payload-live-preview 2.2.1 → 2.2.2

package/dist/index.d.cts

@@ -209,8 +209,8 @@ interface SanitizeOptions {
     /** Extra tags to allow. Lower-case, untrimmed. */
     readonly additionalAllowedTags?: readonly string[];
     /**
-     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`,
-     * or — under `'strict'` — `id`, `name` and `data-payload-*`.
+     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`, or —
+     * under `'strict'` — `id`, `name` and `data-payload-*`; their URLs are checked.
      */
     readonly additionalAllowedAttributes?: Readonly<Record<string, readonly string[]>>;
     /**
@@ -1538,7 +1538,8 @@ interface PreviewAuthorizationRequest {
  * The `payload-session` strategy: forward exactly one named cookie to
  * `GET <serverURL>/api/<usersSlug>/me` and authorize when a user comes back.
  * A cookie-only request preserves working Payload 2 sessions. When `/me`
- * reports no user, one retry adds an `Origin` for Payload 3's CSRF check.
+ * reports no user, one retry adds an `Origin` for Payload 3's CSRF check, and
+ * an endpoint that needed it gets it on the first request from then on.
  */
 
 /** A `fetch`-compatible function, injectable for tests. */
@@ -1561,7 +1562,8 @@ interface PayloadSessionStrategy {
     /**
      * Send this listed origin with the cookie from the first request. Without
      * it, try the existing cookie-only request, then the origin of `serverURL`
-     * once when `/me` reports a null user. Draft reads keep the accepted headers.
+     * once when `/me` reports a null user; an endpoint that needed the origin
+     * gets it first from then on. Draft reads keep the accepted headers.
      */
     readonly origin?: string;
     /** Upper bound for the `/me` round trip. Below 250 ms is raised to 250 ms; default 3000. */

package/dist/index.d.ts

@@ -209,8 +209,8 @@ interface SanitizeOptions {
     /** Extra tags to allow. Lower-case, untrimmed. */
     readonly additionalAllowedTags?: readonly string[];
     /**
-     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`,
-     * or — under `'strict'` — `id`, `name` and `data-payload-*`.
+     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`, or —
+     * under `'strict'` — `id`, `name` and `data-payload-*`; their URLs are checked.
      */
     readonly additionalAllowedAttributes?: Readonly<Record<string, readonly string[]>>;
     /**
@@ -1538,7 +1538,8 @@ interface PreviewAuthorizationRequest {
  * The `payload-session` strategy: forward exactly one named cookie to
  * `GET <serverURL>/api/<usersSlug>/me` and authorize when a user comes back.
  * A cookie-only request preserves working Payload 2 sessions. When `/me`
- * reports no user, one retry adds an `Origin` for Payload 3's CSRF check.
+ * reports no user, one retry adds an `Origin` for Payload 3's CSRF check, and
+ * an endpoint that needed it gets it on the first request from then on.
  */
 
 /** A `fetch`-compatible function, injectable for tests. */
@@ -1561,7 +1562,8 @@ interface PayloadSessionStrategy {
     /**
      * Send this listed origin with the cookie from the first request. Without
      * it, try the existing cookie-only request, then the origin of `serverURL`
-     * once when `/me` reports a null user. Draft reads keep the accepted headers.
+     * once when `/me` reports a null user; an endpoint that needed the origin
+     * gets it first from then on. Draft reads keep the accepted headers.
      */
     readonly origin?: string;
     /** Upper bound for the `/me` round trip. Below 250 ms is raised to 250 ms; default 3000. */