Fix: Use wildcard origin for postMessage in sendReadyMessage

[d-winter]

Problem

Version 1.0.4 introduced wildcard support for allowedOrigins (e.g., http://localhost:*, https://*.hygraph.com), but this caused a runtime error:

SyntaxError: Failed to execute 'postMessage' on 'Window': Invalid target origin 'http://localhost:*' in a call to 'postMessage'.

The issue occurred because sendReadyMessage() tried to use wildcard patterns directly as the targetOrigin parameter in postMessage() calls. The browser's postMessage API only accepts:

1. Specific origins (e.g., http://localhost:3000)
2. The wildcard "*" to send to any origin

It cannot accept pattern strings like http://localhost:*.

Solution

Modified sendReadyMessage() in MessageBridge.ts to use "*" as the target origin instead of iterating through the allowedOrigins patterns.

Security

Security is maintained because:

• The wildcard patterns in allowedOrigins are still used to validate incoming messages via isOriginAllowed()
• Only messages from origins matching the wildcard patterns are accepted
• Once connected (after receiving an init message), all subsequent messages use the specific validated origin

Changes

• MessageBridge.ts: Changed sendReadyMessage() to use "*" as targetOrigin
• MessageBridge.test.ts: Updated and added tests for the new behavior
• Preview.ts: Updated SDK version to 1.0.5
• package.json: Bumped version to 1.0.5

Testing

• ✅ All 26 tests pass (including new wildcard validation tests)
• ✅ TypeScript compilation succeeds with strict types
• ✅ Build completes successfully
• ✅ Published to npm as v1.0.5

🤖 Generated with Claude Code