payload-live-preview 2.0.0-beta.0 → 2.0.0

package/dist/fragment-endpoint-3Mlz7GDz.d.ts

@@ -0,0 +1,189 @@
+import { e as PreviewAuthorizationRequest, f as AuthorizedPreviewScope, A as AuthorizedPreviewContext, P as PreviewAdapterOptions } from './options-BW1eqXvc.js';
+
+/**
+ * The `payload-session` strategy: forward exactly one named cookie to
+ * `GET <serverURL>/api/<usersSlug>/me` and authorize when a user comes back.
+ */
+
+/** A `fetch`-compatible function, injectable for tests. */
+type FetchLike = (input: string, init: {
+    readonly headers: Record<string, string>;
+    readonly signal: AbortSignal;
+}) => Promise<{
+    readonly ok: boolean;
+    readonly status: number;
+    json(): Promise<unknown>;
+}>;
+interface PayloadSessionStrategy {
+    readonly type: 'payload-session';
+    /** Payload server origin, e.g. `https://cms.example.com`. */
+    readonly serverURL: string;
+    /** Auth collection slug; `users` unless the project renamed it. */
+    readonly usersSlug?: string;
+    /** Cookie name; Payload's default is `payload-token`. */
+    readonly cookieName?: string;
+    /** Upper bound for the `/me` round trip. Below 250 ms is raised to 250 ms; default 3000. */
+    readonly timeoutMs?: number;
+    /** Longest cookie value accepted; longer ones are refused as `invalid`. Default 4096. */
+    readonly maxCookieLength?: number;
+    readonly fetch?: FetchLike;
+    /** Clock, Unix milliseconds. Injectable for tests. */
+    readonly now?: () => number;
+}
+
+/**
+ * The `signed-token` strategy: a short-lived HMAC-SHA256 token minted by the
+ * Payload side and verified by the site. Format and bindings: ADR 0006 §3.
+ */
+
+/** The subset of Web Crypto the token strategy needs, injectable for environments that expose it elsewhere. */
+interface SubtleCryptoLike {
+    readonly subtle: {
+        importKey(format: 'raw', keyData: Uint8Array, algorithm: {
+            readonly name: 'HMAC';
+            readonly hash: 'SHA-256';
+        }, extractable: false, keyUsages: readonly ('sign' | 'verify')[]): Promise<CryptoKey>;
+        sign(algorithm: 'HMAC', key: CryptoKey, data: Uint8Array): Promise<ArrayBuffer>;
+        verify(algorithm: 'HMAC', key: CryptoKey, signature: Uint8Array, data: Uint8Array): Promise<boolean>;
+    };
+    getRandomValues<T extends Uint8Array>(array: T): T;
+}
+/** Where a signed token is read from on the request. */
+type PreviewTokenTransport = {
+    readonly kind: 'query';
+    readonly param?: string;
+} | {
+    readonly kind: 'header';
+    readonly name?: string;
+};
+/**
+ * Optional replay store. Not shipped: a per-process memory is useless behind
+ * a load balancer, so the store is a deployment decision.
+ */
+interface PreviewTokenReplayStore {
+    /**
+     * Record `id` as used until `expiresAt` and say whether this call was the
+     * first: `true` admits the token, anything else refuses it as `replayed`, a
+     * throw refuses it as `unavailable`. Check and record in one step (Redis
+     * `SET NX PX`, a unique insert): a read followed by a write lets two requests
+     * that carry the same token and arrive together both pass.
+     */
+    consume(id: string, expiresAt: number): Promise<boolean> | boolean;
+}
+/**
+ * @deprecated The 1.x store shape, removed in 3.0. Its two calls cannot be one
+ * step, so two requests with the same token that arrive together both pass
+ * `isUsed` before either reaches `markUsed`. Implement
+ * {@link PreviewTokenReplayStore.consume} instead.
+ */
+interface PreviewTokenReplayChecks {
+    isUsed(id: string): Promise<boolean> | boolean;
+    markUsed(id: string, expiresAt: number): Promise<void> | void;
+}
+interface SignedTokenStrategy {
+    readonly type: 'signed-token';
+    /** Shared secret, at least 32 bytes; shorter ones are refused on first use. */
+    readonly secret: string | Uint8Array;
+    /** The site origin tokens must name, e.g. `https://www.example.com`. */
+    readonly audience: string;
+    /** Purpose string tokens must carry. Default `live-preview`. */
+    readonly purpose?: string;
+    /** Default: query parameter `previewToken`. */
+    readonly transport?: PreviewTokenTransport;
+    /** Resolve the request's locale for the `loc` binding. Unset: tokens with `loc` are refused as `wrong-locale`. */
+    readonly locale?: (request: PreviewAuthorizationRequest) => string | undefined;
+    readonly replay?: PreviewTokenReplayStore | PreviewTokenReplayChecks;
+    readonly crypto?: SubtleCryptoLike;
+    readonly now?: () => number;
+}
+
+/**
+ * Authorized preview context: the one verdict every privileged preview
+ * decision is keyed on. Intent (`?preview=true`, an iframe destination, a
+ * referer) is client-chosen; this turns a session, a signed token or the
+ * application's own verifier into a branded context. Threat model: ADR 0006.
+ */
+
+/** Claims a consumer verifier returns for a request it accepts. */
+interface PreviewVerifierClaims {
+    readonly subject?: string;
+    readonly expiresAt?: number;
+    readonly scope?: AuthorizedPreviewScope;
+    readonly payloadHeaders?: Readonly<Record<string, string>>;
+}
+/** The application's own verification: claims authorize, `null` refuses, a throw is `unavailable`. */
+interface VerifierStrategy {
+    readonly type: 'verifier';
+    readonly verify: (request: PreviewAuthorizationRequest) => Promise<PreviewVerifierClaims | null> | PreviewVerifierClaims | null;
+    readonly now?: () => number;
+}
+type PreviewAuthorizationStrategy = PayloadSessionStrategy | SignedTokenStrategy | VerifierStrategy;
+
+/**
+ * The fragment endpoint, without a component system (ADR 0011): it renders a
+ * registered boundary from unsaved form state for an authorized preview, and
+ * nothing else. The browser names a registry id; the server decides what that
+ * id renders.
+ *
+ * Everything here is framework-neutral — method and origin checks, the body
+ * limit, the protocol, authorization, the registry lookup, the timeouts and the
+ * response shape. An adapter binds one renderer to it and exports the result;
+ * `src/adapters/astro/fragments.ts` and `src/adapters/nextjs/fragments.ts` are
+ * the two, and each is a few dozen lines because this file is the endpoint.
+ */
+
+/** Everything a registry entry may use to compute its props. */
+interface FragmentRenderInput {
+    readonly id: string;
+    readonly key: string | undefined;
+    readonly revision: number;
+    readonly fields: Readonly<Record<string, unknown>>;
+    readonly locale: string | undefined;
+    readonly collectionSlug: string | undefined;
+    readonly globalSlug: string | undefined;
+    readonly route: string;
+    readonly authorization: AuthorizedPreviewContext;
+    readonly request: Request;
+}
+/**
+ * `Props extends object`, not `Record<string, unknown>`: an `interface` has no
+ * implicit index signature, so the natural way to type a component's props
+ * would not satisfy the narrower constraint and every consumer would have to
+ * restate their props as a type alias. The renderer widens once, where the
+ * props are handed to it.
+ */
+interface FragmentRegistryEntry<Component, Props extends object = object> {
+    readonly component: Component;
+    /** Props for the component, computed from the input; never from request-controlled code. */
+    readonly props: (input: FragmentRenderInput) => Props | Promise<Props>;
+}
+type FragmentRegistry<Component> = Readonly<Record<string, FragmentRegistryEntry<Component>>>;
+/** Renders a component with props to HTML. Each adapter supplies its own. */
+type FragmentRenderer<Component> = (component: Component, props: Record<string, unknown>, input: FragmentRenderInput) => Promise<string>;
+interface FragmentEndpointOptions<Component> {
+    /** The only things this endpoint can render. */
+    readonly registry: FragmentRegistry<Component>;
+    /**
+     * The middleware's `authorizePreview` hook — same type, same rules: a
+     * context `authorizePreviewRequest()` produced authorizes, anything else
+     * refuses, a `PreviewConfigurationError` is loud. It is called with the
+     * page request the fragment belongs to (route, search, and this request's
+     * headers), so a token stays bound to its route and a session is the
+     * visitor's own. One of `authorizePreview` and `authorize` is required.
+     */
+    readonly authorizePreview?: NonNullable<PreviewAdapterOptions['authorizePreview']>;
+    /** A strategy for `authorizePreviewRequest()`, when there is no hook to share. Exclusive with `authorizePreview`. */
+    readonly authorize?: PreviewAuthorizationStrategy;
+    /** Override the adapter's renderer (tests, another component system). */
+    readonly render?: FragmentRenderer<Component>;
+    /** Origins besides the page's own that may call the endpoint. Default: none. */
+    readonly allowedOrigins?: readonly string[];
+    readonly limits?: {
+        /** Largest request body. Default 64 KiB. */
+        readonly bodyBytes?: number;
+        /** Render timeout. Default 5000 ms. */
+        readonly timeoutMs?: number;
+    };
+}
+
+export type { FragmentEndpointOptions as F, FragmentRegistry as a, FragmentRegistryEntry as b, FragmentRenderer as c, FragmentRenderInput as d };

package/dist/fragment.cjs

@@ -1,2 +1,2 @@
-"use strict";var e="data-payload-island";function t(t){return"astro-island"===t.tagName.toLowerCase()||t.hasAttribute(e)}function n(t){return"patch"===t.getAttribute(e)}function isInsideIsland(e){let r=e;for(;null!==r;){if(t(r)&&!n(r))return!0;r=r.parentElement}return!1}function r(e){if(null==e)return[];const t=/* @__PURE__ */new Set,n=[];for(const r of e.split(/[\s,]+/)){const e=r.trim();0===e.length||t.has(e)||(t.add(e),n.push(e))}return n}var o="data-payload-fragment",i="data-payload-fragment-key";function a(e){const t=e.getAttribute(o);if(null===t||0===t.length)return null;const n=e.getAttribute(i);return{element:e,id:t,key:null===n||0===n.length?void 0:n,dependsOn:r(e.getAttribute("data-payload-depends"))}}function s(e,t){const n=[];for(const r of e.querySelectorAll(`[${o}]`)){const e=a(r);null===e||isInsideIsland(r)||e.dependsOn.length>0&&!e.dependsOn.some(e=>t.has(e))||n.push(e)}return n}var l="x-payload-fragment-version";function u(e,t){if(t>12||"object"!=typeof e||null===e)return t;let n=t;for(const r of Object.values(e))if(n=Math.max(n,u(r,t+1)),n>12)break;return n}function c(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function d(e){if(!c(e))return null;const{html:t,boundary:n,revision:r,metadata:o}=e;return"string"!=typeof t?null:c(n)&&"string"==typeof n.id?void 0!==n.key&&"string"!=typeof n.key||"number"!=typeof r?null:c(o)&&"string"==typeof o.renderedAt&&"string"==typeof o.renderer?e:null:null}var f={status:"superseded"};function g(e,t){return{status:"failed",code:e,reason:t}}function p(e){const t=function(e){const t=()=>{throw new TypeError('createFragmentStrategy: endpoint must be a same-origin path starting with "/"')};if(("string"!=typeof e||!e.startsWith("/")||e.startsWith("//")||e.includes("\\"))&&t(),"undefined"!=typeof location){let n;try{n=new URL(e,location.href)}catch{n=void 0}n?.origin!==location.origin&&t()}return e}(e.endpoint),n=e.timeoutMs??5e3,r=e.maxResponseBytes??524288,o=function(e){let t=0;const n=[];return async r=>{t<e?t+=1:await new Promise(e=>{n.push(e)});try{return await r()}finally{(()=>{const e=n.shift();void 0===e?t-=1:e()})()}}}(Math.max(1,e.maxConcurrent??4)),i=/* @__PURE__ */new Map;return(a,s)=>{const u=`${s.id} ${s.key??""} ${String(a.revision)}`,c=i.get(u);if(void 0!==c)return c;const p=o(()=>async function(o,i){const a=()=>o.signal.aborted;if(a())return f;const s=e.location??location,u=function(e){const t={};for(const[n,r]of Object.entries(e))void 0!==r&&(t[n]=r);return t}({fragment:i.id,key:i.key,route:s.pathname,search:s.search,revision:o.revision,locale:o.locale,collectionSlug:o.collectionSlug,globalSlug:o.globalSlug,fields:o.fields}),c=new AbortController,p=()=>{c.abort()};o.signal.addEventListener("abort",p,{once:!0});const m={timedOut:!1},h=setTimeout(()=>{m.timedOut=!0,c.abort()},n),y=e=>a()?f:m.timedOut?g("LP0801",`timeout after ${String(n)} ms`):g("LP0801",function(e){return e instanceof Error?e.message:String(e)}(e));try{let s;try{s=await(e.fetch??fetch)(t,{method:"POST",credentials:"same-origin",headers:{...e.headers,accept:"application/json","content-type":"application/json",[l]:String(1)},body:JSON.stringify(u),signal:c.signal})}catch(e){return y(e)}if(a())return f;if(401===s.status||403===s.status)return g("LP0803",`endpoint refused the preview (${String(s.status)})`);if(!s.ok)return g("LP0801",`endpoint answered ${String(s.status)}`);const p=s.headers.get("content-type")??"";if(!p.toLowerCase().startsWith("application/json"))return g("LP0802",`unexpected content type "${p}"`);if(Number(s.headers.get("content-length")??"0")>r)return g("LP0802","response exceeds the size limit");let h,b;try{h=await async function(e,t,n){const r=e.body;if("object"!=typeof(o=r)||null===o||"function"!=typeof o.getReader){const n=await e.text();return(new TextEncoder).encode(n).byteLength>t?null:n}var o;const i=r.getReader(),a=()=>{i.cancel().catch(()=>{})};n.addEventListener("abort",a,{once:!0});const s=new TextDecoder;let l="",u=0;try{for(;;){const{done:e,value:n}=await i.read();if(e)break;if(u+=n.byteLength,u>t)return a(),null;l+=s.decode(n,{stream:!0})}}finally{n.removeEventListener("abort",a)}return l+s.decode()}(s,r,c.signal)}catch(e){return y(e)}if(a())return f;if(m.timedOut)return g("LP0801",`timeout after ${String(n)} ms`);if(null===h)return g("LP0802","response exceeds the size limit");try{b=JSON.parse(h)}catch{return g("LP0802","response is not JSON")}const v=d(b);return null===v?g("LP0802","response has the wrong shape"):v.boundary.id!==i.id?g("LP0802","response is for another boundary"):v.revision!==o.revision?f:{status:"rendered",html:v.html,metadata:v.metadata}}finally{clearTimeout(h),o.signal.removeEventListener("abort",p)}}(a,s));i.set(u,p);const m=()=>{i.get(u)===p&&i.delete(u)};return p.then(m,m),p}}var m=Object.freeze({NoTrustedOrigin:"LP0101",ReferrerOnlyTrust:"LP0102",PluginIncompatible:"LP0103",OrphanField:"LP0201",UnattributableUpdate:"LP0202",VisibilityGateDeferred:"LP0301",UnsafeAttributeWrite:"LP0401",TextTargetHasChildren:"LP0402",MissingArrayTemplate:"LP0403",StructuralItemUnkeyed:"LP0404",StructuralDuplicateKey:"LP0405",StructuralUnstableKeys:"LP0406",UnsupportedStrategy:"LP0407",MessageRejected:"LP0501",TokenRejected:"LP0502",HandlerThrew:"LP0601",TransformThrew:"LP0602",RendererThrew:"LP0603",StartupFailed:"LP0605",ReadyFailed:"LP0606",AuditRuntimeMissing:"LP0701",AuditNoFrameAncestors:"LP0702",AuditFrameOptionsBlocks:"LP0703",AuditBindingsExposed:"LP0704",AuditGateThresholdExceeded:"LP0705",AuditUnownedBindings:"LP0706",AuditNoBindings:"LP0707",AuditNotAPage:"LP0708",FragmentRequestFailed:"LP0801",FragmentResponseInvalid:"LP0802",FragmentUnauthorized:"LP0803",FragmentSuperseded:"LP0804",RouteRefreshLoop:"LP0805",FragmentStrategyUnavailable:"LP0806",V2ReadinessGap:"LP0709",RuntimeOnPublicPage:"LP0710"}),h="data-payload-owned",y=/* @__PURE__ */new Set(["open","value","checked","selected"]);function b(e,t){for(const n of t.keyAttributes){const t=e.getAttribute(n);if(null!==t&&t.length>0)return`${n}=${t}`}}function v(t){if(t.tagName.toLowerCase().includes("-"))return!0;if(t.hasAttribute(e)||t.hasAttribute(h))return!0;const n=t.getAttribute("contenteditable");return null!==n&&"false"!==n}function L(e,t,n){if(!function(e,t){return e.tagName===t.tagName&&e.namespaceURI===t.namespaceURI&&!v(e)&&!v(t)}(e,t))return t;const r=function(e){const t=e.ownerDocument.activeElement;if(!(t instanceof HTMLElement&&e.contains(t)))return null;return{element:t,selection:t instanceof HTMLInputElement||t instanceof HTMLTextAreaElement?[t.selectionStart,t.selectionEnd]:null}}(e);return function(e,t){for(const n of Array.from(e.attributes))t.hasAttribute(n.name)||y.has(n.name.toLowerCase())||e.removeAttribute(n.name);for(const n of Array.from(t.attributes))e.getAttribute(n.name)!==n.value&&e.setAttribute(n.name,n.value)}(e,t),!0!==n.retainChildrenOf?.(e,t)&&function(e,t,n){const r=function(e,t){const n=/* @__PURE__ */new Map;let r;for(const o of Array.from(e.children)){const e=b(o,t);void 0!==e&&(n.has(e)?r??=e.slice(e.indexOf("=")+1):n.set(e,o))}return void 0!==r&&t.onDuplicateKey?.(e,r),n}(e,n),o=new Set(r.values()),i=Array.from(e.childNodes).filter(e=>!o.has(e)),a=/* @__PURE__ */new Set,s=/* @__PURE__ */new Set,l=Array.from(t.childNodes);let u=e.firstChild,c=0;for(let t=0;t<l.length;t+=1){const o=l[t];let d=null,f=o instanceof Element?b(o,n):void 0;if(void 0!==f&&s.has(f)&&(f=void 0),void 0!==f){s.add(f);const e=r.get(f);if(void 0!==e&&!a.has(e)&&(d=A(e,o,n)===e?e:null,null===d)){e.replaceWith(o),a.add(o),u=o.nextSibling;continue}}else{for(;c<i.length;){const r=i[c];if(c+=1,!a.has(r)){if(P(r,o)){d=A(r,o,n)===r?r:null,null===d&&(e.replaceChild(o,r),a.add(o),u=o.nextSibling);break}if(r instanceof Element){const n=l[t+1];if(!(o instanceof Element)||void 0!==n&&P(r,n)){c-=1;break}e.replaceChild(o,r),a.add(o),u=o.nextSibling;break}if(!(o instanceof Element)){e.replaceChild(o,r),a.add(o),u=o.nextSibling;break}}}if(null===d&&a.has(o))continue}const g=d??o;for(a.add(g);null!==u&&u!==g&&!a.has(u)&&S(u);)u=u.nextSibling;g!==u&&e.insertBefore(g,u),u=g.nextSibling}for(const t of Array.from(e.childNodes))a.has(t)||t.remove()}(e,t,n),function(e){if(null===e)return;const{element:t,selection:n}=e;if(t.ownerDocument.activeElement!==t&&t.isConnected)try{t.focus({preventScroll:!0});const[e,r]=n??[null,null];null!==e&&null!==r&&t.setSelectionRange(e,r)}catch{}}(r),e}function A(e,t,n){return e instanceof Element&&t instanceof Element?v(e)&&v(t)?e:L(e,t,n):(e.nodeValue!==t.nodeValue&&(e.nodeValue=t.nodeValue),e)}function S(e){return e.nodeType===Node.TEXT_NODE&&0===(e.nodeValue??"").trim().length}function P(e,t){return e.nodeType===t.nodeType&&(!(e instanceof Element&&t instanceof Element)||e.tagName===t.tagName&&e.namespaceURI===t.namespaceURI)}var w="data-payload-strategy",E="data-payload-field",T="x-payload-live-preview";function x(e){const t=e.getAttribute(w);return null!==t?"route"===t:null!==e.closest("head")}function R(e){const t=e.getAttribute(E),n=r(e.getAttribute("data-payload-depends"));return null===t||0===t.length?n:[t,...n]}function O(e){if("META"===e.tagName){const t=e.getAttribute("name")??e.getAttribute("property");return null===t?null:`meta:${t}`}return"LINK"===e.tagName&&"canonical"===e.getAttribute("rel")?"link:canonical":null}function N(e){return{plan:(e,t)=>s(e,t).map(e=>e.element),async render(t,n){const r={rendered:0,failed:0,superseded:0},o={revision:t.revision,receivedAt:t.receivedAt,fields:t.fields,locale:t.locale,collectionSlug:t.collectionSlug,globalSlug:t.globalSlug,signal:t.signal};return await Promise.all(n.map(async n=>{const i=a(n);if(null===i)return;let s;try{s=await e(o,i)}catch(e){s={status:"failed",code:"LP0801",reason:e instanceof Error?e.message:String(e)}}return t.isCurrent()&&"superseded"!==s.status?"rendered"===s.status?(t.morph(n,s.html),t.rendered(n,i.id,i.key),void(r.rendered+=1)):(t.failed(n,i.id,i.key,s.code,s.reason),t.isCurrent()&&t.patch(n),void(r.failed+=1)):(r.superseded+=1,void t.log("LP0804",`fragment "${i.id}" for revision ${String(o.revision)} discarded as superseded`))})),r}}}exports.DIAGNOSTIC_CODES=m,exports.FRAGMENT_ATTRIBUTE=o,exports.FRAGMENT_KEY_ATTRIBUTE=i,exports.FRAGMENT_PROTOCOL_VERSION=1,exports.FRAGMENT_VERSION_HEADER=l,exports.ROUTE_REFRESH_HEADER=T,exports.collectFragmentBoundaries=s,exports.createFragmentHandler=p,exports.createFragmentStrategy=function(e){return N(p(e))},exports.createRouteStrategy=function(e={}){const t=e.timeoutMs??8e3,n=e.minIntervalMs??1e3;let r=-1/0;return{plan(e,t){for(const n of e.querySelectorAll(`[${E}], [${w}="route"]`)){if(!x(n))continue;const e=R(n);if(0===e.length||e.some(e=>t.has(e)))return!0}return!1},async refresh(a){const s=Date.now();if(s-r<n)return a.log("LP0805",`route refresh for revision ${String(a.revision)} refused: the previous one was ${String(s-r)} ms ago`),"failed";r=s;const l=e.document??document,u=e.location??location,c=e.window??window,d=new AbortController,f=()=>{d.abort()};a.signal.addEventListener("abort",f,{once:!0});const g=setTimeout(()=>{d.abort()},t),p=e=>a.signal.aborted?"superseded":(a.log("LP0801",e instanceof Error?e.message:String(e)),"failed");try{let t;try{t=await(e.fetch??fetch)(u.href,{method:"GET",credentials:"same-origin",cache:"no-store",headers:{accept:"text/html",[T]:"route"},signal:d.signal})}catch(e){return p(e)}if(a.signal.aborted)return"superseded";if(!t.ok||!(t.headers.get("content-type")??"").includes("text/html"))return a.log("LP0802",`route answered ${String(t.status)} ${t.headers.get("content-type")??""}`),"failed";try{const e=await t.text();if(!a.isCurrent())return"superseded";const n=(new DOMParser).parseFromString(e,"text/html"),r=c.scrollX,s=c.scrollY;return function(e,t){t.title!==e.title&&(e.title=t.title);const n=/* @__PURE__ */new Map;for(const t of e.head.querySelectorAll("meta, link")){const e=O(t);null===e||n.has(e)||n.set(e,t)}const r=/* @__PURE__ */new Set;for(const o of t.head.querySelectorAll("meta, link")){const t=O(o);if(null===t)continue;r.add(t);const i=n.get(t);if(void 0!==i){if(!i.hasAttribute(h))for(const e of Array.from(o.attributes))i.getAttribute(e.name)!==e.value&&i.setAttribute(e.name,e.value)}else e.head.append(e.importNode(o,!0))}for(const[e,t]of n)r.has(e)||t.hasAttribute(h)||t.remove()}(l,n),L(l.body,n.body,{keyAttributes:["data-payload-key",i,o],retainChildrenOf:e=>e.hasAttribute(o)}),c.scrollTo(r,s),"refreshed"}catch(e){return p(e)}}finally{clearTimeout(g),a.signal.removeEventListener("abort",f)}}}},exports.describeBoundary=a,exports.fragmentStrategyFrom=N,exports.isRouteBound=x,exports.parseFragmentRequest=function(e){if(!c(e))return null;const t=e.fragment;if("string"!=typeof t||!/^[a-z][a-z0-9-]{0,63}$/iu.test(t))return null;const n=e.key;if(void 0!==n&&("string"!=typeof n||n.length>128))return null;const r=e.route;if("string"!=typeof r||!r.startsWith("/")||r.length>2048)return null;const o=e.search;if("string"!=typeof o||o.length>4096||""!==o&&!o.startsWith("?"))return null;const i=e.revision;if("number"!=typeof i||!Number.isInteger(i)||i<0)return null;const a=[];for(const t of["locale","collectionSlug","globalSlug"]){const n=e[t];if(void 0!==n){if("string"!=typeof n||n.length>128)return null;a.push(n)}else a.push(void 0)}const[s,l,d]=a,f=e.fields;return!c(f)||u(f,0)>12?null:{fragment:t,..."string"==typeof n?{key:n}:{},route:r,search:o,revision:i,...void 0!==s?{locale:s}:{},...void 0!==l?{collectionSlug:l}:{},...void 0!==d?{globalSlug:d}:{},fields:f}},exports.parseFragmentResponse=d,exports.resolveStrategy=function(e){const t=e.getAttribute("data-payload-strategy");return null!==t&&t.length>0?"patch"===t||"fragment"===t||"route"===t?t:void 0:null!==function(e){return e.closest(`[${o}]`)}(e)?"fragment":null!==e.closest("head")?"route":"patch"};
+"use strict";function e(e,t){const n=new AbortController;let r=!1;const o=()=>{n.abort()};e.addEventListener("abort",o,{once:!0});const i=setTimeout(()=>{r=!0,n.abort()},t);return{signal:n.signal,timedOut:()=>r,dispose:()=>{clearTimeout(i),e.removeEventListener("abort",o)}}}function t(e){return e instanceof Error?e.message:String(e)}var n="data-payload-island";function r(e){return function(e){return"astro-island"===e.tagName.toLowerCase()||e.hasAttribute(n)}(e)&&!("patch"===e.getAttribute(n))}function isInsideIsland(e){let t=e;for(;null!==t;){if(r(t))return!0;t=t.parentElement}return!1}function o(e){if(null==e)return[];const t=/* @__PURE__ */new Set,n=[];for(const r of e.split(/[\s,]+/)){const e=r.trim();0===e.length||t.has(e)||(t.add(e),n.push(e))}return n}var i="data-payload-fragment",a="data-payload-fragment-key";function s(e){const t=e.getAttribute(i);if(null===t||0===t.length)return null;const n=e.getAttribute(a);return{element:e,id:t,key:null===n||0===n.length?void 0:n,dependsOn:o(e.getAttribute("data-payload-depends"))}}function l(e,t){const n=[];for(const r of e.querySelectorAll(`[${i}]`)){const e=s(r);null===e||isInsideIsland(r)||e.dependsOn.length>0&&!e.dependsOn.some(e=>t.has(e))||n.push(e)}return n}var u="x-payload-fragment-version";function c(e,t){if(t>12||"object"!=typeof e||null===e)return t;let n=t;for(const r of Object.values(e))if(n=Math.max(n,c(r,t+1)),n>12)break;return n}function d(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function f(e){if(!d(e))return null;const{html:t,boundary:n,revision:r,metadata:o}=e;return"string"!=typeof t?null:d(n)&&"string"==typeof n.id?void 0!==n.key&&"string"!=typeof n.key||"number"!=typeof r?null:d(o)&&"string"==typeof o.renderedAt&&"string"==typeof o.renderer?e:null:null}var g={status:"superseded"};function p(e,t){return{status:"failed",code:e,reason:t}}function m(n){const r=function(e){const t=()=>{throw new TypeError('createFragmentStrategy: endpoint must be a same-origin path starting with "/"')};if(("string"!=typeof e||!e.startsWith("/")||e.startsWith("//")||e.includes("\\"))&&t(),"undefined"!=typeof location){let n;try{n=new URL(e,location.href)}catch{n=void 0}n?.origin!==location.origin&&t()}return e}(n.endpoint),o=n.timeoutMs??5e3,i=n.maxResponseBytes??524288,a=function(e){let t=0;const n=[];return async r=>{t<e?t+=1:await new Promise(e=>{n.push(e)});try{return await r()}finally{(()=>{const e=n.shift();void 0===e?t-=1:e()})()}}}(Math.max(1,n.maxConcurrent??4)),s=/* @__PURE__ */new Map;return(l,c)=>{const d=`${c.id} ${c.key??""} ${String(l.revision)}`,m=s.get(d);if(void 0!==m)return m;const h=a(()=>async function(a,s){const l=()=>a.signal.aborted;if(l())return g;const c=n.location??location,d=function(e){const t={};for(const[n,r]of Object.entries(e))void 0!==r&&(t[n]=r);return t}({fragment:s.id,key:s.key,route:c.pathname,search:c.search,revision:a.revision,locale:a.locale,collectionSlug:a.collectionSlug,globalSlug:a.globalSlug,fields:a.fields}),m=e(a.signal,o),h=e=>l()?g:m.timedOut()?p("LP0801",`timeout after ${String(o)} ms`):p("LP0801",t(e));try{let e;try{e=await(n.fetch??fetch)(r,{method:"POST",credentials:"same-origin",headers:{...n.headers,accept:"application/json","content-type":"application/json",[u]:String(1)},body:JSON.stringify(d),signal:m.signal})}catch(e){return h(e)}if(l())return g;if(401===e.status||403===e.status)return p("LP0803",`endpoint refused the preview (${String(e.status)})`);if(!e.ok)return p("LP0801",`endpoint answered ${String(e.status)}`);const t=e.headers.get("content-type")??"";if(!t.toLowerCase().startsWith("application/json"))return p("LP0802",`unexpected content type "${t}"`);if(Number(e.headers.get("content-length")??"0")>i)return p("LP0802","response exceeds the size limit");let c,y;try{c=await async function(e,t,n){const r=e.body;if("object"!=typeof(o=r)||null===o||"function"!=typeof o.getReader){const n=await e.text();return(new TextEncoder).encode(n).byteLength>t?null:n}var o;const i=r.getReader(),a=()=>{i.cancel().catch(()=>{})};n.addEventListener("abort",a,{once:!0});const s=new TextDecoder;let l="",u=0;try{for(;;){const{done:e,value:n}=await i.read();if(e)break;if(u+=n.byteLength,u>t)return a(),null;l+=s.decode(n,{stream:!0})}}finally{n.removeEventListener("abort",a)}return l+s.decode()}(e,i,m.signal)}catch(e){return h(e)}if(l())return g;if(m.timedOut())return p("LP0801",`timeout after ${String(o)} ms`);if(null===c)return p("LP0802","response exceeds the size limit");try{y=JSON.parse(c)}catch{return p("LP0802","response is not JSON")}const b=f(y);return null===b?p("LP0802","response has the wrong shape"):b.boundary.id!==s.id?p("LP0802","response is for another boundary"):b.revision!==a.revision?g:{status:"rendered",html:b.html,metadata:b.metadata}}finally{m.dispose()}}(l,c));s.set(d,h);const y=()=>{s.get(d)===h&&s.delete(d)};return h.then(y,y),h}}var h=Object.freeze({NoTrustedOrigin:"LP0101",ReferrerOnlyTrust:"LP0102",PluginIncompatible:"LP0103",ProfileFeatureOmitted:"LP0104",OrphanField:"LP0201",UnattributableUpdate:"LP0202",VisibilityGateDeferred:"LP0301",UnsafeAttributeWrite:"LP0401",TextTargetHasChildren:"LP0402",MissingArrayTemplate:"LP0403",StructuralItemUnkeyed:"LP0404",StructuralDuplicateKey:"LP0405",StructuralUnstableKeys:"LP0406",UnsupportedStrategy:"LP0407",UnknownValueFormat:"LP0408",SanitizerDroppedAttribute:"LP0409",UnrenderedBlockKept:"LP0410",UnfaithfulPatch:"LP0411",ServerFormatReplaced:"LP0412",UnrenderedBlockLost:"LP0413",MessageRejected:"LP0501",TokenRejected:"LP0502",ProtocolShapeUnknown:"LP0503",HandlerThrew:"LP0601",TransformThrew:"LP0602",RendererThrew:"LP0603",StartupFailed:"LP0605",ReadyFailed:"LP0606",HydrationWaitTimedOut:"LP0607",AuditRuntimeMissing:"LP0701",AuditNoFrameAncestors:"LP0702",AuditFrameOptionsBlocks:"LP0703",AuditBindingsExposed:"LP0704",AuditGateThresholdExceeded:"LP0705",AuditUnownedBindings:"LP0706",AuditNoBindings:"LP0707",AuditNotAPage:"LP0708",FragmentRequestFailed:"LP0801",FragmentResponseInvalid:"LP0802",FragmentUnauthorized:"LP0803",FragmentSuperseded:"LP0804",RouteRefreshLoop:"LP0805",FragmentStrategyUnavailable:"LP0806",UnboundChangeRefresh:"LP0807",V2ReadinessGap:"LP0709",RuntimeOnPublicPage:"LP0710"}),y="data-payload-owned",b=/* @__PURE__ */new Set(["open","value","checked","selected"]);function v(e,t){for(const n of t.keyAttributes){const t=e.getAttribute(n);if(null!==t&&t.length>0)return`${n}=${t}`}}function L(e){if(e.tagName.toLowerCase().includes("-"))return!0;if(e.hasAttribute(n)||e.hasAttribute(y))return!0;const t=e.getAttribute("contenteditable");return null!==t&&"false"!==t}function P(e,t,n){if(!function(e,t){return e.tagName===t.tagName&&e.namespaceURI===t.namespaceURI&&!L(e)&&!L(t)}(e,t))return t;const r=function(e){const t=e.ownerDocument.activeElement;if(!(t instanceof HTMLElement&&e.contains(t)))return null;return{element:t,selection:t instanceof HTMLInputElement||t instanceof HTMLTextAreaElement?[t.selectionStart,t.selectionEnd]:null}}(e);return function(e,t){for(const n of Array.from(e.attributes))t.hasAttribute(n.name)||b.has(n.name.toLowerCase())||e.removeAttribute(n.name);for(const n of Array.from(t.attributes))e.getAttribute(n.name)!==n.value&&e.setAttribute(n.name,n.value)}(e,t),!0!==n.retainChildrenOf?.(e,t)&&function(e,t,n){const r=function(e,t){const n=/* @__PURE__ */new Map;let r;for(const o of Array.from(e.children)){const e=v(o,t);void 0!==e&&(n.has(e)?r??=e.slice(e.indexOf("=")+1):n.set(e,o))}return void 0!==r&&t.onDuplicateKey?.(e,r),n}(e,n),o=new Set(r.values()),i=Array.from(e.childNodes).filter(e=>!o.has(e)),a=/* @__PURE__ */new Set,s=/* @__PURE__ */new Set,l=Array.from(t.childNodes);let u=e.firstChild,c=0;for(let t=0;t<l.length;t+=1){const o=l[t];let d=null,f=o instanceof Element?v(o,n):void 0;if(void 0!==f&&s.has(f)&&(f=void 0),void 0!==f){s.add(f);const e=r.get(f);if(void 0!==e&&!a.has(e)&&(d=A(e,o,n)===e?e:null,null===d)){e.replaceWith(o),a.add(o),u=o.nextSibling;continue}}else{for(;c<i.length;){const r=i[c];if(c+=1,!a.has(r)){if(w(r,o)){d=A(r,o,n)===r?r:null,null===d&&(e.replaceChild(o,r),a.add(o),u=o.nextSibling);break}if(r instanceof Element){const n=l[t+1];if(!(o instanceof Element)||void 0!==n&&w(r,n)){c-=1;break}e.replaceChild(o,r),a.add(o),u=o.nextSibling;break}if(!(o instanceof Element)){e.replaceChild(o,r),a.add(o),u=o.nextSibling;break}}}if(null===d&&a.has(o))continue}const g=d??o;for(a.add(g);null!==u&&u!==g&&!a.has(u)&&S(u);)u=u.nextSibling;g!==u&&e.insertBefore(g,u),u=g.nextSibling}for(const t of Array.from(e.childNodes))a.has(t)||t.remove()}(e,t,n),function(e){if(null===e)return;const{element:t,selection:n}=e;if(t.ownerDocument.activeElement!==t&&t.isConnected)try{t.focus({preventScroll:!0});const[e,r]=n??[null,null];null!==e&&null!==r&&t.setSelectionRange(e,r)}catch{}}(r),e}function A(e,t,n){return e instanceof Element&&t instanceof Element?L(e)&&L(t)?e:P(e,t,n):(e.nodeValue!==t.nodeValue&&(e.nodeValue=t.nodeValue),e)}function S(e){return e.nodeType===Node.TEXT_NODE&&0===(e.nodeValue??"").trim().length}function w(e,t){return e.nodeType===t.nodeType&&(!(e instanceof Element&&t instanceof Element)||e.tagName===t.tagName&&e.namespaceURI===t.namespaceURI)}var E="data-payload-strategy",x="data-payload-field",R="x-payload-live-preview";function T(e){const t=e.getAttribute(E);return null!==t?"route"===t:null!==e.closest("head")}function O(e){const t=e.getAttribute(x),n=o(e.getAttribute("data-payload-depends"));return null===t||0===t.length?n:[t,...n]}function k(e){if("META"===e.tagName){const t=e.getAttribute("name")??e.getAttribute("property");return null===t?null:`meta:${t}`}return"LINK"===e.tagName&&"canonical"===e.getAttribute("rel")?"link:canonical":null}function N(e){return{plan:(e,t)=>l(e,t).map(e=>e.element),async render(n,r){const o={rendered:0,failed:0,superseded:0},i={revision:n.revision,receivedAt:n.receivedAt,fields:n.fields,locale:n.locale,collectionSlug:n.collectionSlug,globalSlug:n.globalSlug,signal:n.signal};return await Promise.all(r.map(async r=>{const a=s(r);if(null===a)return;let l;try{l=await e(i,a)}catch(e){l={status:"failed",code:"LP0801",reason:t(e)}}return n.isCurrent()&&"superseded"!==l.status?"rendered"===l.status?(n.morph(r,l.html),n.rendered(r,a.id,a.key),void(o.rendered+=1)):(n.failed(r,a.id,a.key,l.code,l.reason),n.isCurrent()&&n.patch(r),void(o.failed+=1)):(o.superseded+=1,void n.log("LP0804",`fragment "${a.id}" for revision ${String(i.revision)} discarded as superseded`))})),o}}}exports.DIAGNOSTIC_CODES=h,exports.FRAGMENT_ATTRIBUTE=i,exports.FRAGMENT_KEY_ATTRIBUTE=a,exports.FRAGMENT_PROTOCOL_VERSION=1,exports.FRAGMENT_VERSION_HEADER=u,exports.ROUTE_REFRESH_HEADER=R,exports.collectFragmentBoundaries=l,exports.createFragmentHandler=m,exports.createFragmentStrategy=function(e){return N(m(e))},exports.createRouteStrategy=function(n={}){const r=n.timeoutMs??8e3,o=n.minIntervalMs??1e3;let s=-1/0;return{plan(e,t){for(const n of e.querySelectorAll(`[${x}], [${E}="route"]`)){if(!T(n))continue;const e=O(n);if(0===e.length||e.some(e=>t.has(e)))return!0}return!1},async refresh(l){const u=Date.now(),c=o-(u-s);if(c>0)return l.retryAfter?.(c),l.log("LP0805",`route refresh for revision ${String(l.revision)} refused: the previous one was ${String(u-s)} ms ago`),"refused";s=u;const d=n.document??document,f=n.location??location,g=n.window??window,p=e(l.signal,r),m=e=>{if(l.signal.aborted)return"superseded";const n=p.timedOut()?`route refresh timed out after ${String(r)} ms`:t(e);return l.log("LP0801",n),"failed"};try{const e=("undefined"==typeof window?void 0:window)?.__livePreviewRouteRefresh;if(void 0!==e){try{await e()}catch(e){return m(e)}return l.isCurrent()?"refreshed":"superseded"}let t;try{t=await(n.fetch??fetch)(f.href,{method:"GET",credentials:"same-origin",cache:"no-store",headers:{accept:"text/html",[R]:"route"},signal:p.signal})}catch(e){return m(e)}if(l.signal.aborted)return"superseded";if(!t.ok||!(t.headers.get("content-type")??"").includes("text/html"))return l.log("LP0802",`route answered ${String(t.status)} ${t.headers.get("content-type")??""}`),"failed";try{const e=await t.text();if(!l.isCurrent())return"superseded";const n=(new DOMParser).parseFromString(e,"text/html"),r=g.scrollX,o=g.scrollY;return function(e,t){t.title!==e.title&&(e.title=t.title);const n=/* @__PURE__ */new Map;for(const t of e.head.querySelectorAll("meta, link")){const e=k(t);null===e||n.has(e)||n.set(e,t)}const r=/* @__PURE__ */new Set;for(const o of t.head.querySelectorAll("meta, link")){const t=k(o);if(null===t)continue;r.add(t);const i=n.get(t);if(void 0!==i){if(!i.hasAttribute(y))for(const e of Array.from(o.attributes))i.getAttribute(e.name)!==e.value&&i.setAttribute(e.name,e.value)}else e.head.append(e.importNode(o,!0))}for(const[e,t]of n)r.has(e)||t.hasAttribute(y)||t.remove()}(d,n),P(d.body,n.body,{keyAttributes:["data-payload-key",a,i],retainChildrenOf:e=>e.hasAttribute(i)}),g.scrollTo(r,o),"refreshed"}catch(e){return m(e)}}finally{p.dispose()}}}},exports.describeBoundary=s,exports.fragmentStrategyFrom=N,exports.isRouteBound=T,exports.parseFragmentRequest=function(e){if(!d(e))return null;const t=e.fragment;if("string"!=typeof t||!/^[a-z][a-z0-9-]{0,63}$/iu.test(t))return null;const n=e.key;if(void 0!==n&&("string"!=typeof n||n.length>128))return null;const r=e.route;if("string"!=typeof r||!r.startsWith("/")||r.length>2048)return null;const o=e.search;if("string"!=typeof o||o.length>4096||""!==o&&!o.startsWith("?"))return null;const i=e.revision;if("number"!=typeof i||!Number.isInteger(i)||i<0)return null;const a=[];for(const t of["locale","collectionSlug","globalSlug"]){const n=e[t];if(void 0!==n){if("string"!=typeof n||n.length>128)return null;a.push(n)}else a.push(void 0)}const[s,l,u]=a,f=e.fields;return!d(f)||c(f,0)>12?null:{fragment:t,..."string"==typeof n?{key:n}:{},route:r,search:o,revision:i,...void 0!==s?{locale:s}:{},...void 0!==l?{collectionSlug:l}:{},...void 0!==u?{globalSlug:u}:{},fields:f}},exports.parseFragmentResponse=f,exports.resolveStrategy=function(e){const t=e.getAttribute("data-payload-strategy");return null!==t&&t.length>0?"patch"===t||"fragment"===t||"route"===t?t:void 0:null!==function(e){return e.closest(`[${i}]`)}(e)?"fragment":null!==e.closest("head")?"route":"patch"};
 //# sourceMappingURL=fragment.cjs.map