camox 0.59.0 → 0.61.0

package/dist/features/renderer/RendererApp.js

@@ -113,9 +113,10 @@ function RendererApp(t0) {
 }
 /** A block's thumbnail, rendered by the draft's code into its frame: nothing for a block it lacks. */
 function RendererThumbnail(t0) {
-	const $ = c(9);
+	const $ = c(17);
 	const { slot, blockType, camoxApp } = t0;
 	const frameWindow = slot.ownerDocument.defaultView;
+	const left = useLeftInSlot(slot);
 	const t1 = frameWindow?.frameElement ?? null;
 	let t2;
 	if ($[0] !== frameWindow || $[1] !== t1) {
@@ -130,32 +131,55 @@ function RendererThumbnail(t0) {
 	const frameContext = t2;
 	let t3;
 	if ($[3] !== blockType || $[4] !== camoxApp) {
-		t3 = /* @__PURE__ */ jsx(ThumbnailErrorBoundary, { children: /* @__PURE__ */ jsx(React.Suspense, {
-			fallback: null,
-			children: /* @__PURE__ */ jsx(ThumbnailBlock, {
-				blockType,
-				camoxApp
-			})
-		}) });
+		t3 = /* @__PURE__ */ jsx(ThumbnailBlock, {
+			blockType,
+			camoxApp
+		});
 		$[3] = blockType;
 		$[4] = camoxApp;
 		$[5] = t3;
 	} else t3 = $[5];
 	let t4;
-	if ($[6] !== frameContext || $[7] !== t3) {
-		t4 = /* @__PURE__ */ jsx(NavigationProvider, {
+	if ($[6] !== left) {
+		t4 = /* @__PURE__ */ jsx(RemovesLeft, { nodes: left });
+		$[6] = left;
+		$[7] = t4;
+	} else t4 = $[7];
+	let t5;
+	if ($[8] !== t3 || $[9] !== t4) {
+		t5 = /* @__PURE__ */ jsxs(React.Suspense, {
+			fallback: null,
+			children: [t3, t4]
+		});
+		$[8] = t3;
+		$[9] = t4;
+		$[10] = t5;
+	} else t5 = $[10];
+	let t6;
+	if ($[11] !== left || $[12] !== t5) {
+		t6 = /* @__PURE__ */ jsx(ThumbnailErrorBoundary, {
+			left,
+			children: t5
+		});
+		$[11] = left;
+		$[12] = t5;
+		$[13] = t6;
+	} else t6 = $[13];
+	let t7;
+	if ($[14] !== frameContext || $[15] !== t6) {
+		t7 = /* @__PURE__ */ jsx(NavigationProvider, {
 			location: THUMBNAIL_LOCATION,
 			navigate: noNavigation,
 			children: /* @__PURE__ */ jsx(FrameContext.Provider, {
 				value: frameContext,
-				children: t3
+				children: t6
 			})
 		});
-		$[6] = frameContext;
-		$[7] = t3;
-		$[8] = t4;
-	} else t4 = $[8];
-	return t4;
+		$[14] = frameContext;
+		$[15] = t6;
+		$[16] = t7;
+	} else t7 = $[16];
+	return t7;
 }
 const THUMBNAIL_LOCATION = {
 	href: "",
@@ -173,7 +197,7 @@ var ThumbnailErrorBoundary = class extends React.Component {
 		console.error("Camox: a block's thumbnail failed to render.", error);
 	}
 	render() {
-		return this.state.failed ? null : this.props.children;
+		return this.state.failed ? /* @__PURE__ */ jsx(RemovesLeft, { nodes: this.props.left }) : this.props.children;
 	}
 };
 function ThumbnailBlock(t0) {
@@ -188,6 +212,46 @@ function ThumbnailBlock(t0) {
 	} else t1 = $[1];
 	return t1;
 }
+/**
+* What another renderer document left in `slot`, read before this one renders into it. Each new
+* revision loads another renderer document, and removing the last one's frame never unmounts
+* what it rendered into the studio's frames, so its page stays there.
+*/
+function useLeftInSlot(slot) {
+	const $ = c(2);
+	let t0;
+	if ($[0] !== slot) {
+		t0 = () => [...slot.childNodes];
+		$[0] = slot;
+		$[1] = t0;
+	} else t0 = $[1];
+	const [left] = React.useState(t0);
+	return left;
+}
+/**
+* Removes the nodes another renderer left, once what replaces them commits: until then, the
+* frame keeps showing the last page rather than nothing.
+*/
+function RemovesLeft(t0) {
+	const $ = c(3);
+	const { nodes } = t0;
+	let t1;
+	let t2;
+	if ($[0] !== nodes) {
+		t1 = () => {
+			for (const node of nodes) node.remove();
+		};
+		t2 = [nodes];
+		$[0] = nodes;
+		$[1] = t1;
+		$[2] = t2;
+	} else {
+		t1 = $[1];
+		t2 = $[2];
+	}
+	React.useLayoutEffect(t1, t2);
+	return null;
+}
 function locationOf(href) {
 	const url = new URL(href);
 	return {
@@ -199,10 +263,11 @@ function locationOf(href) {
 }
 /** One frame's page, with what the studio says of the frame around it. */
 function RendererFrameContent(t0) {
-	const $ = c(59);
+	const $ = c(65);
 	const { frame: t1, connection, camoxApp, codeLoaded, projectUuid, runtimeBasePath } = t0;
 	const { frameId, slot, target } = t1;
 	const frameWindow = slot.ownerDocument.defaultView;
+	const left = useLeftInSlot(slot);
 	const frameElement = frameWindow?.frameElement ?? null;
 	let t2;
 	if ($[0] !== target.href) {
@@ -293,17 +358,14 @@ function RendererFrameContent(t0) {
 	} else t9 = $[18];
 	let t10;
 	if ($[19] !== camoxApp || $[20] !== codeLoaded || $[21] !== projectUuid || $[22] !== rendered || $[23] !== runtimeBasePath || $[24] !== target.derivedLayoutId || $[25] !== target.pathname) {
-		t10 = /* @__PURE__ */ jsx(React.Suspense, {
-			fallback: t9,
-			children: /* @__PURE__ */ jsx(FramePage, {
-				camoxApp,
-				codeLoaded,
-				projectUuid,
-				runtimeBasePath,
-				pathname: target.pathname,
-				derivedLayoutId: target.derivedLayoutId,
-				onRendered: rendered
-			})
+		t10 = /* @__PURE__ */ jsx(FramePage, {
+			camoxApp,
+			codeLoaded,
+			projectUuid,
+			runtimeBasePath,
+			pathname: target.pathname,
+			derivedLayoutId: target.derivedLayoutId,
+			onRendered: rendered
 		});
 		$[19] = camoxApp;
 		$[20] = codeLoaded;
@@ -315,110 +377,128 @@ function RendererFrameContent(t0) {
 		$[26] = t10;
 	} else t10 = $[26];
 	let t11;
-	if ($[27] !== failed || $[28] !== t10 || $[29] !== target.pathname) {
-		t11 = /* @__PURE__ */ jsx(FrameErrorBoundary, {
-			onError: failed,
-			children: t10
-		}, target.pathname);
-		$[27] = failed;
-		$[28] = t10;
-		$[29] = target.pathname;
-		$[30] = t11;
-	} else t11 = $[30];
+	if ($[27] !== left) {
+		t11 = /* @__PURE__ */ jsx(RemovesLeft, { nodes: left });
+		$[27] = left;
+		$[28] = t11;
+	} else t11 = $[28];
 	let t12;
-	if ($[31] !== t11 || $[32] !== t8) {
-		t12 = /* @__PURE__ */ jsx(React.Activity, {
-			mode: t8,
-			children: t11
+	if ($[29] !== t10 || $[30] !== t11) {
+		t12 = /* @__PURE__ */ jsxs(React.Suspense, {
+			fallback: t9,
+			children: [t10, t11]
 		});
-		$[31] = t11;
-		$[32] = t8;
-		$[33] = t12;
-	} else t12 = $[33];
+		$[29] = t10;
+		$[30] = t11;
+		$[31] = t12;
+	} else t12 = $[31];
 	let t13;
-	if ($[34] !== t12 || $[35] !== target.artifactStudio) {
-		t13 = /* @__PURE__ */ jsx(ArtifactStudioContext, {
-			value: target.artifactStudio,
+	if ($[32] !== failed || $[33] !== left || $[34] !== t12 || $[35] !== target.pathname) {
+		t13 = /* @__PURE__ */ jsx(FrameErrorBoundary, {
+			onError: failed,
+			left,
 			children: t12
-		});
+		}, target.pathname);
+		$[32] = failed;
+		$[33] = left;
 		$[34] = t12;
-		$[35] = target.artifactStudio;
+		$[35] = target.pathname;
 		$[36] = t13;
 	} else t13 = $[36];
 	let t14;
-	if ($[37] !== t13 || $[38] !== target.artifactsRun) {
-		t14 = /* @__PURE__ */ jsx(ArtifactsRunContext, {
-			value: target.artifactsRun,
+	if ($[37] !== t13 || $[38] !== t8) {
+		t14 = /* @__PURE__ */ jsx(React.Activity, {
+			mode: t8,
 			children: t13
 		});
 		$[37] = t13;
-		$[38] = target.artifactsRun;
+		$[38] = t8;
 		$[39] = t14;
 	} else t14 = $[39];
 	let t15;
-	if ($[40] !== t14 || $[41] !== target.editable) {
-		t15 = /* @__PURE__ */ jsx(EditableSurfaceContext, {
-			value: target.editable,
+	if ($[40] !== t14 || $[41] !== target.artifactStudio) {
+		t15 = /* @__PURE__ */ jsx(ArtifactStudioContext, {
+			value: target.artifactStudio,
 			children: t14
 		});
 		$[40] = t14;
-		$[41] = target.editable;
+		$[41] = target.artifactStudio;
 		$[42] = t15;
 	} else t15 = $[42];
 	let t16;
-	if ($[43] !== t15 || $[44] !== workspace) {
-		t16 = /* @__PURE__ */ jsx(CanvasWorkspaceContext, {
-			value: workspace,
+	if ($[43] !== t15 || $[44] !== target.artifactsRun) {
+		t16 = /* @__PURE__ */ jsx(ArtifactsRunContext, {
+			value: target.artifactsRun,
 			children: t15
 		});
 		$[43] = t15;
-		$[44] = workspace;
+		$[44] = target.artifactsRun;
 		$[45] = t16;
 	} else t16 = $[45];
 	let t17;
-	if ($[46] !== t16 || $[47] !== target.owner) {
-		t17 = /* @__PURE__ */ jsx(PreviewEditingOwnerContext, {
-			value: target.owner,
+	if ($[46] !== t16 || $[47] !== target.editable) {
+		t17 = /* @__PURE__ */ jsx(EditableSurfaceContext, {
+			value: target.editable,
 			children: t16
 		});
 		$[46] = t16;
-		$[47] = target.owner;
+		$[47] = target.editable;
 		$[48] = t17;
 	} else t17 = $[48];
 	let t18;
-	if ($[49] !== frameContext || $[50] !== t17) {
-		t18 = /* @__PURE__ */ jsx(FrameContext.Provider, {
-			value: frameContext,
+	if ($[49] !== t17 || $[50] !== workspace) {
+		t18 = /* @__PURE__ */ jsx(CanvasWorkspaceContext, {
+			value: workspace,
 			children: t17
 		});
-		$[49] = frameContext;
-		$[50] = t17;
+		$[49] = t17;
+		$[50] = workspace;
 		$[51] = t18;
 	} else t18 = $[51];
 	let t19;
-	if ($[52] !== location || $[53] !== navigate || $[54] !== t18) {
-		t19 = /* @__PURE__ */ jsx(NavigationProvider, {
-			location,
-			navigate,
+	if ($[52] !== t18 || $[53] !== target.owner) {
+		t19 = /* @__PURE__ */ jsx(PreviewEditingOwnerContext, {
+			value: target.owner,
 			children: t18
 		});
-		$[52] = location;
-		$[53] = navigate;
-		$[54] = t18;
-		$[55] = t19;
-	} else t19 = $[55];
-	const content = t19;
+		$[52] = t18;
+		$[53] = target.owner;
+		$[54] = t19;
+	} else t19 = $[54];
 	let t20;
-	if ($[56] !== content || $[57] !== target.locale) {
-		t20 = target.locale ? /* @__PURE__ */ jsx(ViewLocaleContext, {
+	if ($[55] !== frameContext || $[56] !== t19) {
+		t20 = /* @__PURE__ */ jsx(FrameContext.Provider, {
+			value: frameContext,
+			children: t19
+		});
+		$[55] = frameContext;
+		$[56] = t19;
+		$[57] = t20;
+	} else t20 = $[57];
+	let t21;
+	if ($[58] !== location || $[59] !== navigate || $[60] !== t20) {
+		t21 = /* @__PURE__ */ jsx(NavigationProvider, {
+			location,
+			navigate,
+			children: t20
+		});
+		$[58] = location;
+		$[59] = navigate;
+		$[60] = t20;
+		$[61] = t21;
+	} else t21 = $[61];
+	const content = t21;
+	let t22;
+	if ($[62] !== content || $[63] !== target.locale) {
+		t22 = target.locale ? /* @__PURE__ */ jsx(ViewLocaleContext, {
 			value: target.locale,
 			children: content
 		}) : content;
-		$[56] = content;
-		$[57] = target.locale;
-		$[58] = t20;
-	} else t20 = $[58];
-	return t20;
+		$[62] = content;
+		$[63] = target.locale;
+		$[64] = t22;
+	} else t22 = $[64];
+	return t22;
 }
 function _temp2() {
 	return _temp;
@@ -539,19 +619,23 @@ var FrameErrorBoundary = class extends React.Component {
 			role: "alert",
 			"data-camox-renderer-error": true,
 			style: ERROR_STYLE,
-			children: [/* @__PURE__ */ jsx("p", {
-				style: {
-					margin: 0,
-					fontWeight: 600
-				},
-				children: "This page couldn’t render."
-			}), /* @__PURE__ */ jsx("p", {
-				style: {
-					margin: "8px 0 0",
-					fontFamily: "ui-monospace, monospace"
-				},
-				children: this.state.error
-			})]
+			children: [
+				/* @__PURE__ */ jsx(RemovesLeft, { nodes: this.props.left }),
+				/* @__PURE__ */ jsx("p", {
+					style: {
+						margin: 0,
+						fontWeight: 600
+					},
+					children: "This page couldn’t render."
+				}),
+				/* @__PURE__ */ jsx("p", {
+					style: {
+						margin: "8px 0 0",
+						fontFamily: "ui-monospace, monospace"
+					},
+					children: this.state.error
+				})
+			]
 		});
 	}
 };

package/dist/features/renderer/rendererHost.js

@@ -6,14 +6,30 @@ import { createContentEditor } from "../../core/editing/contentEdits.js";
 import { LIVE_KEY_SCOPE, scopeOfKey } from "@camox/api-contract/query-keys";
 
 //#region src/features/renderer/rendererHost.ts
-const mirrored = {
-	preview: previewStore,
-	canvas: canvasStore
+/** The studio's state of each store the renderer mirrors. */
+const storeMessages = {
+	preview: () => ({
+		type: "store",
+		store: "preview",
+		context: previewStore.getSnapshot().context
+	}),
+	canvas: () => ({
+		type: "store",
+		store: "canvas",
+		context: canvasStore.getSnapshot().context
+	})
 };
+/** The stores the renderer forwards its events to, as the host applies them. */
 const forwarded = {
 	preview: previewStore,
 	referencePickerFocus
 };
+/** Applies an event the renderer forwarded to the studio's store. */
+const applyStoreEvent = (message) => {
+	const store = forwarded[message.store];
+	if (!store) return;
+	store.send(message.event);
+};
 /**
 * The host of the studio whose cache is `studioCache`, viewing the draft `draftScope` names, which
 * the renderer shows too. Without them, the renderer hears nothing of the studio's cache.
@@ -45,12 +61,8 @@ function createRendererHost({ studioCache, draftScope, queryClient, notify } = {
 	const post = (message) => {
 		if (welcomed) renderer?.(message);
 	};
-	const postStore = (store) => post({
-		type: "store",
-		store,
-		context: mirrored[store].getSnapshot().context
-	});
-	const subscriptions = Object.keys(mirrored).map((store) => mirrored[store].subscribe(() => postStore(store)));
+	const postStore = (store) => post(storeMessages[store]());
+	const subscriptions = [previewStore.subscribe(() => postStore("preview")), canvasStore.subscribe(() => postStore("canvas"))];
 	const shownScope = () => draftScope?.current() ?? LIVE_KEY_SCOPE;
 	const shown = (queryKey) => scopeOfKey(queryKey) === shownScope();
 	/** Whether a project room invalidation reaches the reads of the draft the renderer shows. */
@@ -103,7 +115,7 @@ function createRendererHost({ studioCache, draftScope, queryClient, notify } = {
 				if (message.sdkVersion !== SDK_VERSION) return setStatus("updating");
 				welcomed = true;
 				setStatus("connected");
-				for (const store of Object.keys(mirrored)) postStore(store);
+				for (const store of Object.keys(storeMessages)) postStore(store);
 				for (const [frameId, { slot, target }] of frames) post({
 					type: "frame",
 					frameId,
@@ -123,12 +135,7 @@ function createRendererHost({ studioCache, draftScope, queryClient, notify } = {
 				});
 				for (const listener of connectionListeners) listener();
 				return;
-			case "storeEvent": {
-				const store = forwarded[message.store];
-				if (!store) return;
-				store.send(message.event);
-				return;
-			}
+			case "storeEvent": return applyStoreEvent(message);
 			case "rendered": return frames.get(message.frameId)?.hears.rendered?.();
 			case "error": return frames.get(message.frameId)?.hears.failed?.(message.message);
 			case "navigate": return frames.get(message.frameId)?.hears.navigate?.(message.to);

package/dist/features/renderer/studioConnection.js

@@ -5,14 +5,21 @@ import { SDK_VERSION, deferredInbox } from "./protocol.js";
 import { answerFromCode } from "./definitionAnswers.js";
 
 //#region src/features/renderer/studioConnection.ts
+/** The stores of this document that take the studio's state as it is (`mirror`). */
 const mirrors = {
 	preview: previewStore,
 	canvas: canvasStore
 };
+/** The stores of this document whose events are forwarded to the studio's. */
 const forwards = {
 	preview: previewStore,
 	referencePickerFocus
 };
+/** Has this document's copy of a mirrored store take the studio's state. */
+const mirror = (message) => mirrors[message.store]?.send({
+	type: "mirror",
+	context: message.context
+});
 /**
 * Connects the renderer document to the studio through its handle. This document's stores then
 * mirror the studio's, its own events are forwarded to the studio, which owns their truth, and
@@ -64,10 +71,7 @@ function connectToStudio(handle, { queryClient, studioCache, draftScope, camoxAp
 				setFrames(frames.filter(({ frameId }) => frameId !== message.frameId));
 				return;
 			case "store":
-				mirrors[message.store]?.send({
-					type: "mirror",
-					context: message.context
-				});
+				mirror(message);
 				return;
 			case "draftStarted":
 				draftScope.enterStarted(message.draftId);

package/dist/features/runtime/loopbackFetch.d.ts

@@ -0,0 +1,8 @@
+//#region src/features/runtime/loopbackFetch.d.ts
+/**
+ * Browsers resolve any `*.localhost` name to loopback, but the Workers runtime asks the
+ * OS, which need not. Local dev servers (like the per-checkout API) use such names, so
+ * the dev worker reaches them on 127.0.0.1 instead.
+ */
+export declare function fetchLocalhostOnLoopback(fetch: typeof globalThis.fetch): typeof globalThis.fetch;
+//#endregion

package/dist/features/runtime/publicCache.d.ts

@@ -0,0 +1,21 @@
+//#region src/features/runtime/publicCache.d.ts
+/** Where a website's public renders are kept, and what they're kept under. */
+export interface PublicCache {
+  /** Opens Cloudflare's cache in the request's data center: `PUBLIC_CACHE_NAME`. */
+  cache: () => Promise<Cache>;
+  /** The project's Live cache key, which changes whenever Live does; null when unreadable. */
+  liveCacheKey: () => Promise<string | null>;
+  /** The website's build, so a release never serves pages naming the last release's assets. */
+  build: string;
+  waitUntil: (promise: Promise<unknown>) => void;
+}
+/** The named cache public renders are kept in. */
+export declare const PUBLIC_CACHE_NAME = "camox-public-renders";
+/** The project's Live cache key, as the API serves it from its edge cache. */
+export declare function readLiveCacheKey(apiUrl: string, projectUuid: string): Promise<string | null>;
+/**
+ * Answers a public request from the cache, or renders it and keeps the render when it may be
+ * shared. Without a Live cache key, it renders without the cache: nothing tells when Live changed.
+ */
+export declare function respondThroughPublicCache(request: Request, publicCache: PublicCache, render: () => Promise<Response | null>): Promise<Response | null>;
+//#endregion

package/dist/features/runtime/publishingDraft.d.ts

@@ -0,0 +1,4 @@
+//#region src/features/runtime/publishingDraft.d.ts
+/** Keeps the publishing draft a Worker's environment names, if it names one. */
+export declare function rememberPublishingDraft(env: unknown): void;
+//#endregion

package/dist/features/runtime/runtime.js

@@ -2,7 +2,8 @@ import { serializeJsonForHtml } from "../../lib/html.js";
 import { createRequestContext } from "../../core/requestContext.js";
 import { UNNAMED_DEFAULT_LOCALE, localizedPath, parseLocalePath } from "../../lib/locale-path.js";
 import { draftNamedBy } from "../../lib/draft-scope.js";
-import { buildClearServerAuthCookieHeader, getServerAuthCookieHeader } from "../../lib/server-auth-cookie.js";
+import { buildClearServerAuthCookieHeader, buildServerAuthCookieHeader, getServerAuthCookieHeader } from "../../lib/server-auth-cookie.js";
+import { getCookie, getSetCookie } from "../../lib/stored-auth-cookies.js";
 import { ARTIFACTS_PATH_PREFIX, RUNTIME_ROUTE_PATHS, matchRuntimeOwnedRoute } from "./runtimeRoutes.js";
 import { reads } from "../../lib/studio-reads.js";
 import { asCollectionItem, recordMarkdownTemplate, recordPageValues } from "../../core/recordItem.js";
@@ -79,7 +80,7 @@ const PUBLIC_ROUTE_KINDS = /* @__PURE__ */ new Set([
 */
 function isPublicRequest(request, options = {}) {
 	if (request.method !== "GET" && request.method !== "HEAD") return false;
-	if (isPrivateRender(request) || isPreviewHandoff(request, options)) return false;
+	if (isPrivateRender(request) || new URL(request.url).searchParams.has("ott")) return false;
 	const pathname = getRuntimePathname(request.url, options.runtimeBasePath);
 	return pathname !== null && PUBLIC_ROUTE_KINDS.has(matchRuntimeRoute(pathname).kind);
 }
@@ -559,6 +560,51 @@ function isPreviewHandoff(request, options) {
 	return searchParams.has("camox-preview") && searchParams.has("ott") && !!options.apiUrl && !!options.authenticationUrl && !!options.projectUuid && !!options.renderPage;
 }
 /**
+* Whether a request lands from the studio's sign-in with its one-time token, which the Worker
+* exchanges itself. A preview link's handoff checks its target in the browser first.
+*/
+function isSignInHandoff(request) {
+	const { searchParams } = new URL(request.url);
+	return request.method === "GET" && searchParams.has("ott") && !searchParams.has("camox-preview");
+}
+/**
+* Exchanges a sign-in's one-time token for the studio's session, sets the cookie that mirrors it,
+* and sends the browser back to the URL without the token. The page then renders for the member
+* at once, rather than for a visitor, then again once the browser signed in. Null when the
+* exchange fails: the page loads with the token, and the browser tries it and says what failed.
+*/
+async function createSignInResponse(request, apiUrl) {
+	const url = new URL(request.url);
+	let setCookie;
+	try {
+		const response = await fetch(`${apiUrl.replace(/\/+$/, "")}/api/auth/one-time-token/verify`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"Better-Auth-Cookie": ""
+			},
+			body: JSON.stringify({ token: url.searchParams.get("ott") })
+		});
+		if (!response.ok) return null;
+		setCookie = response.headers.get("Set-Better-Auth-Cookie");
+	} catch (error) {
+		console.error("[camox] Sign-in token exchange failed.", error);
+		return null;
+	}
+	const session = setCookie ? getCookie(getSetCookie(setCookie)) : "";
+	if (!session) return null;
+	url.searchParams.delete("ott");
+	return new Response(null, {
+		status: 302,
+		headers: {
+			Location: `${url.pathname}${url.search}`,
+			"Cache-Control": "private, no-store",
+			"Referrer-Policy": "no-referrer",
+			"Set-Cookie": buildServerAuthCookieHeader(session, { secure: url.protocol === "https:" })
+		}
+	});
+}
+/**
 * The alternates of the page a request renders, where it exists in each of the scope's locales,
 * and its head with their `hreflang` links. Without a head, there is none to add them to.
 */
@@ -1257,7 +1303,8 @@ async function createStudioHtmlResponse({ match, options, pathname, located, req
 		routeKind: match.kind,
 		runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
 		locale: located.locale,
-		locales: located.locales
+		locales: located.locales,
+		draftId: project ? getRequestDraftId(request) : void 0
 	};
 	if (dataOnly) return Response.json(studioRenderInput, { headers: {
 		"Cache-Control": "private, no-store",
@@ -1429,6 +1476,10 @@ async function handleCamoxRequest(request, options = {}) {
 		pathname,
 		request
 	});
+	if (options.apiUrl && isSignInHandoff(request)) {
+		const signedIn = await createSignInResponse(request, options.apiUrl);
+		if (signedIn) return signedIn;
+	}
 	const { apiUrl, projectUuid } = options;
 	const markdownPathname = parseMarkdownPath(pathname);
 	if (apiUrl && projectUuid && (markdownPathname || prefersMarkdown(request.headers.get("Accept") ?? ""))) {

package/dist/features/runtime/worker.js

@@ -1,7 +1,4 @@
-import { rememberPublishingDraft } from "./publishingDraft.js";
-import { fetchLocalhostOnLoopback } from "./loopbackFetch.js";
-import { PUBLIC_CACHE_NAME, readLiveCacheKey, respondThroughPublicCache } from "./publicCache.js";
-import { shouldHandleRequest, withDevHtml } from "./workerRequest.js";
+import { PUBLIC_CACHE_NAME, fetchLocalhostOnLoopback, readLiveCacheKey, rememberPublishingDraft, respondThroughPublicCache, shouldHandleRequest, withDevHtml } from "camox/_internal/workerRuntime";
 import { WorkerEntrypoint } from "cloudflare:workers";
 import { devHtml, handleCamoxRequest, isPublicRequest, publicCacheSource, readDefinitionSet, runtimeBasePath } from "virtual:camox/server";
 

package/dist/features/runtime/workerRequest.d.ts

@@ -0,0 +1,8 @@
+//#region src/features/runtime/workerRequest.d.ts
+export declare function shouldHandleRequest(request: Request, basePath: string): boolean;
+/** Adds what Vite injects into HTML in dev, such as its client and React Refresh. */
+export declare function withDevHtml(response: Response, html: {
+  head: string;
+  body: string;
+} | null): Promise<Response>;
+//#endregion

package/dist/features/runtime/workerRuntime.d.ts

@@ -0,0 +1,5 @@
+import { fetchLocalhostOnLoopback } from "./loopbackFetch.js";
+import { PUBLIC_CACHE_NAME, readLiveCacheKey, respondThroughPublicCache } from "./publicCache.js";
+import { rememberPublishingDraft } from "./publishingDraft.js";
+import { shouldHandleRequest, withDevHtml } from "./workerRequest.js";
+export { PUBLIC_CACHE_NAME, fetchLocalhostOnLoopback, readLiveCacheKey, rememberPublishingDraft, respondThroughPublicCache, shouldHandleRequest, withDevHtml };

package/dist/features/runtime/workerRuntime.js

@@ -0,0 +1,6 @@
+import { rememberPublishingDraft } from "./publishingDraft.js";
+import { fetchLocalhostOnLoopback } from "./loopbackFetch.js";
+import { PUBLIC_CACHE_NAME, readLiveCacheKey, respondThroughPublicCache } from "./publicCache.js";
+import { shouldHandleRequest, withDevHtml } from "./workerRequest.js";
+
+export { PUBLIC_CACHE_NAME, fetchLocalhostOnLoopback, readLiveCacheKey, rememberPublishingDraft, respondThroughPublicCache, shouldHandleRequest, withDevHtml };