@kedataindo/docflow-core 0.0.87 → 0.0.88

package/dist/ai/index.d.cts

@@ -1 +1 @@
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from '../index-3B5ckTRa.cjs';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from '../index-DtcV-JK5.cjs';

package/dist/ai/index.d.ts

@@ -1 +1 @@
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from '../index-3B5ckTRa.js';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from '../index-DtcV-JK5.js';

package/dist/{index-3B5ckTRa.d.cts → index-DtcV-JK5.d.cts}

@@ -230,9 +230,17 @@ declare function buildAIPrompt(req: AIActionRequest): {
  *
  * The URL and the key are a pair and travel together. The library ships three
  * reference implementations; hosts may write their own (e.g. keyed per-tenant
- * in their own backend). No URL is hardcoded anywhere — `httpKeyStorage`
- * receives its endpoints from the host, keeping the library backend-agnostic
- * (docs/LIBRARY_CONTRACT.md rule 3).
+ * in their own backend). No *endpoint* is hardcoded on the storage path —
+ * `httpKeyStorage` receives its endpoints from the host, keeping the library
+ * backend-agnostic (docs/LIBRARY_CONTRACT.md rule 3). The only hardcoded host
+ * is the overridable `DEFAULT_BASE_URL` default in `claudeProvider.ts`
+ * (contract rule 4 exception; see §5 of docs/LIBRARY_CONTRACT.md).
+ *
+ * ⚠️ Secrets note: `localStorageKeyStorage` keeps an API key in
+ * `localStorage` in plaintext — any script running on the same origin can read
+ * it. Prefer a non-persistent storage (or `httpKeyStorage`, which keeps the key
+ * on the host backend) when the embedding app is not fully trusted
+ * (issue #179).
  */
 type Auth = {
     type: 'bearer';

package/dist/{index-3B5ckTRa.d.ts → index-DtcV-JK5.d.ts}

@@ -230,9 +230,17 @@ declare function buildAIPrompt(req: AIActionRequest): {
  *
  * The URL and the key are a pair and travel together. The library ships three
  * reference implementations; hosts may write their own (e.g. keyed per-tenant
- * in their own backend). No URL is hardcoded anywhere — `httpKeyStorage`
- * receives its endpoints from the host, keeping the library backend-agnostic
- * (docs/LIBRARY_CONTRACT.md rule 3).
+ * in their own backend). No *endpoint* is hardcoded on the storage path —
+ * `httpKeyStorage` receives its endpoints from the host, keeping the library
+ * backend-agnostic (docs/LIBRARY_CONTRACT.md rule 3). The only hardcoded host
+ * is the overridable `DEFAULT_BASE_URL` default in `claudeProvider.ts`
+ * (contract rule 4 exception; see §5 of docs/LIBRARY_CONTRACT.md).
+ *
+ * ⚠️ Secrets note: `localStorageKeyStorage` keeps an API key in
+ * `localStorage` in plaintext — any script running on the same origin can read
+ * it. Prefer a non-persistent storage (or `httpKeyStorage`, which keeps the key
+ * on the host backend) when the embedding app is not fully trusted
+ * (issue #179).
  */
 type Auth = {
     type: 'bearer';

package/dist/index.d.cts

@@ -4,8 +4,8 @@ import { IndexeddbPersistence } from 'y-indexeddb';
 import { WebrtcProvider } from 'y-webrtc';
 import { WebsocketProvider } from 'y-websocket';
 import * as Y from 'yjs';
-import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-3B5ckTRa.cjs';
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, p as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from './index-3B5ckTRa.cjs';
+import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-DtcV-JK5.cjs';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, p as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from './index-DtcV-JK5.cjs';
 import { PaginationPlusOptions } from 'tiptap-pagination-plus';
 export { PAGE_SIZES, PageSize, PaginationPlus, PaginationPlusOptions } from 'tiptap-pagination-plus';
 import { PluginKey } from '@tiptap/pm/state';

package/dist/index.d.ts

@@ -4,8 +4,8 @@ import { IndexeddbPersistence } from 'y-indexeddb';
 import { WebrtcProvider } from 'y-webrtc';
 import { WebsocketProvider } from 'y-websocket';
 import * as Y from 'yjs';
-import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-3B5ckTRa.js';
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, p as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from './index-3B5ckTRa.js';
+import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-DtcV-JK5.js';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, p as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from './index-DtcV-JK5.js';
 import { PaginationPlusOptions } from 'tiptap-pagination-plus';
 export { PAGE_SIZES, PageSize, PaginationPlus, PaginationPlusOptions } from 'tiptap-pagination-plus';
 import { PluginKey } from '@tiptap/pm/state';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kedataindo/docflow-core",
   "license": "Apache-2.0",
-  "version": "0.0.87",
+  "version": "0.0.88",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",