@brightsideoy/kama 0.1.0-alpha.167 → 0.1.0-alpha.169

package/dist/index.html

@@ -6,8 +6,8 @@
     <title>KAMA</title>
     <link rel="icon" href="/favicon.png">
     <link rel="apple-touch-icon" sizes="180x180" href="/favicon.png">
-    <script type="module" crossorigin src="/assets/index-CFVMeS_q.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DfRZz82F.css">
+    <script type="module" crossorigin src="/assets/index-aPeJS-BG.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-D5W5U152.css">
   </head>
   <body>
     <div id="app"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brightsideoy/kama",
-  "version": "0.1.0-alpha.167",
+  "version": "0.1.0-alpha.169",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/astro-starter/src/middleware.ts

@@ -393,13 +393,24 @@ export const onRequest = defineMiddleware(async (context, next) => {
     // 🎯 5. SECURITY HEADERS FOR HTML PAGES
     if (response.headers.get("content-type")?.includes("text/html")) {
         response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
-        response.headers.set("X-Frame-Options", "SAMEORIGIN");
         response.headers.set("X-Content-Type-Options", "nosniff");
-        response.headers.set("Cross-Origin-Opener-Policy", "same-origin-allow-popups");
-        response.headers.set(
-            "Content-Security-Policy",
-            "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' https: data: blob:; connect-src 'self' https:; frame-ancestors 'self';"
-        );
+
+        // 🎯 DEV FIX: Allow CMS iframe framing in local development
+        if (isDev) {
+            response.headers.set("X-Frame-Options", "ALLOWALL");
+            response.headers.set(
+                "Content-Security-Policy",
+                "default-src 'self' http: https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' http: https: data: blob:; connect-src 'self' http: https: ws: wss:; frame-ancestors *;"
+            );
+        } else {
+            // Production headers
+            response.headers.set("X-Frame-Options", "SAMEORIGIN");
+            response.headers.set("Cross-Origin-Opener-Policy", "same-origin-allow-popups");
+            response.headers.set(
+                "Content-Security-Policy",
+                "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' https: data: blob:; connect-src 'self' https:; frame-ancestors 'self';"
+            );
+        }
     }
 
     return response;

package/templates/astro-starter/src/pages/[...slug].astro

@@ -20,7 +20,7 @@ const revisionId = searchParams.get("revisionId");
 // Smart Edge Caching Logic
 const isTimeTraveling = isPreview || !!revisionId;
 
-// 🎯 FIX: Allow Cloudflare Edge to revalidate with Worker KV middleware
+// 🎯 Allow Cloudflare Edge to revalidate with Worker KV middleware
 Astro.response.headers.set(
   "Cache-Control",
   "public, no-cache, must-revalidate",
@@ -47,7 +47,6 @@ if (isStaticAsset) {
 }
 
 // 2. ENV & WORKER RESOLUTION (Safe Dual-Environment)
-// 🎯 Replaced throwing runtime getter with safeEnv from middleware
 const safeEnv = (Astro.locals as any).safeEnv || {};
 const cmsWorker = safeEnv.CMS_WORKER;
 
@@ -86,7 +85,7 @@ const customFetch = async (input: RequestInfo | URL, init?: RequestInit) => {
     ...init?.headers,
     "Cache-Control": "no-cache, no-store, must-revalidate",
     Pragma: "no-cache",
-    // 🎯 CRITICAL FIX: Direct Service Bindings require explicit header flags to bypass CMS KV cache!
+    // 🎯 Direct Service Bindings require explicit header flags to bypass CMS KV cache!
     "X-Bypass-Cache": "true",
   };
 
@@ -176,6 +175,7 @@ const isSkeleton = node?.nodeType === "page-skeleton";
       isHomePage={isHomePage}
     >
       <BlockRenderer blocks={mainBlocks} contentMap={content} region="main" />
+      <KamaLivePreviewListener />
     </SkeletonLayout>
   ) : (
     <StandardLayout
@@ -216,7 +216,9 @@ const isSkeleton = node?.nodeType === "page-skeleton";
             </section>
           ) : (
             <div class="empty-content">
-              <p>{node?.summary || "No content available for this page."}</p>
+              <p data-cms-field="summary">
+                {node?.summary || "No content available for this page."}
+              </p>
             </div>
           )}
         </div>
@@ -233,6 +235,8 @@ const isSkeleton = node?.nodeType === "page-skeleton";
           </aside>
         )}
       </div>
+
+      <KamaLivePreviewListener />
     </StandardLayout>
   )
 }