@decocms/nextjs 8.9.1 → 8.10.0

package/README.md

@@ -132,6 +132,8 @@ import { StudioBridge } from "@decocms/nextjs";
 
 Studio's origins are the package's own (`STUDIO_ORIGINS`), so the bridge takes only the site's name. v7's "." edit shortcut is on by default (`editShortcut={false}` turns it off), and `nonce` is optional.
 
+The bridge also mounts the Studio channel on every page, production included: a small inline script (about 0.7 kB gzipped) through which Studio loads its own editor code (the section wireframe, the page swap after a save) into the page when it frames it. It is the only way Studio runs code in the page: the bridge evaluates no script Studio sends. The page trusts a list of exact Studio origins: `studioOrigins` when given, else the `DECO_STUDIO_ORIGIN` environment variable, comma-separated (a local Studio, such as `http://localhost:3000`), else Studio's production and staging origins (`DEFAULT_STUDIO_ORIGINS`). Framed, the page posts `{ type: "deco:ready" }` with each of them as the target origin (only a parent at one of them receives it) and imports a module only when Studio's answer, `{ type: "deco:load", url }`, comes from exactly one of them and names a URL on the origin of that message; not framed, or framed by any other origin, it does nothing. A site with a Content Security Policy passes it through `withStudioCsp(directives)`, which adds the same list to `script-src` (and a `frame-ancestors` with Studio's, when the policy has none): `headers: [{ source: "/:path*", headers: [{ key: "Content-Security-Policy", value: withStudioCsp("script-src 'self' 'unsafe-inline'; object-src 'none'").join("; ") }] }]`, or the same in the site's proxy. The inline scripts take the site's `nonce`. The message and module types are in `@decocms/blocks/protocol`.
+
 On a page that isn't in Studio's frame, "." (or Ctrl+Shift+E) opens the page in Studio's editor, and Ctrl or Cmd+"." opens it in a new tab; Studio asks a visitor who isn't signed in to sign in first. To open the right page, each CMS page tells the bridge its path template: the root layout stays across navigations, so the page renders the marker, next to the sections it resolved:
 
 ```tsx
@@ -146,7 +148,7 @@ It renders a `<meta>` that React places in the `<head>`, so the page's own marku
 
 ## Names and Studio's origins
 
-For a site that needs them in its own code (a route that sets its own headers, a CSP it writes itself), `@decocms/nextjs` exports what the proxy, the pages and `withDeco` use: `DRAFT_PARAM` (`__draft`), `DRAFT_COOKIE` (`__deco_draft`), `VERSION_HEADER` (`x-deco-version`), `VISITOR_HEADER` (`x-deco-visitor`), `ASSIGNMENTS_HEADER` (`x-deco-assignments`), `draftResponseHeaders(version)`, `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS` and `isStudioOrigin(origin)`. They have the same values as `@decocms/tanstack`'s; each binding keeps its own copy and never imports the other.
+For a site that needs them in its own code (a route that sets its own headers, a CSP it writes itself), `@decocms/nextjs` exports what the proxy, the pages and `withDeco` use: `DRAFT_PARAM` (`__draft`), `DRAFT_COOKIE` (`__deco_draft`), `VERSION_HEADER` (`x-deco-version`), `VISITOR_HEADER` (`x-deco-visitor`), `ASSIGNMENTS_HEADER` (`x-deco-assignments`), `draftResponseHeaders(version)`, `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS`, `isStudioOrigin(origin)`, `DEFAULT_STUDIO_ORIGINS`, `studioOrigins(option?)` and `withStudioCsp(directives, options?)`. They have the same values as `@decocms/tanstack`'s; each binding keeps its own copy and never imports the other.
 
 ## next.config
 

package/dist/StudioBridge.d.ts

@@ -1,16 +1,29 @@
 /**
  * `StudioBridge` of `@decocms/blocks/preview` with Studio's origins filled in
  * (`STUDIO_ORIGINS`, `./studio.ts`): the package owns where Studio runs, so a
- * site passes only its name. One inline script and no hooks, so a Server
- * Component renders it as is.
+ * site passes only its name. With it, the Studio channel (`StudioChannel`):
+ * on every page, production included, framed by one of Studio's origins
+ * (`studioOrigins` / `DECO_STUDIO_ORIGIN` / Studio's production and staging
+ * origins, each exact) it loads the editor's own modules from that origin;
+ * otherwise it does nothing. Two inline scripts and no hooks, so a Server
+ * Component renders it as is. The site's CSP allows the same origins with
+ * `withStudioCsp`.
  */
 import { type StudioBridgeProps as BridgeScriptProps } from "@decocms/blocks/preview";
 import { type ReactNode } from "react";
-/** `site`, and optionally `editShortcut` and `nonce`; Studio's origins are the package's. */
-export type StudioBridgeProps = Omit<BridgeScriptProps, "trustedOrigins">;
+/** `site`, and optionally `editShortcut`, `page` and `nonce`; Studio's origins are the package's. */
+export interface StudioBridgeProps extends Omit<BridgeScriptProps, "trustedOrigins"> {
+    /**
+     * The Studio origins the Studio channel trusts, each an exact origin.
+     * Default: `DECO_STUDIO_ORIGIN` (comma-separated), else Studio's production
+     * and staging origins (`DEFAULT_STUDIO_ORIGINS`). A site with a CSP passes
+     * the same list to `withStudioCsp`, which adds it to `script-src`.
+     */
+    studioOrigins?: readonly string[];
+}
 /**
  * Lets Studio's site editor select and edit sections on the page when Studio
  * frames it. Render it once, in the root layout's `<body>`.
  */
-export declare function StudioBridge(props: StudioBridgeProps): ReactNode;
+export declare function StudioBridge({ studioOrigins: origins, ...props }: StudioBridgeProps): ReactNode;
 //# sourceMappingURL=StudioBridge.d.ts.map

package/dist/StudioBridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StudioBridge.d.ts","sourceRoot":"","sources":["../src/StudioBridge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,KAAK,iBAAiB,IAAI,iBAAiB,EAC5C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAGtD,6FAA6F;AAC7F,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,SAAS,CAEhE"}
+{"version":3,"file":"StudioBridge.d.ts","sourceRoot":"","sources":["../src/StudioBridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAEL,KAAK,iBAAiB,IAAI,iBAAiB,EAE5C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA2B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAGhE,qGAAqG;AACrG,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IAClF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,iBAAiB,GAAG,SAAS,CAO/F"}

package/dist/StudioBridge.js

@@ -1,17 +1,22 @@
 /**
  * `StudioBridge` of `@decocms/blocks/preview` with Studio's origins filled in
  * (`STUDIO_ORIGINS`, `./studio.ts`): the package owns where Studio runs, so a
- * site passes only its name. One inline script and no hooks, so a Server
- * Component renders it as is.
+ * site passes only its name. With it, the Studio channel (`StudioChannel`):
+ * on every page, production included, framed by one of Studio's origins
+ * (`studioOrigins` / `DECO_STUDIO_ORIGIN` / Studio's production and staging
+ * origins, each exact) it loads the editor's own modules from that origin;
+ * otherwise it does nothing. Two inline scripts and no hooks, so a Server
+ * Component renders it as is. The site's CSP allows the same origins with
+ * `withStudioCsp`.
  */
-import { StudioBridge as BridgeScript, } from "@decocms/blocks/preview";
-import { createElement } from "react";
-import { STUDIO_ORIGINS } from "./studio.js";
+import { StudioBridge as BridgeScript, StudioChannel, } from "@decocms/blocks/preview";
+import { createElement, Fragment } from "react";
+import { STUDIO_ORIGINS, studioOrigins } from "./studio.js";
 /**
  * Lets Studio's site editor select and edit sections on the page when Studio
  * frames it. Render it once, in the root layout's `<body>`.
  */
-export function StudioBridge(props) {
-    return createElement(BridgeScript, { ...props, trustedOrigins: STUDIO_ORIGINS });
+export function StudioBridge({ studioOrigins: origins, ...props }) {
+    return createElement(Fragment, null, createElement(BridgeScript, { ...props, trustedOrigins: STUDIO_ORIGINS }), createElement(StudioChannel, { studioOrigins: studioOrigins(origins), nonce: props.nonce }));
 }
 //# sourceMappingURL=StudioBridge.js.map

package/dist/StudioBridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"StudioBridge.js","sourceRoot":"","sources":["../src/StudioBridge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,YAAY,IAAI,YAAY,GAE7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAkB,MAAM,OAAO,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK7C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,OAAO,aAAa,CAAC,YAAY,EAAE,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"StudioBridge.js","sourceRoot":"","sources":["../src/StudioBridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,YAAY,IAAI,YAAY,EAE5B,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAa5D;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,EAAqB;IAClF,OAAO,aAAa,CAClB,QAAQ,EACR,IAAI,EACJ,aAAa,CAAC,YAAY,EAAE,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,EACzE,aAAa,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAC5F,CAAC;AACJ,CAAC"}

package/dist/assignments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assignments.d.ts","sourceRoot":"","sources":["../src/assignments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6DAA6D;IAC7D,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,oEAAoE;IACpE,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,oHAAoH;AACpH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,WAAW,CAAC,CAAC;AA4CpF;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EACxB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EACxB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC;IAAE,WAAW,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAqB/D;AASD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,CAStE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AA8BxD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,CAOvE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAwB/E;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,MAAM,CAG3F;AAED,8GAA8G;AAC9G,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAC5B,WAAW,EAAE,eAAe,GAC3B,OAAO,CAAC,eAAe,CAAC,CAmB1B"}
+{"version":3,"file":"assignments.d.ts","sourceRoot":"","sources":["../src/assignments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6DAA6D;IAC7D,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,oEAAoE;IACpE,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,oHAAoH;AACpH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,WAAW,CAAC,CAAC;AAoCpF;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EACxB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EACxB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC;IAAE,WAAW,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAqB/D;AASD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,CAStE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AA8BxD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,CAOvE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAwB/E;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,MAAM,CAG3F;AAED,8GAA8G;AAC9G,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAC5B,WAAW,EAAE,eAAe,GAC3B,OAAO,CAAC,eAAe,CAAC,CAmB1B"}

package/dist/assignments.js

@@ -15,19 +15,15 @@ function record() {
     return Object.create(null);
 }
 /**
- * Whether the content saves a block of `type`: listing never fails on a
- * missing block, so a site without tests or campaigns reports no error.
+ * The saved `block` resolved, each name `true` or `false`; `null` when the
+ * content saves none. Whether it exists comes from the index (`NOT_FOUND`,
+ * which is no error to report), with no body listed.
  */
-async function saves(client, type) {
-    const [list] = await client.list(type);
-    return (list?.length ?? 0) > 0;
-}
-/** The saved `block` resolved, each name `true` or `false`; `null` when the content saves none. */
 async function decided(client, spec) {
     try {
-        if (!(await saves(client, spec.type)))
+        const [value, error] = await client.resolve(spec.block);
+        if (error?.code === "NOT_FOUND")
             return null;
-        const [value] = await client.resolve(spec.block);
         const out = record();
         if (!isRecord(value))
             return out;

package/dist/assignments.js.map

@@ -1 +1 @@
-{"version":3,"file":"assignments.js","sourceRoot":"","sources":["../src/assignments.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAKvD,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAW,CAAC;AAC7E,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAW,CAAC;AAIpE,kEAAkE;AAClE,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM;IACb,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgB,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,KAAK,CAAC,MAAc,EAAE,IAAY;IAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAqC;IAErC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QACzF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAwB,EACxB,OAAsB;IAEtB,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAwB,EACxB,OAAsB;IAEtB,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAuB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IACzF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5B,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE;YACX,OAAO;YACP,WAAW,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW;YAC5C,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACvC;QACD,MAAM,EAAE,WAAW,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;KACnD,CAAC;AACJ,CAAC;AAED,qCAAqC;AACrC,SAAS,OAAO,CAAC,WAAkC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;SAC5C,IAAI,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,WAA+B;IAC5D,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAExD,4DAA4D;AAC5D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEjB,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CAAC,MAA6B;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,IAAI,CAAC,UAAU,CAAC;SAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;SAChF,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA4B;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACpC,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBAChD,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,GAAG,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,WAA4B;IACjF,MAAM,IAAI,GAAG,GAAG,wBAAwB,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9E,OAAO,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;AAC3E,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,CACL,QAAQ,KAAK,wBAAwB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,wBAAwB,GAAG,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAA4B,EAC5B,WAA4B;IAE5B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM,CACpD,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CACjD,CAAC;IACF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,CAAU,WAAW,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,CAAC,IAAI;YAAE,KAAK,GAAG,KAAK,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtF,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"assignments.js","sourceRoot":"","sources":["../src/assignments.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAKvD,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAW,CAAC;AAC7E,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAW,CAAC;AAIpE,kEAAkE;AAClE,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM;IACb,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgB,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAuB;IAC5D,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QACzF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAwB,EACxB,OAAsB;IAEtB,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAwB,EACxB,OAAsB;IAEtB,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAuB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IACzF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5B,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE;YACX,OAAO;YACP,WAAW,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW;YAC5C,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACvC;QACD,MAAM,EAAE,WAAW,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;KACnD,CAAC;AACJ,CAAC;AAED,qCAAqC;AACrC,SAAS,OAAO,CAAC,WAAkC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;SAC5C,IAAI,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,WAA+B;IAC5D,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAExD,4DAA4D;AAC5D,MAAM,IAAI,GAAG,GAAG,CAAC;AAEjB,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CAAC,MAA6B;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,IAAI,CAAC,UAAU,CAAC;SAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;SAChF,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA4B;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACpC,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBAChD,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,GAAG,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,WAA4B;IACjF,MAAM,IAAI,GAAG,GAAG,wBAAwB,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9E,OAAO,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;AAC3E,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,CACL,QAAQ,KAAK,wBAAwB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,wBAAwB,GAAG,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAA4B,EAC5B,WAA4B;IAE5B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM,CACpD,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CACjD,CAAC;IACF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,CAAU,WAAW,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,CAAC,IAAI;YAAE,KAAK,GAAG,KAAK,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtF,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;AAC3D,CAAC"}

package/dist/csp.d.ts

@@ -0,0 +1,32 @@
+/** A Studio on this machine, in local development. */
+export declare const LOOPBACK_ANCESTORS: readonly string[];
+export interface StudioCspOptions {
+    /**
+     * Studio's origins; default {@link studioOrigins}() (`DECO_STUDIO_ORIGIN`,
+     * else production and staging). Read through {@link studioOrigins} like any
+     * other value: an entry that isn't an exact http(s) origin is dropped.
+     */
+    studioOrigins?: readonly string[];
+    /** More origins that may frame the site, besides Studio's (a marketing tool's editor). */
+    frameAncestors?: readonly string[];
+    /** Local development: loopback may frame the site. */
+    dev?: boolean;
+    /** Add `frame-ancestors` when the directives have none. Default `true`. */
+    addFrameAncestors?: boolean;
+}
+/** The directives of a policy (`"a; b"` or `["a", "b"]`), trimmed, empty ones dropped. */
+export declare function cspDirectives(value: string | readonly string[] | undefined): string[];
+/** The `frame-ancestors` sources: Studio's, the site's own, and loopback in development. */
+export declare function studioFrameAncestors(options?: StudioCspOptions): string[];
+/**
+ * A policy's directives with what Studio needs added: Studio's origins in
+ * `script-src` (and `script-src-elem`), so the Studio channel can import
+ * Studio's modules, and a `frame-ancestors` with Studio's (when the policy has
+ * none). A policy that restricts scripts only through `default-src` gets a
+ * `script-src` with `default-src`'s sources plus Studio's, which allows the
+ * same scripts as before and Studio's modules. A policy that doesn't restrict
+ * scripts, or forbids them all (`'none'`), keeps its scripts as they are.
+ * A site's own `frame-ancestors` is kept as is.
+ */
+export declare function withStudioCsp(directives: string | readonly string[] | undefined, options?: StudioCspOptions): string[];
+//# sourceMappingURL=csp.d.ts.map

package/dist/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAYA,sDAAsD;AACtD,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAG9C,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,sDAAsD;IACtD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAIrF;AAeD,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,gBAAqB,GAAG,MAAM,EAAE,CAS7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,EAClD,OAAO,GAAE,gBAAqB,GAC7B,MAAM,EAAE,CAqBV"}

package/dist/csp.js

@@ -0,0 +1,77 @@
+/**
+ * What Studio needs in a page's Content Security Policy: its origins in
+ * `script-src` (the Studio channel imports Studio's modules from them) and in
+ * `frame-ancestors` (its site editor frames the page). A Next.js site writes
+ * its own policy (`next.config` headers, or its proxy); it passes the
+ * directives through {@link withStudioCsp}, which adds both. The origins are
+ * {@link studioOrigins}: the same list `StudioBridge`'s Studio channel trusts.
+ * The package's own copy (it never imports `@decocms/tanstack`). No framework
+ * code: safe in every bundle.
+ */
+import { STUDIO_FRAME_ANCESTORS, studioOrigins } from "./studio.js";
+/** A Studio on this machine, in local development. */
+export const LOOPBACK_ANCESTORS = Object.freeze([
+    "http://localhost:*",
+    "http://127.0.0.1:*",
+]);
+/** The directives of a policy (`"a; b"` or `["a", "b"]`), trimmed, empty ones dropped. */
+export function cspDirectives(value) {
+    if (value === undefined)
+        return [];
+    const list = typeof value === "string" ? value.split(";") : [...value];
+    return list.map((d) => d.trim()).filter(Boolean);
+}
+const nameOf = (directive) => (directive.split(/\s+/, 1)[0] ?? "").toLowerCase();
+const isNone = (values) => values.length === 1 && values[0]?.toLowerCase() === "'none'";
+/** `directive` with each of `sources` it lacks appended; one that is `'none'` stays as is. */
+function withSources(directive, sources) {
+    const [name = "", ...values] = directive.split(/\s+/);
+    if (isNone(values))
+        return directive;
+    const have = new Set(values.map((v) => v.toLowerCase()));
+    const extra = sources.filter((s) => !have.has(s.toLowerCase()));
+    return extra.length ? [name, ...values, ...extra].join(" ") : directive;
+}
+/** The `frame-ancestors` sources: Studio's, the site's own, and loopback in development. */
+export function studioFrameAncestors(options = {}) {
+    return [
+        ...new Set([
+            ...STUDIO_FRAME_ANCESTORS,
+            ...studioOrigins(options.studioOrigins),
+            ...(options.frameAncestors ?? []),
+            ...(options.dev ? LOOPBACK_ANCESTORS : []),
+        ]),
+    ];
+}
+/**
+ * A policy's directives with what Studio needs added: Studio's origins in
+ * `script-src` (and `script-src-elem`), so the Studio channel can import
+ * Studio's modules, and a `frame-ancestors` with Studio's (when the policy has
+ * none). A policy that restricts scripts only through `default-src` gets a
+ * `script-src` with `default-src`'s sources plus Studio's, which allows the
+ * same scripts as before and Studio's modules. A policy that doesn't restrict
+ * scripts, or forbids them all (`'none'`), keeps its scripts as they are.
+ * A site's own `frame-ancestors` is kept as is.
+ */
+export function withStudioCsp(directives, options = {}) {
+    const origins = studioOrigins(options.studioOrigins);
+    let list = cspDirectives(directives);
+    if (origins.length) {
+        const isScript = (d) => ["script-src", "script-src-elem"].includes(nameOf(d));
+        if (list.some(isScript)) {
+            list = list.map((d) => (isScript(d) ? withSources(d, origins) : d));
+        }
+        else {
+            const fallback = list.find((d) => nameOf(d) === "default-src");
+            const values = fallback?.split(/\s+/).slice(1) ?? [];
+            if (fallback && !isNone(values)) {
+                list.push(withSources(["script-src", ...values].join(" "), origins));
+            }
+        }
+    }
+    if (options.addFrameAncestors !== false && !list.some((d) => nameOf(d) === "frame-ancestors")) {
+        list.push(`frame-ancestors ${studioFrameAncestors({ ...options, studioOrigins: origins }).join(" ")}`);
+    }
+    return list;
+}
+//# sourceMappingURL=csp.js.map

package/dist/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEpE,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACjE,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAiBH,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,KAA6C;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACzF,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,EAAE,CAC3C,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;AAE/D,8FAA8F;AAC9F,SAAS,WAAW,CAAC,SAAiB,EAAE,OAA0B;IAChE,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,OAAO,GAAqB,EAAE;IACjE,OAAO;QACL,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,sBAAsB;YACzB,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkD,EAClD,OAAO,GAAqB,EAAE;IAE9B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACrD,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,EAAE,CAAC;QAC9F,IAAI,CAAC,IAAI,CACP,mBAAmB,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -8,25 +8,33 @@
  *   lets Studio's site editor drive the page when Studio frames it
  *   (`@decocms/blocks/preview`'s, answering `STUDIO_ORIGINS`). It renders an
  *   inline script with no React hooks, so a Server Component renders it as is.
- *   Outside Studio's frame, "." opens the page in Studio's editor.
+ *   Outside Studio's frame, "." opens the page in Studio's editor. It also
+ *   mounts the Studio channel (`StudioChannel`), through which Studio loads its
+ *   own modules into the page when it frames it (`studioOrigins`).
  * - `StudioPage`: rendered inside each CMS page, `<StudioPage pathTemplate={page.path} />`,
  *   tells the bridge which page "." opens (the root layout doesn't re-render per page).
  * - `DRAFT_PARAM`, `DRAFT_COOKIE`, `VERSION_HEADER`, `draftResponseHeaders`,
  *   `VISITOR_HEADER`, `ASSIGNMENTS_HEADER`,
- *   `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS`, `isStudioOrigin`: for a site
+ *   `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS`, `isStudioOrigin`,
+ *   `STUDIO_ORIGIN`, `DEFAULT_STUDIO_ORIGINS`, `studioOrigins`: for a site
  *   that needs them in its own code (a route that sets its own headers, a CSP
  *   it writes itself). The package's own copy: it never imports
  *   `@decocms/tanstack`.
  *
+ * - `withStudioCsp(directives)`: the site's CSP with Studio's origins added to
+ *   `script-src` (the Studio channel's modules) and `frame-ancestors` (when it
+ *   has none), the same list the Studio channel trusts.
+ *
  * The proxy (`/proxy`), the pages (`/server`), `next.config` (`/config`) and the
  * image loader (`/image-loader`) are separate subpaths, so the proxy never
  * loads React.
  */
 export { DraftBadge, StudioPage, type StudioPageInfo } from "@decocms/blocks/preview";
 export { ASSIGNMENTS_HEADER } from "./assignments.ts";
+export { type StudioCspOptions, withStudioCsp } from "./csp.ts";
 export { DraftPreviewIndicator, type DraftPreviewIndicatorProps, } from "./DraftPreviewIndicator.tsx";
 export { DRAFT_COOKIE, DRAFT_PARAM, draftResponseHeaders, VERSION_HEADER } from "./draft.ts";
 export { StudioBridge, type StudioBridgeProps } from "./StudioBridge.ts";
-export { isStudioOrigin, STUDIO_FRAME_ANCESTORS, STUDIO_ORIGINS } from "./studio.ts";
+export { DEFAULT_STUDIO_ORIGINS, isStudioOrigin, STUDIO_FRAME_ANCESTORS, STUDIO_ORIGIN, STUDIO_ORIGINS, studioOrigins, } from "./studio.ts";
 export { VISITOR_HEADER } from "./visitor.ts";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,KAAK,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -8,25 +8,33 @@
  *   lets Studio's site editor drive the page when Studio frames it
  *   (`@decocms/blocks/preview`'s, answering `STUDIO_ORIGINS`). It renders an
  *   inline script with no React hooks, so a Server Component renders it as is.
- *   Outside Studio's frame, "." opens the page in Studio's editor.
+ *   Outside Studio's frame, "." opens the page in Studio's editor. It also
+ *   mounts the Studio channel (`StudioChannel`), through which Studio loads its
+ *   own modules into the page when it frames it (`studioOrigins`).
  * - `StudioPage`: rendered inside each CMS page, `<StudioPage pathTemplate={page.path} />`,
  *   tells the bridge which page "." opens (the root layout doesn't re-render per page).
  * - `DRAFT_PARAM`, `DRAFT_COOKIE`, `VERSION_HEADER`, `draftResponseHeaders`,
  *   `VISITOR_HEADER`, `ASSIGNMENTS_HEADER`,
- *   `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS`, `isStudioOrigin`: for a site
+ *   `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS`, `isStudioOrigin`,
+ *   `STUDIO_ORIGIN`, `DEFAULT_STUDIO_ORIGINS`, `studioOrigins`: for a site
  *   that needs them in its own code (a route that sets its own headers, a CSP
  *   it writes itself). The package's own copy: it never imports
  *   `@decocms/tanstack`.
  *
+ * - `withStudioCsp(directives)`: the site's CSP with Studio's origins added to
+ *   `script-src` (the Studio channel's modules) and `frame-ancestors` (when it
+ *   has none), the same list the Studio channel trusts.
+ *
  * The proxy (`/proxy`), the pages (`/server`), `next.config` (`/config`) and the
  * image loader (`/image-loader`) are separate subpaths, so the proxy never
  * loads React.
  */
 export { DraftBadge, StudioPage } from "@decocms/blocks/preview";
 export { ASSIGNMENTS_HEADER } from "./assignments.js";
+export { withStudioCsp } from "./csp.js";
 export { DraftPreviewIndicator, } from "./DraftPreviewIndicator.js";
 export { DRAFT_COOKIE, DRAFT_PARAM, draftResponseHeaders, VERSION_HEADER } from "./draft.js";
 export { StudioBridge } from "./StudioBridge.js";
-export { isStudioOrigin, STUDIO_FRAME_ANCESTORS, STUDIO_ORIGINS } from "./studio.js";
+export { DEFAULT_STUDIO_ORIGINS, isStudioOrigin, STUDIO_FRAME_ANCESTORS, STUDIO_ORIGIN, STUDIO_ORIGINS, studioOrigins, } from "./studio.js";
 export { VISITOR_HEADER } from "./visitor.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAuB,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,qBAAqB,GAEtB,MAAM,4BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,YAAY,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAuB,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAyB,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,qBAAqB,GAEtB,MAAM,4BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,YAAY,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/proxy/index.js

@@ -62,7 +62,7 @@ export async function decideDraft(cms, request) {
  */
 function isDraftGone(error) {
     for (let e = error, depth = 0; e instanceof Error && depth < 5; e = e.cause, depth++) {
-        if (/draft changes: HTTP (404|410)\b/.test(e.message))
+        if (/draft (?:changes|index): HTTP (?:404|410)\b/.test(e.message))
             return true;
     }
     return false;

package/dist/proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAoB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAwC3C,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EAEtB,uBAAuB,EAEvB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,KAAK,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/E,8FAA8F;AAC9F,MAAM,eAAe,GAAkB,MAAM,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAc,EACd,OAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,gFAAgF;IAChF,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC;IACjF,qEAAqE;IACrE,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,6EAA6E;YAC7E,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9D,OAAO,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACL,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9D,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACrF,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4CAA4C;AAC5C,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,MAAM,WAAW,GAAG;IAClB,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,wBAAwB;IACxB,oBAAoB;CACrB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA8B,EAC9B,QAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD,uGAAuG;AACvG,SAAS,OAAO,CAAC,OAA8B;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAClF,IAAI,SAAS;QAAE,OAAO,SAAS,KAAK,OAAO,CAAC;IAC5C,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA8B,EAC9B,KAAoB;IAEpB,mFAAmF;IACnF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;QACtC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB;QAClE,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,QAAyB;IAC/E,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAqB,QAAW,EAAE,QAAyB;IACrF,IAAI,QAAQ,CAAC,SAAS;QAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAwB,EACxB,KAAoB,EACpB,OAAwB;IAExB,2FAA2F;IAC3F,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,OAAO,uBAAuB,CAAC,GAAG,EAAE;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,KAAK,CAAC,OAAO;QAChB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAgB,EAChB,WAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wGAAwG;AACxG,SAAS,gBAAgB,CACvB,OAA8B,EAC9B,KAAoB,EACpB,OAAoC,EACpC,WAA2C;IAE3C,IAAI,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,GAAG,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAoB,EACpB,QAAuB,EACvB,OAAyB,EACzB,WAAgC;IAEhC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACpC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,GAAG,CAAC,QAAQ,GAAG,GAAG,kBAAkB,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACtD,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;QAC/B,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE;KAChF,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAwB,EACxB,OAAoB,EACpB,KAAoB,EACpB,OAAwB;IAExB,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACpC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,GAAG,CAAC,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;QACzC,OAAO,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;KAC1D,CAAC,CAAC;IACH,sFAAsF;IACtF,8EAA8E;IAC9E,IAAI,MAAM;QAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAqB,QAAW,EAAE,QAAuB;IACjF,IAAI,QAAQ,CAAC,SAAS;QAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,GAAoC,EACpC,OAAO,GAAsB,EAAE;IAE/B,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACtD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,WAAW,IAAI,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,kBAAkB,GACtB,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;QAC5F,MAAM,SAAS,GAAG,kBAAkB;YAClC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,QAAQ,GAAG,SAAS,CAAC;QACzB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChE,QAAQ;gBACN,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpF,YAAY,CAAC,IAAI,CAAC;wBAChB,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;qBAC5E,CAAC,CAAC;QACP,CAAC;QACD,OAAO,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAoB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAwC3C,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EAEtB,uBAAuB,EAEvB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,KAAK,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/E,8FAA8F;AAC9F,MAAM,eAAe,GAAkB,MAAM,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAc,EACd,OAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,gFAAgF;IAChF,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC;IACjF,qEAAqE;IACrE,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,6EAA6E;YAC7E,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9D,OAAO,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACL,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9D,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACrF,IAAI,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4CAA4C;AAC5C,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,MAAM,WAAW,GAAG;IAClB,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,wBAAwB;IACxB,oBAAoB;CACrB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA8B,EAC9B,QAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD,uGAAuG;AACvG,SAAS,OAAO,CAAC,OAA8B;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAClF,IAAI,SAAS;QAAE,OAAO,SAAS,KAAK,OAAO,CAAC;IAC5C,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA8B,EAC9B,KAAoB;IAEpB,mFAAmF;IACnF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;QACtC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB;QAClE,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,QAAyB;IAC/E,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAqB,QAAW,EAAE,QAAyB;IACrF,IAAI,QAAQ,CAAC,SAAS;QAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAwB,EACxB,KAAoB,EACpB,OAAwB;IAExB,2FAA2F;IAC3F,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,OAAO,uBAAuB,CAAC,GAAG,EAAE;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,KAAK,CAAC,OAAO;QAChB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAgB,EAChB,WAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wGAAwG;AACxG,SAAS,gBAAgB,CACvB,OAA8B,EAC9B,KAAoB,EACpB,OAAoC,EACpC,WAA2C;IAE3C,IAAI,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,GAAG,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAoB,EACpB,QAAuB,EACvB,OAAyB,EACzB,WAAgC;IAEhC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACpC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,GAAG,CAAC,QAAQ,GAAG,GAAG,kBAAkB,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACtD,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;QAC/B,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE;KAChF,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAwB,EACxB,OAAoB,EACpB,KAAoB,EACpB,OAAwB;IAExB,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACpC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,GAAG,CAAC,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;QACzC,OAAO,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;KAC1D,CAAC,CAAC;IACH,sFAAsF;IACtF,8EAA8E;IAC9E,IAAI,MAAM;QAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAqB,QAAW,EAAE,QAAuB;IACjF,IAAI,QAAQ,CAAC,SAAS;QAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,GAAoC,EACpC,OAAO,GAAsB,EAAE;IAE/B,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACtD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,WAAW,IAAI,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,kBAAkB,GACtB,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;QAC5F,MAAM,SAAS,GAAG,kBAAkB;YAClC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,QAAQ,GAAG,SAAS,CAAC;QACzB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChE,QAAQ;gBACN,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpF,YAAY,CAAC,IAAI,CAAC;wBAChB,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;qBAC5E,CAAC,CAAC;QACP,CAAC;QACD,OAAO,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}

package/dist/studio.d.ts

@@ -21,6 +21,26 @@ export declare const STUDIO_ORIGINS: readonly string[];
  * Studio runs on the same machine.
  */
 export declare const STUDIO_FRAME_ANCESTORS: readonly string[];
+/** Studio's production origin. */
+export declare const STUDIO_ORIGIN = "https://studio.decocms.com";
+/**
+ * The exact origins a page trusts for the Studio channel by default, and adds
+ * to its CSP (`script-src`, `frame-ancestors`): Studio's production and
+ * staging origins. No wildcard: each one is compared exactly.
+ */
+export declare const DEFAULT_STUDIO_ORIGINS: readonly string[];
+/**
+ * The Studio origins the page trusts: the Studio channel accepts messages and
+ * modules from them, and the binding adds them to the page's CSP `script-src`
+ * and `frame-ancestors`. The binding option when given (an empty list turns
+ * the channel off), else the `DECO_STUDIO_ORIGIN` environment variable, a
+ * comma-separated list (a local or staging Studio, such as
+ * `http://localhost:3000`; read where `process.env` exists, so on the
+ * server), else {@link DEFAULT_STUDIO_ORIGINS}. Each entry must be an exact
+ * http(s) origin; any other value (a path, a wildcard, a CSP keyword) is
+ * dropped, so the list never widens the CSP beyond origins.
+ */
+export declare function studioOrigins(option?: readonly string[]): readonly string[];
 /**
  * Whether `origin` (a `MessageEvent.origin`, an `Origin` header) is one of
  * {@link STUDIO_ORIGINS}: `https`, the default port, and `decocms.com` or a

package/dist/studio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"studio.d.ts","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAK1C,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAazE"}
+{"version":3,"file":"studio.d.ts","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAK1C,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAEH,kCAAkC;AAClC,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAkBH;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAK3E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAazE"}

package/dist/studio.js

@@ -30,6 +30,53 @@ export const STUDIO_FRAME_ANCESTORS = Object.freeze([
     ...STUDIO_ORIGINS,
     "https://*.deco.studio",
 ]);
+/** Studio's production origin. */
+export const STUDIO_ORIGIN = "https://studio.decocms.com";
+/**
+ * The exact origins a page trusts for the Studio channel by default, and adds
+ * to its CSP (`script-src`, `frame-ancestors`): Studio's production and
+ * staging origins. No wildcard: each one is compared exactly.
+ */
+export const DEFAULT_STUDIO_ORIGINS = Object.freeze([
+    STUDIO_ORIGIN,
+    "https://studio-stg.decocms.com",
+]);
+/** `value` as an exact http(s) origin (`https://host[:port]`, a trailing `/` dropped; no wildcard), or `""`. */
+function asOrigin(value) {
+    if (typeof value !== "string")
+        return "";
+    const trimmed = value.trim();
+    try {
+        const url = new URL(trimmed);
+        if (url.protocol !== "https:" && url.protocol !== "http:")
+            return "";
+        // A host name or an IP address: a URL parser accepts `*` in a host, which a
+        // CSP source would read as a wildcard.
+        if (!/^(\[[0-9a-f:.]+\]|[a-z0-9_.-]+)$/.test(url.hostname))
+            return "";
+        return trimmed === url.origin || trimmed === `${url.origin}/` ? url.origin : "";
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * The Studio origins the page trusts: the Studio channel accepts messages and
+ * modules from them, and the binding adds them to the page's CSP `script-src`
+ * and `frame-ancestors`. The binding option when given (an empty list turns
+ * the channel off), else the `DECO_STUDIO_ORIGIN` environment variable, a
+ * comma-separated list (a local or staging Studio, such as
+ * `http://localhost:3000`; read where `process.env` exists, so on the
+ * server), else {@link DEFAULT_STUDIO_ORIGINS}. Each entry must be an exact
+ * http(s) origin; any other value (a path, a wildcard, a CSP keyword) is
+ * dropped, so the list never widens the CSP beyond origins.
+ */
+export function studioOrigins(option) {
+    const env = globalThis.process
+        ?.env?.DECO_STUDIO_ORIGIN;
+    const list = option ?? (env?.trim() ? env.split(",") : DEFAULT_STUDIO_ORIGINS);
+    return [...new Set(list.map(asOrigin).filter(Boolean))];
+}
 /**
  * Whether `origin` (a `MessageEvent.origin`, an `Origin` header) is one of
  * {@link STUDIO_ORIGINS}: `https`, the default port, and `decocms.com` or a

package/dist/studio.js.map

@@ -1 +1 @@
-{"version":3,"file":"studio.js","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,4BAA4B;IAC5B,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,QAAQ;IACR,GAAG,cAAc;IACjB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiC;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,yBAAyB;IACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"studio.js","sourceRoot":"","sources":["../src/studio.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,4BAA4B;IAC5B,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,QAAQ;IACR,GAAG,cAAc;IACjB,uBAAuB;CACxB,CAAC,CAAC;AAEH,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,aAAa;IACb,gCAAgC;CACjC,CAAC,CAAC;AAEH,gHAAgH;AAChH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QACrE,4EAA4E;QAC5E,uCAAuC;QACvC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACtE,OAAO,OAAO,KAAK,GAAG,CAAC,MAAM,IAAI,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,MAA0B;IACtD,MAAM,GAAG,GAAI,UAAyE,CAAC,OAAO;QAC5F,EAAE,GAAG,EAAE,kBAAkB,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiC;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,yBAAyB;IACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/nextjs",
-  "version": "8.9.1",
+  "version": "8.10.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -67,7 +67,7 @@
     }
   },
   "devDependencies": {
-    "@decocms/blocks": "8.9.1",
+    "@decocms/blocks": "8.10.0",
     "@opentelemetry/api": "^1.9.1",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",

package/src/StudioBridge.ts

@@ -1,23 +1,42 @@
 /**
  * `StudioBridge` of `@decocms/blocks/preview` with Studio's origins filled in
  * (`STUDIO_ORIGINS`, `./studio.ts`): the package owns where Studio runs, so a
- * site passes only its name. One inline script and no hooks, so a Server
- * Component renders it as is.
+ * site passes only its name. With it, the Studio channel (`StudioChannel`):
+ * on every page, production included, framed by one of Studio's origins
+ * (`studioOrigins` / `DECO_STUDIO_ORIGIN` / Studio's production and staging
+ * origins, each exact) it loads the editor's own modules from that origin;
+ * otherwise it does nothing. Two inline scripts and no hooks, so a Server
+ * Component renders it as is. The site's CSP allows the same origins with
+ * `withStudioCsp`.
  */
 import {
   StudioBridge as BridgeScript,
   type StudioBridgeProps as BridgeScriptProps,
+  StudioChannel,
 } from "@decocms/blocks/preview";
-import { createElement, type ReactNode } from "react";
-import { STUDIO_ORIGINS } from "./studio.ts";
+import { createElement, Fragment, type ReactNode } from "react";
+import { STUDIO_ORIGINS, studioOrigins } from "./studio.ts";
 
-/** `site`, and optionally `editShortcut` and `nonce`; Studio's origins are the package's. */
-export type StudioBridgeProps = Omit<BridgeScriptProps, "trustedOrigins">;
+/** `site`, and optionally `editShortcut`, `page` and `nonce`; Studio's origins are the package's. */
+export interface StudioBridgeProps extends Omit<BridgeScriptProps, "trustedOrigins"> {
+  /**
+   * The Studio origins the Studio channel trusts, each an exact origin.
+   * Default: `DECO_STUDIO_ORIGIN` (comma-separated), else Studio's production
+   * and staging origins (`DEFAULT_STUDIO_ORIGINS`). A site with a CSP passes
+   * the same list to `withStudioCsp`, which adds it to `script-src`.
+   */
+  studioOrigins?: readonly string[];
+}
 
 /**
  * Lets Studio's site editor select and edit sections on the page when Studio
  * frames it. Render it once, in the root layout's `<body>`.
  */
-export function StudioBridge(props: StudioBridgeProps): ReactNode {
-  return createElement(BridgeScript, { ...props, trustedOrigins: STUDIO_ORIGINS });
+export function StudioBridge({ studioOrigins: origins, ...props }: StudioBridgeProps): ReactNode {
+  return createElement(
+    Fragment,
+    null,
+    createElement(BridgeScript, { ...props, trustedOrigins: STUDIO_ORIGINS }),
+    createElement(StudioChannel, { studioOrigins: studioOrigins(origins), nonce: props.nonce }),
+  );
 }

package/src/assignments.ts

@@ -55,22 +55,14 @@ function record(): Assignments {
 }
 
 /**
- * Whether the content saves a block of `type`: listing never fails on a
- * missing block, so a site without tests or campaigns reports no error.
+ * The saved `block` resolved, each name `true` or `false`; `null` when the
+ * content saves none. Whether it exists comes from the index (`NOT_FOUND`,
+ * which is no error to report), with no body listed.
  */
-async function saves(client: Reader, type: string): Promise<boolean> {
-  const [list] = await client.list(type);
-  return (list?.length ?? 0) > 0;
-}
-
-/** The saved `block` resolved, each name `true` or `false`; `null` when the content saves none. */
-async function decided(
-  client: Reader,
-  spec: { block: string; type: string },
-): Promise<Assignments | null> {
+async function decided(client: Reader, spec: { block: string }): Promise<Assignments | null> {
   try {
-    if (!(await saves(client, spec.type))) return null;
-    const [value] = await client.resolve<unknown>(spec.block);
+    const [value, error] = await client.resolve<unknown>(spec.block);
+    if (error?.code === "NOT_FOUND") return null;
     const out = record();
     if (!isRecord(value)) return out;
     for (const name of Object.keys(value).sort(byCodeUnit)) out[name] = value[name] === true;

package/src/csp.ts

@@ -0,0 +1,100 @@
+/**
+ * What Studio needs in a page's Content Security Policy: its origins in
+ * `script-src` (the Studio channel imports Studio's modules from them) and in
+ * `frame-ancestors` (its site editor frames the page). A Next.js site writes
+ * its own policy (`next.config` headers, or its proxy); it passes the
+ * directives through {@link withStudioCsp}, which adds both. The origins are
+ * {@link studioOrigins}: the same list `StudioBridge`'s Studio channel trusts.
+ * The package's own copy (it never imports `@decocms/tanstack`). No framework
+ * code: safe in every bundle.
+ */
+import { STUDIO_FRAME_ANCESTORS, studioOrigins } from "./studio.ts";
+
+/** A Studio on this machine, in local development. */
+export const LOOPBACK_ANCESTORS: readonly string[] = Object.freeze([
+  "http://localhost:*",
+  "http://127.0.0.1:*",
+]);
+
+export interface StudioCspOptions {
+  /**
+   * Studio's origins; default {@link studioOrigins}() (`DECO_STUDIO_ORIGIN`,
+   * else production and staging). Read through {@link studioOrigins} like any
+   * other value: an entry that isn't an exact http(s) origin is dropped.
+   */
+  studioOrigins?: readonly string[];
+  /** More origins that may frame the site, besides Studio's (a marketing tool's editor). */
+  frameAncestors?: readonly string[];
+  /** Local development: loopback may frame the site. */
+  dev?: boolean;
+  /** Add `frame-ancestors` when the directives have none. Default `true`. */
+  addFrameAncestors?: boolean;
+}
+
+/** The directives of a policy (`"a; b"` or `["a", "b"]`), trimmed, empty ones dropped. */
+export function cspDirectives(value: string | readonly string[] | undefined): string[] {
+  if (value === undefined) return [];
+  const list = typeof value === "string" ? value.split(";") : [...value];
+  return list.map((d) => d.trim()).filter(Boolean);
+}
+
+const nameOf = (directive: string) => (directive.split(/\s+/, 1)[0] ?? "").toLowerCase();
+const isNone = (values: readonly string[]) =>
+  values.length === 1 && values[0]?.toLowerCase() === "'none'";
+
+/** `directive` with each of `sources` it lacks appended; one that is `'none'` stays as is. */
+function withSources(directive: string, sources: readonly string[]): string {
+  const [name = "", ...values] = directive.split(/\s+/);
+  if (isNone(values)) return directive;
+  const have = new Set(values.map((v) => v.toLowerCase()));
+  const extra = sources.filter((s) => !have.has(s.toLowerCase()));
+  return extra.length ? [name, ...values, ...extra].join(" ") : directive;
+}
+
+/** The `frame-ancestors` sources: Studio's, the site's own, and loopback in development. */
+export function studioFrameAncestors(options: StudioCspOptions = {}): string[] {
+  return [
+    ...new Set([
+      ...STUDIO_FRAME_ANCESTORS,
+      ...studioOrigins(options.studioOrigins),
+      ...(options.frameAncestors ?? []),
+      ...(options.dev ? LOOPBACK_ANCESTORS : []),
+    ]),
+  ];
+}
+
+/**
+ * A policy's directives with what Studio needs added: Studio's origins in
+ * `script-src` (and `script-src-elem`), so the Studio channel can import
+ * Studio's modules, and a `frame-ancestors` with Studio's (when the policy has
+ * none). A policy that restricts scripts only through `default-src` gets a
+ * `script-src` with `default-src`'s sources plus Studio's, which allows the
+ * same scripts as before and Studio's modules. A policy that doesn't restrict
+ * scripts, or forbids them all (`'none'`), keeps its scripts as they are.
+ * A site's own `frame-ancestors` is kept as is.
+ */
+export function withStudioCsp(
+  directives: string | readonly string[] | undefined,
+  options: StudioCspOptions = {},
+): string[] {
+  const origins = studioOrigins(options.studioOrigins);
+  let list = cspDirectives(directives);
+  if (origins.length) {
+    const isScript = (d: string) => ["script-src", "script-src-elem"].includes(nameOf(d));
+    if (list.some(isScript)) {
+      list = list.map((d) => (isScript(d) ? withSources(d, origins) : d));
+    } else {
+      const fallback = list.find((d) => nameOf(d) === "default-src");
+      const values = fallback?.split(/\s+/).slice(1) ?? [];
+      if (fallback && !isNone(values)) {
+        list.push(withSources(["script-src", ...values].join(" "), origins));
+      }
+    }
+  }
+  if (options.addFrameAncestors !== false && !list.some((d) => nameOf(d) === "frame-ancestors")) {
+    list.push(
+      `frame-ancestors ${studioFrameAncestors({ ...options, studioOrigins: origins }).join(" ")}`,
+    );
+  }
+  return list;
+}

package/src/index.ts

@@ -8,16 +8,23 @@
  *   lets Studio's site editor drive the page when Studio frames it
  *   (`@decocms/blocks/preview`'s, answering `STUDIO_ORIGINS`). It renders an
  *   inline script with no React hooks, so a Server Component renders it as is.
- *   Outside Studio's frame, "." opens the page in Studio's editor.
+ *   Outside Studio's frame, "." opens the page in Studio's editor. It also
+ *   mounts the Studio channel (`StudioChannel`), through which Studio loads its
+ *   own modules into the page when it frames it (`studioOrigins`).
  * - `StudioPage`: rendered inside each CMS page, `<StudioPage pathTemplate={page.path} />`,
  *   tells the bridge which page "." opens (the root layout doesn't re-render per page).
  * - `DRAFT_PARAM`, `DRAFT_COOKIE`, `VERSION_HEADER`, `draftResponseHeaders`,
  *   `VISITOR_HEADER`, `ASSIGNMENTS_HEADER`,
- *   `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS`, `isStudioOrigin`: for a site
+ *   `STUDIO_ORIGINS`, `STUDIO_FRAME_ANCESTORS`, `isStudioOrigin`,
+ *   `STUDIO_ORIGIN`, `DEFAULT_STUDIO_ORIGINS`, `studioOrigins`: for a site
  *   that needs them in its own code (a route that sets its own headers, a CSP
  *   it writes itself). The package's own copy: it never imports
  *   `@decocms/tanstack`.
  *
+ * - `withStudioCsp(directives)`: the site's CSP with Studio's origins added to
+ *   `script-src` (the Studio channel's modules) and `frame-ancestors` (when it
+ *   has none), the same list the Studio channel trusts.
+ *
  * The proxy (`/proxy`), the pages (`/server`), `next.config` (`/config`) and the
  * image loader (`/image-loader`) are separate subpaths, so the proxy never
  * loads React.
@@ -25,11 +32,19 @@
 
 export { DraftBadge, StudioPage, type StudioPageInfo } from "@decocms/blocks/preview";
 export { ASSIGNMENTS_HEADER } from "./assignments.ts";
+export { type StudioCspOptions, withStudioCsp } from "./csp.ts";
 export {
   DraftPreviewIndicator,
   type DraftPreviewIndicatorProps,
 } from "./DraftPreviewIndicator.tsx";
 export { DRAFT_COOKIE, DRAFT_PARAM, draftResponseHeaders, VERSION_HEADER } from "./draft.ts";
 export { StudioBridge, type StudioBridgeProps } from "./StudioBridge.ts";
-export { isStudioOrigin, STUDIO_FRAME_ANCESTORS, STUDIO_ORIGINS } from "./studio.ts";
+export {
+  DEFAULT_STUDIO_ORIGINS,
+  isStudioOrigin,
+  STUDIO_FRAME_ANCESTORS,
+  STUDIO_ORIGIN,
+  STUDIO_ORIGINS,
+  studioOrigins,
+} from "./studio.ts";
 export { VISITOR_HEADER } from "./visitor.ts";

package/src/proxy/index.ts

@@ -189,7 +189,7 @@ export async function decideDraft(
  */
 function isDraftGone(error: unknown): boolean {
   for (let e = error, depth = 0; e instanceof Error && depth < 5; e = e.cause, depth++) {
-    if (/draft changes: HTTP (404|410)\b/.test(e.message)) return true;
+    if (/draft (?:changes|index): HTTP (?:404|410)\b/.test(e.message)) return true;
   }
   return false;
 }

package/src/studio.ts

@@ -33,6 +33,53 @@ export const STUDIO_FRAME_ANCESTORS: readonly string[] = Object.freeze([
   "https://*.deco.studio",
 ]);
 
+/** Studio's production origin. */
+export const STUDIO_ORIGIN = "https://studio.decocms.com";
+
+/**
+ * The exact origins a page trusts for the Studio channel by default, and adds
+ * to its CSP (`script-src`, `frame-ancestors`): Studio's production and
+ * staging origins. No wildcard: each one is compared exactly.
+ */
+export const DEFAULT_STUDIO_ORIGINS: readonly string[] = Object.freeze([
+  STUDIO_ORIGIN,
+  "https://studio-stg.decocms.com",
+]);
+
+/** `value` as an exact http(s) origin (`https://host[:port]`, a trailing `/` dropped; no wildcard), or `""`. */
+function asOrigin(value: unknown): string {
+  if (typeof value !== "string") return "";
+  const trimmed = value.trim();
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return "";
+    // A host name or an IP address: a URL parser accepts `*` in a host, which a
+    // CSP source would read as a wildcard.
+    if (!/^(\[[0-9a-f:.]+\]|[a-z0-9_.-]+)$/.test(url.hostname)) return "";
+    return trimmed === url.origin || trimmed === `${url.origin}/` ? url.origin : "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * The Studio origins the page trusts: the Studio channel accepts messages and
+ * modules from them, and the binding adds them to the page's CSP `script-src`
+ * and `frame-ancestors`. The binding option when given (an empty list turns
+ * the channel off), else the `DECO_STUDIO_ORIGIN` environment variable, a
+ * comma-separated list (a local or staging Studio, such as
+ * `http://localhost:3000`; read where `process.env` exists, so on the
+ * server), else {@link DEFAULT_STUDIO_ORIGINS}. Each entry must be an exact
+ * http(s) origin; any other value (a path, a wildcard, a CSP keyword) is
+ * dropped, so the list never widens the CSP beyond origins.
+ */
+export function studioOrigins(option?: readonly string[]): readonly string[] {
+  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process
+    ?.env?.DECO_STUDIO_ORIGIN;
+  const list = option ?? (env?.trim() ? env.split(",") : DEFAULT_STUDIO_ORIGINS);
+  return [...new Set(list.map(asOrigin).filter(Boolean))];
+}
+
 /**
  * Whether `origin` (a `MessageEvent.origin`, an `Origin` header) is one of
  * {@link STUDIO_ORIGINS}: `https`, the default port, and `decocms.com` or a