payload-live-preview 2.0.0-beta.0 → 2.0.0

package/dist/adapters/astro/PreviewBoundary.astro

@@ -24,8 +24,8 @@
  * ```
  *
  * `data-payload-strategy="patch"` is written explicitly: the wrapper is a
- * patch target, and markup that needs the future fragment strategy says so
- * with a different value.
+ * patch target; markup a server renders instead lives in a
+ * `data-payload-fragment` boundary (docs/hybrid.md).
  */
 
 interface Props {

package/dist/adapters/astro/index.d.ts

@@ -1,7 +1,10 @@
-import { L as LivePreviewAstroOptions } from '../../middleware-CEPsY1P7.js';
-export { a as LivePreviewMiddleware, c as createLivePreviewMiddleware } from '../../middleware-CEPsY1P7.js';
-import { P as PreviewAuthorizationRequest, A as AuthorizedPreviewScope, a as AuthorizedPreviewContext } from '../../options-CEzzfHJu.js';
-export { b as PreviewAdapterOptions, c as PreviewRequestLike, d as PreviewRequestOptions, h as hasPreviewIntent } from '../../options-CEzzfHJu.js';
+import { L as LivePreviewAstroOptions } from '../../middleware-Bx9I7PXW.js';
+export { a as LivePreviewMiddleware, c as createLivePreviewMiddleware } from '../../middleware-Bx9I7PXW.js';
+import { h as hasPreviewIntent } from '../../options-BW1eqXvc.js';
+export { P as PreviewAdapterOptions, a as PreviewRequestLike, b as PreviewRequestOptions, c as PreviewSignal } from '../../options-BW1eqXvc.js';
+import { F as FragmentEndpointOptions$1, a as FragmentRegistry$1, b as FragmentRegistryEntry$1, c as FragmentRenderer$1 } from '../../fragment-endpoint-3Mlz7GDz.js';
+export { d as FragmentRenderInput } from '../../fragment-endpoint-3Mlz7GDz.js';
+export { A as AUTHORIZATION_LOCALS_KEY, a as AUTHORIZATION_OUTCOME_LOCALS_KEY, L as LivePreviewLocals, N as NONCE_LOCALS_KEY } from '../../locals-DBXDMxOA.js';
 
 /**
  * The Astro integration for `astro.config.mjs`: `livePreview({ ... })`.
@@ -62,15 +65,6 @@ interface AstroIntegrationLike {
 /** Build the integration. The injected runtime stays inert outside the admin's preview iframe. */
 declare function livePreview(options?: LivePreviewAstroOptions): AstroIntegrationLike;
 
-/** What a decision publishes for templates on `locals` (Astro, SvelteKit) or `event.context` (Nuxt). */
-
-/** The request-scoped nonce, for templates that nonce their own scripts. */
-declare const NONCE_LOCALS_KEY = "livePreviewNonce";
-/** The verified `AuthorizedPreviewContext`; absent unless `authorizePreview` authorized. */
-declare const AUTHORIZATION_LOCALS_KEY = "livePreviewAuthorization";
-/** The hook's `PreviewAuthorizationOutcome`; absent when no hook ran. */
-declare const AUTHORIZATION_OUTCOME_LOCALS_KEY = "livePreviewAuthorizationOutcome";
-
 /**
  * Manual embedding for `.astro` templates, for the cases the integration's
  * automatic injection does not fit (one layout, a conditional).
@@ -84,156 +78,36 @@ interface RenderScriptOptions extends LivePreviewAstroOptions {
 declare function renderLivePreviewScript(options?: RenderScriptOptions): string;
 
 /**
- * The `payload-session` strategy: forward exactly one named cookie to
- * `GET <serverURL>/api/<usersSlug>/me` and authorize when a user comes back.
+ * The 1.x names that 2.0 renamed, kept so a 1.x project compiles unchanged.
+ *
+ * A file of its own, and a small one: everything deprecated for 3.0 that the
+ * rename ledger produced lives here, so removing it is one deletion rather than
+ * a search. It also keeps the alias out of the module that defines the real
+ * function, where two exports of one value read as an accident.
+ *
+ * Measured against the published 1.8.1 declarations, entry by entry, not
+ * guessed: `isPreviewRequest` was exported from the root **and** from
+ * `./astro`, so it is re-exported from both. The other seven names 2.0 dropped
+ * moved behind `definePreview()` or changed shape, where an alias would restore
+ * the very defaults the move removed (ADR 0007, ledger rows 1 and 9).
  */
 
-/** A `fetch`-compatible function, injectable for tests. */
-type FetchLike = (input: string, init: {
-    readonly headers: Record<string, string>;
-    readonly signal: AbortSignal;
-}) => Promise<{
-    readonly ok: boolean;
-    readonly status: number;
-    json(): Promise<unknown>;
-}>;
-interface PayloadSessionStrategy {
-    readonly type: 'payload-session';
-    /** Payload server origin, e.g. `https://cms.example.com`. */
-    readonly serverURL: string;
-    /** Auth collection slug; `users` unless the project renamed it. */
-    readonly usersSlug?: string;
-    /** Cookie name; Payload's default is `payload-token`. */
-    readonly cookieName?: string;
-    /** Upper bound for the `/me` round trip. Below 250 ms is raised to 250 ms; default 3000. */
-    readonly timeoutMs?: number;
-    /** Longest cookie value accepted; longer ones are refused as `invalid`. Default 4096. */
-    readonly maxCookieLength?: number;
-    readonly fetch?: FetchLike;
-    /** Clock, Unix milliseconds. Injectable for tests. */
-    readonly now?: () => number;
-}
-
 /**
- * The `signed-token` strategy: a short-lived HMAC-SHA256 token minted by the
- * Payload side and verified by the site. Format and bindings: ADR 0006 §3.
+ * @deprecated Use `hasPreviewIntent`; removed in 3.0. `pll migrate` rewrites it.
  */
+declare const isPreviewRequest: typeof hasPreviewIntent;
 
-/** The subset of Web Crypto the token strategy needs, injectable for environments that expose it elsewhere. */
-interface SubtleCryptoLike {
-    readonly subtle: {
-        importKey(format: 'raw', keyData: Uint8Array, algorithm: {
-            readonly name: 'HMAC';
-            readonly hash: 'SHA-256';
-        }, extractable: false, keyUsages: readonly ('sign' | 'verify')[]): Promise<CryptoKey>;
-        sign(algorithm: 'HMAC', key: CryptoKey, data: Uint8Array): Promise<ArrayBuffer>;
-        verify(algorithm: 'HMAC', key: CryptoKey, signature: Uint8Array, data: Uint8Array): Promise<boolean>;
-    };
-    getRandomValues<T extends Uint8Array>(array: T): T;
-}
-/** Where a signed token is read from on the request. */
-type PreviewTokenTransport = {
-    readonly kind: 'query';
-    readonly param?: string;
-} | {
-    readonly kind: 'header';
-    readonly name?: string;
-};
-/**
- * Optional replay store. Not shipped: a per-process memory is useless behind
- * a load balancer, so the store is a deployment decision.
- */
-interface PreviewTokenReplayStore {
-    isUsed(id: string): Promise<boolean> | boolean;
-    markUsed(id: string, expiresAt: number): Promise<void> | void;
-}
-interface SignedTokenStrategy {
-    readonly type: 'signed-token';
-    /** Shared secret, at least 32 bytes; shorter ones are refused on first use. */
-    readonly secret: string | Uint8Array;
-    /** The site origin tokens must name, e.g. `https://www.example.com`. */
-    readonly audience: string;
-    /** Purpose string tokens must carry. Default `live-preview`. */
-    readonly purpose?: string;
-    /** Default: query parameter `previewToken`. */
-    readonly transport?: PreviewTokenTransport;
-    /** Resolve the request's locale for the `loc` binding. Unset: tokens with `loc` are refused as `wrong-locale`. */
-    readonly locale?: (request: PreviewAuthorizationRequest) => string | undefined;
-    readonly replay?: PreviewTokenReplayStore;
-    readonly crypto?: SubtleCryptoLike;
-    readonly now?: () => number;
-}
-
-/**
- * Authorized preview context: the one verdict every privileged preview
- * decision is keyed on. Intent (`?preview=true`, an iframe destination, a
- * referer) is client-chosen; this turns a session, a signed token or the
- * application's own verifier into a branded context. Threat model: ADR 0006.
- */
-
-/** Claims a consumer verifier returns for a request it accepts. */
-interface PreviewVerifierClaims {
-    readonly subject?: string;
-    readonly expiresAt?: number;
-    readonly scope?: AuthorizedPreviewScope;
-    readonly payloadHeaders?: Readonly<Record<string, string>>;
-}
-/** The application's own verification: claims authorize, `null` refuses, a throw is `unavailable`. */
-interface VerifierStrategy {
-    readonly type: 'verifier';
-    readonly verify: (request: PreviewAuthorizationRequest) => Promise<PreviewVerifierClaims | null> | PreviewVerifierClaims | null;
-    readonly now?: () => number;
-}
-type PreviewAuthorizationStrategy = PayloadSessionStrategy | SignedTokenStrategy | VerifierStrategy;
-
-/**
- * The Astro fragment endpoint (ADR 0011): renders a registered component
- * boundary from unsaved form state for an authorized preview, and nothing
- * else. The browser names a registry id; the server decides what it renders.
- */
-
-/** Everything a registry entry may use to compute its props. */
-interface FragmentRenderInput {
-    readonly id: string;
-    readonly key: string | undefined;
-    readonly revision: number;
-    readonly fields: Readonly<Record<string, unknown>>;
-    readonly locale: string | undefined;
-    readonly collectionSlug: string | undefined;
-    readonly globalSlug: string | undefined;
-    readonly route: string;
-    readonly authorization: AuthorizedPreviewContext;
-    readonly request: Request;
-}
 /** An Astro component as `import Hero from './Hero.astro'` yields it. */
 type AstroComponentLike = object;
-interface FragmentRegistryEntry<Props extends Record<string, unknown> = Record<string, unknown>> {
-    readonly component: AstroComponentLike;
-    /** Props for the component, computed from the input; never from request-controlled code. */
-    readonly props: (input: FragmentRenderInput) => Props | Promise<Props>;
-}
-type FragmentRegistry = Readonly<Record<string, FragmentRegistryEntry>>;
-/** Renders a component with props to HTML; the default uses Astro's container API. */
-type FragmentRenderer = (component: AstroComponentLike, props: Record<string, unknown>, input: FragmentRenderInput) => Promise<string>;
-interface FragmentEndpointOptions {
-    /** The only things this endpoint can render. */
-    readonly registry: FragmentRegistry;
-    /** How a preview request is authorized; the same strategies as `authorizePreviewRequest()`. */
-    readonly authorize: PreviewAuthorizationStrategy;
-    /** Override the renderer (tests, other component systems). Default: Astro container. */
-    readonly render?: FragmentRenderer;
-    /** Origins besides the page's own that may call the endpoint. Default: none. */
-    readonly allowedOrigins?: readonly string[];
-    readonly limits?: {
-        /** Largest request body. Default 64 KiB. */
-        readonly bodyBytes?: number;
-        /** Render timeout. Default 5000 ms. */
-        readonly timeoutMs?: number;
-    };
-}
+type FragmentRegistryEntry<Props extends object = object> = FragmentRegistryEntry$1<AstroComponentLike, Props>;
+/** @internal */
+type FragmentRegistry = FragmentRegistry$1<AstroComponentLike>;
+/** @internal */
+type FragmentRenderer = FragmentRenderer$1<AstroComponentLike>;
+type FragmentEndpointOptions = FragmentEndpointOptions$1<AstroComponentLike>;
 /** Build the endpoint; export it as the `POST` of a non-prerendered Astro API route. */
 declare function createFragmentEndpoint(options: FragmentEndpointOptions): (context: {
     readonly request: Request;
 }) => Promise<Response>;
 
-export { AUTHORIZATION_LOCALS_KEY, AUTHORIZATION_OUTCOME_LOCALS_KEY, type AstroComponentLike, type AstroIntegrationLike, type FragmentEndpointOptions, type FragmentRegistry, type FragmentRegistryEntry, type FragmentRenderInput, type FragmentRenderer, LivePreviewAstroOptions, NONCE_LOCALS_KEY, type RenderScriptOptions, createFragmentEndpoint, livePreview, renderLivePreviewScript };
+export { type AstroComponentLike, type AstroIntegrationLike, type FragmentEndpointOptions, type FragmentRegistry, type FragmentRegistryEntry, type FragmentRenderer, LivePreviewAstroOptions, type RenderScriptOptions, createFragmentEndpoint, hasPreviewIntent, isPreviewRequest, livePreview, renderLivePreviewScript };