@cmssy/react 0.17.0 → 0.17.1

package/dist/client.cjs

@@ -44,22 +44,37 @@ var PROTOCOL_VERSION = 2;
 
 // src/bridge/messages.ts
 function normalizeOrigin(origin) {
-  if (origin === "*") return "*";
+  const trimmed = origin.trim();
+  if (trimmed === "*") return "*";
   try {
-    return new URL(origin).origin;
+    return new URL(trimmed).origin;
   } catch {
-    return origin;
+    return trimmed;
   }
 }
 function postToEditor(target, editorOrigin, message) {
   target.postMessage(message, normalizeOrigin(editorOrigin));
 }
+function isOriginAllowed(origin, allowed) {
+  const list = Array.isArray(allowed) ? allowed : [allowed];
+  const actual = normalizeOrigin(origin);
+  return list.some((candidate) => {
+    const expected = normalizeOrigin(candidate);
+    return expected === "*" || expected === actual;
+  });
+}
+function resolveInitialTarget(editorOrigin) {
+  const list = (Array.isArray(editorOrigin) ? editorOrigin : [editorOrigin]).map((origin) => normalizeOrigin(origin));
+  if (list.includes("*")) return "*";
+  if (list.length === 1) return list[0];
+  const referrerOrigin = typeof document !== "undefined" && document.referrer ? normalizeOrigin(document.referrer) : "";
+  return list.find((origin) => origin === referrerOrigin) ?? list[0];
+}
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseEditorMessage(data, origin, expectedOrigin) {
-  const expected = normalizeOrigin(expectedOrigin);
-  if (expected !== "*" && origin !== expected) return null;
+  if (!isOriginAllowed(origin, expectedOrigin)) return null;
   if (!isObject(data)) return null;
   switch (data.type) {
     case "cmssy:select":
@@ -174,7 +189,9 @@ function useEditBridge(page, config) {
   react.useEffect(() => {
     if (typeof window === "undefined" || window.parent === window) return;
     const { editorOrigin } = config;
-    if (editorOrigin === "*" && typeof console !== "undefined") {
+    let postTarget = resolveInitialTarget(editorOrigin);
+    const isWildcard = Array.isArray(editorOrigin) ? editorOrigin.includes("*") : editorOrigin === "*";
+    if (isWildcard && typeof console !== "undefined") {
       console.warn(
         "[cmssy] editorOrigin '*' disables origin checks - dev only, do not use in production"
       );
@@ -183,7 +200,7 @@ function useEditBridge(page, config) {
       try {
         const rects = collectRects();
         const pageIds = new Set(blocks.map((b) => b.id));
-        postToEditor(window.parent, editorOrigin, {
+        postToEditor(window.parent, postTarget, {
           type: "cmssy:ready",
           protocolVersion: PROTOCOL_VERSION,
           blocks: [
@@ -211,6 +228,7 @@ function useEditBridge(page, config) {
         editorOrigin
       );
       if (!message) return;
+      postTarget = event.origin;
       if (message.type === "cmssy:patch") {
         if (message.layoutPosition !== void 0) return;
         setPatches((prev) => ({
@@ -268,7 +286,7 @@ function useEditBridge(page, config) {
       const r = el.getBoundingClientRect();
       const layoutPosition = el.getAttribute("data-layout-position");
       try {
-        postToEditor(window.parent, editorOrigin, {
+        postToEditor(window.parent, postTarget, {
           type: "cmssy:click",
           blockId: id,
           rect: { x: r.x, y: r.y, width: r.width, height: r.height },
@@ -293,7 +311,7 @@ function useEditBridge(page, config) {
         if (!el) return;
         const r = el.getBoundingClientRect();
         try {
-          postToEditor(window.parent, editorOrigin, {
+          postToEditor(window.parent, postTarget, {
             type: "cmssy:bounds",
             blockId: id,
             rect: { x: r.x, y: r.y, width: r.width, height: r.height }
@@ -383,7 +401,9 @@ function useDragAgent(config) {
   react.useEffect(() => {
     if (typeof window === "undefined" || window.parent === window) return;
     const { editorOrigin } = config;
-    if (editorOrigin === "*" && typeof console !== "undefined") {
+    let postTarget = resolveInitialTarget(editorOrigin);
+    const isWildcard = Array.isArray(editorOrigin) ? editorOrigin.includes("*") : editorOrigin === "*";
+    if (isWildcard && typeof console !== "undefined") {
       console.warn(
         "[cmssy] editorOrigin '*' disables origin checks - dev only, do not use in production"
       );
@@ -419,7 +439,7 @@ function useDragAgent(config) {
       updateDropY(null);
       resolver.invalidate();
       try {
-        postToEditor(window.parent, editorOrigin, {
+        postToEditor(window.parent, postTarget, {
           type: "cmssy:move",
           protocolVersion: PROTOCOL_VERSION,
           blockId,
@@ -441,6 +461,7 @@ function useDragAgent(config) {
         editorOrigin
       );
       if (!message) return;
+      postTarget = event.origin;
       if (message.type === "cmssy:drag-over") {
         const edge = 64;
         const step = 20;
@@ -452,7 +473,7 @@ function useDragAgent(config) {
         const { index, y } = resolver.resolve(message.y);
         updateDropY(y);
         try {
-          postToEditor(window.parent, editorOrigin, {
+          postToEditor(window.parent, postTarget, {
             type: "cmssy:drag-index",
             protocolVersion: PROTOCOL_VERSION,
             index

package/dist/client.d.cts

@@ -5,7 +5,7 @@ import { ReactNode } from 'react';
 import '@cmssy/types';
 
 interface EditBridgeConfig {
-    editorOrigin: string;
+    editorOrigin: string | string[];
     schemas?: Record<string, BlockSchema>;
     blockMeta?: Record<string, BlockMeta>;
 }

package/dist/client.d.ts

@@ -5,7 +5,7 @@ import { ReactNode } from 'react';
 import '@cmssy/types';
 
 interface EditBridgeConfig {
-    editorOrigin: string;
+    editorOrigin: string | string[];
     schemas?: Record<string, BlockSchema>;
     blockMeta?: Record<string, BlockMeta>;
 }

package/dist/client.js

@@ -42,22 +42,37 @@ var PROTOCOL_VERSION = 2;
 
 // src/bridge/messages.ts
 function normalizeOrigin(origin) {
-  if (origin === "*") return "*";
+  const trimmed = origin.trim();
+  if (trimmed === "*") return "*";
   try {
-    return new URL(origin).origin;
+    return new URL(trimmed).origin;
   } catch {
-    return origin;
+    return trimmed;
   }
 }
 function postToEditor(target, editorOrigin, message) {
   target.postMessage(message, normalizeOrigin(editorOrigin));
 }
+function isOriginAllowed(origin, allowed) {
+  const list = Array.isArray(allowed) ? allowed : [allowed];
+  const actual = normalizeOrigin(origin);
+  return list.some((candidate) => {
+    const expected = normalizeOrigin(candidate);
+    return expected === "*" || expected === actual;
+  });
+}
+function resolveInitialTarget(editorOrigin) {
+  const list = (Array.isArray(editorOrigin) ? editorOrigin : [editorOrigin]).map((origin) => normalizeOrigin(origin));
+  if (list.includes("*")) return "*";
+  if (list.length === 1) return list[0];
+  const referrerOrigin = typeof document !== "undefined" && document.referrer ? normalizeOrigin(document.referrer) : "";
+  return list.find((origin) => origin === referrerOrigin) ?? list[0];
+}
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseEditorMessage(data, origin, expectedOrigin) {
-  const expected = normalizeOrigin(expectedOrigin);
-  if (expected !== "*" && origin !== expected) return null;
+  if (!isOriginAllowed(origin, expectedOrigin)) return null;
   if (!isObject(data)) return null;
   switch (data.type) {
     case "cmssy:select":
@@ -172,7 +187,9 @@ function useEditBridge(page, config) {
   useEffect(() => {
     if (typeof window === "undefined" || window.parent === window) return;
     const { editorOrigin } = config;
-    if (editorOrigin === "*" && typeof console !== "undefined") {
+    let postTarget = resolveInitialTarget(editorOrigin);
+    const isWildcard = Array.isArray(editorOrigin) ? editorOrigin.includes("*") : editorOrigin === "*";
+    if (isWildcard && typeof console !== "undefined") {
       console.warn(
         "[cmssy] editorOrigin '*' disables origin checks - dev only, do not use in production"
       );
@@ -181,7 +198,7 @@ function useEditBridge(page, config) {
       try {
         const rects = collectRects();
         const pageIds = new Set(blocks.map((b) => b.id));
-        postToEditor(window.parent, editorOrigin, {
+        postToEditor(window.parent, postTarget, {
           type: "cmssy:ready",
           protocolVersion: PROTOCOL_VERSION,
           blocks: [
@@ -209,6 +226,7 @@ function useEditBridge(page, config) {
         editorOrigin
       );
       if (!message) return;
+      postTarget = event.origin;
       if (message.type === "cmssy:patch") {
         if (message.layoutPosition !== void 0) return;
         setPatches((prev) => ({
@@ -266,7 +284,7 @@ function useEditBridge(page, config) {
       const r = el.getBoundingClientRect();
       const layoutPosition = el.getAttribute("data-layout-position");
       try {
-        postToEditor(window.parent, editorOrigin, {
+        postToEditor(window.parent, postTarget, {
           type: "cmssy:click",
           blockId: id,
           rect: { x: r.x, y: r.y, width: r.width, height: r.height },
@@ -291,7 +309,7 @@ function useEditBridge(page, config) {
         if (!el) return;
         const r = el.getBoundingClientRect();
         try {
-          postToEditor(window.parent, editorOrigin, {
+          postToEditor(window.parent, postTarget, {
             type: "cmssy:bounds",
             blockId: id,
             rect: { x: r.x, y: r.y, width: r.width, height: r.height }
@@ -381,7 +399,9 @@ function useDragAgent(config) {
   useEffect(() => {
     if (typeof window === "undefined" || window.parent === window) return;
     const { editorOrigin } = config;
-    if (editorOrigin === "*" && typeof console !== "undefined") {
+    let postTarget = resolveInitialTarget(editorOrigin);
+    const isWildcard = Array.isArray(editorOrigin) ? editorOrigin.includes("*") : editorOrigin === "*";
+    if (isWildcard && typeof console !== "undefined") {
       console.warn(
         "[cmssy] editorOrigin '*' disables origin checks - dev only, do not use in production"
       );
@@ -417,7 +437,7 @@ function useDragAgent(config) {
       updateDropY(null);
       resolver.invalidate();
       try {
-        postToEditor(window.parent, editorOrigin, {
+        postToEditor(window.parent, postTarget, {
           type: "cmssy:move",
           protocolVersion: PROTOCOL_VERSION,
           blockId,
@@ -439,6 +459,7 @@ function useDragAgent(config) {
         editorOrigin
       );
       if (!message) return;
+      postTarget = event.origin;
       if (message.type === "cmssy:drag-over") {
         const edge = 64;
         const step = 20;
@@ -450,7 +471,7 @@ function useDragAgent(config) {
         const { index, y } = resolver.resolve(message.y);
         updateDropY(y);
         try {
-          postToEditor(window.parent, editorOrigin, {
+          postToEditor(window.parent, postTarget, {
             type: "cmssy:drag-index",
             protocolVersion: PROTOCOL_VERSION,
             index

package/dist/index.cjs

@@ -239,22 +239,30 @@ function isProtocolCompatible(version) {
 
 // src/bridge/messages.ts
 function normalizeOrigin(origin) {
-  if (origin === "*") return "*";
+  const trimmed = origin.trim();
+  if (trimmed === "*") return "*";
   try {
-    return new URL(origin).origin;
+    return new URL(trimmed).origin;
   } catch {
-    return origin;
+    return trimmed;
   }
 }
 function postToEditor(target, editorOrigin, message) {
   target.postMessage(message, normalizeOrigin(editorOrigin));
 }
+function isOriginAllowed(origin, allowed) {
+  const list = Array.isArray(allowed) ? allowed : [allowed];
+  const actual = normalizeOrigin(origin);
+  return list.some((candidate) => {
+    const expected = normalizeOrigin(candidate);
+    return expected === "*" || expected === actual;
+  });
+}
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseEditorMessage(data, origin, expectedOrigin) {
-  const expected = normalizeOrigin(expectedOrigin);
-  if (expected !== "*" && origin !== expected) return null;
+  if (!isOriginAllowed(origin, expectedOrigin)) return null;
   if (!isObject(data)) return null;
   switch (data.type) {
     case "cmssy:select":
@@ -749,23 +757,23 @@ function createCmssyClient(input) {
   return {
     config,
     resolveWorkspaceId: resolveWorkspaceId2,
-    query(document, variables = {}, options) {
+    query(document2, variables = {}, options) {
       return graphqlRequest(
         config,
-        document,
+        document2,
         variables,
         options,
         "graphql operation"
       );
     },
-    async queryScoped(document, variables = {}, options = {}) {
+    async queryScoped(document2, variables = {}, options = {}) {
       const { workspaceId: provided, headers, ...rest } = options;
       const workspaceId = provided ?? await resolveWorkspaceId2({ ...rest, headers });
       const hasWorkspaceId = variables.workspaceId !== void 0 && variables.workspaceId !== null;
-      const scopedVariables = /\$workspaceId\b/.test(document) && !hasWorkspaceId ? { ...variables, workspaceId } : variables;
+      const scopedVariables = /\$workspaceId\b/.test(document2) && !hasWorkspaceId ? { ...variables, workspaceId } : variables;
       return graphqlRequest(
         config,
-        document,
+        document2,
         scopedVariables,
         { ...rest, headers: { ...headers, "x-workspace-id": workspaceId } },
         "graphql operation"

package/dist/index.d.cts

@@ -68,7 +68,7 @@ interface PostTarget {
 }
 declare function normalizeOrigin(origin: string): string;
 declare function postToEditor(target: PostTarget, editorOrigin: string, message: AppToEditorMessage): void;
-declare function parseEditorMessage(data: unknown, origin: string, expectedOrigin: string): EditorToAppMessage | null;
+declare function parseEditorMessage(data: unknown, origin: string, expectedOrigin: string | string[]): EditorToAppMessage | null;
 
 declare function getBlockContentForLanguage(content: unknown, locale: string, defaultLocale?: string, availableLocales?: string[]): Record<string, unknown>;
 

package/dist/index.d.ts

@@ -68,7 +68,7 @@ interface PostTarget {
 }
 declare function normalizeOrigin(origin: string): string;
 declare function postToEditor(target: PostTarget, editorOrigin: string, message: AppToEditorMessage): void;
-declare function parseEditorMessage(data: unknown, origin: string, expectedOrigin: string): EditorToAppMessage | null;
+declare function parseEditorMessage(data: unknown, origin: string, expectedOrigin: string | string[]): EditorToAppMessage | null;
 
 declare function getBlockContentForLanguage(content: unknown, locale: string, defaultLocale?: string, availableLocales?: string[]): Record<string, unknown>;
 

package/dist/index.js

@@ -237,22 +237,30 @@ function isProtocolCompatible(version) {
 
 // src/bridge/messages.ts
 function normalizeOrigin(origin) {
-  if (origin === "*") return "*";
+  const trimmed = origin.trim();
+  if (trimmed === "*") return "*";
   try {
-    return new URL(origin).origin;
+    return new URL(trimmed).origin;
   } catch {
-    return origin;
+    return trimmed;
   }
 }
 function postToEditor(target, editorOrigin, message) {
   target.postMessage(message, normalizeOrigin(editorOrigin));
 }
+function isOriginAllowed(origin, allowed) {
+  const list = Array.isArray(allowed) ? allowed : [allowed];
+  const actual = normalizeOrigin(origin);
+  return list.some((candidate) => {
+    const expected = normalizeOrigin(candidate);
+    return expected === "*" || expected === actual;
+  });
+}
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseEditorMessage(data, origin, expectedOrigin) {
-  const expected = normalizeOrigin(expectedOrigin);
-  if (expected !== "*" && origin !== expected) return null;
+  if (!isOriginAllowed(origin, expectedOrigin)) return null;
   if (!isObject(data)) return null;
   switch (data.type) {
     case "cmssy:select":
@@ -747,23 +755,23 @@ function createCmssyClient(input) {
   return {
     config,
     resolveWorkspaceId: resolveWorkspaceId2,
-    query(document, variables = {}, options) {
+    query(document2, variables = {}, options) {
       return graphqlRequest(
         config,
-        document,
+        document2,
         variables,
         options,
         "graphql operation"
       );
     },
-    async queryScoped(document, variables = {}, options = {}) {
+    async queryScoped(document2, variables = {}, options = {}) {
       const { workspaceId: provided, headers, ...rest } = options;
       const workspaceId = provided ?? await resolveWorkspaceId2({ ...rest, headers });
       const hasWorkspaceId = variables.workspaceId !== void 0 && variables.workspaceId !== null;
-      const scopedVariables = /\$workspaceId\b/.test(document) && !hasWorkspaceId ? { ...variables, workspaceId } : variables;
+      const scopedVariables = /\$workspaceId\b/.test(document2) && !hasWorkspaceId ? { ...variables, workspaceId } : variables;
       return graphqlRequest(
         config,
-        document,
+        document2,
         scopedVariables,
         { ...rest, headers: { ...headers, "x-workspace-id": workspaceId } },
         "graphql operation"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/react",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "React blocks, renderers, data client and editor bridge for cmssy headless sites",
   "keywords": [
     "cmssy",