{
  "package": "@jrole/web-core",
  "version": "0.1.0-pilot",
  "environment": "dev",
  "asset_origin": "https://web-assets.element-sandbox.netcomposite.net",
  "bridge_url": "https://web-api.element-sandbox.netcomposite.net/web/v1",
  "files": {
    "jrole-web-core.mjs": {
      "path": "/v0.1.0-pilot/jrole-web-core.mjs",
      "latest_path": "/latest/jrole-web-core.mjs",
      "integrity": "sha384-n3PXQpoxhwpmzEhMxdR8dWp4iy1VCrtaPQujFsk5Vm+QcIAd245dU9b090dwibTu",
      "bytes": 15019,
      "sha256": "0c1bcdd547ec5702dd31317b9299b19dadf76a4ccbad0e6d0c47cbec8d9ace7a"
    },
    "jrole-interaction-agent.mjs": {
      "path": "/v0.1.0-pilot/jrole-interaction-agent.mjs",
      "latest_path": "/latest/jrole-interaction-agent.mjs",
      "integrity": "sha384-egpdK+kAL8h8cwUcaZP+9mULSktNcRTkTrnUR9/o32SXZuh9BgHVucbkp1+EpcP5",
      "bytes": 3750,
      "sha256": "7822813a4e7d71b09ecd629046feaa0e58bf05e030fbd0946c894c12be8cd732"
    }
  },
  "delivery_modes": {
    "hosted": {
      "description": "Assets are served by the Jrole Node's asset surface. One version for every site, integrity guaranteed by the origin, install is a single HTML insert.",
      "asset_origin": "https://web-assets.element-sandbox.netcomposite.net",
      "note": "The asset surface is NOT the Web Bridge. The bridge answers protocol only and serves no documents or scripts."
    },
    "cdn": {
      "description": "The integrator copies the versioned files to their own CDN for lower load latency on high-traffic public sites.",
      "requirement": "Keep the integrity attribute. With SRI the CDN cannot alter the bytes without the browser refusing them, so the CDN needs no trust.",
      "unchanged": "Message exchange still goes only to the Web Bridge of this Node."
    }
  },
  "install": {
    "hosted": "<script type=\"module\">\n  import { createJroleWebClient } from \"https://web-assets.element-sandbox.netcomposite.net/v0.1.0-pilot/jrole-web-core.mjs\";\n  const chat = createJroleWebClient({\n    endpoint: \"https://web-api.element-sandbox.netcomposite.net/web/v1\",\n    endpointId: \"<your endpoint id>\",\n    siteId: \"<your site id>\",\n    publishableKey: \"<your publishable key>\",\n  });\n  await chat.bootstrap(); await chat.connect();\n  await chat.startDialog({ mode: \"auto\", routing: \"explicit\" });\n</script>",
    "hosted_preload_with_integrity": "<link rel=\"modulepreload\" href=\"https://web-assets.element-sandbox.netcomposite.net/v0.1.0-pilot/jrole-web-core.mjs\"\n      integrity=\"sha384-n3PXQpoxhwpmzEhMxdR8dWp4iy1VCrtaPQujFsk5Vm+QcIAd245dU9b090dwibTu\" crossorigin=\"anonymous\">",
    "cdn": "<link rel=\"modulepreload\" href=\"https://<your-cdn>/jrole/v0.1.0-pilot/jrole-web-core.mjs\"\n      integrity=\"sha384-n3PXQpoxhwpmzEhMxdR8dWp4iy1VCrtaPQujFsk5Vm+QcIAd245dU9b090dwibTu\" crossorigin=\"anonymous\">\n<!-- same integrity value as Hosted Mode: the hash pins the bytes, not the host -->"
  },
  "rules": [
    "Whatever serves the script, every message goes only to the Web Bridge of this Node.",
    "The origin policy checks the PAGE origin, not where the script was downloaded from. Serving from a CDN does not require registering the CDN origin.",
    "Versioned paths are immutable; /latest is a convenience and is not integrity-pinned.",
    "The publishable key stays publishable in both modes; there is no secret to protect here."
  ]
}