@avocadostudio-ai/astro 0.8.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing the Work or
+      Derivative Works thereof, You may choose to offer, and charge a
+      fee for, acceptance of support, warranty, indemnity, or other
+      liability obligations and/or rights consistent with this License.
+      However, in accepting such obligations, You may act only on Your
+      own behalf and on Your sole responsibility, not on behalf of any
+      other Contributor, and only if You agree to indemnify, defend,
+      and hold each Contributor harmless for any liability incurred by,
+      or claims asserted against, such Contributor by reason of your
+      accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Avocado Studio Contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,126 @@
+# @avocadostudio-ai/astro
+
+The Avocado Studio integration for Astro. Install it, name your content module,
+and the editor can open your site — with your own `.astro` components doing the
+rendering. No React islands, nothing ported, no second copy of your templates.
+
+```bash
+npm install @avocadostudio-ai/astro @avocadostudio-ai/site-sdk @avocadostudio-ai/shared
+```
+
+```ts astro.config.ts
+import { defineConfig } from "astro/config"
+import avocado from "@avocadostudio-ai/astro"
+
+export default defineConfig({
+  output: "static",
+  integrations: [
+    avocado({
+      siteId: "my-site",
+      content: "./src/avocado/content.ts",
+      editablePages: ["src/pages/index.astro"],
+    }),
+  ],
+})
+```
+
+That is the wiring. The integration mounts the five `/api/editor/*` routes,
+injects the preview bridge, and makes the pages you named renderable on demand
+in `astro dev`.
+
+## The site renders itself
+
+Avocado supplies the schema, the draft props, the editable markers and
+publishing. Your components render. This is the mode Avocado calls
+*site-renders-itself*, and it is what makes Astro workable at all: the
+alternative would be re-implementing every `.astro` component as a React block,
+which is a rewrite disguised as an integration.
+
+What you provide is a **content module** — one default export saying where your
+content lives:
+
+```ts src/avocado/content.ts
+import type { PageDoc } from "@avocadostudio-ai/shared"
+import { registerFieldTable } from "@avocadostudio-ai/site-sdk/lens"
+import { FIELD_TABLE } from "./field-table"
+import { getPages, writePage } from "./pages"
+
+export default {
+  getPages: async (): Promise<PageDoc[]> => getPages(),
+  registerBlocks: () => registerFieldTable(FIELD_TABLE),
+  blockTypes: Object.keys(FIELD_TABLE),
+  onPublish: async (pages: PageDoc[]) => {
+    for (const page of pages) await writePage(page)
+    return { ok: true }
+  },
+}
+```
+
+On a static template, `onPublish` writing the page back to a file under `src/`
+is not a limitation to work around — it is what "published" means. The file is
+committed, reviewed as a diff, and the site rebuilt from it.
+
+`content` is a **path**, not a value. The editor API route has to render on
+demand, and `astro build` fails on an on-demand route in `src/pages` when there
+is no adapter — whether or not anyone intends to serve it. So the integration
+injects the route itself, and needs somewhere to import your content from.
+
+## `editablePages` — why it is a list
+
+The pages you name render on demand during `astro dev` and are prerendered in a
+build. Both halves are load-bearing.
+
+A prerendered route has no request: `Astro.request.headers` is empty, so the
+middleware sees no `__editor` parameter and no draft cookie, and resolves every
+request as a visitor's. The preview then renders the *published* page —
+correctly, and with no editable markers — which looks exactly like an
+integration nobody wired up.
+
+Your site cannot opt out of that on its own. `export const prerender = false`
+makes `astro build` fail with `NoAdapterInstalled`, and `!import.meta.env.DEV`
+is not a literal by the time Astro's route analysis reads it, so the route stays
+prerendered regardless.
+
+It is a list rather than "every page" because a route built from
+`getStaticPaths` cannot render on demand at all.
+
+## Marking a field editable
+
+`blockProps` returns the attributes the overlay looks for. Pass it the editor
+flag the middleware left on `Astro.locals`, and a published page emits nothing
+at all — no classes, no data attributes, no view-transition names.
+
+```astro
+---
+import { blockProps } from "@avocadostudio-ai/astro/markers"
+
+const { avocado } = Astro.locals
+const { block } = Astro.props
+---
+<section {...blockProps(Boolean(avocado?.isEditor), block.id, block.type)}>
+  <h1 data-editable-target="title">{block.props.title}</h1>
+</section>
+```
+
+`Astro.locals.avocado` also carries `editorQuery` — append it to every link the
+page renders, or the first in-preview navigation lands on the published page
+instead of the draft.
+
+## Entry points
+
+| Import | What it is |
+| --- | --- |
+| `@avocadostudio-ai/astro` | the integration, plus `AvocadoIntegrationOptions` |
+| `@avocadostudio-ai/astro/runtime` | `resolveEditorRequest`, `AvocadoLocals` |
+| `@avocadostudio-ai/astro/markers` | `blockProps` and the field kinds |
+| `@avocadostudio-ai/astro/middleware` | `createAvocadoMiddleware`, if you compose your own |
+| `@avocadostudio-ai/astro/editor-api` | `createAvocadoEditorApi`, if you mount the route yourself |
+| `@avocadostudio-ai/astro/bridge` | `startAvocadoBridge`, for a custom preview script |
+
+Most sites need only the first and the middle two. The last three exist for
+sites that already own their middleware chain or their API routing.
+
+## Documentation
+
+Full walkthrough, the field table, and the publishing contract:
+[docs.avocadostudio.dev](https://docs.avocadostudio.dev)

package/dist/bridge.d.ts

@@ -0,0 +1,30 @@
+export type AvocadoBridgeOptions = {
+    /** The content slug this page renders. Defaults to `location.pathname`. */
+    slug?: string;
+    /** The editor's origin. Read from the page URL when omitted. */
+    editorOrigin?: string;
+};
+/**
+ * Carry the editor's parameters onto a link.
+ *
+ * Without this the first click inside the preview loads a document with no
+ * `__editor`, no session and no secret — the published page, in the editor's
+ * own iframe, with no bridge on it. The signed cookie covers the same ground,
+ * but only where third-party cookies are allowed, which is exactly the
+ * condition that cannot be relied on inside a cross-origin iframe.
+ */
+export declare function withEditorParams(href: string, from?: URLSearchParams): string;
+/**
+ * Start the bridge and keep it attached across client-side navigation.
+ *
+ * `<ClientRouter />` swaps the document on navigation, so listeners bound to the
+ * old nodes survive as references to elements that are no longer in the page:
+ * the preview keeps rendering and silently stops responding to the editor.
+ * Re-attaching on `astro:page-load` — which fires on the initial load as well as
+ * every swap — is what keeps that from happening, and detaching on
+ * `astro:before-swap` is what keeps the overlay from being carried into the next
+ * document.
+ *
+ * Returns a function that stops the bridge entirely.
+ */
+export declare function startAvocadoBridge(options?: AvocadoBridgeOptions): () => void;

package/dist/bridge.js

@@ -0,0 +1,125 @@
+import { attachBridge, attachImageRevealWatcher, postRouteChanged } from "@avocadostudio-ai/preview-adapter/bridge-controller";
+/** Query parameters that must survive every in-preview navigation. */
+const EDITOR_PARAMS = ["__editor", "session", "siteId", "editorOrigin", "secret"];
+/**
+ * Carry the editor's parameters onto a link.
+ *
+ * Without this the first click inside the preview loads a document with no
+ * `__editor`, no session and no secret — the published page, in the editor's
+ * own iframe, with no bridge on it. The signed cookie covers the same ground,
+ * but only where third-party cookies are allowed, which is exactly the
+ * condition that cannot be relied on inside a cross-origin iframe.
+ */
+export function withEditorParams(href, from = new URLSearchParams(location.search)) {
+    const url = new URL(href, location.origin);
+    for (const key of EDITOR_PARAMS) {
+        const value = from.get(key);
+        if (value !== null && !url.searchParams.has(key))
+            url.searchParams.set(key, value);
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+/**
+ * Replace `<main>` with the same page re-fetched from the server.
+ *
+ * This is `refresh`, and it is emphatically not `location.reload()`.
+ * `smoothRefresh()` in the bridge schedules `restoreAndFocus()` behind two
+ * animation frames and then polls `applyBlockFocus` twenty times at 45 ms, so
+ * that the block being edited keeps its caret and scroll position across a
+ * refresh. A document reload destroys every one of those timers along with the
+ * DOM they were about to act on, so the caret jumps to the top of the page on
+ * each committed keystroke.
+ *
+ * Swapping only `<main>` also leaves the bridge's own overlay chrome — badges,
+ * handles, highlights — outside the replaced subtree, where the mutation
+ * observer can reconcile it rather than rebuild it.
+ */
+async function refreshMain() {
+    const response = await fetch(location.href, { headers: { "x-avocado-refresh": "1" }, cache: "no-store" });
+    if (!response.ok)
+        return;
+    const html = await response.text();
+    const incoming = new DOMParser().parseFromString(html, "text/html").querySelector("main");
+    const current = document.querySelector("main");
+    if (incoming && current)
+        current.replaceWith(incoming);
+}
+/**
+ * Start the bridge and keep it attached across client-side navigation.
+ *
+ * `<ClientRouter />` swaps the document on navigation, so listeners bound to the
+ * old nodes survive as references to elements that are no longer in the page:
+ * the preview keeps rendering and silently stops responding to the editor.
+ * Re-attaching on `astro:page-load` — which fires on the initial load as well as
+ * every swap — is what keeps that from happening, and detaching on
+ * `astro:before-swap` is what keeps the overlay from being carried into the next
+ * document.
+ *
+ * Returns a function that stops the bridge entirely.
+ */
+export function startAvocadoBridge(options = {}) {
+    const params = new URLSearchParams(location.search);
+    const editorOrigin = options.editorOrigin ?? params.get("editorOrigin") ?? "";
+    // Not in the editor's iframe, or no origin to talk to: do nothing at all.
+    if (!editorOrigin || window.parent === window)
+        return () => { };
+    /*
+     * The overlay's stylesheet — block outlines, hover affordances, inline-edit
+     * cursors. Without it every marker is in the document and none of it is
+     * visible, which is the most confusing way for an integration to be wrong.
+     *
+     * Imported dynamically, and deliberately *after* the iframe check: Vite emits
+     * it as its own chunk, so a visitor on the published site never requests it.
+     * A static import would put it in the page's stylesheet for everyone.
+     */
+    void import("@avocadostudio-ai/preview-adapter/styles.css");
+    let detach = null;
+    let detachReveal = null;
+    const attach = () => {
+        detach?.();
+        detachReveal?.();
+        const slug = options.slug ?? location.pathname;
+        detach = attachBridge({
+            slug,
+            editorOrigin,
+            pathname: location.pathname,
+            navigate: (href) => {
+                const target = withEditorParams(href);
+                /*
+                 * `<ClientRouter />` exposes no imperative navigate, and a bare
+                 * `pushState` changes the URL without rendering anything. A same-origin
+                 * assignment is the honest primitive here: it is a real navigation, the
+                 * editor parameters are on it, and the bridge re-attaches on the
+                 * `astro:page-load` that follows.
+                 */
+                location.assign(target);
+            },
+            refresh: () => {
+                void refreshMain();
+            },
+            liveStore: null,
+        });
+        detachReveal = attachImageRevealWatcher();
+        postRouteChanged(slug, editorOrigin);
+    };
+    const teardown = () => {
+        detach?.();
+        detachReveal?.();
+        detach = null;
+        detachReveal = null;
+    };
+    document.addEventListener("astro:page-load", attach);
+    document.addEventListener("astro:before-swap", teardown);
+    /*
+     * `astro:page-load` does not fire on a page without `<ClientRouter />`, and
+     * on a page with it the event has usually already fired by the time a
+     * module script runs. Attaching once here covers both; `attach` detaches
+     * first, so the duplicate case costs one teardown.
+     */
+    attach();
+    return () => {
+        document.removeEventListener("astro:page-load", attach);
+        document.removeEventListener("astro:before-swap", teardown);
+        teardown();
+    };
+}

package/dist/draft-adapter.d.ts

@@ -0,0 +1,19 @@
+import type { DraftRouteAdapter } from "@avocadostudio-ai/site-sdk/routes/core";
+/**
+ * What `createDraftEnableHandlerCore` needs from a framework, answered for
+ * Astro.
+ *
+ * Next's version of this calls `draftMode().enable()` and lets the framework
+ * set its own cookie. Astro has no draft mode, so enabling one means setting
+ * ours — but the core calls `enableDraftMode()` before it has resolved which
+ * session the redirect is for, and that session is what the cookie has to
+ * carry. So enabling records the intent, and the cookie is minted in
+ * `createRedirect`, where the session is finally known.
+ *
+ * The same adapter instance therefore cannot be shared across requests. The
+ * handler factories take it per call; `createAstroDraftAdapter()` is called per
+ * request, which is also why it holds no state beyond a boolean.
+ */
+export declare function createAstroDraftAdapter(options?: {
+    secret?: string;
+}): DraftRouteAdapter;

package/dist/draft-adapter.js

@@ -0,0 +1,67 @@
+import { ASTRO_DRAFT_COOKIE, DRAFT_COOKIE_MAX_AGE_SECONDS, draftSecret, mintDraftCookie } from "./draft-cookie.js";
+/**
+ * What `createDraftEnableHandlerCore` needs from a framework, answered for
+ * Astro.
+ *
+ * Next's version of this calls `draftMode().enable()` and lets the framework
+ * set its own cookie. Astro has no draft mode, so enabling one means setting
+ * ours — but the core calls `enableDraftMode()` before it has resolved which
+ * session the redirect is for, and that session is what the cookie has to
+ * carry. So enabling records the intent, and the cookie is minted in
+ * `createRedirect`, where the session is finally known.
+ *
+ * The same adapter instance therefore cannot be shared across requests. The
+ * handler factories take it per call; `createAstroDraftAdapter()` is called per
+ * request, which is also why it holds no state beyond a boolean.
+ */
+export function createAstroDraftAdapter(options) {
+    let enabled = false;
+    const secret = options?.secret ?? draftSecret();
+    const cookieHeader = (name, value, maxAge) => [
+        `${name}=${value}`,
+        "Path=/",
+        `Max-Age=${maxAge}`,
+        "HttpOnly",
+        /*
+         * `SameSite=None; Secure`, not `Lax`. The site is rendered in the
+         * editor's cross-origin iframe, and a `Lax` cookie is not sent on those
+         * subresource requests at all — the cookie would be set and then never
+         * arrive, which is precisely the failure the cookie exists to prevent.
+         * `Secure` is mandatory alongside `None`, so preview over plain http
+         * works only on localhost, where browsers exempt it.
+         */
+        "SameSite=None",
+        "Secure",
+    ].join("; ");
+    return {
+        enableDraftMode: async () => {
+            enabled = true;
+        },
+        disableDraftMode: async () => {
+            enabled = false;
+        },
+        createRedirect: (url, cookies) => {
+            const headers = new Headers({ Location: url.toString() });
+            for (const c of cookies ?? []) {
+                headers.append("Set-Cookie", c.delete ? cookieHeader(c.name, "", 0) : cookieHeader(c.name, c.value, DRAFT_COOKIE_MAX_AGE_SECONDS));
+            }
+            if (enabled) {
+                const session = url.searchParams.get("session")?.trim() || "dev";
+                const siteId = url.searchParams.get("siteId")?.trim() || "";
+                const value = mintDraftCookie({ session, siteId }, secret);
+                /*
+                 * No secret, no cookie — not an unsigned one. Verification would then
+                 * have to accept unsigned cookies to be useful, which is the same as
+                 * having no cookie check at all.
+                 */
+                if (value)
+                    headers.append("Set-Cookie", cookieHeader(ASTRO_DRAFT_COOKIE, value, DRAFT_COOKIE_MAX_AGE_SECONDS));
+            }
+            else {
+                headers.append("Set-Cookie", cookieHeader(ASTRO_DRAFT_COOKIE, "", 0));
+            }
+            // 307: the method survives, and a preview redirect is never permanent.
+            return new Response(null, { status: 307, headers });
+        },
+    };
+}

package/dist/draft-cookie.d.ts

@@ -0,0 +1,26 @@
+export declare const ASTRO_DRAFT_COOKIE = "avocado_draft";
+/** The draft session this cookie authorizes. */
+export type DraftCookiePayload = {
+    session: string;
+    siteId: string;
+    /** Unix seconds. */
+    exp: number;
+};
+/** How long a draft cookie stays valid. An editing session outlives a short one, and a long one outlives the tab. */
+export declare const DRAFT_COOKIE_MAX_AGE_SECONDS: number;
+/**
+ * A cookie value for this draft session, or `null` when no secret is configured
+ * — in which case the integration must not set one at all, rather than set an
+ * unsigned one that verification would have to accept.
+ */
+export declare function mintDraftCookie(payload: Omit<DraftCookiePayload, "exp">, secret: string | undefined, now?: number): string | null;
+/**
+ * The session a cookie authorizes, or `null` if it does not.
+ *
+ * Returns null rather than throwing for every failure — malformed, unsigned,
+ * wrongly signed, expired — because every one of them means the same thing to
+ * the caller: this request is not authorized to see drafts.
+ */
+export declare function verifyDraftCookie(value: string | undefined, secret: string | undefined, now?: number): DraftCookiePayload | null;
+/** The secret both this cookie and `/api/editor/draft` are checked against. */
+export declare function draftSecret(env?: Record<string, string | undefined>): string | undefined;