payload-live-preview 2.2.1 → 2.3.0

package/dist/index.d.cts

@@ -37,6 +37,8 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly UnattributableUpdate: "LP0202";
     /** An update carried a value for a field the page binds nowhere; editing it changes nothing on this page. */
     readonly UnboundField: "LP0203";
+    /** In development: a bound path covers its group under the `descendant` default, which 3.0 changes. */
+    readonly CoverageDefaultChanges: "LP0204";
     /** The visibility gate held offscreen writes back until they scroll into view. */
     readonly VisibilityGateDeferred: "LP0301";
     /** A value was refused because the attribute or the value itself is unsafe. */
@@ -61,7 +63,7 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly UnrenderedBlockKept: "LP0410";
     /** A patch cannot reach what the server would have drawn; `onUnfaithfulPatch` decided what happens next. */
     readonly UnfaithfulPatch: "LP0411";
-    /** The first write to a date, number or checkbox binding replaced a different reading of the same value. */
+    /** The first write to a date, number, checkbox, select or radio binding replaced a different reading of the same value. */
     readonly ServerFormatReplaced: "LP0412";
     /** A Lexical block has no renderer, and the write could not keep the markup the server rendered for it; it is gone. */
     readonly UnrenderedBlockLost: "LP0413";
@@ -81,7 +83,7 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly StartupFailed: "LP0605";
     /** Sending the ready handshake failed. */
     readonly ReadyFailed: "LP0606";
-    /** The page declared hydration, but no React commit, Vue mount or SvelteKit mount came within the cap; the runtime started without waiting. */
+    /** The page declared hydration, but no React commit, Vue mount, SvelteKit mount or `markHydrated()` call came within the cap; the runtime started without waiting. */
     readonly HydrationWaitTimedOut: "LP0607";
     /** The audit found no runtime in a response that carried preview intent. */
     readonly AuditRuntimeMissing: "LP0701";
@@ -123,6 +125,8 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly V2ReadinessGap: "LP0709";
     /** The preview runtime is served to anonymous visitors, not only inside the admin frame. */
     readonly RuntimeOnPublicPage: "LP0710";
+    /** An element carries attributes that only mean something beside `data-payload-field`, and has none. */
+    readonly AuditModifierWithoutField: "LP0711";
 }>;
 /** A diagnostic code, as it appears in log output and on the `error` event. */
 type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[keyof typeof DIAGNOSTIC_CODES];
@@ -209,8 +213,8 @@ interface SanitizeOptions {
     /** Extra tags to allow. Lower-case, untrimmed. */
     readonly additionalAllowedTags?: readonly string[];
     /**
-     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`,
-     * or — under `'strict'` — `id`, `name` and `data-payload-*`.
+     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`, or —
+     * under `'strict'` — `id`, `name` and `data-payload-*`; their URLs are checked.
      */
     readonly additionalAllowedAttributes?: Readonly<Record<string, readonly string[]>>;
     /**
@@ -350,6 +354,8 @@ interface RenderContext {
      * completes the sentence 'field "x" …' in LP0411.
      */
     readonly reportUnfaithful?: (target: CachedElement, reason: string) => void;
+    /** The route of a Lexical internal link, as `internalLinkPattern` gives it. */
+    readonly internalLinkPattern?: string;
 }
 /**
  * A renderer writes one value into its element. It must not throw: one bad
@@ -856,7 +862,7 @@ interface LivePreviewInspection {
      * SvelteKit page is not connected yet; `timed-out` is LP0607.
      */
     readonly hydration: {
-        readonly mode: 'off' | 'react' | 'vue' | 'sveltekit';
+        readonly mode: 'off' | 'react' | 'vue' | 'sveltekit' | 'manual';
         readonly state: 'idle' | 'waiting' | 'committed' | 'timed-out';
     };
 }
@@ -1009,6 +1015,12 @@ interface LivePreviewClientConfig {
     readonly apiRoute?: string;
     /** Population depth used with `serverURL`. Required with it; `defaults: 'v1'` falls back to `1`. */
     readonly mergeDepth?: number;
+    /** Milliseconds the `serverURL` merge may wait before the update shows its raw values. Off by default. */
+    readonly mergeTimeoutMs?: number;
+    /** The route of a Lexical internal link with no `url` of its own, as `/{locale}/{slug}/`. */
+    readonly internalLinkPattern?: string;
+    /** Hold a route render until Payload reports the save: the route shows what is saved. */
+    readonly routeAfterSave?: boolean;
     /** Custom fetch for the `serverURL` merge request: attach auth headers or route through a proxy. */
     readonly mergeFetch?: typeof fetch;
     /** Verbose console output. Defaults to dev-mode detection. */
@@ -1209,6 +1221,22 @@ type RouteRefresh = () => void | Promise<void>;
  */
 declare function registerRouteRefresh(refresh: RouteRefresh): () => void;
 
+/**
+ * Waiting for a page that says when it has hydrated (ADR 0015, addendum of
+ * 2026-10-31). The React, Vue and SvelteKit waits each read a trace their
+ * framework leaves; a page on any other host, or whose host left none, calls
+ * `markHydrated()` instead. The page's bundle and the runtime are separate
+ * scripts and either may run first, so the slot holds a state a late runtime
+ * can still read rather than an event it could miss.
+ */
+
+/**
+ * Tell a runtime started with `hydration: 'manual'` that this page has hydrated, so its
+ * first write lands on markup the framework keeps. Call it once your framework has
+ * taken the page over; a later call changes nothing, and on a server it does nothing.
+ */
+declare function markHydrated(): void;
+
 interface RuntimeBuildInfo {
     readonly generatedAt: string;
     readonly size: number;
@@ -1263,8 +1291,10 @@ interface InlineScriptConfig {
      * Carry the route strategy, so a binding in `<head>` or one marked
      * `data-payload-strategy="route"` refreshes the route. `fragmentEndpoint`
      * implies it — the fragment prelude already contains it. Default `false`.
+     * `'after-save'` renders the route only once Payload reports a save: before it, a
+     * GET shows nothing the editor typed and costs a server render.
      */
-    readonly routeStrategy?: boolean;
+    readonly routeStrategy?: boolean | 'after-save';
     /**
      * The 2.0 name for `onUnfaithfulPatch`, kept until 3.0. `'route'` means
      * `'escalate'`, `'ignore'` means `'ignore'`.
@@ -1297,10 +1327,11 @@ interface InlineScriptConfig {
      * mounted, on a page SvelteKit's client runs on — otherwise Svelte's
      * hydration sets its own text back over it, as quietly. The Next.js, Nuxt
      * and SvelteKit adapters set it on every script they emit; a page built by
-     * hand with `generateInlineScript()` may. Omitted: the runtime starts on
-     * `DOMContentLoaded`, as on a static page.
+     * hand with `generateInlineScript()` may. Under `'manual'` it holds the write
+     * until the page calls `markHydrated()`, for a framework this package cannot
+     * observe. Omitted: the runtime starts on `DOMContentLoaded`, as on a static page.
      */
-    readonly hydration?: 'react' | 'vue' | 'sveltekit';
+    readonly hydration?: 'react' | 'vue' | 'sveltekit' | 'manual';
     /**
      * Which defaults the omitted options fall back to, resolved by the generator
      * rather than the runtime, whose own fallbacks are the 2.0 rows: `'v1'`
@@ -1327,6 +1358,10 @@ interface InlineScriptConfig {
      * declaration; an uncovered one is an unbound change.
      */
     readonly subfieldCoverage?: 'descendant' | 'declared';
+    /** Milliseconds the `serverURL` merge may wait before the update shows its raw values. Off by default. */
+    readonly mergeTimeoutMs?: number;
+    /** The route of a Lexical internal link with no `url` of its own, as `/{locale}/{slug}/`. */
+    readonly internalLinkPattern?: string;
     /**
      * A runtime artifact to embed instead of the full one — today only
      * `LEAN_RUNTIME` from `payload-live-preview/lean`, which leaves out the
@@ -1538,7 +1573,8 @@ interface PreviewAuthorizationRequest {
  * The `payload-session` strategy: forward exactly one named cookie to
  * `GET <serverURL>/api/<usersSlug>/me` and authorize when a user comes back.
  * A cookie-only request preserves working Payload 2 sessions. When `/me`
- * reports no user, one retry adds an `Origin` for Payload 3's CSRF check.
+ * reports no user, one retry adds an `Origin` for Payload 3's CSRF check, and
+ * an endpoint that needed it gets it on the first request from then on.
  */
 
 /** A `fetch`-compatible function, injectable for tests. */
@@ -1561,7 +1597,8 @@ interface PayloadSessionStrategy {
     /**
      * Send this listed origin with the cookie from the first request. Without
      * it, try the existing cookie-only request, then the origin of `serverURL`
-     * once when `/me` reports a null user. Draft reads keep the accepted headers.
+     * once when `/me` reports a null user; an endpoint that needed the origin
+     * gets it first from then on. Draft reads keep the accepted headers.
      */
     readonly origin?: string;
     /** Upper bound for the `/me` round trip. Below 250 ms is raised to 250 ms; default 3000. */
@@ -1792,12 +1829,20 @@ interface LexicalRenderOptions {
     readonly requireDocument?: boolean;
     /**
      * Called for every `block` or `inlineBlock` the registry has no renderer
-     * for, with the block's slug as Payload sent it and the class its empty
-     * placeholder carries. The `richText` write listens: it is the one caller
+     * for, with the block's slug as Payload sent it, the class its empty
+     * placeholder carries and the block's fields. The `richText` write listens: it is the one caller
      * that later knows whether the server's markup for the block survived, so
      * the diagnostic is spoken there (LP0410, LP0413), not here.
      */
-    readonly onUnrenderedBlock?: (blockType: string, placeholderClass: string) => void;
+    readonly onUnrenderedBlock?: (blockType: string, placeholderClass: string, fields: unknown) => void;
+    /**
+     * The route of an internal link whose document has no `url` of its own, such
+     * as `/{locale}/{slug}/`. `{slug}`, `{id}`, `{collection}` and `{locale}` are
+     * filled in and encoded; with one of them empty the link falls back to `/<slug>`.
+     */
+    readonly internalLinkPattern?: string | undefined;
+    /** What `{locale}` reads in `internalLinkPattern`. */
+    readonly locale?: string | undefined;
 }
 /** @internal */
 declare function isLexicalContent(value: unknown): value is LexicalRoot;
@@ -2046,6 +2091,11 @@ interface FieldBindingAttributes {
     readonly 'data-payload-alt'?: string;
     readonly 'data-payload-href'?: string;
     readonly 'data-payload-array-template'?: string;
+    readonly 'data-payload-format'?: string;
+    readonly 'data-payload-text'?: string;
+    readonly 'data-payload-strategy'?: string;
+    readonly 'data-payload-depends'?: string;
+    readonly 'data-payload-boundary'?: string;
 }
 interface BindOptions {
     /** Attribute to write instead of the text content, e.g. `'src'` for `<img>`. */
@@ -2064,6 +2114,19 @@ interface BindOptions {
     readonly href?: string;
     /** Markup per array item with `{{value}}` placeholders. */
     readonly arrayTemplate?: string;
+    /** How a date or number is written, from `data-payload-format`'s vocabulary. */
+    readonly format?: string;
+    /** Let a text write replace the element's children. */
+    readonly text?: boolean;
+    /** Who shows this field: the patch (default), a server-rendered fragment, or the route. */
+    readonly strategy?: 'patch' | 'fragment' | 'route';
+    /** Fields whose change re-applies this binding under `skipUnchanged`. */
+    readonly dependsOn?: readonly string[];
+    /**
+     * An anchor for a field that may be empty, so an edit that fills it has somewhere to
+     * land. Set `hidden` yourself while the value is empty; the runtime keeps it right after that.
+     */
+    readonly anchor?: boolean;
 }
 /** `bind<Homepage>('heroTitle')`; without `T` any string is accepted. */
 declare function bind<T = Record<string, unknown>>(field: FieldName<T>, options?: BindOptions): FieldBindingAttributes;
@@ -2138,7 +2201,7 @@ declare function createPreviewBindings(options: PreviewBindingsOptions): Preview
  * `App.Locals` declaration in the project it writes into. The verdict is
  * checked, not trusted — only a context `authorizePreviewRequest()` produced
  * emits anything (ADR 0006).
- * @internal
+ * @public
  */
 declare function previewBindingsFromLocals(locals: unknown, options?: {
     readonly owner?: string;
@@ -2169,4 +2232,4 @@ interface IslandUpdateDetail {
 /** Whether `element` (or an ancestor) is an island that did not opt into patching. @internal */
 declare function isInsideIsland(element: Element): boolean;
 
-export { AUTHORIZED_PREVIEW_BRAND_KEY, type AnalyticsSnapshot, type AuthorizedPreviewContext, type AuthorizedPreviewDocument, type AuthorizedPreviewPayloadScope, type AuthorizedPreviewScope, type BindOptions, type BlockRenderContext, type BlockRenderer, CAPABILITY_DECLARATIONS, CAPABILITY_DOCUMENTATION, type CachedElement, type CapabilityDeclaration, type CapabilityDocumentation, type CapabilitySource, type ConnectionStatus, type CspDirectiveMerge, type CustomRendererKey, DIAGNOSTIC_CODES, type DefaultsProfile, type DiagnosticCode, type DocumentSaveHandler, type DocumentSavePluginOptions, type DocumentSaveStrategy, EventEmitter, type EventHandler, type EventSourcePolicy, type FetchLike, type FieldBindingAttributes, type FieldName, type FieldPath, type FieldRenderer, type FieldTransform, type FieldType, type FocusReportTarget, type FragmentBoundaryAttributes, type FragmentBoundaryOptions, type FragmentContext, type FragmentReport, type FragmentStrategy, type FrameAncestorsOptions, ISLAND_EVENT, type InlineScriptConfig, type InspectionBindings, type InspectionFidelity, type InspectionFragments, type InspectionOrigins, type InspectionProtocol, type InspectionRevisions, type InspectionRoute, type InspectionScheduler, type IslandUpdateDetail, type IssuePreviewTokenOptions, LIBRARY_PROTOCOL_VERSION, type LexicalNode, type LexicalRoot, LivePreviewClient, type LivePreviewClientConfig, type LivePreviewEventMap, type LivePreviewInspection, type LivePreviewPlugin, type NavigationLifecycleOptions, type NavigationLifecycleTarget, OriginDetector, type OwnerBindingAttributes, PROTOCOL_CAPABILITIES, type PayloadDocumentEventDetail, type PayloadFieldCondition, type PayloadFieldSchema, type PayloadFieldType, type PayloadLivePreviewData, type PayloadLivePreviewMessage, type PayloadMedia, type PayloadRelationship, type PayloadSessionStrategy, type PluginCompatibility, type PluginContext, type PluginDisposer, type PluginEvents, type PluginInspection, type PreviewAuthorization, type PreviewAuthorizationOutcome, type PreviewAuthorizationRequest, type PreviewAuthorizationStrategy, type PreviewAuthorizationStrategyName, type PreviewBindings, type PreviewBindingsOptions, type PreviewFocusMessage, type PreviewRequestLike, type PreviewRequestOptions, type PreviewTokenClaims, type PreviewTokenReplayChecks, type PreviewTokenReplayStore, type PreviewTokenTransport, type PreviewVerifierClaims, type ProtocolCapability, type ProtocolNegotiation, type ProtocolProfile, type ProtocolProfileName, type RenderContext, type RendererKey, type RevisionDisplay, type RevisionDisplayState, type RevisionShortfall, type RichTextRenderer, type RouteContext, type RouteOutcome, type RoutePlanContext, type RouteRefresh, type RouteStrategy, type RuntimeArtifact, type SanitizerDocument, type SanitizerPolicyMode, type SignedTokenStrategy, type StrategyHandlers, type SubtleCryptoLike, type SuppressedBinding, TRUSTED_TYPES_POLICY_NAME, type TrustedHtmlPolicyLike, type Unsubscribe, type UpdateSource, VERSION, type ValueAt, type VerifierStrategy, authorizePreviewRequest, bind, bindByPath, bindNavigationLifecycle, buildBuiltinRenderers, buildFrameAncestors, buildScriptSrcWithNonce, createAnalyticsPlugin, createPreviewBindings, createPreviewFocusReporter, debugPlugin, detectInitialLocale, detectProtocolProfile, documentSavePlugin, escapeHtml, escapeHtmlAttribute, generateCspNonce, generateInlineScript, hasCapability, hasPreviewIntent, highlightPlugin, initLivePreview, isAuthorizedPreviewContext, isDevMode, isExternalHttpUrl, isInIframe, isInPopup, isInPreviewContext, isInsideIsland, isLexicalContent, isPreviewRequest, isSafeUrl, issuePreviewToken, lexicalToHtml, lexicalToPlainText, mergeCspHeader, negotiateProtocol, previewBindingsFromLocals, registerBlockRenderer, registerBuiltinRenderer, registerRouteRefresh, reportPreviewFocus, runtimeBuildInfo, sanitizeHtml, setCspCrypto, setSanitizerDocument, setSanitizerPolicy, setTrustedTypesPolicy, trustedHtml, wrapWithScriptTag };
+export { AUTHORIZED_PREVIEW_BRAND_KEY, type AnalyticsSnapshot, type AuthorizedPreviewContext, type AuthorizedPreviewDocument, type AuthorizedPreviewPayloadScope, type AuthorizedPreviewScope, type BindOptions, type BlockRenderContext, type BlockRenderer, CAPABILITY_DECLARATIONS, CAPABILITY_DOCUMENTATION, type CachedElement, type CapabilityDeclaration, type CapabilityDocumentation, type CapabilitySource, type ConnectionStatus, type CspDirectiveMerge, type CustomRendererKey, DIAGNOSTIC_CODES, type DefaultsProfile, type DiagnosticCode, type DocumentSaveHandler, type DocumentSavePluginOptions, type DocumentSaveStrategy, EventEmitter, type EventHandler, type EventSourcePolicy, type FetchLike, type FieldBindingAttributes, type FieldName, type FieldPath, type FieldRenderer, type FieldTransform, type FieldType, type FocusReportTarget, type FragmentBoundaryAttributes, type FragmentBoundaryOptions, type FragmentContext, type FragmentReport, type FragmentStrategy, type FrameAncestorsOptions, ISLAND_EVENT, type InlineScriptConfig, type InspectionBindings, type InspectionFidelity, type InspectionFragments, type InspectionOrigins, type InspectionProtocol, type InspectionRevisions, type InspectionRoute, type InspectionScheduler, type IslandUpdateDetail, type IssuePreviewTokenOptions, LIBRARY_PROTOCOL_VERSION, type LexicalNode, type LexicalRoot, LivePreviewClient, type LivePreviewClientConfig, type LivePreviewEventMap, type LivePreviewInspection, type LivePreviewPlugin, type NavigationLifecycleOptions, type NavigationLifecycleTarget, OriginDetector, type OwnerBindingAttributes, PROTOCOL_CAPABILITIES, type PayloadDocumentEventDetail, type PayloadFieldCondition, type PayloadFieldSchema, type PayloadFieldType, type PayloadLivePreviewData, type PayloadLivePreviewMessage, type PayloadMedia, type PayloadRelationship, type PayloadSessionStrategy, type PluginCompatibility, type PluginContext, type PluginDisposer, type PluginEvents, type PluginInspection, type PreviewAuthorization, type PreviewAuthorizationOutcome, type PreviewAuthorizationRequest, type PreviewAuthorizationStrategy, type PreviewAuthorizationStrategyName, type PreviewBindings, type PreviewBindingsOptions, type PreviewFocusMessage, type PreviewRequestLike, type PreviewRequestOptions, type PreviewTokenClaims, type PreviewTokenReplayChecks, type PreviewTokenReplayStore, type PreviewTokenTransport, type PreviewVerifierClaims, type ProtocolCapability, type ProtocolNegotiation, type ProtocolProfile, type ProtocolProfileName, type RenderContext, type RendererKey, type RevisionDisplay, type RevisionDisplayState, type RevisionShortfall, type RichTextRenderer, type RouteContext, type RouteOutcome, type RoutePlanContext, type RouteRefresh, type RouteStrategy, type RuntimeArtifact, type SanitizerDocument, type SanitizerPolicyMode, type SignedTokenStrategy, type StrategyHandlers, type SubtleCryptoLike, type SuppressedBinding, TRUSTED_TYPES_POLICY_NAME, type TrustedHtmlPolicyLike, type Unsubscribe, type UpdateSource, VERSION, type ValueAt, type VerifierStrategy, authorizePreviewRequest, bind, bindByPath, bindNavigationLifecycle, buildBuiltinRenderers, buildFrameAncestors, buildScriptSrcWithNonce, createAnalyticsPlugin, createPreviewBindings, createPreviewFocusReporter, debugPlugin, detectInitialLocale, detectProtocolProfile, documentSavePlugin, escapeHtml, escapeHtmlAttribute, generateCspNonce, generateInlineScript, hasCapability, hasPreviewIntent, highlightPlugin, initLivePreview, isAuthorizedPreviewContext, isDevMode, isExternalHttpUrl, isInIframe, isInPopup, isInPreviewContext, isInsideIsland, isLexicalContent, isPreviewRequest, isSafeUrl, issuePreviewToken, lexicalToHtml, lexicalToPlainText, markHydrated, mergeCspHeader, negotiateProtocol, previewBindingsFromLocals, registerBlockRenderer, registerBuiltinRenderer, registerRouteRefresh, reportPreviewFocus, runtimeBuildInfo, sanitizeHtml, setCspCrypto, setSanitizerDocument, setSanitizerPolicy, setTrustedTypesPolicy, trustedHtml, wrapWithScriptTag };

package/dist/index.d.ts

@@ -37,6 +37,8 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly UnattributableUpdate: "LP0202";
     /** An update carried a value for a field the page binds nowhere; editing it changes nothing on this page. */
     readonly UnboundField: "LP0203";
+    /** In development: a bound path covers its group under the `descendant` default, which 3.0 changes. */
+    readonly CoverageDefaultChanges: "LP0204";
     /** The visibility gate held offscreen writes back until they scroll into view. */
     readonly VisibilityGateDeferred: "LP0301";
     /** A value was refused because the attribute or the value itself is unsafe. */
@@ -61,7 +63,7 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly UnrenderedBlockKept: "LP0410";
     /** A patch cannot reach what the server would have drawn; `onUnfaithfulPatch` decided what happens next. */
     readonly UnfaithfulPatch: "LP0411";
-    /** The first write to a date, number or checkbox binding replaced a different reading of the same value. */
+    /** The first write to a date, number, checkbox, select or radio binding replaced a different reading of the same value. */
     readonly ServerFormatReplaced: "LP0412";
     /** A Lexical block has no renderer, and the write could not keep the markup the server rendered for it; it is gone. */
     readonly UnrenderedBlockLost: "LP0413";
@@ -81,7 +83,7 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly StartupFailed: "LP0605";
     /** Sending the ready handshake failed. */
     readonly ReadyFailed: "LP0606";
-    /** The page declared hydration, but no React commit, Vue mount or SvelteKit mount came within the cap; the runtime started without waiting. */
+    /** The page declared hydration, but no React commit, Vue mount, SvelteKit mount or `markHydrated()` call came within the cap; the runtime started without waiting. */
     readonly HydrationWaitTimedOut: "LP0607";
     /** The audit found no runtime in a response that carried preview intent. */
     readonly AuditRuntimeMissing: "LP0701";
@@ -123,6 +125,8 @@ declare const DIAGNOSTIC_CODES: Readonly<{
     readonly V2ReadinessGap: "LP0709";
     /** The preview runtime is served to anonymous visitors, not only inside the admin frame. */
     readonly RuntimeOnPublicPage: "LP0710";
+    /** An element carries attributes that only mean something beside `data-payload-field`, and has none. */
+    readonly AuditModifierWithoutField: "LP0711";
 }>;
 /** A diagnostic code, as it appears in log output and on the `error` event. */
 type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[keyof typeof DIAGNOSTIC_CODES];
@@ -209,8 +213,8 @@ interface SanitizeOptions {
     /** Extra tags to allow. Lower-case, untrimmed. */
     readonly additionalAllowedTags?: readonly string[];
     /**
-     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`,
-     * or — under `'strict'` — `id`, `name` and `data-payload-*`.
+     * Extra per-tag attributes, lower-case. Cannot re-admit handlers, `style`, or —
+     * under `'strict'` — `id`, `name` and `data-payload-*`; their URLs are checked.
      */
     readonly additionalAllowedAttributes?: Readonly<Record<string, readonly string[]>>;
     /**
@@ -350,6 +354,8 @@ interface RenderContext {
      * completes the sentence 'field "x" …' in LP0411.
      */
     readonly reportUnfaithful?: (target: CachedElement, reason: string) => void;
+    /** The route of a Lexical internal link, as `internalLinkPattern` gives it. */
+    readonly internalLinkPattern?: string;
 }
 /**
  * A renderer writes one value into its element. It must not throw: one bad
@@ -856,7 +862,7 @@ interface LivePreviewInspection {
      * SvelteKit page is not connected yet; `timed-out` is LP0607.
      */
     readonly hydration: {
-        readonly mode: 'off' | 'react' | 'vue' | 'sveltekit';
+        readonly mode: 'off' | 'react' | 'vue' | 'sveltekit' | 'manual';
         readonly state: 'idle' | 'waiting' | 'committed' | 'timed-out';
     };
 }
@@ -1009,6 +1015,12 @@ interface LivePreviewClientConfig {
     readonly apiRoute?: string;
     /** Population depth used with `serverURL`. Required with it; `defaults: 'v1'` falls back to `1`. */
     readonly mergeDepth?: number;
+    /** Milliseconds the `serverURL` merge may wait before the update shows its raw values. Off by default. */
+    readonly mergeTimeoutMs?: number;
+    /** The route of a Lexical internal link with no `url` of its own, as `/{locale}/{slug}/`. */
+    readonly internalLinkPattern?: string;
+    /** Hold a route render until Payload reports the save: the route shows what is saved. */
+    readonly routeAfterSave?: boolean;
     /** Custom fetch for the `serverURL` merge request: attach auth headers or route through a proxy. */
     readonly mergeFetch?: typeof fetch;
     /** Verbose console output. Defaults to dev-mode detection. */
@@ -1209,6 +1221,22 @@ type RouteRefresh = () => void | Promise<void>;
  */
 declare function registerRouteRefresh(refresh: RouteRefresh): () => void;
 
+/**
+ * Waiting for a page that says when it has hydrated (ADR 0015, addendum of
+ * 2026-10-31). The React, Vue and SvelteKit waits each read a trace their
+ * framework leaves; a page on any other host, or whose host left none, calls
+ * `markHydrated()` instead. The page's bundle and the runtime are separate
+ * scripts and either may run first, so the slot holds a state a late runtime
+ * can still read rather than an event it could miss.
+ */
+
+/**
+ * Tell a runtime started with `hydration: 'manual'` that this page has hydrated, so its
+ * first write lands on markup the framework keeps. Call it once your framework has
+ * taken the page over; a later call changes nothing, and on a server it does nothing.
+ */
+declare function markHydrated(): void;
+
 interface RuntimeBuildInfo {
     readonly generatedAt: string;
     readonly size: number;
@@ -1263,8 +1291,10 @@ interface InlineScriptConfig {
      * Carry the route strategy, so a binding in `<head>` or one marked
      * `data-payload-strategy="route"` refreshes the route. `fragmentEndpoint`
      * implies it — the fragment prelude already contains it. Default `false`.
+     * `'after-save'` renders the route only once Payload reports a save: before it, a
+     * GET shows nothing the editor typed and costs a server render.
      */
-    readonly routeStrategy?: boolean;
+    readonly routeStrategy?: boolean | 'after-save';
     /**
      * The 2.0 name for `onUnfaithfulPatch`, kept until 3.0. `'route'` means
      * `'escalate'`, `'ignore'` means `'ignore'`.
@@ -1297,10 +1327,11 @@ interface InlineScriptConfig {
      * mounted, on a page SvelteKit's client runs on — otherwise Svelte's
      * hydration sets its own text back over it, as quietly. The Next.js, Nuxt
      * and SvelteKit adapters set it on every script they emit; a page built by
-     * hand with `generateInlineScript()` may. Omitted: the runtime starts on
-     * `DOMContentLoaded`, as on a static page.
+     * hand with `generateInlineScript()` may. Under `'manual'` it holds the write
+     * until the page calls `markHydrated()`, for a framework this package cannot
+     * observe. Omitted: the runtime starts on `DOMContentLoaded`, as on a static page.
      */
-    readonly hydration?: 'react' | 'vue' | 'sveltekit';
+    readonly hydration?: 'react' | 'vue' | 'sveltekit' | 'manual';
     /**
      * Which defaults the omitted options fall back to, resolved by the generator
      * rather than the runtime, whose own fallbacks are the 2.0 rows: `'v1'`
@@ -1327,6 +1358,10 @@ interface InlineScriptConfig {
      * declaration; an uncovered one is an unbound change.
      */
     readonly subfieldCoverage?: 'descendant' | 'declared';
+    /** Milliseconds the `serverURL` merge may wait before the update shows its raw values. Off by default. */
+    readonly mergeTimeoutMs?: number;
+    /** The route of a Lexical internal link with no `url` of its own, as `/{locale}/{slug}/`. */
+    readonly internalLinkPattern?: string;
     /**
      * A runtime artifact to embed instead of the full one — today only
      * `LEAN_RUNTIME` from `payload-live-preview/lean`, which leaves out the
@@ -1538,7 +1573,8 @@ interface PreviewAuthorizationRequest {
  * The `payload-session` strategy: forward exactly one named cookie to
  * `GET <serverURL>/api/<usersSlug>/me` and authorize when a user comes back.
  * A cookie-only request preserves working Payload 2 sessions. When `/me`
- * reports no user, one retry adds an `Origin` for Payload 3's CSRF check.
+ * reports no user, one retry adds an `Origin` for Payload 3's CSRF check, and
+ * an endpoint that needed it gets it on the first request from then on.
  */
 
 /** A `fetch`-compatible function, injectable for tests. */
@@ -1561,7 +1597,8 @@ interface PayloadSessionStrategy {
     /**
      * Send this listed origin with the cookie from the first request. Without
      * it, try the existing cookie-only request, then the origin of `serverURL`
-     * once when `/me` reports a null user. Draft reads keep the accepted headers.
+     * once when `/me` reports a null user; an endpoint that needed the origin
+     * gets it first from then on. Draft reads keep the accepted headers.
      */
     readonly origin?: string;
     /** Upper bound for the `/me` round trip. Below 250 ms is raised to 250 ms; default 3000. */
@@ -1792,12 +1829,20 @@ interface LexicalRenderOptions {
     readonly requireDocument?: boolean;
     /**
      * Called for every `block` or `inlineBlock` the registry has no renderer
-     * for, with the block's slug as Payload sent it and the class its empty
-     * placeholder carries. The `richText` write listens: it is the one caller
+     * for, with the block's slug as Payload sent it, the class its empty
+     * placeholder carries and the block's fields. The `richText` write listens: it is the one caller
      * that later knows whether the server's markup for the block survived, so
      * the diagnostic is spoken there (LP0410, LP0413), not here.
      */
-    readonly onUnrenderedBlock?: (blockType: string, placeholderClass: string) => void;
+    readonly onUnrenderedBlock?: (blockType: string, placeholderClass: string, fields: unknown) => void;
+    /**
+     * The route of an internal link whose document has no `url` of its own, such
+     * as `/{locale}/{slug}/`. `{slug}`, `{id}`, `{collection}` and `{locale}` are
+     * filled in and encoded; with one of them empty the link falls back to `/<slug>`.
+     */
+    readonly internalLinkPattern?: string | undefined;
+    /** What `{locale}` reads in `internalLinkPattern`. */
+    readonly locale?: string | undefined;
 }
 /** @internal */
 declare function isLexicalContent(value: unknown): value is LexicalRoot;
@@ -2046,6 +2091,11 @@ interface FieldBindingAttributes {
     readonly 'data-payload-alt'?: string;
     readonly 'data-payload-href'?: string;
     readonly 'data-payload-array-template'?: string;
+    readonly 'data-payload-format'?: string;
+    readonly 'data-payload-text'?: string;
+    readonly 'data-payload-strategy'?: string;
+    readonly 'data-payload-depends'?: string;
+    readonly 'data-payload-boundary'?: string;
 }
 interface BindOptions {
     /** Attribute to write instead of the text content, e.g. `'src'` for `<img>`. */
@@ -2064,6 +2114,19 @@ interface BindOptions {
     readonly href?: string;
     /** Markup per array item with `{{value}}` placeholders. */
     readonly arrayTemplate?: string;
+    /** How a date or number is written, from `data-payload-format`'s vocabulary. */
+    readonly format?: string;
+    /** Let a text write replace the element's children. */
+    readonly text?: boolean;
+    /** Who shows this field: the patch (default), a server-rendered fragment, or the route. */
+    readonly strategy?: 'patch' | 'fragment' | 'route';
+    /** Fields whose change re-applies this binding under `skipUnchanged`. */
+    readonly dependsOn?: readonly string[];
+    /**
+     * An anchor for a field that may be empty, so an edit that fills it has somewhere to
+     * land. Set `hidden` yourself while the value is empty; the runtime keeps it right after that.
+     */
+    readonly anchor?: boolean;
 }
 /** `bind<Homepage>('heroTitle')`; without `T` any string is accepted. */
 declare function bind<T = Record<string, unknown>>(field: FieldName<T>, options?: BindOptions): FieldBindingAttributes;
@@ -2138,7 +2201,7 @@ declare function createPreviewBindings(options: PreviewBindingsOptions): Preview
  * `App.Locals` declaration in the project it writes into. The verdict is
  * checked, not trusted — only a context `authorizePreviewRequest()` produced
  * emits anything (ADR 0006).
- * @internal
+ * @public
  */
 declare function previewBindingsFromLocals(locals: unknown, options?: {
     readonly owner?: string;
@@ -2169,4 +2232,4 @@ interface IslandUpdateDetail {
 /** Whether `element` (or an ancestor) is an island that did not opt into patching. @internal */
 declare function isInsideIsland(element: Element): boolean;
 
-export { AUTHORIZED_PREVIEW_BRAND_KEY, type AnalyticsSnapshot, type AuthorizedPreviewContext, type AuthorizedPreviewDocument, type AuthorizedPreviewPayloadScope, type AuthorizedPreviewScope, type BindOptions, type BlockRenderContext, type BlockRenderer, CAPABILITY_DECLARATIONS, CAPABILITY_DOCUMENTATION, type CachedElement, type CapabilityDeclaration, type CapabilityDocumentation, type CapabilitySource, type ConnectionStatus, type CspDirectiveMerge, type CustomRendererKey, DIAGNOSTIC_CODES, type DefaultsProfile, type DiagnosticCode, type DocumentSaveHandler, type DocumentSavePluginOptions, type DocumentSaveStrategy, EventEmitter, type EventHandler, type EventSourcePolicy, type FetchLike, type FieldBindingAttributes, type FieldName, type FieldPath, type FieldRenderer, type FieldTransform, type FieldType, type FocusReportTarget, type FragmentBoundaryAttributes, type FragmentBoundaryOptions, type FragmentContext, type FragmentReport, type FragmentStrategy, type FrameAncestorsOptions, ISLAND_EVENT, type InlineScriptConfig, type InspectionBindings, type InspectionFidelity, type InspectionFragments, type InspectionOrigins, type InspectionProtocol, type InspectionRevisions, type InspectionRoute, type InspectionScheduler, type IslandUpdateDetail, type IssuePreviewTokenOptions, LIBRARY_PROTOCOL_VERSION, type LexicalNode, type LexicalRoot, LivePreviewClient, type LivePreviewClientConfig, type LivePreviewEventMap, type LivePreviewInspection, type LivePreviewPlugin, type NavigationLifecycleOptions, type NavigationLifecycleTarget, OriginDetector, type OwnerBindingAttributes, PROTOCOL_CAPABILITIES, type PayloadDocumentEventDetail, type PayloadFieldCondition, type PayloadFieldSchema, type PayloadFieldType, type PayloadLivePreviewData, type PayloadLivePreviewMessage, type PayloadMedia, type PayloadRelationship, type PayloadSessionStrategy, type PluginCompatibility, type PluginContext, type PluginDisposer, type PluginEvents, type PluginInspection, type PreviewAuthorization, type PreviewAuthorizationOutcome, type PreviewAuthorizationRequest, type PreviewAuthorizationStrategy, type PreviewAuthorizationStrategyName, type PreviewBindings, type PreviewBindingsOptions, type PreviewFocusMessage, type PreviewRequestLike, type PreviewRequestOptions, type PreviewTokenClaims, type PreviewTokenReplayChecks, type PreviewTokenReplayStore, type PreviewTokenTransport, type PreviewVerifierClaims, type ProtocolCapability, type ProtocolNegotiation, type ProtocolProfile, type ProtocolProfileName, type RenderContext, type RendererKey, type RevisionDisplay, type RevisionDisplayState, type RevisionShortfall, type RichTextRenderer, type RouteContext, type RouteOutcome, type RoutePlanContext, type RouteRefresh, type RouteStrategy, type RuntimeArtifact, type SanitizerDocument, type SanitizerPolicyMode, type SignedTokenStrategy, type StrategyHandlers, type SubtleCryptoLike, type SuppressedBinding, TRUSTED_TYPES_POLICY_NAME, type TrustedHtmlPolicyLike, type Unsubscribe, type UpdateSource, VERSION, type ValueAt, type VerifierStrategy, authorizePreviewRequest, bind, bindByPath, bindNavigationLifecycle, buildBuiltinRenderers, buildFrameAncestors, buildScriptSrcWithNonce, createAnalyticsPlugin, createPreviewBindings, createPreviewFocusReporter, debugPlugin, detectInitialLocale, detectProtocolProfile, documentSavePlugin, escapeHtml, escapeHtmlAttribute, generateCspNonce, generateInlineScript, hasCapability, hasPreviewIntent, highlightPlugin, initLivePreview, isAuthorizedPreviewContext, isDevMode, isExternalHttpUrl, isInIframe, isInPopup, isInPreviewContext, isInsideIsland, isLexicalContent, isPreviewRequest, isSafeUrl, issuePreviewToken, lexicalToHtml, lexicalToPlainText, mergeCspHeader, negotiateProtocol, previewBindingsFromLocals, registerBlockRenderer, registerBuiltinRenderer, registerRouteRefresh, reportPreviewFocus, runtimeBuildInfo, sanitizeHtml, setCspCrypto, setSanitizerDocument, setSanitizerPolicy, setTrustedTypesPolicy, trustedHtml, wrapWithScriptTag };
+export { AUTHORIZED_PREVIEW_BRAND_KEY, type AnalyticsSnapshot, type AuthorizedPreviewContext, type AuthorizedPreviewDocument, type AuthorizedPreviewPayloadScope, type AuthorizedPreviewScope, type BindOptions, type BlockRenderContext, type BlockRenderer, CAPABILITY_DECLARATIONS, CAPABILITY_DOCUMENTATION, type CachedElement, type CapabilityDeclaration, type CapabilityDocumentation, type CapabilitySource, type ConnectionStatus, type CspDirectiveMerge, type CustomRendererKey, DIAGNOSTIC_CODES, type DefaultsProfile, type DiagnosticCode, type DocumentSaveHandler, type DocumentSavePluginOptions, type DocumentSaveStrategy, EventEmitter, type EventHandler, type EventSourcePolicy, type FetchLike, type FieldBindingAttributes, type FieldName, type FieldPath, type FieldRenderer, type FieldTransform, type FieldType, type FocusReportTarget, type FragmentBoundaryAttributes, type FragmentBoundaryOptions, type FragmentContext, type FragmentReport, type FragmentStrategy, type FrameAncestorsOptions, ISLAND_EVENT, type InlineScriptConfig, type InspectionBindings, type InspectionFidelity, type InspectionFragments, type InspectionOrigins, type InspectionProtocol, type InspectionRevisions, type InspectionRoute, type InspectionScheduler, type IslandUpdateDetail, type IssuePreviewTokenOptions, LIBRARY_PROTOCOL_VERSION, type LexicalNode, type LexicalRoot, LivePreviewClient, type LivePreviewClientConfig, type LivePreviewEventMap, type LivePreviewInspection, type LivePreviewPlugin, type NavigationLifecycleOptions, type NavigationLifecycleTarget, OriginDetector, type OwnerBindingAttributes, PROTOCOL_CAPABILITIES, type PayloadDocumentEventDetail, type PayloadFieldCondition, type PayloadFieldSchema, type PayloadFieldType, type PayloadLivePreviewData, type PayloadLivePreviewMessage, type PayloadMedia, type PayloadRelationship, type PayloadSessionStrategy, type PluginCompatibility, type PluginContext, type PluginDisposer, type PluginEvents, type PluginInspection, type PreviewAuthorization, type PreviewAuthorizationOutcome, type PreviewAuthorizationRequest, type PreviewAuthorizationStrategy, type PreviewAuthorizationStrategyName, type PreviewBindings, type PreviewBindingsOptions, type PreviewFocusMessage, type PreviewRequestLike, type PreviewRequestOptions, type PreviewTokenClaims, type PreviewTokenReplayChecks, type PreviewTokenReplayStore, type PreviewTokenTransport, type PreviewVerifierClaims, type ProtocolCapability, type ProtocolNegotiation, type ProtocolProfile, type ProtocolProfileName, type RenderContext, type RendererKey, type RevisionDisplay, type RevisionDisplayState, type RevisionShortfall, type RichTextRenderer, type RouteContext, type RouteOutcome, type RoutePlanContext, type RouteRefresh, type RouteStrategy, type RuntimeArtifact, type SanitizerDocument, type SanitizerPolicyMode, type SignedTokenStrategy, type StrategyHandlers, type SubtleCryptoLike, type SuppressedBinding, TRUSTED_TYPES_POLICY_NAME, type TrustedHtmlPolicyLike, type Unsubscribe, type UpdateSource, VERSION, type ValueAt, type VerifierStrategy, authorizePreviewRequest, bind, bindByPath, bindNavigationLifecycle, buildBuiltinRenderers, buildFrameAncestors, buildScriptSrcWithNonce, createAnalyticsPlugin, createPreviewBindings, createPreviewFocusReporter, debugPlugin, detectInitialLocale, detectProtocolProfile, documentSavePlugin, escapeHtml, escapeHtmlAttribute, generateCspNonce, generateInlineScript, hasCapability, hasPreviewIntent, highlightPlugin, initLivePreview, isAuthorizedPreviewContext, isDevMode, isExternalHttpUrl, isInIframe, isInPopup, isInPreviewContext, isInsideIsland, isLexicalContent, isPreviewRequest, isSafeUrl, issuePreviewToken, lexicalToHtml, lexicalToPlainText, markHydrated, mergeCspHeader, negotiateProtocol, previewBindingsFromLocals, registerBlockRenderer, registerBuiltinRenderer, registerRouteRefresh, reportPreviewFocus, runtimeBuildInfo, sanitizeHtml, setCspCrypto, setSanitizerDocument, setSanitizerPolicy, setTrustedTypesPolicy, trustedHtml, wrapWithScriptTag };