datanotes 1.3.0 → 1.5.0

package/SECURITY.md

@@ -15,7 +15,11 @@ run on your own machine, for you and the agents you choose.
 
 - The HTTP server listens on `127.0.0.1` unless told otherwise (`--host`). It answers no CORS
   preflight, so web pages cannot call it.
-- Only `GET /` answers without a token (status and version).
+- Only `GET /` (status and version), `GET /datanotes/openapi.json` (the API's description) and
+  `/datanotes/docs` (an interactive console over it, with its script and stylesheet) answer without
+  a token. They contain no data from the vault: the same description is published on the website.
+  The console's page loads nothing from other hosts (Content-Security-Policy: same origin only);
+  its calls need a token, which it keeps in the browser's local storage until you log out.
 - To reach it from outside (a phone, a hosted assistant), publish it through a reverse proxy or a
   tunnel, over HTTPS, and give each device or agent its own app token. Publish the MCP server
   (`datanotes-mcp serve`) the same way: it holds no credentials and passes each agent's token on.
@@ -49,8 +53,8 @@ Nothing leaves the machine unless you turn it on:
   LM Studio) keeps it on the machine.
 - **Telemetry** sends logs to the OTLP endpoint you configure (`telemetryEnabled`, off by default):
   operations, routes, note paths, actors, tool names and error messages (which may quote a value),
-  not note bodies. `telemetryHeaders` (e.g. an
-  ingestion key) is stored in the settings file; `OTEL_EXPORTER_OTLP_HEADERS` keeps it out.
+  not note bodies. `telemetryHeaders` (an API key) is
+  stored in the settings file; `OTEL_EXPORTER_OTLP_HEADERS` keeps it out.
 - **Webhooks** (created by the owner) post change events to the URLs they name.
 - **Apps' MCP endpoints** (registered by the owner): the engine sends each app's `mcp_token`, and
   the arguments and caller of every call of its tools, to the app's `mcp_url`, which may be remote.

package/dist/api/catalog.d.ts

@@ -15,5 +15,7 @@ export interface OperationDef {
         idempotentHint?: boolean;
         openWorldHint?: boolean;
     };
+    /** JSON Schema of the successful (2xx) response body, for the OpenAPI document; not sent to MCP clients. */
+    responseSchema?: Record<string, unknown>;
 }
 export declare const OPERATIONS: OperationDef[];