datanotes 1.4.0 → 1.5.0

package/SECURITY.md

@@ -15,7 +15,11 @@ run on your own machine, for you and the agents you choose.
 
 - The HTTP server listens on `127.0.0.1` unless told otherwise (`--host`). It answers no CORS
   preflight, so web pages cannot call it.
-- Only `GET /` answers without a token (status and version).
+- Only `GET /` (status and version), `GET /datanotes/openapi.json` (the API's description) and
+  `/datanotes/docs` (an interactive console over it, with its script and stylesheet) answer without
+  a token. They contain no data from the vault: the same description is published on the website.
+  The console's page loads nothing from other hosts (Content-Security-Policy: same origin only);
+  its calls need a token, which it keeps in the browser's local storage until you log out.
 - To reach it from outside (a phone, a hosted assistant), publish it through a reverse proxy or a
   tunnel, over HTTPS, and give each device or agent its own app token. Publish the MCP server
   (`datanotes-mcp serve`) the same way: it holds no credentials and passes each agent's token on.

package/dist/api/catalog.d.ts

@@ -15,5 +15,7 @@ export interface OperationDef {
         idempotentHint?: boolean;
         openWorldHint?: boolean;
     };
+    /** JSON Schema of the successful (2xx) response body, for the OpenAPI document; not sent to MCP clients. */
+    responseSchema?: Record<string, unknown>;
 }
 export declare const OPERATIONS: OperationDef[];