docula 1.14.0 → 2.1.0

package/README.md

@@ -11,7 +11,7 @@
 # Features
 * No configuration required. Just setup the folder structure with a logo, favicon, and css file.
 * Builds a static website that can be hosted anywhere.
-* Simple search is provided by default out of the box.
+* Built-in, fully client-side search (⌘K / Ctrl K) with a keyboard-navigable modal and deep links to matching headings — no external service required.
 * Support for single page with readme or multiple markdown pages in a docs folder.
 * Full TypeScript support with typed configuration and IDE autocompletion.
 * For more complex projects easily add a `docula.config.ts` (TypeScript) or `docula.config.mjs` (JavaScript) file to customize the build process with lifecycle hooks and `DoculaConsole` logging.
@@ -48,6 +48,7 @@
 - [Standalone Binary](#standalone-binary)
 - [Open Source Examples](#open-source-examples)
 - [Code of Conduct and Contributing](#code-of-conduct-and-contributing)
+- [Security](#security)
 - [License - MIT](#license)
 
 # Standalone Binary
@@ -56,7 +57,7 @@ You can build Docula as a standalone binary that runs without Node.js installed.
 
 ## Building the Binary
 
-Requires Node.js >= 20 to build (the resulting binary does not need Node.js to run).
+Requires Node.js >= 25.7.0 to build (the resulting binary does not need Node.js to run). The build uses [tsdown's `exe` option](https://tsdown.dev/options/exe), which wraps Node.js's [Single Executable Applications](https://nodejs.org/api/single-executable-applications.html) feature added in Node 25.7.
 
 ```bash
 pnpm install
@@ -69,7 +70,7 @@ This produces a platform-specific binary at `dist/docula` (or `dist/docula.exe`
 
 1. Embeds all built-in templates (modern, classic) into the bundle as base64
 2. Bundles all source code and dependencies into a single CJS file via [tsdown](https://tsdown.dev/)
-3. Uses tsdown's built-in `exe` option to create a Node.js SEA binary (blob generation, injection, and code signing are handled automatically)
+3. Uses tsdown's built-in `exe` option to create a Node.js SEA binary — blob generation, injection, and (on macOS hosts) ad-hoc code signing are handled automatically
 
 ## Testing the Binary
 
@@ -91,13 +92,12 @@ After building, test it locally:
 
 ## Cross-Platform Binaries
 
-Node.js SEA cannot cross-compile — the binary matches the OS and architecture it was built on. The CI workflow (`.github/workflows/build-binaries.yaml`) builds for all platforms using a matrix strategy:
+The CI workflow (`.github/workflows/build-binaries.yaml`) builds each platform natively on its own runner. Native builds avoid the cross-compile signing pitfall on Apple Silicon, where unsigned Mach-O binaries are killed on launch.
 
 | Platform | Runner | Artifact |
 |---|---|---|
 | Linux x64 | `ubuntu-latest` | `docula-linux-x64` |
 | macOS ARM64 | `macos-latest` | `docula-macos-arm64` |
-| macOS x64 | `macos-13` | `docula-macos-x64` |
 | Windows x64 | `windows-latest` | `docula-windows-x64` |
 
 Binaries are uploaded as build artifacts on every run and attached to GitHub releases automatically.
@@ -113,5 +113,19 @@ See Docula in action with these open source projects that use it for their docum
 # Code of Conduct and Contributing
 [Code of Conduct](CODE_OF_CONDUCT.md) and [Contributing](CONTRIBUTING.md) guidelines.
 
+# Security
+We take the security of Docula seriously and have multiple layers of protection in place:
+
+- **Aikido Security**: Continuous scanning of our codebase, dependencies, and infrastructure for vulnerabilities. Review our public audit report by clicking the badge above.
+- **Pull Request Scans**: Every pull request against `main` is automatically scanned for security issues before merging.
+- **CodeQL Analysis**: GitHub CodeQL static analysis runs on every push and pull request targeting `main`.
+- **npm Package Provenance**: Releases are published with [npm provenance](https://docs.npmjs.com/generating-provenance-statements) for cryptographically verifiable links to source and build.
+
+<a href="https://app.aikido.dev/audit-report/external/lZAT2DfBsT11ZQfpYwClKi6s/request" target="_blank" rel="noopener noreferrer">
+    <img src="https://app.aikido.dev/assets/badges/full-light-theme.svg" alt="Aikido Security Audit Report" height="40" />
+</a>
+
+For full details, see [SECURITY.md](SECURITY.md) or our [Security Guidelines](https://docula.org/docs/project-guidelines/security/).
+
 # License
 MIT © [Jared Wray](https://jaredwray.com)

package/dist/docula.d.ts

@@ -203,6 +203,7 @@ type DoculaData = {
   googleTagManager?: string;
   isGtag?: boolean;
   enableLlmsTxt?: boolean;
+  enableSearch?: boolean;
   hasFeed?: boolean;
   lastModified?: string;
   homeUrl?: string;
@@ -215,6 +216,7 @@ type DoculaData = {
   changelogUrl: string;
   editPageUrl?: string;
   openGraph?: DoculaOpenGraph;
+  faviconUrl?: string;
 };
 type DoculaTemplates = {
   home: string;
@@ -345,6 +347,11 @@ declare class DoculaOptions {
    * When true, generates llms.txt and llms-full.txt files for the built site.
    */
   enableLlmsTxt: boolean;
+  /**
+   * When true, generates a search index (search-index.json) and renders the
+   * search UI in templates that support it. Set to false to disable search.
+   */
+  enableSearch: boolean;
   /**
    * Override the default theme toggle. By default the site follows the system
    * preference. Set to "light" or "dark" to use that theme when no user
@@ -468,6 +475,7 @@ declare class DoculaBuilder {
   buildChangelogFeedJson(data: DoculaData): Promise<void>;
   buildChangelogLatestFeedJson(data: DoculaData): Promise<void>;
   buildLlmsFiles(data: DoculaData): Promise<void>;
+  buildSearchIndex(data: DoculaData): Promise<void>;
   resolveOpenGraphData(data: DoculaData, pageUrl: string, pageData?: Partial<DoculaDocument> & {
     previewImage?: string;
     preview?: string;