feat: versioned CDN auto-update for embedding sites

.github/workflows/release-please.yml

@@ -17,8 +17,60 @@ jobs:
     name: Release Please
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v4
+
       - uses: googleapis/release-please-action@v4
         id: release
         with:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+      # While a release PR is open, rebuild the embed bundle and commit the
+      # fresh artifacts onto the PR branch, so the tagged release commit carries
+      # the exact bytes jsDelivr serves at gh@<major>/cdn/.
+      - name: Checkout release PR branch
+        if: ${{ steps.release.outputs.pr }}
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+
+      - name: Setup pnpm
+        if: ${{ steps.release.outputs.pr }}
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node
+        if: ${{ steps.release.outputs.pr }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: widget/pnpm-lock.yaml
+
+      - name: Rebuild and commit cdn/ bundle
+        if: ${{ steps.release.outputs.pr }}
+        env:
+          PR_BRANCH: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+        run: |
+          pnpm --dir widget install --frozen-lockfile
+          pnpm --dir widget run build:embed
+          mkdir -p cdn
+          cp widget/dist/claudius.iife.js cdn/claudius.iife.js
+          cp widget/dist/claudius.css cdn/claudius.css
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if ! git diff --quiet -- cdn/; then
+            git add cdn/claudius.iife.js cdn/claudius.css
+            git commit -m "chore: rebuild cdn bundle for release"
+            git push origin "HEAD:${PR_BRANCH}"
+          fi
+
+      # On merge, attach the same bundle to the GitHub Release.
+      - name: Upload bundle to release
+        if: ${{ steps.release.outputs.release_created }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${{ steps.release.outputs.tag_name }}" \
+            cdn/claudius.iife.js cdn/claudius.css --clobber

DEPLOY.md

@@ -70,7 +70,31 @@ pnpm build:embed
 # Output: dist/claudius.iife.js + dist/claudius.css
 ```
 
-## Embed on pmds.info (Replit)
+## Embed via CDN (recommended, auto-updating)
+
+Point the site at the version-pinned jsDelivr channel. `@1` always resolves the
+latest `v1.x` release, so patches and minor versions roll out automatically; a
+new major (`v2`) never lands without an explicit bump. (jsDelivr caches the
+range resolution for ~12h.)
+
+```html
+<script>
+  window.ClaudiusConfig = {
+    /* ...your config... */
+  };
+</script>
+<link
+  rel="stylesheet"
+  href="https://cdn.jsdelivr.net/gh/PMDevSolutions/Claudius@1/cdn/claudius.css"
+/>
+<script src="https://cdn.jsdelivr.net/gh/PMDevSolutions/Claudius@1/cdn/claudius.iife.js"></script>
+```
+
+Pin to an exact release with `@1.2.0` when you need it. Embedding sites must
+allow `cdn.jsdelivr.net` in their CSP `script-src` and `style-src`. Check what a
+page is running via `window.ClaudiusWidgetVersion` in the browser console.
+
+## Embed self-hosted (alternative)
 
 Upload `claudius.iife.js` and `claudius.css` to the Replit project, then add before `</body>`:
 

README.md

@@ -88,6 +88,18 @@ For non-React sites, use the IIFE bundle with `window.ClaudiusConfig`:
 <script src="/path/to/claudius.iife.js"></script>
 ```
 
+To auto-update instead of self-hosting, load the version-pinned CDN channel
+(`@1` resolves the latest `v1.x` release; requires allowing `cdn.jsdelivr.net`
+in your CSP). See [DEPLOY.md](DEPLOY.md#embed-via-cdn-recommended-auto-updating).
+
+```html
+<link
+  rel="stylesheet"
+  href="https://cdn.jsdelivr.net/gh/PMDevSolutions/Claudius@1/cdn/claudius.css"
+/>
+<script src="https://cdn.jsdelivr.net/gh/PMDevSolutions/Claudius@1/cdn/claudius.iife.js"></script>
+```
+
 ## Configuration
 
 Both the React component and embed script accept these options:

widget/src/embed.tsx

@@ -5,6 +5,12 @@ import type { LocaleCode } from "./locales";
 import type { ClaudiusTranslations } from "./i18n";
 import "./styles.css";
 
+// Injected at build time by vite.config.embed.ts; undefined under unit tests.
+declare const __CLAUDIUS_VERSION__: string | undefined;
+
+const CLAUDIUS_VERSION =
+  typeof __CLAUDIUS_VERSION__ !== "undefined" ? __CLAUDIUS_VERSION__ : "dev";
+
 interface ClaudiusConfig {
   apiUrl: string;
   title?: string;
@@ -25,9 +31,14 @@ interface ClaudiusConfig {
 declare global {
   interface Window {
     ClaudiusConfig?: ClaudiusConfig;
+    ClaudiusWidgetVersion?: string;
   }
 }
 
+if (typeof window !== "undefined") {
+  window.ClaudiusWidgetVersion = CLAUDIUS_VERSION;
+}
+
 // Script-based initialization (existing method)
 function init() {
   const config = window.ClaudiusConfig;

widget/vite.config.embed.ts

@@ -1,6 +1,11 @@
 import { defineConfig } from "vite";
 import react from "@vitejs/plugin-react";
 import { resolve } from "path";
+import { readFileSync } from "fs";
+
+const pkg = JSON.parse(
+  readFileSync(resolve(__dirname, "package.json"), "utf-8"),
+) as { version: string };
 
 export default defineConfig({
   plugins: [react()],
@@ -9,6 +14,7 @@ export default defineConfig({
   // gate dev warnings) blows up at runtime. Replace it at build time.
   define: {
     "process.env.NODE_ENV": JSON.stringify("production"),
+    __CLAUDIUS_VERSION__: JSON.stringify(pkg.version),
   },
   build: {
     lib: {