payload-live-preview 1.0.2 → 1.0.4

package/dist/adapters/nextjs/index.d.ts

@@ -15,10 +15,15 @@
  *     body because `NextResponse.next()` carries no body.
  *
  *   - `createLivePreviewMiddleware(options)` — merges CSP headers
- *     (`frame-ancestors`) onto preview responses. Its script-injection
- *     path only activates when you pass it a `Response` that actually
- *     carries an HTML body (custom servers, route handlers returning
- *     HTML) — in standard `middleware.ts` use `autoInject: false`.
+ *     (`frame-ancestors`) onto responses carrying preview intent. Its
+ *     script-injection path only activates when you pass it a
+ *     `Response` that actually carries an HTML body (custom servers,
+ *     route handlers returning HTML) — in standard `middleware.ts`
+ *     use `autoInject: false`.
+ *
+ * Preview intent is not authorization. Run application-owned server
+ * authentication first and use its result to gate draft data, cache
+ * policy, privileged headers, CSP changes, and script rendering.
  *
  * @module @adapters/nextjs
  */
@@ -32,14 +37,19 @@ interface LivePreviewNextOptions {
     readonly mergeDepth?: number;
     readonly autoInject?: boolean;
     /**
-     * `'preview-only'` (default) — inject only into responses that look
-     * like preview requests. `'always'` — every HTML response.
+     * `'preview-only'` (default) — inject only into responses carrying
+     * preview intent. The signals are client-controlled and do not
+     * authorize access. `'always'` — every HTML response.
      */
     readonly inject?: 'preview-only' | 'always';
-    /** Query params that mark a preview request. Default `['preview', 'draft', 'livePreview']`. */
+    /** Query params that signal preview intent. Default `['preview', 'draft', 'livePreview']`. */
     readonly previewQueryParams?: readonly string[];
-    /** Which signals count as a preview request. Default: query, fetch-dest, referer. */
+    /** Which signals count as preview intent. Default: query, fetch-dest, referer. */
     readonly previewSignals?: readonly ('query' | 'fetch-dest' | 'referer')[];
+    /**
+     * Synchronous route/content filter for script injection only. It is
+     * not authentication and does not suppress CSP handling.
+     */
     readonly shouldInject?: (request: Request) => boolean;
     /**
      * CSP management: `'frame-ancestors'` (default) merges only the
@@ -61,12 +71,16 @@ type NextMiddleware = (request: Request) => Promise<Response | undefined>;
 /**
  * Build a Next.js-compatible middleware operating on the standard
  * `Request` / `Response` pair. Wrap with `NextResponse.next()` in your
- * project to integrate with Next's request pipeline.
+ * project to integrate with Next's request pipeline. Invoke it only
+ * after application-owned authorization when its response mutations
+ * are privileged.
  */
 declare function createLivePreviewMiddleware(options?: LivePreviewNextOptions): (request: Request, response: Response) => Promise<Response>;
 /**
  * Render the live-preview `<script>` tag — for embedding manually in
- * App Router or Pages Router layouts.
+ * App Router or Pages Router layouts. Rendering must be gated by the
+ * application's verified preview authorization, not merely an intent
+ * query parameter.
  */
 declare function renderLivePreviewScript(options?: LivePreviewNextOptions & {
     readonly nonce?: string;