@lumerahq/ui 0.7.3 → 0.7.6

package/dist/{RecordSheet-DJL4aph1.js → RecordSheet-BvHHP8P4.js}

@@ -1,9 +1,9 @@
 import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import React__default, { forwardRef, createElement, useState, useLayoutEffect, useCallback } from "react";
-import { c as automationStatuses, q as getAutomationRunFileDownloadUrl, w as listAutomationRunFiles } from "./automations-NGijzdAj.js";
+import { c as automationStatuses, q as getAutomationRunFileDownloadUrl, w as listAutomationRunFiles } from "./automations-XN4WPV_g.js";
 import { p as clsx, o as cn, a as formatCellValue } from "./formatters-Baj7FkeG.js";
-import { u as useAutomationRun } from "./use-automation-run-CSxc9EhA.js";
+import { u as useAutomationRun } from "./use-automation-run-Cecvf4Aq.js";
 import * as ReactDOM from "react-dom";
 const toKebabCase = (string) => string.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 const toCamelCase = (string) => string.replace(

package/dist/{api-BIZPZp2T.js → api-BrhR_Jjl.js}

@@ -1,4 +1,4 @@
-import { p as parentApiRequest, B as BridgeError } from "./automations-NGijzdAj.js";
+import { p as parentApiRequest, B as BridgeError } from "./automations-XN4WPV_g.js";
 const API_PREFIX = "/api";
 const buildUrl = (path) => {
   const normalized = path.startsWith("/") ? path : `/${path}`;

package/dist/{automations-NGijzdAj.js → automations-XN4WPV_g.js}

@@ -1,10 +1,25 @@
 const DEFAULT_TIMEOUT_MS = 15e3;
 const parseParentOrigins = (value) => (value ?? "").split(",").map((item) => item.trim()).filter(Boolean);
-const EXPECTED_PARENT_ORIGIN = "https://*.lumerahq.com";
-const EXPECTED_PARENT_ORIGINS = [
+const uniqueStrings = (values) => {
+  const seen = /* @__PURE__ */ new Set();
+  return values.filter((value) => {
+    if (!value || seen.has(value)) return false;
+    seen.add(value);
+    return true;
+  });
+};
+const DEFAULT_PARENT_ORIGINS = [
+  "https://*.lumerahq.com",
+  "https://*.lumerahq.dev",
+  "http://localhost:*",
+  "http://127.0.0.1:*"
+];
+const EXPECTED_PARENT_ORIGIN = DEFAULT_PARENT_ORIGINS[0];
+const EXPECTED_PARENT_ORIGINS = uniqueStrings([
+  ...DEFAULT_PARENT_ORIGINS,
   ...parseParentOrigins(void 0),
   EXPECTED_PARENT_ORIGIN
-].filter(Boolean);
+]);
 class BridgeError extends Error {
   status;
   response;
@@ -23,6 +38,7 @@ let storedHostPayload;
 let storedHostOrigin;
 let suppressRouteBroadcast = false;
 let lastBroadcastRoute = "";
+let hasStoredHostPayload = false;
 function getAppProjectExternalId() {
   return storedHostPayload?.app?.projectExternalId;
 }
@@ -80,6 +96,13 @@ function getShareableAppUrl(options) {
 }
 const log = (...args) => {
 };
+const cacheHostPayload = (payload, options) => {
+  storedHostPayload = payload;
+  if (options?.origin) {
+    storedHostOrigin = options.origin;
+  }
+  hasStoredHostPayload = true;
+};
 const generateId = () => {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID();
@@ -89,16 +112,19 @@ const generateId = () => {
 const matchesOriginPattern = (origin, pattern) => {
   if (!origin || !pattern) return false;
   if (origin === pattern) return true;
-  if (!pattern.includes("*")) {
-    return false;
-  }
   try {
     const originUrl = new URL(origin);
-    const hostnameSuffix = pattern.replace(/^https?:\/\//, "").replace(/^\*\./, "");
-    const expectedProtocol = pattern.startsWith("https") ? "https:" : "http:";
-    const hostMatches = originUrl.hostname === hostnameSuffix || originUrl.hostname.endsWith(`.${hostnameSuffix}`);
+    const parsed = pattern.match(/^(https?):\/\/([^/:]+)(?::(\*|\d+))?$/);
+    if (!parsed) {
+      return false;
+    }
+    const [, expectedProtocolName, hostPattern, portPattern] = parsed;
+    const expectedProtocol = `${expectedProtocolName}:`;
     const protocolMatches = originUrl.protocol === expectedProtocol;
-    return hostMatches && protocolMatches;
+    const hostMatches = hostPattern.startsWith("*.") ? originUrl.hostname === hostPattern.slice(2) || originUrl.hostname.endsWith(`.${hostPattern.slice(2)}`) : originUrl.hostname === hostPattern;
+    const normalizedOriginPort = originUrl.port || (originUrl.protocol === "https:" ? "443" : originUrl.protocol === "http:" ? "80" : "");
+    const portMatches = !portPattern || portPattern === "*" || normalizedOriginPort === portPattern;
+    return protocolMatches && hostMatches && portMatches;
   } catch {
     return false;
   }
@@ -106,7 +132,6 @@ const matchesOriginPattern = (origin, pattern) => {
 const isAllowedParentOrigin = (origin, currentOrigin) => {
   if (!origin) return false;
   if (origin === currentOrigin) return true;
-  if (origin.startsWith("http://localhost:")) return true;
   return EXPECTED_PARENT_ORIGINS.some((pattern) => matchesOriginPattern(origin, pattern));
 };
 const PLAYGROUND_FLAG = "__playground__";
@@ -244,9 +269,6 @@ const ensureRouteSync = () => {
   });
 };
 const handleMessage = (event) => {
-  if (event.source !== window.parent) {
-    return;
-  }
   if (!isAllowedParentOrigin(event.origin, window.location.origin)) {
     log("Ignoring message from unexpected origin", {
       expected: EXPECTED_PARENT_ORIGINS,
@@ -255,10 +277,12 @@ const handleMessage = (event) => {
     });
     return;
   }
+  if (event.source && event.source !== window.parent) ;
   const { type, payload } = event.data ?? {};
   if (type === "init") {
-    storedHostOrigin = event.origin;
-    storedHostPayload = payload;
+    cacheHostPayload(payload, {
+      origin: event.origin
+    });
     initListeners.forEach((listener) => listener(payload));
     return;
   }
@@ -313,16 +337,19 @@ const postReadyMessage = () => {
             message: "Playground mode"
           };
           log("Playground mode: init from VB", payload);
-          storedHostPayload = payload;
+          cacheHostPayload(payload);
           setTimeout(() => initListeners.forEach((listener) => listener(payload)), 0);
         } else {
           log("Playground mode: /api/me returned no user, continuing");
+          cacheHostPayload(void 0);
           setTimeout(() => initListeners.forEach((listener) => listener(void 0)), 0);
         }
       } catch (err) {
+        cacheHostPayload(void 0);
         setTimeout(() => initListeners.forEach((listener) => listener(void 0)), 0);
       }
     } else {
+      cacheHostPayload(void 0);
       setTimeout(() => initListeners.forEach((listener) => listener(void 0)), 0);
     }
     return;
@@ -334,7 +361,7 @@ const postReadyMessage = () => {
 const onInitMessage = (listener) => {
   ensureListener();
   initListeners.add(listener);
-  if (isPlaygroundMode() && storedHostPayload) {
+  if (hasStoredHostPayload) {
     setTimeout(() => listener(storedHostPayload), 0);
   }
   return () => initListeners.delete(listener);

package/dist/components/index.js

@@ -1,4 +1,4 @@
-import { A, a, D, b, c, R } from "../RecordSheet-DJL4aph1.js";
+import { A, a, D, b, c, R } from "../RecordSheet-BvHHP8P4.js";
 export {
   A as AutomationRunList,
   a as AutomationRunner,

package/dist/hooks/index.js

@@ -1,5 +1,5 @@
-import { u, a, b, c, d, e } from "../use-sql-table-CEBrg3zE.js";
-import { u as u2 } from "../use-automation-run-CSxc9EhA.js";
+import { u, a, b, c, d, e } from "../use-sql-table-B7C06_An.js";
+import { u as u2 } from "../use-automation-run-Cecvf4Aq.js";
 export {
   u as useAutomationAgent,
   u2 as useAutomationRun,

package/dist/index.js

@@ -1,8 +1,8 @@
-import { A, a, D, b, c, R } from "./RecordSheet-DJL4aph1.js";
-import { u, a as a2, b as b2, c as c2, d, e } from "./use-sql-table-CEBrg3zE.js";
-import { u as u2 } from "./use-automation-run-CSxc9EhA.js";
-import { B, E, c as c3, d as d2, e as e2, f, h, j, k, l, g, m, n, q, r, t, s, a as a3, u as u3, i, v, w, x, y, z, o, p, A as A2, C, b as b3 } from "./automations-NGijzdAj.js";
-import { g as g2, a as a4, p as p2, b as b4, c as c4, d as d3, e as e3, f as f2, h as h2, i as i2, j as j2, k as k2, l as l2, s as s2, u as u4 } from "./api-BIZPZp2T.js";
+import { A, a, D, b, c, R } from "./RecordSheet-BvHHP8P4.js";
+import { u, a as a2, b as b2, c as c2, d, e } from "./use-sql-table-B7C06_An.js";
+import { u as u2 } from "./use-automation-run-Cecvf4Aq.js";
+import { B, E, c as c3, d as d2, e as e2, f, h, j, k, l, g, m, n, q, r, t, s, a as a3, u as u3, i, v, w, x, y, z, o, p, A as A2, C, b as b3 } from "./automations-XN4WPV_g.js";
+import { g as g2, a as a4, p as p2, b as b4, c as c4, d as d3, e as e3, f as f2, h as h2, i as i2, j as j2, k as k2, l as l2, s as s2, u as u4 } from "./api-BrhR_Jjl.js";
 import { o as o2, f as f3, a as a5, b as b5, c as c5, d as d4, e as e4, g as g3, h as h3, i as i3, j as j3, k as k3, l as l3, m as m2, n as n2, s as s3 } from "./formatters-Baj7FkeG.js";
 import { q as q2 } from "./query-client-DdOWay4_.js";
 export {

package/dist/lib/bridge.d.ts

@@ -7,12 +7,22 @@
  * - API request proxying through the parent
  * - Standalone dev mode for local development
  *
+ * Future cleanup direction:
+ * - Prefer `VITE_PARENT_ORIGINS` over `VITE_PARENT_ORIGIN` for all new code.
+ * - Prefer the allowlist model (`EXPECTED_PARENT_ORIGINS`) over the singular
+ *   compatibility export (`EXPECTED_PARENT_ORIGIN`).
+ * - Once all downstream apps/configs have migrated to the plural env var and no
+ *   external consumers import `EXPECTED_PARENT_ORIGIN`, we can deprecate then
+ *   remove:
+ *   - `VITE_PARENT_ORIGIN`
+ *   - `EXPECTED_PARENT_ORIGIN`
+ * - That removal should happen only in a deliberate breaking release after:
+ *   1. templates and docs use only `VITE_PARENT_ORIGINS`
+ *   2. published Lumera apps no longer depend on the singular export/env var
+ *   3. a major/minor migration note is shipped for external consumers
+ *
  * @module bridge
  */
-/**
- * Expected parent origin for security validation.
- * Supports wildcards like `https://*.lumerahq.com`
- */
 export declare const EXPECTED_PARENT_ORIGIN: any;
 /**
  * Payload received from the parent during initialization.

package/dist/lib/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/lib/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,KAC+E,CAAC;AAWnH;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,yEAAyE;QACzE,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,4BAA4B;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,EAAE,EAAE,OAAO,CAAC;IACZ,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAWF;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc;CAMxE;AAgBD;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAE5D;AAmDD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAgBvF;AAsaD;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,QAAO,OAAsE,CAAC;AAErG;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAAO,IAwEnC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,GAAI,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAgB/F,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,GAAU,SAAS,aAAa,KAAG,OAAO,CAAC,cAAc,CAgDrF,CAAC"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/lib/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA0CH,eAAO,MAAM,sBAAsB,KAAkE,CAAC;AAYtG;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,yEAAyE;QACzE,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,4BAA4B;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,EAAE,EAAE,OAAO,CAAC;IACZ,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAWF;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc;CAMxE;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAE5D;AAmDD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAgBvF;AA0bD;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,QAAO,OAAsE,CAAC;AAErG;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAAO,IA2EnC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,GAAI,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAkB/F,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,GAAU,SAAS,aAAa,KAAG,OAAO,CAAC,cAAc,CAgDrF,CAAC"}

package/dist/lib/index.js

@@ -1,5 +1,5 @@
-import { B, E, c, d, e, f, h, j, k, l, g, m, n, q, r, t, s, a, u, i, v, w, x, y, z, o, p, A, C, b } from "../automations-NGijzdAj.js";
-import { g as g2, a as a2, p as p2, b as b2, c as c2, d as d2, e as e2, f as f2, h as h2, i as i2, j as j2, k as k2, l as l2, s as s2, u as u2 } from "../api-BIZPZp2T.js";
+import { B, E, c, d, e, f, h, j, k, l, g, m, n, q, r, t, s, a, u, i, v, w, x, y, z, o, p, A, C, b } from "../automations-XN4WPV_g.js";
+import { g as g2, a as a2, p as p2, b as b2, c as c2, d as d2, e as e2, f as f2, h as h2, i as i2, j as j2, k as k2, l as l2, s as s2, u as u2 } from "../api-BrhR_Jjl.js";
 import { o as o2, f as f3, a as a3, b as b3, c as c3, d as d3, e as e3, g as g3, h as h3, i as i3, j as j3, k as k3, l as l3, m as m2, n as n2, s as s3 } from "../formatters-Baj7FkeG.js";
 import { q as q2 } from "../query-client-DdOWay4_.js";
 export {

package/dist/{use-automation-run-CSxc9EhA.js → use-automation-run-Cecvf4Aq.js}

@@ -1,6 +1,6 @@
 import { useQueryClient, useMutation, useQuery } from "@tanstack/react-query";
 import { useState, useRef, useEffect, useCallback } from "react";
-import { k as ensureAutomationRun, h as createAutomationRun, d as cancelAutomationRun, c as automationStatuses, n as getAutomationRun } from "./automations-NGijzdAj.js";
+import { k as ensureAutomationRun, h as createAutomationRun, d as cancelAutomationRun, c as automationStatuses, n as getAutomationRun } from "./automations-XN4WPV_g.js";
 function useAutomationRun(options) {
   const {
     agentId,

package/dist/{use-sql-table-CEBrg3zE.js → use-sql-table-B7C06_An.js}

@@ -1,7 +1,7 @@
 import { useQueryClient, useQuery, useMutation } from "@tanstack/react-query";
 import { useState, useCallback, useEffect, useMemo } from "react";
-import { y as listRunsByAgent, c as automationStatuses, h as createAutomationRun, o as onInitMessage } from "./automations-NGijzdAj.js";
-import { u as uploadFile, i as pbSql, k as pbUpdateRecord } from "./api-BIZPZp2T.js";
+import { y as listRunsByAgent, c as automationStatuses, h as createAutomationRun, o as onInitMessage } from "./automations-XN4WPV_g.js";
+import { u as uploadFile, i as pbSql, k as pbUpdateRecord } from "./api-BrhR_Jjl.js";
 function useAutomationAgent({
   agentId,
   limit = 5,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumerahq/ui",
-  "version": "0.7.3",
+  "version": "0.7.6",
   "type": "module",
   "sideEffects": [
     "*.css"