@ai-ecoverse/slicc-vault 1.16.4 → 1.17.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -0
- package/package.json +9 -9
package/README.md
CHANGED
|
@@ -24,6 +24,8 @@ The bundles hold this repo's code, `@ai-ecoverse/slicc-scrub`, and `@ai-ecoverse
|
|
|
24
24
|
|
|
25
25
|
To stay out of the back/forward cache, `index.html` and `button.html` add an `unload` listener, which keeps an embedder's page out of it too, and all three documents reload on a `pageshow` with `persisted`; `bfcache.test.mjs` proves `index.html` is never restored.
|
|
26
26
|
|
|
27
|
+
At start, a vault document that is the top-level document (`popup.html`, or `index.html` or `button.html` opened as a tab) calls `navigator.mediaDevices.setCaptureHandleConfig({ handle: 'slicc-vault', exposeOrigin: true, permittedOrigins })`, with `permittedOrigins` the embedders the document loaded that are valid exact origins, serialized (a `:*` source or an invalid one is left out; none means an empty list, never `'*'`), so seven sees the handle and refuses to capture a vault tab. A framed document, or a browser without the API, sets none.
|
|
28
|
+
|
|
27
29
|
`GET /embedders.json` is answered by the Worker, not by this tree. It returns `{ "embedders": [...] }`, the same sources as `frame-ancestors`. The vault reads it at start and accepts only those origins. When it's missing or malformed, only `vault.sliccy.ai` falls back to `config.json`; on every other host (`vault-preview.sliccy.ai`, branch previews, local) that means no embedders, so it fails closed. An embedder source is `http(s)://host`, optionally with `:port` or `:*`, matched exactly.
|
|
28
30
|
|
|
29
31
|
`main` is served at `vault.sliccy.ai`, and every other branch at `vault-<label>.sliccy.ai`. CI is one caller workflow, `ci.yml`, that runs slicc-shared-web's `pipeline.yml` at the same v2 tag as the `@ai-ecoverse/slicc-shared-web` devDependency, with `secrets: inherit`, on pull requests, on the merge queue (`merge_group`) and on `main`: lint everywhere; on pull requests and in the merge queue the integration tests (`test/integration/*.test.mjs`, split by timings across the pipeline's shards, Chrome for Testing from `slicc-cdp install-browser`, headed on Xvfb); on pull requests a Claude and a Codex review; on `main` semantic-release, with no tests. `ci / integration` and `ci / review` are the checks to require. The pipeline picks its own runners (its self-hosted pool, a hosted runner for a fork's pull request and for the release), and a pull request from a fork gets no review. Releases run only on `main`: the pipeline's release job runs only on a push to it, in the `production` environment, and publishes `vault.sliccy.ai` there. On a pull request the pipeline's `deploy` job publishes the branch preview in the `staging` environment and hands its URL to the tests and reviewers as `STAGING_URL`; it publishes nothing to npm and makes no tag or release, and the merge queue deploys nothing. `ci.yml` is the only workflow, so nothing deploys outside the pipeline. No workflow names a self-hosted runner label. `workflows.test.mjs` keeps all of this so. seven embeds only `vault.sliccy.ai`.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/slicc-vault",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.17.1",
|
|
4
4
|
"description": "The separate-origin vault at vault.sliccy.ai: sealed secrets, OAuth tokens, and model and MCP credentials for SLICC seven, used only by its injector",
|
|
5
5
|
"piAi": "1.4.0",
|
|
6
6
|
"type": "module",
|
|
@@ -47,24 +47,24 @@
|
|
|
47
47
|
"release": "semantic-release"
|
|
48
48
|
},
|
|
49
49
|
"dependencies": {
|
|
50
|
-
"@ai-ecoverse/jerk-oauth": "1.3.
|
|
50
|
+
"@ai-ecoverse/jerk-oauth": "1.3.1",
|
|
51
51
|
"@ai-ecoverse/slicc-scrub": "1.1.0"
|
|
52
52
|
},
|
|
53
53
|
"devDependencies": {
|
|
54
|
-
"@ai-ecoverse/slicc-cdp": "1.
|
|
55
|
-
"@ai-ecoverse/slicc-kernel": "1.
|
|
56
|
-
"@ai-ecoverse/slicc-shared-web": "2.
|
|
54
|
+
"@ai-ecoverse/slicc-cdp": "1.42.10",
|
|
55
|
+
"@ai-ecoverse/slicc-kernel": "1.170.1",
|
|
56
|
+
"@ai-ecoverse/slicc-shared-web": "2.13.7",
|
|
57
57
|
"@ai-ecoverse/wasm-bash": "5.3.0-23",
|
|
58
58
|
"@ai-ecoverse/wasm-coreutils": "9.12.0-15",
|
|
59
|
-
"@biomejs/biome": "2.
|
|
59
|
+
"@biomejs/biome": "2.6.2",
|
|
60
60
|
"@earendil-works/pi-ai": "1.4.0",
|
|
61
|
-
"@happy-dom/global-registrator": "
|
|
61
|
+
"@happy-dom/global-registrator": "21.0.4",
|
|
62
62
|
"@spectrum-css/button": "14.2.0",
|
|
63
63
|
"@spectrum-css/textfield": "8.2.0",
|
|
64
64
|
"@spectrum-css/tokens": "16.0.2",
|
|
65
65
|
"esbuild": "0.28.2",
|
|
66
|
-
"fake-indexeddb": "6.2.
|
|
67
|
-
"happy-dom": "
|
|
66
|
+
"fake-indexeddb": "6.2.6",
|
|
67
|
+
"happy-dom": "21.0.4",
|
|
68
68
|
"hash-wasm": "4.12.0",
|
|
69
69
|
"js-yaml": "5.5.0",
|
|
70
70
|
"kdbxweb": "2.1.1",
|