@byline/host-tanstack-start 0.9.3

package/src/auth/preview-cookies.ts

@@ -0,0 +1,73 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Cookie helpers for the front-end *preview mode* toggle.
+ *
+ * Preview mode lets a signed-in admin see draft (and other non-published)
+ * versions on the public host pages without changing any markup or route
+ * structure. The mechanic is intentionally narrow:
+ *
+ *   - A single httpOnly cookie (`byline_preview=1`) carries the user's
+ *     "show me drafts" intent across requests within the same browser
+ *     session.
+ *   - The cookie's mere *presence* is the signal — there is no payload to
+ *     verify. The actual safety check is the admin session: when the
+ *     viewer client (or a server fn) sees the cookie, it tries to resolve
+ *     `getAdminRequestContext()` and only elevates the read mode when a
+ *     valid admin session resolves. A stale preview cookie on an
+ *     anonymous browser falls through to public/published reads silently.
+ *
+ * Cookie attributes:
+ *   - `httpOnly: true`   — inaccessible to JS; toggled only via server fns.
+ *   - `sameSite: 'lax'`  — sent on top-level navigations only.
+ *   - `secure: true` in production — https-only.
+ *   - `path: '/'`        — visible to every public route.
+ *   - `maxAge: 1 day`    — preview is meant to be a short-lived editorial
+ *                          mode, not a permanent state. Admins can
+ *                          re-enable from the admin UI when needed.
+ */
+
+import { getCookie, setCookie } from '@tanstack/react-start/server'
+
+export const PREVIEW_COOKIE = 'byline_preview'
+const PREVIEW_MAX_AGE_SECONDS = 60 * 60 * 24 // 1 day
+
+const IS_PROD = process.env.NODE_ENV === 'production'
+
+/** True iff the preview cookie is currently set on the request. */
+export function readPreviewCookie(): boolean {
+  return getCookie(PREVIEW_COOKIE) === '1'
+}
+
+/**
+ * Write the preview cookie. Callers should ensure the request is from a
+ * valid admin session before invoking — the cookie itself is just a flag
+ * and carries no proof of authorisation. See `enablePreviewModeFn` for
+ * the canonical entry point.
+ */
+export function setPreviewCookie(): void {
+  setCookie(PREVIEW_COOKIE, '1', {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: IS_PROD,
+    path: '/',
+    maxAge: PREVIEW_MAX_AGE_SECONDS,
+  })
+}
+
+/** Clear the preview cookie. Safe to call from any context. */
+export function clearPreviewCookie(): void {
+  setCookie(PREVIEW_COOKIE, '', {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: IS_PROD,
+    path: '/',
+    maxAge: 0,
+  })
+}

package/src/declarations.d.ts

@@ -0,0 +1,4 @@
+declare module '*.css' {
+  const classes: { [key: string]: string }
+  export default classes
+}

package/src/index.ts

@@ -0,0 +1,44 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * `@byline/host-tanstack-start` — TanStack Start host adapter for Byline.
+ *
+ * Houses everything that's framework-coupled to TanStack Start /
+ * Router so the framework-neutral packages (`@byline/core`, `@byline/admin`,
+ * `@byline/client`, `@byline/auth`, `@byline/ui`) stay framework-neutral.
+ *
+ * Surface is exposed via subpath exports rather than a single root barrel
+ * so hosts only pull in what they consume:
+ *
+ *   - `@byline/host-tanstack-start/server-fns/<module>` — TanStack Start
+ *     server functions for each admin module (admin-account, admin-roles,
+ *     admin-users, admin-permissions, auth, collections).
+ *   - `@byline/host-tanstack-start/auth/auth-context` — request-scoped
+ *     `RequestContext` resolution that reads session cookies, refreshes
+ *     transparently, and surfaces `ERR_UNAUTHENTICATED` to callers.
+ *   - `@byline/host-tanstack-start/integrations/*` — host-side adapters
+ *     binding TanStack Start primitives to the framework-neutral
+ *     contracts in `@byline/ui` and `@byline/client`
+ *     (`bylineFieldServices`, `bylineAdminServices`, the admin
+ *     `BylineClient` singleton).
+ *   - `@byline/host-tanstack-start/admin-shell/{chrome,collections,...}` —
+ *     router-coupled admin UI: shared shell chrome (menu drawer, app bar,
+ *     route-error, breadcrumbs, etc.) plus per-area page containers.
+ *   - `@byline/host-tanstack-start/routes/*` — route factories. Each
+ *     factory returns the result of `createFileRoute(path)({...})` ready
+ *     for assignment to the host's `export const Route = ...`. The host
+ *     supplies the filesystem-backed path string; the package owns the
+ *     loader, `beforeLoad`, component, and error boundary.
+ *
+ * The root entry exports nothing intentionally — every consumption path
+ * is a subpath import. This keeps the public surface small and the
+ * boundaries explicit.
+ */
+
+export {}

package/src/integrations/abilities.tsx

@@ -0,0 +1,90 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Client-side ability helpers for the admin shell.
+ *
+ * These hooks read the current admin user's ability set off the admin
+ * route's TanStack Router context — which `route.tsx` populates in
+ * `beforeLoad` via `getCurrentAdminUser()`. No separate React Context
+ * provider is required because the route context already plays that
+ * role.
+ *
+ * **Cosmetic UI only.** A hidden menu item, disabled button, or
+ * un-rendered children block is an affordance, never a security
+ * boundary. Every server-side path is independently gated by
+ * `assertActorCanPerform` (document collections) or `assertAdminActor`
+ * (admin user / role / permission management). Callers can construct
+ * the matching ability key by hand or — preferred — import the
+ * `ADMIN_*_ABILITIES` constants from the relevant
+ * `@byline/admin/admin-*` subpath so a rename surfaces as a type error
+ * rather than a silent miss.
+ *
+ * Super-admin bypass mirrors the server: every `useAbility` call
+ * returns `true` when `is_super_admin` is set.
+ *
+ * Snapshot semantics: the ability set is the snapshot from the last
+ * `beforeLoad` of the admin route, refreshed on navigation. A grant
+ * revoked mid-session won't disappear from the UI until the next
+ * navigation — fine for cosmetic cues since the server still rejects
+ * the underlying action.
+ */
+
+import type React from 'react'
+import { useRouteContext } from '@tanstack/react-router'
+
+/** Route id of the admin shell — the layout route that owns `user` on context. */
+const ADMIN_ROUTE_ID = '/(byline)/admin' as const
+
+/**
+ * `true` when the current admin holds the given ability (or is a
+ * super-admin). Cosmetic — see file-level docstring.
+ */
+export function useAbility(ability: string): boolean {
+  const { user } = useRouteContext({ from: ADMIN_ROUTE_ID })
+  if (user.is_super_admin) return true
+  return user.abilities.includes(ability)
+}
+
+/**
+ * Bundle of ability checks for situations where a component needs more
+ * than one verb (e.g. the menu drawer asks about three keys at once).
+ * Avoids calling `useAbility` repeatedly when a single context read is
+ * sufficient.
+ */
+export function useAbilities(): {
+  has: (ability: string) => boolean
+  hasAny: (abilities: readonly string[]) => boolean
+  isSuperAdmin: boolean
+} {
+  const { user } = useRouteContext({ from: ADMIN_ROUTE_ID })
+  const has = (ability: string): boolean => user.is_super_admin || user.abilities.includes(ability)
+  const hasAny = (abilities: readonly string[]): boolean =>
+    user.is_super_admin || abilities.some((key) => user.abilities.includes(key))
+  return { has, hasAny, isSuperAdmin: user.is_super_admin }
+}
+
+/**
+ * JSX wrapper. Renders `children` only when the current admin holds
+ * the given ability. Cosmetic — see file-level docstring.
+ *
+ * ```tsx
+ * <RequireAbility ability={ADMIN_USERS_ABILITIES.create}>
+ *   <Button>New admin user</Button>
+ * </RequireAbility>
+ * ```
+ */
+export function RequireAbility({
+  ability,
+  children,
+}: {
+  ability: string
+  children: React.ReactNode
+}): React.ReactNode {
+  return useAbility(ability) ? children : null
+}

package/src/integrations/api-utils.ts

@@ -0,0 +1,66 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * NOTE: Before you dunk on this, this is a prototype implementation
+ * of our API and used only for development.
+ * We'll extract a properly configured API server soon.
+ */
+
+// NOTE: The host's server config (e.g. byline/server.config.ts) is loaded by
+// src/server.ts (TanStack Start server entry point) before any
+// requests are handled. No need to import it here.
+
+import type { CollectionDefinition, CollectionRecord } from '@byline/core'
+import { getCollectionDefinition } from '@byline/core'
+
+import { bylineCore } from './byline-core.js'
+
+export interface EnsuredCollection {
+  definition: CollectionDefinition
+  collection: {
+    id: string
+    path: string
+    version: number
+    schemaHash: string
+  }
+}
+
+/**
+ * Resolve a collection for an admin API request.
+ *
+ * Collections are reconciled with the database once at startup by
+ * `initBylineCore()` (see `packages/core/src/services/collection-bootstrap.ts`).
+ * This helper is a per-request cache lookup against the resulting in-memory
+ * registry — no DB I/O, no hash work.
+ *
+ * Returns `null` when the path is not registered in the client/server config.
+ */
+export async function ensureCollection(path: string): Promise<EnsuredCollection | null> {
+  const definition = getCollectionDefinition(path)
+  if (definition == null) {
+    return null
+  }
+
+  let record: CollectionRecord
+  try {
+    record = bylineCore().getCollectionRecord(path)
+  } catch {
+    return null
+  }
+
+  return {
+    definition,
+    collection: {
+      id: record.collectionId,
+      path,
+      version: record.version,
+      schemaHash: record.schemaHash,
+    },
+  }
+}

package/src/integrations/byline-admin-services.ts

@@ -0,0 +1,86 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Host-side adapter that binds the webapp's TanStack Start server functions
+ * to the framework-neutral `BylineAdminServices` contract consumed by
+ * `@byline/ui` admin components.
+ *
+ * Wired into the admin route once via `<BylineAdminServicesProvider>`. A
+ * future Next.js host would ship its own adapter file (server-actions in
+ * place of server fns) and Provider; the `@byline/ui` surface is unchanged.
+ *
+ * Contract scope: only the framework-neutral admin UI components consume
+ * this — sign-in, account self-service, admin-user/role write forms, the
+ * permissions inspector, role-permissions editor, and the diff modal.
+ * Page-container reads (list/edit) stay on direct server-fn imports
+ * inside the host's deferred router-coupled containers.
+ */
+
+import type { BylineAdminServices } from '@byline/ui'
+
+import { changeAccountPassword, updateAccount } from '../server-fns/admin-account/index.js'
+import { setRoleAbilities, whoHasAbility } from '../server-fns/admin-permissions/index.js'
+import { createAdminRole, updateAdminRole } from '../server-fns/admin-roles/index.js'
+import {
+  createAdminUser,
+  setAdminUserPassword,
+  setUserRoles,
+  updateAdminUser,
+} from '../server-fns/admin-users/index.js'
+import { adminSignIn } from '../server-fns/auth/index.js'
+import { getCollectionDocumentVersion as serverGetCollectionDocumentVersion } from '../server-fns/collections/get.js'
+
+/**
+ * Diff helper adapter — the contract uses positional args; the underlying
+ * server-fn helper expects the same shape, so this is a one-line passthrough
+ * that maps `null` to a default-loader-friendly `Record<string, unknown>`
+ * fallback (the diff modal handles a `null` doc gracefully via its own
+ * loading/error states, but the contract types it as non-null because the
+ * happy-path always returns an object).
+ */
+const getCollectionDocumentVersion: BylineAdminServices['getCollectionDocumentVersion'] = async (
+  collection,
+  documentId,
+  versionId,
+  locale
+) => {
+  const result = await serverGetCollectionDocumentVersion(collection, documentId, versionId, locale)
+  if (result == null) {
+    throw new Error(
+      `Document version not found: collection=${collection} document=${documentId} version=${versionId}`
+    )
+  }
+  return result as Record<string, unknown>
+}
+
+export const bylineAdminServices: BylineAdminServices = {
+  // Auth
+  adminSignIn,
+
+  // Account self-service
+  updateAccount,
+  changeAccountPassword,
+
+  // Admin user writes
+  createAdminUser,
+  updateAdminUser,
+  setAdminUserPassword,
+  setUserRoles,
+
+  // Admin role writes
+  createAdminRole,
+  updateAdminRole,
+
+  // Permissions
+  setRoleAbilities,
+  whoHasAbility,
+
+  // Diff helper
+  getCollectionDocumentVersion,
+}

package/src/integrations/byline-client.ts

@@ -0,0 +1,40 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * The admin webapp's `BylineClient` singleton.
+ *
+ * Configured with a `requestContext` factory that resolves the
+ * authenticated admin actor per call via `getAdminRequestContext`. Every
+ * admin server fn that reads documents goes through this client, so the
+ * full read pipeline (`beforeRead` → `findDocuments` → `populate` →
+ * `afterRead`) is uniform between admin and any future external
+ * client. The collection runtime, db adapter, and storage provider are
+ * sourced from the shared `getServerConfig()` so we don't duplicate
+ * adapter wiring.
+ */
+
+import { type BylineClient, createBylineClient } from '@byline/client'
+import { getServerConfig } from '@byline/core'
+
+import { getAdminRequestContext } from '../auth/auth-context.js'
+
+let cachedClient: BylineClient | undefined
+
+export function getAdminBylineClient(): BylineClient {
+  if (cachedClient) return cachedClient
+  cachedClient = createBylineClient({
+    config: getServerConfig(),
+    // Resolved per-call so each server fn picks up the actor from the
+    // current request's session cookies. `getAdminRequestContext` runs the
+    // refresh dance on its own and throws `ERR_UNAUTHENTICATED` when no
+    // session is present — the client surfaces the throw verbatim.
+    requestContext: getAdminRequestContext,
+  })
+  return cachedClient
+}

package/src/integrations/byline-core.ts

@@ -0,0 +1,32 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Typed accessor for the composed `BylineCore` post-init.
+ *
+ * Wraps `@byline/core`'s framework-neutral `getBylineCore<TAdminStore>()`
+ * and pre-binds `TAdminStore` to `AdminStore` from `@byline/admin`. This
+ * package is the admin host adapter — every server fn here ultimately
+ * delegates to an `@byline/admin` command that wants the typed store, so
+ * baking the generic in once removes the need for each call site to
+ * repeat `getBylineCore<AdminStore>()` and to import `AdminStore`
+ * separately.
+ *
+ * Hosts that wire a different admin-store flavour through
+ * `initBylineCore<TOtherStore>()` should NOT use this helper — they
+ * import `getBylineCore<TOtherStore>()` from `@byline/core` directly.
+ * That escape hatch keeps the framework-neutral package agnostic to
+ * which admin store is configured.
+ */
+
+import type { AdminStore } from '@byline/admin'
+import { type BylineCore, getBylineCore } from '@byline/core'
+
+export function bylineCore(): BylineCore<AdminStore> {
+  return getBylineCore<AdminStore>()
+}

package/src/integrations/byline-field-services.ts

@@ -0,0 +1,35 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Host-side adapters that bind the webapp's TanStack Start server functions
+ * to the framework-neutral `BylineFieldServices` contract consumed by
+ * `@byline/ui` field/form components.
+ *
+ * Wired into the admin route once via `<BylineFieldServicesProvider>`. A
+ * future Next.js host would ship its own adapter file and Provider; the
+ * @byline/ui surface is unchanged.
+ */
+
+import type { BylineFieldServices, GetCollectionDocumentsFn, UploadFieldFn } from '@byline/ui'
+
+import { getCollectionDocuments as serverGetCollectionDocuments } from '../server-fns/collections/list.js'
+import { uploadField as serverUploadField } from '../server-fns/collections/upload.js'
+
+const getCollectionDocuments: GetCollectionDocumentsFn = ({ collection, params }) =>
+  serverGetCollectionDocuments({
+    data: { collection, params },
+  }) as ReturnType<GetCollectionDocumentsFn>
+
+const uploadField: UploadFieldFn = (collection, formData, createDocument) =>
+  serverUploadField(collection, formData, createDocument)
+
+export const bylineFieldServices: BylineFieldServices = {
+  getCollectionDocuments,
+  uploadField,
+}

package/src/integrations/byline-public-client.ts

@@ -0,0 +1,53 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * The host's *public-read* `BylineClient` singleton — the strict
+ * "preview-can-never-apply" sibling of `getViewerBylineClient`.
+ *
+ * Configured with `actor: null` and `readMode: 'published'`, full stop.
+ * The `requestContext` factory does not consult the `byline_preview`
+ * cookie or attempt any admin-session resolution, so an admin browsing
+ * with preview mode on cannot accidentally elevate a read that flows
+ * through this client. `assertActorCanPerform` permits the null actor
+ * exactly on `read` with `readMode === 'published'`, which is what the
+ * factory always returns.
+ *
+ * **Use this client for:**
+ *   - RSS feeds, Atom feeds, sitemaps
+ *   - JSON or other endpoints exposed to third-party consumers
+ *   - any response that an upstream CDN / cache might serve to multiple
+ *     visitors without keying off the `byline_preview` cookie
+ *
+ * **Use `getViewerBylineClient` instead for:**
+ *   - user-facing public pages where an admin's preview-mode session
+ *     should be honoured
+ *
+ * Both clients share the same module-scoped singleton pattern so the
+ * SDK's per-instance `collectionRecordCache` is amortised across the
+ * process lifetime.
+ *
+ * Companion: `getAdminBylineClient` in `./byline-client.ts` for the
+ * admin webapp's authenticated reads (resolves a fresh `RequestContext`
+ * from session cookies on every call).
+ */
+
+import { createRequestContext } from '@byline/auth'
+import { type BylineClient, createBylineClient } from '@byline/client'
+import { getServerConfig } from '@byline/core'
+
+let cachedClient: BylineClient | undefined
+
+export function getPublicBylineClient(): BylineClient {
+  if (cachedClient) return cachedClient
+  cachedClient = createBylineClient({
+    config: getServerConfig(),
+    requestContext: () => createRequestContext({ readMode: 'published' }),
+  })
+  return cachedClient
+}

package/src/integrations/byline-viewer-client.ts

@@ -0,0 +1,99 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * The host's *viewer* `BylineClient` singleton — the preview-aware
+ * sibling of `getPublicBylineClient` (`./byline-public-client.ts`).
+ * Behaves identically to the public client until both the
+ * `byline_preview` cookie is set **and** a valid admin session resolves;
+ * at that point the per-call `requestContext` factory returns the
+ * authenticated `AdminAuth` instead of the anonymous null actor.
+ *
+ * Why this matters: `assertActorCanPerform` (packages/core/src/auth) only
+ * permits anonymous reads when `readMode === 'published'`. So if a server
+ * fn passes `status: 'any'` to surface drafts, an anonymous request
+ * trips the gate and throws — but a preview-mode admin sails through. The
+ * source-view selection itself remains a per-call decision: the SDK's
+ * `resolveReadMode` defaults to `'published'` regardless of context, so
+ * every server fn still has to opt in by passing `status: 'any'`.
+ *
+ * The contract for callers:
+ *
+ *   1. Use `getViewerBylineClient()` on any user-facing public read
+ *      where an admin's preview-mode session should be honoured. Use
+ *      `getPublicBylineClient()` instead for endpoints where preview
+ *      should never apply (RSS feeds, sitemaps, third-party endpoints,
+ *      anything an upstream cache might serve without keying off the
+ *      preview cookie).
+ *   2. Call `isPreviewActive()` once per server fn to decide whether to
+ *      pass `status: 'any'` on the read.
+ *
+ * Stale cookies fail closed: if the preview cookie is present but no
+ * valid admin session resolves, the factory returns the same anonymous
+ * + `'published'` context the public client would have used, so the
+ * worst case is "preview cookie does nothing".
+ *
+ * The collection-record cache is per-instance, so a singleton here keeps
+ * the same amortisation benefit `getPublicBylineClient` has — the two
+ * helpers are parallel singletons (one cached `BylineClient` each).
+ */
+
+import { createRequestContext } from '@byline/auth'
+import { type BylineClient, createBylineClient } from '@byline/client'
+import { getServerConfig } from '@byline/core'
+
+import { getAdminRequestContext } from '../auth/auth-context.js'
+import { readPreviewCookie } from '../auth/preview-cookies.js'
+
+let cachedClient: BylineClient | undefined
+
+export function getViewerBylineClient(): BylineClient {
+  if (cachedClient) return cachedClient
+  cachedClient = createBylineClient({
+    config: getServerConfig(),
+    requestContext: async () => {
+      // No preview cookie → behave exactly like the public client.
+      // Cheap path; no JWT verification, no DB lookup.
+      if (!readPreviewCookie()) {
+        return createRequestContext({ readMode: 'published' })
+      }
+
+      // Preview cookie present → try the admin context. A failure means
+      // the cookie is stale (admin signed out, session expired, refresh
+      // rejected). We swallow the error and fall back to the public
+      // context so the page renders instead of erroring.
+      try {
+        const ctx = await getAdminRequestContext()
+        return { ...ctx, readMode: 'any' }
+      } catch {
+        return createRequestContext({ readMode: 'published' })
+      }
+    },
+  })
+  return cachedClient
+}
+
+/**
+ * Resolve whether the current request should surface non-published
+ * versions. True iff the preview cookie is set **and** a valid admin
+ * session resolves. Server fns call this once and pass the result to
+ * `status: preview ? 'any' : 'published'` on the SDK read.
+ *
+ * Defensive by design: the cookie alone is not enough. A signed-out
+ * browser carrying an old preview cookie still gets `false` here, which
+ * keeps stray query strings or shared links from leaking drafts.
+ */
+export async function isPreviewActive(): Promise<boolean> {
+  if (!readPreviewCookie()) return false
+  try {
+    await getAdminRequestContext()
+    return true
+  } catch {
+    return false
+  }
+}