sitedrift 0.3.2 → 0.3.4

package/assets/viewer.js

@@ -4,7 +4,10 @@
       config.dev = location.origin;
       config.frameOrigins = { dev: location.origin, live: location.origin };
       for (const iframe of document.querySelectorAll('iframe[data-side]')) {
-        iframe.setAttribute('sandbox', 'allow-downloads allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-scripts');
+        // Same-origin is required for Safari to apply `style-src 'self'` inside
+        // the frame. Scripts stay disabled so framed site code cannot reach
+        // the same-origin sitedrift parent.
+        iframe.setAttribute('sandbox', 'allow-downloads allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-same-origin');
       }
     }
     const root = document.documentElement;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sitedrift",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Catch the drift between dev and live — frame your local site and production side-by-side on the same route, locked scroll, with a difference-blend overlay. Zero runtime dependencies.",
   "type": "module",
   "bin": {

package/src/cloudflare-runtime.mjs

@@ -35,9 +35,9 @@ async function devResponse(context, route) {
   if (context.request.method === 'GET' && accept.includes('text/html')) {
     const clean = pathname.replace(/^\/+/, '');
     const candidates = pathname.endsWith('/')
-      ? [`/__sitedrift/source/${clean}index.html.txt`]
-      : [`/__sitedrift/source/${clean}.html.txt`, `/__sitedrift/source/${clean}/index.html.txt`];
-    if (pathname === '/') candidates.unshift('/__sitedrift/source/index.html.txt');
+      ? [`/__sitedrift_source/${clean}index.html.txt`]
+      : [`/__sitedrift_source/${clean}.html.txt`, `/__sitedrift_source/${clean}/index.html.txt`];
+    if (pathname === '/') candidates.unshift('/__sitedrift_source/index.html.txt');
     for (const pathname of candidates) {
       const response = await context.env.ASSETS.fetch(new URL(pathname, requestUrl));
       if (response.ok) {
@@ -72,9 +72,6 @@ async function liveResponse(context, route, live) {
 
 export async function onRequest(context) {
   const requestUrl = new URL(context.request.url);
-  if (requestUrl.pathname.startsWith('/__sitedrift/source')) {
-    return new Response('Not found.', { status: 404 });
-  }
   const match = requestUrl.pathname.match(/^\/__sitedrift\/(dev|live)(\/.*)?$/);
   if (!match) return context.env.ASSETS.fetch(context.request);
   if (!['GET', 'HEAD'].includes(context.request.method)) {

package/src/cloudflare.mjs

@@ -53,7 +53,7 @@ export function installCloudflarePreview({
 
   const liveUrl = secureLive(live);
   const internal = path.join(output, '__sitedrift');
-  const source = path.join(internal, 'source');
+  const source = path.join(output, '__sitedrift_source');
   const assetDir = path.join(internal, 'assets');
   fs.mkdirSync(source, { recursive: true });
   fs.mkdirSync(assetDir, { recursive: true });