@ollie-shop/cli 1.0.0 → 1.0.2

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @ollie-shop/cli@1.0.0 build /home/runner/work/ollie-shop/ollie-shop/packages/cli
+> @ollie-shop/cli@1.0.2 build /home/runner/work/ollie-shop/ollie-shop/packages/cli
 > tsup
 
 CLI Building entry: src/index.tsx
@@ -9,5 +9,5 @@
 CLI Target: node22
 CLI Cleaning output folder
 ESM Build start
-ESM dist/index.js 37.04 KB
-ESM ⚡️ Build success in 179ms
+ESM dist/index.js 37.48 KB
+ESM ⚡️ Build success in 166ms

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ollie-shop/cli
 
+## 1.0.2
+
+### Patch Changes
+
+- 19774e0: Add Private Network Access CORS header to allow cross-origin CSS loading from localhost during studio mode
+
+## 1.0.1
+
+### Patch Changes
+
+- 6aac161: Add missing header in the cli server
+
 ## 1.0.0
 
 ### Major Changes

package/dist/index.js

@@ -603,6 +603,7 @@ async function startDevServer(ctx, options = {}) {
       const componentName = pathMatch[1];
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
       try {
         const stream = await createComponentBundle({ cwd, componentName });
         res.setHeader("Content-Type", "application/zip");
@@ -642,6 +643,7 @@ async function startDevServer(ctx, options = {}) {
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
       res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
       let body = "";
       req.on("data", (chunk) => {
         body += chunk.toString();
@@ -680,7 +682,12 @@ async function startDevServer(ctx, options = {}) {
     if (req.method === "OPTIONS") {
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
+      const requestedHeaders = req.headers["access-control-request-headers"];
+      res.setHeader(
+        "Access-Control-Allow-Headers",
+        requestedHeaders || "Content-Type"
+      );
       res.statusCode = 204;
       res.end();
       return;
@@ -694,8 +701,12 @@ async function startDevServer(ctx, options = {}) {
         headers: req.headers
       },
       (proxyRes) => {
-        res.setHeader("Access-Control-Allow-Origin", "*");
-        res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+        const responseHeaders = {
+          ...proxyRes.headers,
+          "access-control-allow-origin": "*",
+          "access-control-allow-private-network": "true"
+        };
+        res.writeHead(proxyRes.statusCode || 200, responseHeaders);
         proxyRes.pipe(res);
       }
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ollie-shop/cli",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Ollie Shop CLI - Development tools for custom checkouts",
   "type": "module",
   "main": "dist/index.js",

package/src/utils/esbuild.ts

@@ -280,6 +280,7 @@ export async function startDevServer(
       // Set CORS headers
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
 
       try {
         const stream = await createComponentBundle({ cwd, componentName });
@@ -328,6 +329,7 @@ export async function startDevServer(
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
       res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
 
       // Read request body
       let body = "";
@@ -380,7 +382,14 @@ export async function startDevServer(
     if (req.method === "OPTIONS") {
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      // Allow Private Network Access (public origin → localhost)
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
+      // Reflect requested headers back (supports traceparent, tracestate, etc.)
+      const requestedHeaders = req.headers["access-control-request-headers"];
+      res.setHeader(
+        "Access-Control-Allow-Headers",
+        requestedHeaders || "Content-Type",
+      );
       res.statusCode = 204;
       res.end();
       return;
@@ -396,10 +405,14 @@ export async function startDevServer(
         headers: req.headers,
       },
       (proxyRes) => {
-        // Add CORS headers to proxied responses
-        res.setHeader("Access-Control-Allow-Origin", "*");
+        // Merge CORS headers with proxied response headers
+        const responseHeaders = {
+          ...proxyRes.headers,
+          "access-control-allow-origin": "*",
+          "access-control-allow-private-network": "true",
+        };
 
-        res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+        res.writeHead(proxyRes.statusCode || 200, responseHeaders);
         proxyRes.pipe(res);
       },
     );