@adia-ai/llm 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -8,6 +8,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _No pending changes._
 
+## [0.4.4] - 2026-05-12
+
+### Ride-along (no source changes)
+
+Lockstep PATCH cut alongside `@adia-ai/web-components@0.4.4` (14 yaml gap closures from corpus simplification arc), `@adia-ai/a2ui-runtime@0.4.4` (registry expansion +27 web-modules + renderer kebab-case fix), `@adia-ai/a2ui-compose@0.4.4` (composition-library rename + transpiler `<a>` → Link), `@adia-ai/a2ui-corpus@0.4.4` (corpus simplification arc §36–§51), `@adia-ai/a2ui-mcp@0.4.4` (`get_fragment` tool retirement). Source byte-identical to v0.4.3.
+
+Internal `@adia-ai/*` dep ranges stay at `^0.4.0` (patch-cut asymmetry — `^0.4.0` covers `0.4.x` under semver). See root [CHANGELOG.md `## [0.4.4]`](../../../CHANGELOG.md) for the cut narrative.
+
+## [0.4.3] - 2026-05-11
+
+### Added
+
+- **`createAdapter()` browser API-key warn-once** in `llm-bridge.js`. When `IS_BROWSER && apiKey && !window.__adia_llm_key_warning_shown`, emits a one-shot `console.warn` (purple bridge name + amber severity + neutral body) noting that the key will ship in request headers — fine for local dev, **never deploy this shape**. Key masked as `${first8}…${last4}` (e.g. `sk-ant-a…Fiw-`) so the developer can identify *which* key is leaking without re-leaking the full secret. Dedup via `window.__adia_llm_key_warning_shown`. **Rotate at the provider console** if a debug transcript leaves the machine. Convention: every adapter / SDK with browser-side key access should emit a one-shot console warning at construction time.
+
+### Ride-along (otherwise byte-identical to v0.4.2)
+
+Lockstep PATCH cut alongside `@adia-ai/web-components@0.4.3` (input-ui type=number locale + thousands grouping + hold-to-repeat) + `@adia-ai/a2ui-compose@0.4.3` + `@adia-ai/a2ui-retrieval@0.4.3` (process.env browser-compat fix) + `@adia-ai/a2ui-corpus@0.4.3` (catalog regen + chunks re-harvest with new settings-appearance pattern). Apart from the `llm-bridge.js` addition above, source byte-identical to v0.4.2.
+
+Internal `@adia-ai/*` dep ranges stay at `^0.4.0` (patch-cut asymmetry — `^0.4.0` covers `0.4.x` under semver). See root [CHANGELOG.md `## [0.4.3]`](../../CHANGELOG.md) for the cut narrative.
+
 ## [0.4.2] - 2026-05-11
 
 ### Ride-along (no source changes)

package/README.md

@@ -3,6 +3,14 @@
 Provider-agnostic LLM client. Three adapters (anthropic / openai / gemini)
 behind a single `chat()` + `streamChat()` facade. Works in browser and Node.
 
+## Install
+
+```bash
+npm install @adia-ai/llm
+```
+
+## Usage
+
 ```js
 import { chat, streamChat } from '@adia-ai/llm';
 

package/llm-bridge.js

@@ -78,6 +78,26 @@ export async function createAdapter(opts = {}) {
   // Resolve API key for the detected provider
   const apiKey = opts.apiKey || getEnv(`${provider.toUpperCase()}_API_KEY`) || getEnv('ANTHROPIC_API_KEY') || getEnv('OPENAI_API_KEY') || getEnv('GOOGLE_API_KEY');
 
+  // Browser-only safety reminder: when running through the dev-server's
+  // passthrough proxy, the API key is sent verbatim in `x-api-key` /
+  // `Authorization` headers from the browser. Anyone with DevTools open
+  // can read it from the Network panel — fine for local dev, **never**
+  // deploy this shape. We log once per session (deduplicated via a
+  // window-scoped flag) when a key is present and we're in the browser.
+  // Journal entry 2026-05-11 §22 documents the root cause.
+  if (IS_BROWSER && apiKey && typeof window !== 'undefined' && !window.__adia_llm_key_warning_shown) {
+    window.__adia_llm_key_warning_shown = true;
+    const masked = apiKey.length > 12 ? `${apiKey.slice(0, 8)}…${apiKey.slice(-4)}` : '••••';
+    console.warn(
+      `%c[@adia-ai/llm] %cAPI key in browser:%c ${provider} key (${masked}) will be sent in request headers via the Vite passthrough proxy. ` +
+      `Anyone with DevTools access on this dev server can read it. Local-dev only — never deploy this shape. ` +
+      `Rotate at the provider console if this transcript leaves your machine.`,
+      'color: #a78bfa; font-weight: bold;',
+      'color: #f59e0b; font-weight: bold;',
+      'color: inherit;'
+    );
+  }
+
   // No key found → fall back to stub
   if (!apiKey) {
     console.warn('LLM Bridge: No API keys found. Using stub adapter.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adia-ai/llm",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Provider-agnostic LLM client \u2014 anthropic / openai / gemini adapters with a unified chat() + streamChat() facade. Used by AdiaUI's chat-shell and the A2UI generation pipeline; works in browser (with proxyUrl) and Node.",
   "type": "module",
   "exports": {