@webpieces/http-routing 0.3.376 → 0.3.378

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.3.376",
+  "version": "0.3.378",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,9 +22,9 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.3.376",
-    "@webpieces/core-util": "0.3.376",
-    "@webpieces/gcp-identity": "0.3.376",
+    "@webpieces/core-context": "0.3.378",
+    "@webpieces/core-util": "0.3.378",
+    "@webpieces/gcp-identity": "0.3.378",
     "inversify": "7.10.4",
     "jsonwebtoken": "9.0.2",
     "minimatch": "10.0.1"

package/src/WebpiecesConfig.d.ts

@@ -3,6 +3,16 @@
  * Per CLAUDE.md: Data-only structure = class
  */
 export declare class WebpiecesConfig {
+    /**
+     * EXTRA cross-origin origins to allow, beyond the two that are always allowed: the server's OWN
+     * origin (same-origin — a browser sends `Origin` on every POST, even same-origin, so this is what
+     * lets a server that also serves its own UI answer its own api calls) and `localhost:*` (dev).
+     *
+     * Only needed when the browser origin differs from the api origin AND is not localhost — e.g. a
+     * UI on a CDN/custom domain calling an api on a different host. Exact origin match, e.g.
+     * `['https://app.example.com']`.
+     */
+    corsOrigins?: string[];
     /**
      * Record EVERY request as a test case (fixture + generated spec), instead
      * of only requests carrying the x-webpieces-recording header.

package/src/WebpiecesConfig.js

@@ -6,7 +6,16 @@ exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = void 0;
  * Per CLAUDE.md: Data-only structure = class
  */
 class WebpiecesConfig {
-    // CORS is auto-enabled for localhost:* → localhost:*
+    /**
+     * EXTRA cross-origin origins to allow, beyond the two that are always allowed: the server's OWN
+     * origin (same-origin — a browser sends `Origin` on every POST, even same-origin, so this is what
+     * lets a server that also serves its own UI answer its own api calls) and `localhost:*` (dev).
+     *
+     * Only needed when the browser origin differs from the api origin AND is not localhost — e.g. a
+     * UI on a CDN/custom domain calling an api on a different host. Exact origin match, e.g.
+     * `['https://app.example.com']`.
+     */
+    corsOrigins;
     /**
      * Record EVERY request as a test case (fixture + generated spec), instead
      * of only requests carrying the x-webpieces-recording header.

package/src/WebpiecesConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebpiecesConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebpiecesConfig.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,eAAe;IACxB,qDAAqD;IAErD;;;;OAIG;IACH,iBAAiB,CAAW;IAE5B;;;OAGG;IACH,YAAY,CAAU;CACzB;AAfD,0CAeC;AAED;;GAEG;AACU,QAAA,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC","sourcesContent":["/**\n * Configuration for WebPieces server.\n * Per CLAUDE.md: Data-only structure = class\n */\nexport class WebpiecesConfig {\n    // CORS is auto-enabled for localhost:* → localhost:*\n\n    /**\n     * Record EVERY request as a test case (fixture + generated spec), instead\n     * of only requests carrying the x-webpieces-recording header.\n     * Intended for tests/dev - do not leave on in production.\n     */\n    recordingAlwaysOn?: boolean;\n\n    /**\n     * Directory where recorded fixtures + generated specs are written.\n     * When unset, recordings are only logged.\n     */\n    recordingDir?: string;\n}\n\n/**\n * DI token for WebpiecesConfig injection.\n */\nexport const WEBPIECES_CONFIG_TOKEN = Symbol.for('WebpiecesConfig');\n"]}
+{"version":3,"file":"WebpiecesConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebpiecesConfig.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,eAAe;IACxB;;;;;;;;OAQG;IACH,WAAW,CAAY;IAEvB;;;;OAIG;IACH,iBAAiB,CAAW;IAE5B;;;OAGG;IACH,YAAY,CAAU;CACzB;AAxBD,0CAwBC;AAED;;GAEG;AACU,QAAA,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC","sourcesContent":["/**\n * Configuration for WebPieces server.\n * Per CLAUDE.md: Data-only structure = class\n */\nexport class WebpiecesConfig {\n    /**\n     * EXTRA cross-origin origins to allow, beyond the two that are always allowed: the server's OWN\n     * origin (same-origin — a browser sends `Origin` on every POST, even same-origin, so this is what\n     * lets a server that also serves its own UI answer its own api calls) and `localhost:*` (dev).\n     *\n     * Only needed when the browser origin differs from the api origin AND is not localhost — e.g. a\n     * UI on a CDN/custom domain calling an api on a different host. Exact origin match, e.g.\n     * `['https://app.example.com']`.\n     */\n    corsOrigins?: string[];\n\n    /**\n     * Record EVERY request as a test case (fixture + generated spec), instead\n     * of only requests carrying the x-webpieces-recording header.\n     * Intended for tests/dev - do not leave on in production.\n     */\n    recordingAlwaysOn?: boolean;\n\n    /**\n     * Directory where recorded fixtures + generated specs are written.\n     * When unset, recordings are only logged.\n     */\n    recordingDir?: string;\n}\n\n/**\n * DI token for WebpiecesConfig injection.\n */\nexport const WEBPIECES_CONFIG_TOKEN = Symbol.for('WebpiecesConfig');\n"]}