@forge/csp

Index: package/out/csp/csp-injection-service.js
===================================================================
--- package/out/csp/csp-injection-service.js
+++ package/out/csp/csp-injection-service.js
@@ -146,15 +146,15 @@
 exports.getAtlassianImageHost = getAtlassianImageHost;
 exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = ['https://secure.gravatar.com', 'https://images.unsplash.com'];
 class CSPInjectionService {
     constructor() {
-        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain }) => {
+        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain }) => {
             const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv, icOptions);
             const fosCDNUrls = getFOSCDNUrls(microsEnv, icOptions);
             const defaultSrc = ["'self'", ...getFOSHostDownload(microsEnv, icOptions), ...fosCDNUrls].join(' ');
             const frameAncestors = [
                 "'self'",
-                ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain),
+                ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain),
                 ...getFOSHostDownload(microsEnv, icOptions),
                 ...fosCDNUrls
             ].join(' ');
             const frameSrc = [
@@ -280,9 +280,9 @@
         allowed.push(...getFOSHostUpload(microsEnv, icOptions));
         allowed.push(...getFOSCDNUrls(microsEnv, icOptions));
         return allowed;
     }
-    getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain) {
+    getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain) {
         let frameAncestors = [];
         const localhostWithPortRegex = /^localhost:\d+$/;
         switch (microsEnv) {
             case 'dev':
@@ -332,8 +332,11 @@
         }
         if (connectMacroParentDomain) {
             frameAncestors.push(connectMacroParentDomain);
         }
+        if (parentEmbeddingDomain) {
+            frameAncestors.push(parentEmbeddingDomain);
+        }
         if (hostname) {
             frameAncestors.push(hostname);
         }
         return frameAncestors;

Index: package/package.json
===================================================================
--- package/package.json
+++ package/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@forge/csp",
-  "version": "6.0.0-experimental-9423de1",
+  "version": "6.1.0-next.0",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
   "license": "SEE LICENSE IN LICENSE.txt",
@@ -10,10 +10,10 @@
     "compile": "tsc -b -v",
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "9.0.1-next.2-experimental-9423de1",
-    "@forge/manifest": "13.1.0-next.2-experimental-9423de1",
+    "@forge/cli-shared": "9.0.1-next.8",
+    "@forge/manifest": "13.1.0-next.6",
     "@types/jest": "^29.5.14",
     "@types/node": "20.19.1",
     "cheerio": "^1.2.0",
     "typescript": "5.9.2"

Index: package/out/csp/csp-injection-service.d.ts.map
===================================================================
--- package/out/csp/csp-injection-service.d.ts.map
+++ package/out/csp/csp-injection-service.d.ts.map
@@ -1,1 +1,1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA+K1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAYjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,iBAAiB;IAuElB,gBAAgB,GAAI,oIASxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC,KAAG,MAAM,EAAE,CA+FV;CACH"}
\ No newline at end of file
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA+K1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAYjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,iBAAiB;IA4ElB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAsGV;CACH"}
\ No newline at end of file

Index: package/CHANGELOG.md
===================================================================
--- package/CHANGELOG.md
+++ package/CHANGELOG.md
@@ -1,6 +1,12 @@
 # @forge/csp
 
+## 6.1.0-next.0
+
+### Minor Changes
+
+- 9390d98: Add optional `parentEmbeddingDomain` parameter to the CSP injection service. When provided, the domain is appended to the `frame-ancestors` directive, allowing Forge apps embedded in Confluence pages served on a custom parent domain to load.
+
 ## 6.0.0
 
 ### Major Changes

Index: package/out/csp/csp-injection-service.d.ts
===================================================================
--- package/out/csp/csp-injection-service.d.ts
+++ package/out/csp/csp-injection-service.d.ts
@@ -17,17 +17,18 @@
     private getMetalClientCSP;
     private getExistingCSPDetails;
     private getConnectSrc;
     private getFrameAncestors;
-    getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain }: {
+    getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain }: {
         existingCSPDetails: CSPDetails;
         microsEnv: LambdaEnvironment;
         tunnelCSPReporterUri?: string;
         hostname?: string;
         isFedRAMP?: boolean;
         icOptions?: IcOptions;
         macroParentHost?: string;
         connectMacroParentDomain?: string;
+        parentEmbeddingDomain?: string;
     }) => string[];
 }
 export {};
 //# sourceMappingURL=csp-injection-service.d.ts.map
\ No newline at end of file