payload-live-preview 1.8.0 → 2.0.0-beta.0

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "payload-live-preview",
-  "version": "1.8.0",
+  "version": "2.0.0-beta.0",
   "description": "Live preview for Payload CMS in Astro and any SSR/static frontend (SvelteKit, Nuxt, Next.js, plain HTML). Patches the DOM live, no rebuild.",
   "author": "relative23",
   "license": "MIT",
   "type": "module",
-  "packageManager": "npm@11.16.0",
+  "packageManager": "npm@12.0.2",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -76,6 +76,12 @@
         "default": "./dist/doctor.js"
       }
     },
+    "./migrate": {
+      "import": {
+        "types": "./dist/migrate.d.ts",
+        "default": "./dist/migrate.js"
+      }
+    },
     "./payload": {
       "import": {
         "types": "./dist/payload.d.ts",
@@ -86,7 +92,68 @@
         "default": "./dist/payload.cjs"
       }
     },
+    "./server": {
+      "import": {
+        "types": "./dist/server.d.ts",
+        "default": "./dist/server.js"
+      },
+      "require": {
+        "types": "./dist/server.d.cts",
+        "default": "./dist/server.cjs"
+      }
+    },
+    "./client": {
+      "import": {
+        "types": "./dist/client.d.ts",
+        "default": "./dist/client.js"
+      },
+      "require": {
+        "types": "./dist/client.d.cts",
+        "default": "./dist/client.cjs"
+      }
+    },
+    "./structural": {
+      "import": {
+        "types": "./dist/structural.d.ts",
+        "default": "./dist/structural.js"
+      },
+      "require": {
+        "types": "./dist/structural.d.cts",
+        "default": "./dist/structural.cjs"
+      }
+    },
+    "./lexical": {
+      "import": {
+        "types": "./dist/lexical.d.ts",
+        "default": "./dist/lexical.js"
+      },
+      "require": {
+        "types": "./dist/lexical.d.cts",
+        "default": "./dist/lexical.cjs"
+      }
+    },
+    "./plugins": {
+      "import": {
+        "types": "./dist/plugins.d.ts",
+        "default": "./dist/plugins.js"
+      },
+      "require": {
+        "types": "./dist/plugins.d.cts",
+        "default": "./dist/plugins.cjs"
+      }
+    },
+    "./fragment": {
+      "import": {
+        "types": "./dist/fragment.d.ts",
+        "default": "./dist/fragment.js"
+      },
+      "require": {
+        "types": "./dist/fragment.d.cts",
+        "default": "./dist/fragment.cjs"
+      }
+    },
     "./astro/RichText.astro": "./dist/adapters/astro/RichText.astro",
+    "./astro/PreviewBoundary.astro": "./dist/adapters/astro/PreviewBoundary.astro",
     "./astro/middleware-entry": {
       "import": {
         "types": "./dist/adapters/astro/middleware-entry.d.ts",
@@ -106,25 +173,34 @@
   "sideEffects": false,
   "scripts": {
     "build:runtime": "tsx scripts/build-runtime.ts",
-    "build": "npm run build:runtime && tsx scripts/build-dist.ts && npm run build:assets && npm run test:bundle",
-    "build:assets": "node -e \"require('node:fs').copyFileSync('src/adapters/astro/RichText.astro','dist/adapters/astro/RichText.astro')\"",
+    "build": "npm run build:runtime && tsx scripts/build-dist.ts && npm run build:assets && npm run test:bundle && npm run test:treeshake && npm run test:edge",
+    "build:assets": "node -e \"const fs=require('node:fs');for(const f of ['RichText','PreviewBoundary'])fs.copyFileSync('src/adapters/astro/'+f+'.astro','dist/adapters/astro/'+f+'.astro')\"",
     "dev": "tsup --watch",
+    "pretest": "npm run build:runtime",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:unit": "vitest run tests/unit",
     "test:integration": "vitest run tests/integration",
     "test:e2e": "playwright test",
+    "check:fixtures": "tsx scripts/check-fixture-freshness.ts",
     "test:e2e:real-payload": "playwright test --config playwright.real-payload.config.ts",
     "test:a11y": "playwright test tests/e2e/specs/accessibility.spec.ts",
     "test:soak": "playwright test --config playwright.soak.config.ts",
+    "test:browser-bench": "playwright test --config playwright.bench.config.ts",
     "test:bench": "vitest bench tests/benchmarks",
     "test:bench:codspeed": "vitest bench --run --config vitest.bench.config.ts",
     "test:bundle": "tsx scripts/check-bundle-size.ts",
+    "test:treeshake": "tsx scripts/check-tree-shaking.ts",
+    "test:edge": "NODE_OPTIONS='--experimental-vm-modules --no-warnings' tsx scripts/check-edge-runtime.ts",
+    "compat:check": "tsx scripts/compat-table.ts --check",
+    "compat:write": "tsx scripts/compat-table.ts --write",
     "test:package": "tsx scripts/check-package.ts",
+    "audit:gate": "tsx scripts/audit-gate.ts",
+    "test:smoke": "tsx scripts/post-publish-smoke.ts",
     "test:coverage": "vitest run --coverage",
     "test:coverage:diff": "tsx scripts/coverage-policy.ts",
     "test:policy": "tsx scripts/test-policy.ts",
-    "test:architecture": "tsx scripts/architecture-policy.ts && tsx scripts/quality-workflow-policy.ts && knip --no-progress --treat-config-hints-as-errors",
+    "test:architecture": "tsx scripts/architecture-policy.ts && tsx scripts/workflow-contracts.ts && tsx scripts/docs-contracts.ts && knip --no-progress --treat-config-hints-as-errors",
     "test:property": "vitest run tests/unit/property",
     "test:mutation": "stryker run stryker.config.js",
     "test:mutation:policy:pr": "tsx scripts/mutation-policy.ts --policy quality/mutation-policy-pr.json --report test-results/stryker-pr.json",
@@ -141,7 +217,8 @@
     "prepublishOnly": "npm run build && npm run check && npm run format:check && npm run test:package",
     "changeset": "changeset",
     "version": "changeset version && tsx scripts/sync-lockfile-metadata.ts",
-    "release": "tsx scripts/publish-artifact.ts"
+    "release": "tsx scripts/publish-artifact.ts",
+    "test:docs": "tsx scripts/docs-contracts.ts"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.5",
@@ -171,7 +248,9 @@
     "tsx": "^4.23.12",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.67.0",
-    "vitest": "^4.1.10"
+    "vite": "^7.3.6",
+    "vitest": "^4.1.10",
+    "yaml": "^2.9.0"
   },
   "overrides": {
     "qs": "6.15.3",

package/dist/middleware-DD4Hwomt.d.ts

@@ -1,189 +0,0 @@
-/**
- * Public types for the Astro adapter.
- *
- * @module @adapters/astro/types
- */
-interface LivePreviewAstroOptions {
-    /**
-     * How the integration wires the preview:
-     *
-     *   - `'inline'` (default) — bake the runtime into every page at
-     *     build time. For `output: 'static'` projects.
-     *   - `'loader'` — inject a few hundred bytes that check the preview
-     *     context and fetch the runtime as a hashed, SRI-verified asset only
-     *     when it is one. Also for `output: 'static'`, and the better choice
-     *     there: `'inline'` charges every ordinary visitor ~21 KB gzip for a
-     *     feature only an editor uses.
-     *   - `'middleware'` — auto-register the preview middleware:
-     *     request-time injection into requests with preview intent,
-     *     plus `frame-ancestors` CSP management. For `output: 'server'`.
-     *     (`shouldInject` is unsupported here — options serialize into
-     *     the build.)
-     *
-     * Intent signals are not authorization. If either response change
-     * must be access-controlled, compose `createLivePreviewMiddleware()`
-     * manually after an application-owned server-side authorization.
-     */
-    readonly mode?: 'inline' | 'loader' | 'middleware';
-    /**
-     * Allowed Payload admin origin(s) for inbound browser messages and
-     * the optional Referer intent signal. This does not authenticate the
-     * incoming HTTP request or authorize draft access.
-     */
-    readonly allowedOrigins?: readonly string[];
-    /**
-     * Payload server origin, e.g. `https://cms.example.com`. When set,
-     * incoming updates are re-fetched through the Payload REST API so
-     * relationship/upload fields render populated instead of as bare
-     * IDs. Strongly recommended for Payload 3.x.
-     */
-    readonly serverURL?: string;
-    /** REST API route prefix used with `serverURL`. Defaults to `/api`. */
-    readonly apiRoute?: string;
-    /** Population depth used with `serverURL`. Defaults to `1`. */
-    readonly mergeDepth?: number;
-    /**
-     * Auto-inject the inline preview script. Default `true`. Disable to
-     * embed the script manually via `renderLivePreviewScript()`.
-     */
-    readonly autoInject?: boolean;
-    /**
-     * When the middleware injects the script (integration-based
-     * injection is always build-time and unaffected):
-     *
-     *   - `'preview-only'` (default) — only into responses carrying a
-     *     preview-intent signal (`?preview=true` / `?draft=true` query,
-     *     `Sec-Fetch-Dest: iframe`, or a referer from `allowedOrigins`).
-     *     These client-controlled signals are a delivery optimisation,
-     *     not authorization.
-     *   - `'always'` — into every HTML response.
-     */
-    readonly inject?: 'preview-only' | 'always';
-    /**
-     * Query parameters that mark a request as a preview (values `true`
-     * or `1`). Default: `['preview', 'draft', 'livePreview']`.
-     */
-    readonly previewQueryParams?: readonly string[];
-    /**
-     * Which signals count as preview intent. Default: all three
-     * (`query`, `fetch-dest`, `referer`). Restrict to `['query']` when
-     * an unsolicited iframe load must never trigger preview handling
-     * (e.g. sites that serve `frame-ancestors 'none'` and only allow
-     * preview via the explicit `?preview=true` URL).
-     */
-    readonly previewSignals?: readonly ('query' | 'fetch-dest' | 'referer')[];
-    /**
-     * Restrict script injection to requests where this function returns
-     * `true`. Applied on top of the `inject` mode. This is a synchronous
-     * route/content filter, not authentication, and it does not suppress
-     * the adapter's CSP handling. Perform authorization before invoking
-     * the middleware.
-     */
-    readonly shouldInject?: (request: Request) => boolean;
-    /**
-     * Content-Security-Policy management on responses carrying preview
-     * intent. The adapter does not authenticate those requests; invoke
-     * it only after authorization when this policy change is privileged:
-     *
-     *   - `'frame-ancestors'` (default) — merge a `frame-ancestors`
-     *     directive allowing the admin origins to embed the page.
-     *     Existing CSP directives are preserved (union merge).
-     *   - `'full'` — additionally manage `script-src` with a
-     *     per-request nonce. Only useful when your whole page is
-     *     nonce-disciplined; see `strictDynamic`.
-     *   - `false` — never touch CSP headers.
-     *
-     * `true` is accepted as a legacy alias for `'frame-ancestors'`.
-     */
-    readonly manageCsp?: boolean | 'frame-ancestors' | 'full';
-    /**
-     * Add `'strict-dynamic'` to the managed `script-src` (only with
-     * `manageCsp: 'full'`). ⚠️ Under CSP 3 this makes browsers ignore
-     * `'self'` and host sources — every script on the page must then
-     * carry the nonce or be loaded by a nonce-carrying script. Astro's
-     * own hydration scripts do NOT carry it, so leave this off unless
-     * you know your page is fully nonce-disciplined. Default `false`.
-     */
-    readonly strictDynamic?: boolean;
-    /**
-     * Extra `frame-ancestors` sources to merge with the auto-detected
-     * ones. Always includes `'self'` and every entry in `allowedOrigins`.
-     */
-    readonly frameAncestorsExtra?: readonly string[];
-    /**
-     * Extra `script-src` sources (e.g., a CDN) appended after the nonce
-     * (only with `manageCsp: 'full'`).
-     */
-    readonly scriptSrcExtra?: readonly string[];
-    /** Enable verbose debug logging in the injected client. Defaults to `false`. */
-    readonly debug?: boolean;
-    /**
-     * Debounce window for incoming updates. Default: 50 ms.
-     */
-    readonly debounceMs?: number;
-    /**
-     * Heartbeat timeout in ms. Default `0` (disabled — the Payload admin
-     * sends no keepalive, so an idle timeout would cause false
-     * disconnects).
-     */
-    readonly heartbeatMs?: number;
-}
-
-/**
- * Astro middleware for Payload Live Preview.
- *
- * Responsibilities (per request):
- *
- *   1. Generate a per-response CSP nonce and stash it on
- *      `Astro.locals.livePreviewNonce` so consumers can reference it.
- *   2. On requests carrying **preview intent** (see
- *      `isPreviewRequest`), rewrite the HTML response to inject the
- *      live-preview `<script>` tag.
- *   3. On those requests, merge `frame-ancestors` into the
- *      `Content-Security-Policy` header so the Payload admin may embed
- *      the page. Full `script-src` nonce management is opt-in via
- *      `manageCsp: 'full'`.
- *
- * The intent signals are client-controlled and this middleware does
- * not authenticate them. For protected preview responses, first verify
- * an application-owned server session or short-lived authorization,
- * then invoke this middleware with that same decision also governing
- * draft reads, credentials, and cache policy. `shouldInject` filters
- * script insertion only; it is not an authorization boundary and does
- * not disable CSP handling.
- *
- * Prerendered pages are skipped entirely: Astro runs middleware at
- * build time for those, where per-request nonces and response headers
- * are meaningless.
- *
- * @module @adapters/astro/middleware
- */
-
-type MiddlewareNext = () => Promise<Response>;
-interface MiddlewareContext {
-    readonly request: Request;
-    readonly locals: Record<string, unknown>;
-    /** Present in Astro ≥ 5: `true` while prerendering at build time. */
-    readonly isPrerendered?: boolean;
-}
-type LivePreviewMiddleware = (context: MiddlewareContext, next: MiddlewareNext) => Promise<Response>;
-/**
- * Key on `Astro.locals` carrying the request-scoped nonce. Consumers
- * can read `Astro.locals.livePreviewNonce` from `.astro` templates to
- * set the `nonce` attribute on their own scripts.
- */
-declare const NONCE_LOCALS_KEY = "livePreviewNonce";
-/**
- * Build the Astro-compatible middleware. Register it in
- * `src/middleware.ts`:
- *
- * ```ts
- * import { createLivePreviewMiddleware } from 'payload-live-preview/astro';
- * export const onRequest = createLivePreviewMiddleware({
- *   allowedOrigins: [import.meta.env.PUBLIC_PAYLOAD_ADMIN_ORIGIN],
- * });
- * ```
- */
-declare function createLivePreviewMiddleware(options?: LivePreviewAstroOptions): LivePreviewMiddleware;
-
-export { type LivePreviewAstroOptions as L, NONCE_LOCALS_KEY as N, type LivePreviewMiddleware as a, createLivePreviewMiddleware as c };