@decocms/nextjs 8.1.0-next.0 → 8.4.0

package/src/createDecoPage.tsx

@@ -1,173 +0,0 @@
-import {
-  type DecoPageResult,
-  extractSeoFromProps,
-  extractSeoFromSections,
-  isDraftPreviewEnabled,
-  type PageSeo,
-  resolveDecoPage,
-} from "@decocms/blocks/cms";
-import type { Metadata } from "next";
-import { notFound } from "next/navigation";
-import { connection } from "next/server";
-import { cache } from "react";
-import { DecoPageRenderer } from "./DecoPageRenderer";
-import { DraftPreviewIndicator } from "./DraftPreviewIndicator";
-import { type DraftSearchParams, ensureDraft } from "./draft";
-
-interface CreateDecoPageOptions {
-  siteName: string;
-}
-
-interface PageProps {
-  params: Promise<{ slug?: string[] }>;
-  /**
-   * Next always supplies this; optional here so existing callers (and unit
-   * tests) that construct props by hand keep compiling. Draft preview reads
-   * `?__draft=` from it — see bindDraftOnce.
-   */
-  searchParams?: Promise<DraftSearchParams>;
-}
-
-function pathFromSlug(slug: string[] | undefined): string {
-  return `/${(slug ?? []).join("/")}`;
-}
-
-/**
- * Merge page-level SEO (the `seo` block resolved into `DecoPageResult.seoSection`)
- * with section-contributed SEO (sections registered via `registerSeoSections`
- * whose resolved props also carry SEO fields — e.g. a PDP SEO section). Page
- * level fields win on conflict, mirroring `buildPageSeo` in the TanStack
- * binding (packages/tanstack/src/routes/cmsRoute.ts:408-484).
- *
- * Deliberately narrower than that binding's version: it does NOT run
- * `seoSection` through its own section loader (so commerce-loader-backed
- * jsonLD on the seo block won't resolve here) and does NOT fall back to
- * site-wide SEO defaults or apply title/description templates. Those are
- * out of scope for this minimal page.tsx wiring.
- */
-function buildSeo(page: DecoPageResult): PageSeo {
-  const sectionSeo = extractSeoFromSections(page.resolvedSections);
-  const pageSeo = page.seoSection ? extractSeoFromProps(page.seoSection.props) : {};
-  return { ...sectionSeo, ...pageSeo };
-}
-
-/**
- * Creates the { generateMetadata, default } pair a site spreads into
- * app/[[...slug]]/page.tsx. Mirrors `@decocms/tanstack`'s `cmsRouteConfig`.
- *
- * `resolveForPath` is wrapped in React's `cache()` so `generateMetadata` and
- * the page body share one `resolveDecoPage` call per request instead of
- * resolving twice — the same pattern a production Next.js site's own
- * `resolveCmsPageByPath` already used against the old /next tier. This relies
- * on Next's RSC renderer establishing a per-request cache boundary that
- * `cache()` memoizes against: calling the returned functions directly outside
- * that renderer (e.g. in a plain unit test) will NOT dedupe, since there is
- * no active cache boundary for `cache()` to key off — verified empirically
- * against this repo's `react` version. The functions still return correct,
- * independent results either way; only the single-request sharing is
- * untestable outside Next's own pipeline.
- */
-export function createDecoPage({ siteName }: CreateDecoPageOptions) {
-  // `siteName` is unused here. `MatcherContext` (packages/blocks/src/cms/resolve.ts)
-  // has no siteName field, so there's nothing to thread it into `resolveDecoPage`.
-  // It's kept in the options shape to mirror `cmsRouteConfig({ siteName })`'s call
-  // signature and as the extension point for Task 7's root layout
-  // (LiveControls/analytics wiring) — genuinely unused in this file.
-  void siteName;
-
-  const resolveForPath = cache(async (pathname: string) => resolveDecoPage(pathname, {}));
-
-  /**
-   * Bind this request's draft decofile, at most once, BEFORE anything resolves
-   * a page.
-   *
-   * Ordering is load-bearing twice over:
-   *
-   *  1. `resolveDecoPage` calls `loadBlocks()`, so a draft bound afterwards
-   *     would resolve the page against published content and silently render
-   *     the wrong thing.
-   *  2. `resolveForPath` is `cache()`d per request and Next may run
-   *     `generateMetadata` and the page body concurrently — whichever resolves
-   *     first wins for both. So this must be awaited at the top of BOTH, not
-   *     just the page. `cache()` here makes the second call free.
-   *
-   * Gated on `isDraftPreviewEnabled()` (DECO_ALLOWED_PREVIEW_HOSTS non-empty) — a
-   * plain env read, not a dynamic API —
-   * so sites that never opt in behave exactly as before. That gate is doing
-   * real work: `cookies()` and `searchParams` are both dynamic, and touching
-   * them unconditionally would opt EVERY page out of static/ISR rendering.
-   *
-   * KNOWN COST: with the flag on, every page served by this route becomes
-   * dynamic, because reading the pointer requires `cookies()`. Acceptable
-   * while the feature is opt-in; the fix, when it needs to run on a
-   * statically-rendered production site, is for middleware to rewrite draft
-   * requests onto a separate dynamic route so ordinary traffic keeps its cache.
-   */
-  const bindDraftOnce = cache(async (searchParams?: DraftSearchParams): Promise<boolean> => {
-    if (!isDraftPreviewEnabled()) return false;
-
-    const bound = await ensureDraft(searchParams);
-
-    // A draft render must never be cached — ISR or the Full Route Cache would
-    // hand unpublished content to a real visitor. `revalidate` is a static
-    // export and cannot vary per request, so opt out at runtime instead.
-    if (bound) await connection();
-
-    return bound;
-  });
-
-  async function generateMetadata({ params, searchParams }: PageProps): Promise<Metadata> {
-    const { slug } = await params;
-    await bindDraftOnce(await searchParams);
-    const page = await resolveForPath(pathFromSlug(slug));
-    if (!page) return {};
-
-    const seo = buildSeo(page);
-    return {
-      title: seo.title,
-      description: seo.description,
-      alternates: seo.canonical ? { canonical: seo.canonical } : undefined,
-      robots: seo.noIndexing ? { index: false, follow: false } : undefined,
-    };
-  }
-
-  async function Page({ params, searchParams }: PageProps) {
-    const { slug } = await params;
-    const pathname = pathFromSlug(slug);
-    // Before resolveForPath — see bindDraftOnce.
-    const isDraft = await bindDraftOnce(await searchParams);
-    const page = await resolveForPath(pathname);
-    if (!page) notFound();
-
-    // Call DecoPageRenderer directly (await its result) rather than nesting
-    // it as `<DecoPageRenderer .../>` JSX. DecoPageRenderer.tsx documents why:
-    // it's an async function, and Next's real RSC renderer awaits async
-    // components anywhere in the tree — but react-dom/server's synchronous
-    // renderer (used by this package's unit tests, and by any consumer not
-    // going through Next's RSC pipeline) throws when an async component
-    // suspends outside a <Suspense> boundary. Awaiting it here directly
-    // keeps both paths working, matching the same convention
-    // DecoPageRenderer itself uses for SectionRenderer.
-    const content = await DecoPageRenderer({
-      sections: page.resolvedSections,
-      deferredSections: page.deferredSections,
-      pagePath: pathname,
-    });
-
-    // In draft mode, float the preview-mode badge over the page so the
-    // reviewer can never mistake unpublished content for what is live.
-    // `DraftPreviewIndicator` self-gates on the request-scoped pointer; the
-    // `isDraft` short-circuit keeps the extra element out of every published
-    // render. Rendered here (page subtree, after bindDraftOnce) — not a layout,
-    // whose children render concurrently — so the pointer slot is already set.
-    if (!isDraft) return content;
-    return (
-      <>
-        {content}
-        <DraftPreviewIndicator />
-      </>
-    );
-  }
-
-  return { generateMetadata, default: Page };
-}

package/src/createDecoPreviewPage.test.tsx

@@ -1,71 +0,0 @@
-// @vitest-environment node
-
-import { registerSection, setBlocks } from "@decocms/blocks/cms";
-import { setRenderShell } from "@decocms/blocks-admin";
-import { renderToString } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { createDecoPreviewPage } from "./createDecoPreviewPage";
-import * as nextjs from "./index";
-
-vi.mock("next/headers", () => ({
-  headers: vi.fn(
-    async () =>
-      new Headers({
-        host: "store.test",
-        "x-forwarded-proto": "https",
-        "user-agent": "preview-test",
-      }),
-  ),
-}));
-
-const HERO = "site/sections/PreviewHero.tsx";
-
-beforeEach(() => {
-  setBlocks({
-    "Preview Hero": { __resolveType: HERO, label: "rsc" },
-  });
-  registerSection(HERO, async () => ({
-    default: ({ label }: { label?: string }) => <h1>{`hero-${label}`}</h1>,
-  }));
-  setRenderShell({
-    css: "/preview.css",
-    fonts: ["/font.css"],
-    theme: "light",
-    bodyClass: "preview-body",
-  });
-});
-
-describe("createDecoPreviewPage", () => {
-  it("is exposed by the Next.js binding", () => {
-    expect((nextjs as Record<string, unknown>).createDecoPreviewPage).toBeTypeOf("function");
-  });
-
-  it("resolves and renders a section through the RSC-aware SectionRenderer", async () => {
-    const setup = vi.fn(async () => {});
-    const Page = createDecoPreviewPage({ setup });
-    const element = await Page({
-      params: Promise.resolve({ path: ["Preview Hero"] }),
-      searchParams: Promise.resolve({ deviceHint: "desktop" }),
-    });
-    const html = renderToString(element);
-
-    expect(setup).toHaveBeenCalledOnce();
-    expect(html).toContain("hero-rsc");
-    expect(html).toContain('data-manifest-key="site/sections/PreviewHero.tsx"');
-    expect(html).toContain('href="/preview.css"');
-    expect(html).toContain('href="/font.css"');
-    expect(html).toContain('data-theme="light"');
-    expect(html).toContain("preview-body");
-    expect(html).toContain("editor::inject");
-  });
-
-  it("renders a visible diagnostic for an unknown section", async () => {
-    const Page = createDecoPreviewPage();
-    const element = await Page({
-      params: Promise.resolve({ path: ["Missing"] }),
-      searchParams: Promise.resolve({}),
-    });
-
-    expect(renderToString(element)).toContain("Unknown section: Missing");
-  });
-});

package/src/createDecoPreviewPage.tsx

@@ -1,108 +0,0 @@
-import { LIVE_CONTROLS_SCRIPT, resolvePreviewRequest } from "@decocms/blocks-admin";
-import { getPreviewWrapper, getRenderShellConfig } from "@decocms/blocks-admin/admin/setup";
-import { headers } from "next/headers";
-import { cloneElement, createElement, type ReactElement, type ReactNode } from "react";
-import { SectionRenderer } from "./SectionRenderer";
-
-export interface CreateDecoPreviewPageOptions {
-  setup?: () => Promise<void>;
-}
-
-export interface DecoPreviewPageProps {
-  params: Promise<{ path?: string[] }>;
-  searchParams: Promise<Record<string, string | string[] | undefined>>;
-}
-
-function appendSearchParams(
-  target: URLSearchParams,
-  source: Record<string, string | string[] | undefined>,
-) {
-  for (const [key, value] of Object.entries(source)) {
-    if (Array.isArray(value)) {
-      for (const item of value) target.append(key, item);
-    } else if (value !== undefined) {
-      target.set(key, value);
-    }
-  }
-}
-
-async function buildPreviewRequest(props: DecoPreviewPageProps): Promise<Request> {
-  const [params, searchParams, requestHeaders] = await Promise.all([
-    props.params,
-    props.searchParams,
-    headers(),
-  ]);
-  const host = requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host") ?? "localhost";
-  const protocol = requestHeaders.get("x-forwarded-proto") ?? "http";
-  const encodedPath = (params.path ?? []).map(encodeURIComponent).join("/");
-  const url = new URL(`/live/previews/${encodedPath}`, `${protocol}://${host}`);
-  appendSearchParams(url.searchParams, searchParams);
-  return new Request(url, { headers: new Headers(requestHeaders) });
-}
-
-function PreviewResources() {
-  const { cssHref, fontHrefs } = getRenderShellConfig();
-  return (
-    <>
-      {fontHrefs.map((href) => (
-        <link key={href} rel="stylesheet" href={href} />
-      ))}
-      {cssHref ? <link rel="stylesheet" href={cssHref} /> : null}
-    </>
-  );
-}
-
-function PreviewFrame({ children }: { children: ReactNode }) {
-  const { themeName, bodyClass } = getRenderShellConfig();
-  const Wrapper = getPreviewWrapper();
-  const content = Wrapper ? createElement(Wrapper, null, children) : children;
-
-  return (
-    <>
-      <PreviewResources />
-      <div data-theme={themeName || "light"} className={bodyClass || undefined}>
-        {content}
-      </div>
-      <script dangerouslySetInnerHTML={{ __html: LIVE_CONTROLS_SCRIPT }} />
-    </>
-  );
-}
-
-function PreviewDiagnostic({ children }: { children: ReactNode }) {
-  return <div style={{ padding: 20, color: "red" }}>{children}</div>;
-}
-
-export function createDecoPreviewPage(options: CreateDecoPreviewPageOptions = {}) {
-  return async function DecoPreviewPage(props: DecoPreviewPageProps) {
-    await options.setup?.();
-
-    try {
-      const request = await buildPreviewRequest(props);
-      const resolution = await resolvePreviewRequest(request);
-      if (resolution.type === "unknown") {
-        return (
-          <PreviewFrame>
-            <PreviewDiagnostic>{`Unknown section: ${resolution.component}`}</PreviewDiagnostic>
-          </PreviewFrame>
-        );
-      }
-
-      const rendered = await Promise.all(
-        resolution.sections.map(async (section, index): Promise<ReactElement | null> => {
-          const element = await SectionRenderer({ resolved: section });
-          return element
-            ? cloneElement(element, { key: `${section.key}-${section.index ?? index}` })
-            : null;
-        }),
-      );
-
-      return <PreviewFrame>{rendered}</PreviewFrame>;
-    } catch (error) {
-      return (
-        <PreviewFrame>
-          <PreviewDiagnostic>{`Render error: ${(error as Error).message}`}</PreviewDiagnostic>
-        </PreviewFrame>
-      );
-    }
-  };
-}

package/src/draft.test.ts

@@ -1,73 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { DRAFT_COOKIE_OPTIONS, DRAFT_PARAM, decideDraft } from "./draft";
-
-function urlWith(param?: string): URL {
-  const url = new URL("https://site.example/some/page");
-  if (param !== undefined) url.searchParams.set(DRAFT_PARAM, param);
-  return url;
-}
-
-describe("decideDraft", () => {
-  it("enters draft mode from the param and sets the cookie", () => {
-    expect(decideDraft(urlWith("abc@v1"), null)).toEqual({
-      pointer: "abc@v1",
-      setCookie: "abc@v1",
-      clearCookie: false,
-    });
-  });
-
-  it("carries the draft across navigation via the cookie alone", () => {
-    // The param is gone — this is the in-preview link click that a
-    // param-only design would silently drop back to published.
-    expect(decideDraft(urlWith(), "abc@v1")).toEqual({
-      pointer: "abc@v1",
-      setCookie: null,
-      clearCookie: false,
-    });
-  });
-
-  it("lets the param override a stale cookie", () => {
-    // Studio navigating to a newer version must win over the older pointer
-    // still sitting in the cookie, or a save would never be reflected.
-    expect(decideDraft(urlWith("abc@v2"), "abc@v1")).toEqual({
-      pointer: "abc@v2",
-      setCookie: "abc@v2",
-      clearCookie: false,
-    });
-  });
-
-  it("leaves draft mode on ?__draft=off, even with a cookie set", () => {
-    expect(decideDraft(urlWith("off"), "abc@v1")).toEqual({
-      pointer: null,
-      setCookie: null,
-      clearCookie: true,
-    });
-  });
-
-  it("is inert for an ordinary request", () => {
-    expect(decideDraft(urlWith(), null)).toEqual({
-      pointer: null,
-      setCookie: null,
-      clearCookie: false,
-    });
-  });
-});
-
-describe("DRAFT_COOKIE_OPTIONS", () => {
-  it("is set up to survive a cross-site preview iframe", () => {
-    // The preview iframe is cross-site (Studio embeds the production origin),
-    // so the cookie is third-party. Without SameSite=None+Secure it is never
-    // sent; without Partitioned (CHIPS) it is dropped as browsers wind down
-    // unpartitioned third-party cookies. These attributes are load-bearing,
-    // not incidental.
-    expect(DRAFT_COOKIE_OPTIONS.sameSite).toBe("none");
-    expect(DRAFT_COOKIE_OPTIONS.secure).toBe(true);
-    expect(DRAFT_COOKIE_OPTIONS.partitioned).toBe(true);
-    expect(DRAFT_COOKIE_OPTIONS.httpOnly).toBe(true);
-  });
-
-  it("is short-lived so a stale pointer can't pin an old version", () => {
-    expect(DRAFT_COOKIE_OPTIONS.maxAge).toBeLessThanOrEqual(60 * 60);
-  });
-});

package/src/draftConstants.test.ts

@@ -1,21 +0,0 @@
-import { DRAFT_COOKIE_NAME, DRAFT_QUERY_PARAM } from "@decocms/blocks/cms";
-import { describe, expect, it } from "vitest";
-
-import { DRAFT_COOKIE, DRAFT_PARAM } from "./draftConstants";
-
-/**
- * The draft cookie/param names are wire protocol shared across a package
- * boundary: the client-safe copy here (the badge imports it without pulling
- * `next/headers` into the client bundle) MUST stay identical to the
- * framework-agnostic owner in `@decocms/blocks`, which `/deco/invoke` reads to
- * bind the same draft. If these drift, invoke silently serves published content
- * while the page shows the draft.
- */
-describe("draft constants parity with @decocms/blocks", () => {
-  it("cookie name matches", () => {
-    expect(DRAFT_COOKIE).toBe(DRAFT_COOKIE_NAME);
-  });
-  it("query param matches", () => {
-    expect(DRAFT_PARAM).toBe(DRAFT_QUERY_PARAM);
-  });
-});

package/src/draftConstants.ts

@@ -1,30 +0,0 @@
-/**
- * Draft-preview constants with ZERO server imports.
- *
- * `draft.ts` statically imports `next/headers`, so anything reachable from a
- * `"use client"` file must not import from it — that would pull `next/headers`
- * into the client bundle and fail the build. The client-side badge
- * (`DraftPreviewBadge`) needs `DRAFT_PARAM` to build its links, so the shared
- * constants live here and `draft.ts` re-exports them for its own callers.
- */
-
-/** Query param that enters draft mode (and, with `off`, leaves it). */
-export const DRAFT_PARAM = "__draft";
-
-/** Cookie that carries the pointer across in-preview navigation. */
-export const DRAFT_COOKIE = "__deco_draft";
-
-/**
- * Request header the middleware forwards the active pointer on, so the whole
- * RSC tree — including the root layout / app shell — can bind the draft on the
- * SAME request. The page reads `?__draft=` from its own `searchParams`, but a
- * layout never receives `searchParams` and, on the entry request, the cookie
- * has only just been set on the *response* (not yet readable). Forwarding the
- * pointer as a request header closes both gaps so `ensureDraft()` works from a
- * layout, letting shell-resolved Header/Footer reflect the draft too.
- *
- * Not a new trust surface: the pointer was never a secret (the draft id is the
- * capability, host-scoping bounds blast radius — see `draftSource`), so a
- * forwarded/forged header is equivalent to typing the query param.
- */
-export const DRAFT_HEADER = "x-deco-draft";

package/src/draftMiddleware.test.ts

@@ -1,179 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-
-import { DRAFT_COOKIE } from "./draft";
-import {
-  applyDraft,
-  draftRequestHeaders,
-  prepareDraft,
-  rewriteToDraftRoute,
-} from "./draftMiddleware";
-
-beforeEach(() => {
-  // The middleware is host-gated; these tests run as the allowed host.
-  process.env.DECO_ALLOWED_PREVIEW_HOSTS = "site.example";
-});
-afterEach(() => {
-  delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-});
-
-function request(url: string, cookie?: string): NextRequest {
-  const req = new NextRequest(new URL(url), {
-    headers: cookie ? { cookie: `${DRAFT_COOKIE}=${cookie}` } : {},
-  });
-  return req;
-}
-
-describe("prepareDraft", () => {
-  it("reads the pointer from the param", () => {
-    expect(prepareDraft(request("https://site.example/p?__draft=abc.localhost@v1")).pointer).toBe(
-      "abc.localhost@v1",
-    );
-  });
-
-  it("reads the pointer from the cookie on a plain navigation", () => {
-    expect(prepareDraft(request("https://site.example/p", "abc.localhost@v1")).pointer).toBe(
-      "abc.localhost@v1",
-    );
-  });
-
-  it("passes through when no env override is set — the page gate is authoritative", () => {
-    // The site-block hosts live in the server-components graph; middleware
-    // can't see them, so without the env kill switch it must not block.
-    delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-    const req = request("https://anything.example/p?__draft=abc.localhost@v1");
-    expect(prepareDraft(req).pointer).toBe("abc.localhost@v1");
-  });
-
-  it("is inert on a host outside the allowlist — the production domain", () => {
-    // Same build, different Host: no cookie, no rewrite, nothing touched.
-    const req = request("https://acme.com.br/p?__draft=abc@v1");
-    process.env.DECO_ALLOWED_PREVIEW_HOSTS = "acme.vtex.app";
-    expect(prepareDraft(req)).toEqual({ pointer: null, setCookie: null, clearCookie: false });
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("does not read a client-supplied draft header — the decision is param/cookie only", () => {
-    // The forwarded `x-deco-draft` header (read by `ensureDraft` in the layout)
-    // is an OUTPUT of the middleware decision, never an input to it: prepareDraft
-    // still decides purely from the param + cookie. A client that forges the
-    // header directly can't manufacture a decision here (and `draftRequestHeaders`
-    // strips it when not previewing).
-    const req = new NextRequest(new URL("https://site.example/p"), {
-      headers: { "x-deco-draft": "attacker.localhost@v1" },
-    });
-    expect(prepareDraft(req).pointer).toBeNull();
-  });
-});
-
-describe("draftRequestHeaders", () => {
-  it("forwards the active pointer on x-deco-draft so a layout can bind it", () => {
-    const req = request("https://site.example/p?__draft=abc.localhost@v1");
-    const headers = draftRequestHeaders(req, prepareDraft(req));
-    expect(headers.get("x-deco-draft")).toBe("abc.localhost@v1");
-  });
-
-  it("forwards the cookie-carried pointer on plain navigation", () => {
-    const req = request("https://site.example/p", "abc.localhost@v1");
-    const headers = draftRequestHeaders(req, prepareDraft(req));
-    expect(headers.get("x-deco-draft")).toBe("abc.localhost@v1");
-  });
-
-  it("strips a client-forged header when the request is not previewing", () => {
-    // Direct-to-origin request carrying a forged header but no real pointer:
-    // the forwarded headers must not carry it downstream.
-    const req = new NextRequest(new URL("https://site.example/p"), {
-      headers: { "x-deco-draft": "attacker.localhost@v1" },
-    });
-    const headers = draftRequestHeaders(req, prepareDraft(req));
-    expect(headers.get("x-deco-draft")).toBeNull();
-  });
-});
-
-describe("applyDraft", () => {
-  it("sets a partitioned cross-site cookie when entering draft mode", () => {
-    const decision = prepareDraft(request("https://site.example/p?__draft=abc.localhost@v1"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    const setCookie = res.headers.get("set-cookie") ?? "";
-    expect(setCookie).toContain(`${DRAFT_COOKIE}=abc.localhost%40v1`);
-    // The preview iframe is cross-site, so these attributes are what make the
-    // cookie survive at all — not hardening extras.
-    expect(setCookie).toMatch(/SameSite=None/i);
-    expect(setCookie).toMatch(/Secure/i);
-    expect(setCookie).toMatch(/Partitioned/i);
-    expect(setCookie).toMatch(/HttpOnly/i);
-  });
-
-  it("marks a draft response uncacheable and unindexable", () => {
-    // With the pointer in a cookie, draft and published share a URL — a CDN
-    // keyed on URL alone would serve unpublished content to a real visitor.
-    const decision = prepareDraft(request("https://site.example/p", "abc.localhost@v1"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    expect(res.headers.get("cache-control")).toBe("no-store, private");
-    expect(res.headers.get("vary")).toBe("Cookie");
-    expect(res.headers.get("x-robots-tag")).toBe("noindex, nofollow");
-  });
-
-  it("leaves an ordinary response completely untouched", () => {
-    const decision = prepareDraft(request("https://site.example/p"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    expect(res.headers.get("cache-control")).toBeNull();
-    expect(res.headers.get("vary")).toBeNull();
-    expect(res.headers.get("x-robots-tag")).toBeNull();
-    expect(res.headers.get("set-cookie")).toBeNull();
-  });
-
-  it("clears the cookie on ?__draft=off", () => {
-    const decision = prepareDraft(
-      request("https://site.example/p?__draft=off", "abc.localhost@v1"),
-    );
-    expect(decision.clearCookie).toBe(true);
-
-    const res = applyDraft(NextResponse.next(), decision);
-    const setCookie = res.headers.get("set-cookie") ?? "";
-    // Deletion is a set with an immediate expiry.
-    expect(setCookie).toContain(DRAFT_COOKIE);
-    expect(setCookie).toMatch(/Max-Age=0|Expires=Thu, 01 Jan 1970/i);
-    // And the response is not treated as a draft render.
-    expect(res.headers.get("cache-control")).toBeNull();
-  });
-});
-
-describe("rewriteToDraftRoute", () => {
-  it("rewrites a drafted request onto the dynamic draft route", () => {
-    const req = request("https://site.example/blog/hello?__draft=abc.localhost@v1");
-    const res = rewriteToDraftRoute(req, prepareDraft(req));
-    const target = new URL(res?.headers.get("x-middleware-rewrite") ?? "");
-    expect(target.pathname).toBe("/_draft/blog/hello");
-    // The pointer must survive: the draft page reads it from searchParams.
-    expect(target.searchParams.get("__draft")).toBe("abc.localhost@v1");
-  });
-
-  it("rewrites a cookie-only navigation too", () => {
-    const req = request("https://site.example/blog/hello", "abc.localhost@v1");
-    const res = rewriteToDraftRoute(req, prepareDraft(req));
-    expect(new URL(res?.headers.get("x-middleware-rewrite") ?? "").pathname).toBe(
-      "/_draft/blog/hello",
-    );
-  });
-
-  it("leaves an ordinary request alone — ISR must not be disturbed", () => {
-    // The whole point: only drafted requests go dynamic. A shopper's request
-    // must reach the real, statically rendered route untouched.
-    const req = request("https://site.example/blog/hello");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("never nests the prefix when middleware re-runs on the rewritten URL", () => {
-    const req = request("https://site.example/_draft/blog/hello?__draft=abc.localhost@v1");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("does not rewrite when leaving draft mode", () => {
-    const req = request("https://site.example/blog/hello?__draft=off", "abc.localhost@v1");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-});