@promptbook/markitdown 0.112.0-136 → 0.112.0-138

package/README.md

@@ -27,6 +27,26 @@ Create persistent AI agents that turn your company's scattered knowledge into ac
 
 
 
+### Standalone VPS
+
+Run the standalone VPS installer only on a fresh server. Interactive mode asks for the installation values:
+
+```bash
+sudo curl -fsSL https://raw.githubusercontent.com/webgptorg/promptbook/refs/heads/main/other/vps/install.sh | bash
+```
+
+Non-interactive mode takes defaults from command-line options and skips initial code-runner CLI setup, which can be configured later from the UI or SSH:
+
+```bash
+sudo curl -fsSL https://raw.githubusercontent.com/webgptorg/promptbook/refs/heads/main/other/vps/install.sh | bash -s -- \
+    --non-interactive \
+    --yes-i-understand-that-script-should-be-run-on-fresh-server \
+    --domain s24.ptbk.io \
+    --openai-api-key sk-proj-abcdef \
+    --sentry-dsn https://abc@def.ingest.de.sentry.io/123 \
+    --admin-password xxx
+```
+
 
 
 <blockquote style="color: #ff8811">

package/esm/index.es.js

@@ -23,7 +23,7 @@ const BOOK_LANGUAGE_VERSION = '2.0.0';
  * @generated
  * @see https://github.com/webgptorg/promptbook
  */
-const PROMPTBOOK_ENGINE_VERSION = '0.112.0-136';
+const PROMPTBOOK_ENGINE_VERSION = '0.112.0-138';
 /**
  * TODO: string_promptbook_version should be constrained to the all versions of Promptbook engine
  * Note: [💞] Ignore a discrepancy between file name and entity name

package/esm/src/commitments/_common/teamInternalAgentAccess.d.ts

@@ -26,7 +26,15 @@ export type TeamInternalAgentAccessHeadersOptions = {
 /**
  * Resolves the internal token used by same-server TEAM calls.
  *
- * @returns Hashed token, or `null` when the server does not have a private secret.
+ * `PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN` must be a dedicated secret — falling
+ * back to `ADMIN_PASSWORD`, `SUPABASE_SERVICE_ROLE_KEY`, or any other shared
+ * credential would let a leak of one secret compromise both authentication
+ * boundaries (admin login and same-server teammate-agent access). When the
+ * dedicated variable is missing, this function returns `null` so the calling
+ * server fails closed — same-server TEAM access is disabled and no header is
+ * sent — instead of silently authorizing requests with the wrong secret.
+ *
+ * @returns Hashed token, or `null` when the dedicated secret is not configured.
  *
  * @private internal Agents Server access wiring
  */

package/esm/src/utils/isTimingSafeEqualString.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * Plain JavaScript `===` / `!==` string comparisons short-circuit on the first
+ * byte that differs, which lets a remote attacker who can measure response
+ * timing recover the expected value one byte at a time. This helper performs
+ * the comparison through Node's `timingSafeEqual`, which always inspects every
+ * byte of the equal-length buffers.
+ *
+ * Returning `false` early when the byte lengths differ does not expose
+ * character content — only length — which is an acceptable trade-off, since
+ * `timingSafeEqual` requires equal-length buffers and length is typically not
+ * secret.
+ *
+ * `null` and `undefined` inputs are treated as non-matching so callers can
+ * forward raw request values (for example `request.headers.get(name)`) without
+ * an extra guard.
+ *
+ * @param candidate - Value supplied by the caller (for example a request header or cookie).
+ * @param expected - Value to compare against (for example a configured secret).
+ * @returns `true` when both values are strings of equal length with identical bytes.
+ *
+ * @private internal helper function
+ */
+export declare function isTimingSafeEqualString(candidate: string | null | undefined, expected: string | null | undefined): boolean;

package/esm/src/version.d.ts

@@ -15,7 +15,7 @@ export declare const BOOK_LANGUAGE_VERSION: string_semantic_version;
 export declare const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version;
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-135`).
+ * It follows semantic versioning (e.g., `0.112.0-137`).
  *
  * @generated
  */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@promptbook/markitdown",
-    "version": "0.112.0-136",
+    "version": "0.112.0-138",
     "description": "Promptbook: Create persistent AI agents that turn your company's scattered knowledge into action",
     "private": false,
     "sideEffects": false,
@@ -95,7 +95,7 @@
     "types": "./esm/src/_packages/markitdown.index.d.ts",
     "typings": "./esm/src/_packages/markitdown.index.d.ts",
     "peerDependencies": {
-        "@promptbook/core": "0.112.0-136"
+        "@promptbook/core": "0.112.0-138"
     },
     "dependencies": {
         "crypto-js": "4.2.0",

package/umd/index.umd.js

@@ -25,7 +25,7 @@
      * @generated
      * @see https://github.com/webgptorg/promptbook
      */
-    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-136';
+    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-138';
     /**
      * TODO: string_promptbook_version should be constrained to the all versions of Promptbook engine
      * Note: [💞] Ignore a discrepancy between file name and entity name

package/umd/src/commitments/_common/teamInternalAgentAccess.d.ts

@@ -26,7 +26,15 @@ export type TeamInternalAgentAccessHeadersOptions = {
 /**
  * Resolves the internal token used by same-server TEAM calls.
  *
- * @returns Hashed token, or `null` when the server does not have a private secret.
+ * `PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN` must be a dedicated secret — falling
+ * back to `ADMIN_PASSWORD`, `SUPABASE_SERVICE_ROLE_KEY`, or any other shared
+ * credential would let a leak of one secret compromise both authentication
+ * boundaries (admin login and same-server teammate-agent access). When the
+ * dedicated variable is missing, this function returns `null` so the calling
+ * server fails closed — same-server TEAM access is disabled and no header is
+ * sent — instead of silently authorizing requests with the wrong secret.
+ *
+ * @returns Hashed token, or `null` when the dedicated secret is not configured.
  *
  * @private internal Agents Server access wiring
  */

package/umd/src/utils/isTimingSafeEqualString.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * Plain JavaScript `===` / `!==` string comparisons short-circuit on the first
+ * byte that differs, which lets a remote attacker who can measure response
+ * timing recover the expected value one byte at a time. This helper performs
+ * the comparison through Node's `timingSafeEqual`, which always inspects every
+ * byte of the equal-length buffers.
+ *
+ * Returning `false` early when the byte lengths differ does not expose
+ * character content — only length — which is an acceptable trade-off, since
+ * `timingSafeEqual` requires equal-length buffers and length is typically not
+ * secret.
+ *
+ * `null` and `undefined` inputs are treated as non-matching so callers can
+ * forward raw request values (for example `request.headers.get(name)`) without
+ * an extra guard.
+ *
+ * @param candidate - Value supplied by the caller (for example a request header or cookie).
+ * @param expected - Value to compare against (for example a configured secret).
+ * @returns `true` when both values are strings of equal length with identical bytes.
+ *
+ * @private internal helper function
+ */
+export declare function isTimingSafeEqualString(candidate: string | null | undefined, expected: string | null | undefined): boolean;

package/umd/src/version.d.ts

@@ -15,7 +15,7 @@ export declare const BOOK_LANGUAGE_VERSION: string_semantic_version;
 export declare const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version;
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-135`).
+ * It follows semantic versioning (e.g., `0.112.0-137`).
  *
  * @generated
  */