DECORATION_CDN → https://chat.lotusguild.org/decorations. It used to be Nextcloud's public DAV: a new PHP session (four cookies) per image and no cache headers. The new files are static, from the versioned avatar-decorations package (matrix #35), with a one-week cache and no cookies. All 629 images are byte-identical to the Nextcloud copies. The URL is absolute, so the desktop app (img-src https:) and the fork's origin allowlist both work. The web CSP already allows 'self'.
Pins @lotusguild/element-call-embedded0.25.0-lotus.26: call tiles accept the new origin (EC #56).
LOTUS_FEATURES.md: where the files come from and how to update them.
Verified
Unit tests pass (12/12).
scripts/syncDecorations.mjs against the new host: every decoration exists. It refused to prune when the server's rate limit answered 503, as designed; that's what led to matrix #36.
Browser, local stack: the Settings → Account picker loaded 13 images, all from chat.lotusguild.org, all 200, none broken.
Merge after matrix #36 (per-client rate limits, plus a separate budget for /decorations/).
Part of LotusGuild/matrix#22.
- `DECORATION_CDN` → `https://chat.lotusguild.org/decorations`. It used to be Nextcloud's public DAV: a new PHP session (four cookies) per image and no cache headers. The new files are static, from the versioned `avatar-decorations` package (matrix #35), with a one-week cache and no cookies. All 629 images are byte-identical to the Nextcloud copies. The URL is absolute, so the desktop app (`img-src https:`) and the fork's origin allowlist both work. The web CSP already allows `'self'`.
- Pins `@lotusguild/element-call-embedded` **0.25.0-lotus.26**: call tiles accept the new origin (EC #56).
- `LOTUS_FEATURES.md`: where the files come from and how to update them.
**Verified**
- Unit tests pass (12/12).
- `scripts/syncDecorations.mjs` against the new host: every decoration exists. It refused to prune when the server's rate limit answered 503, as designed; that's what led to matrix #36.
- Browser, local stack: the Settings → Account picker loaded 13 images, all from chat.lotusguild.org, all 200, none broken.
**Merge after matrix #36** (per-client rate limits, plus a separate budget for `/decorations/`).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of LotusGuild/matrix#22.
DECORATION_CDN→https://chat.lotusguild.org/decorations. It used to be Nextcloud's public DAV: a new PHP session (four cookies) per image and no cache headers. The new files are static, from the versionedavatar-decorationspackage (matrix #35), with a one-week cache and no cookies. All 629 images are byte-identical to the Nextcloud copies. The URL is absolute, so the desktop app (img-src https:) and the fork's origin allowlist both work. The web CSP already allows'self'.@lotusguild/element-call-embedded0.25.0-lotus.26: call tiles accept the new origin (EC #56).LOTUS_FEATURES.md: where the files come from and how to update them.Verified
scripts/syncDecorations.mjsagainst the new host: every decoration exists. It refused to prune when the server's rate limit answered 503, as designed; that's what led to matrix #36.Merge after matrix #36 (per-client rate limits, plus a separate budget for
/decorations/).🤖 Generated with Claude Code
https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5