@ai-ecoverse/slicc-vault 1.16.2 → 1.16.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/package.json +6 -6
package/README.md
CHANGED
|
@@ -26,7 +26,7 @@ To stay out of the back/forward cache, `index.html` and `button.html` add an `un
|
|
|
26
26
|
|
|
27
27
|
`GET /embedders.json` is answered by the Worker, not by this tree. It returns `{ "embedders": [...] }`, the same sources as `frame-ancestors`. The vault reads it at start and accepts only those origins. When it's missing or malformed, only `vault.sliccy.ai` falls back to `config.json`; on every other host (`vault-preview.sliccy.ai`, branch previews, local) that means no embedders, so it fails closed. An embedder source is `http(s)://host`, optionally with `:port` or `:*`, matched exactly.
|
|
28
28
|
|
|
29
|
-
`main` is served at `vault.sliccy.ai`, and every other branch at `vault-<label>.sliccy.ai`. CI is one caller workflow, `ci.yml`, that runs slicc-shared-web's `pipeline.yml` at the same v2 tag as the `@ai-ecoverse/slicc-shared-web` devDependency, with `secrets: inherit`, on pull requests, on the merge queue (`merge_group`) and on `main`: lint everywhere; on pull requests and in the merge queue the integration tests (`test/integration/*.test.mjs`, split by timings across the pipeline's shards, Chrome for Testing from `slicc-cdp install-browser`, headed on Xvfb); on pull requests a Claude and a Codex review; on `main` semantic-release, with no tests. `ci / integration` and `ci / review` are the checks to require. The pipeline picks its own runners (its self-hosted pool, a hosted runner for a fork's pull request and for the release), and a pull request from a fork gets no review. Releases run only on `main`: the pipeline's release job runs only on a push to it, in the `production` environment, and publishes `vault.sliccy.ai` there.
|
|
29
|
+
`main` is served at `vault.sliccy.ai`, and every other branch at `vault-<label>.sliccy.ai`. CI is one caller workflow, `ci.yml`, that runs slicc-shared-web's `pipeline.yml` at the same v2 tag as the `@ai-ecoverse/slicc-shared-web` devDependency, with `secrets: inherit`, on pull requests, on the merge queue (`merge_group`) and on `main`: lint everywhere; on pull requests and in the merge queue the integration tests (`test/integration/*.test.mjs`, split by timings across the pipeline's shards, Chrome for Testing from `slicc-cdp install-browser`, headed on Xvfb); on pull requests a Claude and a Codex review; on `main` semantic-release, with no tests. `ci / integration` and `ci / review` are the checks to require. The pipeline picks its own runners (its self-hosted pool, a hosted runner for a fork's pull request and for the release), and a pull request from a fork gets no review. Releases run only on `main`: the pipeline's release job runs only on a push to it, in the `production` environment, and publishes `vault.sliccy.ai` there. On a pull request the pipeline's `deploy` job publishes the branch preview in the `staging` environment and hands its URL to the tests and reviewers as `STAGING_URL`; it publishes nothing to npm and makes no tag or release, and the merge queue deploys nothing. `ci.yml` is the only workflow, so nothing deploys outside the pipeline. No workflow names a self-hosted runner label. `workflows.test.mjs` keeps all of this so. seven embeds only `vault.sliccy.ai`.
|
|
30
30
|
|
|
31
31
|
## Storage and keys
|
|
32
32
|
|
|
@@ -514,4 +514,4 @@ npm start # vault on http://vault.sliccy.localhost:8790, a test embedde
|
|
|
514
514
|
## Release and deploy
|
|
515
515
|
|
|
516
516
|
- **Releases:** semantic-release on `main` (the pipeline's release job) tags a version from the conventional commits and publishes the types package to npm with trusted publishing, which names `ci.yml` (`fledgling.workflow`; `npm run trust` registers it).
|
|
517
|
-
- **Deploy:** when semantic-release tags a new version, the pipeline's `after-release` command (in `ci.yml`) builds with that version and publishes `dist/site/` to `vault.sliccy.ai` from the `production` environment; a push to `main` that releases nothing deploys nothing. The packages of ours that the site bundles (`@ai-ecoverse/slicc-scrub` and `@ai-ecoverse/jerk-oauth`) are `dependencies`, which Renovate's `config:recommended` commits as `fix(deps)`, so each bump releases and deploys; every other bump is `chore(deps)` and waits for the next release. `dependencies.test.mjs` keeps the `dependencies` to exactly the packages of ours that `src/` imports. Every
|
|
517
|
+
- **Deploy:** when semantic-release tags a new version, the pipeline's `after-release` command (in `ci.yml`) builds with that version and publishes `dist/site/` to `vault.sliccy.ai` from the `production` environment; a push to `main` that releases nothing deploys nothing. The packages of ours that the site bundles (`@ai-ecoverse/slicc-scrub` and `@ai-ecoverse/jerk-oauth`) are `dependencies`, which Renovate's `config:recommended` commits as `fix(deps)`, so each bump releases and deploys; every other bump is `chore(deps)` and waits for the next release. `dependencies.test.mjs` keeps the `dependencies` to exactly the packages of ours that `src/` imports. Every pull request publishes its branch to `vault-<label>.sliccy.ai` through the pipeline's `deploy` input (in `ci.yml`), in the `staging` environment: it builds with `VAULT_VERSION=0.0.0-$GITHUB_SHA` and writes the published URL to `$GITHUB_OUTPUT` as `url`, so the tests and reviewers get it as `STAGING_URL`. The publish route takes the label from the pull request token's `head_ref`, the branch. A branch without a pull request publishes nothing. The preview needs no secret, so `deploy-secrets` is unset, which since slicc-shared-web v2.11.2 hands the `deploy` command no secret at all. Both use GitHub's OIDC token against sliccy-ai's `/api/publish` route (`edge/publish.mjs`), with no stored secret. `edge/publish.mjs` ends with the verdict line `publish: PASS <url> <sha>`, and both publishes fail without it, so a script that exits without publishing can't read as a pass. It runs as the main module also through a symlinked checkout or workspace: both sides of that check are real paths. A `manifest` answer without an `https://` URL fails the publish.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/slicc-vault",
|
|
3
|
-
"version": "1.16.
|
|
3
|
+
"version": "1.16.4",
|
|
4
4
|
"description": "The separate-origin vault at vault.sliccy.ai: sealed secrets, OAuth tokens, and model and MCP credentials for SLICC seven, used only by its injector",
|
|
5
5
|
"piAi": "1.4.0",
|
|
6
6
|
"type": "module",
|
|
@@ -47,13 +47,13 @@
|
|
|
47
47
|
"release": "semantic-release"
|
|
48
48
|
},
|
|
49
49
|
"dependencies": {
|
|
50
|
-
"@ai-ecoverse/jerk-oauth": "1.
|
|
51
|
-
"@ai-ecoverse/slicc-scrub": "1.0
|
|
50
|
+
"@ai-ecoverse/jerk-oauth": "1.3.0",
|
|
51
|
+
"@ai-ecoverse/slicc-scrub": "1.1.0"
|
|
52
52
|
},
|
|
53
53
|
"devDependencies": {
|
|
54
|
-
"@ai-ecoverse/slicc-cdp": "1.
|
|
55
|
-
"@ai-ecoverse/slicc-kernel": "1.
|
|
56
|
-
"@ai-ecoverse/slicc-shared-web": "2.11.
|
|
54
|
+
"@ai-ecoverse/slicc-cdp": "1.39.1",
|
|
55
|
+
"@ai-ecoverse/slicc-kernel": "1.154.1",
|
|
56
|
+
"@ai-ecoverse/slicc-shared-web": "2.11.3",
|
|
57
57
|
"@ai-ecoverse/wasm-bash": "5.3.0-23",
|
|
58
58
|
"@ai-ecoverse/wasm-coreutils": "9.12.0-15",
|
|
59
59
|
"@biomejs/biome": "2.5.15",
|