@chatcops/server 0.4.0 → 0.6.0

package/README.md

@@ -25,7 +25,7 @@ app.all('/chat', chatcopsMiddleware({
     apiKey: process.env.ANTHROPIC_API_KEY,
   },
   systemPrompt: 'You are a helpful assistant for our website.',
-  cors: '*',
+  allowedOrigins: ['*'],
 }));
 
 app.listen(3001);
@@ -39,7 +39,7 @@ import { chatcopsVercelHandler } from '@chatcops/server';
 const handler = chatcopsVercelHandler({
   provider: { type: 'openai', apiKey: process.env.OPENAI_API_KEY },
   systemPrompt: 'You are a helpful assistant.',
-  cors: '*',
+  allowedOrigins: ['*'],
 });
 
 export const POST = (req: Request) => handler(req);
@@ -57,7 +57,7 @@ function getHandler(env: Env) {
   handler ??= chatcopsCloudflareHandler({
     provider: { type: 'claude', apiKey: env.ANTHROPIC_API_KEY },
     systemPrompt: 'You are a helpful assistant.',
-    cors: '*',
+    allowedOrigins: ['*'],
   });
   return handler;
 }
@@ -80,7 +80,7 @@ const handler = createChatHandler({
   provider: {
     type: 'claude',          // 'claude' | 'openai' | 'gemini'
     apiKey: 'sk-...',
-    model: 'claude-haiku-4-5-20251001',
+    model: 'claude-haiku-5-5',
   },
 
   // System prompt (required)
@@ -115,7 +115,7 @@ const handler = createChatHandler({
   conversationStore: new RedisConversationStore(redisClient),
 
   // CORS origin (optional, default: '*')
-  cors: '*',
+  allowedOrigins: ['*'],
 });
 ```
 
@@ -153,7 +153,7 @@ const result = limiter.check('127.0.0.1');
 
 ## Webhooks
 
-HMAC-SHA256 signed, with exponential backoff retries (up to 3 attempts).
+HMAC-SHA256 signed, with retries (up to 3 attempts).
 
 ```typescript
 import { WebhookDispatcher } from '@chatcops/server';
@@ -165,7 +165,15 @@ const dispatcher = new WebhookDispatcher([
 await dispatcher.dispatch('lead:captured', { email: 'user@example.com' });
 ```
 
-Signature sent via `X-ChatCops-Signature` header.
+Each delivery carries `X-ChatCops-Signature: t=<seconds>,v1=<hmac>`, signed over the raw body. Check it on the receiving side with `verifyWebhook`:
+
+```typescript
+import { verifyWebhook } from '@chatcops/server';
+
+const valid = await verifyWebhook({ body: rawBody, signature: request.headers.get('X-ChatCops-Signature'), secret: 'my-secret' });
+```
+
+The body is `{ id, type, created, data }`; `id` stays the same across retries. 429 and 5xx responses are retried, redirects aren't followed, and URLs must be https on a public host unless the webhook sets `allowPrivateNetwork: true`. See the server setup docs for the full format.
 
 ## Custom Conversation Store
 
@@ -202,6 +210,26 @@ const handler = createChatHandler({
 });
 ```
 
+## Custom integrations
+
+`createChatHandler(config)` returns `handleChat(body, clientIp, options)`, an async generator of SSE `data` payloads. The built-in adapters use it; call it directly for other runtimes. Pass `options.signal` and abort it when the visitor disconnects: the provider request is cancelled, nothing more is yielded, and the partial reply isn't saved.
+
+```typescript
+const abort = new AbortController();
+const stream = new ReadableStream({
+  async start(controller) {
+    for await (const chunk of handler.handleChat(body, clientIp, { signal: abort.signal })) {
+      if (abort.signal.aborted) break;
+      controller.enqueue(new TextEncoder().encode(`data: ${chunk}\n\n`));
+    }
+    if (!abort.signal.aborted) controller.close();
+  },
+  cancel() {
+    abort.abort(); // the runtime cancels the response when the client goes away
+  },
+});
+```
+
 ## License
 
 MIT

package/dist/adapters/ai-sdk.d.ts

@@ -0,0 +1,12 @@
+import type { ChatCopsServerConfig } from '../config.js';
+/**
+ * A Fetch API handler that `useChat` from the AI SDK can talk to: it reads
+ * the AI SDK's request and answers in its UI message stream. Use it as a
+ * Next.js route handler or anywhere that takes `(request) => Response`.
+ *
+ * The server keeps the conversation (keyed by the chat `id`) and reads only
+ * the last user message, unlike AI SDK routes that take the whole history
+ * from the client.
+ */
+export declare function chatcopsAiSdkHandler(config: ChatCopsServerConfig): (req: Request) => Promise<Response>;
+//# sourceMappingURL=ai-sdk.d.ts.map

package/dist/adapters/ai-sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-sdk.d.ts","sourceRoot":"","sources":["../../src/adapters/ai-sdk.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,IAIvC,KAAK,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAMzD"}

package/dist/adapters/ai-sdk.js

@@ -0,0 +1,27 @@
+import { cloudflareClientIp, fetchClientIp } from '../client-ip.js';
+import { createChatHandler } from '../handler.js';
+import { fetchChatResponse } from '../http.js';
+import { originPolicy } from '../security/origin-policy.js';
+/**
+ * A Fetch API handler that `useChat` from the AI SDK can talk to: it reads
+ * the AI SDK's request and answers in its UI message stream. Use it as a
+ * Next.js route handler or anywhere that takes `(request) => Response`.
+ *
+ * The server keeps the conversation (keyed by the chat `id`) and reads only
+ * the last user message, unlike AI SDK routes that take the whole history
+ * from the client.
+ */
+export function chatcopsAiSdkHandler(config) {
+    const chat = createChatHandler(config);
+    const origins = originPolicy(config);
+    return function handler(req) {
+        return fetchChatResponse(chat, origins, req, {
+            clientIp: (request) => (onWorkers() ? cloudflareClientIp(request, config.clientIp) : fetchClientIp(request, config.clientIp)),
+            aiSdk: true,
+        });
+    };
+}
+function onWorkers() {
+    return globalThis.navigator?.userAgent === 'Cloudflare-Workers';
+}
+//# sourceMappingURL=ai-sdk.js.map

package/dist/adapters/ai-sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-sdk.js","sourceRoot":"","sources":["../../src/adapters/ai-sdk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAErC,OAAO,SAAS,OAAO,CAAC,GAAY;QAClC,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;YAC3C,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7H,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAQ,UAAqD,CAAC,SAAS,EAAE,SAAS,KAAK,oBAAoB,CAAC;AAC9G,CAAC"}

package/dist/adapters/cloudflare.d.ts

@@ -1,3 +1,5 @@
 import type { ChatCopsServerConfig } from '../config.js';
-export declare function chatcopsCloudflareHandler(config: ChatCopsServerConfig): (request: Request) => Promise<Response>;
+export declare function chatcopsCloudflareHandler(config: ChatCopsServerConfig): (request: Request, _env?: unknown, ctx?: {
+    waitUntil?(promise: Promise<unknown>): void;
+}) => Promise<Response>;
 //# sourceMappingURL=cloudflare.d.ts.map

package/dist/adapters/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/adapters/cloudflare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,oBAAoB,IActC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmDnE"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/adapters/cloudflare.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,oBAAoB,IAOlE,SAAS,OAAO,EAChB,OAAO,OAAO,EACd,MAAM;IAAE,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;CAAE,KACpD,OAAO,CAAC,QAAQ,CAAC,CAMrB"}

package/dist/adapters/cloudflare.js

@@ -1,63 +1,16 @@
+import { cloudflareClientIp } from '../client-ip.js';
 import { createChatHandler } from '../handler.js';
+import { fetchChatResponse } from '../http.js';
+import { originPolicy } from '../security/origin-policy.js';
 export function chatcopsCloudflareHandler(config) {
-    const { handleChat } = createChatHandler(config);
-    const corsOrigin = config.cors ?? '*';
-    function errorResponse(status, error) {
-        return new Response(JSON.stringify({ error }), {
-            status,
-            headers: {
-                'Content-Type': 'application/json',
-                'Access-Control-Allow-Origin': corsOrigin,
-            },
-        });
-    }
-    return async function handler(request) {
-        // Handle CORS preflight
-        if (request.method === 'OPTIONS') {
-            return new Response(null, {
-                status: 204,
-                headers: {
-                    'Access-Control-Allow-Origin': corsOrigin,
-                    'Access-Control-Allow-Methods': 'POST, OPTIONS',
-                    'Access-Control-Allow-Headers': 'Content-Type',
-                    'Access-Control-Max-Age': '86400',
-                },
-            });
-        }
-        if (request.method !== 'POST') {
-            return errorResponse(405, 'Method not allowed');
-        }
-        const clientIp = request.headers.get('cf-connecting-ip') ?? 'unknown';
-        let body;
-        try {
-            body = await request.json();
-        }
-        catch {
-            return errorResponse(400, 'Invalid JSON body');
-        }
-        const { readable, writable } = new TransformStream();
-        const writer = writable.getWriter();
-        const encoder = new TextEncoder();
-        (async () => {
-            try {
-                for await (const chunk of handleChat(body, clientIp)) {
-                    await writer.write(encoder.encode(`data: ${chunk}\n\n`));
-                }
-                await writer.write(encoder.encode('data: [DONE]\n\n'));
-            }
-            catch {
-                await writer.write(encoder.encode(`data: ${JSON.stringify({ error: 'internal_error' })}\n\n`));
-            }
-            finally {
-                await writer.close();
-            }
-        })();
-        return new Response(readable, {
-            headers: {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                'Access-Control-Allow-Origin': corsOrigin,
-            },
+    const chat = createChatHandler(config);
+    const origins = originPolicy(config);
+    // Workers call fetch(request, env, ctx); ctx.waitUntil keeps lead webhooks
+    // running after a visitor disconnects.
+    return function handler(request, _env, ctx) {
+        return fetchChatResponse(chat, origins, request, {
+            clientIp: (req) => cloudflareClientIp(req, config.clientIp),
+            ...(ctx?.waitUntil ? { waitUntil: (promise) => ctx.waitUntil?.(promise) } : {}),
         });
     };
 }

package/dist/adapters/cloudflare.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/adapters/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,UAAU,yBAAyB,CAAC,MAA4B;IACpE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAEtC,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;QAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YAC7C,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,6BAA6B,EAAE,UAAU;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAC,OAAgB;QAC5C,wBAAwB;QACxB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,6BAA6B,EAAE,UAAU;oBACzC,8BAA8B,EAAE,eAAe;oBAC/C,8BAA8B,EAAE,cAAc;oBAC9C,wBAAwB,EAAE,OAAO;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QACtE,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAElC,CAAC,KAAK,IAAI,EAAE;YACV,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACrD,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACjG,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE;YAC5B,OAAO,EAAE;gBACP,cAAc,EAAE,mBAAmB;gBACnC,eAAe,EAAE,UAAU;gBAC3B,6BAA6B,EAAE,UAAU;aAC1C;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/adapters/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,MAAM,UAAU,yBAAyB,CAAC,MAA4B;IACpE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAErC,2EAA2E;IAC3E,uCAAuC;IACvC,OAAO,SAAS,OAAO,CACrB,OAAgB,EAChB,IAAc,EACd,GAAqD;QAErD,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;YAC/C,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC3D,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAyB,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/express.d.ts

@@ -1,5 +1,9 @@
 import type { Request, Response, NextFunction } from 'express';
 import type { ChatCopsServerConfig } from '../config.js';
-export declare function chatcopsMiddleware(config: ChatCopsServerConfig): (req: Request, res: Response, next: NextFunction) => Promise<void>;
-export declare function chatcopsAnalyticsHandler(config: ChatCopsServerConfig): (_req: Request, res: Response) => void;
+export declare function chatcopsMiddleware(config: ChatCopsServerConfig): (req: Request, res: Response, _next: NextFunction) => Promise<void>;
+/**
+ * Analytics stats as JSON. With a storage that has an event sink, they cover
+ * every instance, for `?from=` and `?to=` (milliseconds) or the last 30 days.
+ */
+export declare function chatcopsAnalyticsHandler(config: ChatCopsServerConfig): (req: Request, res: Response) => Promise<void>;
 //# sourceMappingURL=express.d.ts.map

package/dist/adapters/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAezD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,IASvB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkCtF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,IAE3D,MAAM,OAAO,EAAE,KAAK,QAAQ,UAGrC"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAezD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,IAIvB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,OAAO,YAAY,mBAuEvF;AAaD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,IAIrD,KAAK,OAAO,EAAE,KAAK,QAAQ,mBA8B1C"}

package/dist/adapters/express.js

@@ -1,4 +1,8 @@
+import { errorBody } from '@chatcops/core';
+import { expressClientIp } from '../client-ip.js';
 import { createChatHandler } from '../handler.js';
+import { PROTOCOL_HEADER, chatReply, isSessionPath } from '../http.js';
+import { originPolicy } from '../security/origin-policy.js';
 const chatHandlers = new WeakMap();
 function getOrCreateChatHandler(config) {
     let handler = chatHandlers.get(config);
@@ -9,49 +13,128 @@ function getOrCreateChatHandler(config) {
     return handler;
 }
 export function chatcopsMiddleware(config) {
-    const { handleChat } = getOrCreateChatHandler(config);
-    const corsOrigin = config.cors ?? '*';
-    function sendError(res, status, error) {
-        res.setHeader('Access-Control-Allow-Origin', corsOrigin);
-        res.status(status).json({ error });
-    }
-    return async function chatcopsHandler(req, res, next) {
+    const chat = getOrCreateChatHandler(config);
+    const origins = originPolicy(config);
+    return async function chatcopsHandler(req, res, _next) {
+        const header = req.headers?.origin;
+        const origin = typeof header === 'string' ? header : null;
+        const setHeaders = (headers) => {
+            for (const [name, value] of Object.entries(headers))
+                res.setHeader(name, value);
+        };
+        const sendError = (status, error) => {
+            setHeaders(origins.headers(origin));
+            res.status(status).json({ error });
+        };
         // Handle CORS preflight
         if (req.method === 'OPTIONS') {
-            res.setHeader('Access-Control-Allow-Origin', corsOrigin);
-            res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-            res.setHeader('Access-Control-Max-Age', '86400');
+            setHeaders(origins.preflightHeaders(origin));
             res.status(204).end();
             return;
         }
         if (req.method !== 'POST') {
-            sendError(res, 405, 'Method not allowed');
+            sendError(405, 'Method not allowed');
             return;
         }
-        const clientIp = req.ip ?? req.socket.remoteAddress ?? 'unknown';
-        res.setHeader('Content-Type', 'text/event-stream');
-        res.setHeader('Cache-Control', 'no-cache');
-        res.setHeader('Connection', 'keep-alive');
-        res.setHeader('Access-Control-Allow-Origin', corsOrigin);
-        try {
-            for await (const chunk of handleChat(req.body, clientIp)) {
-                res.write(`data: ${chunk}\n\n`);
+        if (!origins.allows(origin)) {
+            sendError(403, 'origin_not_allowed');
+            return;
+        }
+        // `app.use('/api/chat', chatcopsMiddleware(...))` sends /api/chat/session here too.
+        if (isSessionPath(req.path ?? '')) {
+            setHeaders(origins.headers(origin));
+            if (!chat.startSession) {
+                res.status(404).json(errorBody('invalid_request', { message: 'Session tokens are off. Set `sessionSecrets` to turn them on.' }));
+                return;
             }
-            res.write('data: [DONE]\n\n');
+            const reply = await chat.startSession(req.body, origin, expressClientIp(req));
+            res.status(reply.status).json(reply.body);
+            return;
         }
-        catch (err) {
-            res.write(`data: ${JSON.stringify({ error: 'internal_error' })}\n\n`);
+        const clientIp = expressClientIp(req);
+        // Stop the reply when the visitor goes away before it's done.
+        const abort = new AbortController();
+        res.on('close', () => {
+            if (!res.writableFinished)
+                abort.abort();
+        });
+        const protocolHeader = req.headers?.[PROTOCOL_HEADER];
+        const authorization = req.headers?.authorization;
+        const reply = await chatReply(chat, req.body, clientIp, {
+            signal: abort.signal,
+            protocolHeader: typeof protocolHeader === 'string' ? protocolHeader : null,
+            authorization: typeof authorization === 'string' ? authorization : null,
+            origin,
+        });
+        if (reply.kind === 'json') {
+            setHeaders({ ...origins.headers(origin), ...reply.headers });
+            res.status(reply.status).json(reply.body);
+            return;
+        }
+        setHeaders({ ...reply.headers, ...origins.headers(origin) });
+        try {
+            for await (const frame of reply.frames) {
+                if (abort.signal.aborted)
+                    break;
+                res.write(frame);
+            }
         }
         finally {
             res.end();
         }
     };
 }
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let mismatch = 0;
+    for (let i = 0; i < a.length; i++) {
+        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+/**
+ * Analytics stats as JSON. With a storage that has an event sink, they cover
+ * every instance, for `?from=` and `?to=` (milliseconds) or the last 30 days.
+ */
 export function chatcopsAnalyticsHandler(config) {
-    const { getAnalytics } = getOrCreateChatHandler(config);
-    return (_req, res) => {
-        res.json(getAnalytics());
+    const { analyticsStats } = getOrCreateChatHandler(config);
+    let warned = false;
+    return async (req, res) => {
+        if (config.analyticsToken) {
+            const auth = req.headers?.authorization;
+            const token = typeof auth === 'string' && auth.startsWith('Bearer ') ? auth.slice(7) : undefined;
+            if (!token || !constantTimeEqual(token, config.analyticsToken)) {
+                res.setHeader('WWW-Authenticate', 'Bearer');
+                res.status(401).json({ error: 'unauthorized' });
+                return;
+            }
+        }
+        else if (!warned) {
+            warned = true;
+            console.warn('[chatcops] The analytics endpoint is public and anyone can read your stats. Set `analyticsToken` in your ChatCopsServerConfig to require a bearer token.');
+        }
+        const from = timeParam(req.query?.from);
+        const to = timeParam(req.query?.to);
+        if (from === null || to === null) {
+            res.status(400).json({ error: 'invalid_range' });
+            return;
+        }
+        try {
+            res.json(await analyticsStats({ from, to }));
+        }
+        catch (err) {
+            console.error('[chatcops] Reading analytics failed:', err instanceof Error ? err.message : String(err));
+            res.status(500).json({ error: 'internal_error' });
+        }
     };
 }
+/** A `from` or `to` query value: unset, a time in milliseconds, or `null` when it isn't one. */
+function timeParam(value) {
+    if (value === undefined)
+        return undefined;
+    const time = typeof value === 'string' && value.trim() !== '' ? Number(value) : Number.NaN;
+    return Number.isFinite(time) ? time : null;
+}
 //# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAKlD,MAAM,YAAY,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEtE,SAAS,sBAAsB,CAAC,MAA4B;IAC1D,IAAI,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACpC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAEtC,SAAS,SAAS,CAAC,GAAa,EAAE,MAAc,EAAE,KAAa;QAC7D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACnF,wBAAwB;QACxB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;YACzD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAEjE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;QAEzD,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,MAAM,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAK5D,MAAM,YAAY,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEtE,SAAS,sBAAsB,CAAC,MAA4B;IAC1D,IAAI,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACpC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAErC,OAAO,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,KAAmB;QACpF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,UAAU,GAAG,CAAC,OAA+B,EAAE,EAAE;YACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,EAAE;YAClD,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC;QAEF,wBAAwB;QACxB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,oFAAoF;QACpF,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAClC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC,CAAC;gBACjI,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAEtC,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,GAAG,CAAC,gBAAgB;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE;YACtD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;YAC1E,aAAa,EAAE,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YACvE,MAAM;SACP,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,UAAU,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM;gBAChC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,MAAM,EAAE,cAAc,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3C,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEjG,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,CAAC,IAAI,CACV,0JAA0J,CAC3J,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC3F,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/dist/adapters/index.d.ts

@@ -1,4 +1,5 @@
 export { chatcopsMiddleware, chatcopsAnalyticsHandler } from './express.js';
 export { chatcopsVercelHandler } from './vercel.js';
 export { chatcopsCloudflareHandler } from './cloudflare.js';
+export { chatcopsAiSdkHandler } from './ai-sdk.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/adapters/index.js

@@ -1,4 +1,5 @@
 export { chatcopsMiddleware, chatcopsAnalyticsHandler } from './express.js';
 export { chatcopsVercelHandler } from './vercel.js';
 export { chatcopsCloudflareHandler } from './cloudflare.js';
+export { chatcopsAiSdkHandler } from './ai-sdk.js';
 //# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/adapters/vercel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,IAclC,KAAK,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmD/D"}
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,IAIxC,KAAK,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAGzD"}

package/dist/adapters/vercel.js

@@ -1,65 +1,12 @@
+import { fetchClientIp } from '../client-ip.js';
 import { createChatHandler } from '../handler.js';
+import { fetchChatResponse } from '../http.js';
+import { originPolicy } from '../security/origin-policy.js';
 export function chatcopsVercelHandler(config) {
-    const { handleChat } = createChatHandler(config);
-    const corsOrigin = config.cors ?? '*';
-    function errorResponse(status, error) {
-        return new Response(JSON.stringify({ error }), {
-            status,
-            headers: {
-                'Content-Type': 'application/json',
-                'Access-Control-Allow-Origin': corsOrigin,
-            },
-        });
-    }
-    return async function handler(req) {
-        // Handle CORS preflight
-        if (req.method === 'OPTIONS') {
-            return new Response(null, {
-                status: 204,
-                headers: {
-                    'Access-Control-Allow-Origin': corsOrigin,
-                    'Access-Control-Allow-Methods': 'POST, OPTIONS',
-                    'Access-Control-Allow-Headers': 'Content-Type',
-                    'Access-Control-Max-Age': '86400',
-                },
-            });
-        }
-        if (req.method !== 'POST') {
-            return errorResponse(405, 'Method not allowed');
-        }
-        const clientIp = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
-        let body;
-        try {
-            body = await req.json();
-        }
-        catch {
-            return errorResponse(400, 'Invalid JSON body');
-        }
-        const encoder = new TextEncoder();
-        const stream = new ReadableStream({
-            async start(controller) {
-                try {
-                    for await (const chunk of handleChat(body, clientIp)) {
-                        controller.enqueue(encoder.encode(`data: ${chunk}\n\n`));
-                    }
-                    controller.enqueue(encoder.encode('data: [DONE]\n\n'));
-                }
-                catch {
-                    controller.enqueue(encoder.encode(`data: ${JSON.stringify({ error: 'internal_error' })}\n\n`));
-                }
-                finally {
-                    controller.close();
-                }
-            },
-        });
-        return new Response(stream, {
-            headers: {
-                'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
-                'Connection': 'keep-alive',
-                'Access-Control-Allow-Origin': corsOrigin,
-            },
-        });
+    const chat = createChatHandler(config);
+    const origins = originPolicy(config);
+    return function handler(req) {
+        return fetchChatResponse(chat, origins, req, { clientIp: (request) => fetchClientIp(request, config.clientIp) });
     };
 }
 //# sourceMappingURL=vercel.js.map

package/dist/adapters/vercel.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,UAAU,qBAAqB,CAAC,MAA4B;IAChE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAEtC,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;QAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YAC7C,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,6BAA6B,EAAE,UAAU;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAC,GAAY;QACxC,wBAAwB;QACxB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,6BAA6B,EAAE,UAAU;oBACzC,8BAA8B,EAAE,eAAe;oBAC/C,8BAA8B,EAAE,cAAc;oBAC9C,wBAAwB,EAAE,OAAO;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACxF,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,KAAK,CAAC,KAAK,CAAC,UAAU;gBACpB,IAAI,CAAC;oBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;wBACrD,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC;oBAC3D,CAAC;oBACD,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACzD,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjG,CAAC;wBAAS,CAAC;oBACT,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAC1B,OAAO,EAAE;gBACP,cAAc,EAAE,mBAAmB;gBACnC,eAAe,EAAE,UAAU;gBAC3B,YAAY,EAAE,YAAY;gBAC1B,6BAA6B,EAAE,UAAU;aAC1C;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,MAAM,UAAU,qBAAqB,CAAC,MAA4B;IAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAErC,OAAO,SAAS,OAAO,CAAC,GAAY;QAClC,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC"}

package/dist/client-ip.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The visitor's IP, for per-IP rate limits and budgets. Only headers a
+ * platform sets itself are read, never ones a visitor can send. When the IP
+ * can't be told, per-IP limits are skipped for that request (with one
+ * warning) instead of every visitor sharing one bucket.
+ */
+/** Reads the visitor's IP from a request, for hosts the adapter doesn't know. */
+export type ClientIpResolver = (request: Request) => string | null | undefined;
+export declare function cleanIp(value: string | null | undefined): string | undefined;
+/** Vercel overwrites these headers, so a visitor can't set them there. */
+export declare function onVercel(): boolean;
+export declare function warnOnce(key: string, message: string): void;
+/** For tests. */
+export declare function resetClientIpWarnings(): void;
+/** The fetch handler for Vercel and other Fetch API runtimes. */
+export declare function fetchClientIp(request: Request, resolver: ClientIpResolver | undefined): string | undefined;
+/** Cloudflare sets CF-Connecting-IP on every request that reaches a Worker. */
+export declare function cloudflareClientIp(request: Request, resolver: ClientIpResolver | undefined): string | undefined;
+interface ExpressLikeRequest {
+    ip?: string;
+    socket?: {
+        remoteAddress?: string;
+    };
+    headers?: Record<string, string | string[] | undefined>;
+    app?: {
+        get?(setting: string): unknown;
+    };
+}
+/**
+ * Express's `req.ip` follows its `trust proxy` setting. Behind a proxy with
+ * that setting off, every visitor gets the proxy's address and shares one
+ * rate limit and budget, so that case gets a warning.
+ */
+export declare function expressClientIp(req: ExpressLikeRequest): string | undefined;
+export {};
+//# sourceMappingURL=client-ip.d.ts.map

package/dist/client-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.d.ts","sourceRoot":"","sources":["../src/client-ip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAQ/E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG5E;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAID,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAI3D;AAED,iBAAiB;AACjB,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW1G;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAO/G;AAED,UAAU,kBAAkB;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAQ3E"}