@archie/devtools 0.0.7 → 0.0.10

package/dist/client/inject-inspector/injectInspector.mjs

@@ -1,7 +1,9 @@
 import {
+  REMOTE_INSPECTOR_SCRIPT_URL,
   injectInspector
-} from "../../chunk-JPNYFFBN.mjs";
-import "../../chunk-DLRODACA.mjs";
+} from "../../chunk-REJDPYAO.mjs";
+import "../../chunk-D5EA6RR5.mjs";
 export {
+  REMOTE_INSPECTOR_SCRIPT_URL,
   injectInspector
 };

package/dist/constants/archieOrigins.d.mts

@@ -8,9 +8,17 @@
 declare const ARCHIE_HOST_ORIGINS: readonly ["https://app.dev.archie-platform.com", "https://app.staging.archie-platform.com", "https://app.archie.com"];
 /**
  * Origin suffix patterns for Archie preview iframes (e.g. deploy previews).
- * The inspector allows any origin whose host ends with one of these suffixes,
+ * The inspector allows any origin whose host ends with one of these suffixes
+ * to send messages to the inspector (allowlist).
  */
-declare const ARCHIE_PREVIEW_ORIGIN_SUFFIXES: readonly [".archie-platform.com", ".archie.com"];
+declare const ARCHIE_PREVIEW_ORIGIN_SUFFIXES: readonly [".staging.archie-platform.com", ".archie-platform.com", ".archie.com"];
+/**
+ * Host suffixes that identify a **preview deploy** iframe (e.g. 0cf7f787-....previews.staging.archie-platform.com).
+ * Used only by isPreviewOrigin() to decide "don't use referrer as targetOrigin" when the *current page*
+ * is a preview iframe. Must be narrower than ARCHIE_PREVIEW_ORIGIN_SUFFIXES so that the parent
+ * (e.g. app.dev.archie-platform.com) is not treated as a preview and its origin is used as targetOrigin.
+ */
+declare const PREVIEW_DEPLOY_HOST_SUFFIXES: readonly [".previews.staging.archie-platform.com", ".previews.archie-platform.com", ".previews.archie.com"];
 /**
  * Common local origins for development. Add these when testing the inspector
  * with the host running on localhost (e.g. host on :3000, preview iframe on :5173).
@@ -31,9 +39,10 @@ declare function getAllowedOrigins(includeLocal?: boolean): string[];
  */
 declare function getAllowedOriginPatterns(): string[];
 /**
- * Returns true if the given origin is a known Archie preview origin (e.g. deploy preview iframe).
- * When the inspector runs inside a preview iframe, targetOrigin for postMessage must be
+ * Returns true if the given origin is a preview **deploy** iframe (e.g. xxx.previews.staging.archie-platform.com).
+ * Used so we don't use that origin as postMessage targetOrigin; the target must be the parent app.
+ * Does not match app.dev.archie-platform.com / app.staging.archie-platform.com (so they can be used as target).
  */
 declare function isPreviewOrigin(origin: string): boolean;
 
-export { ARCHIE_HOST_ORIGINS, ARCHIE_PREVIEW_ORIGIN_SUFFIXES, type ArchieHostOrigin, LOCAL_DEV_ORIGINS, getAllowedOriginPatterns, getAllowedOrigins, isPreviewOrigin };
+export { ARCHIE_HOST_ORIGINS, ARCHIE_PREVIEW_ORIGIN_SUFFIXES, type ArchieHostOrigin, LOCAL_DEV_ORIGINS, PREVIEW_DEPLOY_HOST_SUFFIXES, getAllowedOriginPatterns, getAllowedOrigins, isPreviewOrigin };

package/dist/constants/archieOrigins.d.ts

@@ -8,9 +8,17 @@
 declare const ARCHIE_HOST_ORIGINS: readonly ["https://app.dev.archie-platform.com", "https://app.staging.archie-platform.com", "https://app.archie.com"];
 /**
  * Origin suffix patterns for Archie preview iframes (e.g. deploy previews).
- * The inspector allows any origin whose host ends with one of these suffixes,
+ * The inspector allows any origin whose host ends with one of these suffixes
+ * to send messages to the inspector (allowlist).
  */
-declare const ARCHIE_PREVIEW_ORIGIN_SUFFIXES: readonly [".archie-platform.com", ".archie.com"];
+declare const ARCHIE_PREVIEW_ORIGIN_SUFFIXES: readonly [".staging.archie-platform.com", ".archie-platform.com", ".archie.com"];
+/**
+ * Host suffixes that identify a **preview deploy** iframe (e.g. 0cf7f787-....previews.staging.archie-platform.com).
+ * Used only by isPreviewOrigin() to decide "don't use referrer as targetOrigin" when the *current page*
+ * is a preview iframe. Must be narrower than ARCHIE_PREVIEW_ORIGIN_SUFFIXES so that the parent
+ * (e.g. app.dev.archie-platform.com) is not treated as a preview and its origin is used as targetOrigin.
+ */
+declare const PREVIEW_DEPLOY_HOST_SUFFIXES: readonly [".previews.staging.archie-platform.com", ".previews.archie-platform.com", ".previews.archie.com"];
 /**
  * Common local origins for development. Add these when testing the inspector
  * with the host running on localhost (e.g. host on :3000, preview iframe on :5173).
@@ -31,9 +39,10 @@ declare function getAllowedOrigins(includeLocal?: boolean): string[];
  */
 declare function getAllowedOriginPatterns(): string[];
 /**
- * Returns true if the given origin is a known Archie preview origin (e.g. deploy preview iframe).
- * When the inspector runs inside a preview iframe, targetOrigin for postMessage must be
+ * Returns true if the given origin is a preview **deploy** iframe (e.g. xxx.previews.staging.archie-platform.com).
+ * Used so we don't use that origin as postMessage targetOrigin; the target must be the parent app.
+ * Does not match app.dev.archie-platform.com / app.staging.archie-platform.com (so they can be used as target).
  */
 declare function isPreviewOrigin(origin: string): boolean;
 
-export { ARCHIE_HOST_ORIGINS, ARCHIE_PREVIEW_ORIGIN_SUFFIXES, type ArchieHostOrigin, LOCAL_DEV_ORIGINS, getAllowedOriginPatterns, getAllowedOrigins, isPreviewOrigin };
+export { ARCHIE_HOST_ORIGINS, ARCHIE_PREVIEW_ORIGIN_SUFFIXES, type ArchieHostOrigin, LOCAL_DEV_ORIGINS, PREVIEW_DEPLOY_HOST_SUFFIXES, getAllowedOriginPatterns, getAllowedOrigins, isPreviewOrigin };

package/dist/constants/archieOrigins.js

@@ -23,6 +23,7 @@ __export(archieOrigins_exports, {
   ARCHIE_HOST_ORIGINS: () => ARCHIE_HOST_ORIGINS,
   ARCHIE_PREVIEW_ORIGIN_SUFFIXES: () => ARCHIE_PREVIEW_ORIGIN_SUFFIXES,
   LOCAL_DEV_ORIGINS: () => LOCAL_DEV_ORIGINS,
+  PREVIEW_DEPLOY_HOST_SUFFIXES: () => PREVIEW_DEPLOY_HOST_SUFFIXES,
   getAllowedOriginPatterns: () => getAllowedOriginPatterns,
   getAllowedOrigins: () => getAllowedOrigins,
   isPreviewOrigin: () => isPreviewOrigin
@@ -34,9 +35,15 @@ var ARCHIE_HOST_ORIGINS = [
   "https://app.archie.com"
 ];
 var ARCHIE_PREVIEW_ORIGIN_SUFFIXES = [
+  ".staging.archie-platform.com",
   ".archie-platform.com",
   ".archie.com"
 ];
+var PREVIEW_DEPLOY_HOST_SUFFIXES = [
+  ".previews.staging.archie-platform.com",
+  ".previews.archie-platform.com",
+  ".previews.archie.com"
+];
 var LOCAL_DEV_ORIGINS = [
   "http://localhost:3000",
   "http://localhost:3001"
@@ -53,7 +60,7 @@ function isPreviewOrigin(origin) {
   if (!origin || typeof origin !== "string") return false;
   try {
     const host = new URL(origin).host;
-    return ARCHIE_PREVIEW_ORIGIN_SUFFIXES.some((suffix) => host.endsWith(suffix));
+    return PREVIEW_DEPLOY_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
   } catch {
     return false;
   }
@@ -63,6 +70,7 @@ function isPreviewOrigin(origin) {
   ARCHIE_HOST_ORIGINS,
   ARCHIE_PREVIEW_ORIGIN_SUFFIXES,
   LOCAL_DEV_ORIGINS,
+  PREVIEW_DEPLOY_HOST_SUFFIXES,
   getAllowedOriginPatterns,
   getAllowedOrigins,
   isPreviewOrigin

package/dist/constants/archieOrigins.mjs

@@ -2,14 +2,16 @@ import {
   ARCHIE_HOST_ORIGINS,
   ARCHIE_PREVIEW_ORIGIN_SUFFIXES,
   LOCAL_DEV_ORIGINS,
+  PREVIEW_DEPLOY_HOST_SUFFIXES,
   getAllowedOriginPatterns,
   getAllowedOrigins,
   isPreviewOrigin
-} from "../chunk-DLRODACA.mjs";
+} from "../chunk-D5EA6RR5.mjs";
 export {
   ARCHIE_HOST_ORIGINS,
   ARCHIE_PREVIEW_ORIGIN_SUFFIXES,
   LOCAL_DEV_ORIGINS,
+  PREVIEW_DEPLOY_HOST_SUFFIXES,
   getAllowedOriginPatterns,
   getAllowedOrigins,
   isPreviewOrigin

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archie/devtools",
-  "version": "0.0.7",
+  "version": "0.0.10",
   "description": "DevTools for Archie generated applications - Route synchronization and editor communication",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -30,6 +30,7 @@
   "scripts": {
     "test": "vitest run",
     "test:watch": "vitest",
+    "inspector:local": "node scripts/generate-inspector-local.js",
     "build": "tsup src/index.ts src/client/client.ts src/client/inject-inspector/injectInspector.ts src/client/inject-inspector/auto.ts src/client/route-listener/routeListener.ts src/constants/archieOrigins.ts --format cjs,esm --dts",
     "dev": "tsup src/index.ts src/client/client.ts src/client/inject-inspector/injectInspector.ts src/client/inject-inspector/auto.ts src/client/route-listener/routeListener.ts src/constants/archieOrigins.ts --format cjs,esm --dts --watch",
     "typecheck": "tsc --noEmit",