@preprio/toolkit 0.5.0-rc.1 → 0.5.0-rc.2

package/README.md

@@ -694,14 +694,14 @@ createPreprMiddleware(request, response, { preview });
 createPreprPreview({ props, options: { debug: true, locale: 'nl' } });
 ```
 
-| Option                 | Type            | Default       | Description                                                                                              |
-| ---------------------- | --------------- | ------------- | -------------------------------------------------------------------------------------------------------- |
-| `debug`                | `boolean`       | `false`       | Enable debug logging.                                                                                    |
-| `locale`               | `'en' \| 'nl'`  | auto-detected | UI language. Falls back to the first supported browser language, then `en`.                              |
-| `features`             | `PreprFeatures` | all enabled   | Which features run. See [Feature flags](#feature-flags).                                                 |
-| `ui`                   | `boolean`       | `true`        | Mount the visible toolbar. See [Headless preview](#headless-preview-no-toolbar-ui).                      |
-| `allowedEditorOrigins` | `string[]`      | `*.prepr.io`  | Exact editor origins allowed to drive this preview, for self-hosted editors. Replaces the wildcard.      |
-| `autoClean`            | `boolean`       | `true`        | Strip the invisible stega characters from visible text. See [Stega auto-cleaning](#stega-auto-cleaning). |
+| Option                 | Type            | Default       | Description                                                                                                                                                 |
+| ---------------------- | --------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `debug`                | `boolean`       | `false`       | Enable debug logging.                                                                                                                                       |
+| `locale`               | `'en' \| 'nl'`  | auto-detected | UI language. Falls back to the first supported browser language, then `en`.                                                                                 |
+| `features`             | `PreprFeatures` | all enabled   | Which features run. See [Feature flags](#feature-flags).                                                                                                    |
+| `ui`                   | `boolean`       | `true`        | Mount the visible toolbar. See [Headless preview](#headless-preview-no-toolbar-ui).                                                                         |
+| `allowedEditorOrigins` | `string[]`      | `*.prepr.io`  | Exact editor origins allowed to drive this preview, for self-hosted or local editors. Replaces the wildcard. `['*']` accepts any origin — development only. |
+| `autoClean`            | `boolean`       | `true`        | Strip the invisible stega characters from visible text. See [Stega auto-cleaning](#stega-auto-cleaning).                                                    |
 
 `features` and `ui` are independent: `features` decides _what runs_, `ui` decides _whether the toolbar is visible_.
 

package/dist/astro/index.cjs

@@ -30,7 +30,7 @@ __export(astro_exports, {
 module.exports = __toCommonJS(astro_exports);
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/features.ts
 function isEnabled(config) {

package/dist/astro/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/features.ts
 function isEnabled(config) {

package/dist/{chunk-4JNKYIEV.js → chunk-FLPNN3CV.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -2007,7 +2007,10 @@ function t2(key, locale, vars) {
 var debug8 = createScopedLogger("iframe-bridge");
 var EDITOR_BASE_DOMAIN = "prepr.io";
 function isAllowedEditorOrigin(origin, allowed) {
-  if (allowed) return allowed.includes(origin);
+  if (allowed) {
+    if (allowed.includes("*")) return origin !== "null";
+    return allowed.includes(origin);
+  }
   let url;
   try {
     url = new URL(origin);
@@ -2032,7 +2035,10 @@ function createIframeBridge(store, options = {}) {
   const onMessage = (evt) => {
     const data = evt?.data;
     if (data?.event === "prepr:initVE" && !parentOrigin) {
-      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) return;
+      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) {
+        debug8.warn("ignored editor handshake from origin", evt.origin);
+        return;
+      }
       parentOrigin = evt.origin;
       setTrustedParentOrigin(parentOrigin);
       if (data.scrollPosition != null) {

package/dist/index.cjs

@@ -44,7 +44,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -315,7 +315,10 @@ function createElementCache(query, ttl = 1e3) {
 var debug = createScopedLogger("iframe-bridge");
 var EDITOR_BASE_DOMAIN = "prepr.io";
 function isAllowedEditorOrigin(origin, allowed) {
-  if (allowed) return allowed.includes(origin);
+  if (allowed) {
+    if (allowed.includes("*")) return origin !== "null";
+    return allowed.includes(origin);
+  }
   let url;
   try {
     url = new URL(origin);
@@ -340,7 +343,10 @@ function createIframeBridge(store, options = {}) {
   const onMessage = (evt) => {
     const data = evt?.data;
     if (data?.event === "prepr:initVE" && !parentOrigin) {
-      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) return;
+      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) {
+        debug.warn("ignored editor handshake from origin", evt.origin);
+        return;
+      }
       parentOrigin = evt.origin;
       setTrustedParentOrigin(parentOrigin);
       if (data.scrollPosition != null) {

package/dist/index.d.cts

@@ -1,11 +1,11 @@
-import { P as PreprFeatures, R as ResolvedPreprFeatures, L as Locale, a as PreprSegment, b as PreprVariant, c as PreprToolbarProps, d as PreprPreviewOptions, e as PreprErrorCode, f as PreprHeaders } from './pixel-e1fUWl2Y.cjs';
-export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j as PreprHeaderName, k as PreprPixelConfig, l as PreprToolbarComponentProps, m as PreprToolbarOptions, n as loadTrackingPixel, s as setTrackingParam, t as trackEvent } from './pixel-e1fUWl2Y.cjs';
+import { P as PreprFeatures, R as ResolvedPreprFeatures, L as Locale, a as PreprSegment, b as PreprVariant, c as PreprToolbarProps, d as PreprPreviewOptions, e as PreprErrorCode, f as PreprHeaders } from './pixel-B3oQNbZ3.cjs';
+export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j as PreprHeaderName, k as PreprPixelConfig, l as PreprToolbarComponentProps, m as PreprToolbarOptions, n as loadTrackingPixel, s as setTrackingParam, t as trackEvent } from './pixel-B3oQNbZ3.cjs';
 
 /**
  * Package version; must match package.json. Lives in its own leaf module so
  * core can import it without cycling through the barrel.
  */
-declare const VERSION = "0.5.0-rc.1";
+declare const VERSION = "0.5.0-rc.2";
 
 /**
  * Resolve a `PreprFeatures` bag to plain booleans, defaulting every omitted key
@@ -145,7 +145,8 @@ interface ScrollToFieldMessage {
 interface IframeBridgeOptions {
     /**
      * Replace the `*.prepr.io` wildcard with an exact origin list. Intended for
-     * self-hosted editors; when set, the wildcard no longer applies.
+     * self-hosted editors; when set, the wildcard no longer applies. `['*']`
+     * accepts any editor origin — see `PreprPreviewOptions.allowedEditorOrigins`.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { P as PreprFeatures, R as ResolvedPreprFeatures, L as Locale, a as PreprSegment, b as PreprVariant, c as PreprToolbarProps, d as PreprPreviewOptions, e as PreprErrorCode, f as PreprHeaders } from './pixel-e1fUWl2Y.js';
-export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j as PreprHeaderName, k as PreprPixelConfig, l as PreprToolbarComponentProps, m as PreprToolbarOptions, n as loadTrackingPixel, s as setTrackingParam, t as trackEvent } from './pixel-e1fUWl2Y.js';
+import { P as PreprFeatures, R as ResolvedPreprFeatures, L as Locale, a as PreprSegment, b as PreprVariant, c as PreprToolbarProps, d as PreprPreviewOptions, e as PreprErrorCode, f as PreprHeaders } from './pixel-B3oQNbZ3.js';
+export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j as PreprHeaderName, k as PreprPixelConfig, l as PreprToolbarComponentProps, m as PreprToolbarOptions, n as loadTrackingPixel, s as setTrackingParam, t as trackEvent } from './pixel-B3oQNbZ3.js';
 
 /**
  * Package version; must match package.json. Lives in its own leaf module so
  * core can import it without cycling through the barrel.
  */
-declare const VERSION = "0.5.0-rc.1";
+declare const VERSION = "0.5.0-rc.2";
 
 /**
  * Resolve a `PreprFeatures` bag to plain booleans, defaulting every omitted key
@@ -145,7 +145,8 @@ interface ScrollToFieldMessage {
 interface IframeBridgeOptions {
     /**
      * Replace the `*.prepr.io` wildcard with an exact origin list. Intended for
-     * self-hosted editors; when set, the wildcard no longer applies.
+     * self-hosted editors; when set, the wildcard no longer applies. `['*']`
+     * accepts any editor origin — see `PreprPreviewOptions.allowedEditorOrigins`.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   setTrackingParam,
   stegaClean,
   trackEvent
-} from "./chunk-4JNKYIEV.js";
+} from "./chunk-FLPNN3CV.js";
 
 // src/core/server.ts
 var PreprError = class extends Error {

package/dist/nextjs/components.cjs

@@ -295,7 +295,10 @@ function createElementCache(query, ttl = 1e3) {
 var debug = createScopedLogger("iframe-bridge");
 var EDITOR_BASE_DOMAIN = "prepr.io";
 function isAllowedEditorOrigin(origin, allowed) {
-  if (allowed) return allowed.includes(origin);
+  if (allowed) {
+    if (allowed.includes("*")) return origin !== "null";
+    return allowed.includes(origin);
+  }
   let url;
   try {
     url = new URL(origin);
@@ -320,7 +323,10 @@ function createIframeBridge(store, options = {}) {
   const onMessage = (evt) => {
     const data = evt?.data;
     if (data?.event === "prepr:initVE" && !parentOrigin) {
-      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) return;
+      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) {
+        debug.warn("ignored editor handshake from origin", evt.origin);
+        return;
+      }
       parentOrigin = evt.origin;
       setTrustedParentOrigin(parentOrigin);
       if (data.scrollPosition != null) {
@@ -2348,7 +2354,7 @@ function createPreprPreview(opts = {}) {
 var import_react = require("react");
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/pixel.ts
 var PIXEL_SCRIPT_URL = "https://cdn.tracking.prepr.io/js/prepr.min.js";

package/dist/nextjs/components.d.cts

@@ -1,4 +1,4 @@
-import { k as PreprPixelConfig, l as PreprToolbarComponentProps } from '../pixel-e1fUWl2Y.cjs';
+import { k as PreprPixelConfig, l as PreprToolbarComponentProps } from '../pixel-B3oQNbZ3.cjs';
 
 interface PreprTrackingPixelProps {
     /** Prepr tracking/access token. */

package/dist/nextjs/components.d.ts

@@ -1,4 +1,4 @@
-import { k as PreprPixelConfig, l as PreprToolbarComponentProps } from '../pixel-e1fUWl2Y.js';
+import { k as PreprPixelConfig, l as PreprToolbarComponentProps } from '../pixel-B3oQNbZ3.js';
 
 interface PreprTrackingPixelProps {
     /** Prepr tracking/access token. */

package/dist/nextjs/components.js

@@ -2,7 +2,7 @@
 import {
   createPreprPreview,
   loadTrackingPixel
-} from "../chunk-4JNKYIEV.js";
+} from "../chunk-FLPNN3CV.js";
 
 // src/nextjs/components.ts
 import { usePathname, useRouter } from "next/navigation";

package/dist/nextjs/index.cjs

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(nextjs_exports);
 var import_server = require("next/server");
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";

package/dist/nextjs/index.d.cts

@@ -60,8 +60,14 @@ interface PreprPreviewOptions extends PreprToolbarOptions {
      */
     ui?: boolean;
     /**
-     * Replace the `*.prepr.io` editor-origin wildcard with an exact list.
-     * Intended for self-hosted editors; when set, the wildcard no longer applies.
+     * Replace the `*.prepr.io` editor-origin wildcard with an exact list, e.g.
+     * `['http://acme.localhost:8000']`. Intended for self-hosted or locally run
+     * editors; when set, the wildcard no longer applies. Entries are compared to
+     * the editor's origin exactly: scheme, host and port.
+     *
+     * `['*']` accepts any editor origin. Use it for development only: any page
+     * that frames the preview can then switch on preview and edit mode and
+     * receives the field-edit events, which carry content item ids.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/nextjs/index.d.ts

@@ -60,8 +60,14 @@ interface PreprPreviewOptions extends PreprToolbarOptions {
      */
     ui?: boolean;
     /**
-     * Replace the `*.prepr.io` editor-origin wildcard with an exact list.
-     * Intended for self-hosted editors; when set, the wildcard no longer applies.
+     * Replace the `*.prepr.io` editor-origin wildcard with an exact list, e.g.
+     * `['http://acme.localhost:8000']`. Intended for self-hosted or locally run
+     * editors; when set, the wildcard no longer applies. Entries are compared to
+     * the editor's origin exactly: scheme, host and port.
+     *
+     * `['*']` accepts any editor origin. Use it for development only: any page
+     * that frames the preview can then switch on preview and edit mode and
+     * receives the field-edit events, which carry content item ids.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/nextjs/index.js

@@ -2,7 +2,7 @@
 import { NextResponse } from "next/server";
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";

package/dist/nuxt/index.cjs

@@ -35,7 +35,7 @@ __export(nuxt_exports, {
 module.exports = __toCommonJS(nuxt_exports);
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";

package/dist/nuxt/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";

package/dist/{pixel-e1fUWl2Y.d.cts → pixel-B3oQNbZ3.d.cts}

@@ -64,8 +64,14 @@ interface PreprPreviewOptions extends PreprToolbarOptions {
      */
     ui?: boolean;
     /**
-     * Replace the `*.prepr.io` editor-origin wildcard with an exact list.
-     * Intended for self-hosted editors; when set, the wildcard no longer applies.
+     * Replace the `*.prepr.io` editor-origin wildcard with an exact list, e.g.
+     * `['http://acme.localhost:8000']`. Intended for self-hosted or locally run
+     * editors; when set, the wildcard no longer applies. Entries are compared to
+     * the editor's origin exactly: scheme, host and port.
+     *
+     * `['*']` accepts any editor origin. Use it for development only: any page
+     * that frames the preview can then switch on preview and edit mode and
+     * receives the field-edit events, which carry content item ids.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/{pixel-e1fUWl2Y.d.ts → pixel-B3oQNbZ3.d.ts}

@@ -64,8 +64,14 @@ interface PreprPreviewOptions extends PreprToolbarOptions {
      */
     ui?: boolean;
     /**
-     * Replace the `*.prepr.io` editor-origin wildcard with an exact list.
-     * Intended for self-hosted editors; when set, the wildcard no longer applies.
+     * Replace the `*.prepr.io` editor-origin wildcard with an exact list, e.g.
+     * `['http://acme.localhost:8000']`. Intended for self-hosted or locally run
+     * editors; when set, the wildcard no longer applies. Entries are compared to
+     * the editor's origin exactly: scheme, host and port.
+     *
+     * `['*']` accepts any editor origin. Use it for development only: any page
+     * that frames the preview can then switch on preview and edit mode and
+     * receives the field-edit events, which carry content item ids.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/react/components.cjs

@@ -294,7 +294,10 @@ function createElementCache(query, ttl = 1e3) {
 var debug = createScopedLogger("iframe-bridge");
 var EDITOR_BASE_DOMAIN = "prepr.io";
 function isAllowedEditorOrigin(origin, allowed) {
-  if (allowed) return allowed.includes(origin);
+  if (allowed) {
+    if (allowed.includes("*")) return origin !== "null";
+    return allowed.includes(origin);
+  }
   let url;
   try {
     url = new URL(origin);
@@ -319,7 +322,10 @@ function createIframeBridge(store, options = {}) {
   const onMessage = (evt) => {
     const data = evt?.data;
     if (data?.event === "prepr:initVE" && !parentOrigin) {
-      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) return;
+      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) {
+        debug.warn("ignored editor handshake from origin", evt.origin);
+        return;
+      }
       parentOrigin = evt.origin;
       setTrustedParentOrigin(parentOrigin);
       if (data.scrollPosition != null) {
@@ -2344,7 +2350,7 @@ function createPreprPreview(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/pixel.ts
 var PIXEL_SCRIPT_URL = "https://cdn.tracking.prepr.io/js/prepr.min.js";

package/dist/react/components.d.cts

@@ -58,8 +58,14 @@ interface PreprPreviewOptions extends PreprToolbarOptions {
      */
     ui?: boolean;
     /**
-     * Replace the `*.prepr.io` editor-origin wildcard with an exact list.
-     * Intended for self-hosted editors; when set, the wildcard no longer applies.
+     * Replace the `*.prepr.io` editor-origin wildcard with an exact list, e.g.
+     * `['http://acme.localhost:8000']`. Intended for self-hosted or locally run
+     * editors; when set, the wildcard no longer applies. Entries are compared to
+     * the editor's origin exactly: scheme, host and port.
+     *
+     * `['*']` accepts any editor origin. Use it for development only: any page
+     * that frames the preview can then switch on preview and edit mode and
+     * receives the field-edit events, which carry content item ids.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/react/components.d.ts

@@ -58,8 +58,14 @@ interface PreprPreviewOptions extends PreprToolbarOptions {
      */
     ui?: boolean;
     /**
-     * Replace the `*.prepr.io` editor-origin wildcard with an exact list.
-     * Intended for self-hosted editors; when set, the wildcard no longer applies.
+     * Replace the `*.prepr.io` editor-origin wildcard with an exact list, e.g.
+     * `['http://acme.localhost:8000']`. Intended for self-hosted or locally run
+     * editors; when set, the wildcard no longer applies. Entries are compared to
+     * the editor's origin exactly: scheme, host and port.
+     *
+     * `['*']` accepts any editor origin. Use it for development only: any page
+     * that frames the preview can then switch on preview and edit mode and
+     * receives the field-edit events, which carry content item ids.
      */
     allowedEditorOrigins?: string[];
     /**

package/dist/react/components.js

@@ -270,7 +270,10 @@ function createElementCache(query, ttl = 1e3) {
 var debug = createScopedLogger("iframe-bridge");
 var EDITOR_BASE_DOMAIN = "prepr.io";
 function isAllowedEditorOrigin(origin, allowed) {
-  if (allowed) return allowed.includes(origin);
+  if (allowed) {
+    if (allowed.includes("*")) return origin !== "null";
+    return allowed.includes(origin);
+  }
   let url;
   try {
     url = new URL(origin);
@@ -295,7 +298,10 @@ function createIframeBridge(store, options = {}) {
   const onMessage = (evt) => {
     const data = evt?.data;
     if (data?.event === "prepr:initVE" && !parentOrigin) {
-      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) return;
+      if (!isAllowedEditorOrigin(evt.origin, allowedOrigins)) {
+        debug.warn("ignored editor handshake from origin", evt.origin);
+        return;
+      }
       parentOrigin = evt.origin;
       setTrustedParentOrigin(parentOrigin);
       if (data.scrollPosition != null) {
@@ -2320,7 +2326,7 @@ function createPreprPreview(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/pixel.ts
 var PIXEL_SCRIPT_URL = "https://cdn.tracking.prepr.io/js/prepr.min.js";

package/dist/sveltekit/index.cjs

@@ -35,7 +35,7 @@ __export(sveltekit_exports, {
 module.exports = __toCommonJS(sveltekit_exports);
 
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.5.0-rc.1";
+var VERSION = "0.5.0-rc.2";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preprio/toolkit",
-  "version": "0.5.0-rc.1",
+  "version": "0.5.0-rc.2",
   "description": "Prepr personalization, A/B testing and preview toolkit for React, Next.js, Nuxt, Astro, SvelteKit and Express",
   "license": "Apache-2.0",
   "author": "Prepr B.V. (https://prepr.io)",