Fix: Add wildcard support for all Hygraph Studio domains

[d-winter]

Problem

The SDK's default allowedOrigins list was too restrictive, containing only:

• https://app.hygraph.com
• http://localhost:3000

This caused the SDK to reject postMessage events from Studio instances running on:

• Regional domains (e.g., https://studio-eu-central-1-shared-euc1-02.hygraph.com)
• Custom Hygraph deployments
• Staging/development environments (*.hygraph.dev)
• Local development on different ports

Users experienced silent failures where the preview integration wouldn't work in the Studio iframe, forcing them to manually configure allowedOrigins or use studioUrl - neither of which should be necessary for iframe mode.

Solution

Updated the default allowedOrigins to use wildcard patterns (already supported by the MessageBridge):

allowedOrigins: [
  'https://*.hygraph.com',      // Matches any Hygraph subdomain
  'https://*.hygraph.dev',      // Matches staging/dev environments
  'http://localhost:*',         // Matches any local port
]

What This Fixes

✅ Works with regional Studio deployments:

• https://app.hygraph.com ✓
• https://studio-eu-central-1-shared-euc1-02.hygraph.com ✓
• https://eu.app.hygraph.com ✓

✅ Works with all Hygraph environments:

• Production: *.hygraph.com
• Staging/Dev: *.hygraph.dev

✅ Works with any localhost port:

• http://localhost:3000 ✓
• http://localhost:4500 ✓
• http://localhost:8080 ✓

Technical Details

The wildcard matching logic was already implemented in MessageBridge.ts:155-165. This PR simply updates the default values to leverage that existing functionality.

The pattern https://*.hygraph.com is converted to regex ^https://.*.hygraph.com$ and matches any subdomain.

Security

The allowedOrigins validation remains in place to prevent malicious sites from sending fake postMessage events. The wildcards are scoped to Hygraph-owned domains only.

Breaking Changes

None. This is purely additive and makes the SDK work in more scenarios out of the box.

Testing

• ✅ Type checking passes
• ✅ Wildcard pattern verified to match example regional Studio URL
• ✅ Existing behavior preserved

---

Type: Bug Fix
Version: Should be patch bump (1.0.3 → 1.0.4)