murmur-rag 1.3.1 → 2.1.0

package/dist/lib/chunks/{index-4ftk20yq.js → index-ekxks9vp.js}

@@ -1,5 +1,6 @@
 import {
   cleanAnswer2,
+  citedSources2,
   passageHref2
 } from "./index-b77xqap3.js";
 var __chunkGraphs;
@@ -403,8 +404,6 @@ class ChatSession {
       return "custom";
     if (m === "proxy" || m === "auto" && this.options.llm?.endpoint)
       return "proxy";
-    if ((m === "auto" || m === "key") && this.options.llm?.apiKey)
-      return "owner";
     if (m === "local")
       return "local";
     if (m === "key" || !this.localAllowed)
@@ -417,13 +416,13 @@ class ChatSession {
       return false;
     if (m === "local")
       return true;
-    return !this.options.llm?.endpoint && !this.options.llm?.apiKey && this.options.local !== false;
+    return !this.options.llm?.endpoint && this.options.local !== false;
   }
   get keyAllowed() {
     const m = this.configured;
     if (this.options.model || m === "proxy" || m === "local")
       return false;
-    return !this.options.llm?.endpoint && !this.options.llm?.apiKey;
+    return !this.options.llm?.endpoint;
   }
   get localState() {
     return this.local;
@@ -464,7 +463,7 @@ class ChatSession {
   async settleChoice() {
     if (!this.localAllowed || !this.keyAllowed || readLocal(`${this.key}-local`) !== null)
       return;
-    const [{ isConfigured }, store] = await Promise.all([(__preload("xreqcp1t"), import("../llm/index.js")), this.store()]);
+    const [{ isConfigured }, store] = await Promise.all([(__preload("vb9smwta"), import("../llm/index.js")), this.store()]);
     const saved = await store.load();
     if (saved && isConfigured(saved))
       writeLocal(`${this.key}-local`, "0");
@@ -495,7 +494,7 @@ class ChatSession {
     this.persist();
   }
   store() {
-    this.storePromise ??= (__preload("xreqcp1t"), import("../llm/index.js")).then((llm) => {
+    this.storePromise ??= (__preload("vb9smwta"), import("../llm/index.js")).then((llm) => {
       const opts = {};
       if (this.options.catalogUrl)
         opts.catalogUrl = this.options.catalogUrl;
@@ -509,12 +508,10 @@ class ChatSession {
     const mode = this.mode;
     if (mode === "custom" || mode === "local")
       return null;
-    const llm = await (__preload("xreqcp1t"), import("../llm/index.js"));
+    const llm = await (__preload("vb9smwta"), import("../llm/index.js"));
     const config = this.options.llm ?? {};
     if (mode === "proxy")
       return llm.proxySettings(config);
-    if (mode === "owner")
-      return llm.ownerKeySettings(config, this.options.catalogUrl);
     return llm.resolveSettings({ ...config, endpoint: "" }, await this.store());
   }
   async needsSetup() {
@@ -557,7 +554,7 @@ class ChatSession {
         const settings = await this.settings();
         if (!settings)
           throw new SetupNeeded2;
-        const { loadModel } = await (__preload("xreqcp1t"), import("../llm/index.js"));
+        const { loadModel } = await (__preload("vb9smwta"), import("../llm/index.js"));
         return loadModel(settings);
       });
       const opts = {
@@ -621,7 +618,7 @@ class ChatSession {
       return `local-${error.code ?? "load"}|${error.message}`;
     }
     try {
-      const { describeError } = await (__preload("xreqcp1t"), import("../llm/index.js"));
+      const { describeError } = await (__preload("vb9smwta"), import("../llm/index.js"));
       const settings = this.mode === "custom" || this.mode === "local" ? null : await this.settings();
       const info = describeError(error, settings?.apiKey);
       return `${info.code}|${info.message}`;
@@ -1154,14 +1151,17 @@ class MurmurChat2 extends Base {
       return;
     }
     const passages = turn.passages ?? [];
+    const content = cleanAnswer2(turn.content);
+    const order = citedSources2(content, passages.length);
+    const label = (n) => order.indexOf(n) + 1;
     const body = el(doc, "div");
-    renderMarkdown2(body, cleanAnswer2(turn.content), (n) => {
+    renderMarkdown2(body, content, (n) => {
       const p = passages[n - 1];
-      if (!p)
+      if (!p || !label(n))
         return null;
       const a = el(doc, "a", { class: "cite", href: passageHref2(p) });
-      a.textContent = String(n);
-      a.setAttribute("aria-label", `${this.t.sources} ${n}: ${p.title}`);
+      a.textContent = String(label(n));
+      a.setAttribute("aria-label", `${this.t.sources} ${label(n)}: ${p.title}`);
       return a;
     });
     const parts = [body];
@@ -1170,7 +1170,7 @@ class MurmurChat2 extends Base {
       status.append(el(doc, "span", { class: "lamp off", "aria-hidden": "true" }), doc.createTextNode(this.t.notFound));
       parts.push(status);
     }
-    const cited = turn.cited ?? [];
+    const cited = order;
     if (finished && cited.length) {
       parts.push(text(doc, "p", this.t.sources, "sources-label"));
       const list = el(doc, "ol", { class: "sources" });
@@ -1180,7 +1180,7 @@ class MurmurChat2 extends Base {
           continue;
         const li = el(doc, "li");
         const a = el(doc, "a", { href: passageHref2(p) });
-        const ring = text(doc, "span", String(n), "cite");
+        const ring = text(doc, "span", String(label(n)), "cite");
         ring.setAttribute("aria-hidden", "true");
         const where = el(doc, "span", { class: "where" });
         where.append(doc.createTextNode(p.title || p.url));

package/dist/lib/embed.js

@@ -1,8 +1,8 @@
 import {
   __chunks,
   mountMurmur2
-} from "./chunks/index-4ftk20yq.js";
-__chunks(import.meta.url,["n035jphv","4ftk20yq","t36hd4vt","wxshtnm0","dj4321kh","xreqcp1t","qfx1tgz2","kaeec41p","b77xqap3","8h9c8ekq","p86sy3y4","1zk822m5"],[["./embed.js",1],["./chunks/index-4ftk20yq.js",8],["./chunks/murmur-t36hd4vt.js",9,10],["./chunks/retriever-wxshtnm0.js",10],["./indexer/index.js",11],["./llm/index.js"],["./local/index.js"],["./chunks/chunk-kaeec41p.js",11],["./chunks/index-b77xqap3.js"],["./chunks/index-8h9c8ekq.js",10,8],["./chunks/index-p86sy3y4.js",8],["./chunks/index-1zk822m5.js"]],0);
+} from "./chunks/index-ekxks9vp.js";
+__chunks(import.meta.url,["mas10d36","ekxks9vp","t36hd4vt","wxshtnm0","dj4321kh","vb9smwta","qfx1tgz2","kaeec41p","b77xqap3","8h9c8ekq","p86sy3y4","1zk822m5"],[["./embed.js",1],["./chunks/index-ekxks9vp.js",8],["./chunks/murmur-t36hd4vt.js",9,10],["./chunks/retriever-wxshtnm0.js",10],["./indexer/index.js",11],["./llm/index.js"],["./local/index.js"],["./chunks/chunk-kaeec41p.js",11],["./chunks/index-b77xqap3.js"],["./chunks/index-8h9c8ekq.js",10,8],["./chunks/index-p86sy3y4.js",8],["./chunks/index-1zk822m5.js"]],0);
 
 // src/embed.ts
 function optionsFromDataset(data, base) {
@@ -16,8 +16,8 @@ function optionsFromDataset(data, base) {
     llm.model = data.model;
   if (data.endpoint)
     llm.endpoint = data.endpoint;
-  if (data.apiKey)
-    llm.apiKey = data.apiKey;
+  if (data.apiKey && typeof console !== "undefined")
+    console.error('murmur: data-api-key is ignored: a key in the page can be read by anyone. Keep it in a Worker (data-endpoint), run the model in the browser (data-mode="local"), or let visitors use their own key.');
   if (Object.keys(llm).length)
     o.llm = llm;
   if (data.instructions)

package/dist/lib/llm/index.js

@@ -2,11 +2,8 @@
 import {
   createLlmSettingsStore,
   DEFAULT_RECOMMENDED,
-  defaultModelOf,
   isConfigured,
   liveCatalog,
-  loadCatalog,
-  providerMeta,
   secureStorage,
   validateEndpoint
 } from "llm-connect";
@@ -26,25 +23,6 @@ function proxySettings(config) {
     settings.headers = config.headers;
   return settings;
 }
-var warned = false;
-async function ownerKeySettings(config, catalogUrl = DEFAULT_CATALOG_URL) {
-  if (!config.apiKey)
-    return null;
-  if (!warned && typeof console !== "undefined") {
-    warned = true;
-    console.warn("murmur: the API key in this page can be read by anyone. Use a key with a spending limit, or a proxy (data-endpoint).");
-  }
-  const providerId = config.provider || "openai";
-  const catalog = await loadCatalog(catalogUrl);
-  const meta = providerMeta(catalog, providerId);
-  if (!meta)
-    throw new Error(`murmur: unknown provider "${providerId}"`);
-  const model = config.model || defaultModelOf(catalog[providerId]) || "";
-  const settings = { apiKey: config.apiKey, model, ...meta };
-  if (config.headers)
-    settings.headers = config.headers;
-  return settings;
-}
 function visitorStore(config, options = {}) {
   const key = options.storageKey ?? "murmur";
   const defaults = {};
@@ -71,7 +49,6 @@ export {
   describeError,
   isConfigured2 as isConfigured,
   loadModel,
-  ownerKeySettings,
   proxySettings,
   resolveSettings,
   visitorStore

package/dist/lib/widget/index.js

@@ -8,8 +8,8 @@ import {
   MurmurChat2,
   defineMurmurChat2,
   mountMurmur2
-} from "../chunks/index-4ftk20yq.js";
-__chunks(import.meta.url,["kaf6n93p","4ftk20yq","t36hd4vt","wxshtnm0","dj4321kh","xreqcp1t","qfx1tgz2","kaeec41p","b77xqap3","8h9c8ekq","p86sy3y4","1zk822m5"],[["./index.js",1],["../chunks/index-4ftk20yq.js",8],["../chunks/murmur-t36hd4vt.js",9,10],["../chunks/retriever-wxshtnm0.js",10],["../indexer/index.js",11],["../llm/index.js"],["../local/index.js"],["../chunks/chunk-kaeec41p.js",11],["../chunks/index-b77xqap3.js"],["../chunks/index-8h9c8ekq.js",10,8],["../chunks/index-p86sy3y4.js",8],["../chunks/index-1zk822m5.js"]],0);
+} from "../chunks/index-ekxks9vp.js";
+__chunks(import.meta.url,["mm7xk878","ekxks9vp","t36hd4vt","wxshtnm0","dj4321kh","vb9smwta","qfx1tgz2","kaeec41p","b77xqap3","8h9c8ekq","p86sy3y4","1zk822m5"],[["./index.js",1],["../chunks/index-ekxks9vp.js",8],["../chunks/murmur-t36hd4vt.js",9,10],["../chunks/retriever-wxshtnm0.js",10],["../indexer/index.js",11],["../llm/index.js"],["../local/index.js"],["../chunks/chunk-kaeec41p.js",11],["../chunks/index-b77xqap3.js"],["../chunks/index-8h9c8ekq.js",10,8],["../chunks/index-p86sy3y4.js",8],["../chunks/index-1zk822m5.js"]],0);
 export {
   MESSAGES2 as MESSAGES,
   MurmurChat2 as MurmurChat,

package/dist/types/llm/index.d.ts

@@ -13,19 +13,11 @@ export interface LlmConfig {
     endpoint?: string;
     /** Extra headers sent to the proxy. */
     headers?: Record<string, string>;
-    /**
-     * The owner's own key, used for every visitor with `provider` and `model`. It is in the page,
-     * so anyone can read it: only a key with a spending limit (OpenRouter, a restricted project
-     * key), or prefer a proxy that keeps it secret.
-     */
-    apiKey?: string;
 }
 /** Where the catalog falls back to when models.dev or OpenRouter cannot be reached. */
 export declare const DEFAULT_CATALOG_URL = "https://maxgfr.github.io/murmur/cdn/models.json";
 /** Settings calling the owner's proxy, or null when there is no (valid) proxy. */
 export declare function proxySettings(config: LlmConfig): LlmSettings | null;
-/** Settings that call the provider with the owner's key, or null when there is none. */
-export declare function ownerKeySettings(config: LlmConfig, catalogUrl?: string): Promise<LlmSettings | null>;
 export interface VisitorStoreOptions {
     /** Fallback catalog URL. Default {@link DEFAULT_CATALOG_URL}. */
     catalogUrl?: string;

package/dist/types/widget/session.d.ts

@@ -31,10 +31,10 @@ export interface WidgetOptions {
     /** Open the panel on load. */
     open?: boolean;
     /**
-     * How the widget answers. `auto` (default): the owner's proxy or key if set, else the model in
-     * the visitor's browser with their own key as an option. `proxy`: only `llm.endpoint`. `local`:
-     * only the in-browser model, no key settings. `key`: only a key, the owner's `llm.apiKey` or
-     * else each visitor's own.
+     * How the widget answers, never with a key in the page. `auto` (default): the owner's proxy if
+     * set, else the model in the visitor's browser with their own key as an option. `proxy`: only
+     * `llm.endpoint`. `local`: only the in-browser model, no key settings. `key`: only each
+     * visitor's own key.
      */
     mode?: WidgetMode;
     /**
@@ -64,7 +64,7 @@ export interface LocalState {
     status: "idle" | "loading" | "ready" | "error";
     progress?: LoadProgress;
 }
-type Mode = "custom" | "local" | "owner" | "proxy" | "visitor";
+type Mode = "custom" | "local" | "proxy" | "visitor";
 /** Everything the widget does except drawing: index, model settings, history. */
 export declare class ChatSession {
     readonly options: WidgetOptions;
@@ -78,8 +78,8 @@ export declare class ChatSession {
     constructor(options: WidgetOptions);
     private get configured();
     /**
-     * How this session answers: your own model; then the owner's proxy, then the owner's key;
-     * then the visitor's own key if they chose one; else the model in the browser.
+     * How this session answers: your own model; then the owner's proxy; then the visitor's own
+     * key if they chose one; else the model in the browser.
      */
     get mode(): Mode;
     /** Whether the in-browser model is offered at all. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "murmur-rag",
-  "version": "1.3.1",
+  "version": "2.1.0",
   "description": "Embeddable AI chat for static sites: one script tag, a mini RAG over your own pages, any LLM through llm-connect (your proxy or the visitor's own key). No backend.",
   "author": "maxgfr",
   "license": "MIT",

package/dist/cdn/chunk-xyp6nm65.js

@@ -1 +0,0 @@
-import{St,gt,kn,Ct,Tn}from"./embed-q81wdr1z.js";export{St as MAX_CHUNK,Ct as buildIndex,Tn as isMurmurIndex,kn as markdownSections,gt as slugify};