Development Log

Version History

A complete record of platform updates, new features, and fixes for the Parametric Insurance Simulator — Climate Risk Edition.

Maintained by Web3 Certification Board Inc. (W3CB)·Current version: v2.4.0·11 releases
Added Changed Fixed
Added
Embed mode
Add ?embed=true to any URL. The simulator removes its navigation header, site footer, disclaimer modal, and cookie consent banner — leaving only the simulation interface. A small "Powered by W3CB" attribution strip replaces the full footer. Works on any page: the home screen, individual scenarios, education centre, or methodology page.
Scenario deep linking
Two equivalent patterns: /?embed=true&scenario={id} auto-redirects to /scenario/{id}?embed=true via a client-side handler, or use the long-form URL directly. All 9 scenarios supported. Intended use: LMS course modules embed a specific scenario matching the lesson context without requiring learners to navigate from the home screen.
PostMessage completion events
When a learner clicks Finish at the end of the debrief review in embed mode, the simulator fires window.parent.postMessage with type "w3cb_scenario_complete". Payload includes: scenarioId, scenarioName, triggered (boolean), payoutAmount (USD), riskScore (0–1), coverageTier, and timestamp (ISO 8601). Platforms can use this to record completion, update a gradebook, or surface a custom overlay — without any server-side API dependency.
Embed integration guide
New developer documentation page at /embed. Covers: basic iframe code, responsive wrappers, all supported URL parameters, the full PostMessage listener with annotated payload spec, CSP domain allowlist configuration (for institutional IT teams), nginx config example, and live test URLs for all 9 scenarios.
Frame-ancestors CSP header
Content-Security-Policy: frame-ancestors * is emitted by the Express API server (production) and Vite dev server (development). Allows the simulator to be framed by any origin — a prerequisite for institutional embedding without requiring IT exceptions on every platform. The invalid X-Frame-Options: ALLOWALL header was removed (browsers ignore it; CSP is the correct mechanism).
Changed
Compact scenario header in embed mode
When ?embed=true is active, the back button is hidden (navigating to "/" inside an iframe is disorienting) and the header is centred. Scenario icon, name, region, and complexity badges remain visible to give learners clear context.
Fixed
Embed state persists across internal navigation
useEmbedMode now stores an embed flag in sessionStorage (w3cb_embed_active) the first time ?embed=true is seen, so header/footer/modals stay suppressed even if a learner clicks an internal link that drops the query parameter.
Deep-link handler is now reactive
EmbedDeepLinkHandler's effect dependencies were corrected so /?scenario=xxx redirects work on any URL change, not just the initial mount.
Completion modal suppressed in embed mode
The in-app "Scenario Complete" modal no longer renders inside an iframe. The w3cb_scenario_complete postMessage is the single completion signal — letting host LMS platforms drive their own post-completion UI without conflict.
Production framing headers moved to Express
Content-Security-Policy: frame-ancestors * is now set by Express middleware so it applies to production deployments, not just the Vite dev server. The invalid X-Frame-Options: ALLOWALL value was removed.
Embed docs security & accuracy corrections
PostMessage listener example now requires origin validation (prevents spoofed completion events). CSP guidance clearly distinguishes frame-ancestors (set by us) from frame-src (set by the host). Added a third-party iframe storage-partitioning caveat for Safari ITP / Chrome. SEOHead now implements noIndex, keeping /embed out of search results.
Commits: adbc87d