@sparkletree/core 0.11.0 → 0.11.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/publishableKey.d.ts +1 -1
  2. package/dist/publishableKey.js +1 -1
  3. package/dist/safeUrl.d.ts +6 -0
  4. package/dist/safeUrl.d.ts.map +1 -1
  5. package/dist/safeUrl.js +8 -0
  6. package/dist/safeUrl.js.map +1 -1
  7. package/package.json +1 -1
package/dist/publishableKey.d.ts CHANGED
@@ -20,7 +20,7 @@
20
20
  * Because the client cannot verify the signature, an apiBase that arrives VIA
21
21
  * a key is still an unproven host client-side. Content fetches may follow it,
22
22
  * but the mint token — a spend credential — may not: the mint POST fires only
23
- * for an explicit, first-party (*.sparkletree.io), or loopback apiBase
23
+ * for an explicit, first-party (*.sparkletree.io, *.qrtree.ai), or loopback apiBase
24
24
  * (security review S-2; see isFirstPartyApiBase/maybeMint).
25
25
  */
26
26
  export interface PublishableKeyPayload {
package/dist/publishableKey.js CHANGED
@@ -20,7 +20,7 @@
20
20
  * Because the client cannot verify the signature, an apiBase that arrives VIA
21
21
  * a key is still an unproven host client-side. Content fetches may follow it,
22
22
  * but the mint token — a spend credential — may not: the mint POST fires only
23
- * for an explicit, first-party (*.sparkletree.io), or loopback apiBase
23
+ * for an explicit, first-party (*.sparkletree.io, *.qrtree.ai), or loopback apiBase
24
24
  * (security review S-2; see isFirstPartyApiBase/maybeMint).
25
25
  */
26
26
  const KEY_PATTERN = /^st_pk_(live|test)_([A-Za-z0-9_-]+)$/;
package/dist/safeUrl.d.ts CHANGED
@@ -41,6 +41,12 @@ export declare function isSecureApiBase(apiBase: string): boolean;
41
41
  /**
42
42
  * Is this apiBase first-party — the hosted SparkleTree edge, or loopback?
43
43
  *
44
+ * "First-party" is the fixed set of hosts SparkleTree itself operates:
45
+ * sparkletree.io (the platform and the campaigns edge alias) and qrtree.ai
46
+ * (the public edge origin the dashboard writes into every publishable key,
47
+ * `p.qrtree.ai`). A key minted by the dashboard therefore mints as-is; a
48
+ * hand-encoded key pointing anywhere else still gets content and no token.
49
+ *
44
50
  * The publishable key is an unsigned address ANYONE can hand-encode (see
45
51
  * publishableKey.ts), so an apiBase that arrived via a key proves nothing
46
52
  * about who chose it. The one value that must never follow an unproven
package/dist/safeUrl.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"safeUrl.d.ts","sourceRoot":"","sources":["../src/safeUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmBH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAyBhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASxD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAY5D"}
1
+ {"version":3,"file":"safeUrl.d.ts","sourceRoot":"","sources":["../src/safeUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmBH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAyBhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASxD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc5D"}
package/dist/safeUrl.js CHANGED
@@ -91,6 +91,12 @@ export function isSecureApiBase(apiBase) {
91
91
  /**
92
92
  * Is this apiBase first-party — the hosted SparkleTree edge, or loopback?
93
93
  *
94
+ * "First-party" is the fixed set of hosts SparkleTree itself operates:
95
+ * sparkletree.io (the platform and the campaigns edge alias) and qrtree.ai
96
+ * (the public edge origin the dashboard writes into every publishable key,
97
+ * `p.qrtree.ai`). A key minted by the dashboard therefore mints as-is; a
98
+ * hand-encoded key pointing anywhere else still gets content and no token.
99
+ *
94
100
  * The publishable key is an unsigned address ANYONE can hand-encode (see
95
101
  * publishableKey.ts), so an apiBase that arrived via a key proves nothing
96
102
  * about who chose it. The one value that must never follow an unproven
@@ -107,6 +113,8 @@ export function isFirstPartyApiBase(apiBase) {
107
113
  const { hostname } = new URL(apiBase);
108
114
  return (hostname === "sparkletree.io" ||
109
115
  hostname.endsWith(".sparkletree.io") ||
116
+ hostname === "qrtree.ai" ||
117
+ hostname.endsWith(".qrtree.ai") ||
110
118
  hostname === "localhost" ||
111
119
  hostname === "127.0.0.1");
112
120
  }
package/dist/safeUrl.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"safeUrl.js","sourceRoot":"","sources":["../src/safeUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,6EAA6E;AAC7E,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,GAA8B;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC;QACrD,OAAO,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,CACL,QAAQ,KAAK,gBAAgB;YAC7B,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"safeUrl.js","sourceRoot":"","sources":["../src/safeUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,6EAA6E;AAC7E,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,GAA8B;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC;QACrD,OAAO,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,CACL,QAAQ,KAAK,gBAAgB;YAC7B,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,QAAQ,KAAK,WAAW;YACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sparkletree/core",
3
- "version": "0.11.0",
3
+ "version": "0.11.1",
4
4
  "description": "Framework-agnostic core for the SparkleTree SDK: wire protocol, copy choreography, theme, analytics, audio.",
5
5
  "license": "MIT",
6
6
  "type": "module",