@query-farm/vgi 0.26.1 → 0.27.0

package/dist/http/fetch.d.ts

@@ -14,10 +14,18 @@ export interface VgiFetchOptions {
     prefix?: string;
     /** Server ID for state-token attribution (default "vgi-cf"). */
     serverId?: string;
-    /** CORS allowed origins. When set, CORS headers are added to all responses,
-     *  and the preflight `OPTIONS` that browser clients (e.g. the hosted Cupola
-     *  UI) send before `__describe__` will succeed. Omit to disable CORS. */
-    corsOrigins?: string;
+    /** CORS allowed origins, added to all responses so the preflight `OPTIONS`
+     *  that browser clients send before `__describe__` succeeds.
+     *
+     *  **Defaults to `"*"`.** A VGI worker exists to be attached and explored, and
+     *  the hosted Cupola UI reaches it from another origin, so cross-origin is the
+     *  normal case rather than the exception — and a worker that omits this gets
+     *  no CORS headers at all, which fails only in a browser and only for someone
+     *  else's page, i.e. nowhere its author is looking. `serveVgiWorker` has
+     *  always defaulted this way; this matches it so both entries agree.
+     *
+     *  Pass `null` to disable CORS. */
+    corsOrigins?: string | null;
     /** Public source-repository URL, surfaced on the landing page. */
     repositoryUrl?: string;
     /** Worker identity for the standardized VGI landing surface: `GET /` serves

package/dist/serve-entry.js

@@ -5986,7 +5986,7 @@ function createVgiFetch(opts) {
     tokenKey: opts.signingKey,
     tokenTtl,
     stateSerializer: arrowStateSerializer,
-    corsOrigins: opts.corsOrigins,
+    corsOrigins: opts.corsOrigins === null ? undefined : opts.corsOrigins ?? "*",
     repositoryUrl: opts.repositoryUrl,
     extraRoutes: createLandingRoutes(opts.landingInfo),
     enableLandingPage: false
@@ -6054,7 +6054,7 @@ function createVgiWorkerFetch(opts) {
   const env = opts.env ?? process.env;
   const signingKey = resolveSigningKey(opts.signingKey, env);
   const tokenTtl = resolveTokenTtl(opts.tokenTtl, env);
-  const corsOrigins = opts.corsOrigins === null ? undefined : opts.corsOrigins ?? env.CORS_ORIGINS ?? "*";
+  const corsOrigins = opts.corsOrigins === null ? null : opts.corsOrigins ?? env.CORS_ORIGINS;
   return createVgiFetch({
     protocol: { registry: opts.registry, catalogInterface: opts.catalogInterface },
     signingKey,
@@ -6095,4 +6095,4 @@ export {
   DEFAULT_PORT
 };
 
-//# debugId=D0E9A9375E6AE8FE64756E2164756E21
+//# debugId=AF152B2CA425E9C164756E2164756E21