superbee 0.4.4-pre.12 → 0.4.4-pre.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/publication/bridge-host-kind.d.ts +2 -0
- package/dist/publication/bridge.d.ts +1 -1
- package/dist/publication-bridge.mjs +278 -82
- package/dist/publication.mjs +278 -82
- package/dist/superbee.mjs +419 -141
- package/package.json +1 -1
- package/references/hosted-checkout.md +7 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "superbee",
|
|
3
|
-
"version": "0.4.4-pre.
|
|
3
|
+
"version": "0.4.4-pre.14",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Agent-facing Superbee CLI for reading and writing local OKF knowledge bundles: context notes, docs, cross-links, and live bundle Views.",
|
|
6
6
|
"keywords": [
|
|
@@ -101,6 +101,13 @@ bundle read/write capabilities and optional fixed sites. It contains no reposito
|
|
|
101
101
|
refs, environment, credentials or app UUID. Each requested site must have its matching Read bundle
|
|
102
102
|
capability. A protected main-only GitHub environment and `id-token: write` are required by the host.
|
|
103
103
|
This works for custom research or documentation workflows without `release.config.json`.
|
|
104
|
+
By default, the workspace pointer must name its own parent-domain gateway. Optional explicit
|
|
105
|
+
`--host <HTTPS gateway origin>` selects the receiving service through ordinary protected-resource
|
|
106
|
+
and issuer discovery, without pointer or environment fallback. That service receives the signed
|
|
107
|
+
job token. In explicit mode, `--url` is the logical browser approval/audience origin (including a
|
|
108
|
+
shared neutral origin), and `--workspace` independently names the exact workspace: no first-label
|
|
109
|
+
inference is made. The server still decides current authority, and the CLI still checks returned
|
|
110
|
+
workspace, exact capabilities and expiry. Selecting a service grants no access.
|
|
104
111
|
|
|
105
112
|
The existing exchange verifies the job's GitHub identity and resolves exactly approved access.
|
|
106
113
|
Pending approval is `FORBIDDEN` (exit 2) with `details.reason: workload_approval_pending`, an opaque
|