docs: audit the docs site against 3.0.0

CHANGELOG.md

@@ -35,7 +35,7 @@ for the steps.
   CI tests 7.x). Without it, the connector's methods reject with code
   `MISSING_DEPENDENCY` and an install hint, and `rag-pipeline init` with
   the openai template prints the install step. A clean install drops from
-  58 MB and 174 packages (2.7.1) to 47 MB and 162 packages. Optional peers
+  58 MB and 188 packages (2.7.1) to 47 MB and 172 packages. Optional peers
   are now always left out of the bundle.
 
 ### Removed
@@ -217,7 +217,7 @@ for the steps.
 ### Fixed
 
 - **`npm install` failed on machines without husky installed globally.**
-  Every release from 2.2.1 to 2.6.1 declared
+  Every release from 2.0.0 to 2.6.1 declared
   `"postinstall": "husky install"`. husky is a development tool that isn't
   installed in users' projects, so installing the package failed with
   `husky: not found` (or `'husky' is not recognized` on Windows) on clean
@@ -792,5 +792,5 @@ For release notes prior to v2.4.0, see
 [2.4.4]: https://github.com/DevilsDev/rag-pipeline-utils/releases/tag/v2.4.4
 [2.4.3]: https://github.com/DevilsDev/rag-pipeline-utils/releases/tag/v2.4.3
 [2.4.2]: https://github.com/DevilsDev/rag-pipeline-utils/releases/tag/v2.4.2
-[2.4.1]: https://github.com/DevilsDev/rag-pipeline-utils/releases/tag/v2.4.1
-[2.4.0]: https://github.com/DevilsDev/rag-pipeline-utils/releases/tag/v2.4.0
+[2.4.1]: https://www.npmjs.com/package/@devilsdev/rag-pipeline-utils/v/2.4.1
+[2.4.0]: https://www.npmjs.com/package/@devilsdev/rag-pipeline-utils/v/2.4.0

README.md

@@ -60,7 +60,7 @@ npm install @devilsdev/rag-pipeline-utils openai
 
 Upgrading from 2.x? The [3.0 migration guide](https://devilsdev.github.io/rag-pipeline-utils/docs/Migration#upgrading-to-v300) lists the changes to make.
 
-> **`npm install` failed with `husky: not found`?** Versions 2.2.1 to 2.6.1 ran a development hook on install. Install 2.6.2 or later: `npm install @devilsdev/rag-pipeline-utils@latest`.
+> **`npm install` failed with `husky: not found`?** Versions 2.0.0 to 2.6.1 ran a development hook on install. Install 2.6.2 or later: `npm install @devilsdev/rag-pipeline-utils@latest`.
 
 ## Quick start
 

docs-site/blog/2025-11-08-enterprise-release.md

@@ -8,6 +8,10 @@ date: "2025-11-08"
 
 RAG Pipeline Utils v2.2.0 Enterprise Edition delivers production-ready infrastructure with advanced AI capabilities, comprehensive observability, and enterprise-grade security features. This release establishes the platform as a complete solution for mission-critical RAG deployments.
 
+<!-- truncate -->
+
+> **Editor's note (2.5.0):** several features described here were simulated or incomplete: multimodal processing, federated learning, adaptive retrieval, model training, plugin certification, SSO, multi-tenancy and data governance. Since 3.0.0 they are exported only from `@devilsdev/rag-pipeline-utils/experimental`. See [Experimental modules](/docs/Experimental) for what each one really does.
+
 ## Enterprise Features
 
 ### Advanced AI Capabilities

docs-site/blog/2025-11-08-security-enhancements-v2.3.1.md

@@ -3,11 +3,15 @@ slug: security-enhancements-v2.3.1
 title: "RAG Pipeline Utils v2.3.1: Advanced Security Enhancements"
 authors: [ali]
 tags: [release, security, jwt, path-traversal, defense-in-depth]
-date: "2025-11-08"
+date: "2025-11-08T12:00"
 ---
 
 RAG Pipeline Utils v2.3.1 delivers advanced security enhancements and production hardening improvements. This patch release includes critical updates to JWT validation, path traversal defense mechanisms, and race condition mitigation.
 
+<!-- truncate -->
+
+> **Editor's note:** in 2.3.1, `sanitizePath`, `InputSanitizer` and `JWTValidator` were internal and not exported from the package. `JWTValidator` is exported since 2.4.0; the path sanitizer is not public. See [Security](/docs/Security) for the current API.
+
 ## Security Enhancements
 
 ### JWT Validation Hardening

docs-site/blog/2025-11-11-securing-production-rag.md

@@ -10,6 +10,8 @@ Production RAG systems handle sensitive data and require comprehensive security
 
 <!--truncate-->
 
+> **Editor's note:** the code in this post is illustrative and does not match the package's API. The JWT class is `JWTValidator` (exported since 2.4.0) with `verify(token)`; prompt-injection checks are `detectInjection()` and `PreRetrievalGuard`; `createRagPipeline` takes component instances such as `new OpenAIConnector()` and `new MemoryRetriever()`. See [Security](/docs/Security) and the [API Reference](/docs/API-Reference) for working examples.
+
 ## The Security Landscape
 
 RAG systems introduce unique security challenges:

docs-site/blog/2025-11-13-comparing-rag-frameworks.md

@@ -10,6 +10,8 @@ Choosing the right RAG framework impacts development speed, performance, and mai
 
 <!--truncate-->
 
+> **Editor's note:** the code in this post is illustrative and does not match the package's API. The JWT class is `JWTValidator` (exported since 2.4.0) with `verify(token)`; prompt-injection checks are `detectInjection()` and `PreRetrievalGuard`; `createRagPipeline` takes component instances such as `new OpenAIConnector()` and `new MemoryRetriever()`. See [Security](/docs/Security) and the [API Reference](/docs/API-Reference) for working examples.
+
 ## Framework Overview
 
 ### LangChain

docs-site/blog/2026-04-07-v2.4.0-release.md

@@ -3,7 +3,7 @@ slug: v2-4-0-release
 title: "RAG Pipeline Utils v2.4.0: The Complete Node.js RAG Toolkit"
 authors: [ali]
 tags: [release, v2.4.0, features]
-date: "2026-04-07"
+date: "2026-04-14"
 ---
 
 RAG Pipeline Utils v2.4.0 is the most significant release yet — transforming the project from a basic RAG toolkit into the most comprehensive Node.js RAG framework available. This release ships 104 public exports, up from 22 in v2.3.1.
@@ -18,15 +18,15 @@ v2.4.0 nearly quintuples the public API surface. Every major RAG concern now has
 
 ### Smart Chunking Engine
 
-Five strategies cover every document type: sentence, fixed-size, recursive, semantic, and structure-aware chunking. Choose the right strategy for your corpus or let the auto-selector pick one for you.
+Five strategies cover every document type: sentence, fixed-size, recursive, semantic, and structure-aware chunking. Choose the right strategy for your corpus; recursive chunking is the default.
 
 ### Citation & Grounding
 
 Source attribution, hallucination detection, and groundedness scoring let you verify that generated answers are actually supported by your retrieved context.
 
 ### RAG Evaluation Framework
 
-Measure pipeline quality with faithfulness, relevance, context precision/recall, and groundedness metrics. Export results to JSON or CSV for offline analysis.
+Measure pipeline quality with faithfulness, relevance, context precision/recall, and groundedness metrics. Export results to JSON for offline analysis.
 
 ### Agentic RAG
 
@@ -62,7 +62,7 @@ Track token usage per request, enforce budget limits, and compare provider prici
 
 ### Provider Connectors
 
-Seven connectors ship out of the box: OpenAI, Anthropic, Cohere, Ollama, LocalEmbedder, MemoryRetriever, and HuggingFace.
+Six components ship out of the box: OpenAI, Anthropic, Cohere and Ollama connectors, LocalEmbedder and MemoryRetriever, plus a plugin registry for custom providers.
 
 ### MCP Integration
 
@@ -80,7 +80,7 @@ npm install @devilsdev/rag-pipeline-utils
 
 ## What's Next
 
-v3.0.0 will focus on intelligent caching, native Rust bindings, a Kubernetes operator, and edge deployment. Follow the [GitHub repository](https://github.com/alikahwaji/rag-pipeline-utils) for updates.
+v3.0.0 will focus on intelligent caching, native Rust bindings, a Kubernetes operator, and edge deployment. Follow the [GitHub repository](https://github.com/DevilsDev/rag-pipeline-utils) for updates.
 
 ---
 

docs-site/blog/2026-10-29-v2.6.2-release.md

@@ -6,7 +6,7 @@ tags: [release, production]
 date: "2026-10-29T12:00"
 ---
 
-v2.6.2 fixes one bug, and it's an important one: on a machine without husky installed globally, `npm install @devilsdev/rag-pipeline-utils` failed. That covers most laptops and every CI runner. Every release from 2.2.1 to 2.6.1 is affected. Please upgrade:
+v2.6.2 fixes one bug, and it's an important one: on a machine without husky installed globally, `npm install @devilsdev/rag-pipeline-utils` failed. That covers most laptops and every CI runner. Every release from 2.0.0 to 2.6.1 is affected. Please upgrade:
 
 ```bash
 npm install @devilsdev/rag-pipeline-utils@latest

docs-site/blog/2026-10-30-v3.0-release.md

@@ -39,25 +39,25 @@ The install is smaller as a result:
 
 | Clean `npm install` |  Size | Packages |
 | ------------------- | ----: | -------: |
-| 2.7.1               | 58 MB |      174 |
-| 3.0.0               | 47 MB |      162 |
+| 2.7.1               | 58 MB |      188 |
+| 3.0.0               | 47 MB |      172 |
 
-Bundling openai 7 for everyone would have meant about 70 MB.
+Bundling openai 7 for everyone would have meant 77 MB.
 
 ### Connection failures are retried again
 
 openai 5 and later use Node's built-in `fetch`, which reports a refused connection one level deeper than before: the socket error now sits inside a `TypeError('fetch failed')`. The connectors' retry check only looked one level down, so with the new SDK a refused connection would have failed on the first attempt. Testing for that also found an older bug: the SDK's connection error classes keep `name: "Error"`, so the check for `APIConnectionTimeoutError` never matched, and timeouts were never retried, on 4.x either. The retry check now matches the error class and walks the cause chain. As a result, a request to an unresponsive OpenAI endpoint is now retried up to `maxRetries` (default 3) before failing; lower it if you'd rather fail fast.
 
 ## Experimental classes leave the main entry
 
-Since 2.5.0, the simulated or incomplete classes (model training, federated learning, multimodal processing, adaptive retrieval, the SSO providers, multi-tenancy, data governance, `PluginSandbox` and `PluginCertification`) have lived in their own entry point and warned when imported from the main one. In 3.0.0 the main entry no longer exports them:
+Since 2.5.0, the simulated or incomplete classes (model training, federated learning, multimodal processing, adaptive retrieval, the SSO providers, multi-tenancy (`TenantManager`, `ResourceMonitor`), data governance, `PluginSandbox` and `PluginCertification`) have lived in their own entry point and warned when constructed or called through the main one. In 3.0.0 the main entry no longer exports them:
 
 ```diff
 - import { TenantManager } from "@devilsdev/rag-pipeline-utils";
 + import { TenantManager } from "@devilsdev/rag-pipeline-utils/experimental";
 ```
 
-To find the imports to change, run your app or tests on 2.7.x with `node --trace-deprecation`: each `RAG_DEP_*` warning shows the line in your code that uses one of them. Both entries share the same classes in 2.x, so you can change the imports before upgrading. Importing the package also no longer loads these modules at all.
+To find the imports to change, search your code for the class names. Running your app or tests on 2.7.x with `node --trace-deprecation` helps too: each `RAG_DEP_*` warning shows the first place your code constructs that class, once per class per run, but an import that is never constructed (or only used for `instanceof`) doesn't warn. Both entries share the same classes in 2.x, so you can change the imports before upgrading. Importing the package also no longer loads these modules at all.
 
 ## Types that described the wrong thing are gone