@ai-ecoverse/slicc-vault 1.9.1 → 1.9.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +2 -2
  2. package/package.json +12 -11
package/README.md CHANGED
@@ -24,7 +24,7 @@ The bundles hold this repo's code, `@ai-ecoverse/slicc-scrub`, and `@ai-ecoverse
24
24
 
25
25
  `GET /embedders.json` is answered by the Worker, not by this tree. It returns `{ "embedders": [...] }`, the same sources as `frame-ancestors`. The vault reads it at start and accepts only those origins. When it's missing or malformed, only `vault.sliccy.ai` falls back to `config.json`; on every other host (`vault-preview.sliccy.ai`, branch previews, local) that means no embedders, so it fails closed. An embedder source is `http(s)://host`, optionally with `:port` or `:*`, matched exactly.
26
26
 
27
- `main` is served at `vault.sliccy.ai`, and every other branch at `vault-<label>.sliccy.ai`. seven embeds only `vault.sliccy.ai`.
27
+ `main` is served at `vault.sliccy.ai`, and every other branch at `vault-<label>.sliccy.ai`. Releases run only on `main`: the release job (semantic-release, npm, and the deploy to `vault.sliccy.ai`) is guarded by `github.ref == 'refs/heads/main'`, also when dispatched by hand, and the branch preview publishes nothing to npm, makes no tag or release, and skips the merge queue's `gh-readonly-queue/…` branches. CI runs on pull requests, on the merge queue (`merge_group`) and on `main`; `ci / test` is the required check. A `runner` job (on a hosted runner for a fork's pull request) picks where it runs with `.github/runner.mjs`, slicc-kernel's decider: the self-hosted runner `vars.CERT_RUNNER` names (`ubuntu-latest` if it's unset; no workflow names a self-hosted label itself) for this repo's own pull requests, merge groups whose own entries (found by the group's head commit, with those ahead of it) are all such, and pushes to `main`; a hosted runner for a fork's pull request; if the decider fails, `ci / test` still runs, on a hosted runner. `vars.CI_RUNNER` overrides it. A fork that edits this workflow could still name the pool itself: that is held off by the pool's own runner-group settings, not by this file. The release and the branch previews stay on hosted runners. `workflows.test.mjs` keeps all of this so. seven embeds only `vault.sliccy.ai`.
28
28
 
29
29
  ## Storage and keys
30
30
 
@@ -437,4 +437,4 @@ npm start # vault on http://vault.sliccy.localhost:8790, a test embedde
437
437
  ## Release and deploy
438
438
 
439
439
  - **Releases:** semantic-release on `main` tags a version from the conventional commits. It publishes the types package when the repository variable `NPM_PUBLISH` is `true`.
440
- - **Deploy:** after semantic-release, the release job builds with the new version and publishes `dist/site/` to `vault.sliccy.ai` from the `production` environment. Every push to another branch publishes it to `vault-<label>.sliccy.ai`. Both use GitHub's OIDC token against sliccy-ai's `/api/publish` route (`edge/publish.mjs`), with no stored secret.
440
+ - **Deploy:** after semantic-release, the release job builds with the new version and publishes `dist/site/` to `vault.sliccy.ai` from the `production` environment. Every push to another branch publishes it to `vault-<label>.sliccy.ai`. Both use GitHub's OIDC token against sliccy-ai's `/api/publish` route (`edge/publish.mjs`), with no stored secret. `edge/publish.mjs` ends with the verdict line `publish: PASS <url> <sha>`, and both publish steps fail without it, so a script that exits without publishing can't read as a pass. It runs as the main module also through a symlinked checkout or workspace: both sides of that check are real paths. A `manifest` answer without an `https://` URL fails the publish.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ai-ecoverse/slicc-vault",
3
- "version": "1.9.1",
3
+ "version": "1.9.2",
4
4
  "description": "The separate-origin vault at vault.sliccy.ai: sealed secrets, OAuth tokens, and model and MCP credentials for SLICC seven, used only by its injector",
5
5
  "type": "module",
6
6
  "license": "Apache-2.0",
@@ -46,26 +46,27 @@
46
46
  "release": "semantic-release"
47
47
  },
48
48
  "devDependencies": {
49
- "@ai-ecoverse/jerk-oauth": "0.15.2",
50
- "@ai-ecoverse/slicc-kernel": "1.83.0",
49
+ "@ai-ecoverse/jerk-oauth": "0.24.0",
50
+ "@ai-ecoverse/slicc-kernel": "1.122.1",
51
51
  "@ai-ecoverse/slicc-scrub": "1.0.0",
52
- "@ai-ecoverse/slicc-shared-web": "1.13.1",
53
- "@ai-ecoverse/wasm-bash": "5.3.0-18",
54
- "@ai-ecoverse/wasm-coreutils": "9.12.0-5",
52
+ "@ai-ecoverse/slicc-shared-web": "1.23.1",
53
+ "@ai-ecoverse/wasm-bash": "5.3.0-19",
54
+ "@ai-ecoverse/wasm-coreutils": "9.12.0-9",
55
55
  "@biomejs/biome": "2.5.15",
56
- "@earendil-works/pi-ai": "1.0.4",
57
- "@happy-dom/global-registrator": "20.14.5",
56
+ "@earendil-works/pi-ai": "1.1.0",
57
+ "@happy-dom/global-registrator": "20.14.6",
58
58
  "@spectrum-css/button": "14.2.0",
59
59
  "@spectrum-css/textfield": "8.2.0",
60
60
  "@spectrum-css/tokens": "16.0.2",
61
61
  "esbuild": "0.28.2",
62
62
  "fake-indexeddb": "6.2.5",
63
- "happy-dom": "20.14.5",
63
+ "happy-dom": "20.14.6",
64
64
  "hash-wasm": "4.12.0",
65
+ "js-yaml": "4.3.2",
65
66
  "kdbxweb": "2.1.1",
66
- "lefthook": "2.1.17",
67
+ "lefthook": "2.2.1",
67
68
  "monocart-coverage-reports": "2.13.2",
68
- "playwright-core": "1.63.0",
69
+ "playwright-core": "1.64.0",
69
70
  "semantic-release": "25.0.9",
70
71
  "typescript": "7.0.2"
71
72
  }