Skip to content

Editor Security and Packaging

Production mode

The editor build defines hard offline and embedded-editor modes before importing the upstream editor.

  • No SyncSession is constructed, so BroadcastChannel and online collaboration transports do not start.
  • Upstream file/share/update actions are not exposed by the production shell.
  • Host-managed mode does not initialize IndexedDB recovery/version history, does not run the upstream update check, and blocks the upstream local-file save shortcut.
  • Ctrl+S is captured by the Anuva shell and emits the same validated host save request as the visible Save to host action.
  • Persistence flows only through validated host messages.
  • Host-requested manual and autosave use the same validated save path as the visible Save action and Ctrl+S.
  • Focus accepts stable surface/slide identity only and navigates through the upstream Store API.
  • The bridge requires exact origin and parent source.
  • Contract, family, operation, asset, and revision validation run before mutation.
  • No executable operation or unrestricted mutation primitive exists.

The upstream renderer/editor foundation remains in the bundle, but its public update and collaboration behavior is disabled. Network verification covers the real host/editor artifact and fails on any non-host-origin resource request.

Artifact

npm run package:editor builds working/anu-18/anuva-bento-editor-1.1.0/ with:

  • static production editor HTML, CSS, JavaScript, and local example assets;
  • presentation and editor JSON schemas;
  • the validated local anuva-template-catalog.json;
  • LICENSE and THIRD_PARTY_NOTICES.md; and
  • a deterministic manifest containing exact editor, renderer, contract, protocol, family-schema, catalog, and Bento versions plus file SHA-256 digests.

The packager rejects unresolved production flags, eval(, and new Function(. Editor and player manifests carry the same renderer version. This artifact is a local handoff; ANU-18 does not publish or deploy it. The catalog is static local data and does not relax the hard-offline or same-origin resource allowlist.