payload-live-preview 1.8.0 → 2.0.0-beta.0

package/dist/adapters/nextjs/index.d.ts

@@ -1,89 +1,22 @@
+import { b as PreviewAdapterOptions } from '../../options-CEzzfHJu.js';
+
 /**
- * Next.js adapter for Payload Live Preview.
- *
- * ⚠️ Scope: this package patches server-rendered/static DOM. For
- * client-rendered React trees prefer the official
- * `@payloadcms/live-preview-react` (`useLivePreview`) — React
- * re-renders can revert DOM patches made here.
- *
- * Provides:
- *
- *   - `renderLivePreviewScript(options)` / `generateInlineScript` —
- *     embed the script in your root layout via
- *     `<script dangerouslySetInnerHTML>`. This is the PRIMARY wiring
- *     for Next.js: standard middleware cannot inject into the HTML
- *     body because `NextResponse.next()` carries no body.
- *
- *   - `createLivePreviewMiddleware(options)` — merges CSP headers
- *     (`frame-ancestors`) onto responses carrying preview intent. Its
- *     script-injection path only activates when you pass it a
- *     `Response` that actually carries an HTML body (custom servers,
- *     route handlers returning HTML) — in standard `middleware.ts`
- *     use `autoInject: false`.
- *
- * Preview intent is not authorization. Run application-owned server
- * authentication first and use its result to gate draft data, cache
- * policy, privileged headers, CSP changes, and script rendering.
- *
- * @module @adapters/nextjs
+ * Next.js adapter. `renderLivePreviewScript()` in the root layout is the
+ * primary wiring: `NextResponse.next()` carries no body, so the middleware
+ * only injects into responses that actually carry HTML.
  */
-interface LivePreviewNextOptions {
-    readonly allowedOrigins?: readonly string[];
-    /** Payload server origin for REST data merging (Payload 3.x). */
-    readonly serverURL?: string;
-    /** REST API route prefix used with `serverURL`. Defaults to `/api`. */
-    readonly apiRoute?: string;
-    /** Population depth used with `serverURL`. Defaults to `1`. */
-    readonly mergeDepth?: number;
-    readonly autoInject?: boolean;
-    /**
-     * `'preview-only'` (default) — inject only into responses carrying
-     * preview intent. The signals are client-controlled and do not
-     * authorize access. `'always'` — every HTML response.
-     */
-    readonly inject?: 'preview-only' | 'always';
-    /** Query params that signal preview intent. Default `['preview', 'draft', 'livePreview']`. */
-    readonly previewQueryParams?: readonly string[];
-    /** Which signals count as preview intent. Default: query, fetch-dest, referer. */
-    readonly previewSignals?: readonly ('query' | 'fetch-dest' | 'referer')[];
-    /**
-     * Synchronous route/content filter for script injection only. It is
-     * not authentication and does not suppress CSP handling.
-     */
-    readonly shouldInject?: (request: Request) => boolean;
-    /**
-     * CSP management: `'frame-ancestors'` (default) merges only the
-     * embed permission; `'full'` also manages a nonce'd `script-src`;
-     * `false` never touches CSP. `true` is a legacy alias for
-     * `'frame-ancestors'`.
-     */
-    readonly manageCsp?: boolean | 'frame-ancestors' | 'full';
-    /** Add `'strict-dynamic'` to the managed `script-src`. Default `false`. */
-    readonly strictDynamic?: boolean;
-    readonly frameAncestorsExtra?: readonly string[];
-    readonly scriptSrcExtra?: readonly string[];
-    readonly debug?: boolean;
-    readonly debounceMs?: number;
-    /** Heartbeat timeout in ms. Default `0` (disabled). */
-    readonly heartbeatMs?: number;
-}
-type NextMiddleware = (request: Request) => Promise<Response | undefined>;
+
+type LivePreviewNextOptions = PreviewAdapterOptions;
 /**
- * Build a Next.js-compatible middleware operating on the standard
- * `Request` / `Response` pair. Wrap with `NextResponse.next()` in your
- * project to integrate with Next's request pipeline. Invoke it only
- * after application-owned authorization when its response mutations
- * are privileged.
+ * Middleware over the standard `Request`/`Response` pair: on preview intent it
+ * authorizes, injects, merges CSP and marks the response uncacheable. Next.js
+ * middleware has no `locals`, so the verdict is not published — call
+ * `authorizePreviewRequest()` in the route when a page needs it.
  */
 declare function createLivePreviewMiddleware(options?: LivePreviewNextOptions): (request: Request, response: Response) => Promise<Response>;
-/**
- * Render the live-preview `<script>` tag — for embedding manually in
- * App Router or Pages Router layouts. Rendering must be gated by the
- * application's verified preview authorization, not merely an intent
- * query parameter.
- */
+/** The `<script>` tag for `app/layout.tsx`; pass the nonce your CSP uses. */
 declare function renderLivePreviewScript(options?: LivePreviewNextOptions & {
     readonly nonce?: string;
 }): string;
 
-export { type LivePreviewNextOptions, type NextMiddleware, createLivePreviewMiddleware, renderLivePreviewScript };
+export { type LivePreviewNextOptions, PreviewAdapterOptions, createLivePreviewMiddleware, renderLivePreviewScript };