@avocadostudio-ai/site-sdk 0.11.5 → 0.11.6

package/dist/editor-cors.js

@@ -9,7 +9,7 @@
  * site's draft content out of its own browser. Now the development default is
  * only assumed in development, and a deployment says what it allows.
  */
-import { withLoopbackSpellings } from "@avocadostudio-ai/shared";
+import { withLoopbackSpellings, editorAllowHeaders } from "@avocadostudio-ai/shared";
 /*
  * Both spellings of the same loopback address, because the product uses both.
  *
@@ -80,28 +80,23 @@ export function applyEditorCors(response, requestOrigin) {
     response.headers.set("Access-Control-Allow-Origin", requestOrigin);
     response.headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
     /*
-     * `x-access-token` is not optional here, and leaving it out shut the editor.
+     * Derived, not restated.
      *
-     * The editor installs a global `fetch` wrapper that stamps its access token on
-     * every request whose *origin* matches the orchestrator's — not whose path
-     * does. In library mode the orchestrator is mounted inside the site, so
-     * `/api/avocado/*` and `/api/editor/*` share an origin and both get the
-     * header. The orchestrator's own CORS lists it; this list did not, so once a
-     * production gate was configured and a token minted, the browser refused the
-     * preflight for `/api/editor/blocks` and `/api/editor/pages` — the component
-     * manifest the whole editing surface is derived from — with the requests
-     * never leaving the browser. The server saw nothing and logged nothing.
+     * This list was a literal, and being a literal is how it shipped one header
+     * short in three of four consecutive releases: `x-access-token` missing at
+     * 0.11.3 (the component manifest died once a gate existed), then
+     * `x-publish-token` missing at 0.11.5 (publish died — the last step of the
+     * loop, from a UI that said only "Failed to trigger publish").
      *
-     * It only bites in production with a gate on, which is why `curl` and every
-     * development run looked fine: in development no token exists to stamp.
+     * A browser refuses the preflight and the request never leaves it, so the
+     * server sees nothing and logs nothing, and `curl` — which sends no
+     * `Access-Control-Request-Headers` — reports everything working.
      *
-     * These names must stay in step with the `access-control-allow-headers` the
-     * orchestrator's own preflight sends, in
-     * `orchestrator-core/src/handler/create-orchestrator.ts`. A header one group accepts
-     * and the other rejects is indistinguishable, from the browser, from the
-     * server being down.
+     * `EDITOR_REQUEST_HEADERS` is checked against the editor's own source, so a
+     * header added to a `fetch` and not to the list fails a test rather than a
+     * user's publish. See `shared/src/editor-request-headers.ts`.
      */
-    response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, x-access-token");
+    response.headers.set("Access-Control-Allow-Headers", editorAllowHeaders());
     return response;
 }
 export function createEditorCorsOptionsHandler() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avocadostudio-ai/site-sdk",
-  "version": "0.11.5",
+  "version": "0.11.6",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -147,17 +147,17 @@
   ],
   "dependencies": {
     "zod": "^4.3.6",
-    "@avocadostudio-ai/blocks": "^0.11.5",
-    "@avocadostudio-ai/preview-adapter": "^0.11.5",
-    "@avocadostudio-ai/richtext": "^0.11.5",
-    "@avocadostudio-ai/shared": "^0.11.5"
+    "@avocadostudio-ai/preview-adapter": "^0.11.6",
+    "@avocadostudio-ai/richtext": "^0.11.6",
+    "@avocadostudio-ai/shared": "^0.11.6",
+    "@avocadostudio-ai/blocks": "^0.11.6"
   },
   "peerDependencies": {
     "next": ">=15.0.0",
     "react": ">=19.0.0",
     "react-dom": ">=19.0.0",
     "better-sqlite3": ">=12.0.0",
-    "@avocadostudio-ai/orchestrator-core": "^0.11.5"
+    "@avocadostudio-ai/orchestrator-core": "^0.11.6"
   },
   "peerDependenciesMeta": {
     "@avocadostudio-ai/orchestrator-core": {