From 7fc40d89bee91514d75596e7adba5b397e8435dc Mon Sep 17 00:00:00 2001
From: Jack McDade <jack@jackmcdade.com>
Date: Thu, 20 Aug 2026 15:44:54 -0400
Subject: [PATCH 1/5] Add shareable draft preview links

Login-free tokens for unpublished, scheduled, and working-copy entries, minted from the publish form.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 config/live_preview.php                       |  11 +
 lang/en/messages.php                          |   1 +
 .../js/components/entries/PublishForm.vue     |  48 +++-
 routes/cp.php                                 |   2 +
 src/Entries/Entry.php                         |   7 +
 .../CP/Collections/EntriesController.php      |   1 +
 .../EntrySharedPreviewController.php          |  30 +++
 src/Http/Responses/DataResponse.php           |   3 +-
 src/Providers/AppServiceProvider.php          |  11 +
 src/Tokens/Handlers/SharedPreview.php         |  37 +++
 .../Entries/SharedPreviewEntryTest.php        | 159 ++++++++++++
 .../Feature/Entries/ViewSharedPreviewTest.php | 240 ++++++++++++++++++
 12 files changed, 547 insertions(+), 3 deletions(-)
 create mode 100644 src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php
 create mode 100644 src/Tokens/Handlers/SharedPreview.php
 create mode 100644 tests/Feature/Entries/SharedPreviewEntryTest.php
 create mode 100644 tests/Feature/Entries/ViewSharedPreviewTest.php

diff --git a/config/live_preview.php b/config/live_preview.php
index 6e213fc953f..4f5b4133813 100644
--- a/config/live_preview.php
+++ b/config/live_preview.php
@@ -69,4 +69,15 @@
 
     'hot_reload_contents' => true,
 
+    /*
+    |--------------------------------------------------------------------------
+    | Shared Preview Links
+    |--------------------------------------------------------------------------
+    |
+    | How long shareable draft preview links should remain valid, in minutes.
+    |
+    */
+
+    'shared_link_expiry' => 1440,
+
 ];
diff --git a/lang/en/messages.php b/lang/en/messages.php
index 9fa65df7fcd..f09a543bcf5 100644
--- a/lang/en/messages.php
+++ b/lang/en/messages.php
@@ -245,6 +245,7 @@
     'session_expiry_logging_out_in_seconds' => 'You have been inactive for a while and will be logged out in :seconds seconds.',
     'session_expiry_new_window' => 'This will open in a new window. Return here after authenticating.',
     'set_new_password_instructions' => 'Confirm your email address and create a new password.',
+    'shared_preview_link_copied' => 'Preview link copied. Expires in :hours hours.',
     'show_slugs_instructions' => 'Show slugs in the tree view.',
     'site_configure_attributes_instructions' => 'Add arbitrary attributes to your site\'s config which can be accessed in your templates. [Learn more](https://statamic.dev/multi-site#additional-attributes).',
     'site_configure_handle_instructions' => 'A unique reference to this site. This cannot be easily changed later.',
diff --git a/resources/js/components/entries/PublishForm.vue b/resources/js/components/entries/PublishForm.vue
index 2c888064b35..e8ca97afa49 100644
--- a/resources/js/components/entries/PublishForm.vue
+++ b/resources/js/components/entries/PublishForm.vue
@@ -101,8 +101,8 @@
                 <PublishTabs>
                     <template #actions>
                         <div class="space-y-6">
-                            <!-- Live Preview / Visit URL Buttons -->
-                            <div class="flex flex-wrap gap-3 lg:gap-4" v-if="showLivePreviewButton || showVisitUrlButton">
+                            <!-- Live Preview / Visit URL / Copy Preview Link Buttons -->
+                            <div class="flex flex-wrap gap-3 lg:gap-4" v-if="showLivePreviewButton || showVisitUrlButton || showCopyPreviewLinkButton">
                                 <Button
                                     :text="__('Live Preview')"
                                     class="flex-1"
@@ -118,6 +118,14 @@
                                     target="_blank"
                                     v-if="showVisitUrlButton"
                                 />
+                                <Button
+                                    :text="__('Copy Preview Link')"
+                                    class="flex-1"
+                                    icon="link"
+                                    :loading="copyingPreviewLink"
+                                    @click="copyPreviewLink"
+                                    v-if="showCopyPreviewLinkButton"
+                                />
                             </div>
 
                             <!-- Published Switch -->
@@ -390,6 +398,7 @@ export default {
             confirmingPublish: false,
             readOnly: this.initialReadOnly,
             permalink: this.initialPermalink,
+            copyingPreviewLink: false,
 
             saveKeyBinding: null,
             quickSaveKeyBinding: null,
@@ -464,6 +473,20 @@ export default {
             return !!this.permalink;
         },
 
+        showCopyPreviewLinkButton() {
+            if (this.isCreating || !this.isBase || !this.permalink || !this.actions.sharedPreview) {
+                return false;
+            }
+
+            if (this.isWorkingCopy) {
+                return true;
+            }
+
+            const status = this.activeLocalization?.status;
+
+            return this.isDraft || status === 'scheduled' || status === 'expired';
+        },
+
         showLocalizationSelector() {
             return this.localizations.length > 1;
         },
@@ -742,6 +765,27 @@ export default {
                 .then(() => (this.tabsVisible = true));
         },
 
+        async copyPreviewLink() {
+            this.copyingPreviewLink = true;
+
+            try {
+                const { data } = await this.$axios.post(this.actions.sharedPreview);
+
+                try {
+                    await navigator.clipboard.writeText(data.url);
+                    this.$toast.success(
+                        __('messages.shared_preview_link_copied', { hours: data.expires_in_hours }),
+                    );
+                } catch {
+                    Statamic.$callbacks.call('copyToClipboard', data.url);
+                }
+            } catch {
+                this.$toast.error(__('Unable to copy preview link'));
+            } finally {
+                this.copyingPreviewLink = false;
+            }
+        },
+
         closeLivePreview() {
             this.isPreviewing = false;
             this.tabsVisible = true;
diff --git a/routes/cp.php b/routes/cp.php
index 2626fc0f7f2..750c4f1233e 100644
--- a/routes/cp.php
+++ b/routes/cp.php
@@ -40,6 +40,7 @@
 use Statamic\Http\Controllers\CP\Collections\EntryActionController;
 use Statamic\Http\Controllers\CP\Collections\EntryPreviewController;
 use Statamic\Http\Controllers\CP\Collections\EntryRevisionsController;
+use Statamic\Http\Controllers\CP\Collections\EntrySharedPreviewController;
 use Statamic\Http\Controllers\CP\Collections\LocalizeEntryController;
 use Statamic\Http\Controllers\CP\Collections\PublishedEntriesController;
 use Statamic\Http\Controllers\CP\Collections\ReorderCollectionBlueprintsController;
@@ -209,6 +210,7 @@
             Route::post('restore-revision', RestoreEntryRevisionController::class)->name('collections.entries.restore-revision');
             Route::post('preview', [EntryPreviewController::class, 'edit'])->name('collections.entries.preview.edit');
             Route::get('preview', [EntryPreviewController::class, 'show'])->name('collections.entries.preview.popout');
+            Route::post('shared-preview', [EntrySharedPreviewController::class, 'store'])->name('collections.entries.shared-preview');
             Route::patch('/', [EntriesController::class, 'update'])->name('collections.entries.update');
             Route::get('{slug}', fn ($collection, $entry, $slug) => redirect($entry->editUrl()));
         });
diff --git a/src/Entries/Entry.php b/src/Entries/Entry.php
index 1bf3e4c0f84..2bb5cb8aa4a 100644
--- a/src/Entries/Entry.php
+++ b/src/Entries/Entry.php
@@ -360,6 +360,13 @@ public function livePreviewUrl()
             : null;
     }
 
+    public function sharedPreviewUrl()
+    {
+        return $this->collection()->route($this->locale())
+            ? $this->cpUrl('collections.entries.shared-preview')
+            : null;
+    }
+
     protected function cpUrl($route)
     {
         if (! $id = $this->id()) {
diff --git a/src/Http/Controllers/CP/Collections/EntriesController.php b/src/Http/Controllers/CP/Collections/EntriesController.php
index acd8b573d60..0e1cf97a2f0 100644
--- a/src/Http/Controllers/CP/Collections/EntriesController.php
+++ b/src/Http/Controllers/CP/Collections/EntriesController.php
@@ -130,6 +130,7 @@ public function edit(Request $request, $collection, $entry)
                 'restore' => $entry->restoreRevisionUrl(),
                 'createRevision' => $entry->createRevisionUrl(),
                 'editBlueprint' => cp_route('blueprints.collections.edit', [$collection, $blueprint]),
+                'sharedPreview' => $entry->sharedPreviewUrl(),
             ],
             'values' => array_merge($values, ['id' => $entry->id()]),
             'extraValues' => $extraValues,
diff --git a/src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php b/src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php
new file mode 100644
index 00000000000..391bf67e17c
--- /dev/null
+++ b/src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace Statamic\Http\Controllers\CP\Collections;
+
+use Statamic\Facades\Token;
+use Statamic\Http\Controllers\CP\CpController;
+use Statamic\Tokens\Handlers\SharedPreview;
+
+class EntrySharedPreviewController extends CpController
+{
+    public function store($collection, $entry)
+    {
+        $this->authorize('view', $entry);
+
+        $minutes = (int) config('statamic.live_preview.shared_link_expiry', 1440);
+
+        $token = tap(
+            Token::make(null, SharedPreview::class, [
+                'reference' => $entry->reference(),
+            ])->expireAt(now()->addMinutes($minutes))
+        )->save();
+
+        $url = $entry->absoluteUrl();
+
+        return [
+            'url' => $url.(str_contains($url, '?') ? '&' : '?').'token='.$token->token(),
+            'expires_in_hours' => (int) ceil($minutes / 60),
+        ];
+    }
+}
diff --git a/src/Http/Responses/DataResponse.php b/src/Http/Responses/DataResponse.php
index 7ae6885df3e..8710f1c175c 100644
--- a/src/Http/Responses/DataResponse.php
+++ b/src/Http/Responses/DataResponse.php
@@ -138,7 +138,8 @@ protected function handlePrivateEntries()
 
     private function isLivePreviewing()
     {
-        return $this->request->isLivePreviewOf($this->data);
+        return $this->request->isLivePreviewOf($this->data)
+            || $this->request->isSharedPreviewOf($this->data);
     }
 
     protected function view()
diff --git a/src/Providers/AppServiceProvider.php b/src/Providers/AppServiceProvider.php
index b30e1d23b6a..e7c82c0e169 100644
--- a/src/Providers/AppServiceProvider.php
+++ b/src/Providers/AppServiceProvider.php
@@ -26,6 +26,7 @@
 use Statamic\Stache\Query\RevisionQueryBuilder;
 use Statamic\Statamic;
 use Statamic\Tokens\Handlers\LivePreview;
+use Statamic\Tokens\Handlers\SharedPreview;
 use Statamic\View\Scaffolding\TemplateGenerator;
 
 use function Statamic\trans as __;
@@ -127,6 +128,16 @@ public function boot()
             return $item && $previewItem && method_exists($item, 'reference') && $previewItem->reference() === $item->reference();
         });
 
+        Request::macro('isSharedPreviewOf', function ($item) {
+            $token = $this->statamicToken();
+
+            if (! $token || $token->handler() !== SharedPreview::class) {
+                return false;
+            }
+
+            return $item && method_exists($item, 'reference') && $token->get('reference') === $item->reference();
+        });
+
         TrimStrings::skipWhen(function (Request $request) {
             $route = config('statamic.cp.route');
 
diff --git a/src/Tokens/Handlers/SharedPreview.php b/src/Tokens/Handlers/SharedPreview.php
new file mode 100644
index 00000000000..b25442936e5
--- /dev/null
+++ b/src/Tokens/Handlers/SharedPreview.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Statamic\Tokens\Handlers;
+
+use Closure;
+use Statamic\Contracts\Tokens\Token;
+use Statamic\Facades\Data;
+
+class SharedPreview
+{
+    public function handle(Token $token, $request, Closure $next)
+    {
+        $item = Data::find($token->get('reference'));
+
+        if (! $item) {
+            return $next($request);
+        }
+
+        if (
+            method_exists($item, 'hasWorkingCopy')
+            && $item->revisionsEnabled()
+            && $item->hasWorkingCopy()
+        ) {
+            $item = $item->fromWorkingCopy();
+        }
+
+        if (method_exists($item, 'repository')) {
+            $item->repository()->substitute($item);
+        }
+
+        $response = $next($request);
+
+        $response->headers->set('X-Statamic-Shared-Preview', true);
+
+        return $response;
+    }
+}
diff --git a/tests/Feature/Entries/SharedPreviewEntryTest.php b/tests/Feature/Entries/SharedPreviewEntryTest.php
new file mode 100644
index 00000000000..160d347e739
--- /dev/null
+++ b/tests/Feature/Entries/SharedPreviewEntryTest.php
@@ -0,0 +1,159 @@
+<?php
+
+namespace Tests\Feature\Entries;
+
+use Facades\Statamic\Tokens\Generator;
+use Facades\Tests\Factories\EntryFactory;
+use Illuminate\Support\Carbon;
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Collection;
+use Statamic\Facades\Token;
+use Statamic\Facades\User;
+use Statamic\Tokens\Handlers\SharedPreview;
+use Tests\FakesRoles;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class SharedPreviewEntryTest extends TestCase
+{
+    use FakesRoles;
+    use PreventSavingStacheItemsToDisk;
+
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        Carbon::setTestNow(Carbon::parse('2024-01-01 12:00:00'));
+        optional(Token::find('test-shared-token'))->delete();
+    }
+
+    public function tearDown(): void
+    {
+        optional(Token::find('test-shared-token'))->delete();
+
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function it_mints_a_shared_preview_token()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        $entry = EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(false)
+            ->data(['title' => 'The Existing Entry'])
+            ->create();
+
+        Generator::shouldReceive('generate')->andReturn('test-shared-token');
+
+        $this
+            ->actingAs($this->user())
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview')
+            ->assertOk()
+            ->assertJsonPath('url', 'http://localhost/blog/the-existing-entry?token=test-shared-token')
+            ->assertJsonPath('expires_in_hours', 24);
+
+        $token = Token::find('test-shared-token');
+
+        $this->assertNotNull($token);
+        $this->assertEquals(SharedPreview::class, $token->handler());
+        $this->assertEquals($entry->reference(), $token->get('reference'));
+        $this->assertTrue($token->expiry()->eq(Carbon::now()->addMinutes(1440)));
+    }
+
+    #[Test]
+    public function it_mints_a_token_with_a_configured_expiry()
+    {
+        config(['statamic.live_preview.shared_link_expiry' => 60]);
+
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(false)
+            ->create();
+
+        Generator::shouldReceive('generate')->andReturn('test-shared-token');
+
+        $this
+            ->actingAs($this->user())
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview')
+            ->assertOk()
+            ->assertJsonPath('expires_in_hours', 1);
+
+        $token = Token::find('test-shared-token');
+
+        $this->assertTrue($token->expiry()->eq(Carbon::now()->addMinutes(60)));
+    }
+
+    #[Test]
+    public function it_can_be_minted_with_view_permission()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(false)
+            ->create();
+
+        $this->setTestRoles(['viewer' => ['access cp', 'view blog entries']]);
+        $user = User::make()->assignRole('viewer')->save();
+
+        Generator::shouldReceive('generate')->andReturn('test-shared-token');
+
+        $this
+            ->actingAs($user)
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview')
+            ->assertOk()
+            ->assertJsonPath('url', 'http://localhost/blog/the-existing-entry?token=test-shared-token');
+    }
+
+    #[Test]
+    public function it_doesnt_mint_a_token_without_permission()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(false)
+            ->create();
+
+        $this->setTestRoles(['viewer' => ['access cp']]);
+        $user = User::make()->assignRole('viewer')->save();
+
+        $this
+            ->actingAs($user)
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview')
+            ->assertForbidden();
+
+        $this->assertNull(Token::find('test-shared-token'));
+    }
+
+    #[Test]
+    public function guests_cannot_mint_tokens()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(false)
+            ->create();
+
+        $this
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview')
+            ->assertUnauthorized();
+    }
+
+    private function user()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'edit blog entries']]);
+
+        return User::make()->assignRole('test')->save();
+    }
+}
diff --git a/tests/Feature/Entries/ViewSharedPreviewTest.php b/tests/Feature/Entries/ViewSharedPreviewTest.php
new file mode 100644
index 00000000000..f13d5df9004
--- /dev/null
+++ b/tests/Feature/Entries/ViewSharedPreviewTest.php
@@ -0,0 +1,240 @@
+<?php
+
+namespace Tests\Feature\Entries;
+
+use Facades\Tests\Factories\EntryFactory;
+use Illuminate\Support\Carbon;
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Blueprint;
+use Statamic\Facades\Collection;
+use Statamic\Facades\Token;
+use Statamic\Tokens\Handlers\SharedPreview;
+use Tests\FakesViews;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class ViewSharedPreviewTest extends TestCase
+{
+    use FakesViews;
+    use PreventSavingStacheItemsToDisk;
+
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->withStandardFakeViews();
+        $this->withStandardBlueprints();
+
+        Carbon::setTestNow(Carbon::parse('2024-01-01 12:00:00'));
+    }
+
+    #[Test]
+    public function unpublished_drafts_are_visible_with_a_shared_preview_token()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(false)
+            ->data(['content' => 'Draft content'])
+            ->create();
+
+        $token = $this->tokenFor($entry);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertOk()
+            ->assertHeader('X-Statamic-Draft', true)
+            ->assertHeader('X-Statamic-Shared-Preview', true)
+            ->assertSee('Draft content');
+    }
+
+    #[Test]
+    public function unpublished_drafts_are_not_visible_without_a_token()
+    {
+        $this->withStandardFakeErrorViews();
+
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(false)
+            ->data(['content' => 'Draft content'])
+            ->create();
+
+        $this->get('/blog/about')->assertNotFound();
+    }
+
+    #[Test]
+    public function tokens_for_a_different_entry_do_not_unlock_drafts()
+    {
+        $this->withStandardFakeErrorViews();
+
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(false)
+            ->data(['content' => 'Draft content'])
+            ->create();
+
+        $other = EntryFactory::id('2')
+            ->collection('blog')
+            ->slug('other')
+            ->published(false)
+            ->create();
+
+        $token = $this->tokenFor($other);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertNotFound();
+    }
+
+    #[Test]
+    public function expired_tokens_do_not_unlock_drafts()
+    {
+        $this->withStandardFakeErrorViews();
+
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(false)
+            ->data(['content' => 'Draft content'])
+            ->create();
+
+        $token = $this->tokenFor($entry, Carbon::now()->subMinute());
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertNotFound();
+    }
+
+    #[Test]
+    public function future_private_entries_are_visible_with_a_shared_preview_token()
+    {
+        Collection::make('blog')
+            ->routes('/blog/{slug}')
+            ->dated(true)
+            ->futureDateBehavior('private')
+            ->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->date('2024-01-02')
+            ->published(true)
+            ->data(['content' => 'Scheduled content'])
+            ->create();
+
+        $token = $this->tokenFor($entry);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertOk()
+            ->assertHeader('X-Statamic-Private', true)
+            ->assertHeader('X-Statamic-Shared-Preview', true)
+            ->assertSee('Scheduled content');
+    }
+
+    #[Test]
+    public function working_copy_content_is_served_when_revisions_are_enabled()
+    {
+        config(['statamic.revisions.enabled' => true]);
+
+        Collection::make('blog')
+            ->routes('/blog/{slug}')
+            ->revisionsEnabled(true)
+            ->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(true)
+            ->data(['content' => 'Published content'])
+            ->create();
+
+        tap($entry->makeWorkingCopy(), function ($copy) {
+            $attrs = $copy->attributes();
+            $attrs['data']['content'] = 'Working copy content';
+            $copy->attributes($attrs);
+        })->save();
+
+        $token = $this->tokenFor($entry);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertOk()
+            ->assertHeader('X-Statamic-Shared-Preview', true)
+            ->assertSee('Working copy content')
+            ->assertDontSee('Published content');
+
+        $entry->deleteWorkingCopy();
+    }
+
+    #[Test]
+    public function published_entries_render_normally_with_a_token()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(true)
+            ->data(['content' => 'Live content'])
+            ->create();
+
+        $token = $this->tokenFor($entry);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertOk()
+            ->assertHeader('X-Statamic-Shared-Preview', true)
+            ->assertHeaderMissing('X-Statamic-Draft')
+            ->assertSee('Live content');
+    }
+
+    #[Test]
+    public function deleted_entries_404_even_with_a_token()
+    {
+        $this->withStandardFakeErrorViews();
+
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(false)
+            ->data(['content' => 'Draft content'])
+            ->create();
+
+        $token = $this->tokenFor($entry);
+
+        $entry->delete();
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertNotFound();
+    }
+
+    private function tokenFor($entry, ?Carbon $expiresAt = null)
+    {
+        $token = Token::make(null, SharedPreview::class, [
+            'reference' => $entry->reference(),
+        ])->expireAt($expiresAt ?? Carbon::now()->addDay());
+
+        $token->save();
+
+        return $token;
+    }
+
+    private function withStandardBlueprints()
+    {
+        Blueprint::shouldReceive('in')->withAnyArgs()->andReturn(collect([new \Statamic\Fields\Blueprint]));
+    }
+}

From 4db3f7af4f301313f73a34eb2bf2cafb83d56b67 Mon Sep 17 00:00:00 2001
From: Jack McDade <jack@jackmcdade.com>
Date: Thu, 20 Aug 2026 17:51:47 -0400
Subject: [PATCH 2/5] Squeeze all the buttons in one row

---
 .../js/components/entries/PublishForm.vue     | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/resources/js/components/entries/PublishForm.vue b/resources/js/components/entries/PublishForm.vue
index e8ca97afa49..d22f5699722 100644
--- a/resources/js/components/entries/PublishForm.vue
+++ b/resources/js/components/entries/PublishForm.vue
@@ -101,27 +101,31 @@
                 <PublishTabs>
                     <template #actions>
                         <div class="space-y-6">
-                            <!-- Live Preview / Visit URL / Copy Preview Link Buttons -->
-                            <div class="flex flex-wrap gap-3 lg:gap-4" v-if="showLivePreviewButton || showVisitUrlButton || showCopyPreviewLinkButton">
+                            <!-- Live Preview / Visit URL / Share Buttons -->
+                            <div
+                                class="flex"
+                                :class="showCopyPreviewLinkButton ? 'gap-2' : 'flex-wrap gap-3 lg:gap-4'"
+                                v-if="showLivePreviewButton || showVisitUrlButton || showCopyPreviewLinkButton"
+                            >
                                 <Button
-                                    :text="__('Live Preview')"
-                                    class="flex-1"
+                                    :text="showCopyPreviewLinkButton ? __('Preview') : __('Live Preview')"
+                                    :class="showCopyPreviewLinkButton ? 'min-w-0 flex-1 px-2!' : 'flex-1'"
                                     icon="live-preview"
                                     @click="openLivePreview"
                                     v-if="showLivePreviewButton"
                                 />
                                 <Button
                                     :href="permalink"
-                                    :text="__('Visit URL')"
-                                    class="flex-1"
+                                    :text="showCopyPreviewLinkButton ? __('Visit') : __('Visit URL')"
+                                    :class="showCopyPreviewLinkButton ? 'min-w-0 flex-1 px-2!' : 'flex-1'"
                                     icon="external-link"
                                     target="_blank"
                                     v-if="showVisitUrlButton"
                                 />
                                 <Button
-                                    :text="__('Copy Preview Link')"
-                                    class="flex-1"
-                                    icon="link"
+                                    :text="__('Share')"
+                                    class="min-w-0 flex-1 px-2!"
+                                    icon="share-link"
                                     :loading="copyingPreviewLink"
                                     @click="copyPreviewLink"
                                     v-if="showCopyPreviewLinkButton"

From 1e80020d45d149b2921e10d54b915c88f60eb534 Mon Sep 17 00:00:00 2001
From: Jack McDade <jack@jackmcdade.com>
Date: Thu, 20 Aug 2026 20:36:16 -0400
Subject: [PATCH 3/5] Improve shared preview links

Pin specific revisions, reuse unexpired tokens, honor preview targets, skip protect schemes, and show a draft banner. Share from revision history is an icon with a tooltip.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 lang/en/messages.php                          |   2 +
 .../js/components/entries/PublishForm.vue     |   3 +-
 .../components/revision-history/History.vue   |   2 +
 .../components/revision-history/Revision.vue  |  39 ++++++-
 src/CP/SharedPreview.php                      |  90 +++++++++++++++
 src/Contracts/Tokens/TokenRepository.php      |   4 +
 src/Entries/Entry.php                         |   2 +-
 src/Facades/Token.php                         |   1 +
 .../EntrySharedPreviewController.php          |  27 +++--
 src/Http/Responses/DataResponse.php           |  50 +++++++++
 src/Tokens/FileTokenRepository.php            |  12 ++
 src/Tokens/Handlers/SharedPreview.php         |  21 ++--
 .../Entries/SharedPreviewEntryTest.php        |  93 ++++++++++++++++
 .../Feature/Entries/ViewSharedPreviewTest.php | 103 +++++++++++++++++-
 tests/Tokens/TokenRepositoryTest.php          |  14 +++
 15 files changed, 434 insertions(+), 29 deletions(-)
 create mode 100644 src/CP/SharedPreview.php

diff --git a/lang/en/messages.php b/lang/en/messages.php
index f09a543bcf5..461b71d2877 100644
--- a/lang/en/messages.php
+++ b/lang/en/messages.php
@@ -245,6 +245,8 @@
     'session_expiry_logging_out_in_seconds' => 'You have been inactive for a while and will be logged out in :seconds seconds.',
     'session_expiry_new_window' => 'This will open in a new window. Return here after authenticating.',
     'set_new_password_instructions' => 'Confirm your email address and create a new password.',
+    'shared_preview_banner' => 'Draft preview · Expires :date',
+    'shared_preview_banner_revision' => 'Revision preview · Expires :date',
     'shared_preview_link_copied' => 'Preview link copied. Expires in :hours hours.',
     'show_slugs_instructions' => 'Show slugs in the tree view.',
     'site_configure_attributes_instructions' => 'Add arbitrary attributes to your site\'s config which can be accessed in your templates. [Learn more](https://statamic.dev/multi-site#additional-attributes).',
diff --git a/resources/js/components/entries/PublishForm.vue b/resources/js/components/entries/PublishForm.vue
index d22f5699722..5036dc4e018 100644
--- a/resources/js/components/entries/PublishForm.vue
+++ b/resources/js/components/entries/PublishForm.vue
@@ -217,6 +217,7 @@
             <revision-history
                 :index-url="actions.revisions"
                 :restore-url="actions.restore"
+                :shared-preview-url="actions.sharedPreview"
                 :reference="initialReference"
                 :can-restore-revisions="!readOnly"
                 @closed="$refs.revisionHistoryStack.close()"
@@ -478,7 +479,7 @@ export default {
         },
 
         showCopyPreviewLinkButton() {
-            if (this.isCreating || !this.isBase || !this.permalink || !this.actions.sharedPreview) {
+            if (this.isCreating || !this.isBase || !this.actions.sharedPreview) {
                 return false;
             }
 
diff --git a/resources/js/components/revision-history/History.vue b/resources/js/components/revision-history/History.vue
index bcc40de32df..cb6b538398c 100644
--- a/resources/js/components/revision-history/History.vue
+++ b/resources/js/components/revision-history/History.vue
@@ -18,6 +18,7 @@
                         :key="revision.date"
                         :revision="revision"
                         :restore-url="restoreUrl"
+                        :shared-preview-url="sharedPreviewUrl"
                         :reference="reference"
                         :can-restore-revisions="canRestoreRevisions"
                         :is-last="index === group.revisions.length - 1"
@@ -47,6 +48,7 @@ export default {
     props: {
         indexUrl: String,
         restoreUrl: String,
+        sharedPreviewUrl: String,
         reference: String,
         canRestoreRevisions: Boolean,
     },
diff --git a/resources/js/components/revision-history/Revision.vue b/resources/js/components/revision-history/Revision.vue
index 211e06cdfee..a2ddb373398 100644
--- a/resources/js/components/revision-history/Revision.vue
+++ b/resources/js/components/revision-history/Revision.vue
@@ -47,6 +47,18 @@
                               }[revision.action]
                     "
                 />
+                <Button
+                    v-if="sharedPreviewUrl"
+                    icon="share-link"
+                    icon-only
+                    size="xs"
+                    variant="ghost"
+                    inset
+                    :aria-label="__('Share Revision')"
+                    v-tooltip="__('Share Revision')"
+                    :loading="copyingPreviewLink"
+                    @click.stop="copyPreviewLink"
+                />
             </div>
 
             <revision-preview
@@ -74,7 +86,7 @@
 import RestoreRevision from './Restore.vue';
 import RevisionPreview from './Preview.vue';
 import DateFormatter from '@/components/DateFormatter.js';
-import { Subheading, Badge, Avatar } from '@/components/ui';
+import { Subheading, Badge, Avatar, Button } from '@/components/ui';
 
 export default {
     components: {
@@ -83,11 +95,13 @@ export default {
         Subheading,
         Badge,
         Avatar,
+        Button,
     },
 
     props: {
         revision: Object,
         restoreUrl: String,
+        sharedPreviewUrl: String,
         reference: String,
         canRestoreRevisions: Boolean,
         isLast: Boolean,
@@ -96,6 +110,7 @@ export default {
     data() {
         return {
             showDetails: false,
+            copyingPreviewLink: false,
             componentProps: {
                 initialActions: 'actions',
                 collectionTitle: 'collection.title',
@@ -134,6 +149,28 @@ export default {
 
             this.showDetails = true;
         },
+
+        async copyPreviewLink() {
+            this.copyingPreviewLink = true;
+
+            try {
+                const payload = this.revision.action === 'working' ? {} : { revision: this.revision.date };
+                const { data } = await this.$axios.post(this.sharedPreviewUrl, payload);
+
+                try {
+                    await navigator.clipboard.writeText(data.url);
+                    this.$toast.success(
+                        __('messages.shared_preview_link_copied', { hours: data.expires_in_hours }),
+                    );
+                } catch {
+                    Statamic.$callbacks.call('copyToClipboard', data.url);
+                }
+            } catch {
+                this.$toast.error(__('Unable to copy preview link'));
+            } finally {
+                this.copyingPreviewLink = false;
+            }
+        },
     },
 };
 </script>
diff --git a/src/CP/SharedPreview.php b/src/CP/SharedPreview.php
new file mode 100644
index 00000000000..4f51b29c06e
--- /dev/null
+++ b/src/CP/SharedPreview.php
@@ -0,0 +1,90 @@
+<?php
+
+namespace Statamic\CP;
+
+use Statamic\Contracts\Tokens\Token as TokenContract;
+use Statamic\Facades\Data;
+use Statamic\Facades\Token;
+use Statamic\Facades\URL;
+use Statamic\Tokens\Handlers\SharedPreview as Handler;
+
+class SharedPreview
+{
+    public function tokenize($item, ?int $revision = null): TokenContract
+    {
+        if ($existing = $this->existing($item, $revision)) {
+            return $existing;
+        }
+
+        $minutes = (int) config('statamic.live_preview.shared_link_expiry', 1440);
+
+        $data = ['reference' => $item->reference()];
+
+        if ($revision) {
+            $data['revision'] = $revision;
+        }
+
+        return tap(
+            Token::make(null, Handler::class, $data)->expireAt(now()->addMinutes($minutes))
+        )->save();
+    }
+
+    public function existing($item, ?int $revision = null): ?TokenContract
+    {
+        return Token::all()->first(function ($token) use ($item, $revision) {
+            return $token->handler() === Handler::class
+                && $token->get('reference') === $item->reference()
+                && $token->get('revision') == $revision;
+        });
+    }
+
+    public function item(TokenContract $token)
+    {
+        $item = Data::find($token->get('reference'));
+
+        if (! $item) {
+            return null;
+        }
+
+        if ($timestamp = $token->get('revision')) {
+            $revision = $this->findRevision($item, $timestamp);
+
+            return $revision ? $item->makeFromRevision($revision) : false;
+        }
+
+        if (
+            method_exists($item, 'hasWorkingCopy')
+            && $item->revisionsEnabled()
+            && $item->hasWorkingCopy()
+        ) {
+            return $item->fromWorkingCopy();
+        }
+
+        return $item;
+    }
+
+    public function url($item, TokenContract $token, int $target = 0): string
+    {
+        $preview = $this->item($token);
+
+        if (! $preview) {
+            $preview = $item;
+        }
+
+        $targets = method_exists($preview, 'previewTargets') ? $preview->previewTargets() : collect();
+        $url = URL::makeAbsolute($targets[$target]['url'] ?? $preview->absoluteUrl());
+
+        return $url.(str_contains((string) $url, '?') ? '&' : '?').'token='.$token->token();
+    }
+
+    public function findRevision($item, $timestamp)
+    {
+        if (! method_exists($item, 'revisions')) {
+            return null;
+        }
+
+        return $item->revisions()->first(
+            fn ($revision) => (int) $revision->date()->timestamp === (int) $timestamp
+        );
+    }
+}
diff --git a/src/Contracts/Tokens/TokenRepository.php b/src/Contracts/Tokens/TokenRepository.php
index 84b23977ff9..18b0b69b196 100644
--- a/src/Contracts/Tokens/TokenRepository.php
+++ b/src/Contracts/Tokens/TokenRepository.php
@@ -2,12 +2,16 @@
 
 namespace Statamic\Contracts\Tokens;
 
+use Illuminate\Support\Collection;
+
 interface TokenRepository
 {
     public function make(?string $token, string $handler, array $data = []): Token;
 
     public function find(string $token): ?Token;
 
+    public function all(): Collection;
+
     public function save(Token $token): bool;
 
     public function delete(Token $token): bool;
diff --git a/src/Entries/Entry.php b/src/Entries/Entry.php
index 2bb5cb8aa4a..59f7338ec5f 100644
--- a/src/Entries/Entry.php
+++ b/src/Entries/Entry.php
@@ -362,7 +362,7 @@ public function livePreviewUrl()
 
     public function sharedPreviewUrl()
     {
-        return $this->collection()->route($this->locale())
+        return $this->id()
             ? $this->cpUrl('collections.entries.shared-preview')
             : null;
     }
diff --git a/src/Facades/Token.php b/src/Facades/Token.php
index d2a8b7bc18e..df8e8c983ad 100644
--- a/src/Facades/Token.php
+++ b/src/Facades/Token.php
@@ -8,6 +8,7 @@
 /**
  * @method static \Statamic\Contracts\Tokens\Token make(?string $token, string $handler, array $data = [])
  * @method static \Statamic\Contracts\Tokens\Token find(string $token)
+ * @method static \Illuminate\Support\Collection all()
  * @method static bool save(\Statamic\Contracts\Tokens\Token $token)
  * @method static bool delete(\Statamic\Contracts\Tokens\Token $token)
  * @method static void collectGarbage()
diff --git a/src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php b/src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php
index 391bf67e17c..a513122b7b4 100644
--- a/src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php
+++ b/src/Http/Controllers/CP/Collections/EntrySharedPreviewController.php
@@ -2,29 +2,32 @@
 
 namespace Statamic\Http\Controllers\CP\Collections;
 
-use Statamic\Facades\Token;
+use Facades\Statamic\CP\SharedPreview;
+use Illuminate\Http\Request;
+use Statamic\Exceptions\NotFoundHttpException;
 use Statamic\Http\Controllers\CP\CpController;
-use Statamic\Tokens\Handlers\SharedPreview;
 
 class EntrySharedPreviewController extends CpController
 {
-    public function store($collection, $entry)
+    public function store(Request $request, $collection, $entry)
     {
         $this->authorize('view', $entry);
 
-        $minutes = (int) config('statamic.live_preview.shared_link_expiry', 1440);
+        $revision = $request->input('revision');
 
-        $token = tap(
-            Token::make(null, SharedPreview::class, [
-                'reference' => $entry->reference(),
-            ])->expireAt(now()->addMinutes($minutes))
-        )->save();
+        if ($revision !== null) {
+            $revision = (int) $revision;
+            throw_unless(SharedPreview::findRevision($entry, $revision), new NotFoundHttpException);
+        }
 
-        $url = $entry->absoluteUrl();
+        $token = SharedPreview::tokenize($entry, $revision);
+        $url = SharedPreview::url($entry, $token, (int) $request->input('target', 0));
+
+        $minutesRemaining = max(0, now()->diffInMinutes($token->expiry(), false));
 
         return [
-            'url' => $url.(str_contains($url, '?') ? '&' : '?').'token='.$token->token(),
-            'expires_in_hours' => (int) ceil($minutes / 60),
+            'url' => $url,
+            'expires_in_hours' => max(1, (int) ceil($minutesRemaining / 60)),
         ];
     }
 }
diff --git a/src/Http/Responses/DataResponse.php b/src/Http/Responses/DataResponse.php
index 8710f1c175c..047b1f58100 100644
--- a/src/Http/Responses/DataResponse.php
+++ b/src/Http/Responses/DataResponse.php
@@ -91,6 +91,10 @@ protected function getRedirect()
 
     protected function protect()
     {
+        if ($this->request->isSharedPreviewOf($this->data)) {
+            return $this;
+        }
+
         $protection = app(Protection::class)->setData($this->data);
 
         $protection->protect();
@@ -159,6 +163,10 @@ protected function contents()
             $contents = $this->versionJavascriptModules($contents);
         }
 
+        if ($this->shouldShowSharedPreviewBanner()) {
+            $contents = $this->injectSharedPreviewBanner($contents);
+        }
+
         return $contents;
     }
 
@@ -192,6 +200,48 @@ public function with($data)
         return $this;
     }
 
+    private function shouldShowSharedPreviewBanner(): bool
+    {
+        if (! $this->request->isSharedPreviewOf($this->data)) {
+            return false;
+        }
+
+        $token = $this->request->statamicToken();
+
+        if ($token->get('revision')) {
+            return true;
+        }
+
+        if (method_exists($this->data, 'published') && ! $this->data->published()) {
+            return true;
+        }
+
+        if (method_exists($this->data, 'private') && $this->data->private()) {
+            return true;
+        }
+
+        return method_exists($this->data, 'hasWorkingCopy') && $this->data->hasWorkingCopy();
+    }
+
+    private function injectSharedPreviewBanner(string $contents): string
+    {
+        $token = $this->request->statamicToken();
+        $date = $token->expiry()->timezone(config('app.timezone'))->format('M j, g:ia');
+        $label = e($token->get('revision')
+            ? __('statamic::messages.shared_preview_banner_revision', ['date' => $date])
+            : __('statamic::messages.shared_preview_banner', ['date' => $date]));
+
+        $banner = <<<HTML
+<aside role="status" style="position:fixed;z-index:99999;inset-inline:0;bottom:0;display:flex;justify-content:center;padding:10px 16px;background:#1e293b;color:#f8fafc;font:13px/1.4 ui-sans-serif,system-ui,sans-serif">{$label}</aside>
+HTML;
+
+        if (str_contains($contents, '</body>')) {
+            return str_replace('</body>', $banner.'</body>', $contents);
+        }
+
+        return $contents.$banner;
+    }
+
     protected function versionJavascriptModules($contents)
     {
         return preg_replace_callback('~<script[^>]*type=("|\')module\1[^>]*>~i', function ($scriptMatches) {
diff --git a/src/Tokens/FileTokenRepository.php b/src/Tokens/FileTokenRepository.php
index 7b19622d931..542a3039995 100644
--- a/src/Tokens/FileTokenRepository.php
+++ b/src/Tokens/FileTokenRepository.php
@@ -18,6 +18,18 @@ public function make(?string $token, string $handler, array $data = []): TokenCo
         return app()->makeWith(TokenContract::class, compact('token', 'handler', 'data'));
     }
 
+    public function all(): \Illuminate\Support\Collection
+    {
+        if (! File::exists(storage_path('statamic/tokens'))) {
+            return collect();
+        }
+
+        return File::getFilesByType(storage_path('statamic/tokens'), 'yaml')
+            ->map(fn ($path) => $this->makeFromPath($path))
+            ->reject->hasExpired()
+            ->values();
+    }
+
     public function find(string $token): ?TokenContract
     {
         if (! $this->isValidTokenName($token)) {
diff --git a/src/Tokens/Handlers/SharedPreview.php b/src/Tokens/Handlers/SharedPreview.php
index b25442936e5..0bc525c00aa 100644
--- a/src/Tokens/Handlers/SharedPreview.php
+++ b/src/Tokens/Handlers/SharedPreview.php
@@ -3,25 +3,29 @@
 namespace Statamic\Tokens\Handlers;
 
 use Closure;
+use Facades\Statamic\CP\SharedPreview as Facade;
 use Statamic\Contracts\Tokens\Token;
-use Statamic\Facades\Data;
+use Statamic\Exceptions\NotFoundHttpException;
 
 class SharedPreview
 {
     public function handle(Token $token, $request, Closure $next)
     {
-        $item = Data::find($token->get('reference'));
+        $item = Facade::item($token);
+
+        if ($item === false) {
+            throw new NotFoundHttpException;
+        }
 
         if (! $item) {
             return $next($request);
         }
 
-        if (
-            method_exists($item, 'hasWorkingCopy')
-            && $item->revisionsEnabled()
-            && $item->hasWorkingCopy()
-        ) {
-            $item = $item->fromWorkingCopy();
+        if (method_exists($item, 'setSupplement')) {
+            $item->setSupplement('shared_preview', [
+                'expires_at' => $token->expiry()->toIso8601String(),
+                'revision' => $token->get('revision'),
+            ]);
         }
 
         if (method_exists($item, 'repository')) {
@@ -31,6 +35,7 @@ public function handle(Token $token, $request, Closure $next)
         $response = $next($request);
 
         $response->headers->set('X-Statamic-Shared-Preview', true);
+        $response->headers->set('X-Robots-Tag', 'noindex');
 
         return $response;
     }
diff --git a/tests/Feature/Entries/SharedPreviewEntryTest.php b/tests/Feature/Entries/SharedPreviewEntryTest.php
index 160d347e739..f272c4f9415 100644
--- a/tests/Feature/Entries/SharedPreviewEntryTest.php
+++ b/tests/Feature/Entries/SharedPreviewEntryTest.php
@@ -134,6 +134,99 @@ public function it_doesnt_mint_a_token_without_permission()
         $this->assertNull(Token::find('test-shared-token'));
     }
 
+    #[Test]
+    public function it_reuses_an_unexpired_token()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(false)
+            ->create();
+
+        Generator::shouldReceive('generate')->once()->andReturn('test-shared-token');
+
+        $first = $this
+            ->actingAs($this->user())
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview')
+            ->assertOk()
+            ->json();
+
+        $second = $this
+            ->actingAs($this->user())
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview')
+            ->assertOk()
+            ->json();
+
+        $this->assertEquals($first['url'], $second['url']);
+        $this->assertEquals(1, Token::all()->count());
+    }
+
+    #[Test]
+    public function it_mints_a_pinned_revision_token()
+    {
+        config(['statamic.revisions.enabled' => true]);
+
+        Collection::make('blog')->routes('/blog/{slug}')->revisionsEnabled(true)->save();
+
+        $entry = EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(true)
+            ->data(['title' => 'Live title'])
+            ->create();
+
+        $revision = tap($entry->makeRevision(), function ($revision) {
+            $attrs = $revision->attributes();
+            $attrs['data']['title'] = 'Revision title';
+            $revision->attributes($attrs)->date(Carbon::parse('2023-12-01 09:00:00'));
+        });
+        $revision->save();
+
+        Generator::shouldReceive('generate')->andReturn('test-shared-token');
+
+        $this
+            ->actingAs($this->user())
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview', [
+                'revision' => $revision->date()->timestamp,
+            ])
+            ->assertOk()
+            ->assertJsonPath('url', 'http://localhost/blog/the-existing-entry?token=test-shared-token');
+
+        $token = Token::find('test-shared-token');
+
+        $this->assertEquals($revision->date()->timestamp, $token->get('revision'));
+    }
+
+    #[Test]
+    public function it_uses_a_preview_target_url()
+    {
+        Collection::make('blog')
+            ->routes('/blog/{slug}')
+            ->previewTargets([
+                ['label' => 'Entry', 'format' => '{permalink}', 'refresh' => true],
+                ['label' => 'Listing', 'format' => '/blog', 'refresh' => true],
+            ])
+            ->save();
+
+        EntryFactory::id('the-entry')
+            ->collection('blog')
+            ->slug('the-existing-entry')
+            ->published(false)
+            ->create();
+
+        Generator::shouldReceive('generate')->andReturn('test-shared-token');
+
+        $this
+            ->actingAs($this->user())
+            ->postJson('/cp/collections/blog/entries/the-entry/shared-preview', [
+                'target' => 1,
+            ])
+            ->assertOk()
+            ->assertJsonPath('url', 'http://localhost/blog?token=test-shared-token');
+    }
+
     #[Test]
     public function guests_cannot_mint_tokens()
     {
diff --git a/tests/Feature/Entries/ViewSharedPreviewTest.php b/tests/Feature/Entries/ViewSharedPreviewTest.php
index f13d5df9004..f4c85032281 100644
--- a/tests/Feature/Entries/ViewSharedPreviewTest.php
+++ b/tests/Feature/Entries/ViewSharedPreviewTest.php
@@ -47,7 +47,9 @@ public function unpublished_drafts_are_visible_with_a_shared_preview_token()
             ->assertOk()
             ->assertHeader('X-Statamic-Draft', true)
             ->assertHeader('X-Statamic-Shared-Preview', true)
-            ->assertSee('Draft content');
+            ->assertHeader('X-Robots-Tag', 'noindex')
+            ->assertSee('Draft content')
+            ->assertSee('Draft preview');
     }
 
     #[Test]
@@ -195,8 +197,92 @@ public function published_entries_render_normally_with_a_token()
             ->get('/blog/about?token='.$token->token())
             ->assertOk()
             ->assertHeader('X-Statamic-Shared-Preview', true)
+            ->assertHeader('X-Robots-Tag', 'noindex')
             ->assertHeaderMissing('X-Statamic-Draft')
-            ->assertSee('Live content');
+            ->assertSee('Live content')
+            ->assertDontSee('Draft preview');
+    }
+
+    #[Test]
+    public function pinned_revisions_are_served_instead_of_current_content()
+    {
+        config(['statamic.revisions.enabled' => true]);
+
+        Collection::make('blog')
+            ->routes('/blog/{slug}')
+            ->revisionsEnabled(true)
+            ->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(true)
+            ->data(['content' => 'Published content'])
+            ->create();
+
+        $revision = tap($entry->makeRevision(), function ($revision) {
+            $attrs = $revision->attributes();
+            $attrs['data']['content'] = 'Pinned revision content';
+            $revision->attributes($attrs)->date(Carbon::parse('2023-12-01 09:00:00'));
+        });
+        $revision->save();
+
+        $token = $this->tokenFor($entry, revision: $revision->date()->timestamp);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertOk()
+            ->assertSee('Pinned revision content')
+            ->assertDontSee('Published content')
+            ->assertSee('Revision preview');
+    }
+
+    #[Test]
+    public function missing_pinned_revisions_404()
+    {
+        $this->withStandardFakeErrorViews();
+
+        config(['statamic.revisions.enabled' => true]);
+
+        Collection::make('blog')
+            ->routes('/blog/{slug}')
+            ->revisionsEnabled(true)
+            ->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(true)
+            ->data(['content' => 'Published content'])
+            ->create();
+
+        $token = $this->tokenFor($entry, revision: 1234567890);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertNotFound();
+    }
+
+    #[Test]
+    public function shared_preview_bypasses_protect_schemes()
+    {
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(true)
+            ->data(['content' => 'Protected content', 'protect' => 'logged_in'])
+            ->create();
+
+        $this->get('/blog/about')->assertRedirect('/login?redirect=http://localhost/blog/about');
+
+        $token = $this->tokenFor($entry);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertOk()
+            ->assertSee('Protected content');
     }
 
     #[Test]
@@ -222,11 +308,16 @@ public function deleted_entries_404_even_with_a_token()
             ->assertNotFound();
     }
 
-    private function tokenFor($entry, ?Carbon $expiresAt = null)
+    private function tokenFor($entry, ?Carbon $expiresAt = null, $revision = null)
     {
-        $token = Token::make(null, SharedPreview::class, [
-            'reference' => $entry->reference(),
-        ])->expireAt($expiresAt ?? Carbon::now()->addDay());
+        $data = ['reference' => $entry->reference()];
+
+        if ($revision) {
+            $data['revision'] = $revision;
+        }
+
+        $token = Token::make(null, SharedPreview::class, $data)
+            ->expireAt($expiresAt ?? Carbon::now()->addDay());
 
         $token->save();
 
diff --git a/tests/Tokens/TokenRepositoryTest.php b/tests/Tokens/TokenRepositoryTest.php
index e26245b8346..f1f78e4cf47 100644
--- a/tests/Tokens/TokenRepositoryTest.php
+++ b/tests/Tokens/TokenRepositoryTest.php
@@ -161,6 +161,20 @@ public static function invalidTokenNameProvider()
         ];
     }
 
+    #[Test]
+    public function it_gets_all_non_expired_tokens()
+    {
+        Carbon::setTestNow(Carbon::create(2020, 1, 1, 3, 0, 0));
+
+        $this->tokens->make('a', 'test')->save();
+        $this->tokens->make('b', 'test')->expireAt(Carbon::now()->subMinute())->save();
+        $this->tokens->make('c', 'test')->expireAt(Carbon::now()->addHour())->save();
+
+        $tokens = $this->tokens->all();
+
+        $this->assertEquals(['a', 'c'], $tokens->map->token()->sort()->values()->all());
+    }
+
     #[Test]
     public function it_deletes_expired_tokens()
     {

From 13911bbf0d3ff78347bb08c5a89c298668b7c260 Mon Sep 17 00:00:00 2001
From: Jack McDade <jack@jackmcdade.com>
Date: Tue, 25 Aug 2026 11:57:15 -0400
Subject: [PATCH 4/5] Fix shared preview lint, banner config, and token
 contract compat

Add the required Statamic trans import, make the frontend banner configurable, only inject it into HTML documents, and give TokenRepository a default all() so Eloquent/custom drivers do not fatal.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 config/live_preview.php                       |  4 ++++
 src/Http/Responses/DataResponse.php           | 12 +++++++---
 src/Tokens/TokenRepository.php                |  6 +++++
 .../Feature/Entries/ViewSharedPreviewTest.php | 24 +++++++++++++++++++
 4 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/config/live_preview.php b/config/live_preview.php
index 4f5b4133813..925ac3be8fd 100644
--- a/config/live_preview.php
+++ b/config/live_preview.php
@@ -75,9 +75,13 @@
     |--------------------------------------------------------------------------
     |
     | How long shareable draft preview links should remain valid, in minutes.
+    | Set shared_link_banner to false to hide the "Draft preview" bar on
+    | shared frontend pages. Cascade still gets `shared_preview`.
     |
     */
 
     'shared_link_expiry' => 1440,
 
+    'shared_link_banner' => true,
+
 ];
diff --git a/src/Http/Responses/DataResponse.php b/src/Http/Responses/DataResponse.php
index 047b1f58100..d109c528b54 100644
--- a/src/Http/Responses/DataResponse.php
+++ b/src/Http/Responses/DataResponse.php
@@ -11,6 +11,8 @@
 use Statamic\Facades\Site;
 use Statamic\View\View;
 
+use function Statamic\trans as __;
+
 class DataResponse implements Responsable
 {
     protected $data;
@@ -202,6 +204,10 @@ public function with($data)
 
     private function shouldShowSharedPreviewBanner(): bool
     {
+        if (! config('statamic.live_preview.shared_link_banner', true)) {
+            return false;
+        }
+
         if (! $this->request->isSharedPreviewOf($this->data)) {
             return false;
         }
@@ -235,11 +241,11 @@ private function injectSharedPreviewBanner(string $contents): string
 <aside role="status" style="position:fixed;z-index:99999;inset-inline:0;bottom:0;display:flex;justify-content:center;padding:10px 16px;background:#1e293b;color:#f8fafc;font:13px/1.4 ui-sans-serif,system-ui,sans-serif">{$label}</aside>
 HTML;
 
-        if (str_contains($contents, '</body>')) {
-            return str_replace('</body>', $banner.'</body>', $contents);
+        if (! str_contains($contents, '</body>')) {
+            return $contents;
         }
 
-        return $contents.$banner;
+        return str_replace('</body>', $banner.'</body>', $contents);
     }
 
     protected function versionJavascriptModules($contents)
diff --git a/src/Tokens/TokenRepository.php b/src/Tokens/TokenRepository.php
index 982174d02e5..ae5621db307 100644
--- a/src/Tokens/TokenRepository.php
+++ b/src/Tokens/TokenRepository.php
@@ -2,6 +2,7 @@
 
 namespace Statamic\Tokens;
 
+use Illuminate\Support\Collection;
 use Statamic\Contracts\Tokens\Token as TokenContract;
 use Statamic\Contracts\Tokens\TokenRepository as Contract;
 
@@ -12,5 +13,10 @@ public function make(?string $token, string $handler, array $data = []): TokenCo
         return app()->makeWith(TokenContract::class, compact('token', 'handler', 'data'));
     }
 
+    public function all(): Collection
+    {
+        return collect();
+    }
+
     abstract public static function bindings(): array;
 }
diff --git a/tests/Feature/Entries/ViewSharedPreviewTest.php b/tests/Feature/Entries/ViewSharedPreviewTest.php
index f4c85032281..141008b07b1 100644
--- a/tests/Feature/Entries/ViewSharedPreviewTest.php
+++ b/tests/Feature/Entries/ViewSharedPreviewTest.php
@@ -24,6 +24,7 @@ public function setUp(): void
 
         $this->withStandardFakeViews();
         $this->withStandardBlueprints();
+        $this->viewShouldReturnRaw('layout', '<html><body>{{ template_content }}</body></html>');
 
         Carbon::setTestNow(Carbon::parse('2024-01-01 12:00:00'));
     }
@@ -52,6 +53,29 @@ public function unpublished_drafts_are_visible_with_a_shared_preview_token()
             ->assertSee('Draft preview');
     }
 
+    #[Test]
+    public function the_shared_preview_banner_can_be_disabled()
+    {
+        config(['statamic.live_preview.shared_link_banner' => false]);
+
+        Collection::make('blog')->routes('/blog/{slug}')->save();
+
+        $entry = EntryFactory::id('1')
+            ->collection('blog')
+            ->slug('about')
+            ->published(false)
+            ->data(['content' => 'Draft content'])
+            ->create();
+
+        $token = $this->tokenFor($entry);
+
+        $this
+            ->get('/blog/about?token='.$token->token())
+            ->assertOk()
+            ->assertSee('Draft content')
+            ->assertDontSee('Draft preview');
+    }
+
     #[Test]
     public function unpublished_drafts_are_not_visible_without_a_token()
     {

From 625a0dba34b337dcdb7ced58c8cc171aa20e8487 Mon Sep 17 00:00:00 2001
From: Jack McDade <jack@jackmcdade.com>
Date: Tue, 25 Aug 2026 12:04:11 -0400
Subject: [PATCH 5/5] Return expired tokens from Token::all()

Expiry is the caller's concern. Shared preview reuse still skips expired tokens.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/CP/SharedPreview.php             | 1 +
 src/Tokens/FileTokenRepository.php   | 1 -
 tests/Tokens/TokenRepositoryTest.php | 4 ++--
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/CP/SharedPreview.php b/src/CP/SharedPreview.php
index 4f51b29c06e..11379861113 100644
--- a/src/CP/SharedPreview.php
+++ b/src/CP/SharedPreview.php
@@ -33,6 +33,7 @@ public function existing($item, ?int $revision = null): ?TokenContract
     {
         return Token::all()->first(function ($token) use ($item, $revision) {
             return $token->handler() === Handler::class
+                && ! $token->hasExpired()
                 && $token->get('reference') === $item->reference()
                 && $token->get('revision') == $revision;
         });
diff --git a/src/Tokens/FileTokenRepository.php b/src/Tokens/FileTokenRepository.php
index 542a3039995..ccfbd952348 100644
--- a/src/Tokens/FileTokenRepository.php
+++ b/src/Tokens/FileTokenRepository.php
@@ -26,7 +26,6 @@ public function all(): \Illuminate\Support\Collection
 
         return File::getFilesByType(storage_path('statamic/tokens'), 'yaml')
             ->map(fn ($path) => $this->makeFromPath($path))
-            ->reject->hasExpired()
             ->values();
     }
 
diff --git a/tests/Tokens/TokenRepositoryTest.php b/tests/Tokens/TokenRepositoryTest.php
index f1f78e4cf47..f3d58eb7b3a 100644
--- a/tests/Tokens/TokenRepositoryTest.php
+++ b/tests/Tokens/TokenRepositoryTest.php
@@ -162,7 +162,7 @@ public static function invalidTokenNameProvider()
     }
 
     #[Test]
-    public function it_gets_all_non_expired_tokens()
+    public function it_gets_all_tokens()
     {
         Carbon::setTestNow(Carbon::create(2020, 1, 1, 3, 0, 0));
 
@@ -172,7 +172,7 @@ public function it_gets_all_non_expired_tokens()
 
         $tokens = $this->tokens->all();
 
-        $this->assertEquals(['a', 'c'], $tokens->map->token()->sort()->values()->all());
+        $this->assertEquals(['a', 'b', 'c'], $tokens->map->token()->sort()->values()->all());
     }
 
     #[Test]