fimo 2.8.0 → 2.9.0-staging.1

package/dist/runtime/preview/frame-headers.d.ts

@@ -0,0 +1,14 @@
+interface ResponseHeader {
+    key: string;
+    value: string;
+}
+/** Adapt only framing headers, retaining the response stream, status and cookies. */
+export declare function adaptPreviewFrameResponse(response: Response, studioOrigin?: string): Response;
+/** FIMO-2872: Providers apply matching rules in order, with the last header winning. */
+export declare function adaptPreviewFrameHeaderRules<T extends {
+    headers: ResponseHeader[];
+}>(rules: T[], studioOrigin?: string): T[];
+/** FIMO-2872: Only an explicit platform-supplied Studio origin enables adaptation. */
+export declare function adaptPreviewFrameHeaders(headers: ResponseHeader[], studioOrigin?: string, requireAncestors?: boolean): ResponseHeader[];
+export {};
+//# sourceMappingURL=frame-headers.d.ts.map

package/dist/runtime/preview/frame-headers.js

@@ -0,0 +1,96 @@
+/** Adapt only framing headers, retaining the response stream, status and cookies. */
+export function adaptPreviewFrameResponse(response, studioOrigin) {
+    const original = [...response.headers].map(([key, value]) => ({ key, value }));
+    const adapted = adaptPreviewFrameHeaders(original, studioOrigin);
+    if (adapted.length === original.length && adapted.every((header, i) => header === original[i]))
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete('x-frame-options');
+    for (const header of adapted) {
+        if (header.key.toLowerCase() === 'content-security-policy')
+            headers.set(header.key, header.value);
+    }
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+/** FIMO-2872: Providers apply matching rules in order, with the last header winning. */
+export function adaptPreviewFrameHeaderRules(rules, studioOrigin) {
+    const hasFrameOptions = rules.some((rule) => rule.headers.some((header) => header.key.toLowerCase() === 'x-frame-options'));
+    const defaults = [];
+    const adapted = rules.map((rule) => {
+        const hasPolicy = rule.headers.some((header) => header.key.toLowerCase() === 'content-security-policy');
+        const headers = adaptPreviewFrameHeaders(rule.headers, studioOrigin, hasFrameOptions && hasPolicy);
+        if (headers === rule.headers)
+            return rule;
+        if (!hasPolicy) {
+            const policy = headers.find((header) => header.key.toLowerCase() === 'content-security-policy');
+            if (policy) {
+                // A synthesized framing-only policy must never overwrite an application's
+                // resource policy from another matching rule. Keep its original conditions.
+                defaults.push({ ...rule, headers: [policy] });
+                return { ...rule, headers: headers.filter((header) => header !== policy) };
+            }
+        }
+        return { ...rule, headers };
+    });
+    return [...defaults, ...adapted.filter((rule) => rule.headers.length > 0)];
+}
+/** FIMO-2872: Only an explicit platform-supplied Studio origin enables adaptation. */
+export function adaptPreviewFrameHeaders(headers, studioOrigin, requireAncestors = false) {
+    if (!studioOrigin)
+        return headers;
+    let origin;
+    try {
+        const url = new URL(studioOrigin);
+        if (!['http:', 'https:'].includes(url.protocol) ||
+            url.username ||
+            url.password ||
+            url.pathname !== '/' ||
+            url.search ||
+            url.hash ||
+            !/^(?:[a-z\d.-]+|\[[a-f\d:]+\])$/i.test(url.hostname))
+            return headers;
+        origin = url.origin;
+    }
+    catch {
+        return headers;
+    }
+    const frameOptions = headers.filter((header) => header.key.toLowerCase() === 'x-frame-options');
+    let hasAncestors = false;
+    const adapted = headers
+        .filter((header) => header.key.toLowerCase() !== 'x-frame-options')
+        .map((header) => {
+        if (header.key.toLowerCase() !== 'content-security-policy')
+            return header;
+        // Every enforcing policy applies. Keep non-framing directives verbatim,
+        // including nonces, hashes and resource allowlists.
+        const value = header.value
+            .split(',')
+            .map((policy) => policy
+            .split(';')
+            .map((directive) => {
+            const [name, ...sources] = directive.trim().split(/\s+/);
+            if (name?.toLowerCase() !== 'frame-ancestors')
+                return directive;
+            hasAncestors = true;
+            if (sources.includes(origin) && !sources.includes("'none'"))
+                return directive;
+            return `frame-ancestors ${[...new Set([...sources.filter((source) => source !== "'none'"), origin])].join(' ')}`;
+        })
+            .join(';'))
+            .join(',');
+        return value === header.value ? header : { ...header, value };
+    });
+    if ((frameOptions.length || requireAncestors) && !hasAncestors) {
+        const self = frameOptions.some((header) => /\bsameorigin\b/i.test(header.value)) ? "'self' " : '';
+        const ancestors = `frame-ancestors ${self}${origin}`;
+        const policyIndex = adapted.findIndex((header) => header.key.toLowerCase() === 'content-security-policy');
+        const policy = adapted[policyIndex];
+        // Next stores headers by name; adding a second CSP here would overwrite
+        // the application's existing resource restrictions.
+        if (policy)
+            adapted[policyIndex] = { ...policy, value: `${policy.value}; ${ancestors}` };
+        else
+            adapted.push({ key: 'Content-Security-Policy', value: ancestors });
+    }
+    return adapted;
+}

package/dist/runtime/preview/index.d.ts

@@ -1,4 +1,5 @@
 export { getSafePreviewNavigationPath, isPreviewRuntimeEnabled } from './bridge.js';
+export { adaptPreviewFrameHeaderRules, adaptPreviewFrameHeaders, adaptPreviewFrameResponse } from './frame-headers.js';
 export { resolveFimoEditingMetadata, isFimoEditingMetadataEnabled, withoutFimoEditingMetadata, FIMO_EDITING_ATTRIBUTES, } from './editing-metadata.js';
 export { getPreviewLocationChange, getPreviewLocationPath, getPreviewParentOrigin, getDocumentLocale, resolvePreviewParentOrigin, type PreviewBrowserContext, type PreviewLocationChange, type PreviewLocationLike, } from './location.js';
 export { ensurePreviewScript } from './script.js';

package/dist/runtime/preview/index.js

@@ -1,4 +1,5 @@
 export { getSafePreviewNavigationPath, isPreviewRuntimeEnabled } from './bridge.js';
+export { adaptPreviewFrameHeaderRules, adaptPreviewFrameHeaders, adaptPreviewFrameResponse } from './frame-headers.js';
 export { resolveFimoEditingMetadata, isFimoEditingMetadataEnabled, withoutFimoEditingMetadata, FIMO_EDITING_ATTRIBUTES, } from './editing-metadata.js';
 export { getPreviewLocationChange, getPreviewLocationPath, getPreviewParentOrigin, getDocumentLocale, resolvePreviewParentOrigin, } from './location.js';
 export { ensurePreviewScript } from './script.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fimo",
-  "version": "2.8.0",
+  "version": "2.9.0-staging.1",
   "description": "Fimo CLI - create, deploy, and manage Fimo sites",
   "keywords": [
     "astro-component"
@@ -194,13 +194,13 @@
   "devDependencies": {
     "@clack/core": "^1.2.0",
     "@clack/prompts": "^1.2.0",
-    "@fimo/agents-bundle": "2.8.0",
-    "@fimo/api-contracts": "2.8.0",
-    "@fimo/cli-kit": "2.8.0",
-    "@fimo/framework-detect": "2.8.0",
-    "@fimo/routes": "2.8.0",
-    "@fimo/sdk": "2.8.0",
-    "@fimo/tsconfig": "2.8.0",
+    "@fimo/agents-bundle": "2.9.0-staging.1",
+    "@fimo/api-contracts": "2.9.0-staging.1",
+    "@fimo/cli-kit": "2.9.0-staging.1",
+    "@fimo/framework-detect": "2.9.0-staging.1",
+    "@fimo/routes": "2.9.0-staging.1",
+    "@fimo/sdk": "2.9.0-staging.1",
+    "@fimo/tsconfig": "2.9.0-staging.1",
     "@types/node": "22.18.6",
     "agent-install": "^0.0.5",
     "astro": "^7.1.6",

package/release.json

@@ -1,5 +1,5 @@
 {
   "source": "npm",
-  "apiUrl": "https://api.fimo.ai",
-  "webUrl": "https://fimo.ai"
+  "apiUrl": "https://api.staging.fimo.team",
+  "webUrl": "https://staging.fimo.team"
 }

package/templates/astro/package.json

@@ -9,9 +9,9 @@
     "check": "astro sync && astro check"
   },
   "dependencies": {
-    "fimo": "2.8.0",
-    "fimo-analytics": "2.8.0",
-    "fimo-astro": "2.8.0",
+    "fimo": "2.9.0-staging.1",
+    "fimo-analytics": "2.9.0-staging.1",
+    "fimo-astro": "2.9.0-staging.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/nextjs/package.json

@@ -12,11 +12,11 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.80.6",
-    "fimo": "2.8.0",
-    "fimo-analytics": "2.8.0",
-    "fimo-next": "2.8.0",
-    "fimo-react": "2.8.0",
-    "next": "16.3.8",
+    "fimo": "2.9.0-staging.1",
+    "fimo-analytics": "2.9.0-staging.1",
+    "fimo-next": "2.9.0-staging.1",
+    "fimo-react": "2.9.0-staging.1",
+    "next": "16.4.2",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "zod": "^4.4.3"

package/templates/react-router/package.json

@@ -21,11 +21,11 @@
     "cn": "0.2.4",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
-    "fimo": "2.8.0",
-    "fimo-analytics": "2.8.0",
-    "fimo-react": "2.8.0",
-    "fimo-react-router": "2.8.0",
-    "fimo-vite": "2.8.0",
+    "fimo": "2.9.0-staging.1",
+    "fimo-analytics": "2.9.0-staging.1",
+    "fimo-react": "2.9.0-staging.1",
+    "fimo-react-router": "2.9.0-staging.1",
+    "fimo-vite": "2.9.0-staging.1",
     "input-otp": "^1.4.2",
     "isbot": "^5",
     "lucide-react": "^0.577.0",

package/templates/sveltekit/package.json

@@ -11,9 +11,9 @@
     "prepare": "svelte-kit sync"
   },
   "dependencies": {
-    "fimo": "2.8.0",
-    "fimo-analytics": "2.8.0",
-    "fimo-sveltekit": "2.8.0",
+    "fimo": "2.9.0-staging.1",
+    "fimo-analytics": "2.9.0-staging.1",
+    "fimo-sveltekit": "2.9.0-staging.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vite/package.json

@@ -11,11 +11,11 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.80.6",
-    "fimo": "2.8.0",
-    "fimo-analytics": "2.8.0",
-    "fimo-react": "2.8.0",
-    "fimo-react-router": "2.8.0",
-    "fimo-vite": "2.8.0",
+    "fimo": "2.9.0-staging.1",
+    "fimo-analytics": "2.9.0-staging.1",
+    "fimo-react": "2.9.0-staging.1",
+    "fimo-react-router": "2.9.0-staging.1",
+    "fimo-vite": "2.9.0-staging.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-router": "^8.3.0",