@hiai-gg/docsmint 0.6.6 → 0.6.8

package/README.md

@@ -40,7 +40,26 @@ server.
 - **Own the full stack**: application data, vectors, graph, queue, and files run
   on infrastructure you control.
 
-## What's new in DocsMint 0.6.6?
+## What's new in DocsMint 0.6.8?
+
+- **Workspace-safe recovery.** Explicit operator reindexing carries the
+  document's workspace into every durable pipeline stage, including RLS reads.
+- **Consistent operator authentication.** Both documented admin key headers
+  bypass interactive rate limits during maintenance operations.
+
+DocsMint 0.6.8 includes the self-host reliability fixes introduced in 0.6.7:
+
+- **Reliable HTTPS sessions.** Every protected SvelteKit route accepts Better
+  Auth's secure production cookie as well as the local-development cookie.
+- **Cleaner retrieval.** Deleted documents are excluded before exact, lexical,
+  fuzzy, vector, chunk, and graph ranking.
+- **Explicit GraphRAG providers.** Entity extraction requires its own
+  chat-completion URL and never sends chat requests to an embedding endpoint.
+- **Safer self-host defaults.** Auth origins are validated configuration, the
+  SeaweedFS Filer UI binds to loopback, folder moves refresh knowledge
+  metadata, and backups exclude `.env`.
+
+DocsMint 0.6.7 includes the safe index recovery introduced in 0.6.6:
 
 - **Safe explicit index recovery.** Admin document reindexing keeps the active
   generation searchable until a new generation has passed embedding, graph,

package/dist/backend/index.js

@@ -77709,6 +77709,7 @@ var init_config_schema = __esm(() => {
     WEBHOOK_SECRET: exports_external2.string().min(1, "WEBHOOK_SECRET must not be empty").default("change-me-to-random-32-chars").refine((val) => val !== "change-me-to-random-32-chars", "WEBHOOK_SECRET must be set in production"),
     BETTER_AUTH_URL: exports_external2.string().default("http://localhost:50700"),
     CORS_ORIGINS: exports_external2.string().optional(),
+    TRUSTED_ORIGINS: exports_external2.string().optional(),
     WEB_PORT: exports_external2.coerce.number().default(50701),
     EMBEDDING_BASE_URL: exports_external2.string().optional(),
     EMBEDDING_API_KEY: exports_external2.string().optional(),
@@ -192960,7 +192961,7 @@ var auth = betterAuth({
   }),
   secret: config3.BETTER_AUTH_SECRET,
   baseURL: config3.BETTER_AUTH_URL,
-  trustedOrigins: process.env.TRUSTED_ORIGINS ? process.env.TRUSTED_ORIGINS.split(",").map((s2) => s2.trim()) : ["http://localhost:50701", "http://127.0.0.1:50701"],
+  trustedOrigins: config3.TRUSTED_ORIGINS ? config3.TRUSTED_ORIGINS.split(",").map((origin) => origin.trim()).filter(Boolean) : ["http://localhost:50701", "http://127.0.0.1:50701"],
   emailAndPassword: {
     enabled: true
   },
@@ -193195,11 +193196,14 @@ function createRateLimiter(config4, redisClient) {
 }
 
 // ../../backend/src/api/middleware/rate-limit.ts
-function isInternalRequest(request) {
+function isInternalRequest(request, expected = config3.HIAI_DOCS_API_KEY) {
   if (!request)
     return false;
-  const apiKey = request.headers.get("x-api-key");
-  return apiKey === config3.HIAI_DOCS_API_KEY;
+  if (!expected)
+    return false;
+  const headerKey = request.headers.get("x-api-key")?.trim();
+  const bearer = /^Bearer\s+(.+)$/i.exec(request.headers.get("authorization")?.trim() ?? "")?.[1]?.trim();
+  return headerKey === expected || bearer === expected;
 }
 function _limiterWithBypass(config4) {
   const base = createRateLimiter(config4);
@@ -194512,6 +194516,25 @@ async function loadAdminFolderDocumentIds(folderId, limit) {
     return limit > 0 ? query.limit(limit) : query;
   });
 }
+async function loadAdminDocumentTarget(documentId) {
+  const rows = await withTenant(REEMBED_ADMIN_TENANT, (tx) => tx.select({ id: documents.id, workspaceId: documents.workspaceId }).from(documents).where(eq(documents.id, documentId)).limit(1));
+  const row = rows[0];
+  return row ? { id: row.id, workspaceId: row.workspaceId ?? undefined } : undefined;
+}
+async function reembedDocumentAdminWith(documentId, loadTarget) {
+  const target2 = await loadTarget(documentId);
+  if (!target2)
+    return { found: false, enqueued: 0 };
+  const enqueued = await enqueueReembed([target2.id], target2.workspaceId, {
+    bypassDedup: true,
+    forceNewGeneration: true,
+    source: "reindex"
+  });
+  return { found: true, enqueued };
+}
+function reembedDocumentAdmin(documentId) {
+  return reembedDocumentAdminWith(documentId, loadAdminDocumentTarget);
+}
 async function reembedDocsInFolderAdminWith(folderId, loadRows) {
   const limit = config3.FOLDER_REEMBED_BATCH_SIZE;
   const rows = await loadRows(folderId, limit);
@@ -194613,27 +194636,19 @@ var adminRoutes = new Elysia({ prefix: "/api/admin" }).post("/reindex/:docId", a
     return { error: "Invalid or missing admin API key" };
   }
   try {
-    const existing = await withTenant(adminTenantContextBound(), async (tx) => {
-      const rows = await tx.select({ id: documents.id }).from(documents).where(eq(documents.id, params.docId)).limit(1);
-      return rows.length > 0;
-    });
-    if (!existing) {
+    const result = await reembedDocumentAdmin(params.docId);
+    if (!result.found) {
       set2.status = 404;
       return { error: "Document not found" };
     }
-    const enqueued = await enqueueReembed([params.docId], undefined, {
-      bypassDedup: true,
-      forceNewGeneration: true,
-      source: "reindex"
-    });
-    if (enqueued !== 1) {
+    if (result.enqueued !== 1) {
       set2.status = 503;
       return { error: "Failed to queue document reindex" };
     }
     return {
       success: true,
       documentId: params.docId,
-      enqueued,
+      enqueued: result.enqueued,
       message: "Document reindex queued with a new generation"
     };
   } catch (err) {
@@ -229066,8 +229081,8 @@ var folderRoutes = new Elysia({ prefix: "/api/folders" }).get("/:id", async ({ p
       set2.status = 404;
       return { error: "Folder not found" };
     }
-    if (parsed.data.name !== undefined) {
-      reembedDocsInFolder(params2.id, userId, ctx.workspaceId).catch((err) => logger3.warn({ err, folderId: params2.id }, "Failed to enqueue re-embedding for folder rename"));
+    if (parsed.data.name !== undefined || parsed.data.parentId !== undefined || parsed.data.categoryId !== undefined) {
+      reembedDocsInFolder(params2.id, userId, ctx.workspaceId).catch((err) => logger3.warn({ err, folderId: params2.id }, "Failed to enqueue re-embedding for folder metadata change"));
       invalidateDocListCache(userId);
     }
     return result.updated;
@@ -229919,7 +229934,7 @@ async function resolveVisibleIds(ctx, ids, adapter, scope = _buildGraphVisibilit
     id: documents.id,
     ownerId: documents.ownerId,
     visibility: documents.visibility
-  }).from(documents).where(and(inArray(documents.id, ids), scope.kind === "admin" ? undefined : scope.kind === "public" ? eq(documents.visibility, "public") : scope.kind === "share" ? inArray(documents.id, scope.allowedDocumentIds) : or(eq(documents.ownerId, scope.ownerId), eq(documents.visibility, "public")))));
+  }).from(documents).where(and(inArray(documents.id, ids), isNull(documents.deletedAt), scope.kind === "admin" ? undefined : scope.kind === "public" ? eq(documents.visibility, "public") : scope.kind === "share" ? inArray(documents.id, scope.allowedDocumentIds) : or(eq(documents.ownerId, scope.ownerId), eq(documents.visibility, "public")))));
   return new Set(rows.filter((row) => _isGraphDocumentVisible(scope, {
     id: row.id,
     ownerId: row.ownerId,
@@ -230361,6 +230376,7 @@ async function retrieveExact(ctx, plan, limit, execute, scope) {
 			1.0::double precision AS score
 		FROM documents d
 		WHERE d.owner_id = ${ctx.userId}
+			AND d.deleted_at IS NULL
 			${scope}
 			AND (
 				lower(trim(d.title)) = lower(trim(${plan.normalized}))
@@ -230388,6 +230404,7 @@ async function retrieveFts(ctx, plan, limit, execute, scope) {
 				ts_rank(d.search_vector, websearch_to_tsquery('english', ${plan.normalized})) AS score
 			FROM documents d
 			WHERE d.owner_id = ${ctx.userId}
+				AND d.deleted_at IS NULL
 				${scope}
 				AND d.search_vector @@ websearch_to_tsquery('english', ${plan.normalized})
 			UNION ALL
@@ -230395,6 +230412,7 @@ async function retrieveFts(ctx, plan, limit, execute, scope) {
 				ts_rank(d.search_vector_simple, websearch_to_tsquery('simple', ${plan.normalized})) AS score
 			FROM documents d
 			WHERE d.owner_id = ${ctx.userId}
+				AND d.deleted_at IS NULL
 				${scope}
 				AND d.search_vector_simple @@ websearch_to_tsquery('simple', ${plan.normalized})
 		)
@@ -230413,6 +230431,7 @@ async function retrieveFuzzy(ctx, plan, limit, minimum, execute, scope) {
 			similarity(d.title, ${plan.normalized})::double precision AS score
 		FROM documents d
 		WHERE d.owner_id = ${ctx.userId}
+			AND d.deleted_at IS NULL
 			${scope}
 			AND d.title % ${plan.normalized}
 			AND similarity(d.title, ${plan.normalized}) >= ${minimum}
@@ -230447,6 +230466,7 @@ async function retrieveVector(ctx, plan, limit, minimum, chunkLimit, execute, pr
 			FROM document_embeddings de
 			JOIN documents d ON d.id = de.document_id
 			WHERE d.owner_id = ${ctx.userId}
+				AND d.deleted_at IS NULL
 				${scope}
 				AND d.active_embedding_generation IS NOT NULL
 				AND de.generation_id = d.active_embedding_generation
@@ -231179,6 +231199,7 @@ async function hydrateResults(ctx, items, includeChunks, query, allowedDocumentI
 					JOIN documents d ON d.id = de.document_id
 					WHERE de.document_id IN (${sql.join(ids.map((id3) => sql`${id3}`), sql`, `)})
 						AND ${tenantOwnerSql("d", ctx)}
+						AND d.deleted_at IS NULL
 						AND d.active_embedding_generation IS NOT NULL
 						AND de.generation_id = d.active_embedding_generation
 						AND de.is_valid = true
@@ -233301,13 +233322,13 @@ var extractionOutputSchema = exports_external2.object({
   entities: exports_external2.array(exports_external2.unknown())
 });
 async function callEntityExtractionLLM(text4, options) {
-  const primaryBase = options.llmBaseUrl ?? config3.GRAPH_EXTRACT_BASE_URL ?? config3.EMBEDDING_BASE_URL;
+  const primaryBase = options.llmBaseUrl ?? config3.GRAPH_EXTRACT_BASE_URL;
   const primaryExplicitKey = options.llmApiKey ?? config3.GRAPH_EXTRACT_API_KEY;
-  const primaryModel = options.llmModel ?? config3.GRAPH_EXTRACT_MODEL ?? config3.EMBEDDING_MODEL ?? "gpt-4o-mini";
+  const primaryModel = options.llmModel ?? config3.GRAPH_EXTRACT_MODEL ?? "gpt-4o-mini";
   const primaryKey = primaryBase ? resolveGraphProviderKey(primaryBase, primaryExplicitKey) : "";
-  const fallbackBase = config3.GRAPH_EXTRACT_FALLBACK_BASE_URL ?? config3.EMBEDDING_FALLBACK_BASE_URL;
+  const fallbackBase = config3.GRAPH_EXTRACT_FALLBACK_BASE_URL;
   const fallbackExplicitKey = config3.GRAPH_EXTRACT_FALLBACK_API_KEY;
-  const fallbackModel = config3.GRAPH_EXTRACT_FALLBACK_MODEL ?? config3.EMBEDDING_FALLBACK_MODEL ?? primaryModel;
+  const fallbackModel = config3.GRAPH_EXTRACT_FALLBACK_MODEL ?? primaryModel;
   const fallbackKey = fallbackBase ? resolveGraphProviderKey(fallbackBase, fallbackExplicitKey) : "";
   const providers = [];
   if (primaryBase) {
@@ -234953,7 +234974,7 @@ var swaggerConfig = {
     },
     info: {
       title: "DocsMint API",
-      version: "0.6.6",
+      version: "0.6.8",
       description: "Self-hosted AI-first documentation platform. Full-text + semantic search, version history, sharing, and folder organization.",
       contact: { name: "HiAi-gg", url: "https://github.com/HiAi-gg/docsmint" },
       license: {
@@ -234995,7 +235016,7 @@ var app = new Elysia().use(bodySizeLimit).onError(({ error: error53, set: set2 }
   set2.headers["X-Content-Type-Options"] = "nosniff";
   set2.headers["X-Frame-Options"] = "DENY";
 }).use(cors({
-  origin: config3.CORS_ORIGINS?.split(",") ?? [config3.BETTER_AUTH_URL],
+  origin: config3.CORS_ORIGINS ? config3.CORS_ORIGINS.split(",").map((origin) => origin.trim()).filter(Boolean) : [config3.BETTER_AUTH_URL],
   credentials: true,
   maxAge: 86400
 })).use(config3.NODE_ENV !== "production" ? swagger(swaggerConfig) : (e3) => e3).get("/api/health", async ({ request }) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hiai-gg/docsmint",
   "mcpName": "io.github.HiAi-gg/docsmint",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "type": "module",
   "browser": {
     "./dist/backend-launcher.js": false,

package/packages/cli/src/index.ts

@@ -24,7 +24,7 @@ import { registerSearch } from './commands/search.js';
 import { registerSnapshot } from './commands/snapshot.js';
 import { registerUpdate } from './commands/update.js';
 
-const VERSION = '0.6.6';
+const VERSION = '0.6.8';
 
 const program = new Command();
 program.name('hiai-docs').description('CLI for the hiai-docs knowledge base').version(VERSION);

package/packages/mcp-server/src/server.ts

@@ -81,7 +81,7 @@ export interface CreateDocsmintMcpServerOptions {
 }
 
 export function createDocsmintMcpServer(options: CreateDocsmintMcpServerOptions = {}): McpServer {
-  const server = new McpServer({ name: 'docsmint', version: '0.6.6' });
+  const server = new McpServer({ name: 'docsmint', version: '0.6.8' });
   registerDocsmintMcpCapabilities(server, options.client ?? defaultClient);
   return server;
 }

package/server.json

@@ -8,12 +8,12 @@
     "source": "github",
     "id": "1249550690"
   },
-  "version": "0.6.6",
+  "version": "0.6.8",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hiai-gg/docsmint",
-      "version": "0.6.6",
+      "version": "0.6.8",
       "transport": {
         "type": "stdio"
       },