isotone 1.0.3 → 1.0.4

package/dist/serve.js

@@ -11,7 +11,7 @@ import {
 import {
   UPDATE_ENDPOINT,
   startUpdateCheck
-} from "./chunk-QDOV7KYU.js";
+} from "./chunk-3AYKY7NS.js";
 import {
   NOTES_ENDPOINT,
   ensureFileIgnored,

package/dist/server.d.ts

@@ -92,12 +92,21 @@ declare function variantsResponse(opts: VariantsStoreOptions, req: NotesRequest)
  * keep this subpath framework-free.
  */
 
+interface ServeRequestOptions {
+    /**
+     * Accept requests from any loopback page (localhost, 127.0.0.1, [::1]) on
+     * any port. Needed when the app's dev server and this API listen on
+     * different ports, since the page's origin then never matches the API host.
+     * Off by default: only the API's own origin is accepted.
+     */
+    loopbackOrigins?: boolean;
+}
 /**
  * A convenience Next-compatible adapter: given a `Request`/`NextRequest` and the
  * `file`, return a `NextResponse`-shaped `{ status, headers, body }`. Frameworks
  * that expose a `(req, res)` pair call `notesResponse` and render it directly.
  */
-declare function serveNotesRequest(file: string, request: Request): Promise<{
+declare function serveNotesRequest(file: string, request: Request, options?: ServeRequestOptions): Promise<{
     status: number;
     headers: Record<string, string>;
     body: unknown;
@@ -108,10 +117,10 @@ declare function serveNotesRequest(file: string, request: Request): Promise<{
  * such as `.../active`), strip the mount prefix before handing the rest to
  * `variantsResponse`, which routes on the path relative to the mount.
  */
-declare function serveVariantsRequest(opts: VariantsStoreOptions, request: Request): Promise<{
+declare function serveVariantsRequest(opts: VariantsStoreOptions, request: Request, options?: ServeRequestOptions): Promise<{
     status: number;
     headers: Record<string, string>;
     body: unknown;
 }>;
 
-export { ACTIVE_FILE, DEFAULT_VARIANTS_DIR, NOTES_ENDPOINT, type NotesRequest, type NotesResponse, PAYLOAD_MAX, type StoredNote, type VariantsStoreOptions, ensureFileIgnored, listVariants, notesResponse, readActive, readNotes, serveNotesRequest, serveVariantsRequest, updateNotes, variantsResponse, writeActive, writeNotes };
+export { ACTIVE_FILE, DEFAULT_VARIANTS_DIR, NOTES_ENDPOINT, type NotesRequest, type NotesResponse, PAYLOAD_MAX, type ServeRequestOptions, type StoredNote, type VariantsStoreOptions, ensureFileIgnored, listVariants, notesResponse, readActive, readNotes, serveNotesRequest, serveVariantsRequest, updateNotes, variantsResponse, writeActive, writeNotes };

package/dist/server.js

@@ -26,10 +26,10 @@ import {
 import "./chunk-A4DX2V4C.js";
 
 // src/server/index.ts
-async function serveNotesRequest(file, request) {
+async function serveNotesRequest(file, request, options = {}) {
   try {
     const url = new URL(request.url);
-    checkOrigin(request.headers.get("origin"), url.host);
+    checkOrigin(request.headers.get("origin"), url.host, options.loopbackOrigins);
     const body = request.method === "POST" ? await readWebJson(request) : void 0;
     return notesResponse(file, {
       method: request.method,
@@ -40,10 +40,10 @@ async function serveNotesRequest(file, request) {
     return httpFailure(error);
   }
 }
-async function serveVariantsRequest(opts, request) {
+async function serveVariantsRequest(opts, request, options = {}) {
   try {
     const url = new URL(request.url);
-    checkOrigin(request.headers.get("origin"), url.host);
+    checkOrigin(request.headers.get("origin"), url.host, options.loopbackOrigins);
     const body = request.method === "POST" ? await readWebJson(request) : void 0;
     const mounted = url.pathname.startsWith(VARIANTS_ENDPOINT) ? url.pathname.slice(VARIANTS_ENDPOINT.length) : url.pathname;
     return variantsResponse(opts, {

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/index.ts"],"sourcesContent":["import { checkOrigin, httpFailure, readWebJson } from './http';\n/**\n * isotone — server.\n *\n * The transport-agnostic side of the loop: the file store and a pure request\n * handler that any dev runtime (Vite middleware, Next route handler, Bun.serve,\n * Vercel function, plain `node:http`) can render. No React and no Vite here —\n * keep this subpath framework-free.\n */\n\nexport {\n  ensureFileIgnored,\n  notesResponse,\n  readNotes,\n  writeNotes,\n  updateNotes,\n  NOTES_ENDPOINT,\n  PAYLOAD_MAX,\n} from '../store';\nimport { notesResponse } from '../store';\nexport type {\n  NotesRequest,\n  NotesResponse,\n  StoredNote,\n} from '../store';\n\nexport {\n  ACTIVE_FILE,\n  DEFAULT_VARIANTS_DIR,\n  listVariants,\n  readActive,\n  variantsResponse,\n  writeActive,\n} from '../variants-store';\nimport { variantsResponse } from '../variants-store';\nimport type { VariantsStoreOptions } from '../variants-store';\nexport type { VariantsStoreOptions } from '../variants-store';\nexport { VARIANTS_ENDPOINT } from '../core/variants';\nimport { VARIANTS_ENDPOINT } from '../core/variants';\n\n/**\n * A convenience Next-compatible adapter: given a `Request`/`NextRequest` and the\n * `file`, return a `NextResponse`-shaped `{ status, headers, body }`. Frameworks\n * that expose a `(req, res)` pair call `notesResponse` and render it directly.\n */\nexport async function serveNotesRequest(\n  file: string,\n  request: Request,\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    return notesResponse(file, {\n      method: request.method,\n      url: `${url.pathname}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n\n/**\n * Like {@link serveNotesRequest}, for the variants endpoint: given a\n * `Request` whose path ends with `VARIANTS_ENDPOINT` (or a sub-path of it,\n * such as `.../active`), strip the mount prefix before handing the rest to\n * `variantsResponse`, which routes on the path relative to the mount.\n */\nexport async function serveVariantsRequest(\n  opts: VariantsStoreOptions,\n  request: Request,\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    const mounted = url.pathname.startsWith(VARIANTS_ENDPOINT)\n      ? url.pathname.slice(VARIANTS_ENDPOINT.length)\n      : url.pathname;\n    return variantsResponse(opts, {\n      method: request.method,\n      url: `${mounted || '/'}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,eAAsB,kBACpB,MACA,SAC6E;AAC7E,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,IAAI;AACnD,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,WAAO,cAAc,MAAM;AAAA,MACzB,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,IAAI,QAAQ,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;AAQA,eAAsB,qBACpB,MACA,SAC6E;AAC7E,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,IAAI;AACnD,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,UAAM,UAAU,IAAI,SAAS,WAAW,iBAAiB,IACrD,IAAI,SAAS,MAAM,kBAAkB,MAAM,IAC3C,IAAI;AACR,WAAO,iBAAiB,MAAM;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,WAAW,GAAG,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../src/server/index.ts"],"sourcesContent":["import { checkOrigin, httpFailure, readWebJson } from './http';\n/**\n * isotone — server.\n *\n * The transport-agnostic side of the loop: the file store and a pure request\n * handler that any dev runtime (Vite middleware, Next route handler, Bun.serve,\n * Vercel function, plain `node:http`) can render. No React and no Vite here —\n * keep this subpath framework-free.\n */\n\nexport {\n  ensureFileIgnored,\n  notesResponse,\n  readNotes,\n  writeNotes,\n  updateNotes,\n  NOTES_ENDPOINT,\n  PAYLOAD_MAX,\n} from '../store';\nimport { notesResponse } from '../store';\nexport type {\n  NotesRequest,\n  NotesResponse,\n  StoredNote,\n} from '../store';\n\nexport {\n  ACTIVE_FILE,\n  DEFAULT_VARIANTS_DIR,\n  listVariants,\n  readActive,\n  variantsResponse,\n  writeActive,\n} from '../variants-store';\nimport { variantsResponse } from '../variants-store';\nimport type { VariantsStoreOptions } from '../variants-store';\nexport type { VariantsStoreOptions } from '../variants-store';\nexport { VARIANTS_ENDPOINT } from '../core/variants';\nimport { VARIANTS_ENDPOINT } from '../core/variants';\n\nexport interface ServeRequestOptions {\n  /**\n   * Accept requests from any loopback page (localhost, 127.0.0.1, [::1]) on\n   * any port. Needed when the app's dev server and this API listen on\n   * different ports, since the page's origin then never matches the API host.\n   * Off by default: only the API's own origin is accepted.\n   */\n  loopbackOrigins?: boolean;\n}\n\n/**\n * A convenience Next-compatible adapter: given a `Request`/`NextRequest` and the\n * `file`, return a `NextResponse`-shaped `{ status, headers, body }`. Frameworks\n * that expose a `(req, res)` pair call `notesResponse` and render it directly.\n */\nexport async function serveNotesRequest(\n  file: string,\n  request: Request,\n  options: ServeRequestOptions = {},\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host, options.loopbackOrigins);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    return notesResponse(file, {\n      method: request.method,\n      url: `${url.pathname}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n\n/**\n * Like {@link serveNotesRequest}, for the variants endpoint: given a\n * `Request` whose path ends with `VARIANTS_ENDPOINT` (or a sub-path of it,\n * such as `.../active`), strip the mount prefix before handing the rest to\n * `variantsResponse`, which routes on the path relative to the mount.\n */\nexport async function serveVariantsRequest(\n  opts: VariantsStoreOptions,\n  request: Request,\n  options: ServeRequestOptions = {},\n): Promise<{ status: number; headers: Record<string, string>; body: unknown }> {\n  try {\n    const url = new URL(request.url);\n    checkOrigin(request.headers.get('origin'), url.host, options.loopbackOrigins);\n    const body = request.method === 'POST' ? await readWebJson(request) : undefined;\n    const mounted = url.pathname.startsWith(VARIANTS_ENDPOINT)\n      ? url.pathname.slice(VARIANTS_ENDPOINT.length)\n      : url.pathname;\n    return variantsResponse(opts, {\n      method: request.method,\n      url: `${mounted || '/'}?${url.searchParams.toString()}`,\n      body,\n    });\n  } catch (error) {\n    return httpFailure(error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,eAAsB,kBACpB,MACA,SACA,UAA+B,CAAC,GAC6C;AAC7E,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,MAAM,QAAQ,eAAe;AAC5E,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,WAAO,cAAc,MAAM;AAAA,MACzB,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,IAAI,QAAQ,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;AAQA,eAAsB,qBACpB,MACA,SACA,UAA+B,CAAC,GAC6C;AAC7E,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,gBAAY,QAAQ,QAAQ,IAAI,QAAQ,GAAG,IAAI,MAAM,QAAQ,eAAe;AAC5E,UAAM,OAAO,QAAQ,WAAW,SAAS,MAAM,YAAY,OAAO,IAAI;AACtE,UAAM,UAAU,IAAI,SAAS,WAAW,iBAAiB,IACrD,IAAI,SAAS,MAAM,kBAAkB,MAAM,IAC3C,IAAI;AACR,WAAO,iBAAiB,MAAM;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,KAAK,GAAG,WAAW,GAAG,IAAI,IAAI,aAAa,SAAS,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;","names":[]}

package/dist/vite-plugin.js

@@ -22,7 +22,7 @@ import {
 import {
   UPDATE_ENDPOINT,
   startUpdateCheck
-} from "./chunk-QDOV7KYU.js";
+} from "./chunk-3AYKY7NS.js";
 import {
   NOTES_ENDPOINT,
   ensureDirIgnored,

package/docs/integrations.md

@@ -94,6 +94,13 @@ const handle = async (request: Request) => {
 export { handle as GET, handle as POST, handle as DELETE };
 ```
 
+When the page and this API listen on different ports, for example a Next dev
+server and a separate local API, the browser's origin never matches the API's
+host and every request gets a 403 `origin not allowed`. Pass
+`{ loopbackOrigins: true }` as the third argument of `serveNotesRequest` (or
+`serveVariantsRequest`) to accept pages served from localhost, 127.0.0.1 or
+[::1] on any port. Non-loopback origins are still rejected.
+
 For this manual route, add `.iteration-feedback.json` to the project's `.gitignore`.
 The Vite plugin and standalone server ignore their notes file automatically; the
 transport-only request adapter does not modify Git configuration.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "isotone",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "type": "module",
   "license": "MIT",
   "description": "Local feedback and design variants for your running web app. Pin elements, leave notes, and give your coding agent the context to make the change.",