@ai-ecoverse/slicc-vault 1.15.2 → 1.15.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -1
- package/package.json +7 -7
package/README.md
CHANGED
|
@@ -20,7 +20,9 @@ The build (`npm run build`) writes a flat static tree to `dist/site/`:
|
|
|
20
20
|
The bundles hold this repo's code, `@ai-ecoverse/slicc-scrub`, and `@ai-ecoverse/jerk-oauth` (exact-pinned, for token refresh): its wasm is inlined into a separate chunk under `chunks/` (about 970 KB) that loads only on the first refresh or MCP `grant`, never fetched. The only third-party code is for KeePass imports: `kdbxweb` (with `@xmldom/xmldom` and `fflate`) and `hash-wasm`'s argon2, exact-pinned and bundled into a separate chunk under `chunks/` that the core frame loads only when a KeePass import starts; its wasm is inlined, never fetched. The sliccy-ai Worker serves the tree from the network on every load, never from OPFS, with:
|
|
21
21
|
- `Content-Security-Policy` with `script-src 'self'`, no inline scripts or styles, and `frame-ancestors` listing the seven origins;
|
|
22
22
|
- `Cross-Origin-Embedder-Policy: require-corp`, `Cross-Origin-Resource-Policy: same-site`, `Cross-Origin-Opener-Policy: same-origin`;
|
|
23
|
-
- `Origin-Agent-Cluster: ?1`, `nosniff`, `Referrer-Policy: no-referrer`, `no-cache` with an ETag.
|
|
23
|
+
- `Origin-Agent-Cluster: ?1`, `nosniff`, `Referrer-Policy: no-referrer`, `no-cache` with an ETag, and `no-store` on the HTML documents.
|
|
24
|
+
|
|
25
|
+
To stay out of the back/forward cache, `index.html` and `button.html` add an `unload` listener, which keeps an embedder's page out of it too, and all three documents reload on a `pageshow` with `persisted`; `bfcache.test.mjs` proves `index.html` is never restored.
|
|
24
26
|
|
|
25
27
|
`GET /embedders.json` is answered by the Worker, not by this tree. It returns `{ "embedders": [...] }`, the same sources as `frame-ancestors`. The vault reads it at start and accepts only those origins. When it's missing or malformed, only `vault.sliccy.ai` falls back to `config.json`; on every other host (`vault-preview.sliccy.ai`, branch previews, local) that means no embedders, so it fails closed. An embedder source is `http(s)://host`, optionally with `:port` or `:*`, matched exactly.
|
|
26
28
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/slicc-vault",
|
|
3
|
-
"version": "1.15.
|
|
3
|
+
"version": "1.15.4",
|
|
4
4
|
"description": "The separate-origin vault at vault.sliccy.ai: sealed secrets, OAuth tokens, and model and MCP credentials for SLICC seven, used only by its injector",
|
|
5
5
|
"piAi": "1.3.0",
|
|
6
6
|
"type": "module",
|
|
@@ -47,15 +47,15 @@
|
|
|
47
47
|
"release": "semantic-release"
|
|
48
48
|
},
|
|
49
49
|
"dependencies": {
|
|
50
|
-
"@ai-ecoverse/jerk-oauth": "1.2.
|
|
50
|
+
"@ai-ecoverse/jerk-oauth": "1.2.2",
|
|
51
51
|
"@ai-ecoverse/slicc-scrub": "1.0.0"
|
|
52
52
|
},
|
|
53
53
|
"devDependencies": {
|
|
54
|
-
"@ai-ecoverse/slicc-cdp": "1.30.
|
|
55
|
-
"@ai-ecoverse/slicc-kernel": "1.
|
|
56
|
-
"@ai-ecoverse/slicc-shared-web": "2.
|
|
57
|
-
"@ai-ecoverse/wasm-bash": "5.3.0-
|
|
58
|
-
"@ai-ecoverse/wasm-coreutils": "9.12.0-
|
|
54
|
+
"@ai-ecoverse/slicc-cdp": "1.30.24",
|
|
55
|
+
"@ai-ecoverse/slicc-kernel": "1.143.5",
|
|
56
|
+
"@ai-ecoverse/slicc-shared-web": "2.7.6",
|
|
57
|
+
"@ai-ecoverse/wasm-bash": "5.3.0-23",
|
|
58
|
+
"@ai-ecoverse/wasm-coreutils": "9.12.0-13",
|
|
59
59
|
"@biomejs/biome": "2.5.15",
|
|
60
60
|
"@earendil-works/pi-ai": "1.3.0",
|
|
61
61
|
"@happy-dom/global-registrator": "20.14.6",
|