From a31bbf650b5f4dd91d02709668fd5db3807a506c Mon Sep 17 00:00:00 2001
From: Louisa Chu <louisa@ensemble.com>
Date: Tue, 6 Jan 2026 10:27:32 -0800
Subject: [PATCH 1/2] add origin

---
 src/index.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/index.ts b/src/index.ts
index 5d11c41..cfcef12 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -274,6 +274,9 @@ export async function run(req: Request, ctx: Helix.UniversalContext): Promise<Re
     status: 200,
     headers: {
       'content-type': 'text/html',
+      'Access-Control-Allow-Origin': 'http://localhost:3000',
+      'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type, Authorization',
     },
   });
 }

From 35dbdf04f0794ae82b8f7f5e311952e822a31706 Mon Sep 17 00:00:00 2001
From: Louisa Chu <louisa@ensemble.com>
Date: Tue, 6 Jan 2026 11:19:20 -0800
Subject: [PATCH 2/2] update to check if it's localhost

---
 src/index.ts | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index cfcef12..892b1c5 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -197,18 +197,18 @@ export async function run(req: Request, ctx: Helix.UniversalContext): Promise<Re
 
   const resolvePath = (relativePath, currentDirectory) => {
     const baseDir = currentDirectory.substring(0, currentDirectory.lastIndexOf('/'));
-  
+
     if (relativePath.startsWith('../')) {
       return baseDir.substring(0, baseDir.lastIndexOf('/')) + relativePath.slice(2);
     }
-  
+
     if (relativePath.startsWith('./')) {
       return baseDir + relativePath.slice(1);
     }
-  
+
     return baseDir + '/' + relativePath;
   };
-  
+
   const fetchData = async (url) => {
     const response = await fetch(url);
     if (!response.ok) {
@@ -217,20 +217,20 @@ export async function run(req: Request, ctx: Helix.UniversalContext): Promise<Re
     const text = await response.text();
     return text.replace(/^---[\s\S]*?---\s*/g, '').trim();
   };
-  
+
   const replaceComponentWithFragment = async (content, componentName, pathName) => {
-  
+
     if (pathName.endsWith('md')) {
       const resolvedPath = resolvePath(pathName, path);
       const rawUrl = `https://raw.githubusercontent.com/${ctx.attributes.content.owner}/${ctx.attributes.content.repo}/${ctx.attributes.content.branch}${resolvedPath}`;
-  
+
       try {
         const fragment = await fetchData(rawUrl);
-  
+
         if (!fragment) {
           return content;
         }
-  
+
         const componentTag = `<${componentName}\\s*/?>`;
         return content.replace(new RegExp(componentTag, 'g'), fragment);
       } catch (error) {
@@ -242,14 +242,14 @@ export async function run(req: Request, ctx: Helix.UniversalContext): Promise<Re
       return content;
     }
   };
-  
+
   const extractImportPaths = (content) => {
     return [...content.matchAll(/import\s+(\w+)\s+from\s+'([^']+)'/g)].map(match => ({
       componentName: match[1],
       pathName: match[2]
     }));
   };
-  
+
     //credential jsonDefinition url update
     function updateCredentialTag(content: string, currentFilePath: string): string {
       return content.replace(/(<GetCredential[^>]*jsonDefinition=")([^"]+)("[^>]*\/>)/g, (match, before, oldPath, after) => {
@@ -259,24 +259,26 @@ export async function run(req: Request, ctx: Helix.UniversalContext): Promise<Re
     }
     const importPaths = extractImportPaths(content);
     let updatedContent = content;
-  
+
     for (const { componentName, pathName } of importPaths) {
       updatedContent = await replaceComponentWithFragment(updatedContent, componentName, pathName);
     }
-    
+
     updatedContent = updateCredentialTag(updatedContent, path);
-    
+
       ctx.attributes.content.md = updatedContent;
 
   const html = md2markup(ctx);
 
   return new Response(html, {
     status: 200,
-    headers: {
+    headers: ['127.0.0.1', 'localhost'].includes(hostname) ? {
       'content-type': 'text/html',
       'Access-Control-Allow-Origin': 'http://localhost:3000',
       'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
       'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    } : {
+      'content-type': 'text/html',
     },
   });
 }