@mccaskie-labs/workbench-config 0.1.32 → 0.1.34

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.34
+
+### Patch Changes
+
+- forms manifest: the same-verdict rule now says to draw a form with renderForm and add both scripts under the page nonce, never hand-written markup or a show-when script.
+
+## 0.1.33
+
+### Patch Changes
+
+- The `gateway` manifest lists `GET /v1/calls`: the facts of one of the app's own kept AI calls (never its text).
+
 ## 0.1.32
 
 ### Patch Changes

package/capabilities/forms.json

@@ -39,7 +39,7 @@
     {
       "id": "forms.same-verdict",
       "kind": "must",
-      "text": "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.",
+      "text": "Draw the form with renderForm (its config block included), then add FORMS_SCRIPT and workbench-ui's FORM_SCRIPT, in that order, under the page's nonce. Never hand-write a form's markup, a second set of rules or a show-when script, so the page and the endpoint reach the same verdict.",
       "enforced_by": "review",
       "probe": "forms.browser"
     },

package/capabilities/gateway.json

@@ -6,7 +6,7 @@
   "summary": "What every Gateway endpoint shares: project keys by environment and scope, the request and response headers, the monthly budget check and the error codes. Apps hold one Workbench key and never a vendor key.",
   "status": "built",
   "surfaces": {
-    "gateway": ["GET /v1/health", "GET /v1/usage", "GET /v1/capabilities"],
+    "gateway": ["GET /v1/health", "GET /v1/usage", "GET /v1/capabilities", "GET /v1/calls"],
     "package": ["DEFAULT_GATEWAY_URL"]
   },
   "config": [

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "0608bbd8bb6f";
+export declare const MANIFEST_VERSION: "d5366f2127fb";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -1105,7 +1105,7 @@ export declare const capabilities: {
         }, {
             readonly id: "forms.same-verdict";
             readonly kind: "must";
-            readonly text: "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.";
+            readonly text: "Draw the form with renderForm (its config block included), then add FORMS_SCRIPT and workbench-ui's FORM_SCRIPT, in that order, under the page's nonce. Never hand-write a form's markup, a second set of rules or a show-when script, so the page and the endpoint reach the same verdict.";
             readonly enforced_by: "review";
             readonly probe: "forms.browser";
         }, {
@@ -1325,7 +1325,7 @@ export declare const capabilities: {
         readonly summary: "What every Gateway endpoint shares: project keys by environment and scope, the request and response headers, the monthly budget check and the error codes. Apps hold one Workbench key and never a vendor key.";
         readonly status: "built";
         readonly surfaces: {
-            readonly gateway: readonly ["GET /v1/health", "GET /v1/usage", "GET /v1/capabilities"];
+            readonly gateway: readonly ["GET /v1/health", "GET /v1/usage", "GET /v1/capabilities", "GET /v1/calls"];
             readonly package: readonly ["DEFAULT_GATEWAY_URL"];
         };
         readonly config: readonly [{

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "0608bbd8bb6f";
+export const MANIFEST_VERSION = "d5366f2127fb";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -1518,7 +1518,7 @@ export const capabilities = {
             {
                 "id": "forms.same-verdict",
                 "kind": "must",
-                "text": "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.",
+                "text": "Draw the form with renderForm (its config block included), then add FORMS_SCRIPT and workbench-ui's FORM_SCRIPT, in that order, under the page's nonce. Never hand-write a form's markup, a second set of rules or a show-when script, so the page and the endpoint reach the same verdict.",
                 "enforced_by": "review",
                 "probe": "forms.browser"
             },
@@ -1819,7 +1819,8 @@ export const capabilities = {
             "gateway": [
                 "GET /v1/health",
                 "GET /v1/usage",
-                "GET /v1/capabilities"
+                "GET /v1/capabilities",
+                "GET /v1/calls"
             ],
             "package": [
                 "DEFAULT_GATEWAY_URL"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",