create-avocado-site 0.11.2 → 0.11.4

package/dist/templates/common.js

@@ -195,6 +195,22 @@ EDITOR_CORS_ORIGINS=http://localhost:${config.editorPort}
 # SDK warns on the first editor API request. Set both to the same origin.
 NEXT_PUBLIC_EDITOR_ORIGIN=http://localhost:${config.editorPort}
 
+# Which loopback origins the orchestrator may fetch server-side.
+#
+# In the standalone and Docker deployments this is the orchestrator's CORS
+# allowlist, which is what the deployment docs describe. In library mode CORS
+# comes from \`corsOrigins\` on the route above, so here the variable has exactly
+# one remaining job: \`publish/diff\` fetches the site's published pages from
+# \`siteOrigin\`, and a private address is refused under NODE_ENV=production
+# unless it is listed here. That check is right — an unchecked loopback value
+# would turn the orchestrator into a proxy onto its own host — but with nothing
+# listed, the production Publish panel answers
+# \`400 siteOrigin is not an allowed URL\` for this site's own origin.
+#
+# On a real deployment the site origin is public and passes without this. It is
+# here because \`npm run build && npm start\` on your own machine is not.
+ORCHESTRATOR_CORS_ORIGINS=http://localhost:${config.sitePort}
+
 # Any long random string; this one was generated for you. Without it draft mode
 # does not work, and the editor quietly renders the published page instead of
 # your edits.

package/dist/templates/demo-app.js

@@ -191,6 +191,22 @@ EDITOR_CORS_ORIGINS=http://localhost:${config.editorPort}
 # AVOCADO_EDITOR_ORIGINS only if you run more than one editor deployment.
 NEXT_PUBLIC_EDITOR_ORIGIN=http://localhost:${config.editorPort}
 
+# Which loopback origins the orchestrator may fetch server-side.
+#
+# In the standalone and Docker deployments this is the orchestrator's CORS
+# allowlist, which is what the deployment docs describe. In library mode CORS
+# comes from \`corsOrigins\` on the route above, so here the variable has exactly
+# one remaining job: \`publish/diff\` fetches the site's published pages from
+# \`siteOrigin\`, and a private address is refused under NODE_ENV=production
+# unless it is listed here. That check is right — an unchecked loopback value
+# would turn the orchestrator into a proxy onto its own host — but with nothing
+# listed, the production Publish panel answers
+# \`400 siteOrigin is not an allowed URL\` for this site's own origin.
+#
+# On a real deployment the site origin is public and passes without this. It is
+# here because \`npm run build && npm start\` on your own machine is not.
+ORCHESTRATOR_CORS_ORIGINS=http://localhost:${config.sitePort}
+
 # This site's public origin. It is the only thing a page cannot work out from
 # its own content, and three tags need it: <link rel="canonical">, og:url, and
 # an og:image resolved to an absolute URL — a relative one is legal in the

package/dist/versions.d.ts

@@ -17,7 +17,7 @@
  * `@avocadostudio-ai/orchestrator-core`, already pinned there; naming it again
  * here is how a project ends up with two.
  */
-export declare const AVOCADO = "0.11.2";
+export declare const AVOCADO = "0.11.4";
 /**
  * Next 15.5.15 rather than 16, because that is the version every example app
  * and the demo site in this repository build and test against. The SDK

package/dist/versions.js

@@ -17,7 +17,7 @@
  * `@avocadostudio-ai/orchestrator-core`, already pinned there; naming it again
  * here is how a project ends up with two.
  */
-export const AVOCADO = "0.11.2";
+export const AVOCADO = "0.11.4";
 /**
  * Next 15.5.15 rather than 16, because that is the version every example app
  * and the demo site in this repository build and test against. The SDK

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-avocado-site",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Bootstrap a runnable Avocado Studio demo site, or wire Avocado into an existing Next.js project",
   "type": "module",
   "bin": {
@@ -34,8 +34,8 @@
     "@types/node": "^22.13.10",
     "tsx": "^4.19.0",
     "typescript": "^5.7.3",
-    "@avocadostudio-ai/shared": "0.11.2",
-    "@avocadostudio-ai/site-sdk": "0.11.2"
+    "@avocadostudio-ai/site-sdk": "0.11.4",
+    "@avocadostudio-ai/shared": "0.11.4"
   },
   "license": "Apache-2.0",
   "homepage": "https://docs.avocadostudio.dev",