@avocadostudio-ai/site-sdk 0.12.1 → 0.13.1

package/dist/editor-api-handler-core.d.ts

@@ -43,6 +43,16 @@ export interface EditorApiHandlerConfig {
      * request.
      */
     blockTypes?: readonly string[];
+    /**
+     * Editor origins this app allows, for hosts that configure Avocado in code
+     * rather than through `EDITOR_CORS_ORIGINS`.
+     *
+     * Additive to the environment, never a replacement for it. See
+     * `declareEditorCorsOrigins`: the Astro integration takes this list in
+     * `astro.config.ts` because it also decides the `postMessage` target, and a
+     * site that named its editor there was still refused by CORS in production.
+     */
+    editorOrigins?: readonly string[];
     onPublish?: OnPublishFn;
     /** Secret token required for publish requests. Checked against x-publish-token header. */
     publishSecret?: string;

package/dist/editor-api-handler-core.js

@@ -1,6 +1,6 @@
 import { createDraftEnableHandlerCore, createDraftDisableHandlerCore } from "./draft-routes-core.js";
 import { createBlocksHandler, createPagesHandler, createPublishHandler } from "./editor-routes.js";
-import { applyEditorCors } from "./editor-cors.js";
+import { applyEditorCors, declareEditorCorsOrigins } from "./editor-cors.js";
 import { checkIntegrationOnce } from "./integration-check.js";
 import { buildBlockManifest } from "./editor-manifest.js";
 import { declareBlockCatalogue } from "@avocadostudio-ai/shared";
@@ -21,6 +21,8 @@ import { declareBlockCatalogue } from "@avocadostudio-ai/shared";
  * - `/api/editor/publish` → publish content (POST)
  */
 export function createEditorApiHandlerCore(config) {
+    if (config.editorOrigins?.length)
+        declareEditorCorsOrigins(config.editorOrigins);
     const draftEnable = createDraftEnableHandlerCore(config.draftAdapter);
     const draftDisable = createDraftDisableHandlerCore(config.draftAdapter);
     const basePath = (config.basePath ?? "/api/editor").replace(/\/+$/, "");

package/dist/editor-cors.d.ts

@@ -9,6 +9,23 @@
  * site's draft content out of its own browser. Now the development default is
  * only assumed in development, and a deployment says what it allows.
  */
+/**
+ * Origins the *host application* names in its own configuration, as opposed to
+ * in the environment.
+ *
+ * `EDITOR_CORS_ORIGINS` assumes the deployment configures Avocado through env
+ * vars, which is true of Next and false of Astro: there the editor origins are
+ * an argument to the integration in `astro.config.ts`, because that same list
+ * decides the `postMessage` target and which frame may drive inline edits. A
+ * site that had correctly named its editor in the one place the integration
+ * asks for it still got no `Access-Control-Allow-Origin`, and only in
+ * production — in development the loopback defaults below cover it, so the
+ * whole class is invisible until deploy.
+ *
+ * Additive on purpose: env still works, still wins nothing and loses nothing,
+ * and a host that declares the same origin twice is not a conflict.
+ */
+export declare function declareEditorCorsOrigins(origins: readonly string[]): void;
 export declare function getEditorCorsOrigins(): Set<string>;
 /** Test seam — the cache is a module global, and env changes must be able to take effect. */
 export declare function resetEditorCorsOrigins(): void;

package/dist/editor-cors.js

@@ -27,6 +27,35 @@ import { withLoopbackSpellings, editorAllowHeaders } from "@avocadostudio-ai/sha
  */
 const DEV_EDITOR_ORIGINS = ["http://localhost:4100", "http://127.0.0.1:4100"];
 let cachedOrigins;
+const declaredOrigins = [];
+/**
+ * Origins the *host application* names in its own configuration, as opposed to
+ * in the environment.
+ *
+ * `EDITOR_CORS_ORIGINS` assumes the deployment configures Avocado through env
+ * vars, which is true of Next and false of Astro: there the editor origins are
+ * an argument to the integration in `astro.config.ts`, because that same list
+ * decides the `postMessage` target and which frame may drive inline edits. A
+ * site that had correctly named its editor in the one place the integration
+ * asks for it still got no `Access-Control-Allow-Origin`, and only in
+ * production — in development the loopback defaults below cover it, so the
+ * whole class is invisible until deploy.
+ *
+ * Additive on purpose: env still works, still wins nothing and loses nothing,
+ * and a host that declares the same origin twice is not a conflict.
+ */
+export function declareEditorCorsOrigins(origins) {
+    let added = false;
+    for (const origin of origins) {
+        const normalized = origin.trim().replace(/\/+$/, "");
+        if (!normalized || declaredOrigins.includes(normalized))
+            continue;
+        declaredOrigins.push(normalized);
+        added = true;
+    }
+    if (added)
+        cachedOrigins = undefined;
+}
 function parseOrigins(value) {
     return (value ?? "")
         .split(",")
@@ -61,12 +90,13 @@ export function getEditorCorsOrigins() {
      * `editor-origin-parity.test.ts` now asserts the two produce the same set,
      * so the next person to change one is told about the other.
      */
-    cachedOrigins = new Set(withLoopbackSpellings([...defaults, ...declaredEditor, ...configured]));
+    cachedOrigins = new Set(withLoopbackSpellings([...defaults, ...declaredEditor, ...configured, ...declaredOrigins]));
     return cachedOrigins;
 }
 /** Test seam — the cache is a module global, and env changes must be able to take effect. */
 export function resetEditorCorsOrigins() {
     cachedOrigins = undefined;
+    declaredOrigins.length = 0;
 }
 export function applyEditorCors(response, requestOrigin) {
     const vary = response.headers.get("Vary") ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avocadostudio-ai/site-sdk",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -147,17 +147,17 @@
   ],
   "dependencies": {
     "zod": "^4.3.6",
-    "@avocadostudio-ai/blocks": "^0.12.1",
-    "@avocadostudio-ai/preview-adapter": "^0.12.1",
-    "@avocadostudio-ai/richtext": "^0.12.1",
-    "@avocadostudio-ai/shared": "^0.12.1"
+    "@avocadostudio-ai/blocks": "^0.13.1",
+    "@avocadostudio-ai/richtext": "^0.13.1",
+    "@avocadostudio-ai/shared": "^0.13.1",
+    "@avocadostudio-ai/preview-adapter": "^0.13.1"
   },
   "peerDependencies": {
     "next": ">=15.0.0",
     "react": ">=19.0.0",
     "react-dom": ">=19.0.0",
     "better-sqlite3": ">=12.0.0",
-    "@avocadostudio-ai/orchestrator-core": "^0.12.1"
+    "@avocadostudio-ai/orchestrator-core": "^0.13.1"
   },
   "peerDependenciesMeta": {
     "@avocadostudio-ai/orchestrator-core": {