@prismicio/next 2.3.1-pr.147.2aebcfe → 2.3.1-pr.147.bf74d52

package/dist/exitPreview.cjs

@@ -16,10 +16,8 @@ const require_expiredPreviewCookies = require("./lib/expiredPreviewCookies.cjs")
 * 	```
 */
 async function exitPreview() {
-	const { draftMode } = await import("next/headers.js");
-	(await draftMode()).disable();
 	const headers = new Headers({ "Cache-Control": "no-store" });
-	for (const setCookie of require_expiredPreviewCookies.expiredPreviewCookieHeaders()) headers.append("Set-Cookie", setCookie);
+	for (const setCookie of [...require_expiredPreviewCookies.expiredPreviewCookieHeaders(), ...require_expiredPreviewCookies.expiredDraftModeCookieHeaders()]) headers.append("Set-Cookie", setCookie);
 	return new Response(JSON.stringify({ success: true }), { headers });
 }
 //#endregion

package/dist/exitPreview.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.cjs","names":["expiredPreviewCookieHeaders"],"sources":["../src/exitPreview.ts"],"sourcesContent":["import { expiredPreviewCookieHeaders } from \"./lib/expiredPreviewCookies\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { draftMode } = await import(\"next/headers\")\n\n\t;(await draftMode()).disable()\n\n\t// `redirectToPreviewURL` writes SameSite=None; Secure. The toolbar may\n\t// leave SameSite=Lax (not Secure). Those are different cookies to Chrome.\n\t// Expire both on the Response. Do not use `cookies().set` / `delete()`:\n\t// ResponseCookies is name-keyed, so a second `io.prismic.preview` overwrites\n\t// the first and the Lax leftover survives.\n\tconst headers = new Headers({\n\t\t\"Cache-Control\": \"no-store\",\n\t})\n\tfor (const setCookie of expiredPreviewCookieHeaders()) {\n\t\theaders.append(\"Set-Cookie\", setCookie)\n\t}\n\n\treturn new Response(JSON.stringify({ success: true }), { headers })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,eAAsB,cAAiC;CAItD,MAAM,EAAE,cAAc,MAAM,OAAO;AAElC,EAAC,MAAM,WAAW,EAAE,SAAS;CAO9B,MAAM,UAAU,IAAI,QAAQ,EAC3B,iBAAiB,YACjB,CAAC;AACF,MAAK,MAAM,aAAaA,8BAAAA,6BAA6B,CACpD,SAAQ,OAAO,cAAc,UAAU;AAGxC,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC"}
+{"version":3,"file":"exitPreview.cjs","names":["expiredPreviewCookieHeaders","expiredDraftModeCookieHeaders"],"sources":["../src/exitPreview.ts"],"sourcesContent":["import {\n\texpiredDraftModeCookieHeaders,\n\texpiredPreviewCookieHeaders,\n} from \"./lib/expiredPreviewCookies\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Do not call `cookies()` or `draftMode().disable()`. ResponseCookies is\n\t// name-keyed: `appendMutableCookies` rebuilds Set-Cookie by name and drops\n\t// the extra Lax expire. Emit every expire on the Response instead:\n\t// toolbar Lax + iframe None; Secure for `io.prismic.preview`, and both\n\t// shapes of `__prerender_bypass` that `disable()` would have cleared.\n\tconst headers = new Headers({\n\t\t\"Cache-Control\": \"no-store\",\n\t})\n\tfor (const setCookie of [...expiredPreviewCookieHeaders(), ...expiredDraftModeCookieHeaders()]) {\n\t\theaders.append(\"Set-Cookie\", setCookie)\n\t}\n\n\treturn new Response(JSON.stringify({ success: true }), { headers })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,eAAsB,cAAiC;CAMtD,MAAM,UAAU,IAAI,QAAQ,EAC3B,iBAAiB,YACjB,CAAC;AACF,MAAK,MAAM,aAAa,CAAC,GAAGA,8BAAAA,6BAA6B,EAAE,GAAGC,8BAAAA,+BAA+B,CAAC,CAC7F,SAAQ,OAAO,cAAc,UAAU;AAGxC,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC"}

package/dist/exitPreview.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.d.cts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAiBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"exitPreview.d.cts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAoBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}

package/dist/exitPreview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.d.ts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAiBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"exitPreview.d.ts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAoBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}

package/dist/exitPreview.js

@@ -1,4 +1,4 @@
-import { expiredPreviewCookieHeaders } from "./lib/expiredPreviewCookies.js";
+import { expiredDraftModeCookieHeaders, expiredPreviewCookieHeaders } from "./lib/expiredPreviewCookies.js";
 //#region src/exitPreview.ts
 /**
 * Ends a Prismic preview session within a Next.js app. This function should be used in a Router
@@ -16,10 +16,8 @@ import { expiredPreviewCookieHeaders } from "./lib/expiredPreviewCookies.js";
 * 	```
 */
 async function exitPreview() {
-	const { draftMode } = await import("next/headers.js");
-	(await draftMode()).disable();
 	const headers = new Headers({ "Cache-Control": "no-store" });
-	for (const setCookie of expiredPreviewCookieHeaders()) headers.append("Set-Cookie", setCookie);
+	for (const setCookie of [...expiredPreviewCookieHeaders(), ...expiredDraftModeCookieHeaders()]) headers.append("Set-Cookie", setCookie);
 	return new Response(JSON.stringify({ success: true }), { headers });
 }
 //#endregion

package/dist/exitPreview.js.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.js","names":[],"sources":["../src/exitPreview.ts"],"sourcesContent":["import { expiredPreviewCookieHeaders } from \"./lib/expiredPreviewCookies\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { draftMode } = await import(\"next/headers\")\n\n\t;(await draftMode()).disable()\n\n\t// `redirectToPreviewURL` writes SameSite=None; Secure. The toolbar may\n\t// leave SameSite=Lax (not Secure). Those are different cookies to Chrome.\n\t// Expire both on the Response. Do not use `cookies().set` / `delete()`:\n\t// ResponseCookies is name-keyed, so a second `io.prismic.preview` overwrites\n\t// the first and the Lax leftover survives.\n\tconst headers = new Headers({\n\t\t\"Cache-Control\": \"no-store\",\n\t})\n\tfor (const setCookie of expiredPreviewCookieHeaders()) {\n\t\theaders.append(\"Set-Cookie\", setCookie)\n\t}\n\n\treturn new Response(JSON.stringify({ success: true }), { headers })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,eAAsB,cAAiC;CAItD,MAAM,EAAE,cAAc,MAAM,OAAO;AAElC,EAAC,MAAM,WAAW,EAAE,SAAS;CAO9B,MAAM,UAAU,IAAI,QAAQ,EAC3B,iBAAiB,YACjB,CAAC;AACF,MAAK,MAAM,aAAa,6BAA6B,CACpD,SAAQ,OAAO,cAAc,UAAU;AAGxC,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC"}
+{"version":3,"file":"exitPreview.js","names":[],"sources":["../src/exitPreview.ts"],"sourcesContent":["import {\n\texpiredDraftModeCookieHeaders,\n\texpiredPreviewCookieHeaders,\n} from \"./lib/expiredPreviewCookies\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Do not call `cookies()` or `draftMode().disable()`. ResponseCookies is\n\t// name-keyed: `appendMutableCookies` rebuilds Set-Cookie by name and drops\n\t// the extra Lax expire. Emit every expire on the Response instead:\n\t// toolbar Lax + iframe None; Secure for `io.prismic.preview`, and both\n\t// shapes of `__prerender_bypass` that `disable()` would have cleared.\n\tconst headers = new Headers({\n\t\t\"Cache-Control\": \"no-store\",\n\t})\n\tfor (const setCookie of [...expiredPreviewCookieHeaders(), ...expiredDraftModeCookieHeaders()]) {\n\t\theaders.append(\"Set-Cookie\", setCookie)\n\t}\n\n\treturn new Response(JSON.stringify({ success: true }), { headers })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,eAAsB,cAAiC;CAMtD,MAAM,UAAU,IAAI,QAAQ,EAC3B,iBAAiB,YACjB,CAAC;AACF,MAAK,MAAM,aAAa,CAAC,GAAG,6BAA6B,EAAE,GAAG,+BAA+B,CAAC,CAC7F,SAAQ,OAAO,cAAc,UAAU;AAGxC,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC"}

package/dist/lib/expiredPreviewCookies.cjs

@@ -2,12 +2,26 @@ require("../_virtual/_rolldown/runtime.cjs");
 let _prismicio_client = require("@prismicio/client");
 //#region src/lib/expiredPreviewCookies.ts
 const epoch = /* @__PURE__ */ new Date(0);
+function expiresAttr() {
+	return `Expires=${epoch.toUTCString()}`;
+}
 /** Expired `Set-Cookie` values for both leftover `io.prismic.preview` shapes. */
 function expiredPreviewCookieHeaders(name = _prismicio_client.cookie.preview) {
-	const expires = `Expires=${epoch.toUTCString()}`;
+	const expires = expiresAttr();
 	return [`${name}=; Path=/; ${expires}; SameSite=Lax`, `${name}=; Path=/; ${expires}; SameSite=None; Secure`];
 }
+/**
+* Expired `Set-Cookie` values for the App Router draft-mode cookie that `draftMode().disable()`
+* would clear. Next sets `__prerender_bypass` as Lax (not Secure) in development and SameSite=None;
+* Secure in production.
+*/
+function expiredDraftModeCookieHeaders() {
+	const expires = expiresAttr();
+	const name = "__prerender_bypass";
+	return [`${name}=; Path=/; ${expires}; SameSite=Lax; HttpOnly`, `${name}=; Path=/; ${expires}; SameSite=None; Secure; HttpOnly`];
+}
 //#endregion
+exports.expiredDraftModeCookieHeaders = expiredDraftModeCookieHeaders;
 exports.expiredPreviewCookieHeaders = expiredPreviewCookieHeaders;
 
 //# sourceMappingURL=expiredPreviewCookies.cjs.map

package/dist/lib/expiredPreviewCookies.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"expiredPreviewCookies.cjs","names":["prismicCookie"],"sources":["../../src/lib/expiredPreviewCookies.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\nconst epoch = new Date(0)\n\n/** Expired `Set-Cookie` values for both leftover `io.prismic.preview` shapes. */\nexport function expiredPreviewCookieHeaders(name = prismicCookie.preview): string[] {\n\tconst expires = `Expires=${epoch.toUTCString()}`\n\n\treturn [\n\t\t`${name}=; Path=/; ${expires}; SameSite=Lax`,\n\t\t`${name}=; Path=/; ${expires}; SameSite=None; Secure`,\n\t]\n}\n"],"mappings":";;;AAEA,MAAM,wBAAQ,IAAI,KAAK,EAAE;;AAGzB,SAAgB,4BAA4B,OAAOA,kBAAAA,OAAc,SAAmB;CACnF,MAAM,UAAU,WAAW,MAAM,aAAa;AAE9C,QAAO,CACN,GAAG,KAAK,aAAa,QAAQ,iBAC7B,GAAG,KAAK,aAAa,QAAQ,yBAC7B"}
+{"version":3,"file":"expiredPreviewCookies.cjs","names":["prismicCookie"],"sources":["../../src/lib/expiredPreviewCookies.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\nconst epoch = new Date(0)\n\nfunction expiresAttr(): string {\n\treturn `Expires=${epoch.toUTCString()}`\n}\n\n/** Expired `Set-Cookie` values for both leftover `io.prismic.preview` shapes. */\nexport function expiredPreviewCookieHeaders(name = prismicCookie.preview): string[] {\n\tconst expires = expiresAttr()\n\n\treturn [\n\t\t`${name}=; Path=/; ${expires}; SameSite=Lax`,\n\t\t`${name}=; Path=/; ${expires}; SameSite=None; Secure`,\n\t]\n}\n\n/**\n * Expired `Set-Cookie` values for the App Router draft-mode cookie that `draftMode().disable()`\n * would clear. Next sets `__prerender_bypass` as Lax (not Secure) in development and SameSite=None;\n * Secure in production.\n */\nexport function expiredDraftModeCookieHeaders(): string[] {\n\tconst expires = expiresAttr()\n\tconst name = \"__prerender_bypass\"\n\n\treturn [\n\t\t`${name}=; Path=/; ${expires}; SameSite=Lax; HttpOnly`,\n\t\t`${name}=; Path=/; ${expires}; SameSite=None; Secure; HttpOnly`,\n\t]\n}\n"],"mappings":";;;AAEA,MAAM,wBAAQ,IAAI,KAAK,EAAE;AAEzB,SAAS,cAAsB;AAC9B,QAAO,WAAW,MAAM,aAAa;;;AAItC,SAAgB,4BAA4B,OAAOA,kBAAAA,OAAc,SAAmB;CACnF,MAAM,UAAU,aAAa;AAE7B,QAAO,CACN,GAAG,KAAK,aAAa,QAAQ,iBAC7B,GAAG,KAAK,aAAa,QAAQ,yBAC7B;;;;;;;AAQF,SAAgB,gCAA0C;CACzD,MAAM,UAAU,aAAa;CAC7B,MAAM,OAAO;AAEb,QAAO,CACN,GAAG,KAAK,aAAa,QAAQ,2BAC7B,GAAG,KAAK,aAAa,QAAQ,mCAC7B"}

package/dist/lib/expiredPreviewCookies.js

@@ -1,12 +1,25 @@
 import { cookie } from "@prismicio/client";
 //#region src/lib/expiredPreviewCookies.ts
 const epoch = /* @__PURE__ */ new Date(0);
+function expiresAttr() {
+	return `Expires=${epoch.toUTCString()}`;
+}
 /** Expired `Set-Cookie` values for both leftover `io.prismic.preview` shapes. */
 function expiredPreviewCookieHeaders(name = cookie.preview) {
-	const expires = `Expires=${epoch.toUTCString()}`;
+	const expires = expiresAttr();
 	return [`${name}=; Path=/; ${expires}; SameSite=Lax`, `${name}=; Path=/; ${expires}; SameSite=None; Secure`];
 }
+/**
+* Expired `Set-Cookie` values for the App Router draft-mode cookie that `draftMode().disable()`
+* would clear. Next sets `__prerender_bypass` as Lax (not Secure) in development and SameSite=None;
+* Secure in production.
+*/
+function expiredDraftModeCookieHeaders() {
+	const expires = expiresAttr();
+	const name = "__prerender_bypass";
+	return [`${name}=; Path=/; ${expires}; SameSite=Lax; HttpOnly`, `${name}=; Path=/; ${expires}; SameSite=None; Secure; HttpOnly`];
+}
 //#endregion
-export { expiredPreviewCookieHeaders };
+export { expiredDraftModeCookieHeaders, expiredPreviewCookieHeaders };
 
 //# sourceMappingURL=expiredPreviewCookies.js.map

package/dist/lib/expiredPreviewCookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"expiredPreviewCookies.js","names":["prismicCookie"],"sources":["../../src/lib/expiredPreviewCookies.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\nconst epoch = new Date(0)\n\n/** Expired `Set-Cookie` values for both leftover `io.prismic.preview` shapes. */\nexport function expiredPreviewCookieHeaders(name = prismicCookie.preview): string[] {\n\tconst expires = `Expires=${epoch.toUTCString()}`\n\n\treturn [\n\t\t`${name}=; Path=/; ${expires}; SameSite=Lax`,\n\t\t`${name}=; Path=/; ${expires}; SameSite=None; Secure`,\n\t]\n}\n"],"mappings":";;AAEA,MAAM,wBAAQ,IAAI,KAAK,EAAE;;AAGzB,SAAgB,4BAA4B,OAAOA,OAAc,SAAmB;CACnF,MAAM,UAAU,WAAW,MAAM,aAAa;AAE9C,QAAO,CACN,GAAG,KAAK,aAAa,QAAQ,iBAC7B,GAAG,KAAK,aAAa,QAAQ,yBAC7B"}
+{"version":3,"file":"expiredPreviewCookies.js","names":["prismicCookie"],"sources":["../../src/lib/expiredPreviewCookies.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\nconst epoch = new Date(0)\n\nfunction expiresAttr(): string {\n\treturn `Expires=${epoch.toUTCString()}`\n}\n\n/** Expired `Set-Cookie` values for both leftover `io.prismic.preview` shapes. */\nexport function expiredPreviewCookieHeaders(name = prismicCookie.preview): string[] {\n\tconst expires = expiresAttr()\n\n\treturn [\n\t\t`${name}=; Path=/; ${expires}; SameSite=Lax`,\n\t\t`${name}=; Path=/; ${expires}; SameSite=None; Secure`,\n\t]\n}\n\n/**\n * Expired `Set-Cookie` values for the App Router draft-mode cookie that `draftMode().disable()`\n * would clear. Next sets `__prerender_bypass` as Lax (not Secure) in development and SameSite=None;\n * Secure in production.\n */\nexport function expiredDraftModeCookieHeaders(): string[] {\n\tconst expires = expiresAttr()\n\tconst name = \"__prerender_bypass\"\n\n\treturn [\n\t\t`${name}=; Path=/; ${expires}; SameSite=Lax; HttpOnly`,\n\t\t`${name}=; Path=/; ${expires}; SameSite=None; Secure; HttpOnly`,\n\t]\n}\n"],"mappings":";;AAEA,MAAM,wBAAQ,IAAI,KAAK,EAAE;AAEzB,SAAS,cAAsB;AAC9B,QAAO,WAAW,MAAM,aAAa;;;AAItC,SAAgB,4BAA4B,OAAOA,OAAc,SAAmB;CACnF,MAAM,UAAU,aAAa;AAE7B,QAAO,CACN,GAAG,KAAK,aAAa,QAAQ,iBAC7B,GAAG,KAAK,aAAa,QAAQ,yBAC7B;;;;;;;AAQF,SAAgB,gCAA0C;CACzD,MAAM,UAAU,aAAa;CAC7B,MAAM,OAAO;AAEb,QAAO,CACN,GAAG,KAAK,aAAa,QAAQ,2BAC7B,GAAG,KAAK,aAAa,QAAQ,mCAC7B"}

package/dist/package.cjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.3.1-pr.147.2aebcfe";
+var version = "2.3.1-pr.147.bf74d52";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.3.1-pr.147.2aebcfe";
+var version = "2.3.1-pr.147.bf74d52";
 //#endregion
 export { version };
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/next",
-	"version": "2.3.1-pr.147.2aebcfe",
+	"version": "2.3.1-pr.147.bf74d52",
 	"description": "Helpers to integrate Prismic into Next.js apps",
 	"keywords": [
 		"next",

package/src/exitPreview.ts

@@ -1,4 +1,7 @@
-import { expiredPreviewCookieHeaders } from "./lib/expiredPreviewCookies"
+import {
+	expiredDraftModeCookieHeaders,
+	expiredPreviewCookieHeaders,
+} from "./lib/expiredPreviewCookies"
 
 /**
  * Ends a Prismic preview session within a Next.js app. This function should be used in a Router
@@ -16,22 +19,15 @@ import { expiredPreviewCookieHeaders } from "./lib/expiredPreviewCookies"
  * 	```
  */
 export async function exitPreview(): Promise<Response> {
-	// Need this to avoid the following Next.js build-time error:
-	// You're importing a component that needs next/headers. That only works
-	// in a Server Component which is not supported in the pages/ directory.
-	const { draftMode } = await import("next/headers")
-
-	;(await draftMode()).disable()
-
-	// `redirectToPreviewURL` writes SameSite=None; Secure. The toolbar may
-	// leave SameSite=Lax (not Secure). Those are different cookies to Chrome.
-	// Expire both on the Response. Do not use `cookies().set` / `delete()`:
-	// ResponseCookies is name-keyed, so a second `io.prismic.preview` overwrites
-	// the first and the Lax leftover survives.
+	// Do not call `cookies()` or `draftMode().disable()`. ResponseCookies is
+	// name-keyed: `appendMutableCookies` rebuilds Set-Cookie by name and drops
+	// the extra Lax expire. Emit every expire on the Response instead:
+	// toolbar Lax + iframe None; Secure for `io.prismic.preview`, and both
+	// shapes of `__prerender_bypass` that `disable()` would have cleared.
 	const headers = new Headers({
 		"Cache-Control": "no-store",
 	})
-	for (const setCookie of expiredPreviewCookieHeaders()) {
+	for (const setCookie of [...expiredPreviewCookieHeaders(), ...expiredDraftModeCookieHeaders()]) {
 		headers.append("Set-Cookie", setCookie)
 	}
 

package/src/lib/expiredPreviewCookies.ts

@@ -2,12 +2,31 @@ import { cookie as prismicCookie } from "@prismicio/client"
 
 const epoch = new Date(0)
 
+function expiresAttr(): string {
+	return `Expires=${epoch.toUTCString()}`
+}
+
 /** Expired `Set-Cookie` values for both leftover `io.prismic.preview` shapes. */
 export function expiredPreviewCookieHeaders(name = prismicCookie.preview): string[] {
-	const expires = `Expires=${epoch.toUTCString()}`
+	const expires = expiresAttr()
 
 	return [
 		`${name}=; Path=/; ${expires}; SameSite=Lax`,
 		`${name}=; Path=/; ${expires}; SameSite=None; Secure`,
 	]
 }
+
+/**
+ * Expired `Set-Cookie` values for the App Router draft-mode cookie that `draftMode().disable()`
+ * would clear. Next sets `__prerender_bypass` as Lax (not Secure) in development and SameSite=None;
+ * Secure in production.
+ */
+export function expiredDraftModeCookieHeaders(): string[] {
+	const expires = expiresAttr()
+	const name = "__prerender_bypass"
+
+	return [
+		`${name}=; Path=/; ${expires}; SameSite=Lax; HttpOnly`,
+		`${name}=; Path=/; ${expires}; SameSite=None; Secure; HttpOnly`,
+	]
+}