@aparte/core 0.7.1 → 0.9.0

package/dist/utils/uuid.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A unique id, in every context the library actually runs in.
+ *
+ * `crypto.randomUUID` is **secure-context only**. On `http://` — which includes
+ * `http://192.168.1.x`, the archetypal deployment for this library's own audience
+ * (bring-your-own-key, a local model on the LAN box) — it does not exist, and
+ * calling it throws `TypeError: crypto.randomUUID is not a function`.
+ *
+ * That was not a theoretical edge. A cold audit found 27 call sites across ten
+ * files and exactly TWO of them guarded, and the first thing to break was the
+ * stream parser: `_generateId()` runs from `_createTextSegment`, so
+ * `parser.parse('hello')` threw on the very first token of the very first reply.
+ * The two guarded sites — `conversation-controller.ts` and
+ * `files-to-attachments.ts` — prove the hazard was known and the sweep was never
+ * finished. This is that sweep, in one place.
+ *
+ * The fallback is NOT cryptographic and does not need to be: these ids address
+ * DOM nodes and map keys inside one page. Where a real UUID matters (a persisted
+ * conversation id a consumer may treat as stable), `crypto.randomUUID` is still
+ * used first, so a secure context gets the strong value.
+ *
+ * `pnpm check:secure-context` refuses a bare `crypto.randomUUID` anywhere but
+ * here, so the sweep cannot come undone one call site at a time.
+ */
+export declare function uuid(): string;
+//# sourceMappingURL=uuid.d.ts.map

package/dist/utils/uuid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uuid.d.ts","sourceRoot":"","sources":["../../src/utils/uuid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,IAAI,IAAI,MAAM,CAM7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aparte/core",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "High-performance AI conversation engine - Zero-dependency Web Components",
   "type": "module",
   "//sideEffects": "The BROWSER entry defines the custom elements and imports CSS at module scope, so it must never be tree-shaken; the Node entry (`index.node`) and every other module are pure. Listing them explicitly is what lets a bundler drop the rest — the whole package was implicitly side-effectful before, the only one of the 14 without this field.",
@@ -28,8 +28,7 @@
     "./styles.css": {
       "@aparte-workspace/source": "./src/styles/bundle.css",
       "default": "./dist/index.css"
-    },
-    "./dist/index.css": "./dist/index.css"
+    }
   },
   "files": [
     "dist",
@@ -44,8 +43,7 @@
     "@types/node": "^22.0.0",
     "esbuild": "^0.27.2",
     "typescript": "^5.4.0",
-    "vite": "^6.0.0",
-    "vite-plugin-dts": "^4.5.4"
+    "vite": "^6.0.0"
   },
   "keywords": [
     "web-components",