payload-live-preview 2.2.1 → 2.2.2

package/dist/server.cjs

@@ -1,2 +1,2 @@
-"use strict";var e="payload-live-preview.authorized-preview-context",t=Symbol.for(e);function isAuthorizedPreviewContext(e){return"object"==typeof e&&null!==e&&!0===e[t]&&Object.isFrozen(e)}function r(r){return Object.freeze({...r,scope:Object.freeze({...r.scope,...void 0===r.scope.payload?{}:{payload:Object.freeze({...r.scope.payload,document:Object.freeze({...r.scope.payload.document})})}}),payloadHeaders:Object.freeze({...r.payloadHeaders}),[t]:!0,[e]:!0})}var n=class extends Error{name="PreviewConfigurationError"};function o(e){return{authorized:!1,outcome:e,context:null}}var i="users",a=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,s=/^[A-Za-z0-9._~-]+$/;function c(e,t,r=4096){if(null===e||0===e.length)return null;const n=`${t}=`,o=[];for(const t of e.split(";")){const e=t.trim();e.startsWith(n)&&o.push(e.slice(n.length))}if(1!==o.length)return null;const i=o[0]??"";return 0===i.length||i.length>r||!s.test(i)?null:i}function u(e,t){let r;try{r=new URL(e)}catch{throw new n(`payload-live-preview: ${t} "${e}" is not an absolute URL`)}if("https:"!==r.protocol&&"http:"!==r.protocol)throw new n(`payload-live-preview: ${t} must be http(s), got "${r.protocol}"`);return r.origin}function l(e,t){if(!function(){try{const e=globalThis.process?.env;return void 0!==e&&"production"!==e.NODE_ENV}catch{return!1}}())return;const r=globalThis,n=r.__payloadLivePreviewDeprecationsWarned??=/* @__PURE__ */new Set;if(!n.has(e)){n.add(e);try{console.warn(`[payload-live-preview] ${t}`)}catch{}}}var d,p="live-preview",f="v1";function h(){return d??=new TextEncoder,d}function v(e){const t="string"==typeof e?h().encode(e):e;if(t.byteLength<32)throw new n(`payload-live-preview: the preview token secret must be at least ${String(32)} bytes`);return t}function y(e){if(void 0!==e)return e;const t=globalThis.crypto;return"object"==typeof t?.subtle?t:void 0}async function g(e,t){return e.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function w(e){let t="";for(const r of e)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function b(e){if(!/^[A-Za-z0-9_-]*$/.test(e))return;const t=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat((4-e.length%4)%4);try{const e=atob(t),r=new Uint8Array(e.length);for(let t=0;t<e.length;t+=1)r[t]=e.charCodeAt(t);return r}catch{return}}function m(e){return"string"==typeof e&&e.length>0&&"."!==e&&".."!==e&&!/[\s\p{Cc}\p{Cs}/\\?#%]/u.test(e)}function x(e){return"number"==typeof e?Number.isSafeInteger(e):m(e)}function A(e,t="/api"){if("string"!=typeof e||"string"!=typeof t)return null;try{const r=new URL(e);if(!["http:","https:"].includes(r.protocol)||r.username||r.password||r.search||r.hash)return null;const n=e.replace(/^[a-z]+:\/\/[^/]+/iu,"").replace(/\/+$/,""),o=t.replace(/^\//,"").replace(/\/$/,"");return""!==n&&!n.slice(1).split("/").every(m)||!o.split("/").every(m)?null:`${r.origin}${r.pathname.replace(/\/+$/,"")}/${o}`}catch{return null}}function $(e){return void 0!==e.expiresAt&&Number.isFinite(e.expiresAt)&&e.expiresAt>Date.now()}function k(e,t){return e.kind===t.kind&&e.slug===t.slug&&("global"===e.kind||x(t.id)&&String(e.id)===String(t.id))}var j=["preview","draft","livePreview"];function bind(e,t){return z(e,t)}function bindByPath(e,t){const r=function(e){const t=[],r=new Proxy({},{get(e,n){if("symbol"!=typeof n)return/^\d+$/.test(n)||t.push(n),r}});try{e(r)}catch{}return t}(e);if(0===r.length)throw new Error("bindByPath: the picker did not read any field — return data.<field> instead of a constant");return z(r.join("."),t)}function z(e,t){if(0===e.length)throw new Error("bind: field name must be a non-empty string");const r={"data-payload-field":e};return void 0!==t?.attribute&&(r["data-payload-attribute"]=t.attribute),void 0!==t?.type&&(r["data-payload-type"]=t.type),!0===t?.richtext&&(r["data-payload-richtext"]=""),!0===t?.html&&(r["data-payload-html"]=""),void 0!==t?.locale&&(r["data-payload-locale"]=t.locale),void 0!==t?.alt&&(r["data-payload-alt"]=t.alt),void 0!==t?.href&&(r["data-payload-href"]=t.href),void 0!==t?.arrayTemplate&&(r["data-payload-array-template"]=t.arrayTemplate),r}var R=/^[a-z][a-z0-9-]{0,63}$/u,P=Object.freeze({});function createPreviewBindings(e){const t=isAuthorizedPreviewContext(e.authorization),r=void 0!==e.owner&&e.owner.length>0?e.owner:void 0;return Object.freeze({authorized:t,bind:(e,r)=>t?bind(e,r):P,bindByPath:(e,r)=>t?bindByPath(e,r):P,owner:()=>t&&void 0!==r?{"data-payload-owner":r}:P,boundary:(e,r={})=>{const n=function(e,t){if(!R.test(e))throw new RangeError(`createPreviewBindings().boundary(): "${e}" is not a registry id — lowercase, starting with a letter, then letters, digits or hyphens (max 64). The runtime would post it and the endpoint would refuse it.`);const r=t.key;if(void 0!==r&&(0===r.length||r.length>128))throw new RangeError(`createPreviewBindings().boundary(): the key for "${e}" must be 1 to ${String(128)} characters.`);const n=t.dependsOn??[];return{"data-payload-fragment":e,...void 0!==r?{"data-payload-fragment-key":r}:{},...n.length>0?{"data-payload-depends":n.join(",")}:{}}}(e,r);return t?n:P},covers:(...e)=>{const r=function(e){for(const t of e)if(0===t.length||/[\s,]/u.test(t))throw new RangeError(`createPreviewBindings().covers(): "${t}" is not a field path — a name or a dotted path without spaces or commas.`);return{"data-payload-covers":e.join(" ")}}(e);return t&&e.length>0?r:P}})}var U=class extends Error{reason;status;url;constructor(e,t,r,n){super(`payload-live-preview: preview read failed (${e}${void 0===r?"":` ${String(r)}`}) for ${t}`,{cause:n}),this.name="PreviewFetchError",this.reason=e,this.status=r,this.url=t}};function O(e,t,r){const n=isAuthorizedPreviewContext(t.authorization)?t.authorization:null,o=n?.scope.payload;return void 0===o||null===n||$(n)&&(void 0===n.scope.locale||n.scope.locale===t.locale)&&A(e.serverURL,e.apiRoute)===A(o.serverURL,o.apiRoute)&&e.depth<=o.maxDepth&&k(o.document,r)}function E(e){return D(e,{ok:!1,reason:"scope",status:void 0,draft:e.draft,cause:void 0})}function S(e){return isAuthorizedPreviewContext(e.authorization)}function L(e,t,r){const n=new URLSearchParams;return n.set("depth",String(e)),r&&n.set("draft","true"),void 0!==t.locale&&n.set("locale",t.locale),n}async function C({config:e,timeoutMs:t},r,n,o,i){const a=e.fetch??("function"==typeof fetch?fetch:void 0),s={config:e,url:r,draft:o,errorMode:n.errorMode??"result",startedAt:Date.now()};if(!i)return E(s);if(void 0===a)return D(s,{ok:!1,reason:"no-fetch",status:void 0,draft:o,cause:void 0});const c=AbortSignal.timeout(t),u=void 0===n.signal?c:AbortSignal.any([c,n.signal]),l=isAuthorizedPreviewContext(n.authorization)?n.authorization:null;let d,p;try{const e=new Headers({accept:"application/json",...n.headers});for(const[t,r]of Object.entries(l?.payloadHeaders??{}))e.set(t,r);d=await a(r,{headers:Object.fromEntries(e),signal:u,cache:"no-store",redirect:"error"})}catch(e){return D(s,{ok:!1,reason:M(e,n.signal),status:void 0,draft:o,cause:e})}if(void 0!==l?.scope.payload&&!$(l))return E(s);if(!d.ok)return D(s,{ok:!1,reason:"http",status:d.status,draft:o,cause:void 0});try{p=await d.json()}catch(e){return D(s,{ok:!1,reason:"invalid-json",status:d.status,draft:o,cause:e})}return void 0!==l?.scope.payload&&!$(l)||void 0!==l?.scope.payload&&!function(e,t){if("object"!=typeof t||null===t||Array.isArray(t))return!1;const r=t;return"global"===e.kind?!Object.hasOwn(r,"globalType")||r.globalType===e.slug:Object.hasOwn(r,"id")&&k(e,{kind:"collection",slug:e.slug,id:r.id})}(l.scope.payload.document,p)?E(s):D(s,{ok:!0,data:p,draft:o,status:d.status})}function D(e,t){const{config:r,url:n,draft:o}=e,i=Date.now()-e.startedAt;if(t.ok)return r.onDiagnostic?.({kind:"response",url:n,status:t.status,draft:o,durationMs:i}),t;if(r.onDiagnostic?.({kind:"failure",url:n,reason:t.reason,status:t.status,draft:o,durationMs:i}),"throw"===e.errorMode)throw new U(t.reason,n,t.status,t.cause);return t}function M(e,t){if(!0===t?.aborted)return"aborted";const r="object"==typeof e&&null!==e?e.name:void 0;return"TimeoutError"===r?"timeout":"AbortError"===r?"aborted":"network"}function T(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function B(e){return e.map((e,t)=>0===t?e:`[${e}]`).join("")}function N(e,t,r){for(const[n,o]of Object.entries(t)){const t=[...r,n];T(o)?N(e,o,t):Array.isArray(o)&&o.some(T)?o.forEach((r,n)=>{N(e,r,[...t,String(n)])}):Array.isArray(o)?e.set(B(t),o.map(String).join(",")):e.set(B(t),"object"==typeof o?"null":String(o))}}exports.AUTHORIZED_PREVIEW_BRAND_KEY=e,exports.PreviewFetchError=U,exports.authorizePreviewRequest=async function(e,t){switch(t.type){case"payload-session":return async function(e,t){const s=function(e){const t=e??"payload-token";if(!a.test(t))throw new n(`payload-live-preview: cookie name "${t}" is not a valid cookie-name token`);return t}(t.cookieName),l=u(t.serverURL,"serverURL"),d=void 0===t.origin?void 0:u(t.origin,"origin"),p=c(e.headers.get("cookie"),s,t.maxCookieLength??4096);if(null===p)return o("missing-credential");const f=t.now??Date.now,h=Math.max(250,t.timeoutMs??3e3);if(!Number.isSafeInteger(h))return o("unavailable");const v=t.fetch??globalThis.fetch,y=encodeURIComponent(t.usersSlug??i),g=`${s}=${p}`;let w={cookie:g};void 0!==d&&(w.origin=d);const b=new AbortController,m=()=>{b.abort(e.signal?.reason)},x=()=>b.signal.aborted;let A,$;e.signal?.addEventListener("abort",m,{once:!0}),!0===e.signal?.aborted&&m();try{if(x())return o("unavailable");A=setTimeout(()=>{b.abort(new DOMException("The operation timed out","TimeoutError"))},h);for(let e=0;e<2;e++){const t=await v(`${l}/api/${y}/me?depth=0`,{headers:{...w,accept:"application/json"},signal:b.signal});if(x())return o("unavailable");if(!t.ok)return o(401===t.status?"invalid":"unavailable");if($=await t.json(),x())return o("unavailable");if(0!==e||void 0!==d||"object"!=typeof $||null===$||null!==$.user)break;w={cookie:g,origin:l}}}catch{return o("unavailable")}finally{void 0!==A&&clearTimeout(A),e.signal?.removeEventListener("abort",m)}const k=function(e,t){if("object"!=typeof e||null===e||Array.isArray(e))return null;const r=e.user;if("object"!=typeof r||null===r||Array.isArray(r))return null;const n=e.collection??r.collection;if(void 0!==n&&n!==t)return null;const o=r.id;return"string"==typeof o&&o.length>0?o:"number"==typeof o&&Number.isFinite(o)?String(o):null}($,t.usersSlug??i);if(null===k)return o("invalid");const j=function(e){const t=e.exp;return"number"!=typeof t||!Number.isFinite(t)||t<=0?void 0:t<1e11?1e3*t:t}($);return void 0!==j&&j<=f()?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"payload-session",subject:k,authorizedAt:f(),expiresAt:j,scope:{},payloadHeaders:w})}}(e,t);case"signed-token":return async function(e,t){const n=v(t.secret),i=y(t.crypto);if(void 0===i)return o("unavailable");const a=function(e,t){if("header"===t?.kind)return e.headers.get(t.name??"x-preview-token");let r;try{r=new URL(e.url)}catch{return null}const n=r.searchParams.getAll(t?.param??"previewToken");return 1===n.length?n[0]??null:null}(e,t.transport);if(null===a||0===a.length)return o("missing-credential");if(a.length>4096)return o("invalid");const s=a.split(".");if(3!==s.length||s[0]!==f)return o("invalid");const c=s[1]??"",u=b(c),d=b(s[2]??"");if(void 0===u||32!==d?.byteLength)return o("invalid");let w;try{const e=await g(i,n);w=await i.subtle.verify("HMAC",e,d,h().encode(`${f}.${c}`))}catch{return o("unavailable")}if(!w)return o("invalid");const m=function(e){let t;try{t=JSON.parse((new TextDecoder).decode(e))}catch{return}if("object"!=typeof t||null===t)return;const r=t,n=e=>void 0===r[e]||"string"==typeof r[e];return 1===r.v&&"string"==typeof r.aud&&"string"==typeof r.pur&&"number"==typeof r.iat&&"number"==typeof r.exp&&"string"==typeof r.jti&&n("pth")&&n("loc")&&n("sub")?r:void 0}(u);if(void 0===m)return o("invalid");const x=(t.now??Date.now)();if(m.exp<=x||m.iat>m.exp)return o("expired");if(m.aud!==t.audience)return o("wrong-audience");if(m.pur!==(t.purpose??p))return o("wrong-purpose");if(void 0!==m.pth){let t;try{t=new URL(e.url).pathname}catch{return o("invalid")}if(m.pth!==t)return o("wrong-path")}if(void 0!==m.loc){const r=t.locale?.(e);if(r!==m.loc)return o("wrong-locale")}if(void 0!==t.replay){let e;try{e=await async function(e,t,r){return"consume"in e?!0===await e.consume(t,r):(l("replay-is-used","A `signed-token` replay store with `isUsed` and `markUsed` is removed in 3.0: implement `consume(id, expiresAt)`, which checks and records in one step (ADR 0026)."),!await e.isUsed(t)&&(await e.markUsed(t,r),!0))}(t.replay,m.jti,m.exp)}catch{return o("unavailable")}if(!e)return o("replayed")}return{authorized:!0,outcome:"authorized",context:r({strategy:"signed-token",subject:m.sub,authorizedAt:x,expiresAt:m.exp,scope:{audience:m.aud,...void 0!==m.pth?{path:m.pth}:{},...void 0!==m.loc?{locale:m.loc}:{}},payloadHeaders:{}})}}(e,t);case"verifier":return async function(e,t){let n;try{n=await t.verify(e)}catch{return o("unavailable")}if(null===n)return o("invalid");if(!(void 0===n.scope?.payload||function(e){if("object"!=typeof e||null===e)return!1;const t=e,r=t.document;return!(null===A(t.serverURL,t.apiRoute)||"number"!=typeof t.maxDepth||!Number.isSafeInteger(t.maxDepth)||t.maxDepth<0||"object"!=typeof r||null===r||!m(r.slug))&&("global"===r.kind||"collection"===r.kind&&x(r.id))}(n.scope.payload)&&Number.isFinite(n.expiresAt)))return o("invalid");const i=(t.now??Date.now)();return void 0!==n.expiresAt&&n.expiresAt<=i?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"verifier",subject:n.subject,authorizedAt:i,expiresAt:n.expiresAt,scope:n.scope??{},payloadHeaders:n.payloadHeaders??{}})}}(e,t)}},exports.bind=bind,exports.bindByPath=bindByPath,exports.createPreviewBindings=createPreviewBindings,exports.definePreview=function(e){const t=function(e){let t;try{t=new URL(e)}catch{throw new Error(`payload-live-preview: serverURL "${e}" is not an absolute URL`)}if("https:"!==t.protocol&&"http:"!==t.protocol)throw new Error(`payload-live-preview: serverURL must be http(s), got "${t.protocol}"`);return`${t.origin}${t.pathname.replace(/\/+$/,"")}`}(e.serverURL),r=e.apiRoute??"/api",n=r.startsWith("/")?r:`/${r}`;if(!Number.isInteger(e.depth)||e.depth<0)throw new Error(`payload-live-preview: depth must be a non-negative integer, got ${String(e.depth)}`);const o=Math.max(250,e.timeoutMs??5e3),i=Object.freeze({serverURL:t,apiRoute:n,depth:e.depth,timeoutMs:o}),a=Object.freeze({serverURL:t,apiRoute:n,mergeDepth:e.depth}),s=`${t}${n}`,c={config:Object.freeze({...e,...i}),timeoutMs:o};return Object.freeze({config:i,runtimeOptions:a,async fetchDocument(e){const t=S(e),r=void 0!==e.id,n=(!r||x(e.id)&&void 0===e.where)&&O(c.config,e,{kind:"collection",slug:e.collection,id:e.id});if(!n)return C(c,s,e,t,!1);const o=L(i.depth,e,t);r||(o.set("limit","1"),void 0!==e.where&&N(o,e.where,["where"]));const a=x(e.id)?`/${encodeURIComponent(String(e.id))}`:"",u=`${s}/${encodeURIComponent(e.collection)}${a}?${o.toString()}`;if(r)return C(c,u,e,t,n);const l=await C(c,u,e,t,n);if(!l.ok)return l;const d=l.data?.docs?.[0];return{ok:!0,data:d??null,draft:t,status:l.status}},async fetchGlobal(e){const t=S(e),r=L(i.depth,e,t),n=`${s}/globals/${encodeURIComponent(e.global)}?${r.toString()}`;return C(c,n,e,t,O(c.config,e,{kind:"global",slug:e.global}))}})},exports.extractCookie=c,exports.hasPreviewIntent=function(e,t={}){const r=new Set(t.signals??["query","fetch-dest","referer"]),n=t.queryParams??j;if(r.has("query")){let t;try{t=new URL(e.url)}catch{t=void 0}if(void 0!==t)for(const e of n){const r=t.searchParams.getAll(e).at(-1);if("true"===r||"1"===r)return!0}}if(r.has("fetch-dest")&&"iframe"===e.headers.get("sec-fetch-dest"))return!0;const o=t.adminOrigins;void 0!==o&&l("admin-origins","`hasPreviewIntent({ adminOrigins })` is removed in 3.0: name the option `allowedOrigins`; `pll migrate` renames it (ADR 0026).");const i=t.allowedOrigins??o??[],a=r.has("referer")?i:[];if(a.length>0){const t=e.headers.get("referer");if(null!==t)try{const e=new URL(t).origin;for(const t of a)try{if(new URL(t).origin===e)return!0}catch{}}catch{}}return!1},exports.isAuthorizedPreviewContext=isAuthorizedPreviewContext,exports.issuePreviewToken=async function(e,t){const r=y(t.crypto);if(void 0===r)throw new Error("payload-live-preview: no Web Crypto implementation available to sign tokens");const n=v(t.secret),o=(t.now??Date.now)(),i=Math.min(36e5,Math.max(1,e.ttlMs??6e5)),a=new Uint8Array(16);r.getRandomValues(a);const s={v:1,aud:e.audience,...void 0!==e.path?{pth:e.path}:{},...void 0!==e.locale?{loc:e.locale}:{},...void 0!==e.subject?{sub:e.subject}:{},pur:e.purpose??p,iat:o,exp:o+i,jti:w(a)},c=w(h().encode(JSON.stringify(s))),u=`${f}.${c}`,l=await g(r,n);return`${u}.${w(new Uint8Array(await r.subtle.sign("HMAC",l,h().encode(u))))}`},exports.previewBindingsFromLocals=function(e,t={}){return createPreviewBindings({authorization:("object"==typeof e&&null!==e?e.livePreviewAuthorization:void 0)??null,...void 0!==t.owner?{owner:t.owner}:{}})};
+"use strict";var e="payload-live-preview.authorized-preview-context",t=Symbol.for(e);function isAuthorizedPreviewContext(e){return"object"==typeof e&&null!==e&&!0===e[t]&&Object.isFrozen(e)}function r(r){const n={...r,scope:Object.freeze({...r.scope,...void 0===r.scope.payload?{}:{payload:Object.freeze({...r.scope.payload,document:Object.freeze({...r.scope.payload.document})})}}),payloadHeaders:Object.freeze({...r.payloadHeaders}),[t]:!0,[e]:!0};return Object.defineProperty(n,"payloadHeaders",{enumerable:!1}),Object.freeze(n)}var n=class extends Error{name="PreviewConfigurationError"};function o(e){return{authorized:!1,outcome:e,context:null}}var i="users",a=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,s=/^[A-Za-z0-9._~-]+$/,c=/* @__PURE__ */new WeakMap;function u(e,t,r=4096){if(null===e||0===e.length)return null;const n=`${t}=`,o=[];for(const t of e.split(";")){const e=t.trim();e.startsWith(n)&&o.push(e.slice(n.length))}if(1!==o.length)return null;const i=o[0]??"";return 0===i.length||i.length>r||!s.test(i)?null:i}function l(e,t){let r;try{r=new URL(e)}catch{throw new n(`payload-live-preview: ${t} "${e}" is not an absolute URL`)}if("https:"!==r.protocol&&"http:"!==r.protocol)throw new n(`payload-live-preview: ${t} must be http(s), got "${r.protocol}"`);return r.origin}function d(e,t){if(!function(){try{const e=globalThis.process?.env;return void 0!==e&&"production"!==e.NODE_ENV}catch{return!1}}())return;const r=globalThis,n=r.__payloadLivePreviewDeprecationsWarned??=/* @__PURE__ */new Set;if(!n.has(e)){n.add(e);try{console.warn(`[payload-live-preview] ${t}`)}catch{}}}var p,f="live-preview",h=36e5,v="v1";function y(){return p??=new TextEncoder,p}function g(e){const t="string"==typeof e?y().encode(e):e;if(t.byteLength<32)throw new n(`payload-live-preview: the preview token secret must be at least ${String(32)} bytes`);return t}function w(e){if(void 0!==e)return e;const t=globalThis.crypto;return"object"==typeof t?.subtle?t:void 0}async function b(e,t){return e.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function m(e){let t="";for(const r of e)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function x(e){if(!/^[A-Za-z0-9_-]*$/.test(e))return;const t=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat((4-e.length%4)%4);try{const e=atob(t),r=new Uint8Array(e.length);for(let t=0;t<e.length;t+=1)r[t]=e.charCodeAt(t);return r}catch{return}}function A(e){return"string"==typeof e&&e.length>0&&"."!==e&&".."!==e&&!/[\s\p{Cc}\p{Cs}/\\?#%]/u.test(e)}function $(e){return"number"==typeof e?Number.isSafeInteger(e):A(e)}function k(e,t="/api"){if("string"!=typeof e||"string"!=typeof t)return null;try{const r=new URL(e);if(!["http:","https:"].includes(r.protocol)||r.username||r.password||r.search||r.hash)return null;const n=e.replace(/^[a-z]+:\/\/[^/]+/iu,"").replace(/\/+$/,""),o=t.replace(/^\//,"").replace(/\/$/,"");return""!==n&&!n.slice(1).split("/").every(A)||!o.split("/").every(A)?null:`${r.origin}${r.pathname.replace(/\/+$/,"")}/${o}`}catch{return null}}function j(e){return void 0!==e.expiresAt&&Number.isFinite(e.expiresAt)&&e.expiresAt>Date.now()}function z(e,t){return e.kind===t.kind&&e.slug===t.slug&&("global"===e.kind||$(t.id)&&String(e.id)===String(t.id))}var R=["preview","draft","livePreview"];function bind(e,t){return P(e,t)}function bindByPath(e,t){const r=function(e){const t=[],r=new Proxy({},{get(e,n){if("symbol"!=typeof n)return/^\d+$/.test(n)||t.push(n),r}});try{e(r)}catch{}return t}(e);if(0===r.length)throw new Error("bindByPath: the picker did not read any field — return data.<field> instead of a constant");return P(r.join("."),t)}function P(e,t){if(0===e.length)throw new Error("bind: field name must be a non-empty string");const r={"data-payload-field":e};return void 0!==t?.attribute&&(r["data-payload-attribute"]=t.attribute),void 0!==t?.type&&(r["data-payload-type"]=t.type),!0===t?.richtext&&(r["data-payload-richtext"]=""),!0===t?.html&&(r["data-payload-html"]=""),void 0!==t?.locale&&(r["data-payload-locale"]=t.locale),void 0!==t?.alt&&(r["data-payload-alt"]=t.alt),void 0!==t?.href&&(r["data-payload-href"]=t.href),void 0!==t?.arrayTemplate&&(r["data-payload-array-template"]=t.arrayTemplate),r}var U=/^[a-z][a-z0-9-]{0,63}$/u,O=Object.freeze({});function createPreviewBindings(e){const t=isAuthorizedPreviewContext(e.authorization),r=void 0!==e.owner&&e.owner.length>0?e.owner:void 0;return Object.freeze({authorized:t,bind:(e,r)=>t?bind(e,r):O,bindByPath:(e,r)=>t?bindByPath(e,r):O,owner:()=>t&&void 0!==r?{"data-payload-owner":r}:O,boundary:(e,r={})=>{const n=function(e,t){if(!U.test(e))throw new RangeError(`createPreviewBindings().boundary(): "${e}" is not a registry id — lowercase, starting with a letter, then letters, digits or hyphens (max 64). The runtime would post it and the endpoint would refuse it.`);const r=t.key;if(void 0!==r&&(0===r.length||r.length>128))throw new RangeError(`createPreviewBindings().boundary(): the key for "${e}" must be 1 to ${String(128)} characters.`);const n=t.dependsOn??[];return{"data-payload-fragment":e,...void 0!==r?{"data-payload-fragment-key":r}:{},...n.length>0?{"data-payload-depends":n.join(",")}:{}}}(e,r);return t?n:O},covers:(...e)=>{const r=function(e){for(const t of e)if(0===t.length||/[\s,]/u.test(t))throw new RangeError(`createPreviewBindings().covers(): "${t}" is not a field path — a name or a dotted path without spaces or commas.`);return{"data-payload-covers":e.join(" ")}}(e);return t&&e.length>0?r:O}})}var E=class extends Error{reason;status;url;constructor(e,t,r,n){super(`payload-live-preview: preview read failed (${e}${void 0===r?"":` ${String(r)}`}) for ${t}`,{cause:n}),this.name="PreviewFetchError",this.reason=e,this.status=r,this.url=t}};function S(e,t,r){const n=isAuthorizedPreviewContext(t.authorization)?t.authorization:null,o=n?.scope.payload;return void 0===o||null===n||j(n)&&(void 0===n.scope.locale||n.scope.locale===t.locale)&&k(e.serverURL,e.apiRoute)===k(o.serverURL,o.apiRoute)&&e.depth<=o.maxDepth&&z(o.document,r)}function L(e){return T(e,{ok:!1,reason:"scope",status:void 0,draft:e.draft,cause:void 0})}function C(e){return isAuthorizedPreviewContext(e.authorization)}function D(e,t,r){const n=new URLSearchParams;return n.set("depth",String(e)),r&&n.set("draft","true"),void 0!==t.locale&&n.set("locale",t.locale),n}async function M({config:e,timeoutMs:t},r,n,o,i){const a=e.fetch??("function"==typeof fetch?fetch:void 0),s={config:e,url:r,draft:o,errorMode:n.errorMode??"result",startedAt:Date.now()};if(!i)return L(s);if(void 0===a)return T(s,{ok:!1,reason:"no-fetch",status:void 0,draft:o,cause:void 0});const c=AbortSignal.timeout(t),u=void 0===n.signal?c:AbortSignal.any([c,n.signal]),l=isAuthorizedPreviewContext(n.authorization)?n.authorization:null;let d,p;try{const e=new Headers({accept:"application/json",...n.headers});for(const[t,r]of Object.entries(l?.payloadHeaders??{}))e.set(t,r);d=await a(r,{headers:Object.fromEntries(e),signal:u,cache:"no-store",redirect:"error"})}catch(e){return T(s,{ok:!1,reason:B(e,n.signal),status:void 0,draft:o,cause:e})}if(void 0!==l?.scope.payload&&!j(l))return L(s);if(!d.ok)return T(s,{ok:!1,reason:"http",status:d.status,draft:o,cause:void 0});try{p=await d.json()}catch(e){return T(s,{ok:!1,reason:"invalid-json",status:d.status,draft:o,cause:e})}return void 0!==l?.scope.payload&&!j(l)||void 0!==l?.scope.payload&&!function(e,t){if("object"!=typeof t||null===t||Array.isArray(t))return!1;const r=t;return"global"===e.kind?!Object.hasOwn(r,"globalType")||r.globalType===e.slug:Object.hasOwn(r,"id")&&z(e,{kind:"collection",slug:e.slug,id:r.id})}(l.scope.payload.document,p)?L(s):T(s,{ok:!0,data:p,draft:o,status:d.status})}function T(e,t){const{config:r,url:n,draft:o}=e,i=Date.now()-e.startedAt;if(t.ok)return r.onDiagnostic?.({kind:"response",url:n,status:t.status,draft:o,durationMs:i}),t;if(r.onDiagnostic?.({kind:"failure",url:n,reason:t.reason,status:t.status,draft:o,durationMs:i}),"throw"===e.errorMode)throw new E(t.reason,n,t.status,t.cause);return t}function B(e,t){if(!0===t?.aborted)return"aborted";const r="object"==typeof e&&null!==e?e.name:void 0;return"TimeoutError"===r?"timeout":"AbortError"===r?"aborted":"network"}function H(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function N(e){return e.map((e,t)=>0===t?e:`[${e}]`).join("")}function I(e,t,r){for(const[n,o]of Object.entries(t)){const t=[...r,n];H(o)?I(e,o,t):Array.isArray(o)&&o.some(H)?o.forEach((r,n)=>{I(e,r,[...t,String(n)])}):Array.isArray(o)?e.set(N(t),o.map(String).join(",")):e.set(N(t),"object"==typeof o?"null":String(o))}}exports.AUTHORIZED_PREVIEW_BRAND_KEY=e,exports.PreviewFetchError=E,exports.authorizePreviewRequest=async function(e,t){switch(t.type){case"payload-session":return async function(e,t){const s=function(e){const t=e??"payload-token";if(!a.test(t))throw new n(`payload-live-preview: cookie name "${t}" is not a valid cookie-name token`);return t}(t.cookieName),d=l(t.serverURL,"serverURL"),p=void 0===t.origin?void 0:l(t.origin,"origin"),f=u(e.headers.get("cookie"),s,t.maxCookieLength??4096);if(null===f)return o("missing-credential");const h=t.now??Date.now,v=Math.max(250,t.timeoutMs??3e3);if(!Number.isSafeInteger(v))return o("unavailable");const y=t.fetch??globalThis.fetch,g=`${d}/api/${encodeURIComponent(t.usersSlug??i)}/me?depth=0`,w=c.get(y)??/* @__PURE__ */new Map,b=`${s}=${f}`;let m={cookie:b};void 0!==p?m.origin=p:w.has(g)&&(m.origin=d);const x=new AbortController,A=()=>{x.abort(e.signal?.reason)},$=()=>x.signal.aborted;let k,j;e.signal?.addEventListener("abort",A,{once:!0}),!0===e.signal?.aborted&&A();try{if($())return o("unavailable");k=setTimeout(()=>{x.abort(new DOMException("The operation timed out","TimeoutError"))},v);for(let e=0;e<2;e++){const t=await y(g,{headers:{...m,accept:"application/json"},signal:x.signal});if($())return o("unavailable");if(!t.ok)return o(401===t.status?"invalid":"unavailable");if(j=await t.json(),$())return o("unavailable");const r="object"==typeof j&&null!==j?j.user:void 0;if(0!==e){if("object"!=typeof r||null===r||Array.isArray(r))break;void 0===m.origin?w.delete(g):(c.set(y,w),w.set(g,h()));break}if(void 0!==p||null!==r)break;if(void 0!==m.origin){if(h()-(w.get(g)??0)<6e4)break;w.set(g,h()),m={cookie:b}}else m={cookie:b,origin:d}}}catch{return o("unavailable")}finally{void 0!==k&&clearTimeout(k),e.signal?.removeEventListener("abort",A)}const z=function(e,t){if("object"!=typeof e||null===e||Array.isArray(e))return null;const r=e.user;if("object"!=typeof r||null===r||Array.isArray(r))return null;const n=e.collection??r.collection;if(void 0!==n&&n!==t)return null;const o=r.id;return"string"==typeof o&&o.length>0?o:"number"==typeof o&&Number.isFinite(o)?String(o):null}(j,t.usersSlug??i);if(null===z)return o("invalid");const R=function(e){const t=e.exp;return"number"!=typeof t||!Number.isFinite(t)||t<=0?void 0:t<1e11?1e3*t:t}(j);return void 0!==R&&R<=h()?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"payload-session",subject:z,authorizedAt:h(),expiresAt:R,scope:{},payloadHeaders:m})}}(e,t);case"signed-token":return async function(e,t){const n=g(t.secret),i=w(t.crypto);if(void 0===i)return o("unavailable");const a=function(e,t){if("header"===t?.kind)return e.headers.get(t.name??"x-preview-token");let r;try{r=new URL(e.url)}catch{return null}const n=r.searchParams.getAll(t?.param??"previewToken");return 1===n.length?n[0]??null:null}(e,t.transport);if(null===a||0===a.length)return o("missing-credential");if(a.length>4096)return o("invalid");const s=a.split(".");if(3!==s.length||s[0]!==v)return o("invalid");const c=s[1]??"",u=x(c),l=x(s[2]??"");if(void 0===u||32!==l?.byteLength)return o("invalid");let p;try{const e=await b(i,n);p=await i.subtle.verify("HMAC",e,l,y().encode(`${v}.${c}`))}catch{return o("unavailable")}if(!p)return o("invalid");const m=function(e){let t;try{t=JSON.parse((new TextDecoder).decode(e))}catch{return}if("object"!=typeof t||null===t)return;const r=t,n=e=>void 0===r[e]||"string"==typeof r[e];return 1===r.v&&"string"==typeof r.aud&&"string"==typeof r.pur&&"number"==typeof r.iat&&"number"==typeof r.exp&&"string"==typeof r.jti&&n("pth")&&n("loc")&&n("sub")?r:void 0}(u);if(void 0===m)return o("invalid");const A=(t.now??Date.now)();if(m.exp<=A||m.iat>m.exp)return o("expired");if(m.exp-m.iat>h)return o("invalid");if(m.aud!==t.audience)return o("wrong-audience");if(m.pur!==(t.purpose??f))return o("wrong-purpose");if(void 0!==m.pth){let t;try{t=new URL(e.url).pathname}catch{return o("invalid")}if(m.pth!==t)return o("wrong-path")}if(void 0!==m.loc){const r=t.locale?.(e);if(r!==m.loc)return o("wrong-locale")}if(void 0!==t.replay){let e;try{e=await async function(e,t,r){return"consume"in e?!0===await e.consume(t,r):(d("replay-is-used","A `signed-token` replay store with `isUsed` and `markUsed` is removed in 3.0: implement `consume(id, expiresAt)`, which checks and records in one step (ADR 0026)."),!await e.isUsed(t)&&(await e.markUsed(t,r),!0))}(t.replay,m.jti,m.exp)}catch{return o("unavailable")}if(!e)return o("replayed")}return{authorized:!0,outcome:"authorized",context:r({strategy:"signed-token",subject:m.sub,authorizedAt:A,expiresAt:m.exp,scope:{audience:m.aud,...void 0!==m.pth?{path:m.pth}:{},...void 0!==m.loc?{locale:m.loc}:{}},payloadHeaders:{}})}}(e,t);case"verifier":return async function(e,t){let n;try{n=await t.verify(e)}catch{return o("unavailable")}if(null===n)return o("invalid");if(!(void 0===n.scope?.payload||function(e){if("object"!=typeof e||null===e)return!1;const t=e,r=t.document;return!(null===k(t.serverURL,t.apiRoute)||"number"!=typeof t.maxDepth||!Number.isSafeInteger(t.maxDepth)||t.maxDepth<0||"object"!=typeof r||null===r||!A(r.slug))&&("global"===r.kind||"collection"===r.kind&&$(r.id))}(n.scope.payload)&&Number.isFinite(n.expiresAt)))return o("invalid");const i=(t.now??Date.now)();return void 0!==n.expiresAt&&n.expiresAt<=i?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"verifier",subject:n.subject,authorizedAt:i,expiresAt:n.expiresAt,scope:n.scope??{},payloadHeaders:n.payloadHeaders??{}})}}(e,t)}},exports.bind=bind,exports.bindByPath=bindByPath,exports.createPreviewBindings=createPreviewBindings,exports.definePreview=function(e){const t=function(e){let t;try{t=new URL(e)}catch{throw new Error(`payload-live-preview: serverURL "${e}" is not an absolute URL`)}if("https:"!==t.protocol&&"http:"!==t.protocol)throw new Error(`payload-live-preview: serverURL must be http(s), got "${t.protocol}"`);return`${t.origin}${t.pathname.replace(/\/+$/,"")}`}(e.serverURL),r=e.apiRoute??"/api",n=r.startsWith("/")?r:`/${r}`;if(!Number.isInteger(e.depth)||e.depth<0)throw new Error(`payload-live-preview: depth must be a non-negative integer, got ${String(e.depth)}`);const o=Math.max(250,e.timeoutMs??5e3),i=Object.freeze({serverURL:t,apiRoute:n,depth:e.depth,timeoutMs:o}),a=Object.freeze({serverURL:t,apiRoute:n,mergeDepth:e.depth}),s=`${t}${n}`,c={config:Object.freeze({...e,...i}),timeoutMs:o};return Object.freeze({config:i,runtimeOptions:a,async fetchDocument(e){const t=C(e),r=void 0!==e.id,n=(!r||$(e.id)&&void 0===e.where)&&S(c.config,e,{kind:"collection",slug:e.collection,id:e.id});if(!n)return M(c,s,e,t,!1);const o=D(i.depth,e,t);r||(o.set("limit","1"),void 0!==e.where&&I(o,e.where,["where"]));const a=$(e.id)?`/${encodeURIComponent(String(e.id))}`:"",u=`${s}/${encodeURIComponent(e.collection)}${a}?${o.toString()}`;if(r)return M(c,u,e,t,n);const l=await M(c,u,e,t,n);if(!l.ok)return l;const d=l.data?.docs?.[0];return{ok:!0,data:d??null,draft:t,status:l.status}},async fetchGlobal(e){const t=C(e),r=D(i.depth,e,t),n=`${s}/globals/${encodeURIComponent(e.global)}?${r.toString()}`;return M(c,n,e,t,S(c.config,e,{kind:"global",slug:e.global}))}})},exports.extractCookie=u,exports.hasPreviewIntent=function(e,t={}){const r=new Set(t.signals??["query","fetch-dest","referer"]),n=t.queryParams??R;if(r.has("query")){let t;try{t=new URL(e.url)}catch{t=void 0}if(void 0!==t)for(const e of n){const r=t.searchParams.getAll(e).at(-1);if("true"===r||"1"===r)return!0}}if(r.has("fetch-dest")&&"iframe"===e.headers.get("sec-fetch-dest"))return!0;const o=t.adminOrigins;void 0!==o&&d("admin-origins","`hasPreviewIntent({ adminOrigins })` is removed in 3.0: name the option `allowedOrigins`; `pll migrate` renames it (ADR 0026).");const i=t.allowedOrigins??o??[],a=r.has("referer")?i:[];if(a.length>0){const t=e.headers.get("referer");if(null!==t)try{const e=new URL(t).origin;for(const t of a)try{if(new URL(t).origin===e)return!0}catch{}}catch{}}return!1},exports.isAuthorizedPreviewContext=isAuthorizedPreviewContext,exports.issuePreviewToken=async function(e,t){const r=w(t.crypto);if(void 0===r)throw new Error("payload-live-preview: no Web Crypto implementation available to sign tokens");const n=g(t.secret),o=(t.now??Date.now)(),i=Math.min(h,Math.max(1,e.ttlMs??6e5)),a=new Uint8Array(16);r.getRandomValues(a);const s={v:1,aud:e.audience,...void 0!==e.path?{pth:e.path}:{},...void 0!==e.locale?{loc:e.locale}:{},...void 0!==e.subject?{sub:e.subject}:{},pur:e.purpose??f,iat:o,exp:o+i,jti:m(a)},c=m(y().encode(JSON.stringify(s))),u=`${v}.${c}`,l=await b(r,n);return`${u}.${m(new Uint8Array(await r.subtle.sign("HMAC",l,y().encode(u))))}`},exports.previewBindingsFromLocals=function(e,t={}){return createPreviewBindings({authorization:("object"==typeof e&&null!==e?e.livePreviewAuthorization:void 0)??null,...void 0!==t.owner?{owner:t.owner}:{}})};
 //# sourceMappingURL=server.cjs.map