@avocadostudio-ai/site-sdk 0.7.0 → 0.8.0

package/dist/proxy.js

@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { DEFAULT_PREVIEW_ROUTE, buildEditorMatcher } from "./editor-matcher.js";
-import { EDITOR_RENDER_HEADER } from "./editor-render.js";
+import { decideEditorRewrite } from "./editor-rewrite-core.js";
 export { DEFAULT_PREVIEW_ROUTE, buildEditorMatcher } from "./editor-matcher.js";
+export { decideEditorRewrite } from "./editor-rewrite-core.js";
 /**
  * Create a Next.js proxy function that rewrites editor/draft requests
  * to a dynamic preview route, keeping the main page route fully static.
@@ -110,29 +111,22 @@ export function trailingSlashRedirect(request) {
  * {@link trailingSlashRedirect} for the composition.
  */
 export function editorPreviewRewrite(request, options) {
-    const previewRoute = options?.previewRoute ?? DEFAULT_PREVIEW_ROUTE;
-    const editorParam = options?.editorParam ?? "__editor";
-    const draftCookie = options?.draftCookie === undefined ? "__prerender_bypass" : options.draftCookie;
-    const isEditor = request.nextUrl.searchParams.get(editorParam) === "1";
-    const hasDraftCookie = draftCookie !== false && request.cookies.has(draftCookie);
-    if (!isEditor && !hasDraftCookie)
-        return null;
-    const url = request.nextUrl.clone();
-    url.pathname = `${previewRoute}${url.pathname}`;
     /*
-     * The one fact a layout can get at.
-     *
-     * A page learns it is being previewed from `resolveEditorContext(searchParams)`.
-     * A layout receives no `searchParams`, and the root layout is exactly where a
-     * site mounts its consent banner, analytics and tag manager — so every
-     * integration loads all three into the editor iframe until somebody notices
-     * the pageviews. Stamping the rewritten request lets `isEditorRender()` answer
-     * in a layout without the site threading anything down to it.
-     *
-     * Set, not appended: a client-supplied header of the same name is replaced, so
-     * what a layout reads here is the proxy's own answer.
+     * `nextUrl`, not `new URL(request.url)`: it has `basePath` stripped, and the
+     * preview prefix has to be prepended to the path Next routes on. The decision
+     * itself is shared with every other host — see `decideEditorRewrite`.
      */
+    const decision = decideEditorRewrite({
+        pathname: request.nextUrl.pathname,
+        searchParams: request.nextUrl.searchParams,
+        hasCookie: (name) => request.cookies.has(name),
+    }, options);
+    if (decision.kind === "pass")
+        return null;
+    const url = request.nextUrl.clone();
+    url.pathname = decision.pathname;
     const headers = new Headers(request.headers);
-    headers.set(EDITOR_RENDER_HEADER, "1");
+    for (const [name, value] of Object.entries(decision.headers))
+        headers.set(name, value);
     return NextResponse.rewrite(url, { request: { headers } });
 }

package/dist/resolve-page-render.d.ts

@@ -0,0 +1,94 @@
+import type { PageDoc, SiteConfig } from "@avocadostudio-ai/shared";
+import type { SearchParamsRecord } from "./types.ts";
+import { type DraftModeAdapter } from "./draft-context-core.ts";
+import { type NavItem } from "./navigation.ts";
+import type { SiteHeaderBlock } from "./navigation.ts";
+export type PageSourceConfig = {
+    siteId: string;
+    /** Orchestrator draft session. @default "dev" */
+    session?: string;
+    getPage: (slug: string) => Promise<PageDoc | null> | PageDoc | null;
+    getSlugs: () => Promise<string[]> | string[];
+    getSiteConfig?: () => Promise<SiteConfig | undefined> | SiteConfig | undefined;
+    /** @default "/logo.svg" */
+    defaultLogo?: string;
+};
+/** The editor session this render belongs to, when it is one. */
+export type EditorRenderContext = {
+    session: string;
+    siteId: string;
+    /** `postMessage` target and the frame permitted to drive inline edits. Empty when none is trusted. */
+    editorOrigin: string;
+    /**
+     * `?session=…&siteId=…&editorOrigin=…`, to append to every link the preview
+     * renders. Without it the first in-preview navigation lands on the published
+     * page — the editor's own nav goes dead one click in.
+     */
+    editorQuery: string;
+};
+/** Site chrome, already resolved against the right slug list. */
+export type PageChrome = {
+    navItems: NavItem[];
+    siteName: string;
+    siteLogo: string;
+    homeHref: string;
+    /** The header as a block, for a host that renders Avocado's own chrome. */
+    header: SiteHeaderBlock;
+    siteConfig: SiteConfig;
+};
+export type PageRenderOutcome = 
+/** Render this page. `editor` is null for a published render. */
+{
+    kind: "page";
+    slug: string;
+    page: PageDoc;
+    editor: EditorRenderContext | null;
+    chrome: PageChrome;
+}
+/**
+ * No such page. The host must answer with a real 404 status — a rendered
+ * "404" body under HTTP 200 is a soft 404, which crawlers index as a page.
+ */
+ | {
+    kind: "not-found";
+    slug: string;
+}
+/**
+ * An editor render whose draft could not be fetched and which has no
+ * published fallback. Distinct from `not-found` because the page may well
+ * exist: the orchestrator is unreachable, and telling an editor "404" sends
+ * them looking for a content bug that is not there.
+ */
+ | {
+    kind: "draft-unavailable";
+    slug: string;
+    editor: EditorRenderContext;
+    chrome: PageChrome;
+};
+export type ResolvePageRenderInput = {
+    slug: string;
+    config: PageSourceConfig;
+    /**
+     * - `auto`: draft mode or a resolvable editor context switches to the editor render.
+     * - `static`: published content only. Search params are not read.
+     * - `preview`: always the editor render.
+     * @default "auto"
+     */
+    mode?: "auto" | "static" | "preview";
+    /** Required unless `mode` is `"static"`. */
+    search?: SearchParamsRecord;
+    /**
+     * How this runtime reports draft mode and reads cookies. Omit under
+     * `mode: "static"`; omit under `"preview"` only if the host has no draft-mode
+     * concept, in which case authorization rests on the `secret` query parameter.
+     */
+    adapter?: DraftModeAdapter;
+};
+/**
+ * Resolve what a page render should produce, without producing it.
+ *
+ * The published path reads the CMS. The editor path prefers the orchestrator's
+ * draft and falls back to the CMS for each of page and slug list independently
+ * — a session that has edited one page still needs the other twenty in its nav.
+ */
+export declare function resolvePageRender(input: ResolvePageRenderInput): Promise<PageRenderOutcome>;

package/dist/resolve-page-render.js

@@ -0,0 +1,80 @@
+import { resolveDraftContextCore } from "./draft-context-core.js";
+import { fetchEditorPage, fetchEditorSlugs } from "./draft-fetch.js";
+import { buildNavItems, buildSiteHeaderBlock } from "./navigation.js";
+const NO_DRAFT_MODE = { isDraftMode: false, getCookie: () => undefined };
+async function buildChrome(slug, navSlugs, siteConfig, config, editorQuery) {
+    const { navItems, siteName, siteLogo, homeHref } = buildNavItems({
+        navSlugs,
+        currentSlug: slug,
+        siteConfig,
+        siteId: config.siteId,
+        editorQuery,
+        defaultLogo: config.defaultLogo ?? "/logo.svg",
+    });
+    return {
+        navItems,
+        siteName,
+        siteLogo,
+        homeHref,
+        header: buildSiteHeaderBlock({ navItems, siteName, siteLogo, activePath: slug }),
+        siteConfig,
+    };
+}
+/**
+ * Resolve what a page render should produce, without producing it.
+ *
+ * The published path reads the CMS. The editor path prefers the orchestrator's
+ * draft and falls back to the CMS for each of page and slug list independently
+ * — a session that has edited one page still needs the other twenty in its nav.
+ */
+export async function resolvePageRender(input) {
+    const { slug, config } = input;
+    const mode = input.mode ?? "auto";
+    const defaultSession = config.session ?? "dev";
+    const getSiteConfig = () => config.getSiteConfig ? Promise.resolve(config.getSiteConfig()) : Promise.resolve({});
+    const editorCtx = mode === "static"
+        ? null
+        : await resolveDraftContextCore(input.search ?? {}, input.adapter ?? NO_DRAFT_MODE, {
+            defaultSession,
+            defaultSiteId: config.siteId,
+        });
+    const isEditorRender = mode === "preview" || (mode === "auto" && (input.adapter?.isDraftMode === true || Boolean(editorCtx)));
+    if (!isEditorRender) {
+        const [page, navSlugs, siteConfig] = await Promise.all([
+            config.getPage(slug),
+            config.getSlugs(),
+            getSiteConfig(),
+        ]);
+        // Before the chrome is built: none of it survives a 404.
+        if (!page)
+            return { kind: "not-found", slug };
+        return {
+            kind: "page",
+            slug,
+            page,
+            editor: null,
+            chrome: await buildChrome(slug, navSlugs, siteConfig ?? {}, config, ""),
+        };
+    }
+    const session = editorCtx?.session ?? defaultSession;
+    const currentSiteId = editorCtx?.siteId ?? config.siteId;
+    const editorOrigin = editorCtx?.editorOrigin ?? "";
+    const [page, navSlugs, siteConfig] = await Promise.all([
+        fetchEditorPage(slug, session, currentSiteId).then((p) => p ?? config.getPage(slug)),
+        fetchEditorSlugs(session, currentSiteId).then((s) => (s.length > 0 ? s : config.getSlugs())),
+        getSiteConfig(),
+    ]);
+    const params = new URLSearchParams({ session, siteId: currentSiteId });
+    if (editorOrigin)
+        params.set("editorOrigin", editorOrigin);
+    const editor = {
+        session,
+        siteId: currentSiteId,
+        editorOrigin,
+        editorQuery: `?${params.toString()}`,
+    };
+    const chrome = await buildChrome(slug, navSlugs, siteConfig ?? {}, config, editor.editorQuery);
+    if (!page)
+        return { kind: "draft-unavailable", slug, editor, chrome };
+    return { kind: "page", slug, page, editor, chrome };
+}

package/dist/routes-core.d.ts

@@ -0,0 +1,12 @@
+export { createDraftEnableHandlerCore, createDraftDisableHandlerCore } from "./draft-routes-core.ts";
+export type { DraftRouteAdapter } from "./draft-routes-core.ts";
+export { createEditorApiHandlerCore } from "./editor-api-handler-core.ts";
+export type { EditorApiHandlerConfig, EditorApiCoreConfig } from "./editor-api-handler-core.ts";
+export { createBlocksHandler, createPagesHandler, createPublishHandler } from "./editor-routes.ts";
+export type { OnPublishFn, InlineAsset, PublishContext } from "./editor-routes.ts";
+export { isSafeImageUrl, createImageResolver } from "./publish-utils.ts";
+export type { ImageUploader } from "./publish-utils.ts";
+export { createRevalidateHandler } from "./revalidate-handler.ts";
+export type { RevalidateHandlerConfig } from "./revalidate-handler.ts";
+export { getManifestImageFields } from "./manifest-utils.ts";
+export { DRAFT_SESSION_COOKIE, DRAFT_SITE_COOKIE, EDITOR_ORIGIN_COOKIE, normalizeOrigin, single, } from "./draft-common.ts";

package/dist/routes-core.js

@@ -0,0 +1,24 @@
+/*
+ * The editor API, for a host that is not Next.
+ *
+ * This is `./routes` with the two Next-shaped pieces replaced by their cores:
+ * the draft handlers take an adapter instead of calling `draftMode()`, and the
+ * catch-all handler takes the matched path instead of a Next route context.
+ * Everything else in `./routes` was already portable and is re-exported here
+ * unchanged — the same functions, not parallel implementations.
+ */
+// Draft route cores — supply a DraftRouteAdapter for your runtime.
+export { createDraftEnableHandlerCore, createDraftDisableHandlerCore } from "./draft-routes-core.js";
+// Catch-all editor API core.
+export { createEditorApiHandlerCore } from "./editor-api-handler-core.js";
+// Individual editor route handlers — already framework-free.
+export { createBlocksHandler, createPagesHandler, createPublishHandler } from "./editor-routes.js";
+// Publish utilities (SSRF check, image resolution).
+export { isSafeImageUrl, createImageResolver } from "./publish-utils.js";
+// Revalidation handler factory — takes a `revalidate` callback, so the host's
+// cache API never appears here.
+export { createRevalidateHandler } from "./revalidate-handler.js";
+// Manifest utilities (derive image fields from block manifest).
+export { getManifestImageFields } from "./manifest-utils.js";
+// Cookie names and the query-value helper the draft contract is written in.
+export { DRAFT_SESSION_COOKIE, DRAFT_SITE_COOKIE, EDITOR_ORIGIN_COOKIE, normalizeOrigin, single, } from "./draft-common.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avocadostudio-ai/site-sdk",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -67,9 +67,9 @@
       "default": "./dist/draft-context-core.js"
     },
     "./routes/core": {
-      "types": "./dist/draft-routes-core.d.ts",
-      "import": "./dist/draft-routes-core.js",
-      "default": "./dist/draft-routes-core.js"
+      "types": "./dist/routes-core.d.ts",
+      "import": "./dist/routes-core.js",
+      "default": "./dist/routes-core.js"
     },
     "./publish-handlers/json-file": {
       "types": "./dist/publish-handlers/json-file.d.ts",
@@ -91,6 +91,11 @@
       "import": "./dist/proxy.js",
       "default": "./dist/proxy.js"
     },
+    "./proxy/core": {
+      "types": "./dist/editor-rewrite-core.d.ts",
+      "import": "./dist/editor-rewrite-core.js",
+      "default": "./dist/editor-rewrite-core.js"
+    },
     "./matcher": {
       "types": "./dist/editor-matcher.d.ts",
       "import": "./dist/editor-matcher.js",
@@ -106,6 +111,11 @@
       "import": "./dist/create-site-page.js",
       "default": "./dist/create-site-page.js"
     },
+    "./page/core": {
+      "types": "./dist/resolve-page-render.d.ts",
+      "import": "./dist/resolve-page-render.js",
+      "default": "./dist/resolve-page-render.js"
+    },
     "./seo": {
       "types": "./dist/page-metadata.d.ts",
       "import": "./dist/page-metadata.js",
@@ -121,11 +131,6 @@
       "default": "./next-config.mjs"
     }
   },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/avocadostudio-ai/avocado.git",
-    "directory": "packages/site-sdk"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
@@ -137,17 +142,17 @@
   ],
   "dependencies": {
     "zod": "^4.3.6",
-    "@avocadostudio-ai/blocks": "^0.7.0",
-    "@avocadostudio-ai/richtext": "^0.7.0",
-    "@avocadostudio-ai/shared": "^0.7.0",
-    "@avocadostudio-ai/preview-adapter": "^0.7.0"
+    "@avocadostudio-ai/blocks": "^0.8.0",
+    "@avocadostudio-ai/preview-adapter": "^0.8.0",
+    "@avocadostudio-ai/richtext": "^0.8.0",
+    "@avocadostudio-ai/shared": "^0.8.0"
   },
   "peerDependencies": {
     "next": ">=15.0.0",
     "react": ">=19.0.0",
     "react-dom": ">=19.0.0",
     "better-sqlite3": ">=12.0.0",
-    "@avocadostudio-ai/orchestrator-core": "^0.7.0"
+    "@avocadostudio-ai/orchestrator-core": "^0.8.0"
   },
   "peerDependenciesMeta": {
     "@avocadostudio-ai/orchestrator-core": {
@@ -177,7 +182,7 @@
   "license": "Apache-2.0",
   "homepage": "https://docs.avocadostudio.dev",
   "bugs": {
-    "url": "https://github.com/avocadostudio-ai/avocado/issues"
+    "url": "https://docs.avocadostudio.dev"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",

package/dist/cli/register-notice.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/cli/register-notice.test.js

@@ -1,21 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { orchestratorMismatchNotice } from "./register-notice.js";
-/*
- * `avocado-register` ends with "the site should appear in the dashboard", and
- * for a library-mode site that is a promise it cannot keep: the registration
- * went to the site's own handler, and the editor reads one
- * `VITE_ORCHESTRATOR_URL` baked in at build time. The dashboard then opens on
- * a different registry's sites and reports no problem, because there is none —
- * there are simply two registries.
- */
-test("the default target says nothing — that is the path almost everyone is on", () => {
-    assert.equal(orchestratorMismatchNotice("http://localhost:4200"), null);
-    assert.equal(orchestratorMismatchNotice("http://localhost:4200/"), null, "a trailing slash is the same URL");
-});
-test("a library-mode target names the variable the editor needs", () => {
-    const notice = orchestratorMismatchNotice("http://localhost:3002/api/avocado");
-    assert.ok(notice);
-    assert.match(notice, /VITE_ORCHESTRATOR_URL=http:\/\/localhost:3002\/api\/avocado/);
-    assert.match(notice, /sites, or none/, "and names the symptom, which is what the reader is looking at");
-});

package/dist/draft-context-core.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Who may see unpublished content, and which frame may drive the editor.
- *
- * Both questions used to be answered by the query string. `?__editor=1` alone
- * turned on the draft content store — in production, on the customer's own
- * domain — and `editorOrigin` was accepted from the same URL after a check that
- * only asked whether it parsed as http(s). One GET rendered another session's
- * drafts and pointed the postMessage bridge wherever the caller said.
- */
-export {};

package/dist/draft-context-core.test.js

@@ -1,146 +0,0 @@
-/**
- * Who may see unpublished content, and which frame may drive the editor.
- *
- * Both questions used to be answered by the query string. `?__editor=1` alone
- * turned on the draft content store — in production, on the customer's own
- * domain — and `editorOrigin` was accepted from the same URL after a check that
- * only asked whether it parsed as http(s). One GET rendered another session's
- * drafts and pointed the postMessage bridge wherever the caller said.
- */
-import { test, describe, afterEach } from "node:test";
-import assert from "node:assert/strict";
-import { resolveDraftContextCore } from "./draft-context-core.js";
-import { resolveTrustedEditorOrigin, editorOriginAllowlist, isLoopbackOrigin } from "./draft-common.js";
-const SECRET = "s3cr3t-draft-key";
-const saved = {};
-const KEYS = ["NODE_ENV", "DRAFT_MODE_SECRET", "NEXT_PUBLIC_EDITOR_ORIGIN", "AVOCADO_EDITOR_ORIGINS"];
-function setEnv(values) {
-    for (const key of KEYS) {
-        if (!(key in saved))
-            saved[key] = process.env[key];
-    }
-    for (const [key, value] of Object.entries(values)) {
-        if (value === undefined)
-            delete process.env[key];
-        else
-            process.env[key] = value;
-    }
-}
-afterEach(() => {
-    for (const key of KEYS) {
-        if (saved[key] === undefined)
-            delete process.env[key];
-        else
-            process.env[key] = saved[key];
-    }
-});
-function adapter(overrides) {
-    return { isDraftMode: false, getCookie: () => undefined, ...overrides };
-}
-describe("resolveDraftContextCore — production gate", () => {
-    test("__editor=1 alone no longer opens the content store", async () => {
-        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
-        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", session: "victim" }, adapter());
-        assert.equal(ctx, null);
-    });
-    test("a wrong secret is refused", async () => {
-        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
-        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", secret: "guess" }, adapter());
-        assert.equal(ctx, null);
-    });
-    test("the configured secret opens it — the cookie-blocked iframe case", async () => {
-        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
-        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", secret: SECRET }, adapter());
-        assert.equal(ctx?.siteId, "acme");
-    });
-    test("draft mode already enabled opens it — the secret-gated cookie path", async () => {
-        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
-        const ctx = await resolveDraftContextCore({ siteId: "acme" }, adapter({ isDraftMode: true }));
-        assert.equal(ctx?.siteId, "acme");
-    });
-    test("with no secret configured, production stays shut rather than open", async () => {
-        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: undefined });
-        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", secret: "anything" }, adapter());
-        assert.equal(ctx, null);
-    });
-    test("development is unchanged — the parameter alone still works", async () => {
-        setEnv({ NODE_ENV: "development", DRAFT_MODE_SECRET: undefined });
-        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme" }, adapter());
-        assert.equal(ctx?.siteId, "acme");
-    });
-});
-describe("resolveDraftContextCore — editor origin", () => {
-    test("an unlisted origin from the URL is ignored in favour of the configured one", async () => {
-        setEnv({
-            NODE_ENV: "production",
-            DRAFT_MODE_SECRET: SECRET,
-            NEXT_PUBLIC_EDITOR_ORIGIN: "https://editor.example.com"
-        });
-        const ctx = await resolveDraftContextCore({ siteId: "acme", secret: SECRET, editorOrigin: "https://attacker.example" }, adapter());
-        assert.equal(ctx?.editorOrigin, "https://editor.example.com");
-    });
-    test("a listed origin from the URL is honoured", async () => {
-        setEnv({
-            NODE_ENV: "production",
-            DRAFT_MODE_SECRET: SECRET,
-            NEXT_PUBLIC_EDITOR_ORIGIN: "https://editor.example.com",
-            AVOCADO_EDITOR_ORIGINS: "https://staging-editor.example.com, https://other.example.com"
-        });
-        const ctx = await resolveDraftContextCore({ siteId: "acme", secret: SECRET, editorOrigin: "https://staging-editor.example.com" }, adapter());
-        assert.equal(ctx?.editorOrigin, "https://staging-editor.example.com");
-    });
-    test("a hostile origin in the cookie is ignored too", async () => {
-        setEnv({
-            NODE_ENV: "production",
-            DRAFT_MODE_SECRET: SECRET,
-            NEXT_PUBLIC_EDITOR_ORIGIN: "https://editor.example.com"
-        });
-        const ctx = await resolveDraftContextCore({ siteId: "acme", secret: SECRET }, adapter({ getCookie: (name) => (name === "editor_origin" ? "https%3A%2F%2Fattacker.example" : undefined) }));
-        assert.equal(ctx?.editorOrigin, "https://editor.example.com");
-    });
-});
-describe("resolveTrustedEditorOrigin", () => {
-    test("keeps the fallback when there is no candidate", () => {
-        assert.equal(resolveTrustedEditorOrigin({ candidate: undefined, fallback: "https://a.example", isDev: false, env: {} }), "https://a.example");
-    });
-    test("accepts loopback in development, at any port", () => {
-        for (const candidate of ["http://localhost:4100", "http://localhost:4101", "http://127.0.0.1:5173"]) {
-            assert.equal(resolveTrustedEditorOrigin({ candidate, fallback: "http://localhost:4100", isDev: true, env: {} }), candidate);
-        }
-    });
-    test("refuses loopback in production — an operator must list it", () => {
-        assert.equal(resolveTrustedEditorOrigin({
-            candidate: "http://localhost:4100",
-            fallback: "https://editor.example.com",
-            isDev: false,
-            env: {}
-        }), "https://editor.example.com");
-    });
-    test("the fallback itself is always trusted", () => {
-        assert.equal(resolveTrustedEditorOrigin({
-            candidate: "https://editor.example.com",
-            fallback: "https://editor.example.com",
-            isDev: false,
-            env: {}
-        }), "https://editor.example.com");
-    });
-});
-describe("editorOriginAllowlist", () => {
-    test("merges both variables, normalises, and de-duplicates", () => {
-        const list = editorOriginAllowlist({
-            AVOCADO_EDITOR_ORIGINS: "https://a.example/, https://b.example",
-            NEXT_PUBLIC_EDITOR_ORIGIN: "https://a.example"
-        });
-        assert.deepEqual(list, ["https://a.example", "https://b.example"]);
-    });
-    test("drops entries that are not http(s) origins", () => {
-        const list = editorOriginAllowlist({ AVOCADO_EDITOR_ORIGINS: "javascript:alert(1), not-a-url, ftp://x.example" });
-        assert.deepEqual(list, []);
-    });
-});
-test("isLoopbackOrigin recognises the local spellings and nothing else", () => {
-    assert.equal(isLoopbackOrigin("http://localhost:4100"), true);
-    assert.equal(isLoopbackOrigin("http://127.0.0.1:3000"), true);
-    assert.equal(isLoopbackOrigin("https://localhost.attacker.example"), false);
-    assert.equal(isLoopbackOrigin("https://example.com"), false);
-});

package/dist/draft-fetch.test.d.ts

@@ -1 +0,0 @@
-export {};