v1.5.0 — embed mode + theming + channel admin (RBAC)

[1.5.0] — 2026-05-17

Added — embed mode, theming, channel admin + RBAC

• Embed mode (?embed=1 URL param or postMessage('piperchat:embed')).
  Hides sidebar, header chrome, and identity pill so the chat fits inside
  any host page's UI.
• Host postMessage bus for runtime control:
  • piperchat:set-identity — host injects ed25519 + x25519 keys + channel
  • piperchat:set-theme — patch CSS variables at runtime (CSS-var
    whitelist rejects ;, url(), expression())
  • piperchat:set-channel — switch active channel without remount
  • piperchat:embed — enable embed mode at runtime
• Iframe → host events:
  • piperchat:boot — bootstrap script parsed
  • piperchat:ready — DOM ready, accepting commands
  • piperchat:message-received — metadata only (from, channel, ts,
    message_id, in_reply_to); ciphertext never leaves the iframe
• Theming via URL params: ?theme=light|dark presets plus
  ?accent=…&bg=…&surface=…&text=…&radius=…&font=….
• Channel ownership + membership + audit (RBAC) — opt-in:
  • POST /channels/:name/claim — first-write-wins ownership
    (ed25519-signed, ±300s replay window)
  • POST /channels/:name/members — add member (owner/admin)
  • DELETE /channels/:name/members/:dot1 — remove (owner/admin; owner
    is protected)
  • PATCH /channels/:name/members/:dot1 — change role (owner only)
  • GET /channels/:name/admin — public read of owner + roster + audit
  • GET /channels/mine?dot1=… — channels this identity belongs to
• Membership enforcement on /messages POST: unclaimed channels stay
  open; once a channel is claimed only members may post and v1.0 legacy
  unsigned envelopes are rejected outright.
• /admin panel UI at public/admin.html — ed25519 unlock, claim,
  manage roster + roles, audit log.
• Three new examples:
  • examples/embed-iframe/ — vanilla HTML drop-in with live theme picker
  • examples/embed-react/ — <PiperChat /> React component
  • examples/crm-support-panel/ — per-customer encrypted support flow

Schema

Three new tables, all idempotent on existing databases:

• channel_owners (channel, owner_dot1, owner_name, claimed_at, description, branding_json)
• channel_members (channel, dot1, username, role, added_by, added_at)
• channel_audit (id, channel, event_type, actor_dot1, target_dot1, details, ts)

Backwards compatibility

Fully backwards-compatible with v1.0–v1.4 clients on unclaimed channels.
Claimed channels reject v1.0 (no provable identity) and require v1.1+
from_dot1. The protocol layer (sealed bodies, signatures) is unchanged
— this is product-layer RBAC enforced at the relay.

Tests

Smoke-tested end-to-end: claim → add → list → enforce → remove →
owner-protection → duplicate-claim 409 → bad-sig 400 → ts-skew 400 →
unclaimed-channel still open. All paths clean.

---