npm - roxxie-proxy-u-prod - Versions diffs - 0.1.0 → 0.2.3 - Mend

roxxie-proxy-u-prod 0.1.0 → 0.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (60) hide show

package/README.md CHANGED Viewed

@@ -1,34 +1,60 @@
 # roxxie-proxy-u-prod
-Production browser assets for Roxxie Proxy U. This release is pinned to the
-tracker at `https://100.58.76.81/`. The source workspace's development network
-document remains on `http://127.0.0.1:8788/`.
+Production browser assets for Roxxie Proxy U. Version `0.2.3` is pinned to the
+tracker at `https://100.58.76.81/` and can be embedded without hosting browser
+files on the tracker server.
-The browser code and styles in `dist/` are designed to be served by jsDelivr.
-The small files in `runtime/` must be served at `https://100.58.76.81/browser/`.
-They include the HTML shell, tracker network document, and same-origin service
-workers.
+The executable browser code, styles, WebAssembly, and filter assets in `dist/`
+are loaded from version-pinned jsDelivr URLs. The HTML shell, tracker network
+document, and service workers in `runtime/` are loaded from the same exact npm
+release on unpkg so the workers remain on the shell's origin.
-## Embed from one HTML page
+## One-file browser
-After deploying `runtime/` as described below, an external page can embed the
-browser with only this markup:
+Download `standalone.html` and open it directly, including through `file://`, or
+use the equivalent markup:
 ```html
-<div id="roxxie-browser" style="position:fixed;inset:0"></div>
+<!doctype html>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width,initial-scale=1" />
+<style>
+	html,
+	body,
+	#roxxie-browser {
+		width: 100%;
+		height: 100%;
+		margin: 0;
+	}
+</style>
+<div id="roxxie-browser"></div>
 <script
 	defer
-	src="https://cdn.jsdelivr.net/npm/roxxie-proxy-u-prod@0.1.0/embed.js"
+	src="https://cdn.jsdelivr.net/npm/roxxie-proxy-u-prod@0.2.3/embed.js"
+	integrity="sha384-yu0TlvCJ9LcKoOG66anQWT/iHEz3uC7rUGLmaDZV9otcFcWsQ6EvX8y2GPuxFsOH"
+	crossorigin="anonymous"
 	data-roxxie-target="#roxxie-browser"
 ></script>
 ```
-The loader inserts an iframe whose default URL is
-`https://100.58.76.81/browser/`. Call it manually when more control is needed:
+The embed loader creates an iframe for:
+```text
+https://unpkg.com/roxxie-proxy-u-prod@0.2.3/runtime/index.html
+```
+The runtime then obtains its network document and workers from the versioned
+unpkg runtime directory and connects to `https://100.58.76.81/` for tracker
+signaling. The tracker does not relay proxied browsing traffic.
+Call the loader manually when more control is needed:
 ```html
+<div id="roxxie-browser"></div>
 <script
-	src="https://cdn.jsdelivr.net/npm/roxxie-proxy-u-prod@0.1.0/embed.js"
+	src="https://cdn.jsdelivr.net/npm/roxxie-proxy-u-prod@0.2.3/embed.js"
+	integrity="sha384-yu0TlvCJ9LcKoOG66anQWT/iHEz3uC7rUGLmaDZV9otcFcWsQ6EvX8y2GPuxFsOH"
+	crossorigin="anonymous"
 	data-roxxie-auto="false"
 ></script>
 <script>
@@ -36,70 +62,32 @@ The loader inserts an iframe whose default URL is
 </script>
 ```
-Always pin an exact npm version. jsDelivr treats versioned assets as immutable;
-using `@latest` can combine an old shell or worker with new browser code.
-## Deploy the same-origin runtime
-Copy the contents of `runtime/` to a directory served as `/browser/` by the
-tracker's HTTPS server. The Debian installer can verify and deploy it
-atomically:
-```sh
-sudo bash deploy/debian/install.sh \
-  --public-ip 100.58.76.81 \
-  --email admin@edurocks.org \
-  --skip-app-deploy \
-  --frontend-package roxxie-proxy-u-prod@0.1.0
-```
-For a manual Caddy integration, put this handler before the tracker reverse
-proxy and point it at a complete runtime tree (the installer maintains the
-`current` symlink):
-```caddyfile
-handle_path /browser/* {
-    root * /srv/roxxie-browser-runtime/current
-    @document path / /index.html
-    header @document Cache-Control "no-cache, must-revalidate"
-    @network path /roxxie-network.json
-    header @network Cache-Control "no-store"
-    @workers path /sw.js /localcontrollersw.js /controller.sw.js
-    header @workers Cache-Control "no-cache, must-revalidate"
-    file_server
-}
-```
-Serve `index.html` as `text/html`, the three worker files as JavaScript, and
-`roxxie-network.json` as JSON. Do not rewrite a missing worker or network file
-to the shell.
+Use `file://`, loopback HTTP, or HTTPS for the outer page. A non-loopback
+plaintext HTTP ancestor is not a secure context and prevents the iframe from
+using its service worker. A restrictive Content Security Policy must allow the
+pinned jsDelivr script and `frame-src https://unpkg.com`.
-## Why a same-origin shell is required
+## Why the release uses two CDNs
-jsDelivr intentionally serves npm `.html` files as `text/plain`, so a browser
-cannot execute the application directly from a jsDelivr HTML URL. Separately,
-the Web platform forbids a CDN-loaded script from registering a service worker
-for the embedding page's origin. Roxxie's rewritten tab navigation requires
-that worker.
+jsDelivr serves npm HTML files as plain text, so it cannot host the executable
+shell. unpkg serves `runtime/index.html` as HTML and the worker files as
+JavaScript from one versioned origin, allowing the shell to register its
+same-origin service worker. The larger executable assets remain pinned to
+jsDelivr.
-For those reasons, a genuinely CDN-only arbitrary-page embed is not possible
-with this browser architecture. The supported design keeps the executable code
-on jsDelivr while the tracker origin serves the minimal shell, configuration,
-and worker boundary. The one-file host-page example remains valid because it
-iframes that same-origin runtime.
+Every URL includes the exact npm version. Do not replace it with `@latest`:
+combining one release's shell or worker with another release's browser code can
+break routing and cache compatibility.
 ## Release maintenance
-In the complete Roxxie Proxy U source workspace, maintainers build the release
-with:
+In the complete Roxxie Proxy U source workspace, maintainers build and test the
+release with:
 ```sh
 pnpm --filter roxxie-proxy-u-prod build
 pnpm --filter roxxie-proxy-u-prod verify
+pnpm --filter roxxie-proxy-u-prod smoke
 pnpm --filter roxxie-proxy-u-prod pack
 ```
@@ -113,11 +101,11 @@ npm run build
 npm run verify
 ```
-The build fixes the CDN base to this package's exact version, fixes the runtime
-base to `/browser/`, disables source maps, generates the production network
+The build fixes the jsDelivr asset base and unpkg runtime base to this exact
+package version, disables source maps, generates the production tracker network
 document, and copies the repository's AGPL license into the package. The
-tarball also carries a modified-source snapshot, third-party notices, the exact
-filter-list inputs and hashes, and their retained license texts; see
-`SOURCE.md` and `THIRD_PARTY_NOTICES.md`.
+tarball also carries the modified-source snapshot, third-party notices, exact
+filter-list inputs and hashes, and retained license texts; see `SOURCE.md` and
+`THIRD_PARTY_NOTICES.md`.
 Licensed under AGPL-3.0-only.