@bitbaum/chatkit 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cato
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,132 @@
+# chatkit
+
+**One chat for every bitbaum product.** A composer with a microphone that never
+goes dead, a thread that does not fight the reader, answers with Copy and Retry,
+and LLM markdown — the fleet's chat standard as a package, so a fix made once
+reaches every product.
+
+Why it exists: on 2026-09-25 there were 13 chats in 10 repos, each written from
+scratch, each missing something another had already fixed — most often the
+microphone. The person using them found every gap by hand. This package is the
+one place those fixes now live. (Model calls, streaming and transcription stay
+in [`ai-kit`](https://github.com/bitbaum/ai-kit), server-side; chatkit is the
+interface that calls them.)
+
+## Install
+
+```sh
+pnpm add github:bitbaum/chatkit#v0.2.0
+```
+
+`dist/` is committed, so the install needs no build step and no `allowBuilds`
+entry. (npm publishing is set up once the package has its first release there.)
+
+## Use
+
+```tsx
+import { ChatStarters, ChatThread, Composer } from "@bitbaum/chatkit/react";
+import "@bitbaum/chatkit/styles.css";
+
+<ChatThread
+  messages={messages}               // { id, role, content, speaker?, citations?, failed? }
+  live={streaming ? { text: partial } : null}
+  onStop={stop}
+  onRetry={retryLast}
+  empty={<ChatStarters starters={["What can you build for me?"]} onPick={send} />}
+/>
+<Composer
+  onSend={(text, attachments) => send(text, attachments)} // return false to keep the draft
+  placeholder="Ask about any project…"
+  sending={streaming}
+  onStop={stop}
+  voice={{ transcribeUrl: "/api/transcribe" }}
+  attach                             // only if your API accepts attachments
+  tools={<ModelPicker />}            // app-specific controls go in slots
+/>
+```
+
+### The microphone
+
+`voice` is on by default. Give it a server leg so it works everywhere:
+
+- `transcribeUrl`: an endpoint taking `multipart/form-data` `{ audio, locale }`
+  and answering `{ text }` — implement it with `ai-kit`'s `transcribe()`.
+- or `transcribe: (audio, locale) => Promise<string>` for a custom call.
+
+The browser's own recogniser is tried first (free, instant). Where it is
+missing, **or accepts `start()` and then says nothing** — Chromium without
+Google's speech service does exactly that — the same press records and the
+server transcribes. The dead recogniser is remembered for 30 days so the next
+press records immediately. Every failure is shown in words (blocked mic,
+nothing heard, not available), never as a button that does nothing.
+`prefer: "server"` skips the browser leg (one model everywhere, language
+detected by the model). `rememberKey: null` stores nothing on the device.
+
+### Screenshots
+
+`attach` takes limits: `attach={{ maxImageEdge: 1024 }}` shrinks a picture in
+the browser to 1024px on its longest edge and re-encodes it as JPEG before it
+is staged, stepping quality down until it fits `maxImageBytes`. A phone
+screenshot (~1290×2796, several MB) goes out at a few hundred KB: cheaper for
+whoever pays for the vision model, and the full-resolution screenshot never
+leaves the device. Off by default (`0`).
+
+Every reason a file did not attach is a label — `labels={{ attachNotes: {
+imageTooLarge: (name, mb) => … } }}` — so it reaches the reader in their
+language.
+
+### Look
+
+Every colour, radius and face is a `--ck-*` variable. They default to
+[`@bitbaum/design-tokens`](https://github.com/bitbaum/design-tokens), so
+OrangeCat, Loki, Solon and bitbaum match with no work. Any other app sets
+`--ck-*` on the chat's container and keeps its own look. What you cannot
+change is the behaviour — that is the point.
+
+### Language
+
+Every visible word is a label: `labels={{ send: "Senden", dictation: {...} }}`
+on `Composer`, `labels` on `ChatThread`.
+
+## The standard (what this package guarantees)
+
+1. A microphone in the composer, with the server fallback above.
+2. 16px text in the input and the messages (below that iOS zooms the page).
+3. A composer that belongs to the conversation: auto-growing textarea, Enter
+   sends, Shift+Enter breaks the line, IME composition respected, 44px targets,
+   usable above the phone keyboard (`useViewportHeight`).
+4. Stop in the send slot while a turn is in flight.
+5. A failed turn shows as a failure with Retry — never silence.
+6. Scroll follows new tokens only while the reader is at the bottom, with a
+   jump-down button otherwise.
+7. Markdown rendered, never as HTML; `javascript:` links stay text; Copy on
+   every answer.
+8. Starters in the empty state; the speaker's name on every answer once more
+   than one agent speaks.
+9. Nothing overflows at 320–390px.
+
+`pnpm run verify` proves all of it: unit and render tests, then
+`test/browser.mjs` drives Chromium through the demo at desktop and 390px, light
+and dark, and speaks into a fake microphone past a silent recogniser.
+
+## Improving it — here, never in your app
+
+When a chat in any product has a bug or is missing something, **fix it in this
+repo**, add the check that would have caught it, bump the version, and let the
+products pick the release up. A local patch in one app is how the fleet got 13
+different chats. If your app needs something truly its own, it goes in a slot
+(`tools`, `header`, `footer`, `renderFooter`, `renderLink`) — ask for a new slot
+here rather than forking the component.
+
+Release: bump `version` in `package.json`, merge, then
+`git tag v<version> origin/main && git push origin v<version>`.
+
+## Develop
+
+```sh
+pnpm install
+pnpm run demo        # builds demo/dist; open demo/index.html
+pnpm run verify      # everything CI runs
+```
+
+MIT © Cato

package/dist/attachments.d.ts

@@ -0,0 +1,72 @@
+/**
+ * What a composer can attach, and the wire shape an app's API receives.
+ *
+ * From loki `lib/loki/attachments.ts`. The limits are defaults, not law — an
+ * app passes its own to `useAttachments` when its model or API differs.
+ */
+export type TextAttachment = {
+    kind: "text";
+    name: string;
+    content: string;
+};
+export type ImageAttachment = {
+    kind: "image";
+    name: string;
+    mimeType: string;
+    dataBase64: string;
+};
+export type Attachment = TextAttachment | ImageAttachment;
+/** Client-only preview URL — never sent to the API. */
+export type StagedAttachment = Attachment & {
+    previewUrl?: string;
+};
+export type AttachmentLimits = {
+    /** Files per message. */
+    maxFiles: number;
+    /** Characters per text file (it is inlined into a prompt). */
+    maxTextChars: number;
+    /** Raw image bytes before base64 — checked AFTER any downscale. */
+    maxImageBytes: number;
+    /**
+     * Longest edge, in pixels, an image is shrunk to in the browser before it is
+     * staged. 0 = send the original. A phone screenshot is ~1290×2796 and several
+     * megabytes; vision models bill by tile and read a chat bubble just as well
+     * at 1024px, so shrinking first is cheaper for the reader AND means the full
+     * screenshot never leaves the device. Shrunk images are re-encoded as JPEG
+     * (a screenshot re-encoded as PNG is often larger), stepping quality down
+     * until they fit `maxImageBytes`. From heidi `downscale.ts`.
+     */
+    maxImageEdge: number;
+};
+export declare const DEFAULT_ATTACHMENT_LIMITS: AttachmentLimits;
+/** Why a file did not attach — every one a label, so an app can say it in its
+ *  reader's language. */
+export type AttachmentNotes = {
+    wrongType: (name: string) => string;
+    imageTooLarge: (name: string, maxMb: number) => string;
+    textTooLarge: (name: string, maxThousandChars: number) => string;
+    unreadable: (name: string) => string;
+    tooMany: (max: number) => string;
+};
+export declare const DEFAULT_ATTACHMENT_NOTES: AttachmentNotes;
+/**
+ * The size an image is drawn at to fit `maxEdge` on its longest side. Never
+ * enlarges; 0 (or less) means "leave it". Pure, so it is tested without a DOM.
+ */
+export declare function fitWithin(width: number, height: number, maxEdge: number): {
+    width: number;
+    height: number;
+    scaled: boolean;
+};
+/** Bytes a base64 data URL decodes to — close enough to compare to a limit. */
+export declare function dataUrlBytes(dataUrl: string): number;
+export declare function isImageMime(mime: string): boolean;
+/** `data:image/png;base64,AAAA` → `AAAA`: FileReader hands back a data URL,
+ *  the wire carries raw base64. */
+export declare function stripDataUrlBase64(dataUrl: string): string;
+/** Identity for dedupe and removal: the same name and bytes are the same
+ *  attachment however they arrived (picker, paste, drop). */
+export declare function attachmentKey(a: Attachment): string;
+/** Strip client-only fields: what the API validates. */
+export declare function toWire(staged: StagedAttachment[]): Attachment[];
+//# sourceMappingURL=attachments.d.ts.map

package/dist/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,CAAC;AAE1D,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,gBAKvC,CAAC;AAEF;yBACyB;AACzB,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;CAClC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,eAMtC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CASpD;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;mCACmC;AACnC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;6DAC6D;AAC7D,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAInD;AAED,wDAAwD;AACxD,wBAAgB,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,EAAE,CAM/D"}

package/dist/attachments.js

@@ -0,0 +1,64 @@
+/**
+ * What a composer can attach, and the wire shape an app's API receives.
+ *
+ * From loki `lib/loki/attachments.ts`. The limits are defaults, not law — an
+ * app passes its own to `useAttachments` when its model or API differs.
+ */
+export const DEFAULT_ATTACHMENT_LIMITS = {
+    maxFiles: 5,
+    maxTextChars: 100_000,
+    maxImageBytes: 2_800_000,
+    maxImageEdge: 0,
+};
+export const DEFAULT_ATTACHMENT_NOTES = {
+    wrongType: (name) => `${name}: use PNG, JPEG, GIF or WebP.`,
+    imageTooLarge: (name, maxMb) => `${name} is too large (max ${maxMb} MB).`,
+    textTooLarge: (name, k) => `${name} is too large (max ${k}k characters).`,
+    unreadable: (name) => `Could not read ${name}.`,
+    tooMany: (max) => `Up to ${max} files.`,
+};
+/**
+ * The size an image is drawn at to fit `maxEdge` on its longest side. Never
+ * enlarges; 0 (or less) means "leave it". Pure, so it is tested without a DOM.
+ */
+export function fitWithin(width, height, maxEdge) {
+    const longest = Math.max(width, height);
+    if (maxEdge <= 0 || longest <= maxEdge)
+        return { width, height, scaled: false };
+    const scale = maxEdge / longest;
+    return {
+        width: Math.max(1, Math.round(width * scale)),
+        height: Math.max(1, Math.round(height * scale)),
+        scaled: true,
+    };
+}
+/** Bytes a base64 data URL decodes to — close enough to compare to a limit. */
+export function dataUrlBytes(dataUrl) {
+    return Math.floor(stripDataUrlBase64(dataUrl).length * 0.75);
+}
+const IMAGE_MIME = /^image\/(jpeg|jpg|png|gif|webp)$/i;
+export function isImageMime(mime) {
+    return IMAGE_MIME.test(mime);
+}
+/** `data:image/png;base64,AAAA` → `AAAA`: FileReader hands back a data URL,
+ *  the wire carries raw base64. */
+export function stripDataUrlBase64(dataUrl) {
+    const i = dataUrl.indexOf(",");
+    return i >= 0 ? dataUrl.slice(i + 1) : dataUrl;
+}
+/** Identity for dedupe and removal: the same name and bytes are the same
+ *  attachment however they arrived (picker, paste, drop). */
+export function attachmentKey(a) {
+    return a.kind === "image"
+        ? `image:${a.name}:${a.dataBase64.length}`
+        : `text:${a.name}:${a.content.length}`;
+}
+/** Strip client-only fields: what the API validates. */
+export function toWire(staged) {
+    return staged.map((a) => {
+        const { previewUrl: _preview, ...rest } = a;
+        void _preview;
+        return rest;
+    });
+}
+//# sourceMappingURL=attachments.js.map

package/dist/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiCH,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,QAAQ,EAAE,CAAC;IACX,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,SAAS;IACxB,YAAY,EAAE,CAAC;CAChB,CAAC;AAYF,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,+BAA+B;IAC3D,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,sBAAsB,KAAK,OAAO;IACzE,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,sBAAsB,CAAC,gBAAgB;IACzE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,IAAI,GAAG;IAC/C,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,GAAG,SAAS;CACxC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,KAAa,EACb,MAAc,EACd,OAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IAChC,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC7C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;QAC/C,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,mCAAmC,CAAC;AAEvD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;mCACmC;AACnC,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACjD,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,aAAa,CAAC,CAAa;IACzC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO;QACvB,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE;QAC1C,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,MAAM,CAAC,MAA0B;IAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5C,KAAK,QAAQ,CAAC;QACd,OAAO,IAAkB,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/composer.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The composer's decisions, kept out of the component so they can be tested
+ * without a DOM — and so every app that uses the one composer gets exactly the
+ * same answer to "may this send?" and "does the draft survive?".
+ *
+ * From loki `src/components/composer/composer-logic.ts`, where these were
+ * written after four composers in one app gave four different answers.
+ */
+/** A destination the same words can go to (e.g. Ask vs Inject). */
+export type ComposerMode = {
+    id: string;
+    label: string;
+    hint?: string;
+};
+/** `false` keeps the draft (the send failed or was refused); anything else
+ *  clears it. A failed send must be retryable from the same box, not retyped. */
+export type ComposerSendResult = void | boolean;
+export declare function composerCanSend({ text, attachmentCount, attachmentOnlyText, sending, disabled, blocked, }: {
+    text: string;
+    attachmentCount: number;
+    attachmentOnlyText?: string;
+    sending: boolean;
+    disabled: boolean;
+    blocked: boolean;
+}): boolean;
+/** The words actually sent: the draft, or the app's stand-in for an
+ *  attachments-only send. */
+export declare function composerOutgoingText(text: string, attachmentCount: number, attachmentOnlyText?: string): string;
+export declare function shouldClearDraft(result: ComposerSendResult): boolean;
+/** Dictated words join the draft with one space, never glued to the last word. */
+export declare function appendTranscript(draft: string, said: string): string;
+/** `75` → `1:15`. The recording timer. */
+export declare function formatElapsed(seconds: number): string;
+//# sourceMappingURL=composer.d.ts.map

package/dist/composer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../src/composer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;iFACiF;AACjF,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC;AAEhD,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,eAAe,EACf,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,OAAO,GACR,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAMV;AAED;6BAC6B;AAC7B,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,EACvB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,MAAM,CAIR;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAEpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrD"}

package/dist/composer.js

@@ -0,0 +1,41 @@
+/**
+ * The composer's decisions, kept out of the component so they can be tested
+ * without a DOM — and so every app that uses the one composer gets exactly the
+ * same answer to "may this send?" and "does the draft survive?".
+ *
+ * From loki `src/components/composer/composer-logic.ts`, where these were
+ * written after four composers in one app gave four different answers.
+ */
+export function composerCanSend({ text, attachmentCount, attachmentOnlyText, sending, disabled, blocked, }) {
+    if (sending || disabled || blocked)
+        return false;
+    if (text.trim().length > 0)
+        return true;
+    // A screenshot with no words is still a complete message — but only where
+    // the app has said what that message means.
+    return attachmentCount > 0 && Boolean(attachmentOnlyText);
+}
+/** The words actually sent: the draft, or the app's stand-in for an
+ *  attachments-only send. */
+export function composerOutgoingText(text, attachmentCount, attachmentOnlyText) {
+    const trimmed = text.trim();
+    if (trimmed)
+        return trimmed;
+    return attachmentCount > 0 && attachmentOnlyText ? attachmentOnlyText : "";
+}
+export function shouldClearDraft(result) {
+    return result !== false;
+}
+/** Dictated words join the draft with one space, never glued to the last word. */
+export function appendTranscript(draft, said) {
+    const t = said.trim();
+    if (!t)
+        return draft;
+    return draft.trim() ? `${draft.replace(/\s+$/, "")} ${t}` : t;
+}
+/** `75` → `1:15`. The recording timer. */
+export function formatElapsed(seconds) {
+    const s = Math.max(0, Math.floor(seconds));
+    return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")}`;
+}
+//# sourceMappingURL=composer.js.map

package/dist/composer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.js","sourceRoot":"","sources":["../src/composer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,UAAU,eAAe,CAAC,EAC9B,IAAI,EACJ,eAAe,EACf,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,OAAO,GAQR;IACC,IAAI,OAAO,IAAI,QAAQ,IAAI,OAAO;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,0EAA0E;IAC1E,4CAA4C;IAC5C,OAAO,eAAe,GAAG,CAAC,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED;6BAC6B;AAC7B,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,eAAuB,EACvB,kBAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,eAAe,GAAG,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,OAAO,MAAM,KAAK,KAAK,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,IAAY;IAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACpE,CAAC"}

package/dist/dictation.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The decisions behind the microphone, without the microphone.
+ *
+ * The shape comes from heidi (`app/[locale]/_components/use-dictation.ts`),
+ * which is the only chat in the fleet whose mic never goes dead:
+ *
+ * - The browser's recogniser is FAST (free, instant, nothing uploaded) but
+ *   sometimes a lie: Chromium builds without Google's speech service accept
+ *   `start()` and then never fire an event — measured on heidi's live site
+ *   2026-09-12, nine seconds, zero events. So the recogniser is never the only
+ *   path. Missing or silent, the same button RECORDS and a server transcribes.
+ * - Every failure becomes one of three words the person can act on — the mic
+ *   (permission, hardware), silence (nothing heard), unavailable (nothing here
+ *   can do it) — never a button that does nothing and says nothing.
+ *
+ * Kept pure so "never forever" and "which failures the fallback rescues" are
+ * tested properties rather than behaviour buried in a timeout.
+ */
+/** Why a dictation produced no text, in terms the person can act on. */
+export type DictationProblem = "mic" | "silence" | "unavailable";
+/** Which path to try first. `browser` is free and instant; `server` is one
+ *  model everywhere (and detects the language by itself). Either falls back to
+ *  the other when it cannot work. */
+export type DictationPreference = "browser" | "server";
+/**
+ * Which recogniser failures the fallback can rescue: only "unavailable" — the
+ * recogniser cannot do this (no speech service, network refused, language
+ * unsupported) and recording locally does not care. "mic" is the person's
+ * hardware or a permission they denied; "silence" is whether they spoke.
+ * Recording again would tell them the same thing twice.
+ */
+export declare function fallbackCanRescue(problem: DictationProblem | null): boolean;
+/** Web Speech `error` codes → the three words. Anything unknown is
+ *  `unavailable`, never nothing: a control that fails silently looks broken. */
+export declare function problemFor(error: string | undefined): DictationProblem | null;
+/** getUserMedia / MediaRecorder failures → the same three words, so the UI
+ *  never grows a second vocabulary for the same situations. */
+export declare function problemForRecording(error: unknown): DictationProblem;
+/** A working recogniser fires `start` well inside this once the mic is allowed. */
+export declare const START_TIMEOUT_MS = 4000;
+/**
+ * How long a pending permission may hold off the fallback. The wait is right —
+ * someone reading a permission dialog has not failed — but it must be BOUNDED:
+ * `permissions.query` says "prompt" both while a dialog is open and when none
+ * will ever appear (heidi, 2026-09-12: twenty-two seconds, nothing).
+ */
+export declare const PERMISSION_WAIT_MS = 10000;
+export declare function mayKeepWaitingForPermission(elapsedMs: number, permissionPending: boolean): boolean;
+/** A browser whose recogniser proved dead is remembered for this long, so the
+ *  person does not rediscover it on every press — and not forever, because a
+ *  browser can gain the capability. */
+export declare const DEAD_RECOGNISER_TTL_MS: number;
+export declare function deadRecogniserStillTrusted(rememberedAt: number | null, now?: number): boolean;
+/** Recording is capped so a forgotten mic does not run for an hour. */
+export declare const MAX_RECORDING_MS = 120000;
+/** Candidate containers for MediaRecorder, best first. */
+export declare const RECORDING_MIME_CANDIDATES: readonly ["audio/webm;codecs=opus", "audio/webm", "audio/mp4", "audio/ogg"];
+/** The default words for each problem. Override per app (and per language). */
+export declare const DEFAULT_DICTATION_MESSAGES: Record<DictationProblem, string>;
+//# sourceMappingURL=dictation.d.ts.map

package/dist/dictation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dictation.d.ts","sourceRoot":"","sources":["../src/dictation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,aAAa,CAAC;AAEjE;;qCAEqC;AACrC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEvD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAE3E;AAED;gFACgF;AAChF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,IAAI,CAa7E;AAED;+DAC+D;AAC/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAKpE;AAED,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,OAAO,GACzB,OAAO,CAET;AAED;;uCAEuC;AACvC,eAAO,MAAM,sBAAsB,QAA2B,CAAC;AAE/D,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,SAAa,GAAG,OAAO,CAKjG;AAED,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,SAAU,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,6EAK5B,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAIvE,CAAC"}

package/dist/dictation.js

@@ -0,0 +1,93 @@
+/**
+ * The decisions behind the microphone, without the microphone.
+ *
+ * The shape comes from heidi (`app/[locale]/_components/use-dictation.ts`),
+ * which is the only chat in the fleet whose mic never goes dead:
+ *
+ * - The browser's recogniser is FAST (free, instant, nothing uploaded) but
+ *   sometimes a lie: Chromium builds without Google's speech service accept
+ *   `start()` and then never fire an event — measured on heidi's live site
+ *   2026-09-12, nine seconds, zero events. So the recogniser is never the only
+ *   path. Missing or silent, the same button RECORDS and a server transcribes.
+ * - Every failure becomes one of three words the person can act on — the mic
+ *   (permission, hardware), silence (nothing heard), unavailable (nothing here
+ *   can do it) — never a button that does nothing and says nothing.
+ *
+ * Kept pure so "never forever" and "which failures the fallback rescues" are
+ * tested properties rather than behaviour buried in a timeout.
+ */
+/**
+ * Which recogniser failures the fallback can rescue: only "unavailable" — the
+ * recogniser cannot do this (no speech service, network refused, language
+ * unsupported) and recording locally does not care. "mic" is the person's
+ * hardware or a permission they denied; "silence" is whether they spoke.
+ * Recording again would tell them the same thing twice.
+ */
+export function fallbackCanRescue(problem) {
+    return problem === "unavailable";
+}
+/** Web Speech `error` codes → the three words. Anything unknown is
+ *  `unavailable`, never nothing: a control that fails silently looks broken. */
+export function problemFor(error) {
+    switch (error) {
+        case "aborted":
+            return null;
+        case "not-allowed":
+        case "service-not-allowed":
+        case "audio-capture":
+            return "mic";
+        case "no-speech":
+            return "silence";
+        default:
+            return "unavailable";
+    }
+}
+/** getUserMedia / MediaRecorder failures → the same three words, so the UI
+ *  never grows a second vocabulary for the same situations. */
+export function problemForRecording(error) {
+    const name = error?.name ?? "";
+    if (name === "NotAllowedError" || name === "SecurityError")
+        return "mic";
+    if (name === "NotFoundError" || name === "NotReadableError")
+        return "mic";
+    return "unavailable";
+}
+/** A working recogniser fires `start` well inside this once the mic is allowed. */
+export const START_TIMEOUT_MS = 4000;
+/**
+ * How long a pending permission may hold off the fallback. The wait is right —
+ * someone reading a permission dialog has not failed — but it must be BOUNDED:
+ * `permissions.query` says "prompt" both while a dialog is open and when none
+ * will ever appear (heidi, 2026-09-12: twenty-two seconds, nothing).
+ */
+export const PERMISSION_WAIT_MS = 10_000;
+export function mayKeepWaitingForPermission(elapsedMs, permissionPending) {
+    return permissionPending && elapsedMs < PERMISSION_WAIT_MS;
+}
+/** A browser whose recogniser proved dead is remembered for this long, so the
+ *  person does not rediscover it on every press — and not forever, because a
+ *  browser can gain the capability. */
+export const DEAD_RECOGNISER_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export function deadRecogniserStillTrusted(rememberedAt, now = Date.now()) {
+    if (rememberedAt === null || !Number.isFinite(rememberedAt))
+        return false;
+    const age = now - rememberedAt;
+    // A timestamp from the future is a clock change, not a verdict.
+    return age >= 0 && age < DEAD_RECOGNISER_TTL_MS;
+}
+/** Recording is capped so a forgotten mic does not run for an hour. */
+export const MAX_RECORDING_MS = 120_000;
+/** Candidate containers for MediaRecorder, best first. */
+export const RECORDING_MIME_CANDIDATES = [
+    "audio/webm;codecs=opus",
+    "audio/webm",
+    "audio/mp4",
+    "audio/ogg",
+];
+/** The default words for each problem. Override per app (and per language). */
+export const DEFAULT_DICTATION_MESSAGES = {
+    mic: "The microphone is blocked. Allow it for this site and try again.",
+    silence: "Nothing was heard. Try again, a little closer to the mic.",
+    unavailable: "Voice input is not available right now. Type instead, or try again later.",
+};
+//# sourceMappingURL=dictation.js.map

package/dist/dictation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dictation.js","sourceRoot":"","sources":["../src/dictation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAUH;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgC;IAChE,OAAO,OAAO,KAAK,aAAa,CAAC;AACnC,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,aAAa,CAAC;QACnB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,eAAe;YAClB,OAAO,KAAK,CAAC;QACf,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAED;+DAC+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,IAAI,GAAI,KAAkC,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7D,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,iBAA0B;IAE1B,OAAO,iBAAiB,IAAI,SAAS,GAAG,kBAAkB,CAAC;AAC7D,CAAC;AAED;;uCAEuC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D,MAAM,UAAU,0BAA0B,CAAC,YAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtF,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,GAAG,GAAG,GAAG,GAAG,YAAY,CAAC;IAC/B,gEAAgE;IAChE,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,sBAAsB,CAAC;AAClD,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAExC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,wBAAwB;IACxB,YAAY;IACZ,WAAW;IACX,WAAW;CACH,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAqC;IAC1E,GAAG,EAAE,kEAAkE;IACvE,OAAO,EAAE,2DAA2D;IACpE,WAAW,EAAE,2EAA2E;CACzF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @bitbaum/chatkit — the framework-free half. Every decision a chat makes,
+ * testable without a DOM. The React components live in `@bitbaum/chatkit/react`,
+ * the look in `@bitbaum/chatkit/styles.css`.
+ */
+export * from "./composer.js";
+export * from "./dictation.js";
+export * from "./markdown.js";
+export * from "./scroll.js";
+export * from "./attachments.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * @bitbaum/chatkit — the framework-free half. Every decision a chat makes,
+ * testable without a DOM. The React components live in `@bitbaum/chatkit/react`,
+ * the look in `@bitbaum/chatkit/styles.css`.
+ */
+export * from "./composer.js";
+export * from "./dictation.js";
+export * from "./markdown.js";
+export * from "./scroll.js";
+export * from "./attachments.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC"}

package/dist/markdown.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The markdown an LLM actually writes, parsed into blocks and inline spans —
+ * no dependency, no HTML string, nothing to sanitise because nothing is ever
+ * rendered as HTML.
+ *
+ * From loki's `MarkdownText`, the one renderer in the fleet that four repos
+ * did NOT have: those rendered model output with the literal `**` still in it.
+ * Supports what answers use — paragraphs, bullet and numbered lists, headings,
+ * **bold**, *italic*, `code`, fenced code, [links](url) and `[F1]` citation
+ * handles — and deliberately nothing else.
+ */
+export type MarkdownBlock = {
+    kind: "p";
+    text: string;
+} | {
+    kind: "h";
+    text: string;
+} | {
+    kind: "ul";
+    items: string[];
+} | {
+    kind: "ol";
+    items: string[];
+} | {
+    kind: "code";
+    lang: string;
+    code: string;
+} | {
+    kind: "quote";
+    text: string;
+};
+export declare function parseBlocks(text: string): MarkdownBlock[];
+export type InlineSpan = {
+    kind: "text";
+    text: string;
+} | {
+    kind: "code";
+    text: string;
+} | {
+    kind: "strong";
+    text: string;
+    children: InlineSpan[];
+} | {
+    kind: "em";
+    text: string;
+    children: InlineSpan[];
+} | {
+    kind: "link";
+    text: string;
+    href: string;
+} | {
+    kind: "cite";
+    ids: string[];
+};
+export declare function parseInline(text: string): InlineSpan[];
+/**
+ * Only http(s), mailto and same-site paths become links. A `javascript:` URL in
+ * model output is text, never a link — the answer is written by a model that
+ * may have read a hostile page.
+ */
+export declare function safeHref(href: string): string | null;
+/** A same-site path navigates in place; anything else opens a new tab. */
+export declare function isInternalHref(href: string): boolean;
+//# sourceMappingURL=markdown.d.ts.map