@avocadostudio-ai/site-sdk 0.11.2 → 0.11.4

package/dist/editor-cors.js

@@ -9,6 +9,7 @@
  * site's draft content out of its own browser. Now the development default is
  * only assumed in development, and a deployment says what it allows.
  */
+import { withLoopbackSpellings } from "@avocadostudio-ai/shared";
 /*
  * Both spellings of the same loopback address, because the product uses both.
  *
@@ -19,7 +20,10 @@
  * and the symptom is a blank iframe with a console message naming an origin
  * that looks like it should have matched.
  *
- * Development only, as below: a deployment still has to name its editor.
+ * This is the development default. A deployment still has to name its editor —
+ * but whichever spelling it names, `withLoopbackSpellings` now grants the
+ * other, which is what this constant had been quietly doing for development
+ * only. See below.
  */
 const DEV_EDITOR_ORIGINS = ["http://localhost:4100", "http://127.0.0.1:4100"];
 let cachedOrigins;
@@ -41,7 +45,23 @@ export function getEditorCorsOrigins() {
     const declaredEditor = parseOrigins(process.env.NEXT_PUBLIC_EDITOR_ORIGIN);
     const isProduction = process.env.NODE_ENV === "production";
     const defaults = isProduction ? [] : DEV_EDITOR_ORIGINS;
-    cachedOrigins = new Set([...defaults, ...declaredEditor, ...configured]);
+    /*
+     * Expand loopback spellings, which is what this function claimed to do and
+     * did not.
+     *
+     * `next-config.mjs`'s `avocadoEditorOrigins` — the `frame-ancestors` half of
+     * the same decision — says in its own comment that it *mirrors* this
+     * function, and it has run every origin through the same expansion since it
+     * was written. This one applied it to the development constant above and
+     * nowhere else, so a production deployment that wrote
+     * `EDITOR_CORS_ORIGINS=http://localhost:4100` allowed the frame from
+     * `127.0.0.1:4100` and refused every API call from it: the editor paints and
+     * is inert, which is strictly worse than either half failing alone.
+     *
+     * `editor-origin-parity.test.ts` now asserts the two produce the same set,
+     * so the next person to change one is told about the other.
+     */
+    cachedOrigins = new Set(withLoopbackSpellings([...defaults, ...declaredEditor, ...configured]));
     return cachedOrigins;
 }
 /** Test seam — the cache is a module global, and env changes must be able to take effect. */
@@ -59,7 +79,29 @@ export function applyEditorCors(response, requestOrigin) {
         return response;
     response.headers.set("Access-Control-Allow-Origin", requestOrigin);
     response.headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-    response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    /*
+     * `x-access-token` is not optional here, and leaving it out shut the editor.
+     *
+     * The editor installs a global `fetch` wrapper that stamps its access token on
+     * every request whose *origin* matches the orchestrator's — not whose path
+     * does. In library mode the orchestrator is mounted inside the site, so
+     * `/api/avocado/*` and `/api/editor/*` share an origin and both get the
+     * header. The orchestrator's own CORS lists it; this list did not, so once a
+     * production gate was configured and a token minted, the browser refused the
+     * preflight for `/api/editor/blocks` and `/api/editor/pages` — the component
+     * manifest the whole editing surface is derived from — with the requests
+     * never leaving the browser. The server saw nothing and logged nothing.
+     *
+     * It only bites in production with a gate on, which is why `curl` and every
+     * development run looked fine: in development no token exists to stamp.
+     *
+     * These names must stay in step with the `access-control-allow-headers` the
+     * orchestrator's own preflight sends, in
+     * `orchestrator-core/src/handler/create-orchestrator.ts`. A header one group accepts
+     * and the other rejects is indistinguishable, from the browser, from the
+     * server being down.
+     */
+    response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, x-access-token");
     return response;
 }
 export function createEditorCorsOptionsHandler() {

package/next-config.mjs

@@ -427,6 +427,17 @@ function builtOrchestratorCore(from, linked) {
  *    *intersection* — putting `frame-ancestors 'self'` back and blocking the
  *    frame it just allowed.
  */
+/*
+ * A deliberate copy of `bothLoopbackSpellings` from
+ * `@avocadostudio-ai/shared`, not an import.
+ *
+ * This file is shipped as raw ESM and evaluated inside `next.config.mjs`,
+ * before anything is built or resolved, and a helper that can fail to import
+ * there breaks a user's build for a header. So the rule is duplicated and
+ * `packages/site-sdk/src/editor-origin-parity.test.ts` asserts the two agree
+ * on every input either can see. That test exists because this very expansion
+ * was applied here and not to CORS, and the disagreement shipped.
+ */
 function bothLoopbackSpellings(origin) {
   if (origin.includes("localhost")) return [origin, origin.replace("localhost", "127.0.0.1")]
   if (origin.includes("127.0.0.1")) return [origin, origin.replace("127.0.0.1", "localhost")]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avocadostudio-ai/site-sdk",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -147,17 +147,17 @@
   ],
   "dependencies": {
     "zod": "^4.3.6",
-    "@avocadostudio-ai/blocks": "^0.11.2",
-    "@avocadostudio-ai/preview-adapter": "^0.11.2",
-    "@avocadostudio-ai/shared": "^0.11.2",
-    "@avocadostudio-ai/richtext": "^0.11.2"
+    "@avocadostudio-ai/blocks": "^0.11.4",
+    "@avocadostudio-ai/preview-adapter": "^0.11.4",
+    "@avocadostudio-ai/shared": "^0.11.4",
+    "@avocadostudio-ai/richtext": "^0.11.4"
   },
   "peerDependencies": {
     "next": ">=15.0.0",
     "react": ">=19.0.0",
     "react-dom": ">=19.0.0",
     "better-sqlite3": ">=12.0.0",
-    "@avocadostudio-ai/orchestrator-core": "^0.11.2"
+    "@avocadostudio-ai/orchestrator-core": "^0.11.4"
   },
   "peerDependenciesMeta": {
     "@avocadostudio-ai/orchestrator-core": {