@assembly-js/app-foundation 0.7.1 → 0.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +3 -0
- package/CLAUDE.md +1 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -19,6 +19,9 @@ A patch release never changes what an app's build requires; a minor release may
|
|
|
19
19
|
not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
|
|
20
20
|
`bump: minor` change file.
|
|
21
21
|
|
|
22
|
+
## 0.7.2
|
|
23
|
+
- [guidance] The build agent now sets `allow="autoplay; fullscreen; picture-in-picture; encrypted-media"` and `allowfullscreen` on embedded video player iframes, so Vimeo and YouTube players can go fullscreen, autoplay and use picture-in-picture inside the portal.
|
|
24
|
+
|
|
22
25
|
## 0.7.1
|
|
23
26
|
- [fix] The location reporter no longer sends the host's embed-session params (`token`, `clientId`, `companyId`) with the app's location, so they never reach the host URL or a copied deep link.
|
|
24
27
|
|
package/CLAUDE.md
CHANGED
|
@@ -474,6 +474,7 @@ Because the app runs in an iframe inside the parent dashboard, several normal Ne
|
|
|
474
474
|
- **Cookies must be `sameSite: 'none'` and `secure: true`.** Anything else is dropped silently in cross-origin iframes.
|
|
475
475
|
- **No top-level navigation.** Don't use `window.location = '...'` to go to external URLs — it'll either break out of the iframe or be blocked. For external links use `<a target="_blank" rel="noreferrer">`.
|
|
476
476
|
- **No `window.open(..., '_self')`.** Same issue.
|
|
477
|
+
- **Nested video players re-delegate their permissions.** When you embed a Vimeo, YouTube or similar player in an `<iframe>`, set `allow="autoplay; fullscreen; picture-in-picture; encrypted-media"` and `allowfullscreen` on that iframe. Permissions pass down one frame at a time: the portal grants them to your app, but the player only gets them if your iframe grants them again, so without the attribute fullscreen, picture-in-picture and DRM playback fail silently.
|
|
477
478
|
<!-- !feature:app-owned-header -->
|
|
478
479
|
- **The portal owns the chrome (header, sidebar).** Don't render your own breadcrumbs or page titles via DOM. Use `@assembly-js/app-bridge` to set them.
|
|
479
480
|
- **Never put the app name in breadcrumbs.** The parent portal *automatically* prepends the app's name as breadcrumb 0. If you also pass `{ label: 'MyApp' }` as the first entry of `setBreadcrumbs`, it renders twice ("MyApp / MyApp / Reports"). For a flat one-page app pass `[]` (or skip `setBreadcrumbs` entirely). For a multi-level app pass only the sub-pages: `setBreadcrumbs([{ label: 'Reports' }, { label: 'Q4 2026' }])`. Read `.claude/skills/assembly-app-bridge-header/SKILL.md` for full examples.
|