@mondaydotcomorg/z2h-cli 0.18.0 → 0.19.0-feat-arielle-fixed-preview-id-8f3fc72

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAUtG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAWD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3E"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAYtG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAWD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3E"}

package/dist/commands/deploy.js

@@ -1,7 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const os = require('node:os');
-const crypto = require('node:crypto');
 const fs = require('fs-extra');
 const util_logger = require('../util/logger.js');
 const shadow_paths = require('../shadow/paths.js');
@@ -20,6 +19,8 @@ const util_broker_app = require('../util/broker/app.js');
 const util_openBrowser = require('../util/open-browser.js');
 const commands_build = require('./build.js');
 const commands_tag = require('./tag.js');
+const shadow_metadata = require('../shadow/metadata.js');
+const shadow_prepare = require('../shadow/prepare.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
@@ -63,7 +64,8 @@ async function buildAndStamp(opts) {
     };
 }
 async function deployPreview({ paths, consumerName, appName, token, opts }) {
-    const previewId = opts.previewId ?? crypto.randomUUID().slice(0, 8);
+    const meta = await shadow_metadata.readMetadata(paths);
+    const previewId = opts.previewId ?? meta?.previewId ?? shadow_prepare.generatePreviewId();
     const previewSlug = util_appName.buildPreviewSlug(consumerName, previewId);
     const previewAppName = util_appName.mfAppName(previewSlug);
     const keyPrefix = `${constants.S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;

package/dist/esm/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAUtG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAWD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3E"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAYtG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAWD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3E"}

package/dist/esm/commands/deploy.mjs

@@ -1,5 +1,4 @@
 import os from 'node:os';
-import { randomUUID } from 'node:crypto';
 import { readJson } from 'fs-extra';
 import { info, output, getOutputMode, warn } from '../util/logger.mjs';
 import { resolveConsumerPaths } from '../shadow/paths.mjs';
@@ -18,6 +17,8 @@ import { registerOrUpdateApp } from '../util/broker/app.mjs';
 import { openInBrowser } from '../util/open-browser.mjs';
 import { buildCommand } from './build.mjs';
 import { promptForTags } from './tag.mjs';
+import { readMetadata } from '../shadow/metadata.mjs';
+import { generatePreviewId } from '../shadow/prepare.mjs';
 
 // Should be run from the consumer app directory — uses process.cwd() to locate it.
 async function deployCommand(opts = {}) {
@@ -57,7 +58,8 @@ async function buildAndStamp(opts) {
     };
 }
 async function deployPreview({ paths, consumerName, appName, token, opts }) {
-    const previewId = opts.previewId ?? randomUUID().slice(0, 8);
+    const meta = await readMetadata(paths);
+    const previewId = opts.previewId ?? meta?.previewId ?? generatePreviewId();
     const previewSlug = buildPreviewSlug(consumerName, previewId);
     const previewAppName = mfAppName(previewSlug);
     const keyPrefix = `${S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;

package/dist/esm/migrations/007-proxy-iframe-src.d.ts

@@ -0,0 +1,3 @@
+import type { Tree } from '@nx/devkit';
+export default function proxyIframeSrc(tree: Tree): void;
+//# sourceMappingURL=007-proxy-iframe-src.d.ts.map

package/dist/esm/migrations/007-proxy-iframe-src.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"007-proxy-iframe-src.d.ts","sourceRoot":"","sources":["../../../src/migrations/007-proxy-iframe-src.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAqBvC,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAoCvD"}

package/dist/esm/migrations/007-proxy-iframe-src.mjs

@@ -0,0 +1,49 @@
+// Backfills the html-embed template's `toProxiedUrl` fix onto apps scaffolded before it
+// existed. Matches any relative `.html?url` import, not just `./page.html` — apps are
+// free to name/nest their embedded HTML file however they like (e.g. `./pages/foo.html`).
+const IFRAME_URL_IMPORT = /import\s+(\w+)\s+from\s+(['"])(\.\/[^'"]+?\.html)\?url\2;?/;
+function toProxiedUrlBlock() {
+    return [
+        '',
+        "const Z2H_MFS_BASE_URL = 'https://bigbrain-zth-mf-assets.bigbrain.me';",
+        "const Z2H_ASSETS_PROXY_PREFIX = '/z2h-assets';",
+        '',
+        'function toProxiedUrl(url: string): string {',
+        '  if (!url.startsWith(Z2H_MFS_BASE_URL)) return url;',
+        '  return `${window.location.origin}${Z2H_ASSETS_PROXY_PREFIX}${url.slice(Z2H_MFS_BASE_URL.length)}`;',
+        '}',
+    ].join('\n');
+}
+function proxyIframeSrc(tree) {
+    for (const entry of tree.children('.')) {
+        if (entry.startsWith('.')) {
+            continue;
+        }
+        const indexPath = `${entry}/src/index.tsx`;
+        if (!tree.exists(indexPath)) {
+            continue;
+        }
+        const source = tree.read(indexPath, 'utf-8');
+        if (!source.includes('<iframe') || source.includes('toProxiedUrl')) {
+            continue;
+        }
+        const importMatch = source.match(IFRAME_URL_IMPORT);
+        if (!importMatch) {
+            continue;
+        }
+        const [importLine, varName, , relativePath] = importMatch;
+        const htmlPath = `${entry}/src/${relativePath.replace(/^\.\//, '')}`;
+        if (!tree.exists(htmlPath)) {
+            continue;
+        }
+        const srcAttr = `src={${varName}}`;
+        if (!source.includes(srcAttr)) {
+            continue;
+        }
+        const withBlock = source.replace(importLine, `${importLine}\n${toProxiedUrlBlock()}`);
+        const rewritten = withBlock.replace(srcAttr, `src={toProxiedUrl(${varName})}`);
+        tree.write(indexPath, rewritten);
+    }
+}
+
+export { proxyIframeSrc as default };

package/dist/esm/migrations/__tests__/007-proxy-iframe-src.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=007-proxy-iframe-src.test.d.ts.map

package/dist/esm/migrations/__tests__/007-proxy-iframe-src.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"007-proxy-iframe-src.test.d.ts","sourceRoot":"","sources":["../../../../src/migrations/__tests__/007-proxy-iframe-src.test.ts"],"names":[],"mappings":""}

package/dist/esm/shadow/prepare.d.ts

@@ -1,3 +1,4 @@
 import type { PreparedShadow } from '../types';
 export declare function prepareShadow(consumerDir?: string): Promise<PreparedShadow>;
+export declare function generatePreviewId(): string;
 //# sourceMappingURL=prepare.d.ts.map

package/dist/esm/shadow/prepare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prepare.d.ts","sourceRoot":"","sources":["../../../src/shadow/prepare.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAA8B,cAAc,EAAkB,MAAM,UAAU,CAAC;AAE3F,wBAAsB,aAAa,CAAC,WAAW,GAAE,MAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgChG"}
+{"version":3,"file":"prepare.d.ts","sourceRoot":"","sources":["../../../src/shadow/prepare.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAA8B,cAAc,EAAkB,MAAM,UAAU,CAAC;AAE3F,wBAAsB,aAAa,CAAC,WAAW,GAAE,MAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgChG;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/esm/shadow/prepare.mjs

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { pathExists, readJson, ensureDir } from 'fs-extra';
 import { info } from '../util/logger.mjs';
 import { cleanAppName } from '../util/app-name.mjs';
@@ -35,6 +36,9 @@ async function prepareShadow(consumerDir = process.cwd()) {
     await syncShadow(paths, consumerPkg);
     return { appName, port, paths };
 }
+function generatePreviewId() {
+    return randomUUID().slice(0, 8);
+}
 /**
  * Resolve the dev server port. Prefer the persisted port if it's still free
  * (URL stays stable across restarts). Otherwise pick a fresh one. The
@@ -43,16 +47,20 @@ async function prepareShadow(consumerDir = process.cwd()) {
  */
 async function resolvePortAndMetadata(paths, appName) {
     const existing = await readMetadata(paths);
-    if (existing?.port && (await isPortFree(existing.port))) {
-        return existing;
+    let port = existing?.port;
+    if (!port || !(await isPortFree(port))) {
+        port = await pickPort();
     }
     const next = {
         createdAt: existing?.createdAt ?? new Date().toISOString(),
         appName,
-        port: await pickPort(),
+        port,
+        previewId: existing?.previewId ?? generatePreviewId(),
     };
-    await writeMetadata(paths, next);
+    if (JSON.stringify(next) !== JSON.stringify(existing)) {
+        await writeMetadata(paths, next);
+    }
     return next;
 }
 
-export { prepareShadow };
+export { generatePreviewId, prepareShadow };

package/dist/esm/types.d.ts

@@ -26,6 +26,7 @@ export interface ShadowMetadata {
     createdAt: string;
     appName: string;
     port: number;
+    previewId: string;
 }
 export interface ConsumerPaths {
     consumerDir: string;

package/dist/esm/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}

package/dist/esm/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAiD3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/esm/util/auth/broker-credential-provider.mjs

@@ -26,8 +26,11 @@ async function postToBroker(path, body) {
     }
 }
 function assertBrokerOk(res) {
-    if (res.status === 401 || res.status === 403) {
-        throw new Error(`Z2H deploy token rejected by the broker (${res.status}). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    if (res.status === 401) {
+        throw new Error(`Z2H deploy token rejected by the broker (401). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have editor access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
     }
 }
 /**

package/dist/esm/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAiBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}

package/dist/esm/util/broker/app.mjs

@@ -19,6 +19,9 @@ async function fetchApp(appName) {
     if (res.status === 404) {
         return null;
     }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
+    }
     if (!res.ok) {
         const text = await res.text();
         throw new Error(`Z2H app lookup failed (${res.status}): ${text.slice(0, 512)}`);

package/dist/migrations/007-proxy-iframe-src.d.ts

@@ -0,0 +1,3 @@
+import type { Tree } from '@nx/devkit';
+export default function proxyIframeSrc(tree: Tree): void;
+//# sourceMappingURL=007-proxy-iframe-src.d.ts.map

package/dist/migrations/007-proxy-iframe-src.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"007-proxy-iframe-src.d.ts","sourceRoot":"","sources":["../../src/migrations/007-proxy-iframe-src.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAqBvC,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAoCvD"}

package/dist/migrations/007-proxy-iframe-src.js

@@ -0,0 +1,51 @@
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: 'Module' } });
+
+// Backfills the html-embed template's `toProxiedUrl` fix onto apps scaffolded before it
+// existed. Matches any relative `.html?url` import, not just `./page.html` — apps are
+// free to name/nest their embedded HTML file however they like (e.g. `./pages/foo.html`).
+const IFRAME_URL_IMPORT = /import\s+(\w+)\s+from\s+(['"])(\.\/[^'"]+?\.html)\?url\2;?/;
+function toProxiedUrlBlock() {
+    return [
+        '',
+        "const Z2H_MFS_BASE_URL = 'https://bigbrain-zth-mf-assets.bigbrain.me';",
+        "const Z2H_ASSETS_PROXY_PREFIX = '/z2h-assets';",
+        '',
+        'function toProxiedUrl(url: string): string {',
+        '  if (!url.startsWith(Z2H_MFS_BASE_URL)) return url;',
+        '  return `${window.location.origin}${Z2H_ASSETS_PROXY_PREFIX}${url.slice(Z2H_MFS_BASE_URL.length)}`;',
+        '}',
+    ].join('\n');
+}
+function proxyIframeSrc(tree) {
+    for (const entry of tree.children('.')) {
+        if (entry.startsWith('.')) {
+            continue;
+        }
+        const indexPath = `${entry}/src/index.tsx`;
+        if (!tree.exists(indexPath)) {
+            continue;
+        }
+        const source = tree.read(indexPath, 'utf-8');
+        if (!source.includes('<iframe') || source.includes('toProxiedUrl')) {
+            continue;
+        }
+        const importMatch = source.match(IFRAME_URL_IMPORT);
+        if (!importMatch) {
+            continue;
+        }
+        const [importLine, varName, , relativePath] = importMatch;
+        const htmlPath = `${entry}/src/${relativePath.replace(/^\.\//, '')}`;
+        if (!tree.exists(htmlPath)) {
+            continue;
+        }
+        const srcAttr = `src={${varName}}`;
+        if (!source.includes(srcAttr)) {
+            continue;
+        }
+        const withBlock = source.replace(importLine, `${importLine}\n${toProxiedUrlBlock()}`);
+        const rewritten = withBlock.replace(srcAttr, `src={toProxiedUrl(${varName})}`);
+        tree.write(indexPath, rewritten);
+    }
+}
+
+exports.default = proxyIframeSrc;

package/dist/migrations/__tests__/007-proxy-iframe-src.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=007-proxy-iframe-src.test.d.ts.map

package/dist/migrations/__tests__/007-proxy-iframe-src.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"007-proxy-iframe-src.test.d.ts","sourceRoot":"","sources":["../../../src/migrations/__tests__/007-proxy-iframe-src.test.ts"],"names":[],"mappings":""}

package/dist/shadow/prepare.d.ts

@@ -1,3 +1,4 @@
 import type { PreparedShadow } from '../types';
 export declare function prepareShadow(consumerDir?: string): Promise<PreparedShadow>;
+export declare function generatePreviewId(): string;
 //# sourceMappingURL=prepare.d.ts.map

package/dist/shadow/prepare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prepare.d.ts","sourceRoot":"","sources":["../../src/shadow/prepare.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAA8B,cAAc,EAAkB,MAAM,UAAU,CAAC;AAE3F,wBAAsB,aAAa,CAAC,WAAW,GAAE,MAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgChG"}
+{"version":3,"file":"prepare.d.ts","sourceRoot":"","sources":["../../src/shadow/prepare.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAA8B,cAAc,EAAkB,MAAM,UAAU,CAAC;AAE3F,wBAAsB,aAAa,CAAC,WAAW,GAAE,MAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgChG;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/shadow/prepare.js

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const crypto = require('node:crypto');
 const fs = require('fs-extra');
 const util_logger = require('../util/logger.js');
 const util_appName = require('../util/app-name.js');
@@ -37,6 +38,9 @@ async function prepareShadow(consumerDir = process.cwd()) {
     await shadow_sync.syncShadow(paths, consumerPkg);
     return { appName, port, paths };
 }
+function generatePreviewId() {
+    return crypto.randomUUID().slice(0, 8);
+}
 /**
  * Resolve the dev server port. Prefer the persisted port if it's still free
  * (URL stays stable across restarts). Otherwise pick a fresh one. The
@@ -45,16 +49,21 @@ async function prepareShadow(consumerDir = process.cwd()) {
  */
 async function resolvePortAndMetadata(paths, appName) {
     const existing = await shadow_metadata.readMetadata(paths);
-    if (existing?.port && (await shadow_port.isPortFree(existing.port))) {
-        return existing;
+    let port = existing?.port;
+    if (!port || !(await shadow_port.isPortFree(port))) {
+        port = await shadow_port.pickPort();
     }
     const next = {
         createdAt: existing?.createdAt ?? new Date().toISOString(),
         appName,
-        port: await shadow_port.pickPort(),
+        port,
+        previewId: existing?.previewId ?? generatePreviewId(),
     };
-    await shadow_metadata.writeMetadata(paths, next);
+    if (JSON.stringify(next) !== JSON.stringify(existing)) {
+        await shadow_metadata.writeMetadata(paths, next);
+    }
     return next;
 }
 
+exports.generatePreviewId = generatePreviewId;
 exports.prepareShadow = prepareShadow;

package/dist/types.d.ts

@@ -26,6 +26,7 @@ export interface ShadowMetadata {
     createdAt: string;
     appName: string;
     port: number;
+    previewId: string;
 }
 export interface ConsumerPaths {
     consumerDir: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}

package/dist/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA4C3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAiD3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUzE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/util/auth/broker-credential-provider.js

@@ -28,8 +28,11 @@ async function postToBroker(path, body) {
     }
 }
 function assertBrokerOk(res) {
-    if (res.status === 401 || res.status === 403) {
-        throw new Error(`Z2H deploy token rejected by the broker (${res.status}). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    if (res.status === 401) {
+        throw new Error(`Z2H deploy token rejected by the broker (401). Refresh user token by running 'z2h-cli generate-z2h-token'.`);
+    }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have editor access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
     }
 }
 /**

package/dist/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAiBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAwCD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}

package/dist/util/broker/app.js

@@ -21,6 +21,9 @@ async function fetchApp(appName) {
     if (res.status === 404) {
         return null;
     }
+    if (res.status === 403) {
+        throw new Error(`Access denied (403). You do not have access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`);
+    }
     if (!res.ok) {
         const text = await res.text();
         throw new Error(`Z2H app lookup failed (${res.status}): ${text.slice(0, 512)}`);

package/migrations.json

@@ -29,6 +29,11 @@
       "version": "0.15.3",
       "description": "Remove the start script (z2h-cli dev) from consumer package.json — dev is gone, superseded by deploy --preview",
       "migrate": "./dist/migrations/006-remove-start-script"
+    },
+    "proxy-iframe-src": {
+      "version": "0.19.0",
+      "description": "Rewrite html-embed apps' iframe src to go through the host's same-origin /z2h-assets proxy instead of the raw CDN bucket URL",
+      "migrate": "./dist/migrations/007-proxy-iframe-src"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.18.0",
+  "version": "0.19.0-feat-arielle-fixed-preview-id-8f3fc72",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/commands/deploy.ts

@@ -1,5 +1,4 @@
 import os from 'node:os';
-import { randomUUID } from 'node:crypto';
 import { readJson } from 'fs-extra';
 import { info, warn, output, getOutputMode } from '../util/logger';
 import { resolveConsumerPaths } from '../shadow/paths';
@@ -24,8 +23,10 @@ import { registerOrUpdateApp } from '../util/broker/app';
 import { openInBrowser } from '../util/open-browser';
 import { buildCommand } from './build';
 import { promptForTags } from './tag';
+import { readMetadata } from '../shadow/metadata';
 import type { ConsumerPaths } from '../types';
 import type { ManifestEntry } from '../util/manifest';
+import { generatePreviewId } from '../shadow/prepare';
 
 export interface DeployOptions {
   dryRun?: boolean;
@@ -95,7 +96,9 @@ async function buildAndStamp(opts: {
 }
 
 async function deployPreview({ paths, consumerName, appName, token, opts }: DeployContext): Promise<void> {
-  const previewId = opts.previewId ?? randomUUID().slice(0, 8);
+  const meta = await readMetadata(paths);
+  const previewId = opts.previewId ?? meta?.previewId ?? generatePreviewId();
+
   const previewSlug = buildPreviewSlug(consumerName, previewId);
   const previewAppName = mfAppName(previewSlug);
   const keyPrefix = `${S3_PREVIEWS_FOLDER}/${previewAppName}/MF`;

package/src/migrations/007-proxy-iframe-src.ts

@@ -0,0 +1,58 @@
+import type { Tree } from '@nx/devkit';
+
+// Backfills the html-embed template's `toProxiedUrl` fix onto apps scaffolded before it
+// existed. Matches any relative `.html?url` import, not just `./page.html` — apps are
+// free to name/nest their embedded HTML file however they like (e.g. `./pages/foo.html`).
+
+const IFRAME_URL_IMPORT = /import\s+(\w+)\s+from\s+(['"])(\.\/[^'"]+?\.html)\?url\2;?/;
+
+function toProxiedUrlBlock(): string {
+  return [
+    '',
+    "const Z2H_MFS_BASE_URL = 'https://bigbrain-zth-mf-assets.bigbrain.me';",
+    "const Z2H_ASSETS_PROXY_PREFIX = '/z2h-assets';",
+    '',
+    'function toProxiedUrl(url: string): string {',
+    '  if (!url.startsWith(Z2H_MFS_BASE_URL)) return url;',
+    '  return `${window.location.origin}${Z2H_ASSETS_PROXY_PREFIX}${url.slice(Z2H_MFS_BASE_URL.length)}`;',
+    '}',
+  ].join('\n');
+}
+
+export default function proxyIframeSrc(tree: Tree): void {
+  for (const entry of tree.children('.')) {
+    if (entry.startsWith('.')) {
+      continue;
+    }
+
+    const indexPath = `${entry}/src/index.tsx`;
+    if (!tree.exists(indexPath)) {
+      continue;
+    }
+
+    const source = tree.read(indexPath, 'utf-8')!;
+    if (!source.includes('<iframe') || source.includes('toProxiedUrl')) {
+      continue;
+    }
+
+    const importMatch = source.match(IFRAME_URL_IMPORT);
+    if (!importMatch) {
+      continue;
+    }
+
+    const [importLine, varName, , relativePath] = importMatch;
+    const htmlPath = `${entry}/src/${relativePath.replace(/^\.\//, '')}`;
+    if (!tree.exists(htmlPath)) {
+      continue;
+    }
+
+    const srcAttr = `src={${varName}}`;
+    if (!source.includes(srcAttr)) {
+      continue;
+    }
+
+    const withBlock = source.replace(importLine, `${importLine}\n${toProxiedUrlBlock()}`);
+    const rewritten = withBlock.replace(srcAttr, `src={toProxiedUrl(${varName})}`);
+    tree.write(indexPath, rewritten);
+  }
+}

package/src/migrations/__tests__/007-proxy-iframe-src.test.ts

@@ -0,0 +1,112 @@
+import { describe, it, expect } from 'vitest';
+import { createTree } from '@nx/devkit/testing';
+import proxyIframeSrc from '../007-proxy-iframe-src';
+import type { Tree } from '@nx/devkit';
+
+const UNMIGRATED_INDEX = [
+  "import React, { useRef } from 'react';",
+  "import pageUrl from './page.html?url';",
+  '',
+  'export default function App() {',
+  '  const iframeRef = useRef<HTMLIFrameElement>(null);',
+  '  return <iframe ref={iframeRef} src={pageUrl} title="App" />;',
+  '}',
+  '',
+].join('\n');
+
+function makeTree(): Tree {
+  return createTree();
+}
+
+function writeHtmlEmbedApp(tree: Tree, dir: string, indexSource: string): void {
+  tree.write(`${dir}/package.json`, `{"name":"${dir}"}`);
+  tree.write(`${dir}/src/page.html`, '<!doctype html><html></html>');
+  tree.write(`${dir}/src/index.tsx`, indexSource);
+}
+
+describe('migration 007 — proxy iframe src', () => {
+  it('wraps the iframe src and adds the proxy helper', () => {
+    const tree = makeTree();
+    writeHtmlEmbedApp(tree, 'my-app', UNMIGRATED_INDEX);
+
+    proxyIframeSrc(tree);
+
+    const out = tree.read('my-app/src/index.tsx', 'utf-8')!;
+    expect(out).toContain("const Z2H_MFS_BASE_URL = 'https://bigbrain-zth-mf-assets.bigbrain.me';");
+    expect(out).toContain("const Z2H_ASSETS_PROXY_PREFIX = '/z2h-assets';");
+    expect(out).toContain('function toProxiedUrl(url: string): string {');
+    expect(out).toContain('src={toProxiedUrl(pageUrl)}');
+  });
+
+  it('handles a page-url variable named something other than pageUrl', () => {
+    const tree = makeTree();
+    const source = UNMIGRATED_INDEX.replace(/pageUrl/g, 'businessReviewUrl');
+    writeHtmlEmbedApp(tree, 'latam-business-review', source);
+
+    proxyIframeSrc(tree);
+
+    const out = tree.read('latam-business-review/src/index.tsx', 'utf-8')!;
+    expect(out).toContain('src={toProxiedUrl(businessReviewUrl)}');
+  });
+
+  it('handles an HTML file nested in a subdirectory, not just src/page.html', () => {
+    const tree = createTree();
+    const source = [
+      "import React, { useRef } from 'react';",
+      "import businessReviewUrl from './pages/business-review.html?url';",
+      '',
+      'export default function App() {',
+      '  const iframeRef = useRef<HTMLIFrameElement>(null);',
+      '  return <iframe ref={iframeRef} src={businessReviewUrl} title="App" />;',
+      '}',
+      '',
+    ].join('\n');
+    tree.write('latam-business-review/package.json', '{"name":"latam-business-review"}');
+    tree.write('latam-business-review/src/pages/business-review.html', '<!doctype html><html></html>');
+    tree.write('latam-business-review/src/index.tsx', source);
+
+    proxyIframeSrc(tree);
+
+    const out = tree.read('latam-business-review/src/index.tsx', 'utf-8')!;
+    expect(out).toContain('src={toProxiedUrl(businessReviewUrl)}');
+    expect(out).toContain("const Z2H_MFS_BASE_URL = 'https://bigbrain-zth-mf-assets.bigbrain.me';");
+  });
+
+  it('is idempotent — a second run on an already-migrated app is a no-op', () => {
+    const tree = makeTree();
+    writeHtmlEmbedApp(tree, 'my-app', UNMIGRATED_INDEX);
+
+    proxyIframeSrc(tree);
+    const afterFirst = tree.read('my-app/src/index.tsx', 'utf-8')!;
+
+    proxyIframeSrc(tree);
+    expect(tree.read('my-app/src/index.tsx', 'utf-8')!).toBe(afterFirst);
+  });
+
+  it('leaves a default (non-embed) app untouched — no page.html', () => {
+    const tree = makeTree();
+    tree.write('default-app/package.json', '{"name":"default-app"}');
+    tree.write('default-app/src/index.tsx', 'export default function App() { return <div />; }\n');
+
+    proxyIframeSrc(tree);
+
+    expect(tree.read('default-app/src/index.tsx', 'utf-8')!).toBe(
+      'export default function App() { return <div />; }\n'
+    );
+  });
+
+  it('leaves an html-embed app untouched if it has no iframe tag', () => {
+    const tree = makeTree();
+    const source = "import pageUrl from './page.html?url';\nexport default () => null;\n";
+    writeHtmlEmbedApp(tree, 'weird-app', source);
+
+    proxyIframeSrc(tree);
+
+    expect(tree.read('weird-app/src/index.tsx', 'utf-8')!).toBe(source);
+  });
+
+  it('does nothing when the workspace has no apps', () => {
+    const tree = makeTree();
+    expect(() => proxyIframeSrc(tree)).not.toThrow();
+  });
+});

package/src/shadow/prepare.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { ensureDir, pathExists, readJson } from 'fs-extra';
 import { info } from '../util/logger';
 import { cleanAppName } from '../util/app-name';
@@ -44,6 +45,10 @@ export async function prepareShadow(consumerDir: string = process.cwd()): Promis
   return { appName, port, paths };
 }
 
+export function generatePreviewId(): string {
+  return randomUUID().slice(0, 8);
+}
+
 /**
  * Resolve the dev server port. Prefer the persisted port if it's still free
  * (URL stays stable across restarts). Otherwise pick a fresh one. The
@@ -52,15 +57,22 @@ export async function prepareShadow(consumerDir: string = process.cwd()): Promis
  */
 async function resolvePortAndMetadata(paths: ConsumerPaths, appName: string): Promise<ShadowMetadata> {
   const existing = await readMetadata(paths);
-  if (existing?.port && (await isPortFree(existing.port))) {
-    return existing;
+
+  let port = existing?.port;
+  if (!port || !(await isPortFree(port))) {
+    port = await pickPort();
   }
 
   const next: ShadowMetadata = {
     createdAt: existing?.createdAt ?? new Date().toISOString(),
     appName,
-    port: await pickPort(),
+    port,
+    previewId: existing?.previewId ?? generatePreviewId(),
   };
-  await writeMetadata(paths, next);
+
+  if (JSON.stringify(next) !== JSON.stringify(existing)) {
+    await writeMetadata(paths, next);
+  }
+
   return next;
 }

package/src/templates/app/html-index.tsx.tmpl

@@ -9,6 +9,14 @@ function getBackendBaseUrl(): string | null {
   return base ? base.replace('//', `//${BACKEND_SUBDOMAIN}.`) : null;
 }
 
+const Z2H_MFS_BASE_URL = 'https://bigbrain-zth-mf-assets.bigbrain.me';
+const Z2H_ASSETS_PROXY_PREFIX = '/z2h-assets';
+
+function toProxiedUrl(url: string): string {
+  if (!url.startsWith(Z2H_MFS_BASE_URL)) return url;
+  return `${window.location.origin}${Z2H_ASSETS_PROXY_PREFIX}${url.slice(Z2H_MFS_BASE_URL.length)}`;
+}
+
 export default function __APP_COMPONENT__() {
   const iframeRef = useRef<HTMLIFrameElement>(null);
   useEffect(() => {
@@ -25,7 +33,7 @@ export default function __APP_COMPONENT__() {
   return (
     <iframe
       ref={iframeRef}
-      src={pageUrl}
+      src={toProxiedUrl(pageUrl)}
       title="App"
       style={{ width: '100vw', height: '100vh', border: 'none', display: 'block' }}
     />

package/src/types.ts

@@ -34,6 +34,7 @@ export interface ShadowMetadata {
   createdAt: string;
   appName: string;
   port: number;
+  previewId: string;
 }
 
 // ─────────── Filesystem paths, resolved once per invocation ─────

package/src/util/auth/__tests__/broker-credential-provider.test.ts

@@ -62,6 +62,12 @@ describe('fetchDeployVersion', () => {
     mockFetchOnce({}, { status: 401, text: 'Unauthorized' });
     await expect(fetchDeployVersion('my-app')).rejects.toThrow(/token rejected by the broker/);
   });
+
+  it('surfaces an access-denied hint on 403', async () => {
+    mockFetchOnce({}, { status: 403, text: 'Forbidden' });
+    await expect(fetchDeployVersion('my-app')).rejects.toThrow(/Access denied/);
+    await expect(fetchDeployVersion('my-app')).rejects.toThrow(/z2h-cli grant/);
+  });
 });
 
 describe('brokerCredentialProvider', () => {
@@ -132,6 +138,13 @@ describe('brokerCredentialProvider', () => {
     await expect(provider()).rejects.toThrow(/generate-z2h-token/);
   });
 
+  it('surfaces an access-denied hint on 403', async () => {
+    mockFetchOnce({}, { status: 403, text: 'Forbidden' });
+    const provider = brokerCredentialProvider({ appName: 'my-app' });
+    await expect(provider()).rejects.toThrow(/Access denied/);
+    await expect(provider()).rejects.toThrow(/z2h-cli grant/);
+  });
+
   it('honors Z2H_BROKER_BASE_URL override', async () => {
     vi.stubEnv('Z2H_BROKER_BASE_URL', 'https://staging.example.com');
     const fetchMock = mockFetchOnce({ ...STUB_CREDS, expiration: FAR_FUTURE_EXPIRY });
@@ -191,6 +204,13 @@ describe('brokerCredentialProvider', () => {
       await expect(provider()).rejects.toThrow(/generate-z2h-token/);
     });
 
+    it('surfaces an access-denied hint on 403', async () => {
+      mockFetchOnce({}, { status: 403, text: 'Forbidden' });
+      const provider = brokerCredentialProvider({ appName: 'mf-my-app', previewId: 'preview-1' });
+      await expect(provider()).rejects.toThrow(/Access denied/);
+      await expect(provider()).rejects.toThrow(/z2h-cli grant/);
+    });
+
     it('rejects responses missing required credential fields', async () => {
       mockFetchOnce({ accessKeyId: 'AKIA-stub' });
       const provider = brokerCredentialProvider({ appName: 'mf-my-app', previewId: 'preview-1' });

package/src/util/auth/broker-credential-provider.ts

@@ -40,9 +40,14 @@ async function postToBroker(path: string, body: unknown): Promise<Response> {
 }
 
 function assertBrokerOk(res: Response): void {
-  if (res.status === 401 || res.status === 403) {
+  if (res.status === 401) {
     throw new Error(
-      `Z2H deploy token rejected by the broker (${res.status}). Refresh user token by running 'z2h-cli generate-z2h-token'.`
+      `Z2H deploy token rejected by the broker (401). Refresh user token by running 'z2h-cli generate-z2h-token'.`
+    );
+  }
+  if (res.status === 403) {
+    throw new Error(
+      `Access denied (403). You do not have editor access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`
     );
   }
 }

package/src/util/broker/app.ts

@@ -29,6 +29,11 @@ export async function fetchApp(appName: string): Promise<AppInfo | null> {
   if (res.status === 404) {
     return null;
   }
+  if (res.status === 403) {
+    throw new Error(
+      `Access denied (403). You do not have access to this app. Ask the app owner to grant you access via 'z2h-cli grant'.`
+    );
+  }
   if (!res.ok) {
     const text = await res.text();
     throw new Error(`Z2H app lookup failed (${res.status}): ${text.slice(0, 512)}`);