@pi-outpost/embed 0.6.7 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -3
- package/dist/PdfViewer-Bgsp04sQ.js +299 -0
- package/dist/PdfViewer-Brg-USBu.cjs +1 -0
- package/dist/pdf-DyDm1M1B.js +16387 -0
- package/dist/pdf-aU0TN69t.cjs +54 -0
- package/dist/pi-outpost-embed.cjs +59 -57
- package/dist/pi-outpost-embed.js +13274 -6865
- package/dist/workspacePath-BntMOlpq.js +24 -0
- package/dist/workspacePath-CueaT8yG.cjs +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -53,10 +53,9 @@ In Next.js, the component doing this must be a client component (`"use client"`)
|
|
|
53
53
|
|
|
54
54
|
## Server-side configuration
|
|
55
55
|
|
|
56
|
-
|
|
56
|
+
Configure this on the pi-outpost server, whatever the deployment topology:
|
|
57
57
|
|
|
58
|
-
- **`server.allowedOrigins`** — the widget
|
|
59
|
-
- **CORS** — `/branding` and `/health` are plain HTTP endpoints with no CORS headers. They work with zero extra config when the widget and the backend share an origin (recommended: reverse-proxy pi-outpost under your own domain). A genuinely cross-origin deployment needs a CORS layer in front.
|
|
58
|
+
- **`server.allowedOrigins`** — the widget carries the *host page's* origin (e.g. `https://your-app.example.com`), not pi-outpost's own. Add it explicitly; even same-domain deployments need this (only `localhost`/`127.0.0.1` are trusted automatically). Listing it is all a cross-origin mount needs: the server answers those origins with the CORS headers the browser requires on every HTTP route, and applies the same allowlist to the WebSocket handshake. It grants no authority of its own — a token-protected route still wants its token.
|
|
60
59
|
|
|
61
60
|
## License
|
|
62
61
|
|