Embed Suite

A share link stores only a hash of its token, so the working link is returned once at creation and cannot be reconstructed from the database, and revocation is a first-class state with its own timestamp and actor. Each link carries its own policy — password, domain allow and block lists, a login or verified-email requirement, a maximum number of uses and an expiry — enforced by one validator on every request before the use is counted and logged. What an embed may read is projected on the server, so hidden sections are never serialised and previews strip owner and tenant columns rather than hiding them in the client. Only the embed routes may be framed at all, and only by named origins.