@prismicio/next 2.3.1-pr.148.cfcff00 → 2.3.1-pr.148.d5dbc1a

package/dist/exitPreview.cjs

@@ -1,4 +1,5 @@
 require("./_virtual/_rolldown/runtime.cjs");
+const require_previewCookieAttributes = require("./lib/previewCookieAttributes.cjs");
 let _prismicio_client = require("@prismicio/client");
 //#region src/exitPreview.ts
 /**
@@ -17,17 +18,18 @@ let _prismicio_client = require("@prismicio/client");
 * 	```
 */
 async function exitPreview() {
-	const { cookies } = await import("next/headers.js");
+	const { cookies, draftMode, headers } = await import("next/headers.js");
+	(await draftMode()).disable();
 	const cookieJar = await cookies();
+	const cookieAttributes = require_previewCookieAttributes.previewCookieAttributes((await headers()).get("host"));
 	cookieJar.delete({
 		name: "__prerender_bypass",
-		sameSite: "none",
-		secure: true
+		httpOnly: true,
+		...cookieAttributes
 	});
 	cookieJar.delete({
 		name: _prismicio_client.cookie.preview,
-		sameSite: "none",
-		secure: true
+		...cookieAttributes
 	});
 	return new Response(JSON.stringify({ success: true }), { headers: { "Cache-Control": "no-store" } });
 }

package/dist/exitPreview.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.cjs","names":["prismicCookie"],"sources":["../src/exitPreview.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies } = await import(\"next/headers\")\n\n\t// Expire both cookies with the attributes `redirectToPreviewURL` used.\n\t// `draftMode().disable()` only expires the Draft Mode cookie, and with\n\t// `SameSite=Lax` in development, which a cross-site iframe cannot clear.\n\tconst cookieJar = await cookies()\n\tcookieJar.delete({ name: \"__prerender_bypass\", sameSite: \"none\", secure: true })\n\tcookieJar.delete({ name: prismicCookie.preview, sameSite: \"none\", secure: true })\n\n\t// `Cache-Control` header is used to prevent CDN-level caching.\n\treturn new Response(JSON.stringify({ success: true }), {\n\t\theaders: {\n\t\t\t\"Cache-Control\": \"no-store\",\n\t\t},\n\t})\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiBA,eAAsB,cAAiC;CAItD,MAAM,EAAE,YAAY,MAAM,OAAO;CAKjC,MAAM,YAAY,MAAM,SAAS;AACjC,WAAU,OAAO;EAAE,MAAM;EAAsB,UAAU;EAAQ,QAAQ;EAAM,CAAC;AAChF,WAAU,OAAO;EAAE,MAAMA,kBAAAA,OAAc;EAAS,UAAU;EAAQ,QAAQ;EAAM,CAAC;AAGjF,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EACtD,SAAS,EACR,iBAAiB,YACjB,EACD,CAAC"}
+{"version":3,"file":"exitPreview.cjs","names":["previewCookieAttributes","prismicCookie"],"sources":["../src/exitPreview.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\nimport { previewCookieAttributes } from \"./lib/previewCookieAttributes\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies, draftMode, headers } = await import(\"next/headers\")\n\n\t;(await draftMode()).disable()\n\n\t// Clear the cookies `redirectToPreviewURL` wrote with the attributes it\n\t// used: a cross-site iframe can only clear `SameSite=None` cookies, which\n\t// `draftMode().disable()` does not use in development.\n\tconst cookieJar = await cookies()\n\tconst cookieAttributes = previewCookieAttributes((await headers()).get(\"host\"))\n\tcookieJar.delete({ name: \"__prerender_bypass\", httpOnly: true, ...cookieAttributes })\n\tcookieJar.delete({ name: prismicCookie.preview, ...cookieAttributes })\n\n\t// `Cache-Control` header is used to prevent CDN-level caching.\n\treturn new Response(JSON.stringify({ success: true }), {\n\t\theaders: {\n\t\t\t\"Cache-Control\": \"no-store\",\n\t\t},\n\t})\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,eAAsB,cAAiC;CAItD,MAAM,EAAE,SAAS,WAAW,YAAY,MAAM,OAAO;AAEpD,EAAC,MAAM,WAAW,EAAE,SAAS;CAK9B,MAAM,YAAY,MAAM,SAAS;CACjC,MAAM,mBAAmBA,gCAAAA,yBAAyB,MAAM,SAAS,EAAE,IAAI,OAAO,CAAC;AAC/E,WAAU,OAAO;EAAE,MAAM;EAAsB,UAAU;EAAM,GAAG;EAAkB,CAAC;AACrF,WAAU,OAAO;EAAE,MAAMC,kBAAAA,OAAc;EAAS,GAAG;EAAkB,CAAC;AAGtE,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EACtD,SAAS,EACR,iBAAiB,YACjB,EACD,CAAC"}

package/dist/exitPreview.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.d.cts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAiBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"exitPreview.d.cts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAmBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}

package/dist/exitPreview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.d.ts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAiBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"exitPreview.d.ts","names":[],"sources":["../src/exitPreview.ts"],"mappings":";;AAmBA;;;;;;;;;;;;;;iBAAsB,WAAA,CAAA,GAAe,OAAA,CAAQ,QAAA"}

package/dist/exitPreview.js

@@ -1,3 +1,4 @@
+import { previewCookieAttributes } from "./lib/previewCookieAttributes.js";
 import { cookie } from "@prismicio/client";
 //#region src/exitPreview.ts
 /**
@@ -16,17 +17,18 @@ import { cookie } from "@prismicio/client";
 * 	```
 */
 async function exitPreview() {
-	const { cookies } = await import("next/headers.js");
+	const { cookies, draftMode, headers } = await import("next/headers.js");
+	(await draftMode()).disable();
 	const cookieJar = await cookies();
+	const cookieAttributes = previewCookieAttributes((await headers()).get("host"));
 	cookieJar.delete({
 		name: "__prerender_bypass",
-		sameSite: "none",
-		secure: true
+		httpOnly: true,
+		...cookieAttributes
 	});
 	cookieJar.delete({
 		name: cookie.preview,
-		sameSite: "none",
-		secure: true
+		...cookieAttributes
 	});
 	return new Response(JSON.stringify({ success: true }), { headers: { "Cache-Control": "no-store" } });
 }

package/dist/exitPreview.js.map

@@ -1 +1 @@
-{"version":3,"file":"exitPreview.js","names":["prismicCookie"],"sources":["../src/exitPreview.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies } = await import(\"next/headers\")\n\n\t// Expire both cookies with the attributes `redirectToPreviewURL` used.\n\t// `draftMode().disable()` only expires the Draft Mode cookie, and with\n\t// `SameSite=Lax` in development, which a cross-site iframe cannot clear.\n\tconst cookieJar = await cookies()\n\tcookieJar.delete({ name: \"__prerender_bypass\", sameSite: \"none\", secure: true })\n\tcookieJar.delete({ name: prismicCookie.preview, sameSite: \"none\", secure: true })\n\n\t// `Cache-Control` header is used to prevent CDN-level caching.\n\treturn new Response(JSON.stringify({ success: true }), {\n\t\theaders: {\n\t\t\t\"Cache-Control\": \"no-store\",\n\t\t},\n\t})\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,eAAsB,cAAiC;CAItD,MAAM,EAAE,YAAY,MAAM,OAAO;CAKjC,MAAM,YAAY,MAAM,SAAS;AACjC,WAAU,OAAO;EAAE,MAAM;EAAsB,UAAU;EAAQ,QAAQ;EAAM,CAAC;AAChF,WAAU,OAAO;EAAE,MAAMA,OAAc;EAAS,UAAU;EAAQ,QAAQ;EAAM,CAAC;AAGjF,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EACtD,SAAS,EACR,iBAAiB,YACjB,EACD,CAAC"}
+{"version":3,"file":"exitPreview.js","names":["prismicCookie"],"sources":["../src/exitPreview.ts"],"sourcesContent":["import { cookie as prismicCookie } from \"@prismicio/client\"\n\nimport { previewCookieAttributes } from \"./lib/previewCookieAttributes\"\n\n/**\n * Ends a Prismic preview session within a Next.js app. This function should be used in a Router\n * Handler.\n *\n * @example\n * \t;```typescript\n * \t// src/app/api/exit-preview/route.js\n *\n * \timport { exitPreview } from \"@prismicio/next\"\n *\n * \texport async function GET() {\n * \t\treturn await exitPreview()\n * \t}\n * \t```\n */\nexport async function exitPreview(): Promise<Response> {\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies, draftMode, headers } = await import(\"next/headers\")\n\n\t;(await draftMode()).disable()\n\n\t// Clear the cookies `redirectToPreviewURL` wrote with the attributes it\n\t// used: a cross-site iframe can only clear `SameSite=None` cookies, which\n\t// `draftMode().disable()` does not use in development.\n\tconst cookieJar = await cookies()\n\tconst cookieAttributes = previewCookieAttributes((await headers()).get(\"host\"))\n\tcookieJar.delete({ name: \"__prerender_bypass\", httpOnly: true, ...cookieAttributes })\n\tcookieJar.delete({ name: prismicCookie.preview, ...cookieAttributes })\n\n\t// `Cache-Control` header is used to prevent CDN-level caching.\n\treturn new Response(JSON.stringify({ success: true }), {\n\t\theaders: {\n\t\t\t\"Cache-Control\": \"no-store\",\n\t\t},\n\t})\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,eAAsB,cAAiC;CAItD,MAAM,EAAE,SAAS,WAAW,YAAY,MAAM,OAAO;AAEpD,EAAC,MAAM,WAAW,EAAE,SAAS;CAK9B,MAAM,YAAY,MAAM,SAAS;CACjC,MAAM,mBAAmB,yBAAyB,MAAM,SAAS,EAAE,IAAI,OAAO,CAAC;AAC/E,WAAU,OAAO;EAAE,MAAM;EAAsB,UAAU;EAAM,GAAG;EAAkB,CAAC;AACrF,WAAU,OAAO;EAAE,MAAMA,OAAc;EAAS,GAAG;EAAkB,CAAC;AAGtE,QAAO,IAAI,SAAS,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,EAAE,EACtD,SAAS,EACR,iBAAiB,YACjB,EACD,CAAC"}

package/dist/lib/previewCookieAttributes.cjs

@@ -0,0 +1,20 @@
+//#region src/lib/previewCookieAttributes.ts
+/**
+* Attributes for the preview cookie and Next.js's Draft Mode cookie.
+*
+* Browsers only send `SameSite=Lax` cookies on same-site requests, so the cookies need
+* `SameSite=None; Secure` to work when the site is embedded in a cross-site iframe, like the
+* Prismic editor. Browsers reject `Secure` cookies over plain HTTP unless the host is `localhost`,
+* so `next dev` on any other host keeps Next.js's `Lax` default.
+*/
+function previewCookieAttributes(host) {
+	const secure = process.env.NODE_ENV !== "development" || host?.split(":")[0] === "localhost";
+	return {
+		sameSite: secure ? "none" : "lax",
+		secure
+	};
+}
+//#endregion
+exports.previewCookieAttributes = previewCookieAttributes;
+
+//# sourceMappingURL=previewCookieAttributes.cjs.map

package/dist/lib/previewCookieAttributes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"previewCookieAttributes.cjs","names":[],"sources":["../../src/lib/previewCookieAttributes.ts"],"sourcesContent":["/**\n * Attributes for the preview cookie and Next.js's Draft Mode cookie.\n *\n * Browsers only send `SameSite=Lax` cookies on same-site requests, so the cookies need\n * `SameSite=None; Secure` to work when the site is embedded in a cross-site iframe, like the\n * Prismic editor. Browsers reject `Secure` cookies over plain HTTP unless the host is `localhost`,\n * so `next dev` on any other host keeps Next.js's `Lax` default.\n */\nexport function previewCookieAttributes(host: string | null | undefined): {\n\tsameSite: \"none\" | \"lax\"\n\tsecure: boolean\n} {\n\tconst secure = process.env.NODE_ENV !== \"development\" || host?.split(\":\")[0] === \"localhost\"\n\n\treturn { sameSite: secure ? \"none\" : \"lax\", secure }\n}\n"],"mappings":";;;;;;;;;AAQA,SAAgB,wBAAwB,MAGtC;CACD,MAAM,SAAS,QAAQ,IAAI,aAAa,iBAAiB,MAAM,MAAM,IAAI,CAAC,OAAO;AAEjF,QAAO;EAAE,UAAU,SAAS,SAAS;EAAO;EAAQ"}

package/dist/lib/previewCookieAttributes.js

@@ -0,0 +1,20 @@
+//#region src/lib/previewCookieAttributes.ts
+/**
+* Attributes for the preview cookie and Next.js's Draft Mode cookie.
+*
+* Browsers only send `SameSite=Lax` cookies on same-site requests, so the cookies need
+* `SameSite=None; Secure` to work when the site is embedded in a cross-site iframe, like the
+* Prismic editor. Browsers reject `Secure` cookies over plain HTTP unless the host is `localhost`,
+* so `next dev` on any other host keeps Next.js's `Lax` default.
+*/
+function previewCookieAttributes(host) {
+	const secure = process.env.NODE_ENV !== "development" || host?.split(":")[0] === "localhost";
+	return {
+		sameSite: secure ? "none" : "lax",
+		secure
+	};
+}
+//#endregion
+export { previewCookieAttributes };
+
+//# sourceMappingURL=previewCookieAttributes.js.map

package/dist/lib/previewCookieAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"previewCookieAttributes.js","names":[],"sources":["../../src/lib/previewCookieAttributes.ts"],"sourcesContent":["/**\n * Attributes for the preview cookie and Next.js's Draft Mode cookie.\n *\n * Browsers only send `SameSite=Lax` cookies on same-site requests, so the cookies need\n * `SameSite=None; Secure` to work when the site is embedded in a cross-site iframe, like the\n * Prismic editor. Browsers reject `Secure` cookies over plain HTTP unless the host is `localhost`,\n * so `next dev` on any other host keeps Next.js's `Lax` default.\n */\nexport function previewCookieAttributes(host: string | null | undefined): {\n\tsameSite: \"none\" | \"lax\"\n\tsecure: boolean\n} {\n\tconst secure = process.env.NODE_ENV !== \"development\" || host?.split(\":\")[0] === \"localhost\"\n\n\treturn { sameSite: secure ? \"none\" : \"lax\", secure }\n}\n"],"mappings":";;;;;;;;;AAQA,SAAgB,wBAAwB,MAGtC;CACD,MAAM,SAAS,QAAQ,IAAI,aAAa,iBAAiB,MAAM,MAAM,IAAI,CAAC,OAAO;AAEjF,QAAO;EAAE,UAAU,SAAS,SAAS;EAAO;EAAQ"}

package/dist/package.cjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.3.1-pr.148.cfcff00";
+var version = "2.3.1-pr.148.d5dbc1a";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.3.1-pr.148.cfcff00";
+var version = "2.3.1-pr.148.d5dbc1a";
 //#endregion
 export { version };
 

package/dist/redirectToPreviewURL.cjs

@@ -1,4 +1,5 @@
 require("./_virtual/_rolldown/runtime.cjs");
+const require_previewCookieAttributes = require("./lib/previewCookieAttributes.cjs");
 let _prismicio_client = require("@prismicio/client");
 //#region src/redirectToPreviewURL.ts
 async function redirectToPreviewURL(config) {
@@ -7,11 +8,9 @@ async function redirectToPreviewURL(config) {
 	const { redirect } = await import("next/navigation");
 	const documentID = request.nextUrl.searchParams.get("documentId") ?? void 0;
 	const cookieJar = await cookies();
+	const cookieAttributes = require_previewCookieAttributes.previewCookieAttributes(request.headers.get("host"));
 	const previewToken = request.nextUrl.searchParams.get("token") ?? void 0;
-	if (previewToken) cookieJar.set(_prismicio_client.cookie.preview, previewToken, {
-		sameSite: "none",
-		secure: true
-	});
+	if (previewToken) cookieJar.set(_prismicio_client.cookie.preview, previewToken, cookieAttributes);
 	const previewURL = await client.resolvePreviewURL({
 		documentID,
 		previewToken,
@@ -22,8 +21,7 @@ async function redirectToPreviewURL(config) {
 	const draftCookie = cookieJar.get("__prerender_bypass");
 	if (draftCookie) cookieJar.set({
 		...draftCookie,
-		sameSite: "none",
-		secure: true
+		...cookieAttributes
 	});
 	return redirect(previewURL);
 }

package/dist/redirectToPreviewURL.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"redirectToPreviewURL.cjs","names":["prismicCookie"],"sources":["../src/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type Client, type LinkResolverFunction } from \"@prismicio/client\"\n\nimport type { NextRequestLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `request` object from a Next.js Route Handler.\n\t *\n\t * @see Next.js Route Handler docs: \\<https://nextjs.org/docs/app/building-your-application/routing/route-handlers\\>\n\t */\n\trequest: NextRequestLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<never> {\n\tconst { client, request, linkResolver, defaultURL = \"/\" } = config\n\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies, draftMode } = await import(\"next/headers\")\n\n\t// Dynamic so Node.js can load this module: the bare specifier (kept by\n\t// tsdown.config.ts for Next.js's server alias) is not resolvable by Node.js.\n\tconst { redirect } = await import(\"next/navigation\")\n\n\tconst documentID = request.nextUrl.searchParams.get(\"documentId\") ?? undefined\n\n\t// Set the initial preview cookie. Setting the cookie here is necessary\n\t// to support unpublished previews. Without setting it here, the page\n\t// will try to render without the preview cookie, leading to a\n\t// PrismicNotFound error.\n\t//\n\t// Browsers only send `SameSite=Lax` cookies on same-site requests, so\n\t// `SameSite=None; Secure` is needed for the site to preview inside a\n\t// cross-site iframe, like the Prismic editor.\n\tconst cookieJar = await cookies()\n\tconst previewToken = request.nextUrl.searchParams.get(\"token\") ?? undefined\n\tif (previewToken) {\n\t\tcookieJar.set(prismicCookie.preview, previewToken, { sameSite: \"none\", secure: true })\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tdocumentID,\n\t\tpreviewToken,\n\t\tdefaultURL,\n\t\tlinkResolver,\n\t})\n\n\t;(await draftMode()).enable()\n\n\t// Next.js writes its Draft Mode cookie as `SameSite=Lax` in development.\n\t// Rewrite it like the preview cookie, keeping Next.js's value.\n\tconst draftCookie = cookieJar.get(\"__prerender_bypass\")\n\tif (draftCookie) {\n\t\tcookieJar.set({ ...draftCookie, sameSite: \"none\", secure: true })\n\t}\n\n\treturn redirect(previewURL)\n}\n"],"mappings":";;;AAkCA,eAAsB,qBAAqB,QAAoD;CAC9F,MAAM,EAAE,QAAQ,SAAS,cAAc,aAAa,QAAQ;CAK5D,MAAM,EAAE,SAAS,cAAc,MAAM,OAAO;CAI5C,MAAM,EAAE,aAAa,MAAM,OAAO;CAElC,MAAM,aAAa,QAAQ,QAAQ,aAAa,IAAI,aAAa,IAAI,KAAA;CAUrE,MAAM,YAAY,MAAM,SAAS;CACjC,MAAM,eAAe,QAAQ,QAAQ,aAAa,IAAI,QAAQ,IAAI,KAAA;AAClE,KAAI,aACH,WAAU,IAAIA,kBAAAA,OAAc,SAAS,cAAc;EAAE,UAAU;EAAQ,QAAQ;EAAM,CAAC;CAGvF,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;EACA;EACA,CAAC;AAED,EAAC,MAAM,WAAW,EAAE,QAAQ;CAI7B,MAAM,cAAc,UAAU,IAAI,qBAAqB;AACvD,KAAI,YACH,WAAU,IAAI;EAAE,GAAG;EAAa,UAAU;EAAQ,QAAQ;EAAM,CAAC;AAGlE,QAAO,SAAS,WAAW"}
+{"version":3,"file":"redirectToPreviewURL.cjs","names":["previewCookieAttributes","prismicCookie"],"sources":["../src/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type Client, type LinkResolverFunction } from \"@prismicio/client\"\n\nimport { previewCookieAttributes } from \"./lib/previewCookieAttributes\"\nimport type { NextRequestLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `request` object from a Next.js Route Handler.\n\t *\n\t * @see Next.js Route Handler docs: \\<https://nextjs.org/docs/app/building-your-application/routing/route-handlers\\>\n\t */\n\trequest: NextRequestLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<never> {\n\tconst { client, request, linkResolver, defaultURL = \"/\" } = config\n\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies, draftMode } = await import(\"next/headers\")\n\n\t// Dynamic so Node.js can load this module: the bare specifier (kept by\n\t// tsdown.config.ts for Next.js's server alias) is not resolvable by Node.js.\n\tconst { redirect } = await import(\"next/navigation\")\n\n\tconst documentID = request.nextUrl.searchParams.get(\"documentId\") ?? undefined\n\n\t// Set the initial preview cookie. Setting the cookie here is necessary\n\t// to support unpublished previews. Without setting it here, the page\n\t// will try to render without the preview cookie, leading to a\n\t// PrismicNotFound error.\n\tconst cookieJar = await cookies()\n\tconst cookieAttributes = previewCookieAttributes(request.headers.get(\"host\"))\n\tconst previewToken = request.nextUrl.searchParams.get(\"token\") ?? undefined\n\tif (previewToken) {\n\t\tcookieJar.set(prismicCookie.preview, previewToken, cookieAttributes)\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tdocumentID,\n\t\tpreviewToken,\n\t\tdefaultURL,\n\t\tlinkResolver,\n\t})\n\n\t;(await draftMode()).enable()\n\n\t// Next.js writes its Draft Mode cookie as `SameSite=Lax` in development,\n\t// which cross-site iframes drop. Rewrite it with the preview cookie's\n\t// attributes, keeping Next.js's value.\n\tconst draftCookie = cookieJar.get(\"__prerender_bypass\")\n\tif (draftCookie) {\n\t\tcookieJar.set({ ...draftCookie, ...cookieAttributes })\n\t}\n\n\treturn redirect(previewURL)\n}\n"],"mappings":";;;;AAmCA,eAAsB,qBAAqB,QAAoD;CAC9F,MAAM,EAAE,QAAQ,SAAS,cAAc,aAAa,QAAQ;CAK5D,MAAM,EAAE,SAAS,cAAc,MAAM,OAAO;CAI5C,MAAM,EAAE,aAAa,MAAM,OAAO;CAElC,MAAM,aAAa,QAAQ,QAAQ,aAAa,IAAI,aAAa,IAAI,KAAA;CAMrE,MAAM,YAAY,MAAM,SAAS;CACjC,MAAM,mBAAmBA,gCAAAA,wBAAwB,QAAQ,QAAQ,IAAI,OAAO,CAAC;CAC7E,MAAM,eAAe,QAAQ,QAAQ,aAAa,IAAI,QAAQ,IAAI,KAAA;AAClE,KAAI,aACH,WAAU,IAAIC,kBAAAA,OAAc,SAAS,cAAc,iBAAiB;CAGrE,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;EACA;EACA,CAAC;AAED,EAAC,MAAM,WAAW,EAAE,QAAQ;CAK7B,MAAM,cAAc,UAAU,IAAI,qBAAqB;AACvD,KAAI,YACH,WAAU,IAAI;EAAE,GAAG;EAAa,GAAG;EAAkB,CAAC;AAGvD,QAAO,SAAS,WAAW"}

package/dist/redirectToPreviewURL.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"redirectToPreviewURL.d.cts","names":[],"sources":["../src/redirectToPreviewURL.ts"],"mappings":";;;;KAIY,0BAAA;4EAKX,MAAA,EAAQ,IAAA,CAAK,MAAA;EALwB;;;;;EAYrC,OAAA,EAAS,eAAA;EAO0B;;;;;EAAnC,YAAA,GAAe,oBAAA;EAPN;;;;;;EAeT,UAAA;AAAA;AAAA,iBAGqB,oBAAA,CAAqB,MAAA,EAAQ,0BAAA,GAA6B,OAAA"}
+{"version":3,"file":"redirectToPreviewURL.d.cts","names":[],"sources":["../src/redirectToPreviewURL.ts"],"mappings":";;;;KAKY,0BAAA;4EAKX,MAAA,EAAQ,IAAA,CAAK,MAAA;EALwB;;;;;EAYrC,OAAA,EAAS,eAAA;EAO0B;;;;;EAAnC,YAAA,GAAe,oBAAA;EAPN;;;;;;EAeT,UAAA;AAAA;AAAA,iBAGqB,oBAAA,CAAqB,MAAA,EAAQ,0BAAA,GAA6B,OAAA"}

package/dist/redirectToPreviewURL.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirectToPreviewURL.d.ts","names":[],"sources":["../src/redirectToPreviewURL.ts"],"mappings":";;;;KAIY,0BAAA;4EAKX,MAAA,EAAQ,IAAA,CAAK,MAAA;EALwB;;;;;EAYrC,OAAA,EAAS,eAAA;EAO0B;;;;;EAAnC,YAAA,GAAe,oBAAA;EAPN;;;;;;EAeT,UAAA;AAAA;AAAA,iBAGqB,oBAAA,CAAqB,MAAA,EAAQ,0BAAA,GAA6B,OAAA"}
+{"version":3,"file":"redirectToPreviewURL.d.ts","names":[],"sources":["../src/redirectToPreviewURL.ts"],"mappings":";;;;KAKY,0BAAA;4EAKX,MAAA,EAAQ,IAAA,CAAK,MAAA;EALwB;;;;;EAYrC,OAAA,EAAS,eAAA;EAO0B;;;;;EAAnC,YAAA,GAAe,oBAAA;EAPN;;;;;;EAeT,UAAA;AAAA;AAAA,iBAGqB,oBAAA,CAAqB,MAAA,EAAQ,0BAAA,GAA6B,OAAA"}

package/dist/redirectToPreviewURL.js

@@ -1,3 +1,4 @@
+import { previewCookieAttributes } from "./lib/previewCookieAttributes.js";
 import { cookie } from "@prismicio/client";
 //#region src/redirectToPreviewURL.ts
 async function redirectToPreviewURL(config) {
@@ -6,11 +7,9 @@ async function redirectToPreviewURL(config) {
 	const { redirect } = await import("next/navigation");
 	const documentID = request.nextUrl.searchParams.get("documentId") ?? void 0;
 	const cookieJar = await cookies();
+	const cookieAttributes = previewCookieAttributes(request.headers.get("host"));
 	const previewToken = request.nextUrl.searchParams.get("token") ?? void 0;
-	if (previewToken) cookieJar.set(cookie.preview, previewToken, {
-		sameSite: "none",
-		secure: true
-	});
+	if (previewToken) cookieJar.set(cookie.preview, previewToken, cookieAttributes);
 	const previewURL = await client.resolvePreviewURL({
 		documentID,
 		previewToken,
@@ -21,8 +20,7 @@ async function redirectToPreviewURL(config) {
 	const draftCookie = cookieJar.get("__prerender_bypass");
 	if (draftCookie) cookieJar.set({
 		...draftCookie,
-		sameSite: "none",
-		secure: true
+		...cookieAttributes
 	});
 	return redirect(previewURL);
 }

package/dist/redirectToPreviewURL.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirectToPreviewURL.js","names":["prismicCookie"],"sources":["../src/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type Client, type LinkResolverFunction } from \"@prismicio/client\"\n\nimport type { NextRequestLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `request` object from a Next.js Route Handler.\n\t *\n\t * @see Next.js Route Handler docs: \\<https://nextjs.org/docs/app/building-your-application/routing/route-handlers\\>\n\t */\n\trequest: NextRequestLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<never> {\n\tconst { client, request, linkResolver, defaultURL = \"/\" } = config\n\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies, draftMode } = await import(\"next/headers\")\n\n\t// Dynamic so Node.js can load this module: the bare specifier (kept by\n\t// tsdown.config.ts for Next.js's server alias) is not resolvable by Node.js.\n\tconst { redirect } = await import(\"next/navigation\")\n\n\tconst documentID = request.nextUrl.searchParams.get(\"documentId\") ?? undefined\n\n\t// Set the initial preview cookie. Setting the cookie here is necessary\n\t// to support unpublished previews. Without setting it here, the page\n\t// will try to render without the preview cookie, leading to a\n\t// PrismicNotFound error.\n\t//\n\t// Browsers only send `SameSite=Lax` cookies on same-site requests, so\n\t// `SameSite=None; Secure` is needed for the site to preview inside a\n\t// cross-site iframe, like the Prismic editor.\n\tconst cookieJar = await cookies()\n\tconst previewToken = request.nextUrl.searchParams.get(\"token\") ?? undefined\n\tif (previewToken) {\n\t\tcookieJar.set(prismicCookie.preview, previewToken, { sameSite: \"none\", secure: true })\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tdocumentID,\n\t\tpreviewToken,\n\t\tdefaultURL,\n\t\tlinkResolver,\n\t})\n\n\t;(await draftMode()).enable()\n\n\t// Next.js writes its Draft Mode cookie as `SameSite=Lax` in development.\n\t// Rewrite it like the preview cookie, keeping Next.js's value.\n\tconst draftCookie = cookieJar.get(\"__prerender_bypass\")\n\tif (draftCookie) {\n\t\tcookieJar.set({ ...draftCookie, sameSite: \"none\", secure: true })\n\t}\n\n\treturn redirect(previewURL)\n}\n"],"mappings":";;AAkCA,eAAsB,qBAAqB,QAAoD;CAC9F,MAAM,EAAE,QAAQ,SAAS,cAAc,aAAa,QAAQ;CAK5D,MAAM,EAAE,SAAS,cAAc,MAAM,OAAO;CAI5C,MAAM,EAAE,aAAa,MAAM,OAAO;CAElC,MAAM,aAAa,QAAQ,QAAQ,aAAa,IAAI,aAAa,IAAI,KAAA;CAUrE,MAAM,YAAY,MAAM,SAAS;CACjC,MAAM,eAAe,QAAQ,QAAQ,aAAa,IAAI,QAAQ,IAAI,KAAA;AAClE,KAAI,aACH,WAAU,IAAIA,OAAc,SAAS,cAAc;EAAE,UAAU;EAAQ,QAAQ;EAAM,CAAC;CAGvF,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;EACA;EACA,CAAC;AAED,EAAC,MAAM,WAAW,EAAE,QAAQ;CAI7B,MAAM,cAAc,UAAU,IAAI,qBAAqB;AACvD,KAAI,YACH,WAAU,IAAI;EAAE,GAAG;EAAa,UAAU;EAAQ,QAAQ;EAAM,CAAC;AAGlE,QAAO,SAAS,WAAW"}
+{"version":3,"file":"redirectToPreviewURL.js","names":["prismicCookie"],"sources":["../src/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type Client, type LinkResolverFunction } from \"@prismicio/client\"\n\nimport { previewCookieAttributes } from \"./lib/previewCookieAttributes\"\nimport type { NextRequestLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `request` object from a Next.js Route Handler.\n\t *\n\t * @see Next.js Route Handler docs: \\<https://nextjs.org/docs/app/building-your-application/routing/route-handlers\\>\n\t */\n\trequest: NextRequestLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<never> {\n\tconst { client, request, linkResolver, defaultURL = \"/\" } = config\n\n\t// Need this to avoid the following Next.js build-time error:\n\t// You're importing a component that needs next/headers. That only works\n\t// in a Server Component which is not supported in the pages/ directory.\n\tconst { cookies, draftMode } = await import(\"next/headers\")\n\n\t// Dynamic so Node.js can load this module: the bare specifier (kept by\n\t// tsdown.config.ts for Next.js's server alias) is not resolvable by Node.js.\n\tconst { redirect } = await import(\"next/navigation\")\n\n\tconst documentID = request.nextUrl.searchParams.get(\"documentId\") ?? undefined\n\n\t// Set the initial preview cookie. Setting the cookie here is necessary\n\t// to support unpublished previews. Without setting it here, the page\n\t// will try to render without the preview cookie, leading to a\n\t// PrismicNotFound error.\n\tconst cookieJar = await cookies()\n\tconst cookieAttributes = previewCookieAttributes(request.headers.get(\"host\"))\n\tconst previewToken = request.nextUrl.searchParams.get(\"token\") ?? undefined\n\tif (previewToken) {\n\t\tcookieJar.set(prismicCookie.preview, previewToken, cookieAttributes)\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tdocumentID,\n\t\tpreviewToken,\n\t\tdefaultURL,\n\t\tlinkResolver,\n\t})\n\n\t;(await draftMode()).enable()\n\n\t// Next.js writes its Draft Mode cookie as `SameSite=Lax` in development,\n\t// which cross-site iframes drop. Rewrite it with the preview cookie's\n\t// attributes, keeping Next.js's value.\n\tconst draftCookie = cookieJar.get(\"__prerender_bypass\")\n\tif (draftCookie) {\n\t\tcookieJar.set({ ...draftCookie, ...cookieAttributes })\n\t}\n\n\treturn redirect(previewURL)\n}\n"],"mappings":";;;AAmCA,eAAsB,qBAAqB,QAAoD;CAC9F,MAAM,EAAE,QAAQ,SAAS,cAAc,aAAa,QAAQ;CAK5D,MAAM,EAAE,SAAS,cAAc,MAAM,OAAO;CAI5C,MAAM,EAAE,aAAa,MAAM,OAAO;CAElC,MAAM,aAAa,QAAQ,QAAQ,aAAa,IAAI,aAAa,IAAI,KAAA;CAMrE,MAAM,YAAY,MAAM,SAAS;CACjC,MAAM,mBAAmB,wBAAwB,QAAQ,QAAQ,IAAI,OAAO,CAAC;CAC7E,MAAM,eAAe,QAAQ,QAAQ,aAAa,IAAI,QAAQ,IAAI,KAAA;AAClE,KAAI,aACH,WAAU,IAAIA,OAAc,SAAS,cAAc,iBAAiB;CAGrE,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;EACA;EACA,CAAC;AAED,EAAC,MAAM,WAAW,EAAE,QAAQ;CAK7B,MAAM,cAAc,UAAU,IAAI,qBAAqB;AACvD,KAAI,YACH,WAAU,IAAI;EAAE,GAAG;EAAa,GAAG;EAAkB,CAAC;AAGvD,QAAO,SAAS,WAAW"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/next",
-	"version": "2.3.1-pr.148.cfcff00",
+	"version": "2.3.1-pr.148.d5dbc1a",
 	"description": "Helpers to integrate Prismic into Next.js apps",
 	"keywords": [
 		"next",

package/src/exitPreview.ts

@@ -1,5 +1,7 @@
 import { cookie as prismicCookie } from "@prismicio/client"
 
+import { previewCookieAttributes } from "./lib/previewCookieAttributes"
+
 /**
  * Ends a Prismic preview session within a Next.js app. This function should be used in a Router
  * Handler.
@@ -19,14 +21,17 @@ export async function exitPreview(): Promise<Response> {
 	// Need this to avoid the following Next.js build-time error:
 	// You're importing a component that needs next/headers. That only works
 	// in a Server Component which is not supported in the pages/ directory.
-	const { cookies } = await import("next/headers")
+	const { cookies, draftMode, headers } = await import("next/headers")
+
+	;(await draftMode()).disable()
 
-	// Expire both cookies with the attributes `redirectToPreviewURL` used.
-	// `draftMode().disable()` only expires the Draft Mode cookie, and with
-	// `SameSite=Lax` in development, which a cross-site iframe cannot clear.
+	// Clear the cookies `redirectToPreviewURL` wrote with the attributes it
+	// used: a cross-site iframe can only clear `SameSite=None` cookies, which
+	// `draftMode().disable()` does not use in development.
 	const cookieJar = await cookies()
-	cookieJar.delete({ name: "__prerender_bypass", sameSite: "none", secure: true })
-	cookieJar.delete({ name: prismicCookie.preview, sameSite: "none", secure: true })
+	const cookieAttributes = previewCookieAttributes((await headers()).get("host"))
+	cookieJar.delete({ name: "__prerender_bypass", httpOnly: true, ...cookieAttributes })
+	cookieJar.delete({ name: prismicCookie.preview, ...cookieAttributes })
 
 	// `Cache-Control` header is used to prevent CDN-level caching.
 	return new Response(JSON.stringify({ success: true }), {

package/src/lib/previewCookieAttributes.ts

@@ -0,0 +1,16 @@
+/**
+ * Attributes for the preview cookie and Next.js's Draft Mode cookie.
+ *
+ * Browsers only send `SameSite=Lax` cookies on same-site requests, so the cookies need
+ * `SameSite=None; Secure` to work when the site is embedded in a cross-site iframe, like the
+ * Prismic editor. Browsers reject `Secure` cookies over plain HTTP unless the host is `localhost`,
+ * so `next dev` on any other host keeps Next.js's `Lax` default.
+ */
+export function previewCookieAttributes(host: string | null | undefined): {
+	sameSite: "none" | "lax"
+	secure: boolean
+} {
+	const secure = process.env.NODE_ENV !== "development" || host?.split(":")[0] === "localhost"
+
+	return { sameSite: secure ? "none" : "lax", secure }
+}

package/src/redirectToPreviewURL.ts

@@ -1,5 +1,6 @@
 import { cookie as prismicCookie, type Client, type LinkResolverFunction } from "@prismicio/client"
 
+import { previewCookieAttributes } from "./lib/previewCookieAttributes"
 import type { NextRequestLike } from "./types"
 
 export type RedirectToPreviewURLConfig = {
@@ -50,14 +51,11 @@ export async function redirectToPreviewURL(config: RedirectToPreviewURLConfig):
 	// to support unpublished previews. Without setting it here, the page
 	// will try to render without the preview cookie, leading to a
 	// PrismicNotFound error.
-	//
-	// Browsers only send `SameSite=Lax` cookies on same-site requests, so
-	// `SameSite=None; Secure` is needed for the site to preview inside a
-	// cross-site iframe, like the Prismic editor.
 	const cookieJar = await cookies()
+	const cookieAttributes = previewCookieAttributes(request.headers.get("host"))
 	const previewToken = request.nextUrl.searchParams.get("token") ?? undefined
 	if (previewToken) {
-		cookieJar.set(prismicCookie.preview, previewToken, { sameSite: "none", secure: true })
+		cookieJar.set(prismicCookie.preview, previewToken, cookieAttributes)
 	}
 
 	const previewURL = await client.resolvePreviewURL({
@@ -69,11 +67,12 @@ export async function redirectToPreviewURL(config: RedirectToPreviewURLConfig):
 
 	;(await draftMode()).enable()
 
-	// Next.js writes its Draft Mode cookie as `SameSite=Lax` in development.
-	// Rewrite it like the preview cookie, keeping Next.js's value.
+	// Next.js writes its Draft Mode cookie as `SameSite=Lax` in development,
+	// which cross-site iframes drop. Rewrite it with the preview cookie's
+	// attributes, keeping Next.js's value.
 	const draftCookie = cookieJar.get("__prerender_bypass")
 	if (draftCookie) {
-		cookieJar.set({ ...draftCookie, sameSite: "none", secure: true })
+		cookieJar.set({ ...draftCookie, ...cookieAttributes })
 	}
 
 	return redirect(previewURL)