@hiai-gg/docsmint 0.8.7 → 0.8.8

package/README.md

@@ -42,17 +42,21 @@ instructions, and verify the connection. Hosted MCP follows your plan and
 workspace permissions. Prefer workspace-bound or category-scoped credentials.
 
 The Cloud endpoint is `https://docsmint.com/mcp` (Streamable HTTP). OAuth-capable
-clients discover authorization and open DocsMint login and consent in the browser.
-Choose your workspace and explicit scopes; the authorization code uses PKCE S256.
-Access tokens expire after one hour; reconnect through browser authorization when
-they expire (no refresh tokens). API-key clients
-send `Authorization: Bearer <key>`. Credentials cannot create or elevate other
-credentials; lifecycle management belongs to the signed-in browser session.
+clients discover the hosted resource and authorization-server metadata; the current
+authorization metadata advertises client registration at
+`https://docsmint.com/oauth/register` (DCR). The hosted flow uses authorization-code
+PKCE S256; metadata advertises only the `authorization_code` grant and no token
+endpoint client authentication. CIMD is not part of the current contract. Browser consent binds the
+one-hour opaque access token to the selected workspace, optional category, and
+requested scopes. Refresh tokens are not issued. API-key clients can instead send
+`Authorization: Bearer <key>` with an MCP/API credential created in the authenticated
+browser UI. Credentials cannot create or elevate other credentials; lifecycle
+management belongs to the signed-in browser session.
 
 **Self-hosted alternative:** run [DocsMint with Docker](#quickstart), create an API
 key in its browser UI, and configure `HIAI_DOCS_URL` and `HIAI_DOCS_API_KEY` for
 `npx --yes --package @hiai-gg/docsmint docsmint-mcp`. The npm package is a stdio
-bridge to your running deployment, not a server installer. See the
+bridge to your own API, not a server installer or hosted OAuth server. See the
 [MCP guide](https://github.com/HiAi-gg/docsmint/blob/main/packages/mcp-server/README.md) for client configuration.
 
 ## Why DocsMint?
@@ -70,20 +74,19 @@ bridge to your running deployment, not a server installer. See the
 - **Choose how you run it.** Use [managed DocsMint](https://docsmint.com) or
   self-host the application, database, search, queues, and files.
 
-## What's new in 0.8.7?
+## What's new in 0.8.8?
 
-Agents can now complete more document workflows without leaving MCP:
+- Clarify that hosted MCP authorization belongs to DocsMint Cloud and that the
+  stdio bridge uses an API key to connect to your own DocsMint API.
+- Synchronize MCP Registry and LobeHub descriptions with the current Cloud
+  authorization contract and the self-hosted boundary.
+- Keep the published catalog aligned with the implementation: 21 tools,
+  2 prompts, and 3 resources, with regression checks for route and metadata drift.
+- Update vulnerability reporting details and clarify that OAuth protocol flaws
+  remain in scope for the product where they occur.
 
-- Move documents to trash, remove folders or categories, and restore saved versions.
-- Keep changes within workspace/category permissions; version restoration requires edit access.
-- Discover clearer tool descriptions, parameter guidance, and destructive-operation annotations.
-- Apply GraphRAG query text and related-document result limits consistently.
-
-The MCP surface grows additively from 17 to 21 tools. Existing tool names remain
-available. No database migration is required. Hosted clients receive these tools
-when their DocsMint host adopts this release.
-
-Read the [release notes](https://github.com/HiAi-gg/docsmint/releases/tag/v0.8.7)
+No MCP capabilities, existing integrations, or database schema change in this
+release. See the [release notes](https://github.com/HiAi-gg/docsmint/releases/tag/v0.8.8)
 and [changelog](https://github.com/HiAi-gg/docsmint/blob/main/CHANGELOG.md).
 
 ## Install with an AI agent
@@ -136,7 +139,7 @@ docker pull vgalibov/docsmint:web-latest
 docker pull vgalibov/docsmint:caddy-latest
 ```
 
-Use versioned tags `api-v0.8.7`, `web-v0.8.7`, and `caddy-v0.8.7` for
+Use versioned tags `api-v0.8.8`, `web-v0.8.8`, and `caddy-v0.8.8` for
 reproducible deploys. Caddy is the supporting reverse proxy with rate limiting;
 it is separate from the API and web application. The quickstart still builds the Compose stack from this repository so PostgreSQL,
 Redis, and SeaweedFS start together with the application.

package/dist/backend/index.js

@@ -232059,50 +232059,6 @@ function stripQuotes2(value) {
   return trimmed;
 }
 
-// ../../backend/src/api/routes/health.ts
-function createHealthRoutes(dependencies) {
-  return new Elysia().get("/api/health", async ({ request, set: set2 }) => {
-    const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip") ?? "unknown";
-    const rateLimit = await dependencies.rateLimiter(ip, request);
-    set2.headers = {
-      "X-RateLimit-Remaining": String(rateLimit.remaining),
-      ...rateLimit.retryAfter ? { "Retry-After": String(rateLimit.retryAfter) } : {}
-    };
-    if (!rateLimit.allowed) {
-      set2.status = 429;
-      return { error: "Too many requests" };
-    }
-    const [databaseAvailable, redisAvailable, storageAvailable] = await Promise.all([
-      dependencies.databaseAvailable(),
-      dependencies.redisAvailable(),
-      dependencies.storageAvailable()
-    ]);
-    const queueAvailable = dependencies.queueAvailable();
-    const readiness = evaluatePipelineHealth({
-      databaseAvailable,
-      redisAvailable,
-      storageAvailable,
-      queueAvailable,
-      recoveryAvailable: true,
-      oldestInteractiveWaitMs: 0,
-      interactiveSloMs: Number.POSITIVE_INFINITY,
-      graphAvailable: true
-    });
-    if (readiness.status === "unhealthy")
-      set2.status = 503;
-    return {
-      status: readiness.status === "unhealthy" ? "unhealthy" : "ok",
-      service: "docsmint",
-      timestamp: new Date().toISOString(),
-      database: databaseAvailable ? "ok" : "error",
-      redis: redisAvailable ? "ok" : "error",
-      storage: storageAvailable ? "ok" : "error",
-      queue: queueAvailable ? "ok" : "error",
-      ...readiness.reasons.length ? { reasons: readiness.reasons } : {}
-    };
-  });
-}
-
 // ../../backend/src/api/routes/keys.ts
 init_schema2();
 init_drizzle_orm();
@@ -235959,6 +235915,53 @@ var webhookRoutes = new Elysia({ prefix: "/api/webhooks" }).post("/storage", asy
   return { received: true };
 });
 
+// ../../backend/src/api/register-routes.ts
+var selfHostedApiRoutes = new Elysia().use(authRoutes).use(tagRoutes).use(categoryRoutes).use(attachmentRoutes).use(shareRoutes).use(searchRoutes).use(documentRoutes).use(folderRoutes).use(versionRoutes).use(webhookRoutes).use(collaborationRoutes).use(graphRoutes).use(keysRoutes).use(pluginsRoutes).use(visibilityRoutes).use(adminRoutes).use(metricsRoutes);
+
+// ../../backend/src/api/routes/health.ts
+function createHealthRoutes(dependencies) {
+  return new Elysia().get("/api/health", async ({ request, set: set2 }) => {
+    const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip") ?? "unknown";
+    const rateLimit = await dependencies.rateLimiter(ip, request);
+    set2.headers = {
+      "X-RateLimit-Remaining": String(rateLimit.remaining),
+      ...rateLimit.retryAfter ? { "Retry-After": String(rateLimit.retryAfter) } : {}
+    };
+    if (!rateLimit.allowed) {
+      set2.status = 429;
+      return { error: "Too many requests" };
+    }
+    const [databaseAvailable, redisAvailable, storageAvailable] = await Promise.all([
+      dependencies.databaseAvailable(),
+      dependencies.redisAvailable(),
+      dependencies.storageAvailable()
+    ]);
+    const queueAvailable = dependencies.queueAvailable();
+    const readiness = evaluatePipelineHealth({
+      databaseAvailable,
+      redisAvailable,
+      storageAvailable,
+      queueAvailable,
+      recoveryAvailable: true,
+      oldestInteractiveWaitMs: 0,
+      interactiveSloMs: Number.POSITIVE_INFINITY,
+      graphAvailable: true
+    });
+    if (readiness.status === "unhealthy")
+      set2.status = 503;
+    return {
+      status: readiness.status === "unhealthy" ? "unhealthy" : "ok",
+      service: "docsmint",
+      timestamp: new Date().toISOString(),
+      database: databaseAvailable ? "ok" : "error",
+      redis: redisAvailable ? "ok" : "error",
+      storage: storageAvailable ? "ok" : "error",
+      queue: queueAvailable ? "ok" : "error",
+      ...readiness.reasons.length ? { reasons: readiness.reasons } : {}
+    };
+  });
+}
+
 // ../../backend/src/lib/api-key-owner.ts
 init_schema2();
 init_config();
@@ -238422,7 +238425,7 @@ var swaggerConfig = {
     },
     info: {
       title: "DocsMint API",
-      version: "0.8.7",
+      version: "0.8.8",
       description: "Self-hosted AI-native knowledge workspace and installable PWA with hybrid search, GraphRAG, REST, SDK, CLI, and MCP access for people and AI agents.",
       contact: { name: "HiAi-gg", url: "https://github.com/HiAi-gg/docsmint" },
       license: {
@@ -238476,7 +238479,7 @@ var app = new Elysia().use(bodySizeLimit).onError(({ error: error53, set: set2 }
   redisAvailable: () => redis.ping().then(() => true, () => false),
   storageAvailable: () => storage.send(new ListBucketsCommand({})).then(() => true, () => false),
   queueAvailable: () => pipelineRuntime.workers.size === PIPELINE_STAGES.length && [...pipelineRuntime.workers.values()].every((worker2) => worker2.isRunning?.() === true)
-})).use(csrfMiddleware).use(authMiddleware).use(authRoutes).use(tagRoutes).use(categoryRoutes).use(attachmentRoutes).use(shareRoutes).use(searchRoutes).use(documentRoutes).use(folderRoutes).use(versionRoutes).use(webhookRoutes).use(collaborationRoutes).use(graphRoutes).use(keysRoutes).use(pluginsRoutes).use(visibilityRoutes).use(adminRoutes).use(metricsRoutes);
+})).use(csrfMiddleware).use(authMiddleware).use(selfHostedApiRoutes);
 app.listen({
   port: config3.API_PORT,
   development: config3.NODE_ENV !== "production",

package/dist/mcp-cli.js

@@ -1097,7 +1097,7 @@ function registerDocsmintMcpCapabilities(server, client2) {
   registerLifecycleCapabilities(server, client2, (handler11) => wrapHandler("lifecycle", handler11));
 }
 function createDocsmintMcpServer(options = {}) {
-  const server = new McpServer({ name: "docsmint", version: "0.8.7" });
+  const server = new McpServer({ name: "docsmint", version: "0.8.8" });
   const client2 = options.docsClient ? createMcpDocsClient(options.docsClient, options.requestContext) : options.client ?? createMcpDocsClient(createDefaultDocsClient(), options.requestContext);
   registerDocsmintMcpCapabilities(server, client2);
   return server;

package/dist/mcp-server.js

@@ -1093,7 +1093,7 @@ function registerDocsmintMcpCapabilities(server, client2) {
   registerLifecycleCapabilities(server, client2, (handler11) => wrapHandler("lifecycle", handler11));
 }
 function createDocsmintMcpServer(options = {}) {
-  const server = new McpServer({ name: "docsmint", version: "0.8.7" });
+  const server = new McpServer({ name: "docsmint", version: "0.8.8" });
   const client2 = options.docsClient ? createMcpDocsClient(options.docsClient, options.requestContext) : options.client ?? createMcpDocsClient(createDefaultDocsClient(), options.requestContext);
   registerDocsmintMcpCapabilities(server, client2);
   return server;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hiai-gg/docsmint",
   "mcpName": "io.github.HiAi-gg/docsmint",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "type": "module",
   "browser": {
     "./dist/backend-launcher.js": false,
@@ -15,7 +15,7 @@
     "./dist/backend-account-runtime-cleanup.js": false
   },
   "license": "Apache-2.0",
-  "description": "Managed or self-hosted knowledge workspace for AI agents with hybrid search, reranking, GraphRAG, and scoped document tools.",
+  "description": "DocsMint SDK and CLI plus a self-hosted MCP stdio bridge that uses your API key. For DocsMint Cloud MCP, connect to https://docsmint.com/mcp.",
   "repository": {
     "type": "git",
     "url": "https://github.com/HiAi-gg/docsmint"

package/packages/cli/src/index.ts

@@ -25,7 +25,7 @@ import { registerSearch } from './commands/search.js';
 import { registerSnapshot } from './commands/snapshot.js';
 import { registerUpdate } from './commands/update.js';
 
-const VERSION = '0.8.7';
+const VERSION = '0.8.8';
 
 const program = new Command();
 program.name('docsmint').description('CLI for the DocsMint knowledge workspace').version(VERSION);

package/server.json

@@ -10,7 +10,7 @@
     "id": "1249550690",
     "subfolder": "packages/mcp-server"
   },
-  "version": "0.8.7",
+  "version": "0.8.8",
   "icons": [
     {
       "src": "https://raw.githubusercontent.com/HiAi-gg/docsmint/main/frontend/static/logo-dark.png",
@@ -30,7 +30,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@hiai-gg/docsmint",
-      "version": "0.8.7",
+      "version": "0.8.8",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -44,12 +44,12 @@
       "environmentVariables": [
         {
           "name": "HIAI_DOCS_URL",
-          "description": "Base URL of your running self-hosted DocsMint API. For managed Cloud use https://docsmint.com/mcp.",
+          "description": "Base URL of your running self-hosted DocsMint REST API, for example http://localhost:50700. For Cloud MCP, use the Streamable HTTP remote below.",
           "default": "http://localhost:50700"
         },
         {
           "name": "HIAI_DOCS_API_KEY",
-          "description": "Create an API key in your self-hosted DocsMint browser UI. Prefer workspace-bound or category-scoped credentials.",
+          "description": "Create an API key in your self-hosted DocsMint browser UI. The stdio bridge uses it only with your own API; it does not install the Cloud OAuth server. Prefer workspace-bound or category-scoped credentials.",
           "isRequired": true,
           "isSecret": true
         }
@@ -63,7 +63,7 @@
       "headers": [
         {
           "name": "Authorization",
-          "description": "DocsMint Cloud: no self-hosting required. OAuth-capable clients use browser authorization discovered at the hosted endpoint. API-key clients: sign up or log in at https://docsmint.com/mcp/connect?source=mcp_registry and create a workspace-bound or category-scoped MCP/API credential in the authenticated browser UI. Enter Bearer <key>. Credential management requires a browser session; MCP cannot create or elevate credentials. Self-hosted users should use the stdio package.",
+          "description": "DocsMint Cloud remote at https://docsmint.com/mcp; no self-hosted server is required. Discovery advertises /oauth/authorize, /oauth/token, and active DCR at https://docsmint.com/oauth/register. Metadata supports the code response type, authorization_code grant only, no token-endpoint client authentication, and PKCE S256; CIMD is not part of the contract. Access tokens last one hour, have no refresh token, and are bound by browser consent to a workspace, optional category, and requested scopes. API-key clients can use Authorization: Bearer <key> with a workspace-bound or category-scoped credential created at https://docsmint.com/mcp/connect?source=mcp_registry. Credential management requires a browser session. For self-hosting, use the stdio package with your own API and API key; it does not install the Cloud OAuth server.",
           "isRequired": true,
           "isSecret": true
         },
@@ -83,7 +83,7 @@
       "licenseFile": "https://github.com/HiAi-gg/docsmint/blob/main/LICENSE",
       "documentationUrl": "https://docsmint.com/mcp/connect?source=mcp_registry",
       "catalog": {
-        "tools": 17,
+        "tools": 21,
         "prompts": 2,
         "resources": 3
       }