e800f10681
- The build now emits public/_headers implementing the embeddability split (direct-embed pages framable anywhere; staging preview-only) — Netlify/CF Pages consume it automatically; serving/traefik-embed-headers.yaml is the proxy-side reference. The contract is auditable in-repo, not just documented. - README: docs table gains how-to, layouts/README (the SPA machinery), and docs/architecture; Quickstart gains bun run serve + bun run phone.
14 lines
587 B
Text
14 lines
587 B
Text
# doxa-maps frame policy — generated by internal/generate-tree.mjs
|
|
# (see docs/architecture/embeddability.md — the server owns frame-ancestors)
|
|
|
|
# Staging surfaces: internal preview only
|
|
/doxa-maps/index.html
|
|
Content-Security-Policy: frame-ancestors 'self'
|
|
/doxa-maps/:bundle/index.html
|
|
Content-Security-Policy: frame-ancestors 'self'
|
|
|
|
# Direct-embed pages (the product): framable on any partner site
|
|
/doxa-maps/:bundle/:profile/index.html
|
|
Content-Security-Policy: frame-ancestors *
|
|
/doxa-maps/:bundle/:profile/:instance/index.html
|
|
Content-Security-Policy: frame-ancestors *
|