@abbox/inspector 0.2.1 → 0.3.0

package/dist/next/babel-config.cjs

@@ -10,6 +10,7 @@ function createNextBabelConfig(options = {}) {
   const enabled =
     options.enabled ??
     (process.env.ABBBOX_INSPECTOR === "1" ||
+      process.env.ABBBOX_INSPECTION_MODE === "production" ||
       process.env.NEXT_PUBLIC_ABBOX_INSPECTOR === "1" ||
       process.env.VERCEL_ENV === "preview");
 

package/dist/next/index.d.ts

@@ -1,3 +1,3 @@
 export { type WithAbboxInspectorOptions, withAbboxInspector, DEFAULT_VIEWER_FRAME_ANCESTORS, } from "./with-abbox-inspector.js";
-export { isAbboxInspectorBuildEnabled, isAbboxInspectorRuntimeEnabled, } from "./preview-env.js";
+export { type AbboxInspectionMode, getBakedInspectionMode, getBakedViewerOrigin, isAbboxInspectorBuildEnabled, isAbboxInspectorProductionRuntime, isAbboxInspectorRuntimeEnabled, } from "./preview-env.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,yBAAyB,EAC9B,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,yBAAyB,EAC9B,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,mBAAmB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iCAAiC,EACjC,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC"}

package/dist/next/index.js

@@ -1,2 +1,2 @@
 export { withAbboxInspector, DEFAULT_VIEWER_FRAME_ANCESTORS, } from "./with-abbox-inspector.js";
-export { isAbboxInspectorBuildEnabled, isAbboxInspectorRuntimeEnabled, } from "./preview-env.js";
+export { getBakedInspectionMode, getBakedViewerOrigin, isAbboxInspectorBuildEnabled, isAbboxInspectorProductionRuntime, isAbboxInspectorRuntimeEnabled, } from "./preview-env.js";

package/dist/next/preview-env.d.ts

@@ -1,8 +1,15 @@
+export type AbboxInspectionMode = "preview" | "production";
 /**
  * When true, Inspector instrumentation, CSP frame-ancestors, and client bootstrap are allowed.
- * Production Vercel deploys (VERCEL_ENV=production) stay off unless ABBBOX_INSPECTOR=1 is set explicitly.
+ * Preview Vercel deploys stay on by default; production deploys require explicit
+ * `ABBBOX_INSPECTION_MODE=production` (set by @abbox/cli production mode).
  */
 export declare function isAbboxInspectorBuildEnabled(): boolean;
+/** Baked inspection mode in the client bundle (not query parameters). */
+export declare function getBakedInspectionMode(): AbboxInspectionMode | "off";
 /** Client-side: Inspector may connect to the Viewer iframe host. */
 export declare function isAbboxInspectorRuntimeEnabled(): boolean;
+export declare function isAbboxInspectorProductionRuntime(): boolean;
+/** Primary Viewer origin baked at install time (production mode host validation). */
+export declare function getBakedViewerOrigin(): string | undefined;
 //# sourceMappingURL=preview-env.d.ts.map

package/dist/next/preview-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-env.d.ts","sourceRoot":"","sources":["../../src/next/preview-env.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAItD;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,IAAI,OAAO,CAOxD"}
+{"version":3,"file":"preview-env.d.ts","sourceRoot":"","sources":["../../src/next/preview-env.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAKtD;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,KAAK,CAOpE;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,IAAI,OAAO,CAExD;AAED,wBAAgB,iCAAiC,IAAI,OAAO,CAE3D;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAGzD"}

package/dist/next/preview-env.js

@@ -1,22 +1,39 @@
 /**
  * When true, Inspector instrumentation, CSP frame-ancestors, and client bootstrap are allowed.
- * Production Vercel deploys (VERCEL_ENV=production) stay off unless ABBBOX_INSPECTOR=1 is set explicitly.
+ * Preview Vercel deploys stay on by default; production deploys require explicit
+ * `ABBBOX_INSPECTION_MODE=production` (set by @abbox/cli production mode).
  */
 export function isAbboxInspectorBuildEnabled() {
     if (process.env.ABBBOX_INSPECTOR === "1")
         return true;
+    if (process.env.ABBBOX_INSPECTION_MODE === "production")
+        return true;
     if (process.env.VERCEL_ENV === "preview")
         return true;
     return false;
 }
+/** Baked inspection mode in the client bundle (not query parameters). */
+export function getBakedInspectionMode() {
+    const explicit = process.env.NEXT_PUBLIC_ABBOX_INSPECTION_MODE;
+    if (explicit === "production")
+        return "production";
+    if (explicit === "preview")
+        return "preview";
+    if (process.env.NEXT_PUBLIC_ABBOX_INSPECTOR === "1")
+        return "preview";
+    if (process.env.NEXT_PUBLIC_VERCEL_ENV === "preview")
+        return "preview";
+    return "off";
+}
 /** Client-side: Inspector may connect to the Viewer iframe host. */
 export function isAbboxInspectorRuntimeEnabled() {
-    if (process.env.NEXT_PUBLIC_ABBOX_INSPECTOR === "1")
-        return true;
-    if (process.env.VERCEL_ENV === "preview")
-        return true;
-    if (typeof process.env.NEXT_PUBLIC_VERCEL_ENV === "string") {
-        return process.env.NEXT_PUBLIC_VERCEL_ENV === "preview";
-    }
-    return false;
+    return getBakedInspectionMode() !== "off";
+}
+export function isAbboxInspectorProductionRuntime() {
+    return getBakedInspectionMode() === "production";
+}
+/** Primary Viewer origin baked at install time (production mode host validation). */
+export function getBakedViewerOrigin() {
+    const raw = process.env.NEXT_PUBLIC_ABBOX_VIEWER_ORIGIN;
+    return raw?.trim() ? raw.replace(/\/$/, "") : undefined;
 }

package/dist/next/with-abbox-inspector.d.ts

@@ -6,18 +6,23 @@ export type NextConfigLike = {
     [key: string]: unknown;
 };
 export type WithAbboxInspectorOptions = {
-    /** When false, returns config unchanged (default: ABBBOX_INSPECTOR=1). */
+    /** When false, returns config unchanged (default: build gate in preview-env). */
     enabled?: boolean;
     /**
      * Origins allowed to embed this app in an iframe (Abbox Viewer).
-     * Defaults to common local Viewer ports.
+     * Defaults to hosted viewer + common local Viewer ports.
      */
     frameAncestors?: string[];
+    /**
+     * Primary Viewer origin for production-mode postMessage validation.
+     * Defaults to the first `frameAncestors` entry.
+     */
+    viewerOrigin?: string;
 };
 export declare const DEFAULT_VIEWER_FRAME_ANCESTORS: string[];
 /**
- * Merge Next.js config for local Abbox Live Preview: iframe embedding headers
- * and public env flag for client bootstrap.
+ * Merge Next.js config for Abbox inspection: iframe embedding headers
+ * and public env flags for client bootstrap.
  *
  * JSX instrumentation uses a webpack babel-loader rule (no root babel.config.js),
  * so `next/font` in app/layout.tsx can keep using SWC.

package/dist/next/with-abbox-inspector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-abbox-inspector.d.ts","sourceRoot":"","sources":["../../src/next/with-abbox-inspector.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,CACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC;AAIF,eAAO,MAAM,8BAA8B,UAM1C,CAAC;AAOF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,MAAM,EAAE,CAAC,EACT,OAAO,GAAE,yBAA8B,GACtC,CAAC,CA0EH"}
+{"version":3,"file":"with-abbox-inspector.d.ts","sourceRoot":"","sources":["../../src/next/with-abbox-inspector.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,CACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAIF,eAAO,MAAM,8BAA8B,UAM1C,CAAC;AAcF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,MAAM,EAAE,CAAC,EACT,OAAO,GAAE,yBAA8B,GACtC,CAAC,CAiFH"}

package/dist/next/with-abbox-inspector.js

@@ -14,9 +14,15 @@ function inspectorEnabled(explicit) {
         return explicit;
     return isAbboxInspectorBuildEnabled();
 }
+function bakedInspectionMode() {
+    if (process.env.ABBBOX_INSPECTION_MODE === "production") {
+        return "production";
+    }
+    return "preview";
+}
 /**
- * Merge Next.js config for local Abbox Live Preview: iframe embedding headers
- * and public env flag for client bootstrap.
+ * Merge Next.js config for Abbox inspection: iframe embedding headers
+ * and public env flags for client bootstrap.
  *
  * JSX instrumentation uses a webpack babel-loader rule (no root babel.config.js),
  * so `next/font` in app/layout.tsx can keep using SWC.
@@ -28,7 +34,11 @@ export function withAbboxInspector(config, options = {}) {
     const base = config;
     const { applyAbboxWebpackInstrumentation } = require("./webpack-instrumentation.cjs");
     const ancestors = options.frameAncestors ?? DEFAULT_VIEWER_FRAME_ANCESTORS;
+    const viewerOrigin = options.viewerOrigin?.replace(/\/$/, "") ??
+        ancestors.find((a) => a.startsWith("https://")) ??
+        ancestors[0];
     const csp = `frame-ancestors 'self' ${ancestors.join(" ")}`;
+    const mode = bakedInspectionMode();
     const headers = async () => {
         const existing = typeof base.headers === "function"
             ? await base.headers()
@@ -72,6 +82,8 @@ export function withAbboxInspector(config, options = {}) {
         env: {
             ...(base.env ?? {}),
             NEXT_PUBLIC_ABBOX_INSPECTOR: "1",
+            NEXT_PUBLIC_ABBOX_INSPECTION_MODE: mode,
+            NEXT_PUBLIC_ABBOX_VIEWER_ORIGIN: viewerOrigin,
             NEXT_PUBLIC_VERCEL_ENV: process.env.VERCEL_ENV ?? "",
         },
         headers,

package/dist/runtime/bootstrap.d.ts

@@ -3,8 +3,8 @@ export type BootstrapOptions = {
     allowedHostOrigins?: string[];
 };
 /**
- * Entry for instrumented preview apps. Activates when `abboxSession` is in the
- * URL on authorized preview deployments (Vercel preview or local `dev:abbox`).
+ * Entry for instrumented apps. Activates only when the build baked an authorized
+ * inspection mode and `abboxSession` is present (not sufficient on its own for security).
  */
 export declare function bootstrapInspectorPreview(options?: BootstrapOptions): void;
 //# sourceMappingURL=bootstrap.d.ts.map

package/dist/runtime/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gBAAqB,GAC7B,IAAI,CAyBN"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":"AAsCA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gBAAqB,GAC7B,IAAI,CAmCN"}

package/dist/runtime/bootstrap.js

@@ -1,7 +1,7 @@
 import { withLocalhostAliases } from "../host/origin-aliases.js";
 import { createInspectorClient } from "../host/client-bridge.js";
-import { isAbboxInspectorRuntimeEnabled } from "../next/preview-env.js";
-/** Viewer origins used when `abboxHostOrigin` is missing from the iframe URL. */
+import { getBakedViewerOrigin, isAbboxInspectorProductionRuntime, isAbboxInspectorRuntimeEnabled, } from "../next/preview-env.js";
+/** Viewer origins used when `abboxHostOrigin` is missing (preview mode only). */
 const DEFAULT_VIEWER_ORIGINS = [
     "https://viewer.abbox.com",
     "http://localhost:5173",
@@ -19,9 +19,16 @@ function viewerOriginsFromReferrer() {
         return [];
     }
 }
+function normalizeOrigin(origin) {
+    return origin.replace(/\/$/, "");
+}
+function isAllowedHostOrigin(hostOrigin, allowed) {
+    const normalized = normalizeOrigin(hostOrigin);
+    return allowed.some((o) => normalizeOrigin(o) === normalized);
+}
 /**
- * Entry for instrumented preview apps. Activates when `abboxSession` is in the
- * URL on authorized preview deployments (Vercel preview or local `dev:abbox`).
+ * Entry for instrumented apps. Activates only when the build baked an authorized
+ * inspection mode and `abboxSession` is present (not sufficient on its own for security).
  */
 export function bootstrapInspectorPreview(options = {}) {
     if (typeof window === "undefined")
@@ -32,15 +39,25 @@ export function bootstrapInspectorPreview(options = {}) {
     const sessionFromUrl = params.get("abboxSession");
     if (!sessionFromUrl)
         return;
-    const sessionId = options.sessionId ?? sessionFromUrl ?? "local-dev";
+    const sessionId = options.sessionId ?? sessionFromUrl;
     const hostParam = params.get("abboxHostOrigin");
-    const allowedHostOrigins = withLocalhostAliases(options.allowedHostOrigins ??
-        (hostParam
-            ? [hostParam]
-            : [
-                ...viewerOriginsFromReferrer(),
-                ...DEFAULT_VIEWER_ORIGINS,
-            ]));
+    let allowedHostOrigins;
+    if (isAbboxInspectorProductionRuntime()) {
+        if (!hostParam)
+            return;
+        const bakedViewer = getBakedViewerOrigin();
+        const allowed = withLocalhostAliases(options.allowedHostOrigins ??
+            (bakedViewer ? [bakedViewer] : DEFAULT_VIEWER_ORIGINS));
+        if (!isAllowedHostOrigin(hostParam, allowed))
+            return;
+        allowedHostOrigins = withLocalhostAliases([hostParam]);
+    }
+    else {
+        allowedHostOrigins = withLocalhostAliases(options.allowedHostOrigins ??
+            (hostParam
+                ? [hostParam]
+                : [...viewerOriginsFromReferrer(), ...DEFAULT_VIEWER_ORIGINS]));
+    }
     const client = createInspectorClient({
         sessionId,
         allowedHostOrigins,

package/docs/TRUST.md

@@ -1,18 +1,25 @@
-# Trust model (Live Preview)
+# Trust model (Live Preview & production inspection)
 
 ## What is protected
 
-- **Production deployments** (`VERCEL_ENV=production`): no JSX instrumentation, no `frame-ancestors` for the viewer, client bootstrap does not run (even if `?abboxSession` is present).
-- **Preview deployments** (`VERCEL_ENV=preview`): instrumentation and iframe embedding headers are enabled at build time.
+- **Default (preview-only install)**: `VERCEL_ENV=production` deploys have no JSX instrumentation, no `frame-ancestors` for the viewer, and client bootstrap does not run.
+- **Preview deployments** (`VERCEL_ENV=preview`): instrumentation and iframe embedding headers at build time; runtime follows baked preview mode.
+- **Production inspection (explicit opt-in via `@abbox/cli init --mode production`)**: production Vercel builds use webpack instrumentation and bake `NEXT_PUBLIC_ABBOX_INSPECTION_MODE=production`. Runtime still requires a baked mode flag — query parameters alone cannot enable inspection.
+- **Production runtime**: requires `abboxSession` **and** `abboxHostOrigin` matching the Viewer origin configured at install (`NEXT_PUBLIC_ABBOX_VIEWER_ORIGIN`). No broad Viewer fallback list.
 - **postMessage**: channel, version, session id, and origin allow-lists on host and client. No `targetOrigin: "*"`.
-- **Viewer**: preview URL host allow-list (configurable via `VITE_ABBOX_PREVIEW_HOST_ALLOWLIST`).
+- **Viewer**: preview targets use a host allow-list; production website mode accepts customer HTTPS origins (customer must have opted in on their site).
 
 ## What is not authentication
 
 - `VERCEL_ENV=preview` only means “this build was a Vercel preview deployment.” Anyone with the preview URL can load that deployment.
-- `abboxSession` in the query string is a protocol correlation id, not a secret.
-- Customers should treat Vercel preview URLs as capability URLs (protect with Vercel access controls if needed).
+- `abboxSession` is a protocol correlation id generated by the Viewer, not proof that the Viewer user owns the embedded site.
+- **Production inspection opt-in** means the site owner deliberately ships instrumentation and `frame-ancestors` allowing the configured Viewer. That is explicit capability exposure, not cryptographic proof of ownership.
+- Abbox does not receive page contents or credentials in this milestone; inspection stays between the Viewer and the customer origin via `postMessage`.
 
 ## CSP
 
 `withAbboxInspector` adds `Content-Security-Policy: frame-ancestors …` without removing other CSP headers you configure. Remove conflicting `X-Frame-Options: DENY` in your platform if embedding fails.
+
+## Server-side authorization
+
+This milestone does **not** include a backend that verifies domain ownership. Customers who need stronger guarantees should treat production inspection as a controlled internal tool or wait for a future domain-verification flow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abbox/inspector",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "publishConfig": {
     "access": "public"
   },

package/src/next/babel-config.cjs

@@ -10,6 +10,7 @@ function createNextBabelConfig(options = {}) {
   const enabled =
     options.enabled ??
     (process.env.ABBBOX_INSPECTOR === "1" ||
+      process.env.ABBBOX_INSPECTION_MODE === "production" ||
       process.env.NEXT_PUBLIC_ABBOX_INSPECTOR === "1" ||
       process.env.VERCEL_ENV === "preview");