payload-live-preview 2.2.1 → 2.3.0

package/dist/server.d.ts

@@ -106,7 +106,8 @@ interface PreviewAuthorizationRequest {
  * The `payload-session` strategy: forward exactly one named cookie to
  * `GET <serverURL>/api/<usersSlug>/me` and authorize when a user comes back.
  * A cookie-only request preserves working Payload 2 sessions. When `/me`
- * reports no user, one retry adds an `Origin` for Payload 3's CSRF check.
+ * reports no user, one retry adds an `Origin` for Payload 3's CSRF check, and
+ * an endpoint that needed it gets it on the first request from then on.
  */
 
 /** A `fetch`-compatible function, injectable for tests. */
@@ -129,7 +130,8 @@ interface PayloadSessionStrategy {
     /**
      * Send this listed origin with the cookie from the first request. Without
      * it, try the existing cookie-only request, then the origin of `serverURL`
-     * once when `/me` reports a null user. Draft reads keep the accepted headers.
+     * once when `/me` reports a null user; an endpoint that needed the origin
+     * gets it first from then on. Draft reads keep the accepted headers.
      */
     readonly origin?: string;
     /** Upper bound for the `/me` round trip. Below 250 ms is raised to 250 ms; default 3000. */
@@ -309,6 +311,11 @@ interface FieldBindingAttributes {
     readonly 'data-payload-alt'?: string;
     readonly 'data-payload-href'?: string;
     readonly 'data-payload-array-template'?: string;
+    readonly 'data-payload-format'?: string;
+    readonly 'data-payload-text'?: string;
+    readonly 'data-payload-strategy'?: string;
+    readonly 'data-payload-depends'?: string;
+    readonly 'data-payload-boundary'?: string;
 }
 interface BindOptions {
     /** Attribute to write instead of the text content, e.g. `'src'` for `<img>`. */
@@ -327,6 +334,19 @@ interface BindOptions {
     readonly href?: string;
     /** Markup per array item with `{{value}}` placeholders. */
     readonly arrayTemplate?: string;
+    /** How a date or number is written, from `data-payload-format`'s vocabulary. */
+    readonly format?: string;
+    /** Let a text write replace the element's children. */
+    readonly text?: boolean;
+    /** Who shows this field: the patch (default), a server-rendered fragment, or the route. */
+    readonly strategy?: 'patch' | 'fragment' | 'route';
+    /** Fields whose change re-applies this binding under `skipUnchanged`. */
+    readonly dependsOn?: readonly string[];
+    /**
+     * An anchor for a field that may be empty, so an edit that fills it has somewhere to
+     * land. Set `hidden` yourself while the value is empty; the runtime keeps it right after that.
+     */
+    readonly anchor?: boolean;
 }
 /** `bind<Homepage>('heroTitle')`; without `T` any string is accepted. */
 declare function bind<T = Record<string, unknown>>(field: FieldName<T>, options?: BindOptions): FieldBindingAttributes;
@@ -401,7 +421,7 @@ declare function createPreviewBindings(options: PreviewBindingsOptions): Preview
  * `App.Locals` declaration in the project it writes into. The verdict is
  * checked, not trusted — only a context `authorizePreviewRequest()` produced
  * emits anything (ADR 0006).
- * @internal
+ * @public
  */
 declare function previewBindingsFromLocals(locals: unknown, options?: {
     readonly owner?: string;

package/dist/server.js

@@ -1,2 +1,2 @@
-var e="payload-live-preview.authorized-preview-context",t=Symbol.for(e);function isAuthorizedPreviewContext(e){return"object"==typeof e&&null!==e&&!0===e[t]&&Object.isFrozen(e)}function r(r){return Object.freeze({...r,scope:Object.freeze({...r.scope,...void 0===r.scope.payload?{}:{payload:Object.freeze({...r.scope.payload,document:Object.freeze({...r.scope.payload.document})})}}),payloadHeaders:Object.freeze({...r.payloadHeaders}),[t]:!0,[e]:!0})}var n=class extends Error{name="PreviewConfigurationError"};function o(e){return{authorized:!1,outcome:e,context:null}}var i="users",a=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,s=/^[A-Za-z0-9._~-]+$/;function c(e,t,r=4096){if(null===e||0===e.length)return null;const n=`${t}=`,o=[];for(const t of e.split(";")){const e=t.trim();e.startsWith(n)&&o.push(e.slice(n.length))}if(1!==o.length)return null;const i=o[0]??"";return 0===i.length||i.length>r||!s.test(i)?null:i}function u(e,t){let r;try{r=new URL(e)}catch{throw new n(`payload-live-preview: ${t} "${e}" is not an absolute URL`)}if("https:"!==r.protocol&&"http:"!==r.protocol)throw new n(`payload-live-preview: ${t} must be http(s), got "${r.protocol}"`);return r.origin}function l(e,t){if(!function(){try{const e=globalThis.process?.env;return void 0!==e&&"production"!==e.NODE_ENV}catch{return!1}}())return;const r=globalThis,n=r.__payloadLivePreviewDeprecationsWarned??=/* @__PURE__ */new Set;if(!n.has(e)){n.add(e);try{console.warn(`[payload-live-preview] ${t}`)}catch{}}}var d,p="live-preview",f="v1";function h(){return d??=new TextEncoder,d}function v(e){const t="string"==typeof e?h().encode(e):e;if(t.byteLength<32)throw new n(`payload-live-preview: the preview token secret must be at least ${String(32)} bytes`);return t}function y(e){if(void 0!==e)return e;const t=globalThis.crypto;return"object"==typeof t?.subtle?t:void 0}async function g(e,t){return e.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function w(e){let t="";for(const r of e)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function b(e){if(!/^[A-Za-z0-9_-]*$/.test(e))return;const t=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat((4-e.length%4)%4);try{const e=atob(t),r=new Uint8Array(e.length);for(let t=0;t<e.length;t+=1)r[t]=e.charCodeAt(t);return r}catch{return}}async function m(e,t){const r=y(t.crypto);if(void 0===r)throw new Error("payload-live-preview: no Web Crypto implementation available to sign tokens");const n=v(t.secret),o=(t.now??Date.now)(),i=Math.min(36e5,Math.max(1,e.ttlMs??6e5)),a=new Uint8Array(16);r.getRandomValues(a);const s={v:1,aud:e.audience,...void 0!==e.path?{pth:e.path}:{},...void 0!==e.locale?{loc:e.locale}:{},...void 0!==e.subject?{sub:e.subject}:{},pur:e.purpose??p,iat:o,exp:o+i,jti:w(a)},c=w(h().encode(JSON.stringify(s))),u=`${f}.${c}`,l=await g(r,n);return`${u}.${w(new Uint8Array(await r.subtle.sign("HMAC",l,h().encode(u))))}`}function $(e){return"string"==typeof e&&e.length>0&&"."!==e&&".."!==e&&!/[\s\p{Cc}\p{Cs}/\\?#%]/u.test(e)}function A(e){return"number"==typeof e?Number.isSafeInteger(e):$(e)}function x(e,t="/api"){if("string"!=typeof e||"string"!=typeof t)return null;try{const r=new URL(e);if(!["http:","https:"].includes(r.protocol)||r.username||r.password||r.search||r.hash)return null;const n=e.replace(/^[a-z]+:\/\/[^/]+/iu,"").replace(/\/+$/,""),o=t.replace(/^\//,"").replace(/\/$/,"");return""!==n&&!n.slice(1).split("/").every($)||!o.split("/").every($)?null:`${r.origin}${r.pathname.replace(/\/+$/,"")}/${o}`}catch{return null}}function j(e){return void 0!==e.expiresAt&&Number.isFinite(e.expiresAt)&&e.expiresAt>Date.now()}function k(e,t){return e.kind===t.kind&&e.slug===t.slug&&("global"===e.kind||A(t.id)&&String(e.id)===String(t.id))}async function z(e,t){switch(t.type){case"payload-session":return async function(e,t){const s=function(e){const t=e??"payload-token";if(!a.test(t))throw new n(`payload-live-preview: cookie name "${t}" is not a valid cookie-name token`);return t}(t.cookieName),l=u(t.serverURL,"serverURL"),d=void 0===t.origin?void 0:u(t.origin,"origin"),p=c(e.headers.get("cookie"),s,t.maxCookieLength??4096);if(null===p)return o("missing-credential");const f=t.now??Date.now,h=Math.max(250,t.timeoutMs??3e3);if(!Number.isSafeInteger(h))return o("unavailable");const v=t.fetch??globalThis.fetch,y=encodeURIComponent(t.usersSlug??i),g=`${s}=${p}`;let w={cookie:g};void 0!==d&&(w.origin=d);const b=new AbortController,m=()=>{b.abort(e.signal?.reason)},$=()=>b.signal.aborted;let A,x;e.signal?.addEventListener("abort",m,{once:!0}),!0===e.signal?.aborted&&m();try{if($())return o("unavailable");A=setTimeout(()=>{b.abort(new DOMException("The operation timed out","TimeoutError"))},h);for(let e=0;e<2;e++){const t=await v(`${l}/api/${y}/me?depth=0`,{headers:{...w,accept:"application/json"},signal:b.signal});if($())return o("unavailable");if(!t.ok)return o(401===t.status?"invalid":"unavailable");if(x=await t.json(),$())return o("unavailable");if(0!==e||void 0!==d||"object"!=typeof x||null===x||null!==x.user)break;w={cookie:g,origin:l}}}catch{return o("unavailable")}finally{void 0!==A&&clearTimeout(A),e.signal?.removeEventListener("abort",m)}const j=function(e,t){if("object"!=typeof e||null===e||Array.isArray(e))return null;const r=e.user;if("object"!=typeof r||null===r||Array.isArray(r))return null;const n=e.collection??r.collection;if(void 0!==n&&n!==t)return null;const o=r.id;return"string"==typeof o&&o.length>0?o:"number"==typeof o&&Number.isFinite(o)?String(o):null}(x,t.usersSlug??i);if(null===j)return o("invalid");const k=function(e){const t=e.exp;return"number"!=typeof t||!Number.isFinite(t)||t<=0?void 0:t<1e11?1e3*t:t}(x);return void 0!==k&&k<=f()?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"payload-session",subject:j,authorizedAt:f(),expiresAt:k,scope:{},payloadHeaders:w})}}(e,t);case"signed-token":return async function(e,t){const n=v(t.secret),i=y(t.crypto);if(void 0===i)return o("unavailable");const a=function(e,t){if("header"===t?.kind)return e.headers.get(t.name??"x-preview-token");let r;try{r=new URL(e.url)}catch{return null}const n=r.searchParams.getAll(t?.param??"previewToken");return 1===n.length?n[0]??null:null}(e,t.transport);if(null===a||0===a.length)return o("missing-credential");if(a.length>4096)return o("invalid");const s=a.split(".");if(3!==s.length||s[0]!==f)return o("invalid");const c=s[1]??"",u=b(c),d=b(s[2]??"");if(void 0===u||32!==d?.byteLength)return o("invalid");let w;try{const e=await g(i,n);w=await i.subtle.verify("HMAC",e,d,h().encode(`${f}.${c}`))}catch{return o("unavailable")}if(!w)return o("invalid");const m=function(e){let t;try{t=JSON.parse((new TextDecoder).decode(e))}catch{return}if("object"!=typeof t||null===t)return;const r=t,n=e=>void 0===r[e]||"string"==typeof r[e];return 1===r.v&&"string"==typeof r.aud&&"string"==typeof r.pur&&"number"==typeof r.iat&&"number"==typeof r.exp&&"string"==typeof r.jti&&n("pth")&&n("loc")&&n("sub")?r:void 0}(u);if(void 0===m)return o("invalid");const $=(t.now??Date.now)();if(m.exp<=$||m.iat>m.exp)return o("expired");if(m.aud!==t.audience)return o("wrong-audience");if(m.pur!==(t.purpose??p))return o("wrong-purpose");if(void 0!==m.pth){let t;try{t=new URL(e.url).pathname}catch{return o("invalid")}if(m.pth!==t)return o("wrong-path")}if(void 0!==m.loc){const r=t.locale?.(e);if(r!==m.loc)return o("wrong-locale")}if(void 0!==t.replay){let e;try{e=await async function(e,t,r){return"consume"in e?!0===await e.consume(t,r):(l("replay-is-used","A `signed-token` replay store with `isUsed` and `markUsed` is removed in 3.0: implement `consume(id, expiresAt)`, which checks and records in one step (ADR 0026)."),!await e.isUsed(t)&&(await e.markUsed(t,r),!0))}(t.replay,m.jti,m.exp)}catch{return o("unavailable")}if(!e)return o("replayed")}return{authorized:!0,outcome:"authorized",context:r({strategy:"signed-token",subject:m.sub,authorizedAt:$,expiresAt:m.exp,scope:{audience:m.aud,...void 0!==m.pth?{path:m.pth}:{},...void 0!==m.loc?{locale:m.loc}:{}},payloadHeaders:{}})}}(e,t);case"verifier":return async function(e,t){let n;try{n=await t.verify(e)}catch{return o("unavailable")}if(null===n)return o("invalid");if(!(void 0===n.scope?.payload||function(e){if("object"!=typeof e||null===e)return!1;const t=e,r=t.document;return!(null===x(t.serverURL,t.apiRoute)||"number"!=typeof t.maxDepth||!Number.isSafeInteger(t.maxDepth)||t.maxDepth<0||"object"!=typeof r||null===r||!$(r.slug))&&("global"===r.kind||"collection"===r.kind&&A(r.id))}(n.scope.payload)&&Number.isFinite(n.expiresAt)))return o("invalid");const i=(t.now??Date.now)();return void 0!==n.expiresAt&&n.expiresAt<=i?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"verifier",subject:n.subject,authorizedAt:i,expiresAt:n.expiresAt,scope:n.scope??{},payloadHeaders:n.payloadHeaders??{}})}}(e,t)}}var R=["preview","draft","livePreview"];function U(e,t={}){const r=new Set(t.signals??["query","fetch-dest","referer"]),n=t.queryParams??R;if(r.has("query")){let t;try{t=new URL(e.url)}catch{t=void 0}if(void 0!==t)for(const e of n){const r=t.searchParams.getAll(e).at(-1);if("true"===r||"1"===r)return!0}}if(r.has("fetch-dest")&&"iframe"===e.headers.get("sec-fetch-dest"))return!0;const o=t.adminOrigins;void 0!==o&&l("admin-origins","`hasPreviewIntent({ adminOrigins })` is removed in 3.0: name the option `allowedOrigins`; `pll migrate` renames it (ADR 0026).");const i=t.allowedOrigins??o??[],a=r.has("referer")?i:[];if(a.length>0){const t=e.headers.get("referer");if(null!==t)try{const e=new URL(t).origin;for(const t of a)try{if(new URL(t).origin===e)return!0}catch{}}catch{}}return!1}function bind(e,t){return O(e,t)}function bindByPath(e,t){const r=function(e){const t=[],r=new Proxy({},{get(e,n){if("symbol"!=typeof n)return/^\d+$/.test(n)||t.push(n),r}});try{e(r)}catch{}return t}(e);if(0===r.length)throw new Error("bindByPath: the picker did not read any field — return data.<field> instead of a constant");return O(r.join("."),t)}function O(e,t){if(0===e.length)throw new Error("bind: field name must be a non-empty string");const r={"data-payload-field":e};return void 0!==t?.attribute&&(r["data-payload-attribute"]=t.attribute),void 0!==t?.type&&(r["data-payload-type"]=t.type),!0===t?.richtext&&(r["data-payload-richtext"]=""),!0===t?.html&&(r["data-payload-html"]=""),void 0!==t?.locale&&(r["data-payload-locale"]=t.locale),void 0!==t?.alt&&(r["data-payload-alt"]=t.alt),void 0!==t?.href&&(r["data-payload-href"]=t.href),void 0!==t?.arrayTemplate&&(r["data-payload-array-template"]=t.arrayTemplate),r}var S=/^[a-z][a-z0-9-]{0,63}$/u,P=Object.freeze({});function createPreviewBindings(e){const t=isAuthorizedPreviewContext(e.authorization),r=void 0!==e.owner&&e.owner.length>0?e.owner:void 0;return Object.freeze({authorized:t,bind:(e,r)=>t?bind(e,r):P,bindByPath:(e,r)=>t?bindByPath(e,r):P,owner:()=>t&&void 0!==r?{"data-payload-owner":r}:P,boundary:(e,r={})=>{const n=function(e,t){if(!S.test(e))throw new RangeError(`createPreviewBindings().boundary(): "${e}" is not a registry id — lowercase, starting with a letter, then letters, digits or hyphens (max 64). The runtime would post it and the endpoint would refuse it.`);const r=t.key;if(void 0!==r&&(0===r.length||r.length>128))throw new RangeError(`createPreviewBindings().boundary(): the key for "${e}" must be 1 to ${String(128)} characters.`);const n=t.dependsOn??[];return{"data-payload-fragment":e,...void 0!==r?{"data-payload-fragment-key":r}:{},...n.length>0?{"data-payload-depends":n.join(",")}:{}}}(e,r);return t?n:P},covers:(...e)=>{const r=function(e){for(const t of e)if(0===t.length||/[\s,]/u.test(t))throw new RangeError(`createPreviewBindings().covers(): "${t}" is not a field path — a name or a dotted path without spaces or commas.`);return{"data-payload-covers":e.join(" ")}}(e);return t&&e.length>0?r:P}})}function L(e,t={}){return createPreviewBindings({authorization:("object"==typeof e&&null!==e?e.livePreviewAuthorization:void 0)??null,...void 0!==t.owner?{owner:t.owner}:{}})}var E=class extends Error{reason;status;url;constructor(e,t,r,n){super(`payload-live-preview: preview read failed (${e}${void 0===r?"":` ${String(r)}`}) for ${t}`,{cause:n}),this.name="PreviewFetchError",this.reason=e,this.status=r,this.url=t}};function C(e){const t=function(e){let t;try{t=new URL(e)}catch{throw new Error(`payload-live-preview: serverURL "${e}" is not an absolute URL`)}if("https:"!==t.protocol&&"http:"!==t.protocol)throw new Error(`payload-live-preview: serverURL must be http(s), got "${t.protocol}"`);return`${t.origin}${t.pathname.replace(/\/+$/,"")}`}(e.serverURL),r=e.apiRoute??"/api",n=r.startsWith("/")?r:`/${r}`;if(!Number.isInteger(e.depth)||e.depth<0)throw new Error(`payload-live-preview: depth must be a non-negative integer, got ${String(e.depth)}`);const o=Math.max(250,e.timeoutMs??5e3),i=Object.freeze({serverURL:t,apiRoute:n,depth:e.depth,timeoutMs:o}),a=Object.freeze({serverURL:t,apiRoute:n,mergeDepth:e.depth}),s=`${t}${n}`,c={config:Object.freeze({...e,...i}),timeoutMs:o};return Object.freeze({config:i,runtimeOptions:a,async fetchDocument(e){const t=T(e),r=void 0!==e.id,n=(!r||A(e.id)&&void 0===e.where)&&D(c.config,e,{kind:"collection",slug:e.collection,id:e.id});if(!n)return H(c,s,e,t,!1);const o=N(i.depth,e,t);r||(o.set("limit","1"),void 0!==e.where&&W(o,e.where,["where"]));const a=A(e.id)?`/${encodeURIComponent(String(e.id))}`:"",u=`${s}/${encodeURIComponent(e.collection)}${a}?${o.toString()}`;if(r)return H(c,u,e,t,n);const l=await H(c,u,e,t,n);if(!l.ok)return l;const d=l.data?.docs?.[0];return{ok:!0,data:d??null,draft:t,status:l.status}},async fetchGlobal(e){const t=T(e),r=N(i.depth,e,t),n=`${s}/globals/${encodeURIComponent(e.global)}?${r.toString()}`;return H(c,n,e,t,D(c.config,e,{kind:"global",slug:e.global}))}})}function D(e,t,r){const n=isAuthorizedPreviewContext(t.authorization)?t.authorization:null,o=n?.scope.payload;return void 0===o||null===n||j(n)&&(void 0===n.scope.locale||n.scope.locale===t.locale)&&x(e.serverURL,e.apiRoute)===x(o.serverURL,o.apiRoute)&&e.depth<=o.maxDepth&&k(o.document,r)}function M(e){return B(e,{ok:!1,reason:"scope",status:void 0,draft:e.draft,cause:void 0})}function T(e){return isAuthorizedPreviewContext(e.authorization)}function N(e,t,r){const n=new URLSearchParams;return n.set("depth",String(e)),r&&n.set("draft","true"),void 0!==t.locale&&n.set("locale",t.locale),n}async function H({config:e,timeoutMs:t},r,n,o,i){const a=e.fetch??("function"==typeof fetch?fetch:void 0),s={config:e,url:r,draft:o,errorMode:n.errorMode??"result",startedAt:Date.now()};if(!i)return M(s);if(void 0===a)return B(s,{ok:!1,reason:"no-fetch",status:void 0,draft:o,cause:void 0});const c=AbortSignal.timeout(t),u=void 0===n.signal?c:AbortSignal.any([c,n.signal]),l=isAuthorizedPreviewContext(n.authorization)?n.authorization:null;let d,p;try{const e=new Headers({accept:"application/json",...n.headers});for(const[t,r]of Object.entries(l?.payloadHeaders??{}))e.set(t,r);d=await a(r,{headers:Object.fromEntries(e),signal:u,cache:"no-store",redirect:"error"})}catch(e){return B(s,{ok:!1,reason:I(e,n.signal),status:void 0,draft:o,cause:e})}if(void 0!==l?.scope.payload&&!j(l))return M(s);if(!d.ok)return B(s,{ok:!1,reason:"http",status:d.status,draft:o,cause:void 0});try{p=await d.json()}catch(e){return B(s,{ok:!1,reason:"invalid-json",status:d.status,draft:o,cause:e})}return void 0!==l?.scope.payload&&!j(l)||void 0!==l?.scope.payload&&!function(e,t){if("object"!=typeof t||null===t||Array.isArray(t))return!1;const r=t;return"global"===e.kind?!Object.hasOwn(r,"globalType")||r.globalType===e.slug:Object.hasOwn(r,"id")&&k(e,{kind:"collection",slug:e.slug,id:r.id})}(l.scope.payload.document,p)?M(s):B(s,{ok:!0,data:p,draft:o,status:d.status})}function B(e,t){const{config:r,url:n,draft:o}=e,i=Date.now()-e.startedAt;if(t.ok)return r.onDiagnostic?.({kind:"response",url:n,status:t.status,draft:o,durationMs:i}),t;if(r.onDiagnostic?.({kind:"failure",url:n,reason:t.reason,status:t.status,draft:o,durationMs:i}),"throw"===e.errorMode)throw new E(t.reason,n,t.status,t.cause);return t}function I(e,t){if(!0===t?.aborted)return"aborted";const r="object"==typeof e&&null!==e?e.name:void 0;return"TimeoutError"===r?"timeout":"AbortError"===r?"aborted":"network"}function _(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function F(e){return e.map((e,t)=>0===t?e:`[${e}]`).join("")}function W(e,t,r){for(const[n,o]of Object.entries(t)){const t=[...r,n];_(o)?W(e,o,t):Array.isArray(o)&&o.some(_)?o.forEach((r,n)=>{W(e,r,[...t,String(n)])}):Array.isArray(o)?e.set(F(t),o.map(String).join(",")):e.set(F(t),"object"==typeof o?"null":String(o))}}export{e as AUTHORIZED_PREVIEW_BRAND_KEY,E as PreviewFetchError,z as authorizePreviewRequest,bind,bindByPath,createPreviewBindings,C as definePreview,c as extractCookie,U as hasPreviewIntent,isAuthorizedPreviewContext,m as issuePreviewToken,L as previewBindingsFromLocals};
+var e="payload-live-preview.authorized-preview-context",t=Symbol.for(e);function isAuthorizedPreviewContext(e){return"object"==typeof e&&null!==e&&!0===e[t]&&Object.isFrozen(e)}function r(r){const n={...r,scope:Object.freeze({...r.scope,...void 0===r.scope.payload?{}:{payload:Object.freeze({...r.scope.payload,document:Object.freeze({...r.scope.payload.document})})}}),payloadHeaders:Object.freeze({...r.payloadHeaders}),[t]:!0,[e]:!0};return Object.defineProperty(n,"payloadHeaders",{enumerable:!1}),Object.freeze(n)}var n=class extends Error{name="PreviewConfigurationError"};function o(e){return{authorized:!1,outcome:e,context:null}}var i="users",a=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,s=/^[A-Za-z0-9._~-]+$/,c=/* @__PURE__ */new WeakMap;function l(e,t,r=4096){if(null===e||0===e.length)return null;const n=`${t}=`,o=[];for(const t of e.split(";")){const e=t.trim();e.startsWith(n)&&o.push(e.slice(n.length))}if(1!==o.length)return null;const i=o[0]??"";return 0===i.length||i.length>r||!s.test(i)?null:i}function u(e,t){let r;try{r=new URL(e)}catch{throw new n(`payload-live-preview: ${t} "${e}" is not an absolute URL`)}if("https:"!==r.protocol&&"http:"!==r.protocol)throw new n(`payload-live-preview: ${t} must be http(s), got "${r.protocol}"`);return r.origin}function d(e,t){if(!function(){try{const e=globalThis.process?.env;return void 0!==e&&"production"!==e.NODE_ENV}catch{return!1}}())return;const r=globalThis,n=r.__payloadLivePreviewDeprecationsWarned??=/* @__PURE__ */new Set;if(!n.has(e)){n.add(e);try{console.warn(`[payload-live-preview] ${t}`)}catch{}}}var p,f="live-preview",h=36e5,y="v1";function v(){return p??=new TextEncoder,p}function g(e){const t="string"==typeof e?v().encode(e):e;if(t.byteLength<32)throw new n(`payload-live-preview: the preview token secret must be at least ${String(32)} bytes`);return t}function w(e){if(void 0!==e)return e;const t=globalThis.crypto;return"object"==typeof t?.subtle?t:void 0}async function b(e,t){return e.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function m(e){let t="";for(const r of e)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function A(e){if(!/^[A-Za-z0-9_-]*$/.test(e))return;const t=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat((4-e.length%4)%4);try{const e=atob(t),r=new Uint8Array(e.length);for(let t=0;t<e.length;t+=1)r[t]=e.charCodeAt(t);return r}catch{return}}async function $(e,t){const r=w(t.crypto);if(void 0===r)throw new Error("payload-live-preview: no Web Crypto implementation available to sign tokens");const n=g(t.secret),o=(t.now??Date.now)(),i=Math.min(h,Math.max(1,e.ttlMs??6e5)),a=new Uint8Array(16);r.getRandomValues(a);const s={v:1,aud:e.audience,...void 0!==e.path?{pth:e.path}:{},...void 0!==e.locale?{loc:e.locale}:{},...void 0!==e.subject?{sub:e.subject}:{},pur:e.purpose??f,iat:o,exp:o+i,jti:m(a)},c=m(v().encode(JSON.stringify(s))),l=`${y}.${c}`,u=await b(r,n);return`${l}.${m(new Uint8Array(await r.subtle.sign("HMAC",u,v().encode(l))))}`}function x(e){return"string"==typeof e&&e.length>0&&"."!==e&&".."!==e&&!/[\s\p{Cc}\p{Cs}/\\?#%]/u.test(e)}function k(e){return"number"==typeof e?Number.isSafeInteger(e):x(e)}function j(e,t="/api"){if("string"!=typeof e||"string"!=typeof t)return null;try{const r=new URL(e);if(!["http:","https:"].includes(r.protocol)||r.username||r.password||r.search||r.hash)return null;const n=e.replace(/^[a-z]+:\/\/[^/]+/iu,"").replace(/\/+$/,""),o=t.replace(/^\//,"").replace(/\/$/,"");return""!==n&&!n.slice(1).split("/").every(x)||!o.split("/").every(x)?null:`${r.origin}${r.pathname.replace(/\/+$/,"")}/${o}`}catch{return null}}function z(e){return void 0!==e.expiresAt&&Number.isFinite(e.expiresAt)&&e.expiresAt>Date.now()}function R(e,t){return e.kind===t.kind&&e.slug===t.slug&&("global"===e.kind||k(t.id)&&String(e.id)===String(t.id))}async function O(e,t){switch(t.type){case"payload-session":return async function(e,t){const s=function(e){const t=e??"payload-token";if(!a.test(t))throw new n(`payload-live-preview: cookie name "${t}" is not a valid cookie-name token`);return t}(t.cookieName),d=u(t.serverURL,"serverURL"),p=void 0===t.origin?void 0:u(t.origin,"origin"),f=l(e.headers.get("cookie"),s,t.maxCookieLength??4096);if(null===f)return o("missing-credential");const h=t.now??Date.now,y=Math.max(250,t.timeoutMs??3e3);if(!Number.isSafeInteger(y))return o("unavailable");const v=t.fetch??globalThis.fetch,g=`${d}/api/${encodeURIComponent(t.usersSlug??i)}/me?depth=0`,w=c.get(v)??/* @__PURE__ */new Map,b=`${s}=${f}`;let m={cookie:b};void 0!==p?m.origin=p:w.has(g)&&(m.origin=d);const A=new AbortController,$=()=>{A.abort(e.signal?.reason)},x=()=>A.signal.aborted;let k,j;e.signal?.addEventListener("abort",$,{once:!0}),!0===e.signal?.aborted&&$();try{if(x())return o("unavailable");k=setTimeout(()=>{A.abort(new DOMException("The operation timed out","TimeoutError"))},y);for(let e=0;e<2;e++){const t=await v(g,{headers:{...m,accept:"application/json"},signal:A.signal});if(x())return o("unavailable");if(!t.ok)return o(401===t.status?"invalid":"unavailable");if(j=await t.json(),x())return o("unavailable");const r="object"==typeof j&&null!==j?j.user:void 0;if(0!==e){if("object"!=typeof r||null===r||Array.isArray(r))break;void 0===m.origin?w.delete(g):(c.set(v,w),w.set(g,h()));break}if(void 0!==p||null!==r)break;if(void 0!==m.origin){if(h()-(w.get(g)??0)<6e4)break;w.set(g,h()),m={cookie:b}}else m={cookie:b,origin:d}}}catch{return o("unavailable")}finally{void 0!==k&&clearTimeout(k),e.signal?.removeEventListener("abort",$)}const z=function(e,t){if("object"!=typeof e||null===e||Array.isArray(e))return null;const r=e.user;if("object"!=typeof r||null===r||Array.isArray(r))return null;const n=e.collection??r.collection;if(void 0!==n&&n!==t)return null;const o=r.id;return"string"==typeof o&&o.length>0?o:"number"==typeof o&&Number.isFinite(o)?String(o):null}(j,t.usersSlug??i);if(null===z)return o("invalid");const R=function(e){const t=e.exp;return"number"!=typeof t||!Number.isFinite(t)||t<=0?void 0:t<1e11?1e3*t:t}(j);return void 0!==R&&R<=h()?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"payload-session",subject:z,authorizedAt:h(),expiresAt:R,scope:{},payloadHeaders:m})}}(e,t);case"signed-token":return async function(e,t){const n=g(t.secret),i=w(t.crypto);if(void 0===i)return o("unavailable");const a=function(e,t){if("header"===t?.kind)return e.headers.get(t.name??"x-preview-token");let r;try{r=new URL(e.url)}catch{return null}const n=r.searchParams.getAll(t?.param??"previewToken");return 1===n.length?n[0]??null:null}(e,t.transport);if(null===a||0===a.length)return o("missing-credential");if(a.length>4096)return o("invalid");const s=a.split(".");if(3!==s.length||s[0]!==y)return o("invalid");const c=s[1]??"",l=A(c),u=A(s[2]??"");if(void 0===l||32!==u?.byteLength)return o("invalid");let p;try{const e=await b(i,n);p=await i.subtle.verify("HMAC",e,u,v().encode(`${y}.${c}`))}catch{return o("unavailable")}if(!p)return o("invalid");const m=function(e){let t;try{t=JSON.parse((new TextDecoder).decode(e))}catch{return}if("object"!=typeof t||null===t)return;const r=t,n=e=>void 0===r[e]||"string"==typeof r[e];return 1===r.v&&"string"==typeof r.aud&&"string"==typeof r.pur&&"number"==typeof r.iat&&"number"==typeof r.exp&&"string"==typeof r.jti&&n("pth")&&n("loc")&&n("sub")?r:void 0}(l);if(void 0===m)return o("invalid");const $=(t.now??Date.now)();if(m.exp<=$||m.iat>m.exp)return o("expired");if(m.exp-m.iat>h)return o("invalid");if(m.aud!==t.audience)return o("wrong-audience");if(m.pur!==(t.purpose??f))return o("wrong-purpose");if(void 0!==m.pth){let t;try{t=new URL(e.url).pathname}catch{return o("invalid")}if(m.pth!==t)return o("wrong-path")}if(void 0!==m.loc){const r=t.locale?.(e);if(r!==m.loc)return o("wrong-locale")}if(void 0!==t.replay){let e;try{e=await async function(e,t,r){return"consume"in e?!0===await e.consume(t,r):(d("replay-is-used","A `signed-token` replay store with `isUsed` and `markUsed` is removed in 3.0: implement `consume(id, expiresAt)`, which checks and records in one step (ADR 0026)."),!await e.isUsed(t)&&(await e.markUsed(t,r),!0))}(t.replay,m.jti,m.exp)}catch{return o("unavailable")}if(!e)return o("replayed")}return{authorized:!0,outcome:"authorized",context:r({strategy:"signed-token",subject:m.sub,authorizedAt:$,expiresAt:m.exp,scope:{audience:m.aud,...void 0!==m.pth?{path:m.pth}:{},...void 0!==m.loc?{locale:m.loc}:{}},payloadHeaders:{}})}}(e,t);case"verifier":return async function(e,t){let n;try{n=await t.verify(e)}catch{return o("unavailable")}if(null===n)return o("invalid");if(!(void 0===n.scope?.payload||function(e){if("object"!=typeof e||null===e)return!1;const t=e,r=t.document;return!(null===j(t.serverURL,t.apiRoute)||"number"!=typeof t.maxDepth||!Number.isSafeInteger(t.maxDepth)||t.maxDepth<0||"object"!=typeof r||null===r||!x(r.slug))&&("global"===r.kind||"collection"===r.kind&&k(r.id))}(n.scope.payload)&&Number.isFinite(n.expiresAt)))return o("invalid");const i=(t.now??Date.now)();return void 0!==n.expiresAt&&n.expiresAt<=i?o("expired"):{authorized:!0,outcome:"authorized",context:r({strategy:"verifier",subject:n.subject,authorizedAt:i,expiresAt:n.expiresAt,scope:n.scope??{},payloadHeaders:n.payloadHeaders??{}})}}(e,t)}}var U=["preview","draft","livePreview"];function P(e,t={}){const r=new Set(t.signals??["query","fetch-dest","referer"]),n=t.queryParams??U;if(r.has("query")){let t;try{t=new URL(e.url)}catch{t=void 0}if(void 0!==t)for(const e of n){const r=t.searchParams.getAll(e).at(-1);if("true"===r||"1"===r)return!0}}if(r.has("fetch-dest")&&"iframe"===e.headers.get("sec-fetch-dest"))return!0;const o=t.adminOrigins;void 0!==o&&d("admin-origins","`hasPreviewIntent({ adminOrigins })` is removed in 3.0: name the option `allowedOrigins`; `pll migrate` renames it (ADR 0026).");const i=t.allowedOrigins??o??[],a=r.has("referer")?i:[];if(a.length>0){const t=e.headers.get("referer");if(null!==t)try{const e=new URL(t).origin;for(const t of a)try{if(new URL(t).origin===e)return!0}catch{}}catch{}}return!1}function bind(e,t){return S(e,t)}function bindByPath(e,t){const r=function(e){const t=[],r=new Proxy({},{get(e,n){if("symbol"!=typeof n)return/^\d+$/.test(n)||t.push(n),r}});try{e(r)}catch{}return t}(e);if(0===r.length)throw new Error("bindByPath: the picker did not read any field — return data.<field> instead of a constant");return S(r.join("."),t)}function S(e,t){if(0===e.length)throw new Error("bind: field name must be a non-empty string");const r={"data-payload-field":e};return void 0!==t?.attribute&&(r["data-payload-attribute"]=t.attribute),void 0!==t?.type&&(r["data-payload-type"]=t.type),!0===t?.richtext&&(r["data-payload-richtext"]=""),!0===t?.html&&(r["data-payload-html"]=""),void 0!==t?.locale&&(r["data-payload-locale"]=t.locale),void 0!==t?.alt&&(r["data-payload-alt"]=t.alt),void 0!==t?.href&&(r["data-payload-href"]=t.href),void 0!==t?.arrayTemplate&&(r["data-payload-array-template"]=t.arrayTemplate),void 0!==t?.format&&(r["data-payload-format"]=t.format),!0===t?.text&&(r["data-payload-text"]=""),void 0!==t?.strategy&&(r["data-payload-strategy"]=t.strategy),void 0!==t?.dependsOn&&t.dependsOn.length>0&&(r["data-payload-depends"]=t.dependsOn.join(",")),!0===t?.anchor&&(r["data-payload-boundary"]=""),r}var L=/^[a-z][a-z0-9-]{0,63}$/u,E=Object.freeze({});function createPreviewBindings(e){const t=isAuthorizedPreviewContext(e.authorization),r=void 0!==e.owner&&e.owner.length>0?e.owner:void 0;return Object.freeze({authorized:t,bind:(e,r)=>t?bind(e,r):E,bindByPath:(e,r)=>t?bindByPath(e,r):E,owner:()=>t&&void 0!==r?{"data-payload-owner":r}:E,boundary:(e,r={})=>{const n=function(e,t){if(!L.test(e))throw new RangeError(`createPreviewBindings().boundary(): "${e}" is not a registry id — lowercase, starting with a letter, then letters, digits or hyphens (max 64). The runtime would post it and the endpoint would refuse it.`);const r=t.key;if(void 0!==r&&(0===r.length||r.length>128))throw new RangeError(`createPreviewBindings().boundary(): the key for "${e}" must be 1 to ${String(128)} characters.`);const n=t.dependsOn??[];return{"data-payload-fragment":e,...void 0!==r?{"data-payload-fragment-key":r}:{},...n.length>0?{"data-payload-depends":n.join(",")}:{}}}(e,r);return t?n:E},covers:(...e)=>{const r=function(e){for(const t of e)if(0===t.length||/[\s,]/u.test(t))throw new RangeError(`createPreviewBindings().covers(): "${t}" is not a field path — a name or a dotted path without spaces or commas.`);return{"data-payload-covers":e.join(" ")}}(e);return t&&e.length>0?r:E}})}function C(e,t={}){return createPreviewBindings({authorization:("object"==typeof e&&null!==e?e.livePreviewAuthorization:void 0)??null,...void 0!==t.owner?{owner:t.owner}:{}})}var D=class extends Error{reason;status;url;constructor(e,t,r,n){super(`payload-live-preview: preview read failed (${e}${void 0===r?"":` ${String(r)}`}) for ${t}`,{cause:n}),this.name="PreviewFetchError",this.reason=e,this.status=r,this.url=t}};function M(e){const t=function(e){let t;try{t=new URL(e)}catch{throw new Error(`payload-live-preview: serverURL "${e}" is not an absolute URL`)}if("https:"!==t.protocol&&"http:"!==t.protocol)throw new Error(`payload-live-preview: serverURL must be http(s), got "${t.protocol}"`);return`${t.origin}${t.pathname.replace(/\/+$/,"")}`}(e.serverURL),r=e.apiRoute??"/api",n=r.startsWith("/")?r:`/${r}`;if(!Number.isInteger(e.depth)||e.depth<0)throw new Error(`payload-live-preview: depth must be a non-negative integer, got ${String(e.depth)}`);const o=Math.max(250,e.timeoutMs??5e3),i=Object.freeze({serverURL:t,apiRoute:n,depth:e.depth,timeoutMs:o}),a=Object.freeze({serverURL:t,apiRoute:n,mergeDepth:e.depth}),s=`${t}${n}`,c={config:Object.freeze({...e,...i}),timeoutMs:o};return Object.freeze({config:i,runtimeOptions:a,async fetchDocument(e){const t=N(e),r=void 0!==e.id,n=(!r||k(e.id)&&void 0===e.where)&&T(c.config,e,{kind:"collection",slug:e.collection,id:e.id});if(!n)return I(c,s,e,t,!1);const o=B(i.depth,e,t);r||(o.set("limit","1"),void 0!==e.where&&Z(o,e.where,["where"]));const a=k(e.id)?`/${encodeURIComponent(String(e.id))}`:"",l=`${s}/${encodeURIComponent(e.collection)}${a}?${o.toString()}`;if(r)return I(c,l,e,t,n);const u=await I(c,l,e,t,n);if(!u.ok)return u;const d=u.data?.docs?.[0];return{ok:!0,data:d??null,draft:t,status:u.status}},async fetchGlobal(e){const t=N(e),r=B(i.depth,e,t),n=`${s}/globals/${encodeURIComponent(e.global)}?${r.toString()}`;return I(c,n,e,t,T(c.config,e,{kind:"global",slug:e.global}))}})}function T(e,t,r){const n=isAuthorizedPreviewContext(t.authorization)?t.authorization:null,o=n?.scope.payload;return void 0===o||null===n||z(n)&&(void 0===n.scope.locale||n.scope.locale===t.locale)&&j(e.serverURL,e.apiRoute)===j(o.serverURL,o.apiRoute)&&e.depth<=o.maxDepth&&R(o.document,r)}function H(e){return _(e,{ok:!1,reason:"scope",status:void 0,draft:e.draft,cause:void 0})}function N(e){return isAuthorizedPreviewContext(e.authorization)}function B(e,t,r){const n=new URLSearchParams;return n.set("depth",String(e)),r&&n.set("draft","true"),void 0!==t.locale&&n.set("locale",t.locale),n}async function I({config:e,timeoutMs:t},r,n,o,i){const a=e.fetch??("function"==typeof fetch?fetch:void 0),s={config:e,url:r,draft:o,errorMode:n.errorMode??"result",startedAt:Date.now()};if(!i)return H(s);if(void 0===a)return _(s,{ok:!1,reason:"no-fetch",status:void 0,draft:o,cause:void 0});const c=AbortSignal.timeout(t),l=void 0===n.signal?c:AbortSignal.any([c,n.signal]),u=isAuthorizedPreviewContext(n.authorization)?n.authorization:null;let d,p;try{const e=new Headers({accept:"application/json",...n.headers});for(const[t,r]of Object.entries(u?.payloadHeaders??{}))e.set(t,r);d=await a(r,{headers:Object.fromEntries(e),signal:l,cache:"no-store",redirect:"error"})}catch(e){return _(s,{ok:!1,reason:F(e,n.signal),status:void 0,draft:o,cause:e})}if(void 0!==u?.scope.payload&&!z(u))return H(s);if(!d.ok)return _(s,{ok:!1,reason:"http",status:d.status,draft:o,cause:void 0});try{p=await d.json()}catch(e){return _(s,{ok:!1,reason:"invalid-json",status:d.status,draft:o,cause:e})}return void 0!==u?.scope.payload&&!z(u)||void 0!==u?.scope.payload&&!function(e,t){if("object"!=typeof t||null===t||Array.isArray(t))return!1;const r=t;return"global"===e.kind?!Object.hasOwn(r,"globalType")||r.globalType===e.slug:Object.hasOwn(r,"id")&&R(e,{kind:"collection",slug:e.slug,id:r.id})}(u.scope.payload.document,p)?H(s):_(s,{ok:!0,data:p,draft:o,status:d.status})}function _(e,t){const{config:r,url:n,draft:o}=e,i=Date.now()-e.startedAt;if(t.ok)return r.onDiagnostic?.({kind:"response",url:n,status:t.status,draft:o,durationMs:i}),t;if(r.onDiagnostic?.({kind:"failure",url:n,reason:t.reason,status:t.status,draft:o,durationMs:i}),"throw"===e.errorMode)throw new D(t.reason,n,t.status,t.cause);return t}function F(e,t){if(!0===t?.aborted)return"aborted";const r="object"==typeof e&&null!==e?e.name:void 0;return"TimeoutError"===r?"timeout":"AbortError"===r?"aborted":"network"}function W(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function q(e){return e.map((e,t)=>0===t?e:`[${e}]`).join("")}function Z(e,t,r){for(const[n,o]of Object.entries(t)){const t=[...r,n];W(o)?Z(e,o,t):Array.isArray(o)&&o.some(W)?o.forEach((r,n)=>{Z(e,r,[...t,String(n)])}):Array.isArray(o)?e.set(q(t),o.map(String).join(",")):e.set(q(t),"object"==typeof o?"null":String(o))}}export{e as AUTHORIZED_PREVIEW_BRAND_KEY,D as PreviewFetchError,O as authorizePreviewRequest,bind,bindByPath,createPreviewBindings,M as definePreview,l as extractCookie,P as hasPreviewIntent,isAuthorizedPreviewContext,$ as issuePreviewToken,C as previewBindingsFromLocals};
 //# sourceMappingURL=server.js.map