Skip to main content

​
Verification runbook

Use this after deploy or when onboarding a new partner origin.

​
DNS

  1. Confirm Cloudflare record is DNS only (grey cloud).
  2. Fetch embed HTML and verify response headers do not include cf-ray or server: cloudflare.

​
CSP

  1. Load https://embed.withheadlight.com/chart/v<version>/index.html.
  2. Assert Content-Security-Policy matches the published policy for chart surfaces.
  3. Confirm frame-ancestors lists only approved partner origins.

​
Artifact integrity

  1. Fetch https://embed.withheadlight.com/versions.json.
  2. Compare assetDigests to files served under the pinned version prefix.

​
Mint route

  1. Mint with allowed frameOrigin → 200.
  2. Mint with disallowed origin → 400.
  3. Mint without embed:chart permission → 403.

​
Framing

  1. Load partner page that embeds the chart.
  2. Confirm iframe receives ready, posts render, and receives rendered.
  3. Click a node and confirm nodeClick returns partner-scoped IDs.

​
Bundle absence

Run bun run embed:build then the embed bundle cleanliness test. The artifact must not contain Sentry, PostHog, Prisma client code, report-uri, Google Fonts links, or dangerouslySetInnerHTML.