@kedataindo/docflow-core 0.0.95 → 0.0.97

package/dist/ai/index.cjs

@@ -22,12 +22,14 @@ var ai_exports = {};
 __export(ai_exports, {
   CONTEXT_CHAR_CAP: () => CONTEXT_CHAR_CAP,
   LOCAL_STORAGE_KEY: () => LOCAL_STORAGE_KEY,
+  SESSION_STORAGE_KEY: () => SESSION_STORAGE_KEY,
   buildAIPrompt: () => buildAIPrompt,
   claudeProvider: () => claudeProvider,
   httpKeyStorage: () => httpKeyStorage,
   localStorageKeyStorage: () => localStorageKeyStorage,
   memoryKeyStorage: () => memoryKeyStorage,
   openaiCompatibleProvider: () => openaiCompatibleProvider,
+  sessionStorageKeyStorage: () => sessionStorageKeyStorage,
   toAIStreamFn: () => toAIStreamFn,
   trimContextAfter: () => trimContextAfter,
   trimContextBefore: () => trimContextBefore
@@ -144,30 +146,65 @@ function memoryKeyStorage(initial = null) {
   };
 }
 var LOCAL_STORAGE_KEY = "docflow:ai-config";
-function localStorageKeyStorage(key = LOCAL_STORAGE_KEY, storage) {
-  const store = () => {
-    const s = storage ?? globalThis.localStorage;
-    if (!s) throw new Error("localStorageKeyStorage: no Storage available (SSR?)");
-    return s;
-  };
+var SESSION_STORAGE_KEY = "docflow:ai-config";
+function isStoredAIConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.__docflowKeyStorage === 1 && typeof candidate.config === "object" && candidate.config !== null;
+}
+function webStorageKeyStorage(resolve, key = LOCAL_STORAGE_KEY, options = {}) {
+  const { ttlMs } = options;
+  if (ttlMs !== void 0 && (!Number.isFinite(ttlMs) || ttlMs <= 0)) {
+    throw new Error(
+      `webStorageKeyStorage: ttlMs must be a positive number of milliseconds, got ${String(ttlMs)}`
+    );
+  }
   return {
     async get() {
-      const raw = store().getItem(key);
+      const raw = resolve().getItem(key);
       if (!raw) return null;
+      let parsed;
       try {
-        return JSON.parse(raw);
+        parsed = JSON.parse(raw);
       } catch {
         return null;
       }
+      if (!isStoredAIConfig(parsed)) {
+        return parsed;
+      }
+      if (parsed.expiresAt !== void 0 && Date.now() >= parsed.expiresAt) {
+        resolve().removeItem(key);
+        return null;
+      }
+      return parsed.config;
     },
     async set(value) {
-      store().setItem(key, JSON.stringify(value));
+      const stored = {
+        __docflowKeyStorage: 1,
+        config: value,
+        ...ttlMs === void 0 ? {} : { expiresAt: Date.now() + ttlMs }
+      };
+      resolve().setItem(key, JSON.stringify(stored));
     },
     async clear() {
-      store().removeItem(key);
+      resolve().removeItem(key);
     }
   };
 }
+function localStorageKeyStorage(key = LOCAL_STORAGE_KEY, storage, options = {}) {
+  return webStorageKeyStorage(() => {
+    const s = storage ?? globalThis.localStorage;
+    if (!s) throw new Error("localStorageKeyStorage: no localStorage available (SSR?)");
+    return s;
+  }, key, options);
+}
+function sessionStorageKeyStorage(key = SESSION_STORAGE_KEY, storage, options = {}) {
+  return webStorageKeyStorage(() => {
+    const s = storage ?? globalThis.sessionStorage;
+    if (!s) throw new Error("sessionStorageKeyStorage: no sessionStorage available (SSR?)");
+    return s;
+  }, key, options);
+}
 function httpKeyStorage(urls) {
   const doFetch = urls.fetchImpl ?? ((...args) => fetch(...args));
   return {
@@ -444,12 +481,14 @@ function claudeProvider(config) {
 0 && (module.exports = {
   CONTEXT_CHAR_CAP,
   LOCAL_STORAGE_KEY,
+  SESSION_STORAGE_KEY,
   buildAIPrompt,
   claudeProvider,
   httpKeyStorage,
   localStorageKeyStorage,
   memoryKeyStorage,
   openaiCompatibleProvider,
+  sessionStorageKeyStorage,
   toAIStreamFn,
   trimContextAfter,
   trimContextBefore

package/dist/ai/index.d.cts

@@ -1 +1 @@
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from '../index-DRhAaVy1.cjs';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, B as BrowserKeyStorageOptions, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as SESSION_STORAGE_KEY, r as StreamEvent, s as buildAIPrompt, t as claudeProvider, u as httpKeyStorage, v as localStorageKeyStorage, w as memoryKeyStorage, x as openaiCompatibleProvider, y as sessionStorageKeyStorage, z as toAIStreamFn, D as trimContextAfter, E as trimContextBefore } from '../index-Br6IhSDL.cjs';

package/dist/ai/index.d.ts

@@ -1 +1 @@
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from '../index-DRhAaVy1.js';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, a as AIDraftFn, h as AIProvider, A as AIStreamFn, j as Auth, B as BrowserKeyStorageOptions, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as SESSION_STORAGE_KEY, r as StreamEvent, s as buildAIPrompt, t as claudeProvider, u as httpKeyStorage, v as localStorageKeyStorage, w as memoryKeyStorage, x as openaiCompatibleProvider, y as sessionStorageKeyStorage, z as toAIStreamFn, D as trimContextAfter, E as trimContextBefore } from '../index-Br6IhSDL.js';

package/dist/ai/index.js

@@ -1,25 +1,29 @@
 import {
   CONTEXT_CHAR_CAP,
   LOCAL_STORAGE_KEY,
+  SESSION_STORAGE_KEY,
   buildAIPrompt,
   claudeProvider,
   httpKeyStorage,
   localStorageKeyStorage,
   memoryKeyStorage,
   openaiCompatibleProvider,
+  sessionStorageKeyStorage,
   toAIStreamFn,
   trimContextAfter,
   trimContextBefore
-} from "../chunk-6RIBBYIP.js";
+} from "../chunk-ADA2T4CE.js";
 export {
   CONTEXT_CHAR_CAP,
   LOCAL_STORAGE_KEY,
+  SESSION_STORAGE_KEY,
   buildAIPrompt,
   claudeProvider,
   httpKeyStorage,
   localStorageKeyStorage,
   memoryKeyStorage,
   openaiCompatibleProvider,
+  sessionStorageKeyStorage,
   toAIStreamFn,
   trimContextAfter,
   trimContextBefore

package/dist/{chunk-6RIBBYIP.js → chunk-ADA2T4CE.js}

@@ -108,30 +108,65 @@ function memoryKeyStorage(initial = null) {
   };
 }
 var LOCAL_STORAGE_KEY = "docflow:ai-config";
-function localStorageKeyStorage(key = LOCAL_STORAGE_KEY, storage) {
-  const store = () => {
-    const s = storage ?? globalThis.localStorage;
-    if (!s) throw new Error("localStorageKeyStorage: no Storage available (SSR?)");
-    return s;
-  };
+var SESSION_STORAGE_KEY = "docflow:ai-config";
+function isStoredAIConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.__docflowKeyStorage === 1 && typeof candidate.config === "object" && candidate.config !== null;
+}
+function webStorageKeyStorage(resolve, key = LOCAL_STORAGE_KEY, options = {}) {
+  const { ttlMs } = options;
+  if (ttlMs !== void 0 && (!Number.isFinite(ttlMs) || ttlMs <= 0)) {
+    throw new Error(
+      `webStorageKeyStorage: ttlMs must be a positive number of milliseconds, got ${String(ttlMs)}`
+    );
+  }
   return {
     async get() {
-      const raw = store().getItem(key);
+      const raw = resolve().getItem(key);
       if (!raw) return null;
+      let parsed;
       try {
-        return JSON.parse(raw);
+        parsed = JSON.parse(raw);
       } catch {
         return null;
       }
+      if (!isStoredAIConfig(parsed)) {
+        return parsed;
+      }
+      if (parsed.expiresAt !== void 0 && Date.now() >= parsed.expiresAt) {
+        resolve().removeItem(key);
+        return null;
+      }
+      return parsed.config;
     },
     async set(value) {
-      store().setItem(key, JSON.stringify(value));
+      const stored = {
+        __docflowKeyStorage: 1,
+        config: value,
+        ...ttlMs === void 0 ? {} : { expiresAt: Date.now() + ttlMs }
+      };
+      resolve().setItem(key, JSON.stringify(stored));
     },
     async clear() {
-      store().removeItem(key);
+      resolve().removeItem(key);
     }
   };
 }
+function localStorageKeyStorage(key = LOCAL_STORAGE_KEY, storage, options = {}) {
+  return webStorageKeyStorage(() => {
+    const s = storage ?? globalThis.localStorage;
+    if (!s) throw new Error("localStorageKeyStorage: no localStorage available (SSR?)");
+    return s;
+  }, key, options);
+}
+function sessionStorageKeyStorage(key = SESSION_STORAGE_KEY, storage, options = {}) {
+  return webStorageKeyStorage(() => {
+    const s = storage ?? globalThis.sessionStorage;
+    if (!s) throw new Error("sessionStorageKeyStorage: no sessionStorage available (SSR?)");
+    return s;
+  }, key, options);
+}
 function httpKeyStorage(urls) {
   const doFetch = urls.fetchImpl ?? ((...args) => fetch(...args));
   return {
@@ -413,7 +448,9 @@ export {
   toAIStreamFn,
   memoryKeyStorage,
   LOCAL_STORAGE_KEY,
+  SESSION_STORAGE_KEY,
   localStorageKeyStorage,
+  sessionStorageKeyStorage,
   httpKeyStorage,
   openaiCompatibleProvider,
   claudeProvider

package/dist/{index-DRhAaVy1.d.cts → index-Br6IhSDL.d.cts}

@@ -156,6 +156,19 @@ interface CslItemData {
     abstract?: string;
     [k: string]: unknown;
 }
+/**
+ * A CSL style the citation engine can render with (issue #180). The library
+ * bundles four; a host may inject more (an institutional or Harvard/IEEE style)
+ * through `CitationPort.styles` — without modifying the library.
+ */
+interface CslStyleInfo {
+    id: string;
+    name: string;
+    /** 'note' styles render citations as footnotes; 'in-text' render inline. */
+    category: 'note' | 'in-text';
+    /** The CSL XML itself (the `<style>` document, as a string). */
+    xml: string;
+}
 /**
  * Host-supplied citation port. The library never fetches sources itself — the
  * host owns the reference library and injects CSL-JSON through this port,
@@ -166,6 +179,13 @@ interface CitationPort {
     sources: CslItemData[] | (() => CslItemData[]);
     /** Active CSL style id (e.g. 'chicago-notes-bibliography'). */
     style?: string;
+    /**
+     * Extra CSL styles for this document's engine (issue #180). A style whose
+     * `id` matches a bundled one overrides it; every other id is added alongside
+     * the four defaults. Omit it and the engine behaves exactly as before — the
+     * bundled styles keep the editor offline-capable.
+     */
+    styles?: CslStyleInfo[];
     /**
      * Called when the user inserts a citation: the host opens its source
      * picker and resolves with the chosen source id (null = cancelled).
@@ -236,11 +256,16 @@ declare function buildAIPrompt(req: AIActionRequest): {
  * is the overridable `DEFAULT_BASE_URL` default in `claudeProvider.ts`
  * (contract rule 4 exception; see §5 of docs/LIBRARY_CONTRACT.md).
  *
- * ⚠️ Secrets note: `localStorageKeyStorage` keeps an API key in
- * `localStorage` in plaintext — any script running on the same origin can read
- * it. Prefer a non-persistent storage (or `httpKeyStorage`, which keeps the key
- * on the host backend) when the embedding app is not fully trusted
- * (issue #179).
+ * ⚠️ Secrets note (issue #179): `localStorageKeyStorage` **and**
+ * `sessionStorageKeyStorage` keep an API key in the browser in plaintext — any
+ * script running on the same origin can read either one. `sessionStorage` only
+ * shortens the *lifetime* (closing the tab drops it); it is **not** an XSS
+ * mitigation. The only option that keeps the key out of the browser entirely is
+ * `httpKeyStorage` — with `AIConfig.visibility: 'admin-only'` plus the host's
+ * completion proxy, the key never reaches the client. That is the recommended
+ * production path. `ttlMs` (both browser storages) bounds how long a stored key
+ * stays readable, and hosts should call `clear()` on sign-out.
+ * See docs/AI_PROVIDERS.md §5.
  */
 type Auth = {
     type: 'bearer';
@@ -274,12 +299,41 @@ interface KeyStorage {
 /** In-memory storage — for tests and SSR (no persistence). */
 declare function memoryKeyStorage(initial?: AIConfig | null): KeyStorage;
 declare const LOCAL_STORAGE_KEY = "docflow:ai-config";
+/** Same logical key, kept in `sessionStorage` instead (issue #179). */
+declare const SESSION_STORAGE_KEY = "docflow:ai-config";
+interface BrowserKeyStorageOptions {
+    /**
+     * Drop the credentials once the entry is older than this many milliseconds:
+     * `get()` then returns null and removes the entry. Rotating a key is the
+     * host's job, but a TTL bounds how long a key the user forgot about stays
+     * readable.
+     */
+    ttlMs?: number;
+}
 /**
  * Browser `localStorage` persistence — for embedded apps that want the config
  * kept client-side. Note: this stores AI *credentials*, not document data, so
  * it is the host's deliberate choice, not a library persistence leak.
+ *
+ * The key survives browser restarts and is readable by any script on the
+ * origin — see the module secrets note, and prefer `sessionStorageKeyStorage`
+ * (shorter lifetime) or `httpKeyStorage` (key never reaches the client) when the
+ * embedding app is not fully trusted.
+ */
+declare function localStorageKeyStorage(key?: string, storage?: Storage, options?: BrowserKeyStorageOptions): KeyStorage;
+/**
+ * Browser `sessionStorage` persistence (issue #179) — the same key/value pair
+ * as `localStorageKeyStorage`, scoped to the tab: closing it (or the browser)
+ * drops the credentials, and a reload keeps them.
+ *
+ * What this does and does not do: it **reduces the lifetime** of a key the user
+ * typed into an embedded app (no "I logged out but the key is still there"
+ * surprise after the tab closes). It is **not** a defence against XSS — a
+ * script running on the origin reads `sessionStorage` as easily as
+ * `localStorage`. Only `httpKeyStorage` (plus `visibility: 'admin-only'` and the
+ * host's completion proxy) keeps the key out of the browser.
  */
-declare function localStorageKeyStorage(key?: string, storage?: Storage): KeyStorage;
+declare function sessionStorageKeyStorage(key?: string, storage?: Storage, options?: BrowserKeyStorageOptions): KeyStorage;
 interface HttpKeyStorageUrls {
     /** GET → 200 with the AIConfig JSON body, or 404 when unset. */
     getUrl: string;
@@ -349,5 +403,5 @@ interface ClaudeConfig {
 }
 declare function claudeProvider(config: ClaudeConfig): AIProvider;
 
-export { LOCAL_STORAGE_KEY as L, CONTEXT_CHAR_CAP as k, buildAIPrompt as q, claudeProvider as r, httpKeyStorage as s, localStorageKeyStorage as t, memoryKeyStorage as u, openaiCompatibleProvider as v, toAIStreamFn as w, trimContextAfter as x, trimContextBefore as y };
-export type { AIStreamFn as A, CitationPort as C, HttpKeyStorageUrls as H, ImageUploadHandler as I, KeyStorage as K, OpenAICompatibleConfig as O, StreamEvent as S, AIDraftFn as a, AIAction as b, AIActionRequest as c, AICompleteRequest as d, AIConfig as e, AIDraftCitation as f, AIDraftEvent as g, AIProvider as h, AIProviderFactory as i, Auth as j, ClaudeConfig as l, CslDate as m, CslItemData as n, CslName as o, ImageUploadResult as p };
+export { trimContextAfter as D, trimContextBefore as E, LOCAL_STORAGE_KEY as L, SESSION_STORAGE_KEY as S, CONTEXT_CHAR_CAP as k, buildAIPrompt as s, claudeProvider as t, httpKeyStorage as u, localStorageKeyStorage as v, memoryKeyStorage as w, openaiCompatibleProvider as x, sessionStorageKeyStorage as y, toAIStreamFn as z };
+export type { AIStreamFn as A, BrowserKeyStorageOptions as B, CitationPort as C, HttpKeyStorageUrls as H, ImageUploadHandler as I, KeyStorage as K, OpenAICompatibleConfig as O, AIDraftFn as a, AIAction as b, AIActionRequest as c, AICompleteRequest as d, AIConfig as e, AIDraftCitation as f, AIDraftEvent as g, AIProvider as h, AIProviderFactory as i, Auth as j, ClaudeConfig as l, CslDate as m, CslItemData as n, CslName as o, CslStyleInfo as p, ImageUploadResult as q, StreamEvent as r };

package/dist/{index-DRhAaVy1.d.ts → index-Br6IhSDL.d.ts}

@@ -156,6 +156,19 @@ interface CslItemData {
     abstract?: string;
     [k: string]: unknown;
 }
+/**
+ * A CSL style the citation engine can render with (issue #180). The library
+ * bundles four; a host may inject more (an institutional or Harvard/IEEE style)
+ * through `CitationPort.styles` — without modifying the library.
+ */
+interface CslStyleInfo {
+    id: string;
+    name: string;
+    /** 'note' styles render citations as footnotes; 'in-text' render inline. */
+    category: 'note' | 'in-text';
+    /** The CSL XML itself (the `<style>` document, as a string). */
+    xml: string;
+}
 /**
  * Host-supplied citation port. The library never fetches sources itself — the
  * host owns the reference library and injects CSL-JSON through this port,
@@ -166,6 +179,13 @@ interface CitationPort {
     sources: CslItemData[] | (() => CslItemData[]);
     /** Active CSL style id (e.g. 'chicago-notes-bibliography'). */
     style?: string;
+    /**
+     * Extra CSL styles for this document's engine (issue #180). A style whose
+     * `id` matches a bundled one overrides it; every other id is added alongside
+     * the four defaults. Omit it and the engine behaves exactly as before — the
+     * bundled styles keep the editor offline-capable.
+     */
+    styles?: CslStyleInfo[];
     /**
      * Called when the user inserts a citation: the host opens its source
      * picker and resolves with the chosen source id (null = cancelled).
@@ -236,11 +256,16 @@ declare function buildAIPrompt(req: AIActionRequest): {
  * is the overridable `DEFAULT_BASE_URL` default in `claudeProvider.ts`
  * (contract rule 4 exception; see §5 of docs/LIBRARY_CONTRACT.md).
  *
- * ⚠️ Secrets note: `localStorageKeyStorage` keeps an API key in
- * `localStorage` in plaintext — any script running on the same origin can read
- * it. Prefer a non-persistent storage (or `httpKeyStorage`, which keeps the key
- * on the host backend) when the embedding app is not fully trusted
- * (issue #179).
+ * ⚠️ Secrets note (issue #179): `localStorageKeyStorage` **and**
+ * `sessionStorageKeyStorage` keep an API key in the browser in plaintext — any
+ * script running on the same origin can read either one. `sessionStorage` only
+ * shortens the *lifetime* (closing the tab drops it); it is **not** an XSS
+ * mitigation. The only option that keeps the key out of the browser entirely is
+ * `httpKeyStorage` — with `AIConfig.visibility: 'admin-only'` plus the host's
+ * completion proxy, the key never reaches the client. That is the recommended
+ * production path. `ttlMs` (both browser storages) bounds how long a stored key
+ * stays readable, and hosts should call `clear()` on sign-out.
+ * See docs/AI_PROVIDERS.md §5.
  */
 type Auth = {
     type: 'bearer';
@@ -274,12 +299,41 @@ interface KeyStorage {
 /** In-memory storage — for tests and SSR (no persistence). */
 declare function memoryKeyStorage(initial?: AIConfig | null): KeyStorage;
 declare const LOCAL_STORAGE_KEY = "docflow:ai-config";
+/** Same logical key, kept in `sessionStorage` instead (issue #179). */
+declare const SESSION_STORAGE_KEY = "docflow:ai-config";
+interface BrowserKeyStorageOptions {
+    /**
+     * Drop the credentials once the entry is older than this many milliseconds:
+     * `get()` then returns null and removes the entry. Rotating a key is the
+     * host's job, but a TTL bounds how long a key the user forgot about stays
+     * readable.
+     */
+    ttlMs?: number;
+}
 /**
  * Browser `localStorage` persistence — for embedded apps that want the config
  * kept client-side. Note: this stores AI *credentials*, not document data, so
  * it is the host's deliberate choice, not a library persistence leak.
+ *
+ * The key survives browser restarts and is readable by any script on the
+ * origin — see the module secrets note, and prefer `sessionStorageKeyStorage`
+ * (shorter lifetime) or `httpKeyStorage` (key never reaches the client) when the
+ * embedding app is not fully trusted.
+ */
+declare function localStorageKeyStorage(key?: string, storage?: Storage, options?: BrowserKeyStorageOptions): KeyStorage;
+/**
+ * Browser `sessionStorage` persistence (issue #179) — the same key/value pair
+ * as `localStorageKeyStorage`, scoped to the tab: closing it (or the browser)
+ * drops the credentials, and a reload keeps them.
+ *
+ * What this does and does not do: it **reduces the lifetime** of a key the user
+ * typed into an embedded app (no "I logged out but the key is still there"
+ * surprise after the tab closes). It is **not** a defence against XSS — a
+ * script running on the origin reads `sessionStorage` as easily as
+ * `localStorage`. Only `httpKeyStorage` (plus `visibility: 'admin-only'` and the
+ * host's completion proxy) keeps the key out of the browser.
  */
-declare function localStorageKeyStorage(key?: string, storage?: Storage): KeyStorage;
+declare function sessionStorageKeyStorage(key?: string, storage?: Storage, options?: BrowserKeyStorageOptions): KeyStorage;
 interface HttpKeyStorageUrls {
     /** GET → 200 with the AIConfig JSON body, or 404 when unset. */
     getUrl: string;
@@ -349,5 +403,5 @@ interface ClaudeConfig {
 }
 declare function claudeProvider(config: ClaudeConfig): AIProvider;
 
-export { LOCAL_STORAGE_KEY as L, CONTEXT_CHAR_CAP as k, buildAIPrompt as q, claudeProvider as r, httpKeyStorage as s, localStorageKeyStorage as t, memoryKeyStorage as u, openaiCompatibleProvider as v, toAIStreamFn as w, trimContextAfter as x, trimContextBefore as y };
-export type { AIStreamFn as A, CitationPort as C, HttpKeyStorageUrls as H, ImageUploadHandler as I, KeyStorage as K, OpenAICompatibleConfig as O, StreamEvent as S, AIDraftFn as a, AIAction as b, AIActionRequest as c, AICompleteRequest as d, AIConfig as e, AIDraftCitation as f, AIDraftEvent as g, AIProvider as h, AIProviderFactory as i, Auth as j, ClaudeConfig as l, CslDate as m, CslItemData as n, CslName as o, ImageUploadResult as p };
+export { trimContextAfter as D, trimContextBefore as E, LOCAL_STORAGE_KEY as L, SESSION_STORAGE_KEY as S, CONTEXT_CHAR_CAP as k, buildAIPrompt as s, claudeProvider as t, httpKeyStorage as u, localStorageKeyStorage as v, memoryKeyStorage as w, openaiCompatibleProvider as x, sessionStorageKeyStorage as y, toAIStreamFn as z };
+export type { AIStreamFn as A, BrowserKeyStorageOptions as B, CitationPort as C, HttpKeyStorageUrls as H, ImageUploadHandler as I, KeyStorage as K, OpenAICompatibleConfig as O, AIDraftFn as a, AIAction as b, AIActionRequest as c, AICompleteRequest as d, AIConfig as e, AIDraftCitation as f, AIDraftEvent as g, AIProvider as h, AIProviderFactory as i, Auth as j, ClaudeConfig as l, CslDate as m, CslItemData as n, CslName as o, CslStyleInfo as p, ImageUploadResult as q, StreamEvent as r };

package/dist/index.cjs

@@ -45,6 +45,7 @@ __export(index_exports, {
   PAGE_SIZES: () => PAGE_SIZES,
   PaginationPlus: () => PaginationPlus,
   PerformanceMonitor: () => PerformanceMonitor,
+  SESSION_STORAGE_KEY: () => SESSION_STORAGE_KEY,
   SearchAndReplaceExtension: () => SearchAndReplaceExtension,
   SubdocumentProvider: () => SubdocumentProvider,
   buildAIPrompt: () => buildAIPrompt,
@@ -75,6 +76,7 @@ __export(index_exports, {
   searchAndReplaceKey: () => searchAndReplaceKey,
   searchNext: () => searchNext,
   searchPrev: () => searchPrev,
+  sessionStorageKeyStorage: () => sessionStorageKeyStorage,
   setSearchQuery: () => setSearchQuery,
   toAIStreamFn: () => toAIStreamFn,
   trimContextAfter: () => trimContextAfter,
@@ -2801,30 +2803,65 @@ function memoryKeyStorage(initial = null) {
   };
 }
 var LOCAL_STORAGE_KEY = "docflow:ai-config";
-function localStorageKeyStorage(key2 = LOCAL_STORAGE_KEY, storage) {
-  const store = () => {
-    const s = storage ?? globalThis.localStorage;
-    if (!s) throw new Error("localStorageKeyStorage: no Storage available (SSR?)");
-    return s;
-  };
+var SESSION_STORAGE_KEY = "docflow:ai-config";
+function isStoredAIConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.__docflowKeyStorage === 1 && typeof candidate.config === "object" && candidate.config !== null;
+}
+function webStorageKeyStorage(resolve, key2 = LOCAL_STORAGE_KEY, options = {}) {
+  const { ttlMs } = options;
+  if (ttlMs !== void 0 && (!Number.isFinite(ttlMs) || ttlMs <= 0)) {
+    throw new Error(
+      `webStorageKeyStorage: ttlMs must be a positive number of milliseconds, got ${String(ttlMs)}`
+    );
+  }
   return {
     async get() {
-      const raw = store().getItem(key2);
+      const raw = resolve().getItem(key2);
       if (!raw) return null;
+      let parsed;
       try {
-        return JSON.parse(raw);
+        parsed = JSON.parse(raw);
       } catch {
         return null;
       }
+      if (!isStoredAIConfig(parsed)) {
+        return parsed;
+      }
+      if (parsed.expiresAt !== void 0 && Date.now() >= parsed.expiresAt) {
+        resolve().removeItem(key2);
+        return null;
+      }
+      return parsed.config;
     },
     async set(value) {
-      store().setItem(key2, JSON.stringify(value));
+      const stored = {
+        __docflowKeyStorage: 1,
+        config: value,
+        ...ttlMs === void 0 ? {} : { expiresAt: Date.now() + ttlMs }
+      };
+      resolve().setItem(key2, JSON.stringify(stored));
     },
     async clear() {
-      store().removeItem(key2);
+      resolve().removeItem(key2);
     }
   };
 }
+function localStorageKeyStorage(key2 = LOCAL_STORAGE_KEY, storage, options = {}) {
+  return webStorageKeyStorage(() => {
+    const s = storage ?? globalThis.localStorage;
+    if (!s) throw new Error("localStorageKeyStorage: no localStorage available (SSR?)");
+    return s;
+  }, key2, options);
+}
+function sessionStorageKeyStorage(key2 = SESSION_STORAGE_KEY, storage, options = {}) {
+  return webStorageKeyStorage(() => {
+    const s = storage ?? globalThis.sessionStorage;
+    if (!s) throw new Error("sessionStorageKeyStorage: no sessionStorage available (SSR?)");
+    return s;
+  }, key2, options);
+}
 function httpKeyStorage(urls) {
   const doFetch = urls.fetchImpl ?? ((...args) => fetch(...args));
   return {
@@ -3114,6 +3151,7 @@ function claudeProvider(config) {
   PAGE_SIZES,
   PaginationPlus,
   PerformanceMonitor,
+  SESSION_STORAGE_KEY,
   SearchAndReplaceExtension,
   SubdocumentProvider,
   buildAIPrompt,
@@ -3144,6 +3182,7 @@ function claudeProvider(config) {
   searchAndReplaceKey,
   searchNext,
   searchPrev,
+  sessionStorageKeyStorage,
   setSearchQuery,
   toAIStreamFn,
   trimContextAfter,

package/dist/index.d.cts

@@ -4,8 +4,8 @@ import { IndexeddbPersistence } from 'y-indexeddb';
 import { WebrtcProvider } from 'y-webrtc';
 import { WebsocketProvider } from 'y-websocket';
 import * as Y from 'yjs';
-import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-DRhAaVy1.cjs';
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, p as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from './index-DRhAaVy1.cjs';
+import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-Br6IhSDL.cjs';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, B as BrowserKeyStorageOptions, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, p as CslStyleInfo, H as HttpKeyStorageUrls, q as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as SESSION_STORAGE_KEY, r as StreamEvent, s as buildAIPrompt, t as claudeProvider, u as httpKeyStorage, v as localStorageKeyStorage, w as memoryKeyStorage, x as openaiCompatibleProvider, y as sessionStorageKeyStorage, z as toAIStreamFn, D as trimContextAfter, E as trimContextBefore } from './index-Br6IhSDL.cjs';
 import { PaginationPlusOptions } from 'tiptap-pagination-plus';
 export { PAGE_SIZES, PageSize, PaginationPlus, PaginationPlusOptions } from 'tiptap-pagination-plus';
 import { Node } from '@tiptap/pm/model';

package/dist/index.d.ts

@@ -4,8 +4,8 @@ import { IndexeddbPersistence } from 'y-indexeddb';
 import { WebrtcProvider } from 'y-webrtc';
 import { WebsocketProvider } from 'y-websocket';
 import * as Y from 'yjs';
-import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-DRhAaVy1.js';
-export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, H as HttpKeyStorageUrls, p as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as StreamEvent, q as buildAIPrompt, r as claudeProvider, s as httpKeyStorage, t as localStorageKeyStorage, u as memoryKeyStorage, v as openaiCompatibleProvider, w as toAIStreamFn, x as trimContextAfter, y as trimContextBefore } from './index-DRhAaVy1.js';
+import { I as ImageUploadHandler, C as CitationPort, A as AIStreamFn, a as AIDraftFn } from './index-Br6IhSDL.js';
+export { b as AIAction, c as AIActionRequest, d as AICompleteRequest, e as AIConfig, f as AIDraftCitation, g as AIDraftEvent, h as AIProvider, i as AIProviderFactory, j as Auth, B as BrowserKeyStorageOptions, k as CONTEXT_CHAR_CAP, l as ClaudeConfig, m as CslDate, n as CslItemData, o as CslName, p as CslStyleInfo, H as HttpKeyStorageUrls, q as ImageUploadResult, K as KeyStorage, L as LOCAL_STORAGE_KEY, O as OpenAICompatibleConfig, S as SESSION_STORAGE_KEY, r as StreamEvent, s as buildAIPrompt, t as claudeProvider, u as httpKeyStorage, v as localStorageKeyStorage, w as memoryKeyStorage, x as openaiCompatibleProvider, y as sessionStorageKeyStorage, z as toAIStreamFn, D as trimContextAfter, E as trimContextBefore } from './index-Br6IhSDL.js';
 import { PaginationPlusOptions } from 'tiptap-pagination-plus';
 export { PAGE_SIZES, PageSize, PaginationPlus, PaginationPlusOptions } from 'tiptap-pagination-plus';
 import { Node } from '@tiptap/pm/model';

package/dist/index.js

@@ -1,16 +1,18 @@
 import {
   CONTEXT_CHAR_CAP,
   LOCAL_STORAGE_KEY,
+  SESSION_STORAGE_KEY,
   buildAIPrompt,
   claudeProvider,
   httpKeyStorage,
   localStorageKeyStorage,
   memoryKeyStorage,
   openaiCompatibleProvider,
+  sessionStorageKeyStorage,
   toAIStreamFn,
   trimContextAfter,
   trimContextBefore
-} from "./chunk-6RIBBYIP.js";
+} from "./chunk-ADA2T4CE.js";
 
 // src/Editor.ts
 import { Editor as TiptapEditor } from "@tiptap/core";
@@ -2636,6 +2638,7 @@ export {
   PAGE_SIZES,
   PaginationPlus,
   PerformanceMonitor,
+  SESSION_STORAGE_KEY,
   SearchAndReplaceExtension,
   SubdocumentProvider,
   buildAIPrompt,
@@ -2666,6 +2669,7 @@ export {
   searchAndReplaceKey,
   searchNext,
   searchPrev,
+  sessionStorageKeyStorage,
   setSearchQuery,
   toAIStreamFn,
   trimContextAfter,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kedataindo/docflow-core",
   "license": "Apache-2.0",
-  "version": "0.0.95",
+  "version": "0.0.97",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",