docmd-search@0.1.3

Offline semantic search engine for documentation with local vector embeddings and browser-ready search indexes.

Dependency Metadata & Peer Security Constraints

• Enforced Minimum Peer Dependency Ranges: Added explicit minimum peer dependency version constraints for underlying binary and utility modules (sharp >=0.35.0, adm-zip >=0.6.0, protobufjs >=7.6.5, onnxruntime-node >=1.27.0).
• Clean Audit Assurance: Resolves transitive audit warnings when installed in end-user applications without requiring custom "overrides" blocks in the user's package.json.

Installation

npm install docmd-search@0.1.3

Full Changelog: 0.1.2...0.1.3

docmd-search@0.1.2 🛡️ (Security Update)

Offline semantic search engine for documentation with local vector embeddings and browser-ready search indexes.

Security & Dependency Updates

• Patched Dependency Vulnerabilities: Resolved all 5 reported security vulnerabilities (0 vulnerabilities in npm audit).
  • Upgraded protobufjs to ^7.6.5 (mitigating DoS in .proto option parsing).
  • Enforced adm-zip to ^0.6.0 via overrides (patching 4GB memory allocation vulnerability).
  • Upgraded sharp to ^0.35.0 via overrides (resolving inherited libvips security advisories).
• Node.js Engine Minimum: Standardised engines.node requirement to >=20.0.0.
• GitHub Actions Runners: Updated CI workflows (.github/workflows/*.yml) to use Node 24.

Installation

npm install docmd-search@0.1.2

Usage Example

import { createSearchIndex, searchDocumentation } from 'docmd-search';

// Generate offline vector embeddings index
const index = await createSearchIndex({
  docsDir: './docs'
});

// Perform local semantic query
const results = await searchDocumentation(index, 'How to configure custom domain');
console.log(results);

Full Changelog: 0.1.1...0.1.2

docmd-search@0.1.0 🛡️ (Security + Model Caching + Incremental Indexing)

The v0.1.1 release of docmd-search focuses on security hardening, sanitisation of dynamic file path generation, and secure execution of child processes.

What's in This Release

Security Hardening

• Secure Child Process Spawning (CWE-78 mitigation):
  • Replaced shell-based exec calls with direct, non-shell execution using execFile and execFileAsync via argument arrays when checking git status --porcelain.
  • Replaced shell-based execSync with execFileSync when discovering the global docmd CLI path, ensuring no shell expansion is performed.
• Dynamic Config Path Sanitisation (CWE-94 mitigation):
  • Sanitised directory paths interpolated into the generated web UI configuration (docmd.config.json) using JSON.stringify to prevent breakout vulnerability vectors.
• Dynamic Code Evaluation Remediation (CWE-95 mitigation):
  • Removed the new Function('id', 'return import(id)') constructor previously used to import optional peer dependencies dynamically, replacing it with standard ECMA dynamic import() coupled with build-time annotations.
• Deprecation & Warning Clearance:
  • Configured package.json overrides to force onnxruntime-node@1.27.0, resolving the transitive boolean package deprecation warnings.
  • Configured allowScripts in package.json to whitelist required lifecycle binaries (esbuild, onnxruntime-node, protobufjs, sharp) to suppress warnings during installation.

Performance Optimisations

• Model Caching: Added a new keepModelLoaded option to keep the embedding model loaded in memory, eliminating the model-load overhead on subsequent watch/rebuild runs.

Compatibility

Surface	Status
@docmd/plugin-search@>=0.8.14	✓ Optional peer.
@huggingface/transformers@^4.2.0	✓ Optional peer, required for the embedding model.
onnxruntime-node@^1.27.0	✓ Optional peer, required for on-device inference.
Node.js	>=18

Full Changelog: 0.1.0...0.1.1

docmd-search@0.1.0 🚀 (First Test Release)

The first non-alpha release of docmd-search. Bumps from 0.1.0-alpha.1 to 0.1.0, lands on the latest dist-tag, and ships the default exports condition that was missing in the alpha.

🐛 Bug fixes

exports conditions incomplete — require.resolve failed with ERR_PACKAGE_PATH_NOT_EXPORTED

In 0.1.0-alpha.1, the package.json#exports for both . and ./client declared only the import and types conditions. Any tool that used Node's CommonJS resolver — including @docmd/plugin-search's auto-installer, pnpm's hoist layout, and any consumer that built with esbuild's platform: 'node' and format: 'cjs' — hit:

Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: No "exports" main defined in
.../node_modules/docmd-search/package.json

The 0.1.0 fix adds a "default" condition to both subpaths, mirroring the pattern used by every other official package in the @docmd/* scope:

"exports": {
  ".": {
    "import": "./dist/index.js",
    "types": "./dist/index.d.ts",
    "default": "./dist/index.js"
  },
  "./client": {
    "import": "./dist/client/index.js",
    "types": "./dist/client/index.d.ts",
    "default": "./dist/client/index.js"
  }
}

This unblocks:

• @docmd/plugin-search auto-install when plugins.search.semantic = true (the search plugin's peerDependencies: { "docmd-search": ">=0.1.0" } now resolves cleanly).
• pnpm's strict-mode install, which uses CJS require.resolve under the hood for some pre-flight checks.
• Any CJS consumer that imports docmd-search via require('docmd-search').

Dist-tag no longer stuck on alpha

The 0.1.0-alpha.0 release was published with the default latest tag (npm's behaviour when no --tag is given). The follow-up 0.1.0-alpha.1 was tagged alpha, but latest stayed on the older alpha. The published-CI workflow now uses no --tag flag, so all future releases land on latest by default.

✨ New: docmd namespace in package.json

Carries the package's self-description as a docmd key, following the convention introduced in docmd@0.8.9 for @docmd/plugin-* and @docmd/template-* packages. This is metadata-only — it does not change runtime behaviour, but it lets the docmd monorepo's registry generator (scripts/build-plugin-registry.mjs) catalog this package if you ever wire it into the main build.

"docmd": {
  "key": "docmd-search",
  "kind": "search-engine",
  "displayName": "docmd-search",
  "tagline": "Offline semantic search engine for documentation. Local embeddings, browser-ready indexes."
}

Note: the kind is "search-engine", not "plugin" or "engine". The docmd auto-installer recognises the official scope (@docmd/*) but does not auto-install docmd-search — it has to be pulled in explicitly via the search plugin's peerDependencies because the ML stack (@huggingface/transformers, onnxruntime-node) is opt-in.

🔒 Security

No new attack surface. The export-field fix is a strict superset of the previous behaviour — the default condition is only used when neither import nor require matches, which never happens for ESM consumers. No CVE applies.

📦 Compatibility

Surface	Status
@docmd/plugin-search@>=0.8.5	✓ Works as peer dep (>=0.1.0)
@docmd/engine-js@>=0.8.5	✓ Optional peer, used for chunking/quantization
@docmd/engine-rust@>=0.8.5	✓ Optional peer, accelerated chunking/quantization when present
@huggingface/transformers@^4.2.0	✓ Optional peer, required for the embedding model
onnxruntime-node@^1.26.0	✓ Optional peer, required for the on-device inference backend
Node.js	>=18 (matches the rest of the @docmd/* family)
Browser (search client)	Modern browsers with WebAssembly, Atomics, SharedArrayBuffer (cross-origin isolated)

🧪 Verification

The failsafe.js test suite (12+ assertions across indexing, search, manifest round-trip) passes against the published bundle:

$ npm run verify
…
✓ 12 assertions passed across 4 files

Full Changelog: 0.1.0-alpha.1...0.1.0

docmd-search@0.1.0-alpha.1 🌱

Fixes

• Normalise keyword scores to prevent >100% confidence: The hybrid scoring formula combined unnormalized keyword scores with cosine similarity, which could result in scores exceeding 1.0 (100%). This fix normalizes the keyword score using x/(x+1) before combining with the vector similarity score.

Website: https://docmd.io/search/
npmjs: https://www.npmjs.com/package/docmd-search
Documentation: https://docs.docmd.io/search/

Full Changelog: 0.1.0-alpha.0...0.1.0-alpha.1

docmd-search@0.1.0-alpha.0 🌱 (Preview)

We're excited to share the first alpha release of docmd-search.

docmd-search is a semantic search engine built for documentation sites. It runs entirely in the browser, requires no servers or API keys, and keeps all search processing local.

Although created for docmd, it isn't tied to any particular framework. It can be integrated into documentation platforms, websites, and web applications.

This is an early alpha release. APIs, models, and behaviour will continue to evolve as we gather feedback and real-world usage.

What's in This Release

Core Engine

• Local semantic indexing - Generates vector embeddings at build time using Xenova/all-MiniLM-L6-v2, powered by @xenova/transformers
• Browser-side search - Ranking and retrieval happen entirely in the browser using pre-built indexes
• Chunked indexing - Content is split into configurable overlapping chunks to improve search quality on longer pages
• Multi-version support - Documentation versions can be indexed independently and searched together

CLI

docmd-search

Indexes a directory of Markdown files into .docmd-search/.

docmd-search --ui

Launches a standalone search UI using an existing index without rebuilding.

Additional options:

--output
--model
--chunk-size
--chunk-overlap

Search UI Options

Option	Default	Description
semantic	false	Enable semantic search
showConfidence	false	Display confidence percentages on results
showFilters	true	Show the version filter bar
indexDir	-	Use an existing pre-built index

Automatic Fallback

If docmd-search is not installed, @docmd/plugin-search automatically falls back to keyword search. Documentation remains fully searchable without any additional configuration.

Known Limitations

• The default model performs best on English content
• Multilingual models are available but have not yet been tested extensively
• Full re-indexing is currently required when content changes
• The first search may take longer while the browser loads the model and search index
• Browser memory usage typically ranges between 50-100 MB while the model is loaded

What's Next

We're currently exploring:

• Incremental index updates
• Improved multilingual support
• Smaller and quantised model variants
• Additional ranking signals and relevance improvements
• A standalone search UI that can be used outside of docmd

Thanks 💖

A huge thank you to the Transformers.js team for making browser-based language models practical and accessible.

And thank you to everyone who asked for better documentation search, tested early builds, shared feedback, and helped shape the project.

Website: https://docmd.io/search/
npmjs: https://www.npmjs.com/package/docmd-search
Documentation: https://docs.docmd.io/search/

Full Changelog: https://github.com/docmd-io/docmd-search/commits/0.1.0-alpha.0