@open-mercato/core 0.10.1-develop.7903.1.d8ab1c8b0d → 0.10.1-develop.7916.1.586cee8389

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/modules/forms/frontend/embed/[slug]/page.meta.js.map +2 -2
  2. package/package.json +7 -7
  3. package/src/modules/forms/frontend/embed/[slug]/page.meta.ts +2 -1
package/dist/modules/forms/frontend/embed/[slug]/page.meta.js.map CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
3
  "sources": ["../../../../../../src/modules/forms/frontend/embed/%5Bslug%5D/page.meta.ts"],
4
- "sourcesContent": ["import type { PageMetadata } from '@open-mercato/shared/modules/registry'\n\n/**\n * External iframe host page for an embeddable OPEN distribution (spec\n * `2026-05-21-forms-render-surfaces.md`, S4 / D4\u2013D6). Unauthenticated by design\n * \u2014 the slug is the bearer of access, and the anonymous public runtime enforces\n * availability / cap / CAPTCHA exactly as `/f/:slug`.\n *\n * SECURITY (R-RS-1) \u2014 HOST PLUMBING NOT WIRED IN THIS REPO.\n *\n * The design calls for this route to be served with a per-distribution\n * `Content-Security-Policy: frame-ancestors <allowedDomains>` header and no\n * `X-Frame-Options`, with the app's global frame protection carving `/embed/`\n * out so the dynamic header is the sole authority, resolved via\n * `GET /api/forms/public/distributions/:slug/embed-policy`\n * (\u2192 `buildFrameAncestorsCsp` in `lib/embed-frame-policy.ts`).\n *\n * Neither half exists yet. `apps/mercato/next.config.ts` applies\n * `frame-ancestors 'self'` plus `X-Frame-Options: SAMEORIGIN` to `/:path*` with\n * no `/embed/` carve-out, and `apps/mercato/src/proxy.ts` never calls the\n * embed-policy endpoint. It was absent from the module's original repository\n * too \u2014 that sandbox app declared no `headers()` at all, so `/embed/:slug` was\n * framable there by default rather than by policy.\n *\n * Consequence: cross-origin framing of this page is currently BLOCKED by the\n * app's global policy. That is the fail-closed direction, so the page is safe\n * and the embed surface is inert. Everything below the header is complete and\n * tested \u2014 availability / cap / CAPTCHA enforcement, theme application, the\n * allowlist normalizer, the `embed-policy` endpoint. Only the header is missing.\n *\n * Both halves are load-bearing: a carve-out without the dynamic header would\n * leave this page framable by anyone. A per-request response header cannot come\n * from a React Server Component, so it belongs in the proxy. Tracked in\n * `.ai/specs/2026-09-30-forms-module-into-core.md` \u00A7 Known limitations.\n */\nexport const metadata: PageMetadata = {\n requireAuth: false,\n titleKey: 'forms.runner.loading',\n title: 'Form',\n}\n\nexport default metadata\n"],
5
- "mappings": "AAmCO,MAAM,WAAyB;AAAA,EACpC,aAAa;AAAA,EACb,UAAU;AAAA,EACV,OAAO;AACT;AAEA,IAAO,oBAAQ;",
4
+ "sourcesContent": ["import type { PageMetadata } from '@open-mercato/shared/modules/registry'\n\n/**\n * External iframe host page for an embeddable OPEN distribution (spec\n * `2026-05-21-forms-render-surfaces.md`, S4 / D4\u2013D6). Unauthenticated by design\n * \u2014 the slug is the bearer of access, and the anonymous public runtime enforces\n * availability / cap / CAPTCHA exactly as `/f/:slug`.\n *\n * SECURITY (R-RS-1) \u2014 HOST PLUMBING NOT WIRED IN THIS REPO.\n *\n * The design calls for this route to be served with a per-distribution\n * `Content-Security-Policy: frame-ancestors <allowedDomains>` header and no\n * `X-Frame-Options`, with the app's global frame protection carving `/embed/`\n * out so the dynamic header is the sole authority, resolved via\n * `GET /api/forms/public/distributions/:slug/embed-policy`\n * (\u2192 `buildFrameAncestorsCsp` in `lib/embed-frame-policy.ts`).\n *\n * Neither half exists yet. `apps/mercato/next.config.ts` applies\n * `frame-ancestors 'self'` plus `X-Frame-Options: SAMEORIGIN` to `/:path*` with\n * no `/embed/` carve-out (`next dev` additionally admits loopback origins so\n * local tools can preview the app), and `apps/mercato/src/proxy.ts` never calls the\n * embed-policy endpoint. It was absent from the module's original repository\n * too \u2014 that sandbox app declared no `headers()` at all, so `/embed/:slug` was\n * framable there by default rather than by policy.\n *\n * Consequence: cross-origin framing of this page is currently BLOCKED by the\n * app's global policy. That is the fail-closed direction, so the page is safe\n * and the embed surface is inert. Everything below the header is complete and\n * tested \u2014 availability / cap / CAPTCHA enforcement, theme application, the\n * allowlist normalizer, the `embed-policy` endpoint. Only the header is missing.\n *\n * Both halves are load-bearing: a carve-out without the dynamic header would\n * leave this page framable by anyone. A per-request response header cannot come\n * from a React Server Component, so it belongs in the proxy. Tracked in\n * `.ai/specs/2026-09-30-forms-module-into-core.md` \u00A7 Known limitations.\n */\nexport const metadata: PageMetadata = {\n requireAuth: false,\n titleKey: 'forms.runner.loading',\n title: 'Form',\n}\n\nexport default metadata\n"],
5
+ "mappings": "AAoCO,MAAM,WAAyB;AAAA,EACpC,aAAa;AAAA,EACb,UAAU;AAAA,EACV,OAAO;AACT;AAEA,IAAO,oBAAQ;",
6
6
  "names": []
7
7
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@open-mercato/core",
3
- "version": "0.10.1-develop.7903.1.d8ab1c8b0d",
3
+ "version": "0.10.1-develop.7916.1.586cee8389",
4
4
  "license": "MIT",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -266,16 +266,16 @@
266
266
  "zod": "^4.6.6"
267
267
  },
268
268
  "peerDependencies": {
269
- "@open-mercato/ai-assistant": "0.10.1-develop.7903.1.d8ab1c8b0d",
270
- "@open-mercato/shared": "0.10.1-develop.7903.1.d8ab1c8b0d",
271
- "@open-mercato/ui": "0.10.1-develop.7903.1.d8ab1c8b0d",
269
+ "@open-mercato/ai-assistant": "0.10.1-develop.7916.1.586cee8389",
270
+ "@open-mercato/shared": "0.10.1-develop.7916.1.586cee8389",
271
+ "@open-mercato/ui": "0.10.1-develop.7916.1.586cee8389",
272
272
  "react": "^19.0.0",
273
273
  "react-dom": "^19.0.0"
274
274
  },
275
275
  "devDependencies": {
276
- "@open-mercato/ai-assistant": "0.10.1-develop.7903.1.d8ab1c8b0d",
277
- "@open-mercato/shared": "0.10.1-develop.7903.1.d8ab1c8b0d",
278
- "@open-mercato/ui": "0.10.1-develop.7903.1.d8ab1c8b0d",
276
+ "@open-mercato/ai-assistant": "0.10.1-develop.7916.1.586cee8389",
277
+ "@open-mercato/shared": "0.10.1-develop.7916.1.586cee8389",
278
+ "@open-mercato/ui": "0.10.1-develop.7916.1.586cee8389",
279
279
  "@testing-library/dom": "^10.4.1",
280
280
  "@testing-library/jest-dom": "^7.0.1",
281
281
  "@testing-library/react": "^16.3.3",
package/src/modules/forms/frontend/embed/[slug]/page.meta.ts CHANGED
@@ -17,7 +17,8 @@ import type { PageMetadata } from '@open-mercato/shared/modules/registry'
17
17
  *
18
18
  * Neither half exists yet. `apps/mercato/next.config.ts` applies
19
19
  * `frame-ancestors 'self'` plus `X-Frame-Options: SAMEORIGIN` to `/:path*` with
20
- * no `/embed/` carve-out, and `apps/mercato/src/proxy.ts` never calls the
20
+ * no `/embed/` carve-out (`next dev` additionally admits loopback origins so
21
+ * local tools can preview the app), and `apps/mercato/src/proxy.ts` never calls the
21
22
  * embed-policy endpoint. It was absent from the module's original repository
22
23
  * too — that sandbox app declared no `headers()` at all, so `/embed/:slug` was
23
24
  * framable there by default rather than by policy.