[Mahakisore7]

Phase

No phase doc: enterprise readiness (learners stay inside the institute's LMS).

Summary

• /embed/ask asks the published library; /embed/ask?session=<id> asks one session (unlisted too; trials never). Optional theme=light|dark.
• The only framable route: every other page keeps X-Frame-Options: DENY and frame-ancestors 'none'. /embed/* gets frame-ancestors https:, or the EMBED_FRAME_ANCESTORS list to restrict it to an institute's LMS.
• No site header or footer in the embed (SiteChrome); links open in a new tab; the page posts { type: "pravaha:height", height } so hosts can auto-size the frame.
• Studio: "Embed Ask in your LMS" (library) and "Embed" per ready session, with Copy code and Preview.
• docs/EMBED.md (snippet, Moodle/Canvas/Sites, sizing script, security, rate-limit note); SECURITY.md, README and .env.example updated. Unit tests for the snippet, including title escaping.

How to verify

1. curl -sI <preview>/embed/ask → no X-Frame-Options, CSP frame-ancestors https:; curl -sI <preview>/ → DENY and frame-ancestors 'none'.
2. Studio → Sessions → "Embed Ask in your LMS": copy the code, paste it into any HTTPS page (or an LMS): the Ask box loads without the site header.
3. Click the session title inside the embed: it opens in a new tab.
4. <preview>/embed/ask?session=not-a-uuid → "This session isn't available to ask."

Checklist

• Meets the linked phase doc's acceptance criteria (n/a: verified in a framed page on the preview)
• Tests added/updated per the phase doc (tests/unit/embed.test.ts)
• pnpm lint, pnpm typecheck, pnpm test pass
• No secrets or .env values in this diff
• Docs made inaccurate by this change are updated in this PR
• No AI attribution in commits or this description (docs/GIT_WORKFLOW.md)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pravaha	Ready	Preview	Oct 2, 2026 7:10pm UTC