals are not authorization. If either response change
+     * must be access-controlled, compose `createLivePreviewMiddleware()`
+     * manually after an application-owned server-side authorization.
      */
     readonly mode?: 'inline' | 'middleware';
     /**
-     * Trusted Payload admin origin(s). Required in production unless
-     * `document.referrer` reliably exposes the parent origin.
+     * Allowed Payload admin origin(s) for inbound browser messages and
+     * the optional Referer intent signal. This does not authenticate the
+     * incoming HTTP request or authorize draft access.
      */
     readonly allowedOrigins?: readonly string[];
     /**
@@ -41,10 +46,11 @@ interface LivePreviewAstroOptions {
      * When the middleware injects the script (integration-based
      * injection is always build-time and unaffected):
      *
-     *   - `'preview-only'` (default) — only into responses that look
-     *     like preview requests (`?preview=true` / `?draft=true` query,
+     *   - `'preview-only'` (default) — only into responses carrying a
+     *     preview-intent signal (`?preview=true` / `?draft=true` query,
      *     `Sec-Fetch-Dest: iframe`, or a referer from `allowedOrigins`).
-     *     Normal production traffic passes through untouched.
+     *     These client-controlled signals are a delivery optimisation,
+     *     not authorization.
      *   - `'always'` — into every HTML response.
      */
     readonly inject?: 'preview-only' | 'always';
@@ -54,7 +60,7 @@ interface LivePreviewAstroOptions {
      */
     readonly previewQueryParams?: readonly string[];
     /**
-     * Which signals count as a preview request. Default: all three
+     * Which signals count as preview intent. Default: all three
      * (`query`, `fetch-dest`, `referer`). Restrict to `['query']` when
      * an unsolicited iframe load must never trigger preview handling
      * (e.g. sites that serve `frame-ancestors 'none'` and only allow
@@ -62,12 +68,17 @@ interface LivePreviewAstroOptions {
      */
     readonly previewSignals?: readonly ('query' | 'fetch-dest' | 'referer')[];
     /**
-     * Restrict auto-inject to requests where this function returns
-     * `true`. Applied on top of the `inject` mode.
+     * Restrict script injection to requests where this function returns
+     * `true`. Applied on top of the `inject` mode. This is a synchronous
+     * route/content filter, not authentication, and it does not suppress
+     * the adapter's CSP handling. Perform authorization before invoking
+     * the middleware.
      */
     readonly shouldInject?: (request: Request) => boolean;
     /**
-     * Content-Security-Policy management on preview responses:
+     * Content-Security-Policy management on responses carrying preview
+     * intent. The adapter does not authenticate those requests; invoke
+     * it only after authorization when this policy change is privileged:
      *
      *   - `'frame-ancestors'` (default) — merge a `frame-ancestors`
      *     directive allowing the admin origins to embed the page.
@@ -99,9 +110,7 @@ interface LivePreviewAstroOptions {
      * (only with `manageCsp: 'full'`).
      */
     readonly scriptSrcExtra?: readonly string[];
-    /**
-     * Enable verbose debug logging in the injected client. Default: dev mode.
-     */
+    /** Enable verbose debug logging in the injected client. Defaults to `false`. */
     readonly debug?: boolean;
     /**
      * Debounce window for incoming updates. Default: 50 ms.
@@ -122,15 +131,22 @@ interface LivePreviewAstroOptions {
  *
  *   1. Generate a per-response CSP nonce and stash it on
  *      `Astro.locals.livePreviewNonce` so consumers can reference it.
- *   2. On **preview requests only** (see `isPreviewRequest`), rewrite
- *      the HTML response to inject the live-preview `<script>` tag.
- *      Normal production traffic streams through untouched — no
- *      buffering, no extra bytes.
- *   3. On preview requests, merge `frame-ancestors` into the
+ *   2. On requests carrying **preview intent** (see
+ *      `isPreviewRequest`), rewrite the HTML response to inject the
+ *      live-preview `<script>` tag.
+ *   3. On those requests, merge `frame-ancestors` into the
  *      `Content-Security-Policy` header so the Payload admin may embed
  *      the page. Full `script-src` nonce management is opt-in via
  *      `manageCsp: 'full'`.
  *
+ * The intent signals are client-controlled and this middleware does
+ * not authenticate them. For protected preview responses, first verify
+ * an application-owned server session or short-lived authorization,
+ * then invoke this middleware with that same decision also governing
+ * draft reads, credentials, and cache policy. `shouldInject` filters
+ * script insertion only; it is not an authorization boundary and does
+ * not disable CSP handling.
+ *
  * Prerendered pages are skipped entirely: Astro runs middleware at
  * build time for those, where per-request nonces and response headers
  * are meaningless.

package/dist/payload.cjs

@@ -1,31 +1,2 @@
-'use strict';
-
-// src/payload/index.ts
-function buildLivePreviewUrl(options) {
-  const base = options.baseUrl.replace(/\/+$/, "");
-  const fallback = options.fallback ?? "/";
-  const previewParam = options.previewParam === void 0 ? "preview" : options.previewParam;
-  return (args) => {
-    const locale = normaliseLocale(args.locale);
-    const context = { data: args.data, locale };
-    const resolver = (args.collectionConfig !== void 0 ? options.collections?.[args.collectionConfig.slug] : void 0) ?? (args.globalConfig !== void 0 ? options.globals?.[args.globalConfig.slug] : void 0);
-    let path = fallback;
-    if (resolver !== void 0) {
-      const resolved = typeof resolver === "function" ? resolver(context) : resolver;
-      if (resolved.length > 0) path = resolved;
-    }
-    if (!path.startsWith("/")) path = `/${path}`;
-    if (previewParam === null) return `${base}${path}`;
-    const separator = path.includes("?") ? "&" : "?";
-    return `${base}${path}${separator}${previewParam}=true`;
-  };
-}
-function normaliseLocale(locale) {
-  if (locale === void 0) return void 0;
-  if (typeof locale === "string") return locale.length > 0 ? locale : void 0;
-  return locale.code.length > 0 ? locale.code : void 0;
-}
-
-exports.buildLivePreviewUrl = buildLivePreviewUrl;
-//# sourceMappingURL=payload.cjs.map
+"use strict";var g=Object.defineProperty,o=(e,l)=>g(e,"name",{value:l,configurable:!0});function y(e){let l=e.baseUrl.replace(/\/+$/,""),o=e.fallback??"/",i=void 0===e.previewParam?"preview":e.previewParam;return t=>{let r=u(t.locale),n={data:t.data,locale:r},a=(void 0!==t.collectionConfig?e.collections?.[t.collectionConfig.slug]:void 0)??(void 0!==t.globalConfig?e.globals?.[t.globalConfig.slug]:void 0),c=o;if(void 0!==a){let e="function"==typeof a?a(n):a;e.length>0&&(c=e)}if(c.startsWith("/")||(c=`/${c}`),null===i)return`${l}${c}`;let v=c.includes("?")?"&":"?";return`${l}${c}${v}${i}=true`}}function u(e){if(void 0!==e)return"string"==typeof e?e.length>0?e:void 0:e.code.length>0?e.code:void 0}o(y,"buildLivePreviewUrl"),o(u,"normaliseLocale"),exports.buildLivePreviewUrl=y;
 //# sourceMappingURL=payload.cjs.map

package/dist/payload.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/payload/index.ts"],"names":[],"mappings":";;;AAmFO,SAAS,oBACd,OAAA,EACsC;AACtC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAC/C,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACrC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,YAAA,KAAiB,MAAA,GAAY,YAAY,OAAA,CAAQ,YAAA;AAE9E,EAAA,OAAO,CAAC,IAAA,KAAS;AACf,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,MAAM,OAAA,GAA+B,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,MAAA,EAAO;AAE/D,IAAA,MAAM,YACH,IAAA,CAAK,gBAAA,KAAqB,SACvB,OAAA,CAAQ,WAAA,GAAc,KAAK,gBAAA,CAAiB,IAAI,IAChD,MAAA,MACH,IAAA,CAAK,iBAAiB,MAAA,GAAY,OAAA,CAAQ,UAAU,IAAA,CAAK,YAAA,CAAa,IAAI,CAAA,GAAI,MAAA,CAAA;AAEjF,IAAA,IAAI,IAAA,GAAO,QAAA;AACX,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,WAAW,OAAO,QAAA,KAAa,UAAA,GAAa,QAAA,CAAS,OAAO,CAAA,GAAI,QAAA;AACtE,MAAA,IAAI,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,IAAA,GAAO,QAAA;AAAA,IAClC;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAE1C,IAAA,IAAI,iBAAiB,IAAA,EAAM,OAAO,CAAA,EAAG,IAAI,GAAG,IAAI,CAAA,CAAA;AAChD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAA;AAC7C,IAAA,OAAO,GAAG,IAAI,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,GAAG,YAAY,CAAA,KAAA,CAAA;AAAA,EAClD,CAAA;AACF;AAEA,SAAS,gBAAgB,MAAA,EAA0D;AACjF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,SAAiB,MAAA,CAAO,MAAA,GAAS,IAAI,MAAA,GAAS,MAAA;AACpE,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,MAAA,GAAS,CAAA,GAAI,OAAO,IAAA,GAAO,MAAA;AAChD","file":"payload.cjs","sourcesContent":["/**\n * Backend-side helpers for `payload.config.ts`.\n *\n * Payload's `admin.livePreview.url` callback maps the document being\n * edited to the frontend URL that should be shown in the preview\n * iframe. In practice every project hand-writes the same lookup-table\n * boilerplate (global → path, collection → localized route, fallback\n * when a new draft has no slug yet). `buildLivePreviewUrl` packages\n * that pattern.\n *\n * This module is dependency-free and framework-agnostic — it does not\n * import `payload`, it just produces a function with the documented\n * callback shape.\n *\n * ```ts\n * // payload.config.ts\n * import { buildLivePreviewUrl } from 'payload-live-preview/payload';\n *\n * admin: {\n *   livePreview: {\n *     url: buildLivePreviewUrl({\n *       baseUrl: process.env.FRONTEND_URL ?? 'http://localhost:4321',\n *       collections: {\n *         services: ({ data, locale }) => `/${locale}/services/${String(data.slug ?? '')}`,\n *         posts: ({ data }) => `/blog/${String(data.slug ?? '')}`,\n *       },\n *       globals: {\n *         homepage: '/',\n *         contact: ({ locale }) => `/${locale}/contact`,\n *       },\n *       fallback: '/',\n *     }),\n *     collections: ['services', 'posts'],\n *     globals: ['homepage', 'contact'],\n *   },\n * }\n * ```\n *\n * @module @payload\n */\n\n/** Arguments Payload passes to `admin.livePreview.url`. */\nexport interface LivePreviewUrlArgs {\n  readonly data: Record<string, unknown>;\n  readonly locale?: string | { readonly code: string };\n  readonly collectionConfig?: { readonly slug: string };\n  readonly globalConfig?: { readonly slug: string };\n  readonly [extra: string]: unknown;\n}\n\n/** Context handed to per-slug path resolvers. */\nexport interface PathResolverContext {\n  readonly data: Record<string, unknown>;\n  /** Normalised locale code (string), or `undefined`. */\n  readonly locale: string | undefined;\n}\n\nexport type PathResolver = string | ((context: PathResolverContext) => string);\n\nexport interface BuildLivePreviewUrlOptions {\n  /** Frontend origin, e.g. `https://site.example` (no trailing slash needed). */\n  readonly baseUrl: string;\n  /** Per-collection path resolvers keyed by collection slug. */\n  readonly collections?: Readonly<Record<string, PathResolver>>;\n  /** Per-global path resolvers keyed by global slug. */\n  readonly globals?: Readonly<Record<string, PathResolver>>;\n  /**\n   * Path used when no resolver matches, or when a resolver returns an\n   * empty string (e.g. a brand-new draft without a slug). Default `/`.\n   */\n  readonly fallback?: string;\n  /**\n   * Query parameter appended so the frontend can recognise the request\n   * as a preview (`isPreviewRequest` checks it). Set `null` to disable.\n   * Default `'preview'` → `?preview=true`.\n   */\n  readonly previewParam?: string | null;\n}\n\n/**\n * Build an `admin.livePreview.url` callback from declarative slug →\n * path mappings.\n */\nexport function buildLivePreviewUrl(\n  options: BuildLivePreviewUrlOptions,\n): (args: LivePreviewUrlArgs) => string {\n  const base = options.baseUrl.replace(/\\/+$/, '');\n  const fallback = options.fallback ?? '/';\n  const previewParam = options.previewParam === undefined ? 'preview' : options.previewParam;\n\n  return (args) => {\n    const locale = normaliseLocale(args.locale);\n    const context: PathResolverContext = { data: args.data, locale };\n\n    const resolver =\n      (args.collectionConfig !== undefined\n        ? options.collections?.[args.collectionConfig.slug]\n        : undefined) ??\n      (args.globalConfig !== undefined ? options.globals?.[args.globalConfig.slug] : undefined);\n\n    let path = fallback;\n    if (resolver !== undefined) {\n      const resolved = typeof resolver === 'function' ? resolver(context) : resolver;\n      if (resolved.length > 0) path = resolved;\n    }\n    if (!path.startsWith('/')) path = `/${path}`;\n\n    if (previewParam === null) return `${base}${path}`;\n    const separator = path.includes('?') ? '&' : '?';\n    return `${base}${path}${separator}${previewParam}=true`;\n  };\n}\n\nfunction normaliseLocale(locale: LivePreviewUrlArgs['locale']): string | undefined {\n  if (locale === undefined) return undefined;\n  if (typeof locale === 'string') return locale.length > 0 ? locale : undefined;\n  return locale.code.length > 0 ? locale.code : undefined;\n}\n"]}
+{"version":3,"file":"payload.cjs","names":["g","Object","defineProperty","o","e","t","value","configurable","buildLivePreviewUrl","options","base","baseUrl","replace","fallback","previewParam","args","locale","normaliseLocale","context","data","resolver","collectionConfig","collections","slug","globalConfig","globals","path","resolved","length","startsWith","separator","includes","code","__name","exports","y"],"sources":["../src/payload/index.ts"],"sourcesContent":["/**\n * Backend-side helpers for `payload.config.ts`.\n *\n * Payload's `admin.livePreview.url` callback maps the document being\n * edited to the frontend URL that should be shown in the preview\n * iframe. In practice every project hand-writes the same lookup-table\n * boilerplate (global → path, collection → localized route, fallback\n * when a new draft has no slug yet). `buildLivePreviewUrl` packages\n * that pattern.\n *\n * This module is dependency-free and framework-agnostic — it does not\n * import `payload`, it just produces a function with the documented\n * callback shape.\n *\n * ```ts\n * // payload.config.ts\n * import { buildLivePreviewUrl } from 'payload-live-preview/payload';\n *\n * admin: {\n *   livePreview: {\n *     url: buildLivePreviewUrl({\n *       baseUrl: process.env.FRONTEND_URL ?? 'http://localhost:4321',\n *       collections: {\n *         services: ({ data, locale }) => `/${locale}/services/${String(data.slug ?? '')}`,\n *         posts: ({ data }) => `/blog/${String(data.slug ?? '')}`,\n *       },\n *       globals: {\n *         homepage: '/',\n *         contact: ({ locale }) => `/${locale}/contact`,\n *       },\n *       fallback: '/',\n *     }),\n *     collections: ['services', 'posts'],\n *     globals: ['homepage', 'contact'],\n *   },\n * }\n * ```\n *\n * @module @payload\n */\n\n/** Arguments Payload passes to `admin.livePreview.url`. */\nexport interface LivePreviewUrlArgs {\n  readonly data: Record<string, unknown>;\n  readonly locale?: string | { readonly code: string };\n  readonly collectionConfig?: { readonly slug: string };\n  readonly globalConfig?: { readonly slug: string };\n  readonly [extra: string]: unknown;\n}\n\n/** Context handed to per-slug path resolvers. */\nexport interface PathResolverContext {\n  readonly data: Record<string, unknown>;\n  /** Normalised locale code (string), or `undefined`. */\n  readonly locale: string | undefined;\n}\n\nexport type PathResolver = string | ((context: PathResolverContext) => string);\n\nexport interface BuildLivePreviewUrlOptions {\n  /** Frontend origin, e.g. `https://site.example` (no trailing slash needed). */\n  readonly baseUrl: string;\n  /** Per-collection path resolvers keyed by collection slug. */\n  readonly collections?: Readonly<Record<string, PathResolver>>;\n  /** Per-global path resolvers keyed by global slug. */\n  readonly globals?: Readonly<Record<string, PathResolver>>;\n  /**\n   * Path used when no resolver matches, or when a resolver returns an\n   * empty string (e.g. a brand-new draft without a slug). Default `/`.\n   */\n  readonly fallback?: string;\n  /**\n   * Query parameter appended so the frontend can detect preview intent\n   * (`isPreviewRequest` checks it). This client-controlled signal does\n   * not authenticate or authorize draft access or response changes.\n   * Set `null` to disable. Default `'preview'` → `?preview=true`.\n   */\n  readonly previewParam?: string | null;\n}\n\n/**\n * Build an `admin.livePreview.url` callback from declarative slug →\n * path mappings.\n */\nexport function buildLivePreviewUrl(\n  options: BuildLivePreviewUrlOptions,\n): (args: LivePreviewUrlArgs) => string {\n  const base = options.baseUrl.replace(/\\/+$/, '');\n  const fallback = options.fallback ?? '/';\n  const previewParam = options.previewParam === undefined ? 'preview' : options.previewParam;\n\n  return (args) => {\n    const locale = normaliseLocale(args.locale);\n    const context: PathResolverContext = { data: args.data, locale };\n\n    const resolver =\n      (args.collectionConfig !== undefined\n        ? options.collections?.[args.collectionConfig.slug]\n        : undefined) ??\n      (args.globalConfig !== undefined ? options.globals?.[args.globalConfig.slug] : undefined);\n\n    let path = fallback;\n    if (resolver !== undefined) {\n      const resolved = typeof resolver === 'function' ? resolver(context) : resolver;\n      if (resolved.length > 0) path = resolved;\n    }\n    if (!path.startsWith('/')) path = `/${path}`;\n\n    if (previewParam === null) return `${base}${path}`;\n    const separator = path.includes('?') ? '&' : '?';\n    return `${base}${path}${separator}${previewParam}=true`;\n  };\n}\n\nfunction normaliseLocale(locale: LivePreviewUrlArgs['locale']): string | undefined {\n  if (locale === undefined) return undefined;\n  if (typeof locale === 'string') return locale.length > 0 ? locale : undefined;\n  return locale.code.length > 0 ? locale.code : undefined;\n}\n"],"mappings":"aAoFO,IAAAA,EAAAC,OAAAC,eAAAC,EAAA,CAAAC,EAAAC,IAAAL,EAAAI,EAAA,QAAAE,MAAAD,EAAAE,cAAA,aAASC,EACdC,GAEA,IAAMC,EAAOD,EAAQE,QAAQC,QAAQ,OAAQ,IACvCC,EAAWJ,EAAQI,UAAY,IAC/BC,OAAwC,IAAzBL,EAAQK,aAA6B,UAAYL,EAAQK,aAE9E,OAAQC,IACN,IAAMC,EAASC,EAAgBF,EAAKC,QAC9BE,EAA+B,CAAEC,KAAMJ,EAAKI,KAAMH,UAElDI,QACuB,IAA1BL,EAAKM,iBACFZ,EAAQa,cAAcP,EAAKM,iBAAiBE,WAC5C,UACmB,IAAtBR,EAAKS,aAA6Bf,EAAQgB,UAAUV,EAAKS,aAAaD,WAAQ,GAE7EG,EAAOb,EACX,QAAiB,IAAbO,EAAwB,CAC1B,IAAMO,EAA+B,mBAAbP,EAA0BA,EAASF,GAAWE,EAClEO,EAASC,OAAS,IAAGF,EAAOC,EAClC,CAGA,GAFKD,EAAKG,WAAW,OAAMH,EAAO,IAAIA,KAEjB,OAAjBZ,EAAuB,MAAO,GAAGJ,IAAOgB,IAC5C,IAAMI,EAAYJ,EAAKK,SAAS,KAAO,IAAM,IAC7C,MAAO,GAAGrB,IAAOgB,IAAOI,IAAYhB,SAExC,CAEA,SAASG,EAAgBD,GACvB,QAAe,IAAXA,EACJ,MAAsB,iBAAXA,EAA4BA,EAAOY,OAAS,EAAIZ,OAAS,EAC7DA,EAAOgB,KAAKJ,OAAS,EAAIZ,EAAOgB,UAAO,CAChD,CAlCgBC,EAAAzB,EAAA,uBA8BPyB,EAAAhB,EAAA,mBAAAiB,QAAA1B,oBAAA2B","ignoreList":[]}

package/dist/payload.d.cts

@@ -72,9 +72,10 @@ interface BuildLivePreviewUrlOptions {
      */
     readonly fallback?: string;
     /**
-     * Query parameter appended so the frontend can recognise the request
-     * as a preview (`isPreviewRequest` checks it). Set `null` to disable.
-     * Default `'preview'` → `?preview=true`.
+     * Query parameter appended so the frontend can detect preview intent
+     * (`isPreviewRequest` checks it). This client-controlled signal does
+     * not authenticate or authorize draft access or response changes.
+     * Set `null` to disable. Default `'preview'` → `?preview=true`.
      */
     readonly previewParam?: string | null;
 }

package/dist/payload.d.ts

@@ -72,9 +72,10 @@ interface BuildLivePreviewUrlOptions {
      */
     readonly fallback?: string;
     /**
-     * Query parameter appended so the frontend can recognise the request
-     * as a preview (`isPreviewRequest` checks it). Set `null` to disable.
-     * Default `'preview'` → `?preview=true`.
+     * Query parameter appended so the frontend can detect preview intent
+     * (`isPreviewRequest` checks it). This client-controlled signal does
+     * not authenticate or authorize draft access or response changes.
+     * Set `null` to disable. Default `'preview'` → `?preview=true`.
      */
     readonly previewParam?: string | null;
 }

package/dist/payload.js

@@ -1,29 +1,2 @@
-// src/payload/index.ts
-function buildLivePreviewUrl(options) {
-  const base = options.baseUrl.replace(/\/+$/, "");
-  const fallback = options.fallback ?? "/";
-  const previewParam = options.previewParam === void 0 ? "preview" : options.previewParam;
-  return (args) => {
-    const locale = normaliseLocale(args.locale);
-    const context = { data: args.data, locale };
-    const resolver = (args.collectionConfig !== void 0 ? options.collections?.[args.collectionConfig.slug] : void 0) ?? (args.globalConfig !== void 0 ? options.globals?.[args.globalConfig.slug] : void 0);
-    let path = fallback;
-    if (resolver !== void 0) {
-      const resolved = typeof resolver === "function" ? resolver(context) : resolver;
-      if (resolved.length > 0) path = resolved;
-    }
-    if (!path.startsWith("/")) path = `/${path}`;
-    if (previewParam === null) return `${base}${path}`;
-    const separator = path.includes("?") ? "&" : "?";
-    return `${base}${path}${separator}${previewParam}=true`;
-  };
-}
-function normaliseLocale(locale) {
-  if (locale === void 0) return void 0;
-  if (typeof locale === "string") return locale.length > 0 ? locale : void 0;
-  return locale.code.length > 0 ? locale.code : void 0;
-}
-
-export { buildLivePreviewUrl };
-//# sourceMappingURL=payload.js.map
+var e=Object.defineProperty,l=(l,i)=>e(l,"name",{value:i,configurable:!0});function i(e){let l=e.baseUrl.replace(/\/+$/,""),i=e.fallback??"/",t=void 0===e.previewParam?"preview":e.previewParam;return r=>{let n=o(r.locale),a={data:r.data,locale:n},c=(void 0!==r.collectionConfig?e.collections?.[r.collectionConfig.slug]:void 0)??(void 0!==r.globalConfig?e.globals?.[r.globalConfig.slug]:void 0),v=i;if(void 0!==c){let e="function"==typeof c?c(a):c;e.length>0&&(v=e)}if(v.startsWith("/")||(v=`/${v}`),null===t)return`${l}${v}`;let d=v.includes("?")?"&":"?";return`${l}${v}${d}${t}=true`}}function o(e){if(void 0!==e)return"string"==typeof e?e.length>0?e:void 0:e.code.length>0?e.code:void 0}l(i,"buildLivePreviewUrl"),l(o,"normaliseLocale");export{i as buildLivePreviewUrl};
 //# sourceMappingURL=payload.js.map

package/dist/payload.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/payload/index.ts"],"names":[],"mappings":";AAmFO,SAAS,oBACd,OAAA,EACsC;AACtC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAC/C,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACrC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,YAAA,KAAiB,MAAA,GAAY,YAAY,OAAA,CAAQ,YAAA;AAE9E,EAAA,OAAO,CAAC,IAAA,KAAS;AACf,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,MAAM,OAAA,GAA+B,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,MAAA,EAAO;AAE/D,IAAA,MAAM,YACH,IAAA,CAAK,gBAAA,KAAqB,SACvB,OAAA,CAAQ,WAAA,GAAc,KAAK,gBAAA,CAAiB,IAAI,IAChD,MAAA,MACH,IAAA,CAAK,iBAAiB,MAAA,GAAY,OAAA,CAAQ,UAAU,IAAA,CAAK,YAAA,CAAa,IAAI,CAAA,GAAI,MAAA,CAAA;AAEjF,IAAA,IAAI,IAAA,GAAO,QAAA;AACX,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,WAAW,OAAO,QAAA,KAAa,UAAA,GAAa,QAAA,CAAS,OAAO,CAAA,GAAI,QAAA;AACtE,MAAA,IAAI,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG,IAAA,GAAO,QAAA;AAAA,IAClC;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAE1C,IAAA,IAAI,iBAAiB,IAAA,EAAM,OAAO,CAAA,EAAG,IAAI,GAAG,IAAI,CAAA,CAAA;AAChD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAA;AAC7C,IAAA,OAAO,GAAG,IAAI,CAAA,EAAG,IAAI,CAAA,EAAG,SAAS,GAAG,YAAY,CAAA,KAAA,CAAA;AAAA,EAClD,CAAA;AACF;AAEA,SAAS,gBAAgB,MAAA,EAA0D;AACjF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,SAAiB,MAAA,CAAO,MAAA,GAAS,IAAI,MAAA,GAAS,MAAA;AACpE,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,MAAA,GAAS,CAAA,GAAI,OAAO,IAAA,GAAO,MAAA;AAChD","file":"payload.js","sourcesContent":["/**\n * Backend-side helpers for `payload.config.ts`.\n *\n * Payload's `admin.livePreview.url` callback maps the document being\n * edited to the frontend URL that should be shown in the preview\n * iframe. In practice every project hand-writes the same lookup-table\n * boilerplate (global → path, collection → localized route, fallback\n * when a new draft has no slug yet). `buildLivePreviewUrl` packages\n * that pattern.\n *\n * This module is dependency-free and framework-agnostic — it does not\n * import `payload`, it just produces a function with the documented\n * callback shape.\n *\n * ```ts\n * // payload.config.ts\n * import { buildLivePreviewUrl } from 'payload-live-preview/payload';\n *\n * admin: {\n *   livePreview: {\n *     url: buildLivePreviewUrl({\n *       baseUrl: process.env.FRONTEND_URL ?? 'http://localhost:4321',\n *       collections: {\n *         services: ({ data, locale }) => `/${locale}/services/${String(data.slug ?? '')}`,\n *         posts: ({ data }) => `/blog/${String(data.slug ?? '')}`,\n *       },\n *       globals: {\n *         homepage: '/',\n *         contact: ({ locale }) => `/${locale}/contact`,\n *       },\n *       fallback: '/',\n *     }),\n *     collections: ['services', 'posts'],\n *     globals: ['homepage', 'contact'],\n *   },\n * }\n * ```\n *\n * @module @payload\n */\n\n/** Arguments Payload passes to `admin.livePreview.url`. */\nexport interface LivePreviewUrlArgs {\n  readonly data: Record<string, unknown>;\n  readonly locale?: string | { readonly code: string };\n  readonly collectionConfig?: { readonly slug: string };\n  readonly globalConfig?: { readonly slug: string };\n  readonly [extra: string]: unknown;\n}\n\n/** Context handed to per-slug path resolvers. */\nexport interface PathResolverContext {\n  readonly data: Record<string, unknown>;\n  /** Normalised locale code (string), or `undefined`. */\n  readonly locale: string | undefined;\n}\n\nexport type PathResolver = string | ((context: PathResolverContext) => string);\n\nexport interface BuildLivePreviewUrlOptions {\n  /** Frontend origin, e.g. `https://site.example` (no trailing slash needed). */\n  readonly baseUrl: string;\n  /** Per-collection path resolvers keyed by collection slug. */\n  readonly collections?: Readonly<Record<string, PathResolver>>;\n  /** Per-global path resolvers keyed by global slug. */\n  readonly globals?: Readonly<Record<string, PathResolver>>;\n  /**\n   * Path used when no resolver matches, or when a resolver returns an\n   * empty string (e.g. a brand-new draft without a slug). Default `/`.\n   */\n  readonly fallback?: string;\n  /**\n   * Query parameter appended so the frontend can recognise the request\n   * as a preview (`isPreviewRequest` checks it). Set `null` to disable.\n   * Default `'preview'` → `?preview=true`.\n   */\n  readonly previewParam?: string | null;\n}\n\n/**\n * Build an `admin.livePreview.url` callback from declarative slug →\n * path mappings.\n */\nexport function buildLivePreviewUrl(\n  options: BuildLivePreviewUrlOptions,\n): (args: LivePreviewUrlArgs) => string {\n  const base = options.baseUrl.replace(/\\/+$/, '');\n  const fallback = options.fallback ?? '/';\n  const previewParam = options.previewParam === undefined ? 'preview' : options.previewParam;\n\n  return (args) => {\n    const locale = normaliseLocale(args.locale);\n    const context: PathResolverContext = { data: args.data, locale };\n\n    const resolver =\n      (args.collectionConfig !== undefined\n        ? options.collections?.[args.collectionConfig.slug]\n        : undefined) ??\n      (args.globalConfig !== undefined ? options.globals?.[args.globalConfig.slug] : undefined);\n\n    let path = fallback;\n    if (resolver !== undefined) {\n      const resolved = typeof resolver === 'function' ? resolver(context) : resolver;\n      if (resolved.length > 0) path = resolved;\n    }\n    if (!path.startsWith('/')) path = `/${path}`;\n\n    if (previewParam === null) return `${base}${path}`;\n    const separator = path.includes('?') ? '&' : '?';\n    return `${base}${path}${separator}${previewParam}=true`;\n  };\n}\n\nfunction normaliseLocale(locale: LivePreviewUrlArgs['locale']): string | undefined {\n  if (locale === undefined) return undefined;\n  if (typeof locale === 'string') return locale.length > 0 ? locale : undefined;\n  return locale.code.length > 0 ? locale.code : undefined;\n}\n"]}
+{"version":3,"file":"payload.js","names":["g","Object","defineProperty","o","e","t","value","configurable","buildLivePreviewUrl","options","base","baseUrl","replace","fallback","previewParam","args","locale","normaliseLocale","context","data","resolver","collectionConfig","collections","slug","globalConfig","globals","path","resolved","length","startsWith","separator","includes","code","__name","y"],"sources":["../src/payload/index.ts"],"sourcesContent":["/**\n * Backend-side helpers for `payload.config.ts`.\n *\n * Payload's `admin.livePreview.url` callback maps the document being\n * edited to the frontend URL that should be shown in the preview\n * iframe. In practice every project hand-writes the same lookup-table\n * boilerplate (global → path, collection → localized route, fallback\n * when a new draft has no slug yet). `buildLivePreviewUrl` packages\n * that pattern.\n *\n * This module is dependency-free and framework-agnostic — it does not\n * import `payload`, it just produces a function with the documented\n * callback shape.\n *\n * ```ts\n * // payload.config.ts\n * import { buildLivePreviewUrl } from 'payload-live-preview/payload';\n *\n * admin: {\n *   livePreview: {\n *     url: buildLivePreviewUrl({\n *       baseUrl: process.env.FRONTEND_URL ?? 'http://localhost:4321',\n *       collections: {\n *         services: ({ data, locale }) => `/${locale}/services/${String(data.slug ?? '')}`,\n *         posts: ({ data }) => `/blog/${String(data.slug ?? '')}`,\n *       },\n *       globals: {\n *         homepage: '/',\n *         contact: ({ locale }) => `/${locale}/contact`,\n *       },\n *       fallback: '/',\n *     }),\n *     collections: ['services', 'posts'],\n *     globals: ['homepage', 'contact'],\n *   },\n * }\n * ```\n *\n * @module @payload\n */\n\n/** Arguments Payload passes to `admin.livePreview.url`. */\nexport interface LivePreviewUrlArgs {\n  readonly data: Record<string, unknown>;\n  readonly locale?: string | { readonly code: string };\n  readonly collectionConfig?: { readonly slug: string };\n  readonly globalConfig?: { readonly slug: string };\n  readonly [extra: string]: unknown;\n}\n\n/** Context handed to per-slug path resolvers. */\nexport interface PathResolverContext {\n  readonly data: Record<string, unknown>;\n  /** Normalised locale code (string), or `undefined`. */\n  readonly locale: string | undefined;\n}\n\nexport type PathResolver = string | ((context: PathResolverContext) => string);\n\nexport interface BuildLivePreviewUrlOptions {\n  /** Frontend origin, e.g. `https://site.example` (no trailing slash needed). */\n  readonly baseUrl: string;\n  /** Per-collection path resolvers keyed by collection slug. */\n  readonly collections?: Readonly<Record<string, PathResolver>>;\n  /** Per-global path resolvers keyed by global slug. */\n  readonly globals?: Readonly<Record<string, PathResolver>>;\n  /**\n   * Path used when no resolver matches, or when a resolver returns an\n   * empty string (e.g. a brand-new draft without a slug). Default `/`.\n   */\n  readonly fallback?: string;\n  /**\n   * Query parameter appended so the frontend can detect preview intent\n   * (`isPreviewRequest` checks it). This client-controlled signal does\n   * not authenticate or authorize draft access or response changes.\n   * Set `null` to disable. Default `'preview'` → `?preview=true`.\n   */\n  readonly previewParam?: string | null;\n}\n\n/**\n * Build an `admin.livePreview.url` callback from declarative slug →\n * path mappings.\n */\nexport function buildLivePreviewUrl(\n  options: BuildLivePreviewUrlOptions,\n): (args: LivePreviewUrlArgs) => string {\n  const base = options.baseUrl.replace(/\\/+$/, '');\n  const fallback = options.fallback ?? '/';\n  const previewParam = options.previewParam === undefined ? 'preview' : options.previewParam;\n\n  return (args) => {\n    const locale = normaliseLocale(args.locale);\n    const context: PathResolverContext = { data: args.data, locale };\n\n    const resolver =\n      (args.collectionConfig !== undefined\n        ? options.collections?.[args.collectionConfig.slug]\n        : undefined) ??\n      (args.globalConfig !== undefined ? options.globals?.[args.globalConfig.slug] : undefined);\n\n    let path = fallback;\n    if (resolver !== undefined) {\n      const resolved = typeof resolver === 'function' ? resolver(context) : resolver;\n      if (resolved.length > 0) path = resolved;\n    }\n    if (!path.startsWith('/')) path = `/${path}`;\n\n    if (previewParam === null) return `${base}${path}`;\n    const separator = path.includes('?') ? '&' : '?';\n    return `${base}${path}${separator}${previewParam}=true`;\n  };\n}\n\nfunction normaliseLocale(locale: LivePreviewUrlArgs['locale']): string | undefined {\n  if (locale === undefined) return undefined;\n  if (typeof locale === 'string') return locale.length > 0 ? locale : undefined;\n  return locale.code.length > 0 ? locale.code : undefined;\n}\n"],"mappings":"AAoFO,IAAAA,EAAAC,OAAAC,eAAAC,EAAA,CAAAC,EAAAC,IAAAL,EAAAI,EAAA,QAAAE,MAAAD,EAAAE,cAAA,aAASC,EACdC,GAEA,IAAMC,EAAOD,EAAQE,QAAQC,QAAQ,OAAQ,IACvCC,EAAWJ,EAAQI,UAAY,IAC/BC,OAAwC,IAAzBL,EAAQK,aAA6B,UAAYL,EAAQK,aAE9E,OAAQC,IACN,IAAMC,EAASC,EAAgBF,EAAKC,QAC9BE,EAA+B,CAAEC,KAAMJ,EAAKI,KAAMH,UAElDI,QACuB,IAA1BL,EAAKM,iBACFZ,EAAQa,cAAcP,EAAKM,iBAAiBE,WAC5C,UACmB,IAAtBR,EAAKS,aAA6Bf,EAAQgB,UAAUV,EAAKS,aAAaD,WAAQ,GAE7EG,EAAOb,EACX,QAAiB,IAAbO,EAAwB,CAC1B,IAAMO,EAA+B,mBAAbP,EAA0BA,EAASF,GAAWE,EAClEO,EAASC,OAAS,IAAGF,EAAOC,EAClC,CAGA,GAFKD,EAAKG,WAAW,OAAMH,EAAO,IAAIA,KAEjB,OAAjBZ,EAAuB,MAAO,GAAGJ,IAAOgB,IAC5C,IAAMI,EAAYJ,EAAKK,SAAS,KAAO,IAAM,IAC7C,MAAO,GAAGrB,IAAOgB,IAAOI,IAAYhB,SAExC,CAEA,SAASG,EAAgBD,GACvB,QAAe,IAAXA,EACJ,MAAsB,iBAAXA,EAA4BA,EAAOY,OAAS,EAAIZ,OAAS,EAC7DA,EAAOgB,KAAKJ,OAAS,EAAIZ,EAAOgB,UAAO,CAChD,CAlCgBC,EAAAzB,EAAA,uBA8BPyB,EAAAhB,EAAA,0BAAAiB","ignoreList":[]}

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "payload-live-preview",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Live preview for Payload CMS in Astro and any SSR/static frontend (SvelteKit, Nuxt, Next.js, plain HTML). Patches the DOM live, no rebuild.",
   "author": "relative23",
   "license": "MIT",
   "type": "module",
+  "packageManager": "npm@11.16.0",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -97,9 +98,8 @@
   ],
   "sideEffects": false,
   "scripts": {
-    "prepare": "npm run build:runtime",
     "build:runtime": "tsx scripts/build-runtime.ts",
-    "build": "npm run build:runtime && tsup && npm run build:assets",
+    "build": "npm run build:runtime && tsx scripts/build-dist.ts && npm run build:assets && npm run test:bundle",
     "build:assets": "node -e \"require('node:fs').copyFileSync('src/adapters/astro/RichText.astro','dist/adapters/astro/RichText.astro')\"",
     "dev": "tsup --watch",
     "test": "vitest run",
@@ -107,37 +107,76 @@
     "test:unit": "vitest run tests/unit",
     "test:integration": "vitest run tests/integration",
     "test:e2e": "playwright test",
+    "test:e2e:real-payload": "playwright test --config playwright.real-payload.config.ts",
+    "test:a11y": "playwright test tests/e2e/specs/accessibility.spec.ts",
+    "test:soak": "playwright test --config playwright.soak.config.ts",
     "test:bench": "vitest bench tests/benchmarks",
+    "test:bench:codspeed": "vitest bench --run --config vitest.bench.config.ts",
+    "test:bundle": "tsx scripts/check-bundle-size.ts",
+    "test:package": "tsx scripts/check-package.ts",
     "test:coverage": "vitest run --coverage",
+    "test:coverage:diff": "tsx scripts/coverage-policy.ts",
+    "test:policy": "tsx scripts/test-policy.ts",
+    "test:architecture": "tsx scripts/architecture-policy.ts && tsx scripts/quality-workflow-policy.ts && knip --no-progress --treat-config-hints-as-errors",
+    "test:property": "vitest run tests/unit/property",
+    "test:mutation": "stryker run stryker.config.js",
+    "test:mutation:policy:pr": "tsx scripts/mutation-policy.ts --policy quality/mutation-policy-pr.json --report test-results/stryker-pr.json",
+    "test:mutation:policy": "tsx scripts/mutation-policy.ts",
+    "test:leak": "node --expose-gc --import tsx scripts/leak-soak.ts",
+    "test:leak:quick": "node --expose-gc --import tsx scripts/leak-soak.ts --quick",
+    "api:update": "npm run build && tsx scripts/check-package.ts --update-api-reports",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",
-    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\"",
-    "check": "npm run typecheck && npm run lint && npm run test",
-    "prepublishOnly": "npm run check && npm run build",
+    "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.ts\" \"*.{js,cjs,mjs,ts,json,jsonc,yml,yaml,md}\" \"quality/**/*.json\" \"docs/**/*.md\" \"type-tests/**/*.md\" \".prettierrc.json\" \".changeset/*.{json,md}\" \".github/**/*.{yml,yaml,json}\" \"examples/**/*.{ts,tsx,js,cjs,mjs,json}\" && prettier --write \"type-tests/packed/*.fixture\" --parser typescript",
+    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.ts\" \"*.{js,cjs,mjs,ts,json,jsonc,yml,yaml,md}\" \"quality/**/*.json\" \"docs/**/*.md\" \"type-tests/**/*.md\" \".prettierrc.json\" \".changeset/*.{json,md}\" \".github/**/*.{yml,yaml,json}\" \"examples/**/*.{ts,tsx,js,cjs,mjs,json}\" && prettier --check \"type-tests/packed/*.fixture\" --parser typescript",
+    "check": "npm run typecheck && npm run lint && npm run test:policy && npm run test:architecture && npm run test",
+    "prepublishOnly": "npm run build && npm run check && npm run format:check && npm run test:package",
     "changeset": "changeset",
     "version": "changeset version",
-    "release": "npm run build && changeset publish"
+    "release": "tsx scripts/publish-artifact.ts"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.31.0",
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@axe-core/playwright": "^4.13.0",
+    "@changesets/cli": "^2.31.1",
+    "@codspeed/vitest-plugin": "^5.7.1",
     "@eslint/js": "^10.0.1",
-    "@playwright/test": "^1.61.1",
+    "@fast-check/vitest": "^0.4.1",
+    "@microsoft/api-extractor": "^7.58.12",
+    "@playwright/test": "^1.62.1",
+    "@stryker-mutator/core": "^9.6.1",
+    "@stryker-mutator/vitest-runner": "^9.6.1",
+    "@types/jsdom": "^30.0.0",
     "@types/node": "^22.20.1",
     "@vitest/coverage-v8": "^4.1.10",
-    "esbuild": "^0.28.1",
-    "eslint": "^10.7.0",
-    "globals": "^17.7.0",
+    "esbuild": "^0.28.2",
+    "eslint": "^10.8.1",
+    "fast-check": "^4.9.0",
+    "globals": "^17.11.0",
     "jsdom": "^29.1.1",
-    "prettier": "^3.9.5",
+    "knip": "^6.32.2",
+    "prettier": "^3.9.6",
+    "publint": "^0.3.23",
+    "terser": "^5.46.1",
     "ts-morph": "^28.0.0",
     "tsup": "^8.5.1",
-    "tsx": "^4.23.0",
+    "tsx": "^4.23.12",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.63.0",
+    "typescript-eslint": "^8.67.0",
     "vitest": "^4.1.10"
   },
+  "overrides": {
+    "qs": "6.15.3",
+    "tsup": {
+      "esbuild": "0.28.2"
+    }
+  },
+  "allowScripts": {
+    "esbuild@0.28.2": true,
+    "fsevents@2.3.2": false,
+    "fsevents@2.3.3": false
+  },
   "keywords": [
     "astro",
     "astro-payload",