@decocms/nextjs 8.1.0-next.0 → 8.5.0

package/dist/studio.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Where Deco Studio runs: the origins its site editor frames a site from and
+ * talks to it from (`postMessage`). One list, so the Studio bridge
+ * (`StudioBridge`), `withDeco()`'s dev origins and a site's own
+ * `frame-ancestors` never drift apart. This package's own copy: it never
+ * imports `@decocms/tanstack`.
+ *
+ * No module state and no framework code: safe in a browser bundle.
+ */
+/**
+ * Studio's origins, in the CSP source form (`https://*.decocms.com` matches
+ * any subdomain). Test an origin with {@link isStudioOrigin}: the list holds a
+ * wildcard, so `includes()` isn't the check.
+ */
+export declare const STUDIO_ORIGINS: readonly string[];
+/**
+ * The `frame-ancestors` sources a site sends so Studio can show it in the
+ * site editor: the site itself, {@link STUDIO_ORIGINS}, and v7's
+ * `https://*.deco.studio`. For a site that writes its own CSP; add the
+ * loopback origins in local development (`http://localhost:*`), where a
+ * Studio runs on the same machine.
+ */
+export declare const STUDIO_FRAME_ANCESTORS: readonly string[];
+/**
+ * Whether `origin` (a `MessageEvent.origin`, an `Origin` header) is one of
+ * {@link STUDIO_ORIGINS}: `https`, the default port, and `decocms.com` or a
+ * name under it.
+ */
+export declare function isStudioOrigin(origin: string | null | undefined): boolean;
+//# sourceMappingURL=studio.d.ts.map

package/dist/studio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.d.ts","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAK1C,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAazE"}

package/dist/studio.js

@@ -0,0 +1,55 @@
+/**
+ * Where Deco Studio runs: the origins its site editor frames a site from and
+ * talks to it from (`postMessage`). One list, so the Studio bridge
+ * (`StudioBridge`), `withDeco()`'s dev origins and a site's own
+ * `frame-ancestors` never drift apart. This package's own copy: it never
+ * imports `@decocms/tanstack`.
+ *
+ * No module state and no framework code: safe in a browser bundle.
+ */
+/**
+ * Studio's origins, in the CSP source form (`https://*.decocms.com` matches
+ * any subdomain). Test an origin with {@link isStudioOrigin}: the list holds a
+ * wildcard, so `includes()` isn't the check.
+ */
+export const STUDIO_ORIGINS = Object.freeze([
+    "https://studio.decocms.com",
+    "https://studio-stg.decocms.com",
+    "https://decocms.com",
+    "https://*.decocms.com",
+]);
+/**
+ * The `frame-ancestors` sources a site sends so Studio can show it in the
+ * site editor: the site itself, {@link STUDIO_ORIGINS}, and v7's
+ * `https://*.deco.studio`. For a site that writes its own CSP; add the
+ * loopback origins in local development (`http://localhost:*`), where a
+ * Studio runs on the same machine.
+ */
+export const STUDIO_FRAME_ANCESTORS = Object.freeze([
+    "'self'",
+    ...STUDIO_ORIGINS,
+    "https://*.deco.studio",
+]);
+/**
+ * Whether `origin` (a `MessageEvent.origin`, an `Origin` header) is one of
+ * {@link STUDIO_ORIGINS}: `https`, the default port, and `decocms.com` or a
+ * name under it.
+ */
+export function isStudioOrigin(origin) {
+    if (typeof origin !== "string" || origin === "")
+        return false;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    // An origin is the scheme and host alone: `https://decocms.com/x` or one with
+    // credentials isn't one.
+    if (url.origin !== origin || url.protocol !== "https:" || url.port !== "")
+        return false;
+    const host = url.hostname;
+    return host === "decocms.com" || host.endsWith(".decocms.com");
+}
+//# sourceMappingURL=studio.js.map

package/dist/studio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"studio.js","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,4BAA4B;IAC5B,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,QAAQ;IACR,GAAG,cAAc;IACjB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiC;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,yBAAyB;IACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,48 +1,79 @@
 {
   "name": "@decocms/nextjs",
-  "version": "8.1.0-next.0",
+  "version": "8.5.0",
   "type": "module",
   "engines": {
     "node": ">=24"
   },
-  "description": "Deco framework binding for Next.js App Router",
+  "description": "Deco CMS for any Next.js App Router app: draft previews in the proxy and the pages, the preview badge, the Studio bridge, withDeco() and a next/image loader",
   "repository": {
     "type": "git",
     "url": "https://github.com/decocms/blocks.git",
     "directory": "packages/nextjs"
   },
-  "main": "./src/index.ts",
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/**/__tests__"
+  ],
   "exports": {
-    ".": "./src/index.ts",
-    "./routeHandlers": "./src/routeHandlers.ts",
-    "./setup": "./src/setup.ts",
+    ".": {
+      "types": "./dist/index.d.ts",
+      "source": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./proxy": {
+      "types": "./dist/proxy/index.d.ts",
+      "source": "./src/proxy/index.ts",
+      "default": "./dist/proxy/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "source": "./src/server/index.ts",
+      "default": "./dist/server/index.js"
+    },
     "./config": {
-      "types": "./src/config.d.cts",
-      "default": "./src/config.cjs"
+      "types": "./src/config/index.d.cts",
+      "default": "./src/config/index.cjs"
     },
-    "./middleware": "./src/draftMiddleware.ts"
+    "./instrumentation": {
+      "types": "./dist/instrumentation/index.d.ts",
+      "source": "./src/instrumentation/index.ts",
+      "default": "./dist/instrumentation/index.js"
+    },
+    "./image-loader": {
+      "types": "./dist/image-loader/index.d.ts",
+      "source": "./src/image-loader/index.ts",
+      "default": "./dist/image-loader/index.js"
+    }
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node ../../scripts/tsc.mjs --clean dist -p tsconfig.build.json",
+    "prepack": "npm run build",
     "test": "vitest run --root ../.. packages/nextjs/",
-    "typecheck": "tsc --noEmit",
-    "lint:unused": "knip"
-  },
-  "dependencies": {
-    "@decocms/blocks": "8.1.0-next.0",
-    "@decocms/blocks-admin": "8.1.0-next.0"
+    "typecheck": "node ../../scripts/tsc.mjs -p tsconfig.json"
   },
   "peerDependencies": {
-    "next": ">=15.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
+    "@decocms/blocks": "^8.4.0",
+    "@opentelemetry/api": "^1.0.0",
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@opentelemetry/api": {
+      "optional": true
+    }
   },
   "devDependencies": {
+    "@decocms/blocks": "8.5.0",
+    "@opentelemetry/api": "^1.9.1",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "knip": "^5.86.0",
-    "next": "^15.4.0",
-    "typescript": "^5.9.0"
+    "next": "16.3.8",
+    "react": "19.2.7",
+    "react-dom": "19.2.7"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/DraftPreviewIndicator.tsx

@@ -1,22 +1,23 @@
 /**
- * Server-side gate for the preview-mode badge.
+ * The "Preview mode" badge for the request's draft: a Server Component that
+ * renders `DraftBadge` (`@decocms/blocks/preview`) only when `bindDraft`
+ * bound a draft, so a published page emits nothing.
  *
- * A Server Component (no `"use client"`) so it can read the request-scoped
- * draft pointer via `getActiveDraftPointer()` and mount the client badge ONLY
- * when a draft is actually bound — an unconfigured/published request renders
- * nothing at all.
- *
- * Placement rule (inherited from `ensureDraft`): render this INSIDE the page
- * subtree, after `ensureDraft` has been awaited — never from a layout, whose
- * children render concurrently with the page that fills the slot. Sites using
- * `createDecoPage` get it wired automatically; hand-rolled routes drop
- * `<DraftPreviewIndicator />` at the end of their page.
+ * Render it inside the page, after `bindDraft` was awaited, never from a
+ * layout: a layout renders alongside the page that fills it, so it may run
+ * before the page bound its draft.
  */
-import { DraftPreviewBadge } from "./DraftPreviewBadge";
-import { getActiveDraftPointer } from "./draft";
+import { DraftBadge } from "@decocms/blocks/preview";
+import type { ReactNode } from "react";
+import { activeDraftPointer } from "./server/slot.ts";
+
+export interface DraftPreviewIndicatorProps {
+  /** Where "Exit preview" goes; default: the current URL with `?__draft=off`. */
+  exitHref?: string;
+}
 
-export function DraftPreviewIndicator() {
-  const pointer = getActiveDraftPointer();
+export function DraftPreviewIndicator({ exitHref }: DraftPreviewIndicatorProps = {}): ReactNode {
+  const pointer = activeDraftPointer();
   if (!pointer) return null;
-  return <DraftPreviewBadge pointer={pointer} />;
+  return <DraftBadge pointer={pointer} exitHref={exitHref} />;
 }

package/src/StudioBridge.ts

@@ -0,0 +1,23 @@
+/**
+ * `StudioBridge` of `@decocms/blocks/preview` with Studio's origins filled in
+ * (`STUDIO_ORIGINS`, `./studio.ts`): the package owns where Studio runs, so a
+ * site passes only its name. One inline script and no hooks, so a Server
+ * Component renders it as is.
+ */
+import {
+  StudioBridge as BridgeScript,
+  type StudioBridgeProps as BridgeScriptProps,
+} from "@decocms/blocks/preview";
+import { createElement, type ReactNode } from "react";
+import { STUDIO_ORIGINS } from "./studio.ts";
+
+/** `site`, and optionally `editShortcut` and `nonce`; Studio's origins are the package's. */
+export type StudioBridgeProps = Omit<BridgeScriptProps, "trustedOrigins">;
+
+/**
+ * Lets Studio's site editor select and edit sections on the page when Studio
+ * frames it. Render it once, in the root layout's `<body>`.
+ */
+export function StudioBridge(props: StudioBridgeProps): ReactNode {
+  return createElement(BridgeScript, { ...props, trustedOrigins: STUDIO_ORIGINS });
+}

package/src/config/index.cjs

@@ -0,0 +1,78 @@
+/**
+ * `@decocms/nextjs/config`: `withDeco(nextConfig)` for `next.config`.
+ * Plain CommonJS JavaScript, shipped as is, so a CommonJS `next.config.js`
+ * can `require()` it; an ESM `next.config.mjs`/`.ts` imports it the same way.
+ *
+ * It adds two things and nothing about hosting (no rewrites, no image hosts,
+ * no CDN rules):
+ *
+ * 1. `draftHeaders` (default on): v7's two header rules, first, so a draft
+ *    is never stored or indexed. A rule's `has` entries are ANDed and the two
+ *    signals never meet: a draft link carries the query (the proxy sets the
+ *    cookie on that response), every navigation after it the cookie.
+ *    On a dynamic App Router response Next sets `Cache-Control` and `Vary`
+ *    itself, so only `X-Robots-Tag` is sure to arrive from here; the proxy's
+ *    `applyDraft` sets all three on the responses it makes.
+ * 2. `studioOrigins` (default on): Studio's origins in `allowedDevOrigins`,
+ *    so `next dev` serves Studio's local mode its dev assets.
+ *
+ * The names repeat the package's (`DRAFT_PARAM`, `DRAFT_COOKIE`,
+ * `draftResponseHeaders` in `src/draft.ts`, `STUDIO_ORIGINS` in
+ * `src/studio.ts`): a CommonJS file can't load an ES module everywhere
+ * `next.config` runs. `config.test.ts` holds them equal.
+ */
+"use strict";
+
+/** `draftResponseHeaders(pointer)` (`src/draft.ts`), as `next.config` header entries. */
+const DRAFT_NO_STORE_HEADERS = [
+  { key: "Cache-Control", value: "no-store, private" },
+  { key: "Vary", value: "Cookie" },
+  { key: "X-Robots-Tag", value: "noindex, nofollow" },
+];
+
+/** v7's draft rules: the `?__draft=` query, or the `__deco_draft` cookie. */
+const DECO_DRAFT_HEADERS = [
+  {
+    source: "/:path*",
+    has: [{ type: "query", key: "__draft" }],
+    headers: DRAFT_NO_STORE_HEADERS,
+  },
+  {
+    source: "/:path*",
+    has: [{ type: "cookie", key: "__deco_draft" }],
+    headers: DRAFT_NO_STORE_HEADERS,
+  },
+];
+
+/**
+ * `STUDIO_ORIGINS` as `allowedDevOrigins` hosts: `https://*.decocms.com`
+ * matches any name under `decocms.com` (`isStudioOrigin`), which Next writes
+ * as `**.decocms.com`.
+ */
+const STUDIO_DEV_ORIGINS = [
+  "studio.decocms.com",
+  "studio-stg.decocms.com",
+  "decocms.com",
+  "**.decocms.com",
+];
+
+function withDeco(nextConfig = {}, options = {}) {
+  const { draftHeaders = true, studioOrigins = true } = options;
+  const config = { ...nextConfig };
+  if (studioOrigins) {
+    config.allowedDevOrigins = [
+      ...new Set([...(nextConfig.allowedDevOrigins ?? []), ...STUDIO_DEV_ORIGINS]),
+    ];
+  }
+  if (draftHeaders) {
+    const siteHeaders = nextConfig.headers;
+    config.headers = async () => [
+      // First: a site-wide Cache-Control rule must not win over a draft's.
+      ...DECO_DRAFT_HEADERS,
+      ...(siteHeaders ? await siteHeaders() : []),
+    ];
+  }
+  return config;
+}
+
+module.exports = { withDeco, DECO_DRAFT_HEADERS, STUDIO_DEV_ORIGINS };

package/src/config/index.d.cts

@@ -0,0 +1,27 @@
+import type { NextConfig } from "next";
+
+/** A `next.config` header rule. */
+export interface HeaderRule {
+  source: string;
+  has?: { type: string; key: string; value?: string }[];
+  headers: { key: string; value: string }[];
+}
+
+export interface WithDecoOptions {
+  /** v7's draft header rules (no-store, `Vary: Cookie`, noindex), before the site's own. Default `true`. */
+  draftHeaders?: boolean;
+  /** Studio's origins in `allowedDevOrigins`. Default `true`. */
+  studioOrigins?: boolean;
+}
+
+/** The site's `next.config` with Deco's draft header rules and Studio's dev origins. */
+export declare function withDeco<C extends NextConfig>(
+  nextConfig?: C,
+  options?: WithDecoOptions,
+): C & NextConfig;
+
+/** The header rules `withDeco` puts first: a `?__draft=` query, or the `__deco_draft` cookie. */
+export declare const DECO_DRAFT_HEADERS: HeaderRule[];
+
+/** `STUDIO_ORIGINS` (`@decocms/nextjs`) in `allowedDevOrigins` form. */
+export declare const STUDIO_DEV_ORIGINS: string[];

package/src/draft.ts

@@ -1,231 +1,48 @@
 /**
- * Draft preview — the Next.js binding.
- *
- * `@decocms/blocks`'s `draftSource` owns the framework-agnostic half (pointer
- * parsing, origin construction, fetch, version cache). This file binds a
- * resolved draft to the current request.
- *
- * ## Why React `cache()` and not AsyncLocalStorage
- *
- * App Router never enters `RequestContext.run` (that is a TanStack/Workers
- * path), and ALS cannot help here anyway: you cannot wrap `ALS.run()` around a
- * component's children, because the children render later, outside the call.
- * `cache()` gives a per-request memoized value in RSC, which is exactly the
- * scope needed — verified concurrently, see `draft.test.ts`.
- *
- * ## Why this must be awaited by the PAGE, not a layout
- *
- * A layout's `await` does NOT gate its children: App Router renders a layout
- * and its children concurrently, so sections call `loadBlocks()` before a
- * layout-level resolve lands, and silently render published content. The
- * resolve has to happen somewhere that returns the subtree *after* awaiting —
- * i.e. the page component. `ensureDraft()` exists so each site makes one call
- * instead of re-deriving that ordering rule.
+ * The draft names and headers of a Deco Next.js site: the `?__draft=` link,
+ * the cookie that keeps a preview going, the request header the proxy hands
+ * the pages, and the response headers of a page rendered from a draft. The
+ * proxy reads and writes them (`./drafts.ts`, `./proxy`); the pages read the
+ * header (`./server`); `./config/index.cjs` repeats them (`config.test.ts`
+ * holds them equal). This package's own copy: it never imports
+ * `@decocms/tanstack`. No imports, no state: safe in every bundle.
  */
-import {
-  isDraftHostAllowed,
-  resolveDraftDecofile,
-  setDraftOverrideGetter,
-} from "@decocms/blocks/cms";
-import { cookies, headers } from "next/headers";
-import { cache } from "react";
-import { DRAFT_COOKIE, DRAFT_HEADER, DRAFT_PARAM } from "./draftConstants";
-
-// Re-exported for back-compat: these used to live here, but the client badge
-// needs DRAFT_PARAM and cannot import this module (it pulls in `next/headers`).
-export { DRAFT_COOKIE, DRAFT_HEADER, DRAFT_PARAM } from "./draftConstants";
 
 /**
- * Request-scoped slot.
- *
- * `cache()` memoizes per-request, so every call within one request gets the
- * same object and a different one per request. Mutable by design: the page
- * fills it before returning its subtree, and nested sections read it
- * synchronously through `loadBlocks()`.
- *
- * `pointer` is the raw `<host>@<version>` token this render is bound to, kept
- * so the UI can surface an explicit "you are in preview" indicator and build a
- * shareable link — see {@link getActiveDraftPointer}.
+ * The query parameter a draft link carries (`?__draft=<pointer>`, or `off` to
+ * end a preview). The proxy reads it after its host check; reading it
+ * directly would skip that check.
  */
-const draftSlot = cache((): {
-  blocks: Record<string, unknown> | null;
-  pointer: string | null;
-} => ({
-  blocks: null,
-  pointer: null,
-}));
+export const DRAFT_PARAM = "__draft";
 
 /**
- * Register the request-scoped getter with the runtime.
- *
- * Idempotent and safe to call at module scope: outside a request `cache()`
- * still returns an object, whose `blocks` is null, so `loadBlocks()` sees no
- * override and behaves exactly as before.
+ * The cookie that keeps a preview going after the first draft link. Like
+ * {@link DRAFT_PARAM}, the proxy reads it after its host check.
  */
-let registered = false;
-export function registerDraftOverride(): void {
-  if (registered) return;
-  registered = true;
-  setDraftOverrideGetter(() => draftSlot().blocks);
-}
-
-/** A page's `searchParams` prop, before it is narrowed. */
-export type DraftSearchParams = Record<string, string | string[] | undefined>;
-
-/** First value of a search param that may legitimately repeat. */
-function firstParam(searchParams: DraftSearchParams | undefined, key: string): string | null {
-  const raw = searchParams?.[key];
-  if (Array.isArray(raw)) return raw[0] ?? null;
-  return raw ?? null;
-}
+export const DRAFT_COOKIE = "__deco_draft";
 
 /**
- * The pointer for this request: the query param wins, the cookie carries
- * navigation, `off` exits.
- *
- * Read directly from the page rather than trusted from a request header. The
- * param has to take precedence or a save would never surface — Studio
- * navigating to a new version would keep rendering whatever older pointer is
- * still sitting in the cookie.
+ * The request header the proxy sets on the request it hands the pages once it
+ * accepted the draft: the pointer, already checked. The proxy removes any
+ * copy that arrives from outside, and `bindDraft` repeats the host check, so a
+ * client can't send one itself.
  */
-export function selectDraftPointer(
-  searchParams: DraftSearchParams | undefined,
-  cookieValue: string | null | undefined,
-): string | null {
-  const param = firstParam(searchParams, DRAFT_PARAM);
-  if (param === "off") return null;
-  if (param) return param;
-  return cookieValue ?? null;
-}
+export const DRAFT_HEADER = "x-deco-draft";
 
-/**
- * Resolve the request's draft, if any, and bind it for the rest of the render.
- *
- * Call this from the PAGE, awaited, before returning the subtree:
- *
- * ```tsx
- * export default async function Page({ searchParams }) {
- *   await ensureDraft(await searchParams);
- *   return <DecoPageRenderer />;
- * }
- * ```
- *
- * Reads the param from the page's own `searchParams` and the cookie via
- * `cookies()`. There is deliberately no request header in the path: the page
- * owns the decision, so a draft keeps working on routes the middleware matcher
- * never sees, and there is one less forgeable input to reason about. (The
- * pointer was never a secret — the draft id (the token's authority) is the capability — so a
- * client supplying one directly is equivalent to typing the query param.)
- *
- * Returns whether a draft was bound, so callers can surface an explicit
- * "draft unavailable" state instead of silently showing published content —
- * the failure mode most likely to mislead someone reviewing their own edits.
- */
-export async function ensureDraft(searchParams?: DraftSearchParams): Promise<boolean> {
-  registerDraftOverride();
-
-  const [cookieStore, requestHeaders] = await Promise.all([cookies(), headers()]);
-
-  // Pointer precedence: the page's own `?__draft=` param wins; then the
-  // middleware-forwarded header (the only source a LAYOUT can see on the entry
-  // request — see DRAFT_HEADER); then the navigation cookie. This is what lets
-  // `ensureDraft()` bind from a layout so shell-resolved Header/Footer reflect
-  // the draft, not just page sections.
-  const carried = requestHeaders.get(DRAFT_HEADER) ?? cookieStore.get(DRAFT_COOKIE)?.value ?? null;
-  const pointer = selectDraftPointer(searchParams, carried);
-  if (!pointer) return false;
-
-  // Host gate, checked only once a pointer exists (headers() is a dynamic
-  // API): the same build may serve the preview domain and the production
-  // domain, and only hosts named in DECO_ALLOWED_PREVIEW_HOSTS may render
-  // drafts — production stays published no matter what the URL carries.
-  const host = requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
-  if (!isDraftHostAllowed(host)) return false;
-
-  const blocks = await resolveDraftDecofile({ pointer });
-  if (!blocks) return false;
-
-  const slot = draftSlot();
-  slot.blocks = blocks;
-  slot.pointer = pointer;
-  return true;
-}
-
-/**
- * The raw draft pointer bound to this request, or null if the request is not
- * rendering a draft.
- *
- * Synchronous — reads the same request-scoped slot `ensureDraft` fills, so it
- * must be called AFTER `ensureDraft` has been awaited in this request (i.e.
- * from inside the page subtree, not a concurrently-rendered layout). Powers
- * the preview-mode indicator: a bound pointer is the signal that the visitor
- * is looking at unpublished content, and it is exactly what a "share this
- * draft" link must carry.
- */
-export function getActiveDraftPointer(): string | null {
-  return draftSlot().pointer;
-}
-
-// ---------------------------------------------------------------------------
-// Middleware helper
-// ---------------------------------------------------------------------------
-
-/** What middleware should do with this request. */
-export interface DraftMiddlewareDecision {
-  /** The active pointer, or null. Drives the cache/indexing headers. */
-  pointer: string | null;
-  /** Set the cookie to this value (entering draft mode). */
-  setCookie: string | null;
-  /** Clear the cookie (leaving draft mode via `?__draft=off`). */
-  clearCookie: boolean;
-}
+/** The URL prefix a drafted request is rewritten onto (`app/%5Fdraft/[[...path]]`). */
+export const DRAFT_ROUTE_PREFIX = "/_draft";
 
 /**
- * Decide the draft state for a request, from `?__draft=` and the cookie.
- *
- * The param is authoritative on entry and the cookie carries subsequent
- * in-preview navigation — a param alone dies on the first link click, and a
- * cookie alone cannot be relied on: the preview iframe is cross-site, so the
- * cookie is third-party and may be blocked outright (Safari ITP) or
- * partitioned (Chrome CHIPS). Entry therefore never depends on cookie support.
- *
- * `?__draft=off` leaves draft mode, so a session can be ended deliberately
- * rather than waiting for a cookie to expire.
- *
- * Pure and framework-free so it can be unit-tested without a Next request; the
- * caller applies the decision to its own `NextResponse`.
+ * The response headers of a page rendered from a draft: never stored by a
+ * browser or a CDN (`Cache-Control: no-store, private`, `Vary: Cookie`) and
+ * never indexed (`X-Robots-Tag: noindex, nofollow`). `{}` when `pointer` is
+ * `null`, so the result of the draft decision applies as is.
  */
-export function decideDraft(
-  url: URL,
-  cookieValue: string | null | undefined,
-): DraftMiddlewareDecision {
-  const param = url.searchParams.get(DRAFT_PARAM);
-
-  if (param === "off") {
-    return { pointer: null, setCookie: null, clearCookie: true };
-  }
-  if (param) {
-    return { pointer: param, setCookie: param, clearCookie: false };
-  }
-  if (cookieValue) {
-    return { pointer: cookieValue, setCookie: null, clearCookie: false };
-  }
-  return { pointer: null, setCookie: null, clearCookie: false };
+export function draftResponseHeaders(pointer: string | null | undefined): Record<string, string> {
+  if (!pointer) return {};
+  return {
+    "Cache-Control": "no-store, private",
+    Vary: "Cookie",
+    "X-Robots-Tag": "noindex, nofollow",
+  };
 }
-
-/**
- * Cookie attributes for the draft pointer.
- *
- * `SameSite=None; Secure` is mandatory for a cross-site iframe, and
- * `Partitioned` (CHIPS) is what keeps it working as browsers wind down
- * unpartitioned third-party cookies. Short-lived: a draft session is minutes,
- * and a stale pointer would keep pinning an old version.
- */
-export const DRAFT_COOKIE_OPTIONS = {
-  httpOnly: true,
-  secure: true,
-  sameSite: "none",
-  partitioned: true,
-  path: "/",
-  maxAge: 60 * 30,
-} as const;