@avocadostudio-ai/site-sdk 0.1.0 → 0.2.1

package/dist/draft-context-core.js

@@ -1,10 +1,34 @@
-import { DRAFT_SESSION_COOKIE, DRAFT_SITE_COOKIE, EDITOR_ORIGIN_COOKIE, normalizeOrigin } from "./draft-common.js";
+import { validateDraftSecret } from "@avocadostudio-ai/shared";
+import { DRAFT_SESSION_COOKIE, DRAFT_SITE_COOKIE, EDITOR_ORIGIN_COOKIE, normalizeOrigin, resolveTrustedEditorOrigin } from "./draft-common.js";
 import { single } from "./draft-context.js";
 export { single } from "./draft-context.js";
 export async function resolveDraftContextCore(searchParams, adapter, options) {
     const isDev = process.env.NODE_ENV !== "production";
-    const isEditorParam = single(searchParams.__editor) === "1";
-    const isContentStoreEnabled = isDev || adapter.isDraftMode || isEditorParam;
+    /*
+     * What proves this request may see unpublished content.
+     *
+     * `__editor=1` used to be enough on its own, in production, on the customer's
+     * own domain. It is a routing hint the middleware puts in the URL — no
+     * secret, no cookie — so one GET to a live site rendered another session's
+     * drafts and mounted the editing bridge. The parameter still selects the
+     * preview route; it no longer authorizes anything.
+     *
+     * Two things authorize in production. Draft mode being already enabled means
+     * the secret-gated /api/draft handler was passed and set the cookie. A valid
+     * `secret` on the request itself covers the case that handler cannot: the
+     * editor renders the site in a cross-origin iframe, where the draft cookie is
+     * frequently blocked outright, and a credential in the URL is what remains.
+     *
+     * That credential is a long-lived shared secret travelling in a query string.
+     * It is weaker than a signed, short-lived token and should become one — but
+     * it is the credential this stack already has, it is what /api/draft checks,
+     * and requiring it is the difference between "an attacker needs a secret" and
+     * "an attacker needs a URL".
+     *
+     * Development is unchanged: the parameter alone still works.
+     */
+    const hasValidSecret = validateDraftSecret(single(searchParams.secret), process.env).ok;
+    const isContentStoreEnabled = isDev || adapter.isDraftMode || hasValidSecret;
     if (!isContentStoreEnabled)
         return null;
     const defaultSession = options?.defaultSession ?? process.env.DRAFT_DEFAULT_SESSION?.trim() ?? "dev";
@@ -19,8 +43,17 @@ export async function resolveDraftContextCore(searchParams, adapter, options) {
     if (!siteId)
         return null;
     const session = single(searchParams.session) ?? adapter.getCookie(DRAFT_SESSION_COOKIE)?.trim() ?? defaultSession;
-    const editorOrigin = normalizeOrigin(single(searchParams.editorOrigin))
-        ?? normalizeOrigin(adapter.getCookie(EDITOR_ORIGIN_COOKIE))
-        ?? defaultEditorOrigin;
+    /*
+     * The editor origin becomes the postMessage `targetOrigin` and the frame
+     * permitted to drive inline edits, so it cannot simply be whatever the URL
+     * says. A candidate is honoured only when the operator listed it; anything
+     * else degrades to the configured default.
+     */
+    const candidateOrigin = normalizeOrigin(single(searchParams.editorOrigin)) ?? normalizeOrigin(adapter.getCookie(EDITOR_ORIGIN_COOKIE));
+    const editorOrigin = resolveTrustedEditorOrigin({
+        candidate: candidateOrigin,
+        fallback: defaultEditorOrigin,
+        isDev
+    });
     return { session, siteId, editorOrigin };
 }

package/dist/draft-context-core.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Who may see unpublished content, and which frame may drive the editor.
+ *
+ * Both questions used to be answered by the query string. `?__editor=1` alone
+ * turned on the draft content store — in production, on the customer's own
+ * domain — and `editorOrigin` was accepted from the same URL after a check that
+ * only asked whether it parsed as http(s). One GET rendered another session's
+ * drafts and pointed the postMessage bridge wherever the caller said.
+ */
+export {};

package/dist/draft-context-core.test.js

@@ -0,0 +1,146 @@
+/**
+ * Who may see unpublished content, and which frame may drive the editor.
+ *
+ * Both questions used to be answered by the query string. `?__editor=1` alone
+ * turned on the draft content store — in production, on the customer's own
+ * domain — and `editorOrigin` was accepted from the same URL after a check that
+ * only asked whether it parsed as http(s). One GET rendered another session's
+ * drafts and pointed the postMessage bridge wherever the caller said.
+ */
+import { test, describe, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { resolveDraftContextCore } from "./draft-context-core.js";
+import { resolveTrustedEditorOrigin, editorOriginAllowlist, isLoopbackOrigin } from "./draft-common.js";
+const SECRET = "s3cr3t-draft-key";
+const saved = {};
+const KEYS = ["NODE_ENV", "DRAFT_MODE_SECRET", "NEXT_PUBLIC_EDITOR_ORIGIN", "AVOCADO_EDITOR_ORIGINS"];
+function setEnv(values) {
+    for (const key of KEYS) {
+        if (!(key in saved))
+            saved[key] = process.env[key];
+    }
+    for (const [key, value] of Object.entries(values)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+}
+afterEach(() => {
+    for (const key of KEYS) {
+        if (saved[key] === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = saved[key];
+    }
+});
+function adapter(overrides) {
+    return { isDraftMode: false, getCookie: () => undefined, ...overrides };
+}
+describe("resolveDraftContextCore — production gate", () => {
+    test("__editor=1 alone no longer opens the content store", async () => {
+        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
+        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", session: "victim" }, adapter());
+        assert.equal(ctx, null);
+    });
+    test("a wrong secret is refused", async () => {
+        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
+        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", secret: "guess" }, adapter());
+        assert.equal(ctx, null);
+    });
+    test("the configured secret opens it — the cookie-blocked iframe case", async () => {
+        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
+        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", secret: SECRET }, adapter());
+        assert.equal(ctx?.siteId, "acme");
+    });
+    test("draft mode already enabled opens it — the secret-gated cookie path", async () => {
+        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: SECRET });
+        const ctx = await resolveDraftContextCore({ siteId: "acme" }, adapter({ isDraftMode: true }));
+        assert.equal(ctx?.siteId, "acme");
+    });
+    test("with no secret configured, production stays shut rather than open", async () => {
+        setEnv({ NODE_ENV: "production", DRAFT_MODE_SECRET: undefined });
+        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme", secret: "anything" }, adapter());
+        assert.equal(ctx, null);
+    });
+    test("development is unchanged — the parameter alone still works", async () => {
+        setEnv({ NODE_ENV: "development", DRAFT_MODE_SECRET: undefined });
+        const ctx = await resolveDraftContextCore({ __editor: "1", siteId: "acme" }, adapter());
+        assert.equal(ctx?.siteId, "acme");
+    });
+});
+describe("resolveDraftContextCore — editor origin", () => {
+    test("an unlisted origin from the URL is ignored in favour of the configured one", async () => {
+        setEnv({
+            NODE_ENV: "production",
+            DRAFT_MODE_SECRET: SECRET,
+            NEXT_PUBLIC_EDITOR_ORIGIN: "https://editor.example.com"
+        });
+        const ctx = await resolveDraftContextCore({ siteId: "acme", secret: SECRET, editorOrigin: "https://attacker.example" }, adapter());
+        assert.equal(ctx?.editorOrigin, "https://editor.example.com");
+    });
+    test("a listed origin from the URL is honoured", async () => {
+        setEnv({
+            NODE_ENV: "production",
+            DRAFT_MODE_SECRET: SECRET,
+            NEXT_PUBLIC_EDITOR_ORIGIN: "https://editor.example.com",
+            AVOCADO_EDITOR_ORIGINS: "https://staging-editor.example.com, https://other.example.com"
+        });
+        const ctx = await resolveDraftContextCore({ siteId: "acme", secret: SECRET, editorOrigin: "https://staging-editor.example.com" }, adapter());
+        assert.equal(ctx?.editorOrigin, "https://staging-editor.example.com");
+    });
+    test("a hostile origin in the cookie is ignored too", async () => {
+        setEnv({
+            NODE_ENV: "production",
+            DRAFT_MODE_SECRET: SECRET,
+            NEXT_PUBLIC_EDITOR_ORIGIN: "https://editor.example.com"
+        });
+        const ctx = await resolveDraftContextCore({ siteId: "acme", secret: SECRET }, adapter({ getCookie: (name) => (name === "editor_origin" ? "https%3A%2F%2Fattacker.example" : undefined) }));
+        assert.equal(ctx?.editorOrigin, "https://editor.example.com");
+    });
+});
+describe("resolveTrustedEditorOrigin", () => {
+    test("keeps the fallback when there is no candidate", () => {
+        assert.equal(resolveTrustedEditorOrigin({ candidate: undefined, fallback: "https://a.example", isDev: false, env: {} }), "https://a.example");
+    });
+    test("accepts loopback in development, at any port", () => {
+        for (const candidate of ["http://localhost:4100", "http://localhost:4101", "http://127.0.0.1:5173"]) {
+            assert.equal(resolveTrustedEditorOrigin({ candidate, fallback: "http://localhost:4100", isDev: true, env: {} }), candidate);
+        }
+    });
+    test("refuses loopback in production — an operator must list it", () => {
+        assert.equal(resolveTrustedEditorOrigin({
+            candidate: "http://localhost:4100",
+            fallback: "https://editor.example.com",
+            isDev: false,
+            env: {}
+        }), "https://editor.example.com");
+    });
+    test("the fallback itself is always trusted", () => {
+        assert.equal(resolveTrustedEditorOrigin({
+            candidate: "https://editor.example.com",
+            fallback: "https://editor.example.com",
+            isDev: false,
+            env: {}
+        }), "https://editor.example.com");
+    });
+});
+describe("editorOriginAllowlist", () => {
+    test("merges both variables, normalises, and de-duplicates", () => {
+        const list = editorOriginAllowlist({
+            AVOCADO_EDITOR_ORIGINS: "https://a.example/, https://b.example",
+            NEXT_PUBLIC_EDITOR_ORIGIN: "https://a.example"
+        });
+        assert.deepEqual(list, ["https://a.example", "https://b.example"]);
+    });
+    test("drops entries that are not http(s) origins", () => {
+        const list = editorOriginAllowlist({ AVOCADO_EDITOR_ORIGINS: "javascript:alert(1), not-a-url, ftp://x.example" });
+        assert.deepEqual(list, []);
+    });
+});
+test("isLoopbackOrigin recognises the local spellings and nothing else", () => {
+    assert.equal(isLoopbackOrigin("http://localhost:4100"), true);
+    assert.equal(isLoopbackOrigin("http://127.0.0.1:3000"), true);
+    assert.equal(isLoopbackOrigin("https://localhost.attacker.example"), false);
+    assert.equal(isLoopbackOrigin("https://example.com"), false);
+});

package/dist/draft-fetch.d.ts

@@ -1,14 +1,13 @@
 import type { PageDoc, SiteConfig } from "@avocadostudio-ai/shared";
 export declare function getOrchestratorUrl(): string | null;
-export declare function fetchEditorPage(slug: string, session: string, siteId: string, options?: {
+type DraftFetchOptions = {
     timeoutMs?: number;
     orchestratorUrl?: string;
-}): Promise<PageDoc | null>;
-export declare function fetchEditorSlugs(session: string, siteId: string, options?: {
-    timeoutMs?: number;
-    orchestratorUrl?: string;
-}): Promise<string[]>;
-export declare function fetchEditorSiteConfig(session: string, siteId: string, options?: {
-    timeoutMs?: number;
-    orchestratorUrl?: string;
-}): Promise<SiteConfig>;
+    accessToken?: string;
+};
+/** For tests: forget which refusals have already been reported. */
+export declare function resetDraftFetchWarnings(): void;
+export declare function fetchEditorPage(slug: string, session: string, siteId: string, options?: DraftFetchOptions): Promise<PageDoc | null>;
+export declare function fetchEditorSlugs(session: string, siteId: string, options?: DraftFetchOptions): Promise<string[]>;
+export declare function fetchEditorSiteConfig(session: string, siteId: string, options?: DraftFetchOptions): Promise<SiteConfig>;
+export {};

package/dist/draft-fetch.js

@@ -7,6 +7,25 @@ export function getOrchestratorUrl() {
         return "http://127.0.0.1:4200";
     return null;
 }
+/**
+ * The credential these reads present, if there is one.
+ *
+ * A library-mode orchestrator *must* be credentialed in production —
+ * `createOrchestrator` refuses every request under `NODE_ENV=production` with
+ * neither `ORCHESTRATOR_ACCESS_TOKEN` nor `ACCESS_PASSWORD_HASH` set. Until
+ * this existed, these three helpers sent no headers at all, so a site could not
+ * read its own drafts through the SDK its own docs told it to use.
+ *
+ * Read from the environment rather than passed in because the caller is a
+ * server component that has no session of its own. `ORCHESTRATOR_ACCESS_TOKEN`
+ * has no `NEXT_PUBLIC_` prefix, so it is `undefined` in a client bundle: if one
+ * of these ever gets pulled clientward the request degrades to no header
+ * instead of shipping the token to a browser.
+ */
+function resolveAccessToken(explicit) {
+    const token = explicit?.trim() || process.env.ORCHESTRATOR_ACCESS_TOKEN?.trim();
+    return token || undefined;
+}
 function buildCandidateBaseUrls(configuredBaseUrl) {
     const candidates = [configuredBaseUrl];
     try {
@@ -25,27 +44,64 @@ function buildCandidateBaseUrls(configuredBaseUrl) {
     }
     return candidates;
 }
-async function fetchWithTimeout(url, timeoutMs) {
+async function fetchWithTimeout(url, timeoutMs, token) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await fetch(url, { cache: "no-store", signal: controller.signal });
+        const response = await fetch(url, {
+            cache: "no-store",
+            signal: controller.signal,
+            ...(token ? { headers: { "x-access-token": token } } : {})
+        });
         return response;
     }
     finally {
         clearTimeout(timeoutId);
     }
 }
+/**
+ * A refusal is not an absence, and the difference is the whole bug.
+ *
+ * These helpers run per page render, so a 401 that fell through to `return
+ * null` produced a preview showing *published* content — no error, no log line,
+ * and a page that looks right. It is the hardest failure in the stack to see.
+ *
+ * Retrying the next candidate base URL cannot help either: the same missing
+ * credential will be missing there too. So a refusal stops the loop and says so
+ * once, rather than being spent on latency and silence.
+ */
+const REFUSAL_STATUSES = new Set([401, 403]);
+const warned = new Set();
+function warnRefused(fn, status, hadToken) {
+    const key = `${fn}:${status}:${hadToken}`;
+    if (warned.has(key))
+        return;
+    warned.add(key);
+    console.warn(`[site-sdk/draft] ${fn}: the orchestrator answered ${status}. ` +
+        (hadToken
+            ? "The token that was sent is not the one it accepts — check ORCHESTRATOR_ACCESS_TOKEN on both sides."
+            : "No credential was sent. Set ORCHESTRATOR_ACCESS_TOKEN, or pass `accessToken`.") +
+        " Drafts are unavailable, so this page is rendering published content.");
+}
+/** For tests: forget which refusals have already been reported. */
+export function resetDraftFetchWarnings() {
+    warned.clear();
+}
 export async function fetchEditorPage(slug, session, siteId, options) {
     const configuredBaseUrl = options?.orchestratorUrl ?? getOrchestratorUrl();
     if (!configuredBaseUrl)
         return null;
     const timeout = options?.timeoutMs ?? 5000;
+    const token = resolveAccessToken(options?.accessToken);
     const baseUrls = buildCandidateBaseUrls(configuredBaseUrl);
     for (const baseUrl of baseUrls) {
         try {
             const url = `${baseUrl}/draft/pages?session=${encodeURIComponent(session)}&siteId=${encodeURIComponent(siteId)}&slug=${encodeURIComponent(slug)}`;
-            const res = await fetchWithTimeout(url, timeout);
+            const res = await fetchWithTimeout(url, timeout, token);
+            if (REFUSAL_STATUSES.has(res.status)) {
+                warnRefused("fetchEditorPage", res.status, Boolean(token));
+                return null;
+            }
             if (!res.ok)
                 continue;
             const payload = (await res.json());
@@ -70,11 +126,16 @@ export async function fetchEditorSlugs(session, siteId, options) {
     if (!configuredBaseUrl)
         return [];
     const timeout = options?.timeoutMs ?? 5000;
+    const token = resolveAccessToken(options?.accessToken);
     const baseUrls = buildCandidateBaseUrls(configuredBaseUrl);
     for (const baseUrl of baseUrls) {
         try {
             const url = `${baseUrl}/draft/slugs?session=${encodeURIComponent(session)}&siteId=${encodeURIComponent(siteId)}`;
-            const res = await fetchWithTimeout(url, timeout);
+            const res = await fetchWithTimeout(url, timeout, token);
+            if (REFUSAL_STATUSES.has(res.status)) {
+                warnRefused("fetchEditorSlugs", res.status, Boolean(token));
+                return [];
+            }
             if (!res.ok)
                 continue;
             const payload = (await res.json());
@@ -95,11 +156,16 @@ export async function fetchEditorSiteConfig(session, siteId, options) {
     if (!configuredBaseUrl)
         return {};
     const timeout = options?.timeoutMs ?? 5000;
+    const token = resolveAccessToken(options?.accessToken);
     const baseUrls = buildCandidateBaseUrls(configuredBaseUrl);
     for (const baseUrl of baseUrls) {
         try {
             const url = `${baseUrl}/draft/site-config?session=${encodeURIComponent(session)}&siteId=${encodeURIComponent(siteId)}`;
-            const res = await fetchWithTimeout(url, timeout);
+            const res = await fetchWithTimeout(url, timeout, token);
+            if (REFUSAL_STATUSES.has(res.status)) {
+                warnRefused("fetchEditorSiteConfig", res.status, Boolean(token));
+                return {};
+            }
             if (!res.ok)
                 continue;
             const payload = (await res.json());

package/dist/draft-fetch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/draft-fetch.test.js

@@ -0,0 +1,87 @@
+import { test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { fetchEditorPage, fetchEditorSlugs, resetDraftFetchWarnings } from "./draft-fetch.js";
+let calls = [];
+let warnings = [];
+const realFetch = globalThis.fetch;
+const realWarn = console.warn;
+/** Answer every request with `status`, recording what was asked and with what. */
+function stubFetch(status, body = {}) {
+    globalThis.fetch = (async (input, init) => {
+        const headers = new Headers(init?.headers ?? {});
+        calls.push({ url: String(input), token: headers.get("x-access-token") });
+        return new Response(JSON.stringify(body), {
+            status,
+            headers: { "content-type": "application/json" }
+        });
+    });
+}
+beforeEach(() => {
+    calls = [];
+    warnings = [];
+    resetDraftFetchWarnings();
+    console.warn = (msg) => { warnings.push(String(msg)); };
+    delete process.env.ORCHESTRATOR_ACCESS_TOKEN;
+});
+afterEach(() => {
+    globalThis.fetch = realFetch;
+    console.warn = realWarn;
+    delete process.env.ORCHESTRATOR_ACCESS_TOKEN;
+});
+test("the configured access token travels with the request", async () => {
+    process.env.ORCHESTRATOR_ACCESS_TOKEN = "s3cret";
+    stubFetch(404);
+    await fetchEditorPage("/about", "dev", "site", { orchestratorUrl: "http://example.test" });
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].token, "s3cret");
+});
+test("an explicit token beats the environment", async () => {
+    process.env.ORCHESTRATOR_ACCESS_TOKEN = "from-env";
+    stubFetch(404);
+    await fetchEditorPage("/about", "dev", "site", {
+        orchestratorUrl: "http://example.test",
+        accessToken: "explicit"
+    });
+    assert.equal(calls[0].token, "explicit");
+});
+test("no credential configured sends no header, rather than an empty one", async () => {
+    stubFetch(404);
+    await fetchEditorPage("/about", "dev", "site", { orchestratorUrl: "http://example.test" });
+    assert.equal(calls[0].token, null);
+});
+test("a refusal stops the walk instead of retrying the same missing credential", async () => {
+    // `localhost` yields a second candidate (127.0.0.1); a 404 tries it, a 401
+    // must not — the credential that was missing is missing there too.
+    stubFetch(401, { error: "unauthorized" });
+    const page = await fetchEditorPage("/about", "dev", "site", {
+        orchestratorUrl: "http://localhost:4200"
+    });
+    assert.equal(page, null);
+    assert.equal(calls.length, 1, "a 401 must not be spent on the next candidate URL");
+});
+test("a refusal is reported, because otherwise the page just looks right", async () => {
+    stubFetch(401, { error: "unauthorized" });
+    await fetchEditorPage("/about", "dev", "site", { orchestratorUrl: "http://example.test" });
+    assert.equal(warnings.length, 1);
+    assert.match(warnings[0], /401/);
+    assert.match(warnings[0], /ORCHESTRATOR_ACCESS_TOKEN/);
+    assert.match(warnings[0], /published content/);
+});
+test("the same refusal is not reported once per rendered page", async () => {
+    stubFetch(401);
+    await fetchEditorPage("/a", "dev", "site", { orchestratorUrl: "http://example.test" });
+    await fetchEditorPage("/b", "dev", "site", { orchestratorUrl: "http://example.test" });
+    assert.equal(warnings.length, 1);
+});
+test("a 404 still falls through to the other candidate host", async () => {
+    stubFetch(404);
+    await fetchEditorPage("/about", "dev", "site", { orchestratorUrl: "http://localhost:4200" });
+    assert.equal(calls.length, 2, "the localhost/127.0.0.1 fallback must survive this change");
+});
+test("fetchEditorSlugs refuses the same way, and returns an empty list", async () => {
+    stubFetch(401);
+    const slugs = await fetchEditorSlugs("dev", "site", { orchestratorUrl: "http://localhost:4200" });
+    assert.deepEqual(slugs, []);
+    assert.equal(calls.length, 1);
+    assert.match(warnings[0], /fetchEditorSlugs/);
+});

package/dist/editor-cors.d.ts

@@ -1,3 +1,15 @@
+/**
+ * CORS for the editor API routes a host app mounts.
+ *
+ * The dev editor runs on its own origin (`localhost:4100`), so the routes have
+ * to answer cross-origin requests from it. That default used to be added
+ * unconditionally, which meant a deployed site kept answering CORS-approved
+ * requests to a `localhost` origin: any page a visitor had open could read that
+ * site's draft content out of its own browser. Now the development default is
+ * only assumed in development, and a deployment says what it allows.
+ */
 export declare function getEditorCorsOrigins(): Set<string>;
+/** Test seam — the cache is a module global, and env changes must be able to take effect. */
+export declare function resetEditorCorsOrigins(): void;
 export declare function applyEditorCors(response: Response, requestOrigin: string | null): Response;
 export declare function createEditorCorsOptionsHandler(): (request: Request) => Response;

package/dist/editor-cors.js

@@ -1,15 +1,40 @@
+/**
+ * CORS for the editor API routes a host app mounts.
+ *
+ * The dev editor runs on its own origin (`localhost:4100`), so the routes have
+ * to answer cross-origin requests from it. That default used to be added
+ * unconditionally, which meant a deployed site kept answering CORS-approved
+ * requests to a `localhost` origin: any page a visitor had open could read that
+ * site's draft content out of its own browser. Now the development default is
+ * only assumed in development, and a deployment says what it allows.
+ */
+const DEV_EDITOR_ORIGIN = "http://localhost:4100";
 let cachedOrigins;
+function parseOrigins(value) {
+    return (value ?? "")
+        .split(",")
+        .map((entry) => entry.trim().replace(/\/+$/, ""))
+        .filter(Boolean);
+}
 export function getEditorCorsOrigins() {
     if (cachedOrigins)
         return cachedOrigins;
-    const defaults = ["http://localhost:4100"];
-    const extra = (process.env.EDITOR_CORS_ORIGINS ?? "")
-        .split(",")
-        .map((value) => value.trim())
-        .filter(Boolean);
-    cachedOrigins = new Set([...defaults, ...extra]);
+    const configured = parseOrigins(process.env.EDITOR_CORS_ORIGINS);
+    /*
+     * `NEXT_PUBLIC_EDITOR_ORIGIN` is what the app already tells the browser to
+     * talk to, so a deployment that set it has already named its editor and
+     * should not have to name it twice.
+     */
+    const declaredEditor = parseOrigins(process.env.NEXT_PUBLIC_EDITOR_ORIGIN);
+    const isProduction = process.env.NODE_ENV === "production";
+    const defaults = isProduction ? [] : [DEV_EDITOR_ORIGIN];
+    cachedOrigins = new Set([...defaults, ...declaredEditor, ...configured]);
     return cachedOrigins;
 }
+/** Test seam — the cache is a module global, and env changes must be able to take effect. */
+export function resetEditorCorsOrigins() {
+    cachedOrigins = undefined;
+}
 export function applyEditorCors(response, requestOrigin) {
     const vary = response.headers.get("Vary") ?? "";
     const hasOrigin = vary.split(",").map((v) => v.trim().toLowerCase()).includes("origin");

package/dist/editor-cors.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/editor-cors.test.js

@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { applyEditorCors, getEditorCorsOrigins, resetEditorCorsOrigins } from "./editor-cors.js";
+function withEnv(env, fn) {
+    const previous = {};
+    for (const [key, value] of Object.entries(env)) {
+        previous[key] = process.env[key];
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
+    resetEditorCorsOrigins();
+    try {
+        fn();
+    }
+    finally {
+        for (const [key, value] of Object.entries(previous)) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+        resetEditorCorsOrigins();
+    }
+}
+const CLEAN = { EDITOR_CORS_ORIGINS: undefined, NEXT_PUBLIC_EDITOR_ORIGIN: undefined };
+test("the dev editor origin is allowed in development", () => {
+    withEnv({ ...CLEAN, NODE_ENV: "development" }, () => {
+        assert.ok(getEditorCorsOrigins().has("http://localhost:4100"));
+    });
+});
+test("the dev editor origin is not allowed in production", () => {
+    /*
+     * The bug this replaces: a deployed site answered CORS-approved requests to
+     * localhost:4100, so any page a visitor had open could read the site's drafts
+     * out of that visitor's browser.
+     */
+    withEnv({ ...CLEAN, NODE_ENV: "production" }, () => {
+        assert.equal(getEditorCorsOrigins().has("http://localhost:4100"), false);
+    });
+});
+test("a production deployment allows exactly what it names", () => {
+    withEnv({ ...CLEAN, NODE_ENV: "production", EDITOR_CORS_ORIGINS: "https://editor.example.com" }, () => {
+        const origins = getEditorCorsOrigins();
+        assert.ok(origins.has("https://editor.example.com"));
+        assert.equal(origins.size, 1);
+    });
+});
+test("the editor origin the app already advertises does not have to be named twice", () => {
+    withEnv({ ...CLEAN, NODE_ENV: "production", NEXT_PUBLIC_EDITOR_ORIGIN: "https://editor.example.com/" }, () => {
+        // Trailing slash stripped — an Origin header never has one, so a config
+        // that carries one would silently match nothing.
+        assert.ok(getEditorCorsOrigins().has("https://editor.example.com"));
+    });
+});
+test("an allowed origin gets the CORS headers and a disallowed one does not", () => {
+    withEnv({ ...CLEAN, NODE_ENV: "production", EDITOR_CORS_ORIGINS: "https://editor.example.com" }, () => {
+        const allowed = applyEditorCors(new Response(null), "https://editor.example.com");
+        assert.equal(allowed.headers.get("Access-Control-Allow-Origin"), "https://editor.example.com");
+        const denied = applyEditorCors(new Response(null), "https://evil.example.com");
+        assert.equal(denied.headers.get("Access-Control-Allow-Origin"), null);
+        // Vary is set either way, or a cache would serve one origin's answer to another.
+        assert.equal(denied.headers.get("Vary"), "Origin");
+    });
+});

package/dist/editor-manifest.d.ts

@@ -1,3 +1,2 @@
-import { blockDefinitionSchema, blockManifestSchema, validateByJsonSchemaLike, validateManifestDefaultProps, type BlockDefinition, type BlockManifest } from "@avocadostudio-ai/shared";
-export { blockDefinitionSchema, blockManifestSchema, validateByJsonSchemaLike, validateManifestDefaultProps, type BlockDefinition, type BlockManifest };
-export declare function buildBlockManifest(): BlockManifest;
+import { buildBlockManifest, blockDefinitionSchema, blockManifestSchema, validateByJsonSchemaLike, validateManifestDefaultProps, type BlockDefinition, type BlockManifest } from "@avocadostudio-ai/shared";
+export { buildBlockManifest, blockDefinitionSchema, blockManifestSchema, validateByJsonSchemaLike, validateManifestDefaultProps, type BlockDefinition, type BlockManifest };