Release/11.14.0

.gitattributes

@@ -1 +1,14 @@
+# Enforce LF line endings in the repository for text sources.
+# `text=auto` lets Git normalize newly-committed/edited content to LF without
+# retroactively flagging existing CRLF blobs (progressive convergence, no bulk
+# renormalization). Only text extensions are listed so binaries/assets are never touched.
+*.ts    text=auto eol=lf
+*.js    text=auto eol=lf
+*.css   text=auto eol=lf
+*.scss  text=auto eol=lf
+*.json  text=auto eol=lf
+*.html  text=auto eol=lf
+*.md    text=auto eol=lf
+
+# Git LFS for assets — kept as-is.
 src/assets/ filter=lfs diff=lfs merge=lfs -text

.github/workflows/deploy-private.yml

@@ -62,4 +62,3 @@ jobs:
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v1
-

.gitignore

@@ -82,6 +82,7 @@ docusaurus/node_modules/*
 
 # Insight configuration
 proxy.conf.insight.json
+proxy.conf.spfx.json
 /src/environments/environment.insight.ts
 /src/assets/i18n/multi-selection-toolbar
 /src/assets/i18n/custom-elements
@@ -100,3 +101,6 @@ proxy.conf.insight.json
 /src/assets/i18n/agt-saved-chats
 /src/assets/i18n/agt-search
 /src/assets/i18n/agt-settings
+
+/src/assets/i18n/navbar-tabs
+/src/assets/i18n/agt-enterprise-search

.oxfmtrc.json

@@ -1,21 +1,21 @@
-{
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "embeddedLanguageFormatting": "off",
-  "experimentalTailwindcss": {
-    "attributes": ["class"],
-    "functions": ["tv", "cva", "cn"],
-    "preserveWhitespace": true
-  },
-  "tabWidth": 2,
-  "useTabs": false,
-  "singleQuote": false,
-  "semi": true,
-  "bracketSpacing": true,
-  "arrowParens": "avoid",
-  "trailingComma": "none",
-  "bracketSameLine": true,
-  "printWidth": 160,
-  "endOfLine": "crlf",
-  "experimentalSortPackageJson": false,
-  "ignorePatterns": ["src/assets/vendors/**/*", "*.html"]
-}
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "embeddedLanguageFormatting": "off",
+  "experimentalTailwindcss": {
+    "attributes": ["class"],
+    "functions": ["tv", "cva", "cn"],
+    "preserveWhitespace": true
+  },
+  "tabWidth": 2,
+  "useTabs": false,
+  "singleQuote": false,
+  "semi": true,
+  "bracketSpacing": true,
+  "arrowParens": "avoid",
+  "trailingComma": "none",
+  "bracketSameLine": true,
+  "printWidth": 160,
+  "endOfLine": "lf",
+  "experimentalSortPackageJson": false,
+  "ignorePatterns": ["src/assets/vendors/**/*", "*.html"]
+}

.prettierrc

@@ -16,7 +16,7 @@
   "trailingComma": "none",
   "bracketSameLine": true,
   "printWidth": 160,
-  "endOfLine": "crlf",
+  "endOfLine": "lf",
   "overrides": [
     {
       "files": ["*.html"],

SECURITY-NOTES.md

@@ -0,0 +1,87 @@
+# Security notes
+
+Accepted dependency risks, with the analysis behind each decision. Use this file to
+justify dismissing the matching Dependabot alerts.
+
+## Accepted: `brace-expansion` DoS in `docusaurus/`
+
+- **Advisory**: [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg)
+  (CVE-2026-14257) — DoS via unbounded expansion length causing an out-of-memory
+  process crash. Severity: high. Affected range: `brace-expansion <= 5.0.7`.
+- **Scope**: `docusaurus/` only. The root workspace is clean (`npm audit` → 0).
+- **Reported count**: 20 high alerts, all of which are the same single root cause
+  surfacing through the `@docusaurus/*` dependency graph.
+
+### Affected chains
+
+```
+brace-expansion@1.1.x
+└── minimatch@3.1.5
+    ├── serve-handler@6.1.7        ← dependency of @docusaurus/core
+    │   └── @docusaurus/core       ← and transitively every @docusaurus/plugin-* and theme-*
+    └── docusaurus-lunr-search@3.6.1
+```
+
+### Why it cannot be fixed
+
+1. **No upstream fix exists.** `serve-handler@6.1.7` is the latest published version
+   and hard-pins `minimatch: 3.1.5` (an exact version, not a range).
+   `@docusaurus/core` still depends on `serve-handler: ^6.1.7` up to and including
+   3.10.2, the current latest. `docusaurus-lunr-search@3.6.1` requires
+   `minimatch: ^3.1.2`.
+
+2. **Overriding `minimatch` breaks at runtime.** Both consumers use the v3
+   default-function API:
+
+   ```js
+   const minimatch = require('minimatch');
+   minimatch(resolvedPath, slashed);
+   ```
+
+   From `minimatch@9` onwards the CommonJS build exports a namespace object rather
+   than a callable function (`typeof require('minimatch') === 'object'`, keys:
+   `minimatch`, `sep`, `GLOBSTAR`, `filter`, …). Forcing `minimatch >= 9` therefore
+   raises `minimatch is not a function` on the first call.
+
+3. **Overriding `brace-expansion` to a maintenance release does not help.** The
+   `1.1.16` / `2.1.2` tarballs do ship a patched `dist/commonjs/index.js`, but that
+   file is dead code: both packages declare `main: index.js` and no `exports` field,
+   so `require('brace-expansion')` resolves the legacy `index.js`, which still has
+   `max = Infinity` and no `maxLength` cap. They remain genuinely vulnerable, and
+   they stay inside the advisory range. npm's "No fix available" is accurate.
+
+   The fix only exists in `brace-expansion@5.0.8`, whose CommonJS build exports a
+   *named* `expand` — incompatible with the `minimatch@3` call site, which expects a
+   default function export.
+
+### Why it is not exploitable here
+
+- **Build-time only.** The glob patterns fed to `minimatch` come from our own
+  `docusaurus.config.js` / `docusaurus.internal.config.js` and from the repository's
+  own file paths. There is no attacker-controlled input reaching the parser.
+- **The published artefact is a static site.** `npm run docs:build` emits plain
+  HTML/CSS/JS; neither `brace-expansion` nor `minimatch` ships in it.
+- **`serve-handler` never runs in production.** It backs the local `docusaurus serve`
+  preview command only; the deployed docs are served by the hosting platform.
+- Worst case is a crash of a local build process on input we author ourselves.
+
+### Re-examine when
+
+- `serve-handler` publishes a release depending on `minimatch >= 10`, **or**
+- `@docusaurus/core` drops `serve-handler` for another static file server, **or**
+- `docusaurus-lunr-search` bumps its `minimatch` range (this alone is not enough —
+  `serve-handler` would still keep the alerts open).
+
+Re-run `npm audit` in `docusaurus/` after any `@docusaurus/*` major upgrade to check
+whether the chain has been broken upstream.
+
+## Root workspace: overrides kept for security
+
+`package.json` carries three security-motivated `overrides`. Each should be removed
+once upstream catches up:
+
+| Override | Reason | Remove when |
+|---|---|---|
+| `@hono/node-server: ">=2.0.5 <3"` | [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9) — path traversal in `serve-static`. `@modelcontextprotocol/sdk` caps the range at `^1.19.9`, so `npm audit fix` can never reach the patched version. Note the flaw is unreachable in practice: the SDK only imports `serve` and `getRequestListener`, never `serve-static`. | `@modelcontextprotocol/sdk` widens its range to `^2` |
+| `@jsverse/transloco: "^8.4.0"` | `@sinequa/atomic-angular@1.10.0` declares `@jsverse/transloco: ^7.6.1` as a hard dependency, and transloco 7 pulls in the vulnerable `glob`/`replace-in-file` chain. Without this override npm installs a second, nested transloco 7 instance, which breaks Angular DI (two distinct `TranslocoService` instances). | `@sinequa/atomic-angular` ships a release depending on `@jsverse/transloco: ^8` |
+| `@jsverse/transloco-scoped-libs: { "glob": "^13.0.6" }` | `@jsverse/transloco-scoped-libs@8.4.0` still depends on `glob: ^10.3.3` → `minimatch@9` → `brace-expansion@2.1.2`. Its single call site is `glob(pattern)`, whose signature is unchanged in v13. | `@jsverse/transloco-scoped-libs` bumps to `glob@13` |

angular.json

@@ -4,7 +4,10 @@
   "newProjectRoot": "projects",
   "cli": {
     "schematicCollections": ["@angular-eslint/schematics"],
-    "analytics": false
+    "analytics": false,
+    "cache": {
+      "enabled": false
+    }
   },
   "projects": {
     "sinequa-mint": {
@@ -106,6 +109,55 @@
               "optimization": false,
               "extractLicenses": false,
               "sourceMap": true
+            },
+            "spfx": {
+              "tsConfig": "tsconfig.spfx.json",
+              "optimization": false,
+              "extractLicenses": false,
+              "sourceMap": true,
+              "fileReplacements": [
+                {
+                  "replace": "src/main.ts",
+                  "with": "src/main.spfx.ts"
+                },
+                {
+                  "replace": "src/config/interceptors/http-interceptors.ts",
+                  "with": "src/config/spfx/http-interceptors.spfx.ts"
+                }
+              ]
+            },
+            "spfx-production": {
+              "tsConfig": "tsconfig.spfx.json",
+              "optimization": true,
+              "extractLicenses": true,
+              "sourceMap": false,
+              "outputHashing": "none",
+              "budgets": [
+                {
+                  "type": "initial",
+                  "maximumWarning": "3mb",
+                  "maximumError": "5mb"
+                },
+                {
+                  "type": "anyComponentStyle",
+                  "maximumWarning": "2kb",
+                  "maximumError": "4kb"
+                }
+              ],
+              "fileReplacements": [
+                {
+                  "replace": "src/main.ts",
+                  "with": "src/main.spfx.ts"
+                },
+                {
+                  "replace": "src/config/interceptors/http-interceptors.ts",
+                  "with": "src/config/spfx/http-interceptors.spfx.ts"
+                },
+                {
+                  "replace": "src/environments/environment.ts",
+                  "with": "src/environments/environment.spfx.production.ts"
+                }
+              ]
             }
           },
           "defaultConfiguration": "production"
@@ -130,6 +182,11 @@
               "buildTarget": "sinequa-mint:build:development",
               "ssl": true,
               "proxyConfig": "proxy.conf.json"
+            },
+            "spfx": {
+              "buildTarget": "sinequa-mint:build:spfx",
+              "ssl": true,
+              "proxyConfig": "proxy.conf.spfx.json"
             }
           },
           "defaultConfiguration": "development"

biome.json

@@ -1,60 +1,61 @@
-{
-  "$schema": "https://biomejs.dev/schemas/2.3.14/schema.json",
-  "vcs": {
-    "enabled": true,
-    "clientKind": "git",
-    "useIgnoreFile": true
-  },
-  "files": {
-    "ignoreUnknown": true,
-    "includes": ["src/**/*.{js,ts,html,scss,css,json}"]
-  },
-  "formatter": {
-    "enabled": true,
-    "indentStyle": "space",
-    "indentWidth": 2,
-    "lineWidth": 160,
-    "formatWithErrors": true
-  },
-  "linter": {
-    "enabled": true,
-    "rules": {
-      "recommended": true,
-      "style": {
-        "useImportType": "off"
-      },
-      "correctness": {
-        "noUnknownTypeSelector": "warn"
-      }
-    }
-  },
-  "javascript": {
-    "formatter": {
-      "quoteStyle": "double",
-      "trailingCommas": "none"
-    }
-  },
-  "assist": {
-    "enabled": true,
-    "actions": {
-      "source": {
-        "organizeImports": "on"
-      }
-    }
-  },
-  "css": {
-    "parser": {
-      "tailwindDirectives": true
-    }
-  },
-  "html": {
-    "parser": {
-      "interpolation": true
-    }
-  },
-  "json": {
-    "formatter": {
-      "enabled": true
-    }
-  }
-}
+{
+  "$schema": "https://biomejs.dev/schemas/2.3.14/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "ignoreUnknown": true,
+    "includes": ["src/**/*.{js,ts,html,scss,css,json}"]
+  },
+  "formatter": {
+    "enabled": true,
+    "lineEnding": "lf",
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 160,
+    "formatWithErrors": true
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "style": {
+        "useImportType": "off"
+      },
+      "correctness": {
+        "noUnknownTypeSelector": "warn"
+      }
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "trailingCommas": "none"
+    }
+  },
+  "assist": {
+    "enabled": true,
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
+  },
+  "html": {
+    "parser": {
+      "interpolation": true
+    }
+  },
+  "json": {
+    "formatter": {
+      "enabled": true
+    }
+  }
+}