@decocms/nextjs 8.0.0 → 8.4.0

package/src/draftConstants.test.ts

@@ -1,21 +0,0 @@
-import { DRAFT_COOKIE_NAME, DRAFT_QUERY_PARAM } from "@decocms/blocks/cms";
-import { describe, expect, it } from "vitest";
-
-import { DRAFT_COOKIE, DRAFT_PARAM } from "./draftConstants";
-
-/**
- * The draft cookie/param names are wire protocol shared across a package
- * boundary: the client-safe copy here (the badge imports it without pulling
- * `next/headers` into the client bundle) MUST stay identical to the
- * framework-agnostic owner in `@decocms/blocks`, which `/deco/invoke` reads to
- * bind the same draft. If these drift, invoke silently serves published content
- * while the page shows the draft.
- */
-describe("draft constants parity with @decocms/blocks", () => {
-  it("cookie name matches", () => {
-    expect(DRAFT_COOKIE).toBe(DRAFT_COOKIE_NAME);
-  });
-  it("query param matches", () => {
-    expect(DRAFT_PARAM).toBe(DRAFT_QUERY_PARAM);
-  });
-});

package/src/draftConstants.ts

@@ -1,15 +0,0 @@
-/**
- * Draft-preview constants with ZERO server imports.
- *
- * `draft.ts` statically imports `next/headers`, so anything reachable from a
- * `"use client"` file must not import from it — that would pull `next/headers`
- * into the client bundle and fail the build. The client-side badge
- * (`DraftPreviewBadge`) needs `DRAFT_PARAM` to build its links, so the shared
- * constants live here and `draft.ts` re-exports them for its own callers.
- */
-
-/** Query param that enters draft mode (and, with `off`, leaves it). */
-export const DRAFT_PARAM = "__draft";
-
-/** Cookie that carries the pointer across in-preview navigation. */
-export const DRAFT_COOKIE = "__deco_draft";

package/src/draftMiddleware.test.ts

@@ -1,147 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-
-import { DRAFT_COOKIE } from "./draft";
-import { applyDraft, prepareDraft, rewriteToDraftRoute } from "./draftMiddleware";
-
-beforeEach(() => {
-  // The middleware is host-gated; these tests run as the allowed host.
-  process.env.DECO_ALLOWED_PREVIEW_HOSTS = "site.example";
-});
-afterEach(() => {
-  delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-});
-
-function request(url: string, cookie?: string): NextRequest {
-  const req = new NextRequest(new URL(url), {
-    headers: cookie ? { cookie: `${DRAFT_COOKIE}=${cookie}` } : {},
-  });
-  return req;
-}
-
-describe("prepareDraft", () => {
-  it("reads the pointer from the param", () => {
-    expect(prepareDraft(request("https://site.example/p?__draft=abc.localhost@v1")).pointer).toBe(
-      "abc.localhost@v1",
-    );
-  });
-
-  it("reads the pointer from the cookie on a plain navigation", () => {
-    expect(prepareDraft(request("https://site.example/p", "abc.localhost@v1")).pointer).toBe(
-      "abc.localhost@v1",
-    );
-  });
-
-  it("passes through when no env override is set — the page gate is authoritative", () => {
-    // The site-block hosts live in the server-components graph; middleware
-    // can't see them, so without the env kill switch it must not block.
-    delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-    const req = request("https://anything.example/p?__draft=abc.localhost@v1");
-    expect(prepareDraft(req).pointer).toBe("abc.localhost@v1");
-  });
-
-  it("is inert on a host outside the allowlist — the production domain", () => {
-    // Same build, different Host: no cookie, no rewrite, nothing touched.
-    const req = request("https://fila.com.br/p?__draft=abc@v1");
-    process.env.DECO_ALLOWED_PREVIEW_HOSTS = "fila.vtex.app";
-    expect(prepareDraft(req)).toEqual({ pointer: null, setCookie: null, clearCookie: false });
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("ignores a client-supplied draft header — the page owns the decision", () => {
-    // There is no request-header path any more; the page reads searchParams
-    // and cookies itself, so a forged header is simply not an input.
-    const req = new NextRequest(new URL("https://site.example/p"), {
-      headers: { "x-deco-draft": "attacker.localhost@v1" },
-    });
-    expect(prepareDraft(req).pointer).toBeNull();
-  });
-});
-
-describe("applyDraft", () => {
-  it("sets a partitioned cross-site cookie when entering draft mode", () => {
-    const decision = prepareDraft(request("https://site.example/p?__draft=abc.localhost@v1"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    const setCookie = res.headers.get("set-cookie") ?? "";
-    expect(setCookie).toContain(`${DRAFT_COOKIE}=abc.localhost%40v1`);
-    // The preview iframe is cross-site, so these attributes are what make the
-    // cookie survive at all — not hardening extras.
-    expect(setCookie).toMatch(/SameSite=None/i);
-    expect(setCookie).toMatch(/Secure/i);
-    expect(setCookie).toMatch(/Partitioned/i);
-    expect(setCookie).toMatch(/HttpOnly/i);
-  });
-
-  it("marks a draft response uncacheable and unindexable", () => {
-    // With the pointer in a cookie, draft and published share a URL — a CDN
-    // keyed on URL alone would serve unpublished content to a real visitor.
-    const decision = prepareDraft(request("https://site.example/p", "abc.localhost@v1"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    expect(res.headers.get("cache-control")).toBe("no-store, private");
-    expect(res.headers.get("vary")).toBe("Cookie");
-    expect(res.headers.get("x-robots-tag")).toBe("noindex, nofollow");
-  });
-
-  it("leaves an ordinary response completely untouched", () => {
-    const decision = prepareDraft(request("https://site.example/p"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    expect(res.headers.get("cache-control")).toBeNull();
-    expect(res.headers.get("vary")).toBeNull();
-    expect(res.headers.get("x-robots-tag")).toBeNull();
-    expect(res.headers.get("set-cookie")).toBeNull();
-  });
-
-  it("clears the cookie on ?__draft=off", () => {
-    const decision = prepareDraft(
-      request("https://site.example/p?__draft=off", "abc.localhost@v1"),
-    );
-    expect(decision.clearCookie).toBe(true);
-
-    const res = applyDraft(NextResponse.next(), decision);
-    const setCookie = res.headers.get("set-cookie") ?? "";
-    // Deletion is a set with an immediate expiry.
-    expect(setCookie).toContain(DRAFT_COOKIE);
-    expect(setCookie).toMatch(/Max-Age=0|Expires=Thu, 01 Jan 1970/i);
-    // And the response is not treated as a draft render.
-    expect(res.headers.get("cache-control")).toBeNull();
-  });
-});
-
-describe("rewriteToDraftRoute", () => {
-  it("rewrites a drafted request onto the dynamic draft route", () => {
-    const req = request("https://site.example/blog/hello?__draft=abc.localhost@v1");
-    const res = rewriteToDraftRoute(req, prepareDraft(req));
-    const target = new URL(res?.headers.get("x-middleware-rewrite") ?? "");
-    expect(target.pathname).toBe("/_draft/blog/hello");
-    // The pointer must survive: the draft page reads it from searchParams.
-    expect(target.searchParams.get("__draft")).toBe("abc.localhost@v1");
-  });
-
-  it("rewrites a cookie-only navigation too", () => {
-    const req = request("https://site.example/blog/hello", "abc.localhost@v1");
-    const res = rewriteToDraftRoute(req, prepareDraft(req));
-    expect(new URL(res?.headers.get("x-middleware-rewrite") ?? "").pathname).toBe(
-      "/_draft/blog/hello",
-    );
-  });
-
-  it("leaves an ordinary request alone — ISR must not be disturbed", () => {
-    // The whole point: only drafted requests go dynamic. A shopper's request
-    // must reach the real, statically rendered route untouched.
-    const req = request("https://site.example/blog/hello");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("never nests the prefix when middleware re-runs on the rewritten URL", () => {
-    const req = request("https://site.example/_draft/blog/hello?__draft=abc.localhost@v1");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("does not rewrite when leaving draft mode", () => {
-    const req = request("https://site.example/blog/hello?__draft=off", "abc.localhost@v1");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-});

package/src/draftMiddleware.ts

@@ -1,136 +0,0 @@
-/**
- * Draft preview — middleware half.
- *
- * Two composable calls, because sites already own their middleware and this
- * must slot into it rather than replace it:
- *
- * ```ts
- * // middleware.ts (Next <16) / proxy.ts (Next 16+)
- * export function middleware(request: NextRequest) {
- *   const decision = prepareDraft(request);
- *   return applyDraft(NextResponse.next(), decision);
- * }
- * ```
- *
- * The middleware owns only the cookie and the cache/indexing headers — a
- * Server Component can read cookies but cannot set them, so that part has to
- * live here. The pointer itself is read by the page.
- *
- * Lives on its own subpath so middleware (edge runtime) never imports the root
- * barrel, which pulls in the client component graph.
- */
-
-import { isDraftHostAllowed } from "@decocms/blocks/cms";
-import { type NextRequest, NextResponse } from "next/server";
-import {
-  DRAFT_COOKIE,
-  DRAFT_COOKIE_OPTIONS,
-  type DraftMiddlewareDecision,
-  decideDraft,
-} from "./draft";
-
-/**
- * Compute the draft decision for a request.
- *
- * Only the cookie and the response headers are the middleware's business now —
- * the page reads the pointer itself from `searchParams` + `cookies()`, so
- * nothing has to be forwarded through the request. That also means a draft
- * still works on routes this middleware never matches.
- */
-const INERT: DraftMiddlewareDecision = { pointer: null, setCookie: null, clearCookie: false };
-
-export function prepareDraft(request: NextRequest): DraftMiddlewareDecision {
-  // The AUTHORITATIVE host gate lives page-side (`ensureDraft`): the site
-  // block's `previewHosts` are installed in the server-components graph, and
-  // middleware runs in a separate module graph/runtime that never sees them.
-  // Middleware therefore hard-gates only on the env override — keeping
-  // DECO_ALLOWED_PREVIEW_HOSTS a full kill switch — and otherwise passes the
-  // decision through. Worst case on a non-preview host is a cookie the
-  // page-side gate then ignores; drafts never render there.
-  if (process.env.DECO_ALLOWED_PREVIEW_HOSTS) {
-    const host =
-      request.headers.get("x-forwarded-host") ??
-      request.headers.get("host") ??
-      request.nextUrl.host;
-    if (!isDraftHostAllowed(host)) return INERT;
-  }
-  return decideDraft(new URL(request.url), request.cookies.get(DRAFT_COOKIE)?.value ?? null);
-}
-
-/**
- * URL prefix a drafted request is rewritten onto.
- *
- * The site must mount the matching route as `app/%5Fdraft/...` — URL-encoded.
- * A literal `_draft/` directory is a Next "private folder", excluded from
- * routing entirely, so the rewrite would fall through to whatever catch-all
- * follows and 404. The encoded directory serves the same `/_draft` URL while
- * staying routable.
- */
-export const DRAFT_ROUTE_PREFIX = "/_draft";
-
-/**
- * Rewrite a drafted request onto the dynamic draft route.
- *
- * This exists because `dynamic` / `revalidate` are STATIC route exports: a
- * statically rendered page cannot become dynamic for one request. Making the
- * real route dynamic to support drafts would cost every shopper their cached
- * page, and — worse — a statically rendered draft would be cached and served to
- * them. Rewriting sends only drafted requests to a route that is dynamic by
- * construction, leaving ordinary traffic's ISR completely untouched.
- *
- * The original path is preserved in the rewritten pathname, so the draft route
- * can resolve exactly the page the visitor asked for.
- *
- * Returns null when this request is not drafted, so callers fall through to
- * their normal response.
- */
-export function rewriteToDraftRoute(
-  request: NextRequest,
-  decision: DraftMiddlewareDecision,
-): NextResponse | null {
-  if (!decision.pointer) return null;
-  const url = request.nextUrl.clone();
-  // Already rewritten (Next re-runs middleware on the rewritten URL in some
-  // configurations) — never nest the prefix.
-  if (url.pathname.startsWith(`${DRAFT_ROUTE_PREFIX}/`)) return null;
-  url.pathname = `${DRAFT_ROUTE_PREFIX}${url.pathname}`;
-  return NextResponse.rewrite(url);
-}
-
-/**
- * Apply the cookie and the cache/indexing headers a draft response requires.
- *
- * The caching headers are the difference between a preview and a **leak**.
- * With the pointer in a cookie, a draft response and a published one share an
- * identical URL, so a CDN keyed on URL alone would happily serve unpublished
- * content to a real visitor. `no-store` is what actually prevents that;
- * `Vary: Cookie` keeps any intermediary that *does* respect it from mixing the
- * two; `X-Robots-Tag` keeps a leaked draft out of search results.
- */
-export function applyDraft(
-  response: NextResponse,
-  decision: DraftMiddlewareDecision,
-): NextResponse {
-  if (decision.clearCookie) {
-    response.cookies.delete(DRAFT_COOKIE);
-  } else if (decision.setCookie) {
-    response.cookies.set(DRAFT_COOKIE, decision.setCookie, DRAFT_COOKIE_OPTIONS);
-  }
-
-  if (decision.pointer) {
-    response.headers.set("cache-control", "no-store, private");
-    response.headers.set("vary", "Cookie");
-    response.headers.set("x-robots-tag", "noindex, nofollow");
-  }
-
-  return response;
-}
-
-/**
- * Convenience for sites with no middleware of their own: prepare, continue,
- * apply. Sites that already have middleware should call the two halves
- * directly so their own logic sits in between.
- */
-export function draftMiddleware(request: NextRequest): NextResponse {
-  return applyDraft(NextResponse.next(), prepareDraft(request));
-}

package/src/routeHandlers.test.ts

@@ -1,243 +0,0 @@
-// @vitest-environment node
-//
-// Route Handlers run server-side with no DOM (same rationale as
-// setup.test.ts in this package). This matters concretely here: jsdom's
-// bundled Request polyfill does not reproduce Node/edge's Request-as-init
-// body-stream forwarding (`new Request(url, existingRequest)`) — under
-// jsdom the body-forwarding test below silently loses the body. Node's
-// native Request (used in this environment, and in the real Next.js
-// runtime) preserves it, which is what the previews-rebuild code path
-// relies on.
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-  handleDecofileRead: vi.fn(async () => new Response("decofile")),
-  handleDecofileReload: vi.fn(async () => new Response("reloaded")),
-  handleInvoke: vi.fn(async () => new Response("invoked")),
-  handleMeta: vi.fn(() => new Response("meta")),
-  handleRender: vi.fn(async (req: Request) => new Response(new URL(req.url).pathname)),
-  setMetaData: vi.fn(),
-  // Real corsHeaders shape (mirrors blocks-admin/src/admin/cors.ts) so the
-  // CORS assertions below test genuine header propagation, not a stub echo.
-  corsHeaders: vi.fn((req: Request) => ({
-    "Access-Control-Allow-Origin": req.headers.get("origin") || "*",
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, If-None-Match",
-    "Access-Control-Allow-Credentials": "true",
-  })),
-}));
-vi.mock("@decocms/blocks-admin", () => mocks);
-
-import { setMetaData } from "@decocms/blocks-admin";
-import { createDecoRouteHandlers, metaGET } from "./routeHandlers";
-
-describe("routeHandlers (next)", () => {
-  it("metaGET returns the schema response", async () => {
-    setMetaData({ sections: {}, actions: {}, loaders: {} } as any);
-    const response = await metaGET(new Request("https://example.com/live/_meta"));
-    expect(response.status).toBe(200);
-  });
-});
-
-describe("createDecoRouteHandlers", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("runs setup before dispatching and routes decofile GET/POST", async () => {
-    const order: string[] = [];
-    const setup = vi.fn(async () => {
-      order.push("setup");
-    });
-    const { GET, POST } = createDecoRouteHandlers({ setup });
-
-    await GET(new Request("http://x/deco/decofile"));
-    expect(setup).toHaveBeenCalled();
-    expect(mocks.handleDecofileRead).toHaveBeenCalled();
-
-    await POST(new Request("http://x/deco/decofile", { method: "POST" }));
-    expect(mocks.handleDecofileReload).toHaveBeenCalled();
-  });
-
-  it("routes meta, render, and invoke", async () => {
-    const { GET, POST } = createDecoRouteHandlers();
-    await GET(new Request("http://x/deco/meta"));
-    expect(mocks.handleMeta).toHaveBeenCalled();
-    await POST(new Request("http://x/deco/render", { method: "POST" }));
-    expect(mocks.handleRender).toHaveBeenCalled();
-    await POST(new Request("http://x/deco/invoke/site/actions/x", { method: "POST" }));
-    expect(mocks.handleInvoke).toHaveBeenCalled();
-  });
-
-  it("redirects preview GETs to the fixed RSC page and preserves the path and query", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/deco/previews/pages-Home-123?props=x&deviceHint=mobile"),
-    );
-
-    expect(res.status).toBe(307);
-    expect(res.headers.get("location")).toBe(
-      "http://x/deco/preview/pages-Home-123?props=x&deviceHint=mobile",
-    );
-    expect(mocks.handleRender).not.toHaveBeenCalled();
-  });
-
-  it("redirects the public /live/previews path to the fixed RSC page", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/live/previews/site/sections/Hero.tsx?deviceHint=desktop"),
-    );
-
-    expect(res.status).toBe(307);
-    expect(res.headers.get("location")).toBe(
-      "http://x/deco/preview/site/sections/Hero.tsx?deviceHint=desktop",
-    );
-    expect(mocks.handleRender).not.toHaveBeenCalled();
-  });
-
-  it("keeps preview POSTs on handleRender", async () => {
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(
-      new Request("http://x/deco/previews/pages-Home-123", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ hello: "world" }),
-      }),
-    );
-
-    expect(res.status).toBe(200);
-    expect(mocks.handleRender).toHaveBeenCalledOnce();
-  });
-
-  it("forwards a POST body through the /deco/previews/* URL rebuild (Request-as-init carries the body stream)", async () => {
-    // Pins the `new Request(rebuilt, request)` semantics documented on the
-    // rebuild line: passing a Request as `init` clones the body stream
-    // without a `duplex` option. A refactor to a plain init object would
-    // throw "duplex option is required" for this POST body.
-    mocks.handleRender.mockImplementationOnce(async (req: Request) => {
-      const body = await req.json();
-      return new Response(JSON.stringify({ pathname: new URL(req.url).pathname, body }));
-    });
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(
-      new Request("http://x/deco/previews/pages-Home-123", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ hello: "world" }),
-      }),
-    );
-    const json = await res.json();
-    expect(json.pathname).toBe("/live/previews/pages-Home-123");
-    expect(json.body).toEqual({ hello: "world" });
-  });
-
-  it("404s unknown deco paths", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/deco/nope"));
-    expect(res.status).toBe(404);
-  });
-
-  // Regression coverage for the rewrite-source paths, not just their
-  // /deco/* destinations: a Next.js App Router route handler reached via a
-  // next.config.js `rewrites()` entry sees `request.url` as the ORIGINAL,
-  // pre-rewrite path (verified empirically against a real `next build` +
-  // `next start`) — NOT the /deco/* destination the rewrite maps to. Every
-  // test above this one only ever constructs an already-/deco/*-shaped
-  // Request, so it would keep passing even if the dispatcher only matched
-  // that form and 404'd every real rewritten request — which is exactly
-  // the bug these tests catch.
-  it("routes the rewrite-source /.decofile path (not just its /deco/decofile destination)", async () => {
-    const { GET, POST } = createDecoRouteHandlers();
-    await GET(new Request("http://x/.decofile"));
-    expect(mocks.handleDecofileRead).toHaveBeenCalled();
-    await POST(new Request("http://x/.decofile", { method: "POST" }));
-    expect(mocks.handleDecofileReload).toHaveBeenCalled();
-  });
-
-  it("routes the rewrite-source /live/_meta path (not just its /deco/meta destination)", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/live/_meta"));
-    expect(mocks.handleMeta).toHaveBeenCalled();
-    expect(res.status).not.toBe(404);
-  });
-
-  it("405s POST /live/_meta with Allow: GET (the PRE-rewrite URL form)", async () => {
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(new Request("http://x/live/_meta", { method: "POST" }));
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Allow")).toBe("GET");
-    expect(mocks.handleMeta).not.toHaveBeenCalled();
-  });
-
-  it("redirects the rewrite-source /live/previews/* path to the fixed RSC page", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/live/previews/pages-Home-123?props=x"));
-    expect(res.status).toBe(307);
-    expect(res.headers.get("location")).toBe("http://x/deco/preview/pages-Home-123?props=x");
-    expect(mocks.handleRender).not.toHaveBeenCalled();
-  });
-
-  it("405s GET /deco/invoke/* with Allow: POST (CSRF protection — see comment on the invoke branch)", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/deco/invoke/site/actions/x"));
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Allow")).toBe("POST");
-    expect(mocks.handleInvoke).not.toHaveBeenCalled();
-  });
-
-  it("405s POST /deco/meta with Allow: GET", async () => {
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(new Request("http://x/deco/meta", { method: "POST" }));
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Allow")).toBe("GET");
-    expect(mocks.handleMeta).not.toHaveBeenCalled();
-  });
-});
-
-describe("createDecoRouteHandlers — CORS (Studio is a cross-origin browser client)", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("answers OPTIONS preflight with 204 + CORS headers, without running setup", async () => {
-    const setup = vi.fn(async () => {});
-    const { OPTIONS } = createDecoRouteHandlers({ setup });
-    const res = await OPTIONS(
-      new Request("http://x/live/_meta", {
-        method: "OPTIONS",
-        headers: {
-          origin: "https://decocms.com",
-          "access-control-request-method": "GET",
-          "access-control-request-headers": "if-none-match",
-        },
-      }),
-    );
-    expect(res.status).toBe(204);
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://decocms.com");
-    expect(res.headers.get("Access-Control-Allow-Headers")).toContain("If-None-Match");
-    expect(setup).not.toHaveBeenCalled();
-  });
-
-  it("stamps CORS headers on successful responses (meta via pre-rewrite URL)", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/live/_meta", { headers: { origin: "https://admin.deco.cx" } }),
-    );
-    expect(await res.text()).toBe("meta");
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://admin.deco.cx");
-  });
-
-  it("stamps CORS headers on method-gate 405s too", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/deco/invoke/site/actions/x", {
-        headers: { origin: "https://decocms.com" },
-      }),
-    );
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://decocms.com");
-  });
-
-  it("named exports carry CORS as well (metaGET)", async () => {
-    const res = await metaGET(
-      new Request("http://x/live/_meta", { headers: { origin: "https://decocms.com" } }),
-    );
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://decocms.com");
-  });
-});