@soloworks/smking-next 0.20.2 → 0.20.3

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @soloworks/smking-next
 
+## 0.20.3 — 2026-06-08
+
+**CMS draft preview URL now carries a visible `?smking_preview=1` marker.**
+
+The `/smking-preview` route still enables Next.js Draft Mode + stashes the
+token in an httpOnly cookie, but now redirects to `…/path?smking_preview=1`
+instead of the bare path. This makes a preview tab's URL visibly distinct from
+the published page so authors can tell draft from live at a glance (parity with
+the Laravel SDK). The token stays in the cookie — never the URL. Additive, so
+`^0.20` gets it automatically.
+
 ## 0.20.2 — 2026-06-08
 
 **Feature (additive — shipped as a patch): CMS draft preview via Next.js Draft Mode.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soloworks/smking-next",
-  "version": "0.20.2",
+  "version": "0.20.3",
   "description": "AI-native SEO (AEO) for Next.js — auto-inject JSON-LD, FAQ, AI summary, and SEO metadata so AI crawlers (ChatGPT, Perplexity, Google AI) can cite your pages.",
   "license": "MIT",
   "homepage": "https://github.com/sillyleo/smking/tree/main/packages/smking-next",

package/src/lib/preview-route.ts

@@ -11,8 +11,13 @@ import { redirect } from "next/navigation";
  *
  * Flow: the dashboard 預覽鈕 opens `/smking-preview?token=…&path=/blog/x` →
  * this enables Next.js Draft Mode + stashes the short-lived token in an
- * httpOnly cookie → redirects to the page, which `<SmkingCms>` then renders
- * from draftBlocks (status "preview").
+ * httpOnly cookie → redirects to `/blog/x?smking_preview=1`, which
+ * `<SmkingCms>` then renders from draftBlocks (status "preview").
+ *
+ * The `?smking_preview=1` marker makes the preview tab's URL visibly distinct
+ * from the live page at a glance (parity with the Laravel SDK's
+ * `?smking_preview=` URL). The token itself stays in the httpOnly Draft Mode
+ * cookie — never the URL — so it can't leak via the address bar / referrer.
  *
  * Fail-safe / install-only:
  *   - No token → plain redirect to the live page (Draft Mode NOT enabled).
@@ -27,6 +32,7 @@ export async function GET(request: Request): Promise<Response> {
   const path =
     rawPath.startsWith("/") && !rawPath.startsWith("//") ? rawPath : "/";
 
+  let target = path;
   if (token) {
     (await draftMode()).enable();
     (await cookies()).set("smking_preview_token", token, {
@@ -35,8 +41,14 @@ export async function GET(request: Request): Promise<Response> {
       path: "/",
       maxAge: 60 * 15,
     });
+    // Visible marker so the preview tab's URL differs from the live page at a
+    // glance (parity with the Laravel SDK). The token rides the httpOnly
+    // cookie above — deliberately kept OUT of the URL: it'd be a dead param
+    // (<SmkingCms> reads the cookie) and would leak into address bar / referrer.
+    const sep = path.includes("?") ? "&" : "?";
+    target = `${path}${sep}smking_preview=1`;
   }
 
   // redirect() throws NEXT_REDIRECT — expected control flow in route handlers.
-  redirect(path);
+  redirect(target);
 }