@decocms/nextjs 8.1.0-next.0 → 8.4.0

package/dist/server/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `@decocms/nextjs/server`: draft previews in Server Components (pages,
+ * layouts, route handlers). Server only: it reads `next/headers`.
+ *
+ * A page (and, through the `x-deco-draft` header the proxy forwards, the root
+ * layout) binds the request's draft before it reads content, then reads
+ * through `contentClient(cms)`:
+ *
+ * ```tsx
+ * export default async function Page({ searchParams }) {
+ *   await bindDraft(cms, { searchParams: await searchParams, site: "my-store" });
+ *   const client = contentClient(cms);
+ *   …
+ *   return <>{sections}<DraftPreviewIndicator /></>;
+ * }
+ * ```
+ *
+ * The host check is the proxy's (`decideDraft`), repeated here with the same
+ * options, so a route the proxy doesn't match, or a forged `x-deco-draft`,
+ * still gets the release on a host that may not preview.
+ */
+import type { Client, CMS } from "@decocms/blocks";
+import { type PreviewPolicy } from "../drafts.ts";
+import { activeDraftPointer } from "./slot.ts";
+export { type PreviewPolicy, requestLike } from "../drafts.ts";
+export { activeDraftPointer };
+/** A page's `searchParams` prop, awaited. */
+export type SearchParams = Record<string, string | string[] | undefined>;
+export interface BindDraftOptions extends PreviewPolicy {
+    /** The page's own `searchParams` (a layout has none: it reads the proxy's `x-deco-draft`). */
+    searchParams?: SearchParams;
+}
+/**
+ * Binds the request's draft, if any: the page's own `?__draft=` first (`off`
+ * leaves preview), then the pointer the proxy forwarded on `x-deco-draft`,
+ * then the draft cookie, each on a host the options allow. Returns whether a
+ * draft was bound. With previews off on every host it returns `false`
+ * without reading the request, so a static page stays static.
+ */
+export declare function bindDraft(cms: Pick<CMS, "draftPointer" | "settings" | "forRelease">, options?: BindDraftOptions): Promise<boolean>;
+/**
+ * The content client for this request: the draft `bindDraft` bound, or the
+ * release.
+ */
+export declare function contentClient(cms: Pick<CMS, "forDraft" | "forRelease">): Client;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,EAAuC,KAAK,aAAa,EAAe,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAa,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAE,KAAK,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,8FAA8F;IAC9F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAOD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,UAAU,GAAG,YAAY,CAAC,EAC1D,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CAAC,GAAG,MAAM,CAG/E"}

package/dist/server/index.js

@@ -0,0 +1,64 @@
+/**
+ * `@decocms/nextjs/server`: draft previews in Server Components (pages,
+ * layouts, route handlers). Server only: it reads `next/headers`.
+ *
+ * A page (and, through the `x-deco-draft` header the proxy forwards, the root
+ * layout) binds the request's draft before it reads content, then reads
+ * through `contentClient(cms)`:
+ *
+ * ```tsx
+ * export default async function Page({ searchParams }) {
+ *   await bindDraft(cms, { searchParams: await searchParams, site: "my-store" });
+ *   const client = contentClient(cms);
+ *   …
+ *   return <>{sections}<DraftPreviewIndicator /></>;
+ * }
+ * ```
+ *
+ * The host check is the proxy's (`decideDraft`), repeated here with the same
+ * options, so a route the proxy doesn't match, or a forged `x-deco-draft`,
+ * still gets the release on a host that may not preview.
+ */
+import { headers } from "next/headers.js";
+import { DRAFT_HEADER, DRAFT_PARAM } from "../draft.js";
+import { allowedDraft, isDraftPreviewEnabled, requestLike } from "../drafts.js";
+import { activeDraftPointer, draftSlot } from "./slot.js";
+export { requestLike } from "../drafts.js";
+export { activeDraftPointer };
+function firstParam(searchParams, key) {
+    const raw = searchParams?.[key];
+    return (Array.isArray(raw) ? raw[0] : raw) ?? null;
+}
+/**
+ * Binds the request's draft, if any: the page's own `?__draft=` first (`off`
+ * leaves preview), then the pointer the proxy forwarded on `x-deco-draft`,
+ * then the draft cookie, each on a host the options allow. Returns whether a
+ * draft was bound. With previews off on every host it returns `false`
+ * without reading the request, so a static page stays static.
+ */
+export async function bindDraft(cms, options = {}) {
+    const { searchParams, ...policy } = options;
+    if (!(await isDraftPreviewEnabled(cms, policy)))
+        return false;
+    const param = firstParam(searchParams, DRAFT_PARAM);
+    if (param === "off")
+        return false;
+    const requestHeaders = await headers();
+    const forwarded = param ?? requestHeaders.get(DRAFT_HEADER);
+    const query = forwarded ? `?${DRAFT_PARAM}=${encodeURIComponent(forwarded)}` : "";
+    const request = requestLike(requestHeaders, `/${query}`);
+    const pointer = request ? await allowedDraft(cms, request, policy) : null;
+    if (pointer === null)
+        return false;
+    draftSlot().pointer = pointer;
+    return true;
+}
+/**
+ * The content client for this request: the draft `bindDraft` bound, or the
+ * release.
+ */
+export function contentClient(cms) {
+    const pointer = activeDraftPointer();
+    return pointer ? cms.forDraft(pointer) : cms.forRelease();
+}
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAsB,WAAW,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAsB,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAU9B,SAAS,UAAU,CAAC,YAAsC,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAA0D,EAC1D,OAAO,GAAqB,EAAE;IAE9B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,cAAyB,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,SAAS,EAAE,CAAC,OAAO,GAAG,OAAO,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyC;IACrE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5D,CAAC"}

package/dist/server/slot.d.ts

@@ -0,0 +1,6 @@
+export declare const draftSlot: () => {
+    pointer: string | null;
+};
+/** The draft pointer bound to this request (`bindDraft`), or `null` when it renders the release. */
+export declare function activeDraftPointer(): string | null;
+//# sourceMappingURL=slot.d.ts.map

package/dist/server/slot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot.d.ts","sourceRoot":"","sources":["../../src/server/slot.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,SAAS,QAAa;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAA0B,CAAC;AAEtF,oGAAoG;AACpG,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAElD"}

package/dist/server/slot.js

@@ -0,0 +1,13 @@
+/**
+ * The draft a request renders, held for the request's Server Components.
+ * React's `cache()` gives one slot per request in the React Server
+ * Components graph, the scope a draft needs; no `next/headers` here, so the
+ * root components can read it without binding anything.
+ */
+import { cache } from "react";
+export const draftSlot = cache(() => ({ pointer: null }));
+/** The draft pointer bound to this request (`bindDraft`), or `null` when it renders the release. */
+export function activeDraftPointer() {
+    return draftSlot().pointer;
+}
+//# sourceMappingURL=slot.js.map

package/dist/server/slot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot.js","sourceRoot":"","sources":["../../src/server/slot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,GAA+B,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAEtF,oGAAoG;AACpG,MAAM,UAAU,kBAAkB;IAChC,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC;AAC7B,CAAC"}

package/dist/studio.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Where Deco Studio runs: the origins its site editor frames a site from and
+ * talks to it from (`postMessage`). One list, so the Studio bridge
+ * (`StudioBridge`), `withDeco()`'s dev origins and a site's own
+ * `frame-ancestors` never drift apart. This package's own copy: it never
+ * imports `@decocms/tanstack`.
+ *
+ * No module state and no framework code: safe in a browser bundle.
+ */
+/**
+ * Studio's origins, in the CSP source form (`https://*.decocms.com` matches
+ * any subdomain). Test an origin with {@link isStudioOrigin}: the list holds a
+ * wildcard, so `includes()` isn't the check.
+ */
+export declare const STUDIO_ORIGINS: readonly string[];
+/**
+ * The `frame-ancestors` sources a site sends so Studio can show it in the
+ * site editor: the site itself, {@link STUDIO_ORIGINS}, and v7's
+ * `https://*.deco.studio`. For a site that writes its own CSP; add the
+ * loopback origins in local development (`http://localhost:*`), where a
+ * Studio runs on the same machine.
+ */
+export declare const STUDIO_FRAME_ANCESTORS: readonly string[];
+/**
+ * Whether `origin` (a `MessageEvent.origin`, an `Origin` header) is one of
+ * {@link STUDIO_ORIGINS}: `https`, the default port, and `decocms.com` or a
+ * name under it.
+ */
+export declare function isStudioOrigin(origin: string | null | undefined): boolean;
+//# sourceMappingURL=studio.d.ts.map

package/dist/studio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.d.ts","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAK1C,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAazE"}

package/dist/studio.js

@@ -0,0 +1,55 @@
+/**
+ * Where Deco Studio runs: the origins its site editor frames a site from and
+ * talks to it from (`postMessage`). One list, so the Studio bridge
+ * (`StudioBridge`), `withDeco()`'s dev origins and a site's own
+ * `frame-ancestors` never drift apart. This package's own copy: it never
+ * imports `@decocms/tanstack`.
+ *
+ * No module state and no framework code: safe in a browser bundle.
+ */
+/**
+ * Studio's origins, in the CSP source form (`https://*.decocms.com` matches
+ * any subdomain). Test an origin with {@link isStudioOrigin}: the list holds a
+ * wildcard, so `includes()` isn't the check.
+ */
+export const STUDIO_ORIGINS = Object.freeze([
+    "https://studio.decocms.com",
+    "https://studio-stg.decocms.com",
+    "https://decocms.com",
+    "https://*.decocms.com",
+]);
+/**
+ * The `frame-ancestors` sources a site sends so Studio can show it in the
+ * site editor: the site itself, {@link STUDIO_ORIGINS}, and v7's
+ * `https://*.deco.studio`. For a site that writes its own CSP; add the
+ * loopback origins in local development (`http://localhost:*`), where a
+ * Studio runs on the same machine.
+ */
+export const STUDIO_FRAME_ANCESTORS = Object.freeze([
+    "'self'",
+    ...STUDIO_ORIGINS,
+    "https://*.deco.studio",
+]);
+/**
+ * Whether `origin` (a `MessageEvent.origin`, an `Origin` header) is one of
+ * {@link STUDIO_ORIGINS}: `https`, the default port, and `decocms.com` or a
+ * name under it.
+ */
+export function isStudioOrigin(origin) {
+    if (typeof origin !== "string" || origin === "")
+        return false;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    // An origin is the scheme and host alone: `https://decocms.com/x` or one with
+    // credentials isn't one.
+    if (url.origin !== origin || url.protocol !== "https:" || url.port !== "")
+        return false;
+    const host = url.hostname;
+    return host === "decocms.com" || host.endsWith(".decocms.com");
+}
+//# sourceMappingURL=studio.js.map

package/dist/studio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.js","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,4BAA4B;IAC5B,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,QAAQ;IACR,GAAG,cAAc;IACjB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiC;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,yBAAyB;IACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,48 +1,67 @@
 {
   "name": "@decocms/nextjs",
-  "version": "8.1.0-next.0",
+  "version": "8.4.0",
   "type": "module",
   "engines": {
     "node": ">=24"
   },
-  "description": "Deco framework binding for Next.js App Router",
+  "description": "Deco CMS for any Next.js App Router app: draft previews in the proxy and the pages, the preview badge, the Studio bridge, withDeco() and a next/image loader",
   "repository": {
     "type": "git",
     "url": "https://github.com/decocms/blocks.git",
     "directory": "packages/nextjs"
   },
-  "main": "./src/index.ts",
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/**/__tests__"
+  ],
   "exports": {
-    ".": "./src/index.ts",
-    "./routeHandlers": "./src/routeHandlers.ts",
-    "./setup": "./src/setup.ts",
+    ".": {
+      "types": "./dist/index.d.ts",
+      "source": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./proxy": {
+      "types": "./dist/proxy/index.d.ts",
+      "source": "./src/proxy/index.ts",
+      "default": "./dist/proxy/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "source": "./src/server/index.ts",
+      "default": "./dist/server/index.js"
+    },
     "./config": {
-      "types": "./src/config.d.cts",
-      "default": "./src/config.cjs"
+      "types": "./src/config/index.d.cts",
+      "default": "./src/config/index.cjs"
     },
-    "./middleware": "./src/draftMiddleware.ts"
+    "./image-loader": {
+      "types": "./dist/image-loader/index.d.ts",
+      "source": "./src/image-loader/index.ts",
+      "default": "./dist/image-loader/index.js"
+    }
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node ../../scripts/tsc.mjs --clean dist -p tsconfig.build.json",
+    "prepack": "npm run build",
     "test": "vitest run --root ../.. packages/nextjs/",
-    "typecheck": "tsc --noEmit",
-    "lint:unused": "knip"
-  },
-  "dependencies": {
-    "@decocms/blocks": "8.1.0-next.0",
-    "@decocms/blocks-admin": "8.1.0-next.0"
+    "typecheck": "node ../../scripts/tsc.mjs -p tsconfig.json"
   },
   "peerDependencies": {
-    "next": ">=15.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
+    "@decocms/blocks": "^8.4.0",
+    "next": "^16.0.0",
+    "react": "^19.0.0"
   },
   "devDependencies": {
+    "@decocms/blocks": "8.4.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "knip": "^5.86.0",
-    "next": "^15.4.0",
-    "typescript": "^5.9.0"
+    "next": "16.3.8",
+    "react": "19.2.7",
+    "react-dom": "19.2.7"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/DraftPreviewIndicator.tsx

@@ -1,22 +1,23 @@
 /**
- * Server-side gate for the preview-mode badge.
+ * The "Preview mode" badge for the request's draft: a Server Component that
+ * renders `DraftBadge` (`@decocms/blocks/preview`) only when `bindDraft`
+ * bound a draft, so a published page emits nothing.
  *
- * A Server Component (no `"use client"`) so it can read the request-scoped
- * draft pointer via `getActiveDraftPointer()` and mount the client badge ONLY
- * when a draft is actually bound — an unconfigured/published request renders
- * nothing at all.
- *
- * Placement rule (inherited from `ensureDraft`): render this INSIDE the page
- * subtree, after `ensureDraft` has been awaited — never from a layout, whose
- * children render concurrently with the page that fills the slot. Sites using
- * `createDecoPage` get it wired automatically; hand-rolled routes drop
- * `<DraftPreviewIndicator />` at the end of their page.
+ * Render it inside the page, after `bindDraft` was awaited, never from a
+ * layout: a layout renders alongside the page that fills it, so it may run
+ * before the page bound its draft.
  */
-import { DraftPreviewBadge } from "./DraftPreviewBadge";
-import { getActiveDraftPointer } from "./draft";
+import { DraftBadge } from "@decocms/blocks/preview";
+import type { ReactNode } from "react";
+import { activeDraftPointer } from "./server/slot.ts";
+
+export interface DraftPreviewIndicatorProps {
+  /** Where "Exit preview" goes; default: the current URL with `?__draft=off`. */
+  exitHref?: string;
+}
 
-export function DraftPreviewIndicator() {
-  const pointer = getActiveDraftPointer();
+export function DraftPreviewIndicator({ exitHref }: DraftPreviewIndicatorProps = {}): ReactNode {
+  const pointer = activeDraftPointer();
   if (!pointer) return null;
-  return <DraftPreviewBadge pointer={pointer} />;
+  return <DraftBadge pointer={pointer} exitHref={exitHref} />;
 }

package/src/StudioBridge.ts

@@ -0,0 +1,23 @@
+/**
+ * `StudioBridge` of `@decocms/blocks/preview` with Studio's origins filled in
+ * (`STUDIO_ORIGINS`, `./studio.ts`): the package owns where Studio runs, so a
+ * site passes only its name. One inline script and no hooks, so a Server
+ * Component renders it as is.
+ */
+import {
+  StudioBridge as BridgeScript,
+  type StudioBridgeProps as BridgeScriptProps,
+} from "@decocms/blocks/preview";
+import { createElement, type ReactNode } from "react";
+import { STUDIO_ORIGINS } from "./studio.ts";
+
+/** `site`, and optionally `editShortcut` and `nonce`; Studio's origins are the package's. */
+export type StudioBridgeProps = Omit<BridgeScriptProps, "trustedOrigins">;
+
+/**
+ * Lets Studio's site editor select and edit sections on the page when Studio
+ * frames it. Render it once, in the root layout's `<body>`.
+ */
+export function StudioBridge(props: StudioBridgeProps): ReactNode {
+  return createElement(BridgeScript, { ...props, trustedOrigins: STUDIO_ORIGINS });
+}

package/src/config/index.cjs

@@ -0,0 +1,78 @@
+/**
+ * `@decocms/nextjs/config`: `withDeco(nextConfig)` for `next.config`.
+ * Plain CommonJS JavaScript, shipped as is, so a CommonJS `next.config.js`
+ * can `require()` it; an ESM `next.config.mjs`/`.ts` imports it the same way.
+ *
+ * It adds two things and nothing about hosting (no rewrites, no image hosts,
+ * no CDN rules):
+ *
+ * 1. `draftHeaders` (default on): v7's two header rules, first, so a draft
+ *    is never stored or indexed. A rule's `has` entries are ANDed and the two
+ *    signals never meet: a draft link carries the query (the proxy sets the
+ *    cookie on that response), every navigation after it the cookie.
+ *    On a dynamic App Router response Next sets `Cache-Control` and `Vary`
+ *    itself, so only `X-Robots-Tag` is sure to arrive from here; the proxy's
+ *    `applyDraft` sets all three on the responses it makes.
+ * 2. `studioOrigins` (default on): Studio's origins in `allowedDevOrigins`,
+ *    so `next dev` serves Studio's local mode its dev assets.
+ *
+ * The names repeat the package's (`DRAFT_PARAM`, `DRAFT_COOKIE`,
+ * `draftResponseHeaders` in `src/draft.ts`, `STUDIO_ORIGINS` in
+ * `src/studio.ts`): a CommonJS file can't load an ES module everywhere
+ * `next.config` runs. `config.test.ts` holds them equal.
+ */
+"use strict";
+
+/** `draftResponseHeaders(pointer)` (`src/draft.ts`), as `next.config` header entries. */
+const DRAFT_NO_STORE_HEADERS = [
+  { key: "Cache-Control", value: "no-store, private" },
+  { key: "Vary", value: "Cookie" },
+  { key: "X-Robots-Tag", value: "noindex, nofollow" },
+];
+
+/** v7's draft rules: the `?__draft=` query, or the `__deco_draft` cookie. */
+const DECO_DRAFT_HEADERS = [
+  {
+    source: "/:path*",
+    has: [{ type: "query", key: "__draft" }],
+    headers: DRAFT_NO_STORE_HEADERS,
+  },
+  {
+    source: "/:path*",
+    has: [{ type: "cookie", key: "__deco_draft" }],
+    headers: DRAFT_NO_STORE_HEADERS,
+  },
+];
+
+/**
+ * `STUDIO_ORIGINS` as `allowedDevOrigins` hosts: `https://*.decocms.com`
+ * matches any name under `decocms.com` (`isStudioOrigin`), which Next writes
+ * as `**.decocms.com`.
+ */
+const STUDIO_DEV_ORIGINS = [
+  "studio.decocms.com",
+  "studio-stg.decocms.com",
+  "decocms.com",
+  "**.decocms.com",
+];
+
+function withDeco(nextConfig = {}, options = {}) {
+  const { draftHeaders = true, studioOrigins = true } = options;
+  const config = { ...nextConfig };
+  if (studioOrigins) {
+    config.allowedDevOrigins = [
+      ...new Set([...(nextConfig.allowedDevOrigins ?? []), ...STUDIO_DEV_ORIGINS]),
+    ];
+  }
+  if (draftHeaders) {
+    const siteHeaders = nextConfig.headers;
+    config.headers = async () => [
+      // First: a site-wide Cache-Control rule must not win over a draft's.
+      ...DECO_DRAFT_HEADERS,
+      ...(siteHeaders ? await siteHeaders() : []),
+    ];
+  }
+  return config;
+}
+
+module.exports = { withDeco, DECO_DRAFT_HEADERS, STUDIO_DEV_ORIGINS };

package/src/config/index.d.cts

@@ -0,0 +1,27 @@
+import type { NextConfig } from "next";
+
+/** A `next.config` header rule. */
+export interface HeaderRule {
+  source: string;
+  has?: { type: string; key: string; value?: string }[];
+  headers: { key: string; value: string }[];
+}
+
+export interface WithDecoOptions {
+  /** v7's draft header rules (no-store, `Vary: Cookie`, noindex), before the site's own. Default `true`. */
+  draftHeaders?: boolean;
+  /** Studio's origins in `allowedDevOrigins`. Default `true`. */
+  studioOrigins?: boolean;
+}
+
+/** The site's `next.config` with Deco's draft header rules and Studio's dev origins. */
+export declare function withDeco<C extends NextConfig>(
+  nextConfig?: C,
+  options?: WithDecoOptions,
+): C & NextConfig;
+
+/** The header rules `withDeco` puts first: a `?__draft=` query, or the `__deco_draft` cookie. */
+export declare const DECO_DRAFT_HEADERS: HeaderRule[];
+
+/** `STUDIO_ORIGINS` (`@decocms/nextjs`) in `allowedDevOrigins` form. */
+export declare const STUDIO_DEV_ORIGINS: string[];